istio improvements

loop.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-while true; do curl $1 2>/dev/null;sleep ${2:-1}; done
+while true; do curl -k -s -L $1 2>/dev/null;sleep ${2:-1}; done

testapp/api/api-v1-istio.yaml

@@ -1,3 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: testapp-api
+  namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,9 +23,17 @@ spec:
         app: testapp-api
         version: v1
     spec:
+      serviceAccountName: testapp-api
       containers:
       - name: testapp-api
         image: 127.0.0.1:5000/testapp/api:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -61,10 +75,15 @@ spec:
   servers:
   - port:
       number: 80
-      name: http
+      name: https
-      protocol: HTTP
+      protocol: HTTPS
     hosts:
     - httpbin.org
+    tls:
+      mode: MUTUAL
+      serverCertificate: /etc/certs/cert-chain.pem
+      privateKey: /etc/certs/key.pem
+      caCertificates: /etc/certs/root-cert.pem
 ---
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
@@ -74,11 +93,23 @@ spec:
   host: istio-egressgateway.istio-system.svc.cluster.local
   subsets:
   - name: httpbin
+    trafficPolicy:
+      loadBalancer:
+        simple: ROUND_ROBIN
+      portLevelSettings:
+      - port:
+          number: 80
+        tls:
+          mode: ISTIO_MUTUAL
+          sni: httpbin.org
+#  trafficPolicy:
+#    tls:
+#      mode: ISTIO_MUTUAL
 ---
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
-  name: httpbin-egress
+  name: httpbin
 spec:
   hosts:
   - httpbin.org

testapp/api/api-v1.yaml

@@ -20,6 +20,13 @@ spec:
       containers:
       - name: testapp-api
         image: 127.0.0.1:5000/testapp/api:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

testapp/db/db.yaml

@@ -1,3 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: testapp-db
+  namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,9 +23,17 @@ spec:
         app: testapp-db
         version: v1
     spec:
+      serviceAccountName: testapp-db
       containers:
       - name: testapp-db
         image: 127.0.0.1:5000/testapp/db:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

testapp/istio/api-role.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-api.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  subjects:
+  - user: "cluster.local/ns/default/sa/testapp-srv"
+  - user: "cluster.local/ns/default/sa/testapp-db"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-api
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-api
+  namespace: default
+spec:
+  host: testapp-api.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/cluster-rbac.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ClusterRbacConfig
+metadata:
+  name: default
+spec:
+  mode: 'ON_WITH_INCLUSION'
+  inclusion:
+    namespaces: ["default", "redirect"]
+    #services: ["istio-egressgateway.istio-system.svc.cluster.local"]

testapp/istio/db-role.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-db.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  subjects:
+  - user: "cluster.local/ns/default/sa/testapp-srv"
+  - user: "cluster.local/ns/default/sa/testapp-api"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-db
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-db
+  namespace: default
+spec:
+  host: testapp-db.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/mtls.yaml

@@ -0,0 +1,62 @@
+apiVersion: authentication.istio.io/v1alpha1
+kind: MeshPolicy
+metadata:
+  name: default
+spec:
+  peers:
+  - mtls: {}
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  host: "*.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: api-server
+ namespace: istio-system
+spec:
+ host: "kubernetes.default.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: rook
+ namespace: istio-system
+spec:
+ host: "*.rook-ceph.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: kiali
+ namespace: istio-system
+spec:
+ host: "kiali.istio-system.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: k8s-testapp-cert
+ namespace: istio-system
+spec:
+ host: "k8s-testapp-cert.istio-system.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE

testapp/istio/redirect-role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  rules:
+  - services: ["redirect.redirect.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  subjects:
+  - user: "*"
+  roleRef:
+    kind: ServiceRole
+    name: "redirect"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: redirect
+  namespace: redirect
+spec:
+  host: redirect.redirect.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/istio/srv-role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRole
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  rules:
+  - services: ["testapp-srv.default.svc.cluster.local"]
+---
+apiVersion: rbac.istio.io/v1alpha1
+kind: ServiceRoleBinding
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  subjects:
+  - user: "*"
+  roleRef:
+    kind: ServiceRole
+    name: testapp-srv
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: testapp-srv
+  namespace: default
+spec:
+  host: testapp-srv.default.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

testapp/redirect/redirect.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: redirect
+  namespace: redirect
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-config
+  namespace: redirect
+data:
+  nginx.conf: |
+    server {
+      listen 80 default_server;
+      server_name _;
+      return 301 https://$host$request_uri;
+    }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redirect
+  namespace: redirect
+  labels:
+    app: redirect
+spec:
+  ports:
+  - port: 80
+    name: http
+  selector:
+    app: redirect
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redirect
+  namespace: redirect
+  labels:
+    app: redirect
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redirect
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: redirect
+        version: v1
+    spec:
+      serviceAccountName: redirect
+      containers:
+      - name: redirect
+        image: nginx:stable
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - mountPath: /etc/nginx/conf.d
+          name: config
+      volumes:
+      - name: config
+        configMap:
+          name: nginx-config

testapp/srv/srv-v1-istio.yaml

@@ -1,3 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: testapp-srv
+  namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,9 +23,17 @@ spec:
         app: testapp-srv
         version: v1
     spec:
+      serviceAccountName: testapp-srv
       containers:
-      - name: testapp-srv
+      - name: srv
         image: 127.0.0.1:5000/testapp/srv:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -28,6 +42,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: testapp-srv
+  labels:
+    app: testapp-srv
 spec:
   type: ClusterIP
   ports:
@@ -50,6 +66,22 @@ spec:
       protocol: HTTP
     hosts:
     - "k8s-testapp.example.com"
+  - port:
+      number: 443
+      name: https
+      protocol: HTTPS
+    hosts:
+    - "k8s-testapp.example.com"
+    tls:
+      mode: SIMPLE
+      serverCertificate: "sds"
+      privateKey: "sds"
+      credentialName: "k8s-testapp-cert"
+      minProtocolVersion: 3 #TLSv1_2
+      cipherSuites:
+      - ECDHE-RSA-CHACHA20-POLY1305
+      - ECDHE-RSA-AES256-GCM-SHA384
+      - ECDHE-RSA-AES128-GCM-SHA256
 ---
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
@@ -61,7 +93,25 @@ spec:
   hosts:
   - "k8s-testapp.example.com"
   http:
-  - route:
+  - match:
+    - port: 80
+      uri:
+        prefix: "/.well-known/acme-challenge"
+    route:
+    - destination:
+        port:
+          number: 8089
+        host: k8s-testapp-cert.istio-system.svc.cluster.local
+  - match:
+    - port: 80
+    route:
+    - destination:
+        port:
+          number: 80
+        host: redirect.redirect.svc.cluster.local
+  - match:
+    - port: 443
+    route:
     - destination:
         port:
           number: 8080

testapp/srv/srv-v1.yaml

@@ -20,6 +20,13 @@ spec:
       containers:
       - name: testapp-srv
         image: 127.0.0.1:5000/testapp/srv:v1
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -28,6 +35,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: testapp-srv
+  labels:
+    app: testapp-srv
 spec:
   type: ClusterIP
   ports:
@@ -36,7 +45,6 @@ spec:
   selector:
     app: testapp-srv
 ---
----
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata: