apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx
  namespace: mtls-a
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: mtls-a
data:
  default.conf: "server {\n  listen 8080;\n  server_name _;\n  default_type text/plain;\n\
    \  location = /health { return 200 \"ok\\n\"; }\n  location / {\n    proxy_pass\
    \ http://nginx.mtls-b.svc.cluster.local:8080;\n    proxy_http_version 1.1;\n \
    \   proxy_set_header Connection \"\";\n  }\n}\n"
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: mtls-a
spec:
  selector:
    app: nginx
  ports:
  - name: http
    port: 8080
    targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: mtls-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
      annotations:
        proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\
          \  SECRET_TTL: \"10m\"\n"
    spec:
      serviceAccountName: nginx
      containers:
      - name: nginx
        image: cr.yandex/crp3ccidau046kdj8g9q/nginx:1.27-alpine
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 2
          periodSeconds: 3
        volumeMounts:
        - name: config
          mountPath: /etc/nginx/conf.d
          readOnly: true
      - name: curl
        image: cr.yandex/crp3ccidau046kdj8g9q/curl
        command:
        - /bin/sh
        - -c
        args:
        - while true; do sleep 3600; done
      volumes:
      - name: config
        configMap:
          name: nginx-config

---

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: mtls-a
spec:
  mtls:
    mode: STRICT