Add OpenFaaS Istio mTLS and policies

deploy/auto-scaling/podinfo-dep.yaml

@@ -9,75 +9,41 @@ spec:
     metadata:
       labels:
         app: podinfo
+        #role: openfaas-system
       annotations:
         prometheus.io/scrape: 'true'
     spec:
       containers:
       - name: podinfod
-        image: stefanprodan/podinfo:0.0.9
-        imagePullPolicy: Always
+        image: quay.io/stefanprodan/podinfo:1.0.1
         command:
           - ./podinfo
-          - -port=9898
-          - -logtostderr=true
-          - -v=2
-        volumeMounts:
-          - name: metadata
-            mountPath: /etc/podinfod/metadata
-            readOnly: true
-          - name: resources
-            mountPath: /etc/podinfod/resources
-            readOnly: true
+          - --port=9898
+          - --level=debug
         ports:
-        - containerPort: 9898
+        - name: http
+          containerPort: 9898
           protocol: TCP
-        readinessProbe:
-          httpGet:
-            path: /readyz
-            port: 9898
-          initialDelaySeconds: 1
-          periodSeconds: 2
-          failureThreshold: 1
         livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 9898
-          initialDelaySeconds: 1
-          periodSeconds: 3
-          failureThreshold: 2
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - wget --quiet --tries=1 --spider http://localhost:9898/healthz || exit 1
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - wget --quiet --tries=1 --spider http://localhost:9898/readyz || exit 1
         resources:
           requests:
             memory: "32Mi"
             cpu: "10m"
-          limits:
-            memory: "256Mi"
-            cpu: "100m"
-      volumes:
-        - name: metadata
-          downwardAPI:
-            items:
-              - path: "labels"
-                fieldRef:
-                  fieldPath: metadata.labels
-              - path: "annotations"
-                fieldRef:
-                  fieldPath: metadata.annotations
-        - name: resources
-          downwardAPI:
-            items:
-              - path: "cpu_limit"
-                resourceFieldRef:
-                  containerName: podinfod
-                  resource: limits.cpu
-              - path: "cpu_request"
-                resourceFieldRef:
-                  containerName: podinfod
-                  resource: requests.cpu
-              - path: "mem_limit"
-                resourceFieldRef:
-                  containerName: podinfod
-                  resource: limits.memory
-              - path: "mem_request"
-                resourceFieldRef:
-                  containerName: podinfod
-                  resource: requests.memory
+        env:
+          - name: color
+            value: "blue"
+          - name: message
+            value: "Greetings from podinfo blue"
+          - name: backendURL
+            value: "http://podinfo-backend:9898/backend"

deploy/auto-scaling/podinfo-svc-clusterip.yaml

@@ -2,13 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: podinfo-clusterip
+  name: podinfo
   labels:
     app: podinfo
 spec:
   type: ClusterIP
   ports:
-    - port: 9898
+    - name: http
+      port: 9898
       targetPort: 9898
       protocol: TCP
   selector:

deploy/istio-system/openfaas-mtls.yaml

@@ -0,0 +1,51 @@
+apiVersion: authentication.istio.io/v1alpha1
+kind: Policy
+metadata:
+  name: default
+  namespace: openfaas
+spec:
+  peers:
+  - mtls: {}
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: default
+  namespace: openfaas
+spec:
+  host: "*.openfaas.svc.cluster.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: authentication.istio.io/v1alpha1
+kind: Policy
+metadata:
+  name: default
+  namespace: openfaas-fn
+spec:
+  peers:
+  - mtls: {}
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: default
+  namespace: openfaas-fn
+spec:
+  host: "*.openfaas-fn.svc.cluster.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: authentication.istio.io/v1alpha1
+kind: Policy
+metadata:
+  name: openfaas-permissive
+  namespace: openfaas
+spec:
+  targets:
+  - name: gateway
+  peers:
+  - mtls:
+      mode: PERMISSIVE

deploy/istio-system/openfaas-ns.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    istio-injection: enabled
+  name: openfaas
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    istio-injection: enabled
+  name: openfaas-fn

deploy/istio-system/openfaas-policies.yaml

@@ -0,0 +1,55 @@
+apiVersion: config.istio.io/v1alpha2
+kind: denier
+metadata:
+  name: denyhandler
+  namespace: openfaas
+spec:
+  status:
+    code: 7
+    message: Not allowed
+---
+apiVersion: config.istio.io/v1alpha2
+kind: checknothing
+metadata:
+  name: denyrequest
+  namespace: openfaas
+spec:
+---
+apiVersion: config.istio.io/v1alpha2
+kind: rule
+metadata:
+  name: denyopenfaasfn
+  namespace: openfaas
+spec:
+  match: destination.namespace == "openfaas" && source.namespace == "openfaas-fn" && source.labels["role"] != "openfaas-system"
+  actions:
+  - handler: denyhandler.denier
+    instances: [ denyrequest.checknothing ]
+---
+apiVersion: config.istio.io/v1alpha2
+kind: denier
+metadata:
+  name: denyhandler
+  namespace: openfaas-fn
+spec:
+  status:
+    code: 7
+    message: Not allowed
+---
+apiVersion: config.istio.io/v1alpha2
+kind: checknothing
+metadata:
+  name: denyrequest
+  namespace: openfaas-fn
+spec:
+---
+apiVersion: config.istio.io/v1alpha2
+kind: rule
+metadata:
+  name: denyopenfaasfn
+  namespace: openfaas-fn
+spec:
+  match: destination.namespace == "openfaas-fn" && source.namespace != "openfaas" && source.labels["role"] != "openfaas-system"
+  actions:
+  - handler: denyhandler.denier
+    instances: [ denyrequest.checknothing ]

deploy/istio-system/openfaas-virtual-service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: gateway
+  namespace: openfaas
+spec:
+  hosts:
+  - "openfaas.istio.weavedx.com"
+  gateways:
+  - public-gateway.istio-system.svc.cluster.local
+  http:
+  - route:
+    - destination:
+        host: gateway
+    timeout: 30s
+