Enforce network policy for Istio

    Value

    Calico network policy for Istio lets you enforce application layer attributes like HTTP methods or paths, and cryptographically secure identities for Istio-enabled apps.

    The Calico support for Istio service mesh has the following benefits:

    • Pod traffic controls

      Lets you restrict ingress traffic inside and outside pods and mitigate common threats to Istio-enabled apps.

    • Supports security goals

      Enables adoption of a zero trust network model for security, including traffic encryption, multiple enforcement points, and multiple identity criteria for authentication.

    • Familiar policy language

      Kubernetes network policies and Calico network policies work as is; users do not need to learn another network policy model to adopt Istio.

    See Enforce network policy using Istio tutorial to learn how application layer policy provides second-factor authentication for the mythical Yao Bank.

    Before you begin

    Istio support

    Following Istio versions have been verified to work with application layer policies:

    • Istio v1.10.2
    • Istio v1.9.6

    Istio v1.7.x and lower are not supported.

    Although we expect future minor versions to work with the corresponding manifest below (for example, v1.9.7 or v1.10.3), manifest compatibility depends entirely on the upstream changes in the respective Istio release.

    1. Enable application layer policy
    3. Install Istio
    5. Add Calico authorization services to the mesh

    Enable application layer policy

    To enable the application layer policy, you must enable the Policy Sync API on Felix cluster-wide.

    In the default FelixConfiguration, set the field, to /var/run/nodeagent:

    Additionally, if you have installed Calico via the operator, you can optionally disable flexvolumes. Flexvolumes were used in earlier implementations and have since been deprecated.

    1. kubectl patch installation default --type=merge -p '{"spec": {"flexVolumePath": "None"}}'

    Calico utilizes a Container Storage Interface (CSI) driver to help set up the policy sync API on every node. Apply the following to install the Calico CSI driver

    1. kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.24.5/manifests/csi-driver.yaml

    Install Istio

    1. Verify .
    2. Install Istio using installation guide in the project documentation.

    Next, create the following policy.

    1. kubectl create -f - <<EOF
    3. kind: PeerAuthentication
    4.   name: default-strict-mode
    5.   namespace: istio-system
    6. spec:
    7.   mtls:
    9. EOF

    The sidecar injector automatically modifies pods as they are created to work with Istio. This step modifies the injector configuration to add Dikastes (a Calico component), as sidecar containers.

    1. Follow the to install the sidecar injector and enable it in your chosen namespace(s).
    2. Patch the istio-sidecar-injector ConfigMap to enable injection of Dikastes alongside Envoy.
    • Istio v1.10.x
    • Istio v1.9.x
    1. curl https://raw.githubusercontent.com/projectcalico/calico/v3.24.5/manifests/alp/istio-inject-configmap-1.10.yaml -o istio-inject-configmap.yaml
    2. kubectl patch configmap -n istio-system istio-sidecar-injector --patch "$(cat istio-inject-configmap.yaml)"

    View sample manifest

    Add Calico authorization services to the mesh

    Apply the following manifest to configure Istio to query Calico for application layer policy authorization decisions.

    This applies to Istio v1.10.x and v1.9.x:

    1. kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.24.5/manifests/alp/istio-app-layer-policy-envoy-v3.yaml

    You can control enforcement of application layer policy on a per-namespace basis. However, this only works on pods that are started with the Envoy and Calico Dikastes sidecars (as noted in the step, Update Istio sidecar injector). Pods that do not have the Calico sidecars, enforce only standard Calico network policy.

    To enable Istio and application layer policy in a namespace, add the label istio-injection=enabled.

    If the namespace already has pods in it, you must recreate them for this to take effect.

    Envoy must be able to communicate with the istio-pilot.istio-system service. If you apply any egress policies to your pods, you must enable access.

    Above and beyond