messaging-topology-operator compatibility with Istio mTLS ?

[bmaguireibm]

Hi All,
I have been attempting to deploy and configure rabbitmq in k8 cluster using the operators. The k8 cluster has istio service mesh installed and it is configured to use strict mTLS. I think this is causing an issue with the operation of the messaging-topology-operator. The cluster-operator deploys a cluster without issue, but any resources defined by messaging-topology-operator are failing to be created.

If the rabbitmq-system does not have side car injection enabled, I'm seeing a read: connection reset by peer and when the side car is enabled on all pods I get the following Error 403 (Error 403 from RabbitMQ: invalid character 'R' looking for beginning of value):

Has anyone else encountered similar issues or succeeded in a similar configuration?

Thanks for your help,

Brian

[bmaguireibm]

It is indeed compatible with mTLS Istio, the issue I was getting was caused by overly restrictive rbac rules, with access logs enabled on istio side cars I could see the 403 was coming from the rabbitmq cluster side car proxy. I fixed it by adding an AuthorizationPolicy that allowed traffic from the rabbitmq-system namespace.