No Permissive Authz + Istio Collector

✓ Guardrail ↓ Collector Experimental Deployment And Infrastructure

Enforce No Permissive Authz using data collected by Istio Collector. Automatically check deployment and infrastructure standards on every PR.

Guardrail: Fails when an AuthorizationPolicy grants blanket access — an ALLOW action with a rule that has no from/to/when constraints (matches every source). Accidental allow-all rules quietly negate the rest of the mesh's authz.

Data Source: Parse Istio config from repository manifests: mTLS mode, authorization policies, JWT authentication, traffic routing (VirtualService, DestinationRule, Gateway), sidecars, telemetry, install profile, and sidecar-injection settings. Also records istioctl commands run in CI.

Get Started View on GitHub

How Istio Collector Powers This Guardrail

The Istio Collector gathers metadata from your security, orchestration systems. This data flows into Lunar's Component JSON, where the No Permissive Authz guardrail evaluates it against your standards.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.

↓ Istio Collector Gathers Data Collector

Extracts metadata from code, configs, and tool outputs

{ } Component JSON

Data centralized in structured format for evaluation

✓ No Permissive Authz Checks Guardrail

Pass/fail result with actionable feedback in PRs

Quick Start Configuration

Add both the collector and policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

# Step 1: Enable the Istio Collector
collectors:
  - uses: github://earthly/lunar-lib/collectors/istio@v1.0.5
    # with: ...

# Step 2: Enable the Istio Guardrails
policies:
  - uses: github://earthly/lunar-lib/policies/istio@v1.0.5
    include: [no-permissive-authz]
    # with: ...

What Istio Collector Collects

This collector gathers the following data that the No Permissive Authz guardrail evaluates.

Collector code

`istio`

Parses all Istio custom resources in the repository and collects:

mTLS posture from PeerAuthentication (STRICT / PERMISSIVE / DISABLE, and scope)
AuthorizationPolicy actions and whether any rule grants blanket access
RequestAuthentication (JWT) issuers
Traffic management: VirtualService, DestinationRule, Gateway, ServiceEntry, Sidecar, EnvoyFilter
Telemetry resources (tracing / metrics / access logging)
Install profile from IstioOperator
Sidecar injection: namespace labels (istio-injection / istio.io/rev) and per-workload sidecar.istio.io/inject overrides Each resource is validated with istioctl analyze (offline, no cluster required).

Collector ci-after-command

`cicd`

Records every istioctl command executed in CI pipelines along with the istioctl client version. Writes command strings and version info to .mesh.cicd for audit trails and deployment traceability (istioctl install, istioctl analyze, istioctl upgrade, etc.).

Example Data Flow

Here's an example of the data that Istio Collector writes to the Component JSON, which No Permissive Authz then evaluates.

{ } component.json From Istio Collector

{
  "mesh": {
    "source": {
      "tool": "istio",
      "version": "1.22.0",
      "integration": "code"
    },
    "provider": "istio",
    "resources": [
      {"kind": "VirtualService", "name": "reviews", "namespace": "bookinfo", "path": "istio/reviews-vs.yaml", "valid": true},
      {"kind": "PeerAuthentication", "name": "default", "namespace": "istio-system", "path": "istio/mtls.yaml", "valid": true}
    ],
    "peer_authentications": [
      {"name": "default", "namespace": "istio-system", "scope": "mesh", "mode": "STRICT", "path": "istio/mtls.yaml"}
    ],
    "authorization_policies": [
      {"name": "require-jwt", "namespace": "bookinfo", "action": "ALLOW", "rule_count": 1, "allows_all": false, "path": "istio/authz.yaml"}
    ],
    "request_authentications": [
      {"name": "jwt-example", "namespace": "bookinfo", "issuers": ["https://accounts.example.com"], "path": "istio/reqauth.yaml"}
    ],
    "virtual_services": [
      {"name": "reviews", "namespace": "bookinfo", "hosts": ["reviews"], "gateways": ["mesh"], "has_timeout": true, "has_retries": true, "has_fault_injection": false, "path": "istio/reviews-vs.yaml"}
    ],
    "destination_rules": [
      {"name": "reviews", "namespace": "bookinfo", "host": "reviews", "tls_mode": "ISTIO_MUTUAL", "has_outlier_detection": true, "has_connection_pool": true, "subsets": ["v1", "v2"], "path": "istio/reviews-dr.yaml"}
    ],
    "gateways": [
      {
        "name": "bookinfo-gateway",
        "namespace": "istio-system",
        "servers": [
          {"port": 443, "protocol": "HTTPS", "tls_mode": "SIMPLE", "https_redirect": false},
          {"port": 80, "protocol": "HTTP", "https_redirect": true}
        ],
        "path": "istio/gateway.yaml"
      }
    ],
    "service_entries": [
      {"name": "external-api", "namespace": "bookinfo", "hosts": ["api.example.com"], "location": "MESH_EXTERNAL", "resolution": "DNS", "path": "istio/service-entry.yaml"}
    ],
    "sidecars": [
      {"name": "default", "namespace": "bookinfo", "restricts_egress": true, "egress_hosts": ["./*", "istio-system/*"], "path": "istio/sidecar.yaml"}
    ],
    "envoy_filters": [
      {"name": "custom-lua", "namespace": "bookinfo", "path": "istio/envoyfilter.yaml"}
    ],
    "telemetry": [
      {"name": "mesh-default", "namespace": "istio-system", "has_tracing": true, "has_metrics": true, "has_access_logging": true, "path": "istio/telemetry.yaml"}
    ],
    "install": [
      {"kind": "IstioOperator", "name": "control-plane", "namespace": "istio-system", "profile": "default", "path": "istio/istiooperator.yaml"}
    ],
    "injection": {
      "namespaces": [
        {"name": "bookinfo", "enabled": true, "revision": null, "path": "istio/ns-bookinfo.yaml"}
      ],
      "workload_overrides": [
        {"kind": "Deployment", "name": "legacy-batch", "namespace": "bookinfo", "inject": false, "path": "deploy/legacy.yaml"}
      ]
    },
    "cicd": {
      "cmds": [
        {"cmd": "istioctl install -y", "version": "1.22.0"},
        {"cmd": "istioctl analyze ./istio", "version": "1.22.0"}
      ],
      "source": {"tool": "istioctl", "integration": "ci"}
    },
    "summary": {
      "mtls_default_mode": "STRICT",
      "mtls_strict": true,
      "has_authorization_policies": true,
      "all_gateways_tls": true,
      "injection_enabled": true,
      "uses_envoy_filters": true
    }
  }
}

Configuration Options

Istio Collector Inputs

Input	Required	Default	Description
`find_command`	Optional	`find . -type f \( -name '.yaml' -o -name '.yml' \)`	Command to find Istio manifest files (must output one file path per line)

Istio Guardrails Inputs

Input	Required	Default	Description
`required_mtls_mode`	Optional	`STRICT`	Required mesh-wide mTLS mode for the mtls-strict check (STRICT or PERMISSIVE)

Learn More

Guardrail · Istio Guardrails No Permissive Authz View all compatible integrations

→

Collector Istio Collector View full documentation

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo