UNCLASSIFIED - NO CUI

loki's virtual-service should not be enabled by default

Motivation

Loki's API does not require authentication and allows callers to perform administrative functions in Loki. The loki package creates a virtual service exposing this API via the istio public gateway with its default values, creating a security concern. Big Bang umbrella does not explicitly enable the loki virtual service, but the package itself does and should not.

Acceptance Criteria

  • istio.loki.enabled must be set to false in loki's default values.yaml
  • A deployment of BigBang with istio enabled must not expose the loki API by default