This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 18%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDG%3C/text%3E%3C/svg%3E)
Three months ago I successfully created a AuthorizatioPolicy in the preview version (1.18) of the Istio Service Mesh into our AKS cluster. Yesterday, I made an attempt to modify the policy and received the following error:
Error from server: error when creating "jwtauth.yml": admission webhook "azure-service-mesh-ccp-validating-webhook.azmk8s.io" denied the request: unknown gvk: security.istio.io/v1, Kind=AuthorizationPolicy
I am unable to modify or delete the existing AuthorizationPolicy. I also can't add a new one.
Since the preview version is no longer supported I upgraded to v1.20 and get the same result.
I then installed Istio 1.21 in another AKS instance/subscription to confirm there wasn't something corrupted in the original instance and I get the same error.
Is anyone else experiencing this issue?
The definition of the policy I was attempting to delete/modify is below:
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: payment
spec:
selector:
matchLabels:
app: payment
action: ALLOW
rules:
- to:
- operation:
paths:
- /swagger*
- /v3/api-docs*
- /v1/payments
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 86%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJL%3C/text%3E%3C/svg%3E)
I am experiencing the same error when trying to add a AuthorizationPolicy. Were you able to find a workaround?
Omitted
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 74%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAN%3C/text%3E%3C/svg%3E)
It appears from the error message that the AuthorizationPolicy resource you are attempting to create is not recognized by the admission webhook.
It's possible that the AuthorizationPolicy resource is more recent than the Istio version that's presently operational in your AKS cluster.
You can see the Istio deployment data or use a command like istiodctl version to find out the Istio version in your AKS cluster.
Refer to the Istio documentations for supported versions and resource definitions
https://istio.io/latest/docs/reference/config/security/authorization-policy/
https://istio.io/latest/docs/reference/config/security/request_authentication/
https://istio.io/latest/docs/reference/config/security/conditions/
Hope this helps you.
I haven't found a workaround yet.
The AuthorizationPolicy resource has been available in Istio for years and is available in all versions (1.18, 1.20, and 1.21) that I've installed using the Azure provided feature.
I've submitted a support ticket to investigate this issue. I'll post once a response is provided.
thankyou for the update @David Glantz
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 47%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMV%3C/text%3E%3C/svg%3E)
Looks like there is problem with the webhook recognizing specifically v1, I was able to create Authorization Policy with v1beta1 using go istio client though both are valid versions according to the webhook.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 83%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENS%3C/text%3E%3C/svg%3E)
Hi - engineer from the PG here. This was due to an error on our end related to validations we add for Authorization Policy for the v1 API. The fix is in and will go out in the next upcoming AKS release after 2024-06-09 finished rolling out globally. The fix for the time being is to use the v1beta1 API until our fix rolls out. Apologies for any inconvenience.
In the future, we encourage users to file issues in the AKS GitHub repo with the "mesh" label for faster responses: https://github.com/Azure/aks.
Hello David Glantz,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 67%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Hi, We were facing this issue as well. We downgraded to "v1beta1" for the time being as a workaround. I have asked support why this issue just started happening all of a sudden. We were using "v1" version for quiet some time.