Hands-On Microservices with Kubernetes

Authenticating users with Istio

Istio authentication is based on policies. There are two kinds of policies: namespace policies and mesh policies. A namespace policy applies to a single namespace. A mesh policy applies to the entire cluster. There can be only one mesh policy with a kind of MeshPolicy and it must be named default. Here is an example of a mesh policy that requires all services to use mTLS:

apiVersion: "authentication.istio.io/v1alpha1" kind: "MeshPolicy" metadata:   name: "default" spec:   peers:   - mtls: {}

Namespace policies have a kind of Policy. If you don't specify a namespace, then it will apply to the default namespace. There can be only one policy per namespace and it must be called default too. The following policy uses ...