istio improvements

testapp/istio/api-role.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-api.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  subjects:
+  - user: "cluster.local/ns/default/sa/testapp-srv"
+  - user: "cluster.local/ns/default/sa/testapp-db"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-api
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  host: testapp-api.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL