Hide error message on Policy failure in Istio

Question

If I define an AuthorizationPolicy in Istio which is violated, the error message is returned to me, for example:

INTERNAL:performing check operation failed: 1 error occurred:%0A%09* rpc error: code = PermissionDenied desc = RBAC: access denied%0A%0A

Is there a way I can hide the message?

Istio version: 1.4.5

Answer 1

Based on below istio github code

// CheckRBACRequest checks if a request is successful under RBAC policies.
// Under RBAC policies, a request is consider successful if:
// * If the policy is allow:
// *** Response code is 200
// * If the policy is deny:
// *** For HTTP: response code is 403.
// *** For TCP: EOF error
func (tc TestCase) CheckRBACRequest() error {
    req := tc.Request

    headers := make(http.Header)
    if len(tc.Jwt) > 0 {
        headers.Add("Authorization", "Bearer "+tc.Jwt)
    }
    for k, v := range tc.Headers {
        headers.Add(k, v)
    }
    tc.Request.Options.Headers = headers

    resp, err := req.From.Call(tc.Request.Options)

    if tc.ExpectAllowed {
        if err == nil {
            err = resp.CheckOK()
        }
        if err != nil {
            return getError(req, "allow with code 200", fmt.Sprintf("error: %v", err))
        }
    } else {
        if req.Options.PortName == "tcp" || req.Options.PortName == "grpc" {
            expectedErrMsg := "EOF" // TCP deny message.
            if req.Options.PortName == "grpc" {
                expectedErrMsg = "rpc error: code = PermissionDenied desc = RBAC: access denied"
            }
            if err == nil || !strings.Contains(err.Error(), expectedErrMsg) {
                expect := fmt.Sprintf("deny with %s error", expectedErrMsg)
                actual := fmt.Sprintf("error: %v", err)
                return getError(req, expect, actual)
            }
        } else {
            if err != nil {
                return getError(req, "deny with code 403", fmt.Sprintf("error: %v", err))
            }
            var result string
            if len(resp) == 0 {
                result = "no response"
            } else if resp[0].Code != response.StatusCodeForbidden {
                result = resp[0].Code
            }
            if result != "" {
                return getError(req, "deny with code 403", result)
            }
        }
    }
    return nil
}

As far as I'm concerned, and based on above code, you would have to actually change istio code to achieve what you need.