istio improvements

testapp/istio/api-role.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-api.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  subjects:
+  - user: "cluster.local/ns/default/sa/testapp-srv"
+  - user: "cluster.local/ns/default/sa/testapp-db"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-api
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  host: testapp-api.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/cluster-rbac.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ClusterRbacConfig
+metadata:
+  name: default
+spec:
+  mode: 'ON_WITH_INCLUSION'
+  inclusion:
+    namespaces: ["default", "redirect"]
+    #services: ["istio-egressgateway.istio-system.svc.cluster.local"]

testapp/istio/db-role.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-db.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  subjects:
+  - user: "cluster.local/ns/default/sa/testapp-srv"
+  - user: "cluster.local/ns/default/sa/testapp-api"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-db
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  host: testapp-db.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/mtls.yaml

@@ -0,0 +1,62 @@
+apiVersion: authentication.istio.io/v1alpha1
+kind: MeshPolicy
+metadata:
+  name: default
+spec:
+  peers:
+  - mtls: {}
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  host: "*.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: api-server
+ namespace: istio-system
+spec:
+ host: "kubernetes.default.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: rook
+ namespace: istio-system
+spec:
+ host: "*.rook-ceph.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: kiali
+ namespace: istio-system
+spec:
+ host: "kiali.istio-system.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: k8s-testapp-cert
+ namespace: istio-system
+spec:
+ host: "k8s-testapp-cert.istio-system.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE

testapp/istio/redirect-role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  rules:
+  - services: ["redirect.redirect.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  subjects:
+  - user: "*"
+  roleRef:
+    kind: ServiceRole
+    name: "redirect"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  host: redirect.redirect.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/srv-role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-srv.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  subjects:
+  - user: "*"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-srv
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  host: testapp-srv.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL