fai555

"""
This script uses RSA public/private key pair generated using Openssl command line tool.
The series of steps are listed below

1. Import openssl generated public/private key pair
3. Generate the Token using the Private key from step 1
4. Validate the JWT Token using the Public key from step 1

"""
# ______________________________ Step 0 ______________________________________

fai555

kubectl apply -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: "jwt-example"
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway

fai555

# Create a namespace with istio sidecar injection inabled
kubectl create -f namespace.yaml

# Install Elasticsearch, Kibana, ApmServer
kubectl create -f eck.yaml

# Install Fluent Bit Service Account
kubectl create -f fluent-bit-service-account.yaml
# Install Fluent Bit Cluster Role
kubectl create -f fluent-bit-role.yaml

fai555

kubectl create ns foo
kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n foo
kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) -n foo

kubectl create ns bar
kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n bar
kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) -n bar

kubectl create ns legacy
kubectl apply -f samples/httpbin/httpbin.yaml -n legacy

fai555

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: foo
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:

fai555

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
  namespace: foo
spec:
  hosts:
  - "*"
  gateways:

fai555

kubectl apply -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: "jwt-example"
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway

fai555

kubectl apply -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "frontend-ingress"
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway

fai555

kubectl apply -f - <<EOF

apiVersion: v1
kind: Service
metadata:
  name: helloworld
  namespace: istio-test
  labels:
    app: helloworld
spec:

fai555

kubectl apply -f - <<EOF

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: helloworld-gateway
  namespace: istio-test
spec:
  selector:
    istio: ingressgateway # use istio default controller