🕸Istio & Service Mesh

# Step 1: Enable PERMISSIVE mesh-wide (allows both mTLS and plaintext)
# Use this first to verify all traffic switches to mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system   # mesh-wide scope
spec:
  mtls:
    mode: PERMISSIVE

---
# Step 2: After verifying no plaintext traffic in Kiali,
# switch to STRICT (breaks plaintext connections)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

---
# Namespace-level override (more granular)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: production-strict
  namespace: production
spec:
  mtls:
    mode: STRICT
  # Port-specific exception for health probes
  portLevelMtls:
    8080:
      mode: PERMISSIVE  # liveness probe from kubelet (no cert)

# Only payments-api service account can call fraud-service
# All other callers get 403 Forbidden
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: fraud-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: fraud-service
  action: ALLOW
  rules:
    - from:
        - source:
            # SPIFFE identity — cryptographic, not IP-based
            principals:
              - cluster.local/ns/production/sa/payments-api
      to:
        - operation:
            methods: ["POST"]
            paths: ["/v1/fraud/check"]

---
# Deny all ingress except from ingress gateway
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all-except-gateway
  namespace: production
spec:
  action: DENY
  rules:
    - from:
        - source:
            notPrincipals:
              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account

# Progressive canary: send 10% traffic to v2
# No DNS changes, no load balancer rules — pure Envoy routing
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: payments-api
  namespace: production
spec:
  hosts:
    - payments-api
  http:
    # Header-based testing: QA team always gets v2
    - match:
        - headers:
            x-canary-user:
              exact: "true"
      route:
        - destination:
            host: payments-api
            subset: v2
    # Weight-based: 90/10 split
    - route:
        - destination:
            host: payments-api
            subset: v1
          weight: 90
        - destination:
            host: payments-api
            subset: v2
          weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: payments-api
  namespace: production
spec:
  host: payments-api
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE

# Circuit breaker: eject unhealthy endpoints
# If >50% requests fail, eject host for 5 minutes
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: inventory-service
  namespace: production
spec:
  host: inventory-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 50
        http2MaxRequests: 100
        maxRetries: 3
    outlierDetection:
      # Eject if >5 errors in 30s consecutive interval
      consecutiveGatewayErrors: 5
      interval: 30s
      # Keep ejected for 5 minutes
      baseEjectionTime: 5m
      # Never eject more than 50% of endpoints
      maxEjectionPercent: 50
      # Also detect 5xx errors (not just gateway errors)
      consecutive5xxErrors: 10

# Chaos engineering: inject 500ms delay for 20% of requests
# Use this to test timeout handling before incidents happen
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: inventory-service-chaos
  namespace: production
spec:
  hosts:
    - inventory-service
  http:
    - fault:
        delay:
          percentage:
            value: 20.0
          fixedDelay: 500ms
        abort:
          percentage:
            value: 5.0   # 5% of requests return HTTP 503
          httpStatus: 503
      route:
        - destination:
            host: inventory-service

# Local rate limiting via EnvoyFilter
# Limits: 100 req/s per source IP on the /v1/search endpoint
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: search-rate-limit
  namespace: production
spec:
  workloadSelector:
    labels:
      app: search-api
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
            value:
              stat_prefix: local_rate_limiter
              token_bucket:
                max_tokens: 100
                tokens_per_fill: 100
                fill_interval: 1s
              filter_enabled:
                runtime_key: local_rate_limit_enabled
                default_value:
                  numerator: 100
                  denominator: HUNDRED