Enforce Istio Strict mTLS

Strict mTLS requires that mutual TLS be enabled across the entire service mesh, which can be set using a PeerAuthentication resource on a per-Namespace basis and, if set on the `istio-system` Namespace could disable it across the entire mesh. Disabling mTLS can reduce the security for traffic within that portion of the mesh and should be controlled. This policy prevents disabling strict mTLS in a PeerAuthentication resource by requiring the `mode` be set to either `UNSET` or `STRICT`.

Policy Definition

/istio/enforce-strict-mtls/enforce-strict-mtls.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: enforce-strict-mtls
 5  annotations:
 6    policies.kyverno.io/title: Enforce Istio Strict mTLS
 7    policies.kyverno.io/category: Istio
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: PeerAuthentication
10    kyverno.io/kyverno-version: 1.8.0
11    policies.kyverno.io/minversion: 1.6.0
12    kyverno.io/kubernetes-version: "1.24"
13    policies.kyverno.io/description: >- 
14      Strict mTLS requires that mutual TLS be enabled across the entire service mesh, which
15      can be set using a PeerAuthentication resource on a per-Namespace basis and, if set on
16      the `istio-system` Namespace could disable it across the entire mesh. Disabling mTLS
17      can reduce the security for traffic within that portion of the mesh and should be controlled.
18      This policy prevents disabling strict mTLS in a PeerAuthentication resource by requiring
19      the `mode` be set to either `UNSET` or `STRICT`.
20spec:
21  validationFailureAction: Audit
22  background: true
23  rules:
24  - name: validate-mtls
25    match:
26      any:
27      - resources:
28          kinds:
29          - PeerAuthentication
30    validate:
31      message: "PeerAuthentication resources may only set UNSET or STRICT for the mode."
32      pattern:
33        =(spec):
34          =(mtls):
35            =(mode): "UNSET | STRICT"

Create policy issue