app-deployment-authc.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: customer-sa
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: preference-sa
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: recommendation-sa
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: customer
    version: v1
  name: customer
spec:
  replicas: 1
  selector:
    matchLabels:
      app: customer
  template:
    metadata:
      labels:
        app: customer
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - env:
        - name: JAVA_OPTIONS
          value: -Xms15m -Xmx15m -Xmn15m
        name: customer
        image: quay.io/redhattraining/ossm-customer:1.0
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8778
          name: jolokia
          protocol: TCP
        - containerPort: 9779
          name: prometheus
          protocol: TCP
      serviceAccountName: "customer-sa"
---
apiVersion: v1
kind: Service
metadata:
  name: customer
  labels:
    app: customer
spec:
  ports:
  - name: http
    port: 8080
  selector:
    app: customer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: preference
  name: preference
spec:
  replicas: 1
  selector:
    matchLabels:
      app: preference
  template:
    metadata:
      labels:
        app: preference
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - env:
        - name: JAVA_OPTIONS
          value: -Xms15m -Xmx15m -Xmn15m
        name: preference
        image: quay.io/redhattraining/ossm-preference:1.0
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8778
          name: jolokia
          protocol: TCP
        - containerPort: 9779
          name: prometheus
          protocol: TCP
      serviceAccountName: "preference-sa"
---
apiVersion: v1
kind: Service
metadata:
  name: preference
  labels:
    app: preference
spec:
  ports:
  - name: http
    port: 8080
  selector:
    app: preference
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: recommendation
  name: recommendation
spec:
  replicas: 1
  selector:
    matchLabels:
      app: recommendation
  template:
    metadata:
      labels:
        app: recommendation
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - env:
        - name: JAVA_OPTIONS
          value: -Xms15m -Xmx15m -Xmn15m
        name: recommendation
        image: quay.io/redhattraining/ossm-recommendation:1.0
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8778
          name: jolokia
          protocol: TCP
        - containerPort: 9779
          name: prometheus
          protocol: TCP
      serviceAccountName: "recommendation-sa"
---
apiVersion: v1
kind: Service
metadata:
  name: recommendation
  labels:
    app: recommendation
spec:
  ports:
  - name: http
    port: 8080
  selector:
    app: recommendation
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: customer-gateway-secure-authc
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: customer-vservice
spec:
  hosts:
  - "*"
  gateways:
  - customer-gateway-secure-authc
  http:
  - match:
    - uri:
        prefix: /secure-authc
    rewrite:
      uri: /
    route:
    - destination:
        host: customer
        port:
          number: 8080
---

curl-customer-policy.yaml

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "curl-get-customer"
  namespace: "secure-authc"
spec:
  selector:
    matchLabels:
      app: customer
  rules:
  - from:
    - source:
        namespaces: ["curl"]

customer-policy.yaml

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "get-customer"
spec:
  selector:
    matchLabels:
      app: customer
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"]
    to:
    - operation:
        methods: ["GET"]
        ports: ["8080"]

disable-mtls.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: secure-authc
spec:
  mtls:
    mode: DISABLE

preference-policy.yaml

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "get-preference"
spec:
  selector:
    matchLabels:
      app: preference
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/secure-authc/sa/customer-sa"]
    to:
    - operation:
        methods: ["GET"]
        ports: ["8080"]

recommendation-policy.yaml

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "get-recommendation"
spec:
  selector:
    matchLabels:
      app: recommendation
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/secure-authc/sa/preference-sa"]
    to:
    - operation:
        methods: ["GET"]
        ports: ["8080"]