istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Mention istioctl authn tls-check only check conflict states between c… (#4519) 

* Mention istioctl authn tls-check only check conflict states between configurations

* Fix spelling

* Update content/docs/tasks/security/mutual-tls/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* Update content/docs/tasks/security/mutual-tls/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>
This commit is contained in:
Diem Vu 2019-06-21 13:13:21 -07:00 committed by GitHub
parent 05fcde723d
commit d8a4aba879
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
content/docs/tasks/security/mutual-tls/index.md
View File

@ -72,6 +72,11 @@ Please check [Istio identity](/docs/concepts/security/#istio-identity) for more
Use the `istioctl` tool to check if the mutual TLS settings are in effect. The `istioctl` command needs the client's pod because the destination rule depends on the client's namespace.
You can also provide the destination service to filter the status to that service only.
{{< tip >}}
This tool only checks the consistency of the static TLS settings between destination rules and authentication policies. It doesn't take into account whether or not the
corresponding workloads have sidecars or not. When they don't, the policy and destination rules are not enforced, so note that status `CONFLICT` doesn't always mean that traffic is broken.
{{< /tip >}}
The following commands identify the authentication policy for the `httpbin.default.svc.cluster.local` service and identify the destination rules for the service as seen from the same pod of the `sleep` app:
{{< text bash >}}