Skip to main content
logoTetrate Istio SubscriptionVersion: Next

TIS0503 - Mesh-Wide DestinationRule Disabling mTLS is Missing

A mesh-wide DestinationRule disabling mTLS is missing.

Recommendation: Ensure Correct DestinationRule and PeerAuthentication for mTLS

To prevent unintended secure communication, either add a mesh-wide DestinationRule to disable mTLS or update the mesh-wide PeerAuthentication to STRICT or PERMISSIVE mode, ensuring proper connectivity across the mesh.

Examples​

  1. No Mesh-Wide DestinationRule Configured to Disable mTLS

    # No mesh-wide `DestinationRule` disabling mTLS is present in the mesh configuration

    Explanation: Without a mesh-wide DestinationRule explicitly disabling mTLS, services in the mesh may inadvertently attempt to use mTLS for communication. This can cause connectivity issues if the workloads are not prepared for secure communication.

Recommendation​

Change the mesh-wide DestinationRule to DISABLE mode or update the PeerAuthentication to allow mTLS in STRICT or PERMISSIVE mode.

  1. Add Mesh-Wide DestinationRule to Disable mTLS

    Create a DestinationRule in the istio-system namespace that applies to all services in the mesh, disabling mTLS.

    apiVersion: networking.istio.io/v1beta1
    kind: DestinationRule
    metadata:
      name: mesh-disable-mtls
      namespace: istio-system
    spec:
      host: "*.cluster.local"
      trafficPolicy:
        tls:
          mode: DISABLE

    Explanation: This DestinationRule ensures that mTLS is disabled for all services within the mesh, allowing them to communicate in plaintext when mTLS is not required.

  2. Update PeerAuthentication to Allow mTLS

    If the intention is to support both mTLS and plaintext communication, update the mesh-wide PeerAuthentication to use PERMISSIVE mode.

    apiVersion: security.istio.io/v1beta1
    kind: PeerAuthentication
    metadata:
      name: mesh-permissive-peer-auth
      namespace: istio-system
    spec:
      mtls:
        mode: PERMISSIVE

    Explanation: Setting the PeerAuthentication mode to PERMISSIVE allows services to accept both mTLS and plaintext connections, enabling more flexibility depending on client capabilities.