diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml index 495a424..0c5a4f4 100644 --- a/clusters/uralkal/kustomization.yaml +++ b/clusters/uralkal/kustomization.yaml @@ -55,6 +55,7 @@ resources: - ../../apps/message-hub/uralkal - ../../apps/cde/uralkal - ../../apps/postgres-tls-test/uralkal + - ../../infrastructure/istio-mtls-check/base patches: - target: diff --git a/infrastructure/istio-mtls-check/base/00-namespaces.yaml b/infrastructure/istio-mtls-check/base/00-namespaces.yaml new file mode 100644 index 0000000..f3e9831 --- /dev/null +++ b/infrastructure/istio-mtls-check/base/00-namespaces.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: mtls-a + labels: + istio-injection: enabled +--- +apiVersion: v1 +kind: Namespace +metadata: + name: mtls-b + labels: + istio-injection: enabled diff --git a/infrastructure/istio-mtls-check/base/10-mtls-b.yaml b/infrastructure/istio-mtls-check/base/10-mtls-b.yaml new file mode 100644 index 0000000..fc5f435 --- /dev/null +++ b/infrastructure/istio-mtls-check/base/10-mtls-b.yaml @@ -0,0 +1,88 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: nginx + namespace: mtls-b +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-config + namespace: mtls-b +data: + default.conf: "log_format mtls '$remote_addr \"$request\" status=$status '\n \ + \ 'xfcc=\"$http_x_forwarded_client_cert\"';\naccess_log /dev/stdout\ + \ mtls;\nserver {\n listen 8080;\n server_name _;\n default_type text/plain;\n\ + \ location = /health { return 200 \"ok\\n\"; }\n location / {\n return 200\ + \ \"backend=nginx-b\\nX-Forwarded-Client-Cert: $http_x_forwarded_client_cert\\\ + n\";\n }\n}\n" +--- +apiVersion: v1 +kind: Service +metadata: + name: nginx + namespace: mtls-b +spec: + selector: + app: nginx + ports: + - name: http + port: 8080 + targetPort: 8080 +#--- +#apiVersion: apps/v1 +#kind: Deployment +#metadata: +# name: nginx +# namespace: mtls-b +#spec: +# replicas: 1 +# selector: +# matchLabels: +# app: nginx +# template: +# metadata: +# labels: +# app: nginx +# annotations: +# proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\ +# \ SECRET_TTL: \"10m\"\n" +# spec: +# serviceAccountName: nginx +# containers: +# - name: nginx +# image: nginx:demo-placeholder +# ports: +# - containerPort: 8080 +# readinessProbe: +# httpGet: +# path: /health +# port: 8080 +# initialDelaySeconds: 2 +# periodSeconds: 3 +# volumeMounts: +# - name: config +# mountPath: /etc/nginx/conf.d +# readOnly: true +# - name: curl +# image: curlimages/curl:demo-placeholder +# command: +# - /bin/sh +# - -c +# args: +# - while true; do sleep 3600; done +# volumes: +# - name: config +# configMap: +# name: nginx-config + +--- + +apiVersion: security.istio.io/v1 +kind: PeerAuthentication +metadata: + name: default + namespace: mtls-b +spec: + mtls: + mode: STRICT \ No newline at end of file diff --git a/infrastructure/istio-mtls-check/base/20-mtls-a.yaml b/infrastructure/istio-mtls-check/base/20-mtls-a.yaml new file mode 100644 index 0000000..d2e64ee --- /dev/null +++ b/infrastructure/istio-mtls-check/base/20-mtls-a.yaml @@ -0,0 +1,86 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: nginx + namespace: mtls-a +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-config + namespace: mtls-a +data: + default.conf: "server {\n listen 8080;\n server_name _;\n default_type text/plain;\n\ + \ location = /health { return 200 \"ok\\n\"; }\n location / {\n proxy_pass\ + \ http://nginx.mtls-b.svc.cluster.local:8080;\n proxy_http_version 1.1;\n \ + \ proxy_set_header Connection \"\";\n }\n}\n" +--- +apiVersion: v1 +kind: Service +metadata: + name: nginx + namespace: mtls-a +spec: + selector: + app: nginx + ports: + - name: http + port: 8080 + targetPort: 8080 +#--- +#apiVersion: apps/v1 +#kind: Deployment +#metadata: +# name: nginx +# namespace: mtls-a +#spec: +# replicas: 1 +# selector: +# matchLabels: +# app: nginx +# template: +# metadata: +# labels: +# app: nginx +# annotations: +# proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\ +# \ SECRET_TTL: \"10m\"\n" +# spec: +# serviceAccountName: nginx +# containers: +# - name: nginx +# image: nginx:demo-placeholder +# ports: +# - containerPort: 8080 +# readinessProbe: +# httpGet: +# path: /health +# port: 8080 +# initialDelaySeconds: 2 +# periodSeconds: 3 +# volumeMounts: +# - name: config +# mountPath: /etc/nginx/conf.d +# readOnly: true +# - name: curl +# image: curlimages/curl:demo-placeholder +# command: +# - /bin/sh +# - -c +# args: +# - while true; do sleep 3600; done +# volumes: +# - name: config +# configMap: +# name: nginx-config + +--- + +apiVersion: security.istio.io/v1 +kind: PeerAuthentication +metadata: + name: default + namespace: mtls-a +spec: + mtls: + mode: STRICT \ No newline at end of file diff --git a/infrastructure/istio-mtls-check/base/30-plain-client.yaml b/infrastructure/istio-mtls-check/base/30-plain-client.yaml new file mode 100644 index 0000000..34a90a9 --- /dev/null +++ b/infrastructure/istio-mtls-check/base/30-plain-client.yaml @@ -0,0 +1,16 @@ +#apiVersion: v1 +#kind: Pod +#metadata: +# name: plain-client +# namespace: mtls-a +# labels: +# sidecar.istio.io/inject: 'false' +#spec: +# containers: +# - name: curl +# image: curlimages/curl:demo-placeholder +# command: +# - /bin/sh +# - -c +# args: +# - while true; do sleep 3600; done diff --git a/infrastructure/istio-mtls-check/base/kustomization.yaml b/infrastructure/istio-mtls-check/base/kustomization.yaml new file mode 100644 index 0000000..fbc1a9a --- /dev/null +++ b/infrastructure/istio-mtls-check/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - 00-namespaces.yaml + - 10-mtls-b.yaml + - 20-mtls-a.yaml +# - 30-plain-client.yaml