Listing 1: targetRef im Ambient Mode

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-frontend
namespace: demo
spec:
targetRef:
group: ""
kind: Service
name: api-service
action: ALLOW
rules:
- from:
- source:
principals:
- cluster.local/ns/demo/sa/frontend


Listing 2: Demoanwendung aufbauen

apiVersion: apps/v1
kind: Deployment
metadata:
name: api-v1
namespace: demo
spec:
replicas: 2
selector:
matchLabels: {app: api-service, version: v1}
template:
metadata:
labels: {app: api-service, version: v1}
spec:
serviceAccountName: api-service
containers:
- name: api
image: hashicorp/http-echo
args: ["-text=v1", "-listen=:80"]
ports: [{containerPort: 80}]
api-v2: identisch, args: ["-text=v2", "-listen=:80"]


Listing 3: Auszug aus l4-policy.yaml

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-client
namespace: demo
spec:
targetRef:
group: ""
kind: Service
name: api-service
action: ALLOW
rules:
from:
source:
principals: ["cluster.local/ns/demo/sa/client"]


Listing 4: Routing-Regeln in canary-routing.yaml

spec:
hosts: [api-service]
http:
Requests mit Header "x-canary: true" immer
auf v2
match:
headers:
x-canary: {exact: "true"}
route:
destination: {host: api-service, subset: v2}
Normaler Traffic: 90% v1, 10% v2 - unabhängig
von Pod-Anzahl
route:
destination: {host: api-service, subset: v1}
weight: 90
destination: {host: api-service, subset: v2}
weight: 10


Listing 5: targetRef in l7-policy.yaml

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: deny-non-get
namespace: demo
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway # Waypoint, nicht Service
name: waypoint
action: DENY
rules:
to:
operation:
methods: ["POST", "PUT", "DELETE", "PATCH"]
ports: ["80]