TCA Analysis

Tetrate Config Analyzers (TCA) performs various configuration checks to ensure the proper setup and functioning of your Istio service mesh. This document describes in detail the validations that TIS Plus performs with examples of recommended configurations.

Following are the analysis checks TCA performs:

TIS00 - General Configurations

• TIS0001 - Multiple configuration objects within the same namespace
• TIS0002 - Multiple configuration objects applied to the same workload
• TIS0003 - No workload matches the specified selector in this namespace
• TIS0004 - Namespace for Configuration Export is Inaccessible or Does Not Exist
• TIS0005 - Root CA certificate is invalid or has expired

TIS01 - Basic Resource Issues

• TIS0101 - Specified Namespace Cannot Be Found
• TIS0102 - Invalid HTTP Method or gRPC Name
• TIS0103 - Specified Host Not Found in Service Registry
• TIS0104 - Mutual TLS (mTLS) is Required for This Field
• TIS0105 - Specified Service Account Cannot Be Found for Principal

TIS02 - DestinationRule and PeerAuthentication

• TIS0201 - Multiple DestinationRule Objects for Same Host-Subset Combination
• TIS0202 - Specified Host Not Found in Service Registry
• TIS0203 - No Matching Labels Found for Subset in Any Host
• TIS0204 - Mutual TLS (mTLS) Settings Overridden by Non-Local DestinationRule
• TIS0205 - Missing PeerAuthentication for Mesh-Level mTLS
• TIS0206 - Missing PeerAuthentication for Namespace-Wide mTLS
• TIS0207 - PeerAuthentication with STRICT Mode Found, Should Be PERMISSIVE
• TIS0208 - PeerAuthentication Enabling mTLS Found, Permissive Mode Needed
• TIS0209 - Subset Lacks Labels

TIS03 - Gateway Issues

• TIS0301 - Multiple Gateways for Same Host-Port Combination
• TIS0302 - No Workload Matches Gateway Selector in Namespace
• TIS0303 - Duplicate Certificates in Multiple Gateways
• TIS0304 - Gateway Server Credentials Not Found
• TIS0305 - Gateway Server Credentials is Invalid

TIS04 - Mesh-Wide DestinationRule

• TIS0401 - Mesh-Wide DestinationRule Enabling mTLS is Missing

TIS05 - Namespace-Wide and Mesh-Wide DestinationRule

• TIS0501 - Namespace-Wide DestinationRule Enabling mTLS is Missing
• TIS0502 - Namespace-Wide DestinationRule Disabling mTLS is Missing
• TIS0503 - Mesh-Wide DestinationRule Disabling mTLS is Missing

TIS06 - Port Configuration

• TIS0601 - Port Name Must Follow the 'protocol'[-suffix] Format
• TIS0602 - Port appProtocol Must Follow the 'protocol'[-suffix] Format

TIS07 - Deployment and Service Issues

• TIS0701 - Deployment Exposing the Same Port as the Service Not Found

TIS08 - EnvoyFilter Operations

• TIS0801 - ADD Operation Ignored for applyTo Set to ROUTE_CONFIGURATION or HTTP_ROUTE
• TIS0802 - REMOVE Operation Ignored for applyTo Set to ROUTE_CONFIGURATION or HTTP_ROUTE
• TIS0803 - REPLACE Operation Only Valid for HTTP_FILTER and NETWORK_FILTER
• TIS0804 - MeshConfig Telemetry Configuration Detected

TIS09 - Telemetry Issues

• TIS0901 - Telemetry with Empty Providers Not Valid Without Default Providers
• TIS0902 - Using tracing configuration in MeshConfig is not recommended

TIS10 - Service Registry and Sidecar Issues

• TIS1001 - Specified Host Not Found in Service Registry
• TIS1002 - Global Default Sidecar Should Not Have a workloadSelector
• TIS1003 - OutboundTrafficPolicy with Empty Mode Value Is Ambiguous

TIS11 - VirtualService and Route Issues

• TIS1101 - DestinationWeight on Route Does Not Have a Valid Service
• TIS1102 - VirtualService Points to Non-Existent Gateway
• TIS1103 - Weight Assumed as 100 for a Single Route Destination
• TIS1104 - Host Subset Combination Already Referenced in Another Route Destination
• TIS1105 - More than One VirtualService Exists for the Same Host
• TIS1106 - Subset Not Found
• TIS1107 - Preferred Gateway Nomenclature
• TIS1108 - JWT Claim Based Routing Without RequestAuthentication
• TIS1109 - Protocol Mismatch Between Gateway and VirtualService

TIS12 - WorkloadEntry Issues

• TIS1201 - Missing Addresses from Matching WorkloadEntries

TIS13 - Authorization Policy Issues

• TIS1301 - Workload Not Covered by Any Authorization Policy

TIS14 - HTTPRoute Issues

• TIS1401 - HTTPRoute Points to a Non-Existent Kubernetes Gateway
• TIS1402 - Reference Does Not Have a Valid Service (Service Name Not Found)

TIS15 - Kubernetes Gateway Issues

• TIS1501 - More Than One Kubernetes Gateway Exists for the Same Host-Port Combination
• TIS1502 - More Than One Kubernetes Gateway Exists for the Same Address and Type Combination
• TIS1503 - Listener Must Have a Unique Combination of Hostname, Port, and Protocol
• TIS1504 - Gateway API Class Not Found in Configuration

TIS16 - Namespace Issues

• TIS1601 - Specified Namespace Not Found or Inaccessible

TIS17 - FIPS Compliance

• TIS1701 - The compliance policy is either missing, invalid, or not set to enforce FIPS 140-2 requirements
• TIS1702 - The gateway’s TLS configuration (version or cipher suites) does not comply with strict FIPS 140-2 requirements
• TIS1703 - The image is not FIPS compliant