Kyma

Appearance

Istio Controller RBAC Configuration ​

Security is paramount, so Istio Controller strictly follows the least privilege principle. While it needs permissions to manage Istio resources effectively, they're carefully tailored to specific tasks, avoiding unnecessary escalation to the level of all created resources. As Istio Controller orchestrates the deployment of Istio components, it necessitates comprehensive management privileges for Istio resources. These privileges must mirror the access control levels accorded to the resources themselves, ensuring seamless operation.

Usage of Wildcards in ClusterRole Definitions ​

ClusterRole istio-manager-role ​

This ClusterRole allows full management of all Istio resources. This is achieved by using the wildcard "*" to specify all resources within the Istio API group. Istio Controller must have this ClusterRole to be able to create, update, and delete Istio resources as needed, as well as pass the necessary permissions to Istio components.

Additionally, this role allows read access to all resources from the following groups:

  • gateway.networking.k8s.io
  • networking.k8s.io
  • rbac.istio.io

This is required for Istio installation to succeed. Lastly, this role allows full management over ingresses and status resources from the networking.k8s.io API group. Istio installation requires the role to pass the necessary permissions to Istiod, which manages the status of ingress resources.

ClusterRole istio-reader-clusterrole-istio-system ​

This ClusterRole grants read-only access to all Istio resources. This is achieved by using the wildcard "*" to specify all resources within the Istio API group. This role is generated by Istio installation by default.

ClusterRole istiod-clusterrole-istio-system ​

This ClusterRole allows full management of all Istio resources. This is achieved by using the wildcard "*" to specify all resources within the Istio API group. This role is generated by Istio installation by default. Additionally, this role allows read access to all resources from the following groups:

  • gateway.networking.k8s.io
  • networking.k8s.io
  • rbac.istio.io This is required for Istiod to correctly maintain the state of the Istio service mesh. Lastly, this role allows management over ingresses and status resources from the networking.k8s.io API group. Istiod requires this permission to manage the status of ingress resources.