Istio Workload Minimum TLS Version Configuration

This task shows how to configure the minimum TLS version for Istio workloads. The maximum TLS version for Istio workloads is 1.3.

Configuration of minimum TLS version for Istio workloads

  • Install Istio through istioctl with the minimum TLS version configured. The IstioOperator custom resource used to configure Istio in the istioctl install command contains a field for the minimum TLS version for Istio workloads. The minProtocolVersion field specifies the minimum TLS version for the TLS connections among Istio workloads. In the following example, the minimum TLS version for Istio workloads is configured to be 1.3.

    1. $ cat <<EOF > ./istio.yaml
    2. apiVersion: install.istio.io/v1alpha1
    3. kind: IstioOperator
    4. spec:
    5.   meshConfig:
    6.     meshMTLS:
    7.       minProtocolVersion: TLSV1_3
    8. EOF
    9. $ istioctl install -f ./istio.yaml

Check the TLS configuration of Istio workloads

After configuring the minimum TLS version of Istio workloads, you can verify that the minimum TLS version was configured and works as expected.

  • Deploy two workloads: httpbin and sleep. Deploy these into a single namespace, for example foo. Both workloads run with an Envoy proxy in front of each.

    ZipZip

    1. $ kubectl create ns foo
    2. $ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@) -n foo
    3. $ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@) -n foo

  • Verify that sleep successfully communicates with httpbin using this command:

    1. $ kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl http://httpbin.foo:8000/ip -sS -o /dev/null -w "%{http_code}\n"
    2. 200

If you don’t see the expected output, retry after a few seconds. Caching and propagation can cause a delay.

In the example, the minimum TLS version was configured to be 1.3. To check that TLS 1.3 is allowed, you can run the following command:

  1. $ kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c istio-proxy -n foo -- openssl s_client -alpn istio -tls1_3 -connect httpbin.foo:8000 | grep "TLSv1.3"

The text output should include:

  1. TLSv1.3

To check that TLS 1.2 is not allowed, you can run the following command:

  1. $ kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c istio-proxy -n foo -- openssl s_client -alpn istio -tls1_2 -connect httpbin.foo:8000 | grep "Cipher is (NONE)"

The text output should include:

  1. Cipher is (NONE)

Cleanup

To remove the foo and istio-system namespaces:

  1. $ kubectl delete ns foo istio-system