istio improvements

testapp/srv/srv-v1-istio.yaml

@@ -1,3 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: testapp-srv
+  namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,9 +23,17 @@ spec:
         app: testapp-srv
         version: v1
     spec:
+      serviceAccountName: testapp-srv
       containers:
-      - name: testapp-srv
+      - name: srv
         image: 127.0.0.1:5000/testapp/srv:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -28,6 +42,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: testapp-srv
+  labels:
+    app: testapp-srv
 spec:
   type: ClusterIP
   ports:
@@ -50,6 +66,22 @@ spec:
       protocol: HTTP
     hosts:
     - "k8s-testapp.example.com"
+  - port:
+      number: 443
+      name: https
+      protocol: HTTPS
+    hosts:
+    - "k8s-testapp.example.com"
+    tls:
+      mode: SIMPLE
+      serverCertificate: "sds"
+      privateKey: "sds"
+      credentialName: "k8s-testapp-cert"
+      minProtocolVersion: 3 #TLSv1_2
+      cipherSuites:
+      - ECDHE-RSA-CHACHA20-POLY1305
+      - ECDHE-RSA-AES256-GCM-SHA384
+      - ECDHE-RSA-AES128-GCM-SHA256
 ---
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
@@ -61,7 +93,25 @@ spec:
   hosts:
   - "k8s-testapp.example.com"
   http:
-  - route:
+  - match:
+    - port: 80
+      uri:
+        prefix: "/.well-known/acme-challenge"
+    route:
+    - destination:
+        port:
+          number: 8089
+        host: k8s-testapp-cert.istio-system.svc.cluster.local
+  - match:
+    - port: 80
+    route:
+    - destination:
+        port:
+          number: 80
+        host: redirect.redirect.svc.cluster.local
+  - match:
+    - port: 443
+    route:
     - destination:
         port:
           number: 8080

testapp/srv/srv-v1.yaml

@@ -20,6 +20,13 @@ spec:
       containers:
       - name: testapp-srv
         image: 127.0.0.1:5000/testapp/srv:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -28,6 +35,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: testapp-srv
+  labels:
+    app: testapp-srv
 spec:
   type: ClusterIP
   ports:
@@ -36,7 +45,6 @@ spec:
   selector:
     app: testapp-srv
 ---
----
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata: