Hands-On Microservices with Kubernetes

Authorizing requests with Istio

Services usually expose multiple endpoints. Service A may be allowed to call only specific endpoints of service B. Service A must first authenticate against service B, and then the specific request must be authorized as well. Istio supports this by extending the role-based access control (RBAC) that Kubernetes uses to authorize requests to its API server.

It's important to note that authorization is turned off by default. To turn it on, you can create a ClusterRbacConfig object. The mode controls how authorization is enabled, as follows:

• OFF means authorization is disabled (the default).
• ON means authorization is enabled for all the services in the entire mesh.
• ON_WITH_INCLUSION means authorization is enabled ...