Istio Security Model Analysis: mTLS, Authentication, Authorization

istiod CA
├── Root Certificate (self-signed or issued by external CA)
├── Intermediate CA Certificate (optional)
└── Workload Certificates (issued to each workload)
    ├── frontend → spiffe://cluster.local/ns/prod/sa/frontend
    ├── reviews → spiffe://cluster.local/ns/prod/sa/reviews
    └── ratings → spiffe://cluster.local/ns/prod/sa/ratings

[1] Pod starts → istio-agent initializes
        │
[2] istio-agent generates RSA 2048 or ECDSA P-256 key pair
        │
[3] Creates CSR including SPIFFE ID
    (spiffe://cluster.local/ns/NAMESPACE/sa/SA_NAME)
        │
[4] Sends CSR to istiod along with Kubernetes ServiceAccount token
        │
[5] istiod validation:
    ├── ServiceAccount token validity (TokenReview API)
    ├── Token namespace/SA matches CSR SPIFFE ID
    └── CSR format validity
        │
[6] istiod CA signs X.509 certificate
    ├── Subject: SPIFFE ID
    ├── SAN (Subject Alternative Name): SPIFFE URI
    ├── Validity: 24 hours (default)
    └── Key Usage: Digital Signature, Key Encipherment
        │
[7] Returns signed certificate + CA chain to istio-agent
        │
[8] istio-agent delivers certificate to Envoy via SDS
        │
[9] Automatic renewal before expiry (around 50% of validity period)

External CA integration methods:
├── 1. Plug-in CA: Mount external CA intermediate cert in istiod
│   └── istiod signs workload certs as intermediate CA
│
├── 2. CSR API: Use Kubernetes CertificateSigningRequest API
│   └── External signer approves/signs Kubernetes CSRs
│
└── 3. Custom CA (istio-csr): cert-manager + Istio CSR Agent
    └── cert-manager issues certs from external CA (Vault, AWS ACM, etc.)

Client Pod (frontend)              Server Pod (reviews)
[App] → [Envoy Proxy]     ←→     [Envoy Proxy] → [App]

1. App sends request to reviews:9080
   (plaintext HTTP, internal to localhost)
        │
2. iptables redirects traffic to Envoy (15001)
        │
3. Envoy checks TLS settings for destination cluster
   (DestinationRule or auto mTLS)
        │
4. TLS handshake begins:
   ├── ClientHello (supported TLS versions, cipher suites)
   ├── ServerHello + Server Certificate
   │   └── reviews presents its SPIFFE certificate
   ├── Client Certificate
   │   └── frontend presents its SPIFFE certificate
   ├── Certificate Verification (bidirectional)
   │   ├── CA chain validation
   │   ├── SPIFFE ID verification
   │   └── Certificate expiry check
   └── Finished (session key exchange complete)
        │
5. HTTP request sent over encrypted channel
        │
6. Server Envoy terminates TLS
        │
7. Forwards as plaintext to App (localhost)

Does the destination have a sidecar?
    │
    ├── Yes → automatically use mTLS
    │   (even without TLS settings in DestinationRule)
    │
    └── No → use plaintext
        (forcing mTLS to sidecar-less services fails)

Priority (highest first):
1. Workload-level (selector specified)
2. Namespace-level (no selector, specific namespace)
3. Mesh-level (istio-system namespace, no selector)

{
  "filter_chains": [
    {
      "filter_chain_match": {},
      "transport_socket": {
        "name": "envoy.transport_sockets.tls",
        "typed_config": {
          "require_client_certificate": true,
          "common_tls_context": {
            "validation_context": {
              "trusted_ca": "CA certificate"
            }
          }
        }
      }
    }
  ]
}

{
  "filter_chains": [
    {
      "filter_chain_match": {
        "transport_protocol": "tls"
      },
      "transport_socket": {
        "name": "envoy.transport_sockets.tls",
        "typed_config": {
          "require_client_certificate": true
        }
      }
    },
    {
      "filter_chain_match": {},
      "transport_socket": {
        "name": "envoy.transport_sockets.raw_buffer"
      }
    }
  ]
}

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: reviews-mtls
  namespace: production
spec:
  selector:
    matchLabels:
      app: reviews
  mtls:
    mode: STRICT
  portLevelMtls:
    8080:
      mode: STRICT
    15021:
      mode: DISABLE # Disable mTLS for health check port

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
spec:
  selector:
    matchLabels:
      app: reviews
  jwtRules:
    - issuer: 'https://auth.example.com'
      jwksUri: 'https://auth.example.com/.well-known/jwks.json'
      forwardOriginalToken: true
      outputPayloadToHeader: 'x-jwt-payload'

