apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx
  namespace: mtls-b
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: mtls-b
data:
  default.conf: "log_format mtls '$remote_addr \"$request\" status=$status '\n   \
    \             'xfcc=\"$http_x_forwarded_client_cert\"';\naccess_log /dev/stdout\
    \ mtls;\nserver {\n  listen 8080;\n  server_name _;\n  default_type text/plain;\n\
    \  location = /health { return 200 \"ok\\n\"; }\n  location / {\n    return 200\
    \ \"backend=nginx-b\\nX-Forwarded-Client-Cert: $http_x_forwarded_client_cert\\\
    n\";\n  }\n}\n"
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: mtls-b
spec:
  selector:
    app: nginx
  ports:
  - name: http
    port: 8080
    targetPort: 8080
#---
#apiVersion: apps/v1
#kind: Deployment
#metadata:
#  name: nginx
#  namespace: mtls-b
#spec:
#  replicas: 1
#  selector:
#    matchLabels:
#      app: nginx
#  template:
#    metadata:
#      labels:
#        app: nginx
#      annotations:
#        proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\
#          \  SECRET_TTL: \"10m\"\n"
#    spec:
#      serviceAccountName: nginx
#      containers:
#      - name: nginx
#        image: nginx:demo-placeholder
#        ports:
#        - containerPort: 8080
#        readinessProbe:
#          httpGet:
#            path: /health
#            port: 8080
#          initialDelaySeconds: 2
#          periodSeconds: 3
#        volumeMounts:
#        - name: config
#          mountPath: /etc/nginx/conf.d
#          readOnly: true
#      - name: curl
#        image: curlimages/curl:demo-placeholder
#        command:
#        - /bin/sh
#        - -c
#        args:
#        - while true; do sleep 3600; done
#      volumes:
#      - name: config
#        configMap:
#          name: nginx-config

---

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: mtls-b
spec:
  mtls:
    mode: STRICT