From 0d39bcddc9436f1899528df7f6e402d9e1c473e0 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Tue, 10 Mar 2026 22:35:20 -0500 Subject: [PATCH] Add ServiceEntry for wildcard host to fix Kiali KIA0104 The global-authentik-authz AuthorizationPolicy uses *.kube.huskypup.net as a host match, but Kiali flagged KIA0104 because the wildcard had no matching entry in Istio's service registry. Adding a MESH_EXTERNAL ServiceEntry with resolution NONE registers the hostname without affecting routing. Co-Authored-By: Claude Opus 4.6 --- .../istio/manifests/mesh/authentik-allow.yaml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/infrastructure/istio/manifests/mesh/authentik-allow.yaml b/infrastructure/istio/manifests/mesh/authentik-allow.yaml index 27062cf..9015081 100644 --- a/infrastructure/istio/manifests/mesh/authentik-allow.yaml +++ b/infrastructure/istio/manifests/mesh/authentik-allow.yaml @@ -65,3 +65,23 @@ spec: # --- Vault (has its own auth system + API access by ESO/apps) --- - "vault.kube.huskypup.net" + +--- +# Register the wildcard hostname in Istio's service registry so that the +# AuthorizationPolicy host reference above passes Kiali KIA0104 validation. +# MESH_EXTERNAL + resolution NONE = no routing side-effects; this is purely +# a registry entry for the wildcard used in the CUSTOM policy above. +apiVersion: networking.istio.io/v1 +kind: ServiceEntry +metadata: + name: kube-huskypup-net-wildcard + namespace: istio-system +spec: + hosts: + - "*.kube.huskypup.net" + location: MESH_EXTERNAL + resolution: NONE + ports: + - number: 443 + name: https + protocol: HTTPS