apiVersion: v1
kind: ServiceAccount
metadata:
  name: testapp-srv
  namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: testapp-srv
  labels:
    app: testapp-srv
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: testapp-srv
      version: v1
  template:
    metadata:
      labels:
        app: testapp-srv
        version: v1
    spec:
      serviceAccountName: testapp-srv
      containers:
      - name: srv
        image: 127.0.0.1:5000/testapp/srv:v1
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 64Mi
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: testapp-srv
  labels:
    app: testapp-srv
spec:
  type: ClusterIP
  ports:
  - name: http
    port: 8080
  selector:
    app: testapp-srv
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: testapp-srv
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "k8s-testapp.example.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "k8s-testapp.example.com"
    tls:
      mode: SIMPLE
      serverCertificate: "sds"
      privateKey: "sds"
      credentialName: "k8s-testapp-cert"
      minProtocolVersion: 3 #TLSv1_2
      cipherSuites:
      - ECDHE-RSA-CHACHA20-POLY1305
      - ECDHE-RSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES128-GCM-SHA256
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: testapp-srv
spec:
  gateways:
  - testapp-srv
  hosts:
  - "k8s-testapp.example.com"
  http:
  - match:
    - port: 80
      uri:
        prefix: "/.well-known/acme-challenge"
    route:
    - destination:
        port:
          number: 8089
        host: k8s-testapp-cert.istio-system.svc.cluster.local
  - match:
    - port: 80
    route:
    - destination:
        port:
          number: 80
        host: redirect.redirect.svc.cluster.local
  - match:
    - port: 443
    route:
    - destination:
        port:
          number: 8080
        host: testapp-srv.default.svc.cluster.local