Configuration examples and field descriptions for Peer Authentication-Alibaba Cloud Service Mesh-阿里云帮助中心

Peer authentication defines whether traffic that reaches a sidecar is tunneled through Transport Layer Security (TLS). This topic provides configuration examples and field descriptions for peer authentication.

Configuration examples

Example 1: Allow all workloads in the foo namespace to use mutual TLS (mTLS)

Note

To apply the policy at the mesh level, set the namespace field to istio-system.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  mtls:
    mode: STRICT

Example 2: Use mTLS or plaintext in the foo namespace, but require mTLS for the finance application

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  mtls:
    mode: PERMISSIVE
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  selector:
    matchLabels:
      app: finance
  mtls:
    mode: STRICT

Example 3: Require mTLS for the finance application in the foo namespace, but require plaintext for port 8080

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  selector:
    matchLabels:
      app: finance
  mtls:
    mode: STRICT
  portLevelMtls:
    8080:
      mode: DISABLE

Example 4: Inherit the configuration from the namespace or mesh level, and then override the configuration for port 8080

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  selector:
    matchLabels:
      app: finance
  mtls:
    mode: UNSET
  portLevelMtls:
    8080:
      mode: DISABLE

Field descriptions

PeerAuthentication

Field	Type	Required	Description
selector	WorkloadSelector	No	Selects the workloads to which this configuration applies based on a set of labels. The search is limited to the namespace of the resource.
mtls	MutualTLS	No	The mTLS settings for the workload. If not configured, the settings are inherited from a broader scope. Note The order of precedence from highest to lowest is: port, workload, namespace, and global.
portLevelMtls	map<uint32, MutualTLS>	No	The port-level mTLS settings. This takes effect only if `WorkloadSelector` is not empty.

PeerAuthentication.MutualTLS

Field	Type	Required	Description
mode	Mode	No	Defines the mTLS mode for peer authentication.

PeerAuthentication.MutualTLS.Mode

Field	Description
UNSET	Inherits the mode from the parent scope. If the parent scope is not configured, the mode defaults to PERMISSIVE. Note The order of precedence from highest to lowest is: port, workload, namespace, and global.
DISABLE	Connections between sidecars use plaintext.
PERMISSIVE	Connections between sidecars can be either plaintext or mTLS encrypted.
STRICT	Connections between sidecars must use mTLS mode. This requires TLS with a client certificate.