Add Istio mTLS check manifests to uralkal cluster

clusters/uralkal/kustomization.yaml

@@ -55,6 +55,7 @@ resources:
   - ../../apps/message-hub/uralkal
   - ../../apps/cde/uralkal
   - ../../apps/postgres-tls-test/uralkal
+  - ../../infrastructure/istio-mtls-check/base
 
 patches:
   - target:

infrastructure/istio-mtls-check/base/00-namespaces.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mtls-a
+  labels:
+    istio-injection: enabled
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mtls-b
+  labels:
+    istio-injection: enabled

infrastructure/istio-mtls-check/base/10-mtls-b.yaml

@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nginx
+  namespace: mtls-b
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-config
+  namespace: mtls-b
+data:
+  default.conf: "log_format mtls '$remote_addr \"$request\" status=$status '\n   \
+    \             'xfcc=\"$http_x_forwarded_client_cert\"';\naccess_log /dev/stdout\
+    \ mtls;\nserver {\n  listen 8080;\n  server_name _;\n  default_type text/plain;\n\
+    \  location = /health { return 200 \"ok\\n\"; }\n  location / {\n    return 200\
+    \ \"backend=nginx-b\\nX-Forwarded-Client-Cert: $http_x_forwarded_client_cert\\\
+    n\";\n  }\n}\n"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  namespace: mtls-b
+spec:
+  selector:
+    app: nginx
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+#---
+#apiVersion: apps/v1
+#kind: Deployment
+#metadata:
+#  name: nginx
+#  namespace: mtls-b
+#spec:
+#  replicas: 1
+#  selector:
+#    matchLabels:
+#      app: nginx
+#  template:
+#    metadata:
+#      labels:
+#        app: nginx
+#      annotations:
+#        proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\
+#          \  SECRET_TTL: \"10m\"\n"
+#    spec:
+#      serviceAccountName: nginx
+#      containers:
+#      - name: nginx
+#        image: nginx:demo-placeholder
+#        ports:
+#        - containerPort: 8080
+#        readinessProbe:
+#          httpGet:
+#            path: /health
+#            port: 8080
+#          initialDelaySeconds: 2
+#          periodSeconds: 3
+#        volumeMounts:
+#        - name: config
+#          mountPath: /etc/nginx/conf.d
+#          readOnly: true
+#      - name: curl
+#        image: curlimages/curl:demo-placeholder
+#        command:
+#        - /bin/sh
+#        - -c
+#        args:
+#        - while true; do sleep 3600; done
+#      volumes:
+#      - name: config
+#        configMap:
+#          name: nginx-config
+
+---
+
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: mtls-b
+spec:
+  mtls:
+    mode: STRICT

infrastructure/istio-mtls-check/base/20-mtls-a.yaml

@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nginx
+  namespace: mtls-a
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-config
+  namespace: mtls-a
+data:
+  default.conf: "server {\n  listen 8080;\n  server_name _;\n  default_type text/plain;\n\
+    \  location = /health { return 200 \"ok\\n\"; }\n  location / {\n    proxy_pass\
+    \ http://nginx.mtls-b.svc.cluster.local:8080;\n    proxy_http_version 1.1;\n \
+    \   proxy_set_header Connection \"\";\n  }\n}\n"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  namespace: mtls-a
+spec:
+  selector:
+    app: nginx
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+#---
+#apiVersion: apps/v1
+#kind: Deployment
+#metadata:
+#  name: nginx
+#  namespace: mtls-a
+#spec:
+#  replicas: 1
+#  selector:
+#    matchLabels:
+#      app: nginx
+#  template:
+#    metadata:
+#      labels:
+#        app: nginx
+#      annotations:
+#        proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\
+#          \  SECRET_TTL: \"10m\"\n"
+#    spec:
+#      serviceAccountName: nginx
+#      containers:
+#      - name: nginx
+#        image: nginx:demo-placeholder
+#        ports:
+#        - containerPort: 8080
+#        readinessProbe:
+#          httpGet:
+#            path: /health
+#            port: 8080
+#          initialDelaySeconds: 2
+#          periodSeconds: 3
+#        volumeMounts:
+#        - name: config
+#          mountPath: /etc/nginx/conf.d
+#          readOnly: true
+#      - name: curl
+#        image: curlimages/curl:demo-placeholder
+#        command:
+#        - /bin/sh
+#        - -c
+#        args:
+#        - while true; do sleep 3600; done
+#      volumes:
+#      - name: config
+#        configMap:
+#          name: nginx-config
+
+---
+
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: mtls-a
+spec:
+  mtls:
+    mode: STRICT

infrastructure/istio-mtls-check/base/30-plain-client.yaml

@@ -0,0 +1,16 @@
+#apiVersion: v1
+#kind: Pod
+#metadata:
+#  name: plain-client
+#  namespace: mtls-a
+#  labels:
+#    sidecar.istio.io/inject: 'false'
+#spec:
+#  containers:
+#  - name: curl
+#    image: curlimages/curl:demo-placeholder
+#    command:
+#    - /bin/sh
+#    - -c
+#    args:
+#    - while true; do sleep 3600; done

infrastructure/istio-mtls-check/base/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - 00-namespaces.yaml
+  - 10-mtls-b.yaml
+  - 20-mtls-a.yaml
+#  - 30-plain-client.yaml