apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: default
  namespace: {{ .SystemNamespace.Name }}
spec:
  jwtRules:
    - issuer: "test-issuer-1@istio.io"
      jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
    - issuer: "test-issuer-2@istio.io"
      jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: egressgateway
  namespace: {{ .SystemNamespace.Name }}
spec:
  selector:
    matchLabels:
      app: istio-egressgateway
  rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]
            hosts: [ "www.company.com" ]
    - to: # checks only a call 443 over istio mutual without JWT
        - operation:
            hosts: [ "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com" ]
      from:
        - source:
            principals: [ "{{ .Allowed.ServiceAccountName }}" ]
    - to: # checks workload can call 443 over istio mutual with JWT
        - operation:
            hosts: [ "jwt-only.com" ]
      from:
        - source:
            requestPrincipals: [ "test-issuer-1@istio.io/sub-1" ]
    - to: # checks only a can call 443 over istio mutual with JWT
        - operation:
            hosts: [ "jwt-and-{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com" ]
      from:
        - source:
            requestPrincipals: [ "test-issuer-1@istio.io/sub-1" ]
            principals: [ "{{ .Allowed.ServiceAccountName }}" ]
---
# The following policy redirects the request through egress gateway.

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: test-egress
  namespace: {{ .From.NamespaceName }}
spec:
  selector:
    istio: egressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "www.company.com"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: ISTIO_MUTUAL
      hosts:
        - "*"
---

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: route-via-egressgateway
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "www.company.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: "istio-egressgateway.{{ .SystemNamespace.Name }}.svc.cluster.local"
            port:
              number: 80
          weight: 100
    - match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: route-via-egressgateway-2
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
    - "jwt-only.com"
    - "jwt-and-{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: "istio-egressgateway.{{ .SystemNamespace.Name }}.svc.cluster.local"
            port:
              number: 443
          weight: 100
    - match:
        - gateways:
            - test-egress
          port: 443
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: test-egress
  namespace: {{ .From.NamespaceName }}
spec:
  host: "istio-egressgateway.{{ .SystemNamespace.Name }}.svc.cluster.local"
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: ISTIO_MUTUAL
---
# TODO(nmittler): Shouldn't need this. Workaround for https://github.com/istio/istio/issues/38704.
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: test-egress
  namespace: {{ .SystemNamespace.Name }}
spec:
  host: "istio-egressgateway.{{ .SystemNamespace.Name }}.svc.cluster.local"
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: ISTIO_MUTUAL
---
