Istio mesh security

See routing and TLS behavior for the workload contract. This chart uses bb-common for shared mesh resources and adds workload-selected PeerAuthentications for Elasticsearch, Kibana, and the exporter. The umbrella owns mesh enablement, namespace enrollment, gateways, and legacy hardening-key migration; do not configure new overrides using deprecated istio.hardened or istio.kibana paths.

Package entry points

Package mesh controls live under istio; in umbrella v1 configuration they are under packages.elasticsearchKibana.values.istio. Relevant parent entry points are mtls, sidecar, authorizationPolicies, and serviceEntries. Follow the bb-common reference for the locked library’s schema rather than reproducing generic policy templates.

istio.sidecar.enabled creates an outbound registry restriction, not proxy injection. In sidecar mode, REGISTRY_ONLY requires registering external IdP or snapshot hosts through routes.outbound or custom ServiceEntries. NetworkPolicy egress permission is still required. Ambient enrollment and waypoint behavior are platform concerns; sidecar restrictions do not prove ambient reachability.

When enabled, authorization-policy generation uses supported ingress network-policy inputs plus shared defaults and custom policies. Validate the actual workload and gateway selectors before adding ALLOW rules; a generated policy is not evidence that a deployed request succeeds.

Elastic transport exception

Port 9300 uses Elastic transport TLS and is excluded from sidecar interception; the Elasticsearch-specific PeerAuthentication makes it PERMISSIVE when the package mode is STRICT. Elasticsearch HTTP port 9200 is also made PERMISSIVE when its inbound route is enabled, while the CR retains ECK HTTP TLS. Kibana’s ECK HTTP TLS is disabled when package Istio is enabled. Do not remove these distinctions or disable TLS verification as a workaround. Review operator-to-workload, collector, gateway, and monitoring traffic in the selected mesh mode.