• About
    • Service mesh
    • Solutions
    • Case studies
    • Ecosystem
    • Deployment
    • FAQ
  • Blog
  • News
  • Get involved
  • Documentation
Try Istio
  • Concepts
    • Traffic Management
    • Security
    • Observability
    • Extensibility
  • Setup
    • Getting Started
    • Platform Setup
      • Alibaba Cloud
      • Azure
      • Docker Desktop
      • Google Kubernetes Engine
      • Huawei Cloud
      • IBM Cloud
      • kind
      • Kops
      • Kubernetes Gardener
      • KubeSphere Container Platform
      • MicroK8s
      • Minikube
      • OpenShift
      • Oracle Cloud Infrastructure
    • Install
      • Install with Istioctl
      • Istio Operator Install
      • Install with Helm
      • Install Multicluster
        • Before you begin
        • Install Multi-Primary
        • Install Primary-Remote
        • Install Multi-Primary on different networks
        • Install Primary-Remote on different networks
        • Verify the installation
      • Install Istio with an External Control Plane
      • Virtual Machine Installation
    • Upgrade
      • Canary Upgrades
      • In-place Upgrades
      • Upgrade with Helm
      • Managing Gateways with Multiple Revisions (Experimental)
    • More Guides
      • Installation Configuration Profiles
      • Installing Gateways
      • Installing the Sidecar
      • Customizing the installation configuration
      • Install Istio with the Istio CNI plugin
  • Tasks
    • Traffic Management
      • Request Routing
      • Fault Injection
      • Traffic Shifting
      • TCP Traffic Shifting
      • Request Timeouts
      • Circuit Breaking
      • Mirroring
      • Locality Load Balancing
        • Before you begin
        • Locality failover
        • Locality weighted distribution
        • Cleanup
      • Ingress
        • Ingress Gateways
        • Secure Gateways
        • Ingress Gateway without TLS Termination
        • Kubernetes Ingress
        • Kubernetes Gateway API
      • Egress
        • Accessing External Services
        • Egress TLS Origination
        • Egress Gateways
        • Egress Gateways with TLS Origination (File Mount)
        • Egress Gateways with TLS Origination (SDS)
        • Egress using Wildcard Hosts
        • Kubernetes Services for Egress Traffic
        • Using an External HTTPS Proxy
    • Security
      • Certificate Management
        • Plug in CA Certificates
        • Istio DNS Certificate Management
        • Custom CA Integration using Kubernetes CSR (Experimental)
      • Authentication
        • Authentication Policy
        • Mutual TLS Migration
      • Authorization
        • HTTP Traffic
        • TCP Traffic
        • JWT Token
        • External Authorization
        • Explicit Deny
        • Ingress Gateway
        • Trust Domain Migration
        • Dry Run (Experimental)
    • Policy Enforcement
      • Enabling Rate Limits using Envoy
    • Observability
      • Metrics
        • Collecting Metrics for TCP Services
        • Customizing Istio Metrics
        • Classifying Metrics Based on Request or Response
        • Querying Metrics from Prometheus
        • Visualizing Metrics with Grafana
      • Logs
        • Getting Envoy's Access Logs
      • Distributed Tracing
        • Overview
        • Jaeger
        • Zipkin
        • Lightstep
        • Configurability [Beta/Experimental]
      • Visualizing Your Mesh
      • Remotely Accessing Telemetry Addons
  • Examples
    • Bookinfo Application
    • Bookinfo with a Virtual Machine
    • Learn Microservices using Kubernetes and Istio
      • Prerequisites
      • Setup a Kubernetes Cluster
      • Setup a Local Computer
      • Run a Microservice Locally
      • Run ratings in Docker
      • Run Bookinfo with Kubernetes
      • Test in production
      • Add a new version of reviews
      • Enable Istio on productpage
      • Enable Istio on all the microservices
      • Configure Istio Ingress Gateway
      • Monitoring with Istio
  • Operations
    • Deployment
      • Architecture
      • Deployment Models
      • Virtual Machine Architecture
      • Performance and Scalability
      • Application Requirements
    • Configuration
      • Mesh Configuration
        • Dynamic Admission Webhooks Overview
        • Wait on Resource Status for Applied Configuration
        • Automatic Sidecar Injection
        • Health Checking of Istio Services
      • Traffic Management
        • Protocol Selection
        • TLS Configuration
        • Traffic Routing
        • DNS Proxying
        • Configuring Gateway Network Topology (Alpha)
      • Security
