IMPORTANT : OPA-ENVOY-PLUGIN with MutatingWebhookConfiguration and admission-controller

[ajoysinha]

We did deploy OPA-ISTIO-PLUGIN with previous version [ istio 1.5.6 ] using MutatingWebhookConfiguration and admission-controller. Which help us to decouple application deployment file and opa configuration files. [ Which was our expectation also ].

In recent past we are planning to upgrade istio to latest version [1.7.4 ] and trying to consider upgrade OPA plugin also.

But surprisingly we have noticed, in recent deployment approach, there is nothing like OPA-ISTIO-PLUGIN, whereas it is now OPA-ENVOY-PLUGIN. [ Which i can understand for generic behavior ], but I haven't found any MutatingWebhookConfiguration and admission-controller in OPA-ENVOY-PLUGIN deployment.

Don't we have any process to use MutatingWebhookConfiguration and admission-controller and make OPA and APPLICATION deployment files loosely coupled in latest OPA-ENVOY-PLUGIN deployment process. If we have, could you please provide me the implementation approach, else we will stuck in middle because we have already implement opa-istio-plugin using admission controller.

[ashutosh-narkar]

Hello, we re-branded the opa-istio-plugin to the opa-envoy-plugin. The Istio specific deployment steps have been added in the examples/istio folder. You can find the MutatingWebhookConfiguration, etc. here.

Also, the plugin does not work with Istio v1.7.0+. With the 1.7 release, the OPA heath checks are passed through istio-proxy and then sent to OPA resulting in OPA returning a 403. So the health checks fail and the pods keep restarting. The plugin will work with v1.6.x. For Istio v1.7.x, we could add a Rego policy to allow health checks as a workaround but it would be better if there was a way to configure the behavior in the EnvoyFilter config. There seems to be an open issue related to this.

[ajoysinha]

Thanks ashutosh. Yesterday I was stuck with 403 issue .. as i was using 1.7.x version of istio. I will try with downgrade version of istio. and will update soon.

[ajoysinha]

Hi ashutosh, I was trying to use 1.6.13 istio version for OPA injection and implementation using Envoy Filter and adminssion controller. I did use Envoy Filter from this example [ as it mention it is working ] https://github.com/open-policy-agent/opa/issues/2454#issuecomment-681832631 but I am stuck with health check issue for 1.6.13 also. [403]. Totally stuck and confused with version compatibility. Looking forward to move to 1.6 version with a working solution of EnvoyFilter. need guidance.

[ashutosh-narkar]

How are you running the Istio ? Is it over minikube and if yes, what version ? Also what version of the plugin are you using ? It would be great if you could share OPA logs that show the heath checks are being passed through istio-proxy.