Gaurav Agarwal bharatmicrosystems
😀
bharatmicrosystems
/ allow-foo.yaml
Created
May 6, 2020 20:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: security.istio.io/v1beta1 | |
| kind: AuthorizationPolicy | |
| metadata: | |
| name: httpbin-deny | |
| namespace: foo | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: httpbin | |
| version: v1 |
bharatmicrosystems
/ allow-get-head.yaml
Created
May 6, 2020 20:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: security.istio.io/v1beta1 | |
| kind: AuthorizationPolicy | |
| metadata: | |
| name: allow-read | |
| namespace: default | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: products | |
| action: ALLOW |
bharatmicrosystems
/ allow-url-paths.yaml
Created
May 6, 2020 20:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: security.istio.io/v1beta1 | |
| kind: AuthorizationPolicy | |
| metadata: | |
| name: tester | |
| namespace: default | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: products | |
| action: ALLOW |
bharatmicrosystems
/ test-legacy.sh
Created
May 9, 2020 14:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl "http://httpbin.${to}:8000/ip" -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done | |
| sleep.foo to httpbin.foo: 200 | |
| sleep.foo to httpbin.bar: 200 | |
| sleep.foo to httpbin.legacy: 200 | |
| sleep.bar to httpbin.foo: 200 | |
| sleep.bar to httpbin.bar: 200 | |
| sleep.bar to httpbin.legacy: 200 | |
| sleep.legacy to httpbin.foo: 200 | |
| sleep.legacy to httpbin.bar: 200 | |
| sleep.legacy to httpbin.legacy: 200 |
bharatmicrosystems
/ global-tls-strict.yaml
Created
May 9, 2020 14:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ kubectl apply -f - <<EOF | |
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "PeerAuthentication" | |
| metadata: | |
| name: "default" | |
| namespace: "istio-system" | |
| spec: | |
| mtls: | |
| mode: STRICT | |
| EOF |
bharatmicrosystems
/ test-global-strict.sh
Created
May 9, 2020 14:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl "http://httpbin.${to}:8000/ip" -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done | |
| sleep.foo to httpbin.foo: 200 | |
| sleep.foo to httpbin.bar: 200 | |
| sleep.foo to httpbin.legacy: 200 | |
| sleep.bar to httpbin.foo: 200 | |
| sleep.bar to httpbin.bar: 200 | |
| sleep.bar to httpbin.legacy: 200 | |
| sleep.legacy to httpbin.foo: 000 | |
| command terminated with exit code 56 | |
| sleep.legacy to httpbin.bar: 000 |
bharatmicrosystems
/ namespace-tls-strict.yaml
Created
May 9, 2020 14:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ kubectl apply -f - <<EOF | |
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "PeerAuthentication" | |
| metadata: | |
| name: "default" | |
| namespace: "foo" | |
| spec: | |
| mtls: | |
| mode: STRICT | |
| EOF |
bharatmicrosystems
/ test-namespace-strict.sh
Created
May 9, 2020 14:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl "http://httpbin.${to}:8000/ip" -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done | |
| sleep.foo to httpbin.foo: 200 | |
| sleep.foo to httpbin.bar: 200 | |
| sleep.foo to httpbin.legacy: 200 | |
| sleep.bar to httpbin.foo: 200 | |
| sleep.bar to httpbin.bar: 200 | |
| sleep.bar to httpbin.legacy: 200 | |
| sleep.legacy to httpbin.foo: 000 | |
| command terminated with exit code 56 | |
| sleep.legacy to httpbin.bar: 200 |
bharatmicrosystems
/ workload-tls-strict.yaml
Created
May 9, 2020 14:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ cat <<EOF | kubectl apply -n bar -f - | |
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "PeerAuthentication" | |
| metadata: | |
| name: "httpbin" | |
| namespace: "bar" | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: httpbin |
bharatmicrosystems
/ test-workload-strict.sh
Created
May 9, 2020 14:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl "http://httpbin.${to}:8000/ip" -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done | |
| sleep.foo to httpbin.foo: 200 | |
| sleep.foo to httpbin.bar: 200 | |
| sleep.foo to httpbin.legacy: 200 | |
| sleep.bar to httpbin.foo: 200 | |
| sleep.bar to httpbin.bar: 200 | |
| sleep.bar to httpbin.legacy: 200 | |
| sleep.legacy to httpbin.foo: 200 | |
| sleep.legacy to httpbin.bar: 000 | |
| command terminated with exit code 56 |