Hands-On Microservices with Kubernetes

Enforcing policies with Istio

Istio policy enforcement is similar to the way admission controllers work in Kubernetes. Mixer has a set of adapters that are invoked before and after a request is processed. Before we dive in further, it's important to note that policy enforcement is disabled by default. If you install Istio using helm, you can enable it by providing the following flag:

--set global.disablePolicyChecks=false.

On GKE, it is enabled; here is how to check this:

$ kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecksdisablePolicyChecks: false

If the result is disablePolicyChecks: false, then it's already enabled. Otherwise, enable it by editing the Istio ConfigMap and setting it to false.