About this scenario
The payments namespace runs api inside the Istio mesh. Security wants it to accept mutual TLS only, with a PeerAuthentication in STRICT mode. Today it runs in the default PERMISSIVE mode and takes plain text too.
Two clients call http://api.payments:8080: web in shop and nightly in reports. Both work now. Applying STRICT as things stand would break both, each for a different reason.
Find the two reasons, fix them, then lock the namespace down. Test a client with kubectl exec -n reports deploy/nightly -- curl -s -m 5 http://api.payments:8080.
Objectives
- See which Pods have a sidecar and which namespaces inject one
- nightly in reports runs with a sidecar
- No DestinationRule turns client TLS off for api.payments
- payments accepts only mutual TLS: a Pod without a sidecar is refused
- web and nightly still reach api
What you'll practice
- Mutual TLS in Istio has a client half and a server half. Auto mTLS makes a sidecar send mutual TLS to destinations that have a proxy; a
PeerAuthentication decides what the server accepts. PERMISSIVE takes mutual TLS and plain text, STRICT only mutual TLS. The narrowest policy wins: workload, then namespace, then the mesh-wide one in istio-system.- A client without a sidecar sends plain text. Under STRICT its connection is reset and curl exits with code 56. Label its namespace for injection and restart the workload before you lock down.
- A DestinationRule with
tls.mode: DISABLE overrides auto mTLS for its host. The client then gets a 503 from its own sidecar once the server goes STRICT. - Go namespace by namespace, and keep
PERMISSIVE as the quick way back.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Helm, Flux, Argo CD, Kyverno, Cilium, Istio) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.