Skip to content

Istio hardening

Monitoring configures Istio resources through the bb-common subchart. Package values live under bb-common.istio; umbrella overrides belong under monitoring.values.bb-common.istio.

Enable Istio and the sidecar egress policy to restrict sidecar traffic to registered services. Strict mTLS also requires the certificate and scrape configuration described in Istio mTLS metrics.

bb-common:
  istio:
    enabled: true
    mtls:
      mode: STRICT
    sidecar:
      enabled: true
      outboundTrafficPolicyMode: REGISTRY_ONLY
    authorizationPolicies:
      enabled: true
      generateFromNetpol: true

Ambient mode uses bb-common.istio.ambient.enabled: true and does not render a Sidecar resource. The Big Bang umbrella supplies mesh mode and certificate wiring for monitoring.

Custom ServiceEntries

Register external endpoints through serviceEntries.custom. NetworkPolicies must also permit the connection.

bb-common:
  istio:
    serviceEntries:
      custom:
        - name: allow-google
          spec:
            hosts:
              - google.com
            location: MESH_EXTERNAL
            ports:
              - number: 443
                protocol: TLS
                name: https
            resolution: DNS

Custom AuthorizationPolicies

With authorization policies enabled, bb-common generates default policies and can derive allow policies from supported ingress NetworkPolicy rules. Add application-specific policies with authorizationPolicies.custom:

bb-common:
  istio:
    authorizationPolicies:
      custom:
        - name: allow-my-namespace
          spec:
            selector:
              matchLabels:
                app.kubernetes.io/name: prometheus
            action: ALLOW
            rules:
              - from:
                  - source:
                      namespaces:
                        - my-namespace

See the subchart migration notices for moved values and legacy umbrella compatibility.