TIS0105 - Specified Service Account Cannot Be Found for Principal

The specified Service Account cannot be found for this principal.

Recommendation: Ensure Specified Service Accounts Exist and are Correctly Referenced

To ensure policies are effective, make sure that the referenced Service Accounts exist in the specified namespace and are correctly formatted. This prevents misconfigurations that could lead to unintended behavior.

Examples

1. AuthorizationPolicy with Non-Existent Service Account

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: service-account-auth-policy
     namespace: example-namespace
   spec:
     rules:
     - from:
       - source:
           principals: ["cluster.local/ns/example-namespace/sa/non-existent-service-account"]

   Explanation: The AuthorizationPolicy references a Service Account non-existent-service-account in example-namespace, but this Service Account does not exist, making the rule ineffective.

2. PeerAuthentication with Incorrect Service Account Format

   apiVersion: security.istio.io/v1beta1
   kind: PeerAuthentication
   metadata:
     name: incorrect-service-account-peer-auth
     namespace: example-namespace
   spec:
     selector:
       matchLabels:
         app: my-service
     mtls:
       mode: STRICT
     portLevelMtls:
       8080:
         clientCertificate: "/var/run/secrets/kubernetes.io/serviceaccount/non-existent-service-account"

   Explanation: The Service Account specified for the clientCertificate field does not exist or is incorrectly referenced, causing issues with mTLS communication.

Recommendation

Correct the principal to refer to an existing Service Account, ensuring it is in the correct format and free of typographical errors.

1. Specify an Existing Service Account

   Update the principal in the policy to refer to an existing Service Account in the correct format.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: service-account-auth-policy
     namespace: example-namespace
   spec:
     rules:
     - from:
       - source:
           principals: ["cluster.local/ns/example-namespace/sa/existing-service-account"]

2. Create the Missing Service Account

   If the Service Account is intended to exist, create it before applying the policy.

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: non-existent-service-account
     namespace: example-namespace

3. Ensure Correct Service Account Format

   Verify that the Service Account is referenced in the correct format: cluster.local/ns/<namespace>/sa/<service-account-name>.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: service-account-auth-policy
     namespace: example-namespace
   spec:
     rules:
     - from:
       - source:
           principals: ["cluster.local/ns/example-namespace/sa/existing-service-account"]