apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: default-{{ .To.ServiceName }}
spec:
  targetRef:
    kind: Gateway
    group: gateway.networking.k8s.io
    name: {{ .To.ServiceName }}-gateway
  jwtRules:
  - issuer: "test-issuer-1@istio.io"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
  - issuer: "test-issuer-2@istio.io"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
---
apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: ignored-{{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: {{ .To.ServiceName }}-gateway # This would be ignored (not a targetRef) but the feature flag isn't on, so it's applied
  jwtRules:
  - issuer: "test-issuer-3@istio.io"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: authz-gateway-{{ .To.ServiceName }}
spec:
  targetRef:
    name: {{ .To.ServiceName }}-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
  rules:
  - to:
    - operation:
        hosts:
{{- range $svc := .Services }}
        - "example.{{ $svc.ServiceName }}.com"
{{- end }}
    from:
    - source:
        requestPrincipals: ["test-issuer-1@istio.io/sub-1"]
    - source:
        requestPrincipals: ["test-issuer-3@istio.io/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}
    from:
    - source:
        requestPrincipals: ["*"]
  - to:
    - operation:
        paths: ["/healthz"]
