Skip to content
This repository has been archived by the owner on Mar 27, 2023. It is now read-only.

mTLS Probe Vetter returns MeshPolicy when Auth Policy cannot be determined #26

Open
BLaurenB opened this issue Oct 17, 2018 · 0 comments
Labels

Comments

@BLaurenB
Copy link
Contributor

Problem:
In pkg/vetter/mtlsprobes/vet.go, isNoteRequiredForMtlsProbe() previously had only 2 cases, but after adding functionality to account for Istio changes in 1.0, there are now 3 to maintain old functionality and allow for new functionality. The old functionality still has an issue to be addressed.
In the case that the Auth Policy cannot be determined (either due to an error, or due to conflicting policies), the global (or mesh) policy is returned and a note is or isn't written based on that policy. Because we just don't know what the mTls state is of the target service, the global/mesh policy should not be used. The function should exit at this point, or return false so that no note is written since we cannot determine what the behavior is or should be. Conflicting policies are already handled with a different vet note.

@BLaurenB BLaurenB added the bug label Oct 17, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

1 participant