Accessing FQDN returns RBAC access denied error

Cause and resolution for RBAC access denied errors when accessing an FQDN via Istio in Automation Suite on EKS/AKS.

Description

Accessing an FQDN may return the following error:

RBAC: access denied

This issue occurs because the FQDN and its relevant URL access are routed via Istio. Istio relies on a WASM plugin to route the request to the appropriate destination pod.

If the WASM plugin image is missing in the registry, internal or external, Istio blocks the URL access and returns a RBAC: access denied error.

Solution

To address this issue, you must ensure that the registry is hydrated and the WASM plugin image exists in registry.

To check the WASM plugin image, run teh folowing command:

kubectl get wasmplugin -A -o yaml | grep url

The output will be similar to the one from the following example:

url: oci://testing.azurecr.io/istio-wasm-plugin:2024.10.3

In the example above, the WASM plugin image is istio-wasm-plugin:2024.10.3. You must check if this image is present in your registry or not.