routing.yaml.j2

apiVersion: v1
kind: List
items:
{% for index in range(1, (num_apps | int) + 1) %}
# This virtual service requires any request to have x-variant set to either
# 'stable', 'canary' or 'mirror' (otherwise the request raturns 404)
- apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    labels:
      app: scale-test
    name: variant-{{ index }}
    namespace: {{ namespace }}
  spec:
    hosts:
    - app-{{ index }}.{{ wildcard_domain }} # for external routing
    - app-{{ index }} # for internal routing within NAMESPACE
    gateways:
    - app-gateway # for external routing
    - mesh # for internal routing
    http:
    - match:
      - headers:
          x-variant:
            exact: stable
      route:
      - destination:
          host: app-{{ index }}
          port:
            number: 8080
          subset: stable
    - match:
      - headers:
          x-variant:
            exact: canary
      route:
      - destination:
          host: app-{{ index }}
          port:
            number: 8080
          subset: canary
    - match:
      - headers:
          x-variant:
            exact: mirror
      route:
      - destination:
          host: app-{{ index }}
          port:
            number: 8080
          subset: stable
      mirror:
        host: app-{{ index }}
        port:
          number: 8080
        subset: canary
- apiVersion: networking.istio.io/v1alpha3
  kind: DestinationRule
  metadata:
    name: variant-{{ index }}
    namespace: {{ namespace }}
    labels:
      app: scale-test
  spec:
    host: app-{{ index }}.{{ namespace }}.svc.cluster.local
    trafficPolicy:
      loadBalancer:
        simple: RANDOM
      portLevelSettings:
      - port:
          number: 8080
        tls:
          mode: ISTIO_MUTUAL
        connectionPool:
          http:
            http1MaxPendingRequests: 10000
            http2MaxRequests: 10000
          tcp:
            maxConnections: 10000
      - port:
          number: 5432
        tls:
          mode: DISABLE
        connectionPool:
          http:
            http1MaxPendingRequests: 10000
            http2MaxRequests: 10000
          tcp:
            maxConnections: 10000
    subsets:
    - name: stable
      labels:
        app.variant: stable
    - name: canary
      labels:
        app.variant: canary
{% endfor %}
- apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: app-gateway
    namespace: {{ namespace }}
    labels:
      app: scale-test
  spec:
    selector:
      istio: ingressgateway # use Istio default gateway implementation
    servers:
    - hosts:
      # Catch-all route not allowed in Maistra
      # Wildcard routes not possible in OCP 4.1
{% for index in range(1, (num_apps | int) + 1) %}
      - "app-{{ index }}.{{ wildcard_domain }}"
{% endfor %}
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        mode: SIMPLE
        # These keys are mounted from the secret istio-system/istio-ingressgateway-certs
        privateKey: /etc/istio/ingressgateway-certs/tls.key
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
    # Redirect non-encrypted traffic to port 443
    - hosts:
      # Wildcard routes not possible in OCP 4.1
{% for index in range(1, (num_apps | int) + 1) %}
      - "app-{{ index }}.{{ wildcard_domain }}"
{% endfor %}
      port:
        name: http
        number: 80
        protocol: HTTP
      tls:
        httpsRedirect: true
{% if policy_version is defined and policy_version == "old" %}
# Global policy requiring communication to be TLS-encrypted
- apiVersion: authentication.istio.io/v1alpha1
  kind: Policy
  metadata:
    name: default
    namespace: {{ namespace }}
    labels:
      app: scale-test
  spec:
    peers:
    - mtls: {}
# Exception for the policy above on DB port
- apiVersion: authentication.istio.io/v1alpha1
  kind: Policy
  metadata:
    name: app-db
    namespace: {{ namespace }}
    labels:
      app: scale-test
  spec:
    peers: []
    targets:
{% for index in range(1, (num_apps | int) + 1) %}
    - name: app-{{ index }}
      ports:
      - number: 5432
{% endfor %}
{% else %}
- apiVersion: security.istio.io/v1beta1
  kind: PeerAuthentication
  metadata:
    name: default
    namespace: {{ namespace }}
  spec:
    mtls:
      mode: STRICT
# Port-level mTLS is not allowed on mesh-level policy
- apiVersion: security.istio.io/v1beta1
  kind: PeerAuthentication
  metadata:
    name: app-db
    namespace: {{ namespace }}
  spec:
    selector:
      matchLabels:
        app: scale-test
    mtls:
      mode: STRICT
    portLevelMtls:
      5432:
        mode: DISABLE
{% endif %}