apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
  name: testapp-db
  namespace: default
spec:
  rules:
  - services: ["testapp-db.default.svc.cluster.local"]
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
  name: testapp-db
  namespace: default
spec:
  subjects:
  - user: "cluster.local/ns/default/sa/testapp-srv"
  - user: "cluster.local/ns/default/sa/testapp-api"
  roleRef:
    kind: ServiceRole
    name: testapp-db
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: testapp-db
  namespace: default
spec:
  host: testapp-db.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL