Istio Mutual TLS DestinationRule (SL025)

Validates that SQA and PROD Kubernetes environments resolve to an Istio DestinationRule with trafficPolicy.tls.mode: ISTIO_MUTUAL.

Description

Checks SQA and PROD Kubernetes environments to ensure that each resolves to an Istio DestinationRule configured with trafficPolicy.tls.mode: ISTIO_MUTUAL, either defined directly in the environment overlay or inherited from the base overlay.

Rationale

Ensuring service-to-service communications are encrypted and compliant with requirement CKM-47739.

Findings

  • WARNING

    • Missing Istio DestinationRule for SQA or PROD environment

    • Missing or non-ISTIO_MUTUAL trafficPolicy.tls.mode in DestinationRule

Noncompliant

Noncompliant DestinationRule missing ISTIO_MUTUAL
# kubernetes/prod/destination-rule.yaml (noncompliant TLS mode)
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-service
spec:
  host: my-service
  trafficPolicy:
    tls:
      mode: DISABLE

Compliant

Compliant DestinationRule with ISTIO_MUTUAL
# kubernetes/prod/destination-rule.yaml (compliant Istio mutual TLS)
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-service
spec:
  host: my-service
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

Configuration

This rule has no configuration.