Hi,

Mixer policy is fail-close by default. That means if you remove policy pods, then the requests to policy fail, and that is interpreted as a policy failure.

To disable policy checks being applied altogether, you need to edit the mesh config (and restart pilot pods):
https://github.com/istio/istio/blob/master/install/kubernetes/helm/istio/values.yaml#L85

The corresponding installation helm option is this:
https://github.com/istio/istio/blob/master/install/kubernetes/helm/istio/values.yaml#L85

@kyessenov
Hi , I changed the istio ConfigMap, set disablePolicyChecks to true, and restarted the istio-pilot. But my requests still got failed with status code 503. I don't know why.

Here is my meshconfig:

apiVersion: v1
kind: ConfigMap
metadata:
name: istio
namespace: istio-system
labels:
app: istio
chart: istio-1.0.0
release: RELEASE-NAME
heritage: Tiller
data:
mesh: |-
# Set the following variable to true to disable policy checks by the Mixer.
# Note that metrics will still be reported to the Mixer.
disablePolicyChecks: true

# Set enableTracing to false to disable request tracing.
enableTracing: true

My requests are responsed like this:

About to connect() to apigateway.smhtest.svc.a1.uae port 12344 (#0)
Trying 2002:ac1f:91c5:1::6ff2...
Connected to apigateway.smhtest.svc.a1.uae (2002:ac1f:91c5:1::6ff2) port 12344 (#0)

GET /helloworld HTTP/1.1
User-Agent: curl/7.29.0
Host: apigateway.smhtest.svc.a1.uae:12344
Accept: /

< HTTP/1.1 503 Service Unavailable
< content-length: 33
< content-type: text/plain
< date: Tue, 07 Aug 2018 08:51:19 GMT
< server: envoy
< x-envoy-decorator-operation: apigateway.smhtest.svc.a1.uae:12344/*
<
Connection #0 to host apigateway.smhtest.svc.a1.uae left intact
UNAVAILABLE:Cluster not available

Not sure why the mixer checks are still applied after you changed configmap and istio-pilot. Can you try killing gateway pods and see if that helps? If it does work, then we have an issue with stale config in gateways. cc @nmittler @costinm

@kyessenov
I tried again, and found that it would take a few minutes to disable mixer checks after restarting istio-pilot.

Related to #7759 as well as pilot general slowness to push updates.

Do you mind closing this issue and opening up another one with some evidence / logs for the few minute delay after restarting pilot?

@kyessenov
No problem