Mtls prototype 1

cmd/controller/main.go

@@ -140,6 +140,8 @@ func main() {
 	endpointsInformer := kubeInformerFactory.Core().V1().Endpoints()
 	configMapInformer := kubeInformerFactory.Core().V1().ConfigMaps()
 	virtualServiceInformer := servingInformerFactory.Networking().V1alpha3().VirtualServices()
+	destinationRuleInformer := servingInformerFactory.Networking().V1alpha3().DestinationRules()
+	authenticationPolicyInformer := servingInformerFactory.Authentication().V1alpha1().Policies()
 	vpaInformer := vpaInformerFactory.Poc().V1alpha1().VerticalPodAutoscalers()
 
 	// Build all of our controllers, with the clients constructed above.
@@ -160,6 +162,8 @@ func main() {
 			endpointsInformer,
 			configMapInformer,
 			vpaInformer,
+			destinationRuleInformer,
+			authenticationPolicyInformer,
 			&revControllerConfig,
 		),
 		route.NewController(
@@ -201,6 +205,8 @@ func main() {
 		endpointsInformer.Informer().HasSynced,
 		configMapInformer.Informer().HasSynced,
 		virtualServiceInformer.Informer().HasSynced,
+		destinationRuleInformer.Informer().HasSynced,
+		authenticationPolicyInformer.Informer().HasSynced,
 	} {
 		if ok := cache.WaitForCacheSync(stopCh, synced); !ok {
 			logger.Fatalf("failed to wait for cache at index %v to sync", i)

config/200-clusterrole.yaml

@@ -25,7 +25,10 @@ rules:
     resources: ["builds"]
     verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
   - apiGroups: ["networking.istio.io"]
-    resources: ["virtualservices"]
+    resources: ["virtualservices", "destinationrules"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["authentication.istio.io"]
+    resources: ["policies"]
     verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
 ---
 kind: ClusterRole
@@ -55,5 +58,8 @@ rules:
     resources: ["builds"]
     verbs: ["get", "list", "update", "patch", "watch"]
   - apiGroups: ["networking.istio.io"]
-    resources: ["virtualservices"]
+    resources: ["virtualservices", "destinationrules"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["authentication.istio.io"]
+    resources: ["policies"]
     verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

config/400-activator-service.yaml

@@ -28,3 +28,25 @@ spec:
     port: 80
     targetPort: 8080
   type: NodePort
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: activator-destination-rule
+  namespace: knative-serving
+spec:
+  host: activator-service.knative-serving.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: "authentication.istio.io/v1alpha1"
+kind: Policy
+metadata:
+  name: activator-service-auth-policy
+  namespace: knative-serving
+spec:
+  targets:
+  - name: activator-service
+  peers:
+  - mtls:

hack/update-codegen.sh

@@ -27,7 +27,7 @@ CODEGEN_PKG=${CODEGEN_PKG:-$(cd ${SERVING_ROOT}; ls -d -1 ./vendor/k8s.io/code-g
 #                  instead of the $GOPATH directly. For normal projects this can be dropped.
 ${CODEGEN_PKG}/generate-groups.sh "deepcopy,client,informer,lister" \
   github.com/knative/serving/pkg/client github.com/knative/serving/pkg/apis \
-  "serving:v1alpha1 istio:v1alpha3" \
+  "serving:v1alpha1 istio:v1alpha3 istio/authentication:v1alpha1" \
   --go-header-file ${SERVING_ROOT}/hack/boilerplate/boilerplate.go.txt
 
 # Update code to change Gatewaies -> Gateways to workaround cleverness of codegen pluralizer.

pkg/apis/istio/authentication/register.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2018 The Knative Authors
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authentication
+
+const (
+        GroupName = "authentication.istio.io"
+)

pkg/apis/istio/authentication/v1alpha1/doc.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Api versions allow the api contract for a resource to be changed while keeping
+// backward compatibility by support multiple concurrent versions
+// of the same resource
+
+// +k8s:deepcopy-gen=package
+// +groupName=authentication.istio.io
+package v1alpha1