88 lines
1.9 KiB
YAML
88 lines
1.9 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: nginx
|
|
namespace: mtls-b
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: nginx-config
|
|
namespace: mtls-b
|
|
data:
|
|
default.conf: "log_format mtls '$remote_addr \"$request\" status=$status '\n \
|
|
\ 'xfcc=\"$http_x_forwarded_client_cert\"';\naccess_log /dev/stdout\
|
|
\ mtls;\nserver {\n listen 8080;\n server_name _;\n default_type text/plain;\n\
|
|
\ location = /health { return 200 \"ok\\n\"; }\n location / {\n return 200\
|
|
\ \"backend=nginx-b\\nX-Forwarded-Client-Cert: $http_x_forwarded_client_cert\\\
|
|
n\";\n }\n}\n"
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: nginx
|
|
namespace: mtls-b
|
|
spec:
|
|
selector:
|
|
app: nginx
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: 8080
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: nginx
|
|
namespace: mtls-b
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: nginx
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: nginx
|
|
annotations:
|
|
proxy.istio.io/config: "holdApplicationUntilProxyStarts: true\nproxyMetadata:\n\
|
|
\ SECRET_TTL: \"10m\"\n"
|
|
spec:
|
|
serviceAccountName: nginx
|
|
containers:
|
|
- name: nginx
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/nginx:1.27-alpine
|
|
ports:
|
|
- containerPort: 8080
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8080
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 3
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/conf.d
|
|
readOnly: true
|
|
- name: curl
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/curl
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
args:
|
|
- while true; do sleep 3600; done
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: nginx-config
|
|
|
|
---
|
|
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: default
|
|
namespace: mtls-b
|
|
spec:
|
|
mtls:
|
|
mode: STRICT |