GistPin/infrastructure/security/zero-trust/mtls-config.yaml at fix/gitignore-encoding · ghzhost/GistPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default-strict-mtls
  namespace: gistpin
spec:
  selector:
    matchLabels:
      app.kubernetes.io/part-of: gistpin
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: gistpin-mtls
  namespace: gistpin
spec:
  host: "*.gistpin.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
    loadBalancer:
      simple: ROUND_ROBIN
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: backend-api-allow
  namespace: gistpin
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - cluster.local/ns/gistpin/sa/frontend
              - cluster.local/ns/gistpin/sa/worker
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/*"]