NoServerCertificateVerificationPortLevel

Message NameNoServerCertificateVerificationPortLevel
Message CodeIST0129
DescriptionNo caCertificates are set in DestinationRule, this results in no verification of presented server certificate for traffic to a given port.
LevelWarning

This message occurs when caCertificates is not set in a destination rule, but is needed for the traffic policy.

Example

You will receive this message:

  1. Error [IST0129] (DestinationRule db-tls.default) DestinationRule default/db-tls in namespace default has TLS mode set to SIMPLE but no caCertificates are set to validate server identity for host: mydbserver.prod.svc.cluster.local at port number:443

when your cluster has the following destination rule:

  1. apiVersion: networking.istio.io/v1alpha3
  2. kind: DestinationRule
  3. metadata:
  4.   name: db-tls
  5. spec:
  6.   host: mydbserver.prod.svc.cluster.local
  7.   trafficPolicy:
  8.     portLevelSettings:
  9.       - port:
  10.           number: 443
  11.         tls:
  12.           mode: SIMPLE
  13.           clientCertificate: /etc/certs/myclientcert.pem
  14.           privateKey: /etc/certs/client_private_key.pem
  15.           sni: my-nginx.mesh-external.svc.cluster.local
  16.           # caCertificates not set

In this example, the destination rule db-tls specifies TLS, but does not set the CA certificate file.

How to resolve

  • Supply the filename of a CA certificate
  • Change the traffic policy so that a certificate is not needed