        • Security policy examples
        • Harden Docker Container Images
      • Observability
        • Envoy Statistics
        • Monitoring Multicluster Istio with Prometheus
      • Extensibility
        • Distributing WebAssembly Modules (Experimental)
    • Best Practices
      • Deployment Best Practices
      • Traffic Management Best Practices
      • Security Best Practices
      • Observability Best Practices
    • Common Problems
      • Traffic Management Problems
      • Security Problems
      • Observability Problems
      • Sidecar Injection Problems
      • Configuration Validation Problems
    • Diagnostic Tools
      • Using the Istioctl Command-line Tool
      • Debugging Envoy and Istiod
      • Understand your Mesh with Istioctl Describe
      • Diagnose your Configuration with Istioctl Analyze
      • Istiod Introspection
      • Component Logging
      • Debugging Virtual Machines
      • Troubleshooting Multicluster
    • Integrations
      • cert-manager
      • Grafana
      • Jaeger
      • Kiali
      • Prometheus
      • Zipkin
  • Releases
    • Feature Status
    • Reporting Bugs
    • Security Vulnerabilities
    • Supported Releases
    • Contribute Documentation
      • Work with GitHub
      • Add New Documentation
      • Remove Retired Documentation
      • Build and serve the website locally
      • Front matter
      • Documentation Review Process
      • Add Code Blocks
      • Use Shortcodes
      • Follow Formatting Standards
      • Style Guide
      • Terminology Standards
      • Diagram Creation Guidelines
    • Website Content Changes
  • Reference
    • Configuration
      • IstioOperator Options
      • Global Mesh Options
      • Analysis Messages
      • Configuration Status Field
      • Proxy Extensions
        • Metadata Exchange Config
        • AttributeGen Config
        • Stackdriver Config
        • Stats Config
        • AccessLogPolicy Config
        • Wasm-based Telemetry (Experimental)
      • Traffic Management
        • Destination Rule
        • Envoy Filter
        • Gateway
        • Workload Group
        • Service Entry
        • Sidecar
        • Virtual Service
        • Workload Entry
      • Security
        • JWTRule
        • PeerAuthentication
        • RequestAuthentication
        • Authorization Policy
        • Authorization Policy Conditions
      • Common Types
        • Workload Selector
      • Istio Standard Metrics
      • Resource Annotations
      • Resource Labels
      • Configuration Analysis Messages
        • PodMissingProxy
        • Analyzer Message Format
        • ConflictingMeshGatewayVirtualServiceHosts
        • ConflictingSidecarWorkloadSelectors
        • DeploymentAssociatedToMultipleServices
        • DeploymentConflictingPorts
        • DeploymentRequiresServiceAssociated
        • Deprecated
        • DeprecatedAnnotation
        • GatewayPortNotOnWorkload
        • InternalError
        • InvalidAnnotation
        • InvalidApplicationUID
        • InvalidRegexp
        • IstioProxyImageMismatch
        • JwtFailureDueToInvalidServicePortPrefix
        • LocalhostListener
        • AlphaAnnotation
        • MTLSPolicyConflict
        • MultipleSidecarsWithoutWorkloadSelectors
        • NamespaceMultipleInjectionLabels
        • NamespaceNotInjected
        • NoMatchingWorkloadsFound
        • NoServerCertificateVerificationDestinationLevel
        • NoServerCertificateVerificationPortLevel
        • MisplacedAnnotation
        • PortNameIsNotUnderNamingConvention
        • ReferencedResourceNotFound
        • SchemaValidationError
        • ServiceEntryAddressesRequired
        • UnknownAnnotation
        • VirtualServiceDestinationPortSelectorRequired
        • VirtualServiceHostNotFoundInGateway
        • VirtualServiceIneffectiveMatch
        • VirtualServiceUnreachableRule
    • Commands
      • istioctl
      • operator
      • pilot-agent
      • pilot-discovery
    • Glossary
  1. Documentation
  2. Reference
  3. Configuration
  4. Security

Security

Describes how to configure Istio's security features.

Authorization Policy

Configuration for access control on workloads.

Authorization Policy Conditions

Describes the supported conditions in authorization policies.

JWTRule

Configuration to validate JWT.

PeerAuthentication

Peer authentication configuration for workloads.

RequestAuthentication

Request authentication configuration for workloads.

Links

    English 中文
    • Privacy policy | Edit this Page on GitHub
    © 2021 Istio Authors. Version Archive 1.10.3
    • current release
    • next release
    • older releases