Policy attachment for global services

Attach policies and routes to global services using service inheritance or a GlobalService parentRef.

About

By default, policy resources that target a Kubernetes Service do not apply to the corresponding global service. For example, an AuthorizationPolicy that controls access to the myapp Kubernetes Service does not apply when traffic routes through the myapp.mynamespace.mesh.internal global hostname. To apply the policy to both, you previously needed to create a separate policy resource that targeted the peered ServiceEntry using its associated hostname, such as myapp.mynamespace.mesh.internal.

Starting in version 1.30 of the Solo distribution of Istio, you can automatically extend non-routing policy resources from a Kubernetes Service to its corresponding global service by using policy inheritance.

Note that policy inheritance is independent of how you route to the global service. For information about configuring routes to target global services, see Route to global services.

Before you begin

Make sure that your apps are exposed as global services across clusters.

Policy inheritance

Policy inheritance extends the following non-routing policy types from a Kubernetes Service to its corresponding global service:

• AuthorizationPolicy
• Telemetry
• EnvoyFilter
• TrafficExtension
• WasmPlugin
• RequestAuthentication

Routing resources such as VirtualService, HTTPRoute, GRPCRoute, TCPRoute, TLSRoute, and DestinationRule are not eligible for inheritance. Use a GlobalService parentRef to attach a route directly to a global service instead.

You can enable inheritance per resource or globally for all eligible resources:

• Per-resource: Add the solo.io/service-inheritance: "true" annotation to a policy resource to extend it to the global service.
• Globally: Set the ENABLE_SERVICE_INHERITANCE=true environment variable on the istiod deployment to enable inheritance for all eligible resources. To opt individual resources out, annotate them with solo.io/service-inheritance: "false".

Example: AuthorizationPolicy with service inheritance

The following AuthorizationPolicy restricts access to a Kubernetes Service and uses the solo.io/service-inheritance annotation to extend that restriction to the global service.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: myapp
  namespace: mynamespace
  annotations:
    solo.io/service-inheritance: "true"
spec:
  targetRef:
    group: ""
    kind: Service
    name: myapp
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/client-ns/sa/client-sa

With the annotation, this AuthorizationPolicy applies to both the local myapp.mynamespace.svc.cluster.local service and the hostname of the corresponding peered ServiceEntry, such as myapp.mynamespace.mesh.internal (or myapp.mynamespace.<segment-domain> if you use a custom segment domain).