Request arrives (Authorization: Bearer TOKEN)
    │
    ▼
JWT Authn Filter (envoy.filters.http.jwt_authn)
    │
    ├── Extract JWT token (Authorization header)
    │
    ├── Check JWKS cache
    │   ├── Cache hit → verify signature with public key
    │   └── Cache miss → download keys from jwksUri
    │
    ├── Token validation:
    │   ├── Signature validity
    │   ├── issuer (iss) match
    │   ├── Expiry (exp) check
    │   └── audience (aud) check (if configured)
    │
    ├── Validation success:
    │   ├── Store payload in filter metadata
    │   ├── forwardOriginalToken: true → preserve original token
    │   └── outputPayloadToHeader → add payload to specified header
    │
    └── Validation failure:
        ├── Invalid JWT → 401 Unauthorized
        └── No JWT → request passes through (unauthenticated)

# Pattern to also reject requests without JWT
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
spec:
  selector:
    matchLabels:
      app: reviews
  action: DENY
  rules:
    - from:
        - source:
            notRequestPrincipals: ['*']

Request arrives
    │
    ▼
[1] CUSTOM policy evaluation
    ├── Matched and denied → 403 Forbidden
    ├── Matched and allowed → proceed to [2]
    └── Not matched → proceed to [2]
    │
    ▼
[2] DENY policy evaluation
    ├── Matched → 403 Forbidden
    └── Not matched → proceed to [3]
    │
    ▼
[3] Check for ALLOW policies
    ├── No ALLOW policies → allow (default allow)
    └── ALLOW policies exist:
        ├── Matched → allow
        └── Not matched → 403 Forbidden

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  selector:
    matchLabels:
      app: reviews
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ['cluster.local/ns/production/sa/frontend']
      to:
        - operation:
            methods: ['GET']
            paths: ['/api/*']

{
  "name": "envoy.filters.http.rbac",
  "typed_config": {
    "rules": {
      "action": "ALLOW",
      "policies": {
        "allow-frontend": {
          "permissions": [
            {
              "and_rules": {
                "rules": [
                  {
                    "header": {
                      "name": ":method",
                      "string_match": {
                        "exact": "GET"
                      }
                    }
                  },
                  {
                    "url_path": {
                      "path": {
                        "prefix": "/api/"
                      }
                    }
                  }
                ]
              }
            }
          ],
          "principals": [
            {
              "authenticated": {
                "principal_name": {
                  "exact": "spiffe://cluster.local/ns/production/sa/frontend"
                }
              }
            }
          ]
        }
      }
    }
  }
}

Trust Domain: scope of trust for a CA that issues certificates

cluster-1: trust domain = "cluster-1.example.com"
  └── spiffe://cluster-1.example.com/ns/prod/sa/frontend

cluster-2: trust domain = "cluster-2.example.com"
  └── spiffe://cluster-2.example.com/ns/prod/sa/frontend

# Configure trust domain aliases in MeshConfig
meshConfig:
  trustDomain: 'new-domain.example.com'
  trustDomainAliases:
    - 'old-domain.example.com'

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ext-authz
  namespace: production
spec:
  selector:
    matchLabels:
      app: reviews
  action: CUSTOM
  provider:
    name: 'opa-ext-authz'
  rules:
    - to:
        - operation:
            paths: ['/api/*']

meshConfig:
  extensionProviders:
    - name: 'opa-ext-authz'
      envoyExtAuthzGrpc:
        service: 'opa.opa-system.svc.cluster.local'
        port: 9191
        timeout: 5s
        failOpen: false

Request arrives
    │
    ▼
Envoy ext_authz filter
    │
    ├── Send authorization request to OPA service via gRPC
    │   ├── Request headers
    │   ├── Path, method
    │   ├── Source principal (SPIFFE ID)
    │   └── Custom attributes
    │
    ├── OPA response:
    │   ├── ALLOW → continue processing request
    │   ├── DENY → return 403
    │   └── Timeout:
    │       ├── failOpen: true → allow request
    │       └── failOpen: false → deny request
    │
    └── OPA can include additional headers in response
        (e.g., authorization context info)

# Phase 1: Mesh-wide PERMISSIVE
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: PERMISSIVE

# Phase 2: Per-namespace STRICT transition
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

# Phase 3: Mesh-wide STRICT
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

# Deny all requests by default, explicitly allow
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: production
spec: {} # Empty spec = ALLOW action, empty rules = deny all requests

# Allow only traffic within the same namespace
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-same-namespace
  namespace: production
spec:
  action: ALLOW
  rules:
    - from:
        - source:
            namespaces: ['production']

# Check mTLS status
istioctl authn tls-check PODNAME.NAMESPACE

# AuthorizationPolicy application status
istioctl x authz check PODNAME.NAMESPACE

# Check certificate information
istioctl proxy-config secret PODNAME.NAMESPACE -o json

# Enable Envoy RBAC debug logging
kubectl exec PODNAME -c istio-proxy -- \
  curl -X POST "localhost:15000/logging?rbac=debug"

# Check RBAC denial statistics
kubectl exec PODNAME -c istio-proxy -- \
  curl -s localhost:15000/stats | grep rbac