days to Istio 1.5

Enabling Policy Enforcement

This task shows you how to enable Istio policy enforcement.

At install time

In the default Istio installation profile, policy enforcement is disabled. To install Istio with policy enforcement on, use the --set values.global.disablePolicyChecks=false install option.

Alternatively, you may install Istio using the demo profile, which enables policy checks by default.

For an existing Istio mesh

  1. Check the status of policy enforcement for your mesh.

    $ kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
    disablePolicyChecks: true
    

    If policy enforcement is enabled (disablePolicyChecks is false), no further action is needed.

  2. Edit the istio configmap to enable policy checks.

    Execute the following command from the root Istio directory:

    $ istioctl manifest apply --set values.global.disablePolicyChecks=false
    configmap "istio" replaced
    
  3. Validate that policy enforcement is now enabled.

    $ kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
    disablePolicyChecks: false
    
Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!