Egress rule to google.com according to documentation not working with istio-RBAC enabled.

[arshchimni]

Is this a BUG or FEATURE REQUEST?: BUG

Did you review https://istio.io/help/ and existing issues to identify if this is already solved or being worked on?: Yes

Bug: Y

What Version of Istio and Kubernetes are you using, where did you get Istio from, Installation details

istioctl version 0.7.1
kubectl version 1.9.6

Is Istio Auth enabled or not ? Did you install the stable istio.yaml, istio-auth.yaml.... or if using the Helm chart please provide full command line input.

YES, applied both istio.yaml and istio-auth.yaml

What happened: The clusters are provisioned on GKE and I have istio-rbac and mTLS enabled.

When I apply the egress rule according to the documentation to connect to google.com over HTTPS, I consistently get 403 from the Envoy proxy which states PERMISSION_DENIED:rbac-handler.rbac.istio-system:RBAC

Following is the response I receive from curl -:

# curl -vv  http://www.google.com:443
* Rebuilt URL to: http://www.google.com:443/
*   Trying 108.177.112.104...
* TCP_NODELAY set
* Connected to www.google.com (108.177.112.104) port 443 (#0)
> GET / HTTP/1.1
> Host: www.google.com:443
> User-Agent: curl/7.60.0
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< content-length: 73
< content-type: text/plain
< date: Fri, 25 May 2018 10:18:11 GMT
< server: envoy
<
* Connection #0 to host www.google.com left intact
PERMISSION_DENIED:rbac-handler.rbac.istio-system:RBAC

Following is the egress rule applied -:

apiVersion: config.istio.io/v1alpha2
kind: EgressRule
metadata:
  name: google-egress-rule
  namespace: default
spec:
  destination:
    service: www.google.com
  ports:
    - port: 443
      protocol: https

Tried ExternalService in v1aplha3, that also did not work. (https://istio.io/docs/tasks/traffic-management-v1alpha3/egress-tcp.html)

What you expected to happen:

I should be able to communicate with google.com over HTTPS

How to reproduce it: Enable istio RBAC and apply the egress rule.

Feature Request: N

[arshchimni]

I found the solution. if someone else is stuck , you have to make a service role and role binding

cat <<EOF | kubectl apply -f -
apiVersion: "config.istio.io/v1alpha2"
kind: ServiceRole
metadata:
  name: google-egress-service-role
spec:
  rules:
  - services: ["google-egress-rule.default.cluster.local"]
    methods: ["*"]
EOF

cat <<EOF | kubectl apply -f -
   apiVersion: "config.istio.io/v1alpha2"
   kind: ServiceRoleBinding
   metadata:
     name: binding-google-egress-allusers
   spec:
     subjects:
     - user: "*"
     roleRef:
       kind: ServiceRole
       name: "google-egress-service-role"
EOF