Istio allow incoming traffic to a service only from a particular namespace - istio

Question

We want Istio to allow incoming traffic to a service only from a particular namespace. How can we do this with Istio? We are runnning Istio 1.1.3 version.
Update:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-app-ingress
namespace: test-ns
spec:
podSelector:
matchLabels:
app: testapp
ingress:
- ports:
- protocol: TCP
port: 80
from:
- podSelector:
matchLabels:
istio: ingress
This did not work I am able to access the service from other namespaces as well. Next i tried:
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: external-api-caller
namespace: test-ns
spec:
rules:
- services: ["testapp"]
methods: ["*"]
constraints:
- key: "destination.labels[version]"
values: ["v1", "v2"]
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: external-api-caller
namespace: test-ns
spec:
subjects:
- properties:
source.namespace: "default"
roleRef:
kind: ServiceRole
name: "external-api-caller"
I am able to access the service from all the namespaces. Where i expected it should be allowed only from "default" namespace

Answer 1

I'm not sure if this is possible for particular namespace, but it will work on labels.
You can create a network policy in Istio, this is nicely explained on Traffic Routing in Kubernetes via Istio and Envoy Proxy.
...
ingress:
- from:
- podSelector:
matchLabels:
zone: trusted
...
In the example only pods with label zone: trusted will be allowed to make incoming connection to the pod.
You can read about Using Network Policy with Istio.
I would also recommend reading Security Concepts in Istio as well as Denials and White/Black Listing.
Hope this helps You.

Answer 2

Using k8s Network Policy: Yes it is possible. The example that is posted in the question is not allowing from a different namespace. In the Ingress rule you have to use namespace selector which will be used to specify the namespace from which you want to allow the traffic. In the example below, namespace with label 'ns-group: prod-ns' will be allowed to access the pod with label 'app: testapp' on port 80 and protocol TCP
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-app-ingress
namespace: test-ns
spec:
podSelector:
matchLabels:
app: testapp
ingress:
- ports:
- protocol: TCP
port: 80
from:
- namespaceSelector:
matchLabels:
ns-group: prod-ns
Using Istio White Listing Policy: You can go through white listing policy examples and attribute vocabulary
Below is the example,
apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
name: whitelist-namespace
spec:
compiledAdapter: listchecker
params:
overrides: ["prod-ns"]
blacklist: false
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
name: source-ns-instance
spec:
compiledTemplate: listentry
params:
value: source.namespace
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
name: rule-policy-1
spec:
match: destination.labels["app"] == "testapp" && destination.namespace == "test-ns"
actions:
- handler: whitelist-namespace
instances: [ source-ns-instance ]