In this demonstration, we explore the differences between having no Peer Authentication Policy and enforcing Mutual TLS (mTLS) in an Istio-enabled environment. You will see how applying a STRICT mTLS policy to the default namespace prevents services from unauthorized access by workloads from other namespaces.Documentation Index
Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
Use this file to discover all available pages before exploring further.
Step 1: Cleaning Up the Default Namespace
Before proceeding, remove any existing Bookinfo components from the default namespace. Execute the following cleanup script:Cleaning up the default namespace ensures a clean environment before you apply new configurations.
Step 2: Setting Up the Bar Namespace and Deploying HTTP Bin
Create a separate namespace named “Bar” to deploy the HTTP Bin application. This application will allow you to perform curl requests between namespaces. If Istio auto-injection is disabled in your environment, manually inject the Istio sidecar using this command:Step 3: Testing Connectivity with cURL
With HTTP Bin deployed in the Bar namespace, you can now test connectivity to the product page in the default namespace. Initially, you might encounter an error if the Istio proxy container is still initializing. Once the container is ready, execute the following command:Step 4: Enforcing Mutual TLS with a Peer Authentication Policy
To secure communications, apply a Peer Authentication Policy to enforce STRICT Mutual TLS in the default namespace. This configuration ensures that only workloads with valid mTLS certificates can communicate within the namespace. Apply the policy with the following command:Enforcing STRICT mTLS means that any workload without the proper mTLS configuration will be unable to communicate with services in the default namespace.
Step 5: Verifying Connectivity After Enforcing Mutual TLS
After enforcing STRICT mTLS, test the connectivity from the Bar namespace again by running:Before enforcing STRICT mTLS, ensure that all relevant workloads are properly configured with mTLS to prevent unintended service disruptions.