# T90 combined manifests — double-mTLS egress via dedicated gateway
# imperative pieces (PKI, configmap, secret) are in run.sh
# --- partner (out of mesh, istio-verify-ext) ---
# "External partner" requiring client certs — OUT of mesh (istio-verify-ext, no injection)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dmtls-partner
  namespace: istio-verify-ext
  labels: { app: dmtls-partner, test: t90 }
spec:
  replicas: 1
  selector: { matchLabels: { app: dmtls-partner } }
  template:
    metadata:
      labels: { app: dmtls-partner }
    spec:
      containers:
      - name: nginx
        image: nginx:1.27-alpine
        command: ["nginx", "-c", "/etc/dmtls/nginx.conf", "-g", "daemon off;"]
        ports: [{ containerPort: 8443 }]
        volumeMounts:
        - { name: dmtls, mountPath: /etc/dmtls, readOnly: true }
      volumes:
      - name: dmtls
        configMap: { name: dmtls-partner }
---
apiVersion: v1
kind: Service
metadata:
  name: dmtls-partner
  namespace: istio-verify-ext
  labels: { app: dmtls-partner, test: t90 }
spec:
  selector: { app: dmtls-partner }
  ports:
  - { name: https, port: 443, targetPort: 8443 }
---
# --- test ns + workloads (applied via istioctl kube-inject due to webhook outage; normal injection also valid) ---
apiVersion: v1
kind: Namespace
metadata:
  name: istio-vt-t90
  labels: { istio-injection: enabled, test: t90 }
---
# sidecar-injected client (client certs mounted only for out-of-band partner sanity check)
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: istio-vt-t90
  labels: { app: client }
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
    volumeMounts:
    - { name: certs, mountPath: /certs, readOnly: true }
  volumes:
  - name: certs
    secret: { secretName: dmtls-partner-client-cred }
---
# DEDICATED egress gateway via Istio gateway injection template (NOT the shared istio-egressgateway)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dmtls-egress
  namespace: istio-vt-t90
spec:
  replicas: 1
  selector: { matchLabels: { istio: dmtls-egress } }
  template:
    metadata:
      annotations:
        inject.istio.io/templates: gateway
      labels:
        istio: dmtls-egress
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: istio-proxy
        image: auto
---
apiVersion: v1
kind: Service
metadata:
  name: dmtls-egress
  namespace: istio-vt-t90
spec:
  selector: { istio: dmtls-egress }
  ports:
  - { name: https, port: 8443, targetPort: 8443 }
---
# --- SDS RBAC for dedicated gateway SA (REQUIRED for credentialName outside istio-system) ---
# Required for credentialName SDS on a dedicated gateway outside istio-system:
# istiod authorizes secret access via SubjectAccessReview against the gateway pod's SA.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: dmtls-egress-sds, namespace: istio-vt-t90 }
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: dmtls-egress-sds, namespace: istio-vt-t90 }
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: dmtls-egress-sds }
subjects:
- kind: ServiceAccount
  name: default
  namespace: istio-vt-t90
---
# T90 wiring — double-mTLS egress via DEDICATED gateway (guide adaptation)
# registry domain empirically = homelab.local (istiod --domain homelab.local since 2026-07-05 04:40Z)
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata: { name: dmtls-partner-se, namespace: istio-vt-t90 }
spec:
  hosts: [api.partner.example]
  exportTo: ["."]
  location: MESH_EXTERNAL
  resolution: DNS
  ports:
  - { number: 80,  name: http, protocol: HTTP }
  - { number: 443, name: tls,  protocol: TLS }
  endpoints:
  - address: dmtls-partner.istio-verify-ext.svc.homelab.local
    ports: { http: 443, tls: 443 }   # both SE ports land on the partner's TLS service port
---
# hop1 server half: dedicated gateway terminates ISTIO_MUTUAL on container port 8443
apiVersion: networking.istio.io/v1
kind: Gateway
metadata: { name: dmtls-egress-gw, namespace: istio-vt-t90 }
spec:
  selector: { istio: dmtls-egress }
  servers:
  - port: { number: 8443, name: https-partner, protocol: HTTPS }
    hosts: [api.partner.example]
    tls: { mode: ISTIO_MUTUAL }
---
# DR-hop1: client sidecar -> dedicated gateway, mesh mTLS (compiles into CLIENT sidecar cluster)
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: dmtls-egress-hop1, namespace: istio-vt-t90 }
spec:
  host: dmtls-egress.istio-vt-t90.svc.homelab.local
  subsets:
  - name: partner
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
        sni: api.partner.example
      connectionPool:
        tcp:
          maxConnections: 77
          connectTimeout: 3s
          tcpKeepalive: { time: 300s, interval: 30s, probes: 3 }
---
# DR-hop2: gateway -> external partner, MUTUAL + credentialName (compiles into GATEWAY cluster)
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: dmtls-partner-originate, namespace: istio-vt-t90 }
spec:
  host: api.partner.example
  exportTo: ["."]
  trafficPolicy:
    portLevelSettings:
    - port: { number: 443 }
      tls:
        mode: MUTUAL
        credentialName: dmtls-partner-client-cred   # k8s secret in gateway ns (istio-vt-t90)
        sni: api.partner.example
        subjectAltNames: [api.partner.example]
      connectionPool:
        tcp:
          maxConnections: 83
          connectTimeout: 3s
          tcpKeepalive: { time: 300s, interval: 30s, probes: 3 }
---
# VS: hop1 (mesh :80 -> gateway svc :8443) + hop2 (gateway :8443 -> external :443)
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: dmtls-partner-via-egress, namespace: istio-vt-t90 }
spec:
  hosts: [api.partner.example]
  gateways: [mesh, istio-vt-t90/dmtls-egress-gw]
  exportTo: ["."]
  http:
  - match:
    - gateways: [mesh]
      port: 80
    route:
    - destination:
        host: dmtls-egress.istio-vt-t90.svc.homelab.local
        subset: partner
        port: { number: 8443 }
  - match:
    - gateways: [istio-vt-t90/dmtls-egress-gw]
      port: 8443
    route:
    - destination:
        host: api.partner.example
        port: { number: 443 }
