Istio Prelim 1.8
Docs Blog News FAQ About
English 中文
Light Theme Dark Theme
Color Examples
Edit this Page on GitHub Report Site Bugs
Other versions of this site
Current Release Older Releases
  • What is Istio?
  • Traffic Management
  • Security
  • Observability
  • Extensibility
  • Getting Started
  • Platform Setup
    • Alibaba Cloud
    • Azure
    • Docker Desktop
    • Google Kubernetes Engine
    • IBM Cloud
    • kind
    • Kops
    • Kubernetes Gardener
    • KubeSphere Container Platform
    • MicroK8s
    • Minikube
    • OpenShift
    • Oracle Cloud Infrastructure
  • Install
    • Install with Istioctl
    • Istio Operator Install
    • Install with Helm
    • Virtual Machine Installation
    • Install Multicluster
      • Before you begin
      • Install Multi-Primary
      • Install Primary-Remote
      • Install Multi-Primary on different networks
      • Install Primary-Remote on different networks
      • Verify the installation
  • Upgrade
    • Canary Upgrades
    • In-place Upgrades
    • Managing Gateways with Multiple Revisions [experimental]
  • More Guides
    • Installation Configuration Profiles
    • Installing the Sidecar
    • Install Istio with the Istio CNI plugin
  • Traffic Management
    • Request Routing
    • Fault Injection
    • Traffic Shifting
    • TCP Traffic Shifting
    • Request Timeouts
    • Circuit Breaking
    • Mirroring
    • Ingress
      • Ingress Gateways
      • Ingress (Kubernetes)
      • Secure Gateways
      • Ingress Gateway without TLS Termination
    • Egress
      • Accessing External Services
      • Egress TLS Origination
      • Egress Gateways
      • Egress Gateways with TLS Origination (File Mount)
      • Egress Gateways with TLS Origination (SDS)
      • Egress using Wildcard Hosts
      • Kubernetes Services for Egress Traffic
      • Using an External HTTPS Proxy
  • Security
    • Certificate Management
      • Plug in CA Certificates
      • Istio DNS Certificate Management
    • Authentication
      • Authentication Policy
      • Mutual TLS Migration
    • Authorization
      • Authorization for HTTP traffic
      • Authorization for TCP traffic
      • Authorization with JWT
      • Authorization policies with a deny action
      • Authorization on Ingress Gateway
      • Authorization Policy Trust Domain Migration
  • Observability
    • Metrics
      • Collecting Metrics for TCP Services
      • Customizing Istio Metrics
      • Classifying Metrics Based on Request or Response (Experimental)
      • Querying Metrics from Prometheus
      • Visualizing Metrics with Grafana
    • Logs
      • Getting Envoy's Access Logs
    • Distributed Tracing
      • Overview
      • Jaeger
      • Zipkin
      • Lightstep
      • Configurability (Beta/Development)
    • Visualizing Your Mesh
    • Remotely Accessing Telemetry Addons
  • Bookinfo Application
  • Virtual Machines
    • Example Application using Virtual Machines in a Single Network Mesh
    • Virtual Machines in Multi-Network Meshes
    • Bookinfo with a Virtual Machine
  • Learn Microservices using Kubernetes and Istio
    • Prerequisites
    • Setup a Kubernetes Cluster
    • Setup a Local Computer
    • Run a Microservice Locally
    • Run ratings in Docker
    • Run Bookinfo with Kubernetes
    • Test in production
    • Add a new version of reviews
    • Enable Istio on productpage
    • Enable Istio on all the microservices
    • Configure Istio Ingress Gateway
    • Monitoring with Istio
  • Deployment
    • Architecture
    • Deployment Models
    • Performance and Scalability
    • Pods and Services
  • Configuration
    • Mesh Configuration
      • Dynamic Admission Webhooks Overview
      • Wait for Resource Status to Apply Configuration
      • Automatic Sidecar Injection
      • Health Checking of Istio Services
    • Traffic Management
      • Protocol Selection
      • Locality Load Balancing
      • TLS Configuration
      • Configuring Gateway Network Topology [experimental]
    • Security
      • Harden Docker Container Images
      • Extending Self-Signed Certificate Lifetime
    • Observability
      • Monitoring Multicluster Istio with Prometheus
      • Envoy Statistics
  • Best Practices
    • Deployment Best Practices
    • Traffic Management Best Practices
    • Security Best Practices
    • Observability Best Practices
  • Common Problems
    • Traffic Management Problems
    • Security Problems
    • Observability Problems
    • Sidecar Injection Problems
    • Configuration Validation Problems
  • Diagnostic Tools
    • Using the Istioctl Command-line Tool
    • Debugging Envoy and Istiod
    • Understand your Mesh with Istioctl Describe
    • Diagnose your Configuration with Istioctl Analyze
    • Istiod Introspection
    • Component Logging
  • Integrations
    • cert-manager
    • Grafana
    • Jaeger
    • Kiali
    • Prometheus
    • Zipkin
  • Configuration
    • IstioOperator Options
    • Global Mesh Options
    • Analysis Messages
    • Configuration Status Field
    • Proxy Extensions
      • Stackdriver Config
      • AttributeGen Config
      • AccessLogPolicy Config
      • Metadata Exchange Config
      • Stats Config
      • Wasm-based Telemetry (Experimental)
    • Traffic Management
      • Workload Entry
      • Virtual Service
      • Sidecar
      • Workload Group
      • Destination Rule
      • Envoy Filter
      • Gateway
      • Service Entry
    • Security
      • JWTRule
      • RequestAuthentication
      • PeerAuthentication
      • Authorization Policy
      • Authorization Policy Conditions
    • Istio Standard Metrics
    • Resource Annotations
    • Configuration Analysis Messages
      • Analyzer Message Format
      • UnknownAnnotation
      • ConflictingMeshGatewayVirtualServiceHosts
      • ConflictingSidecarWorkloadSelectors
      • Deprecated
      • GatewayPortNotOnWorkload
      • InternalError
      • IstioProxyImageMismatch
      • JwtFailureDueToInvalidServicePortPrefix
      • MTLSPolicyConflict
      • MultipleSidecarsWithoutWorkloadSelectors
      • NamespaceNotInjected
      • PodMissingProxy
      • PortNameIsNotUnderNamingConvention
      • ReferencedResourceNotFound
      • MisplacedAnnotation
      • SchemaValidationError
      • VirtualServiceDestinationPortSelectorRequired
  • Commands
    • istioctl
    • operator
    • pilot-agent
    • pilot-discovery
  • Glossary
  1. Istio
  2. Docs
  3. Reference
  4. Configuration
  5. Security

Security

Describes how to configure Istio's security features.

Authorization Policy

Configuration for access control on workloads.

Authorization Policy Conditions

Describes the supported conditions in authorization policies.

JWTRule

Configuration to validate JWT.

PeerAuthentication

Peer authentication configuration for workloads.

RequestAuthentication

Request authentication configuration for workloads.

Links

    download discuss stack overflow slack twitter
    for everyone

    Istio Preliminary 1.8
    © 2020 Istio Authors, Privacy Policy
    Page last modified: May 27, 2020

    github drive working groups
    for developers