bleggett

# This example requires Lima v0.7.0 or later.
images:
- location: "https://download.fedoraproject.org/pub/fedora/linux/releases/37/Cloud/aarch64/images/Fedora-Cloud-Base-37-1.7.aarch64.qcow2"
  arch: "aarch64"
  digest: "sha256:cc8b0f49bc60875a16eef65ad13e0e86ba502ba3585cc51146f11f4182a628c0"
mounts:
- location: "~/Source"
  writable: true
- location: "/tmp/lima"
  writable: true

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable.
#
# https://github.com/istio/istio/issues/43105
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
---

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable.
#
# https://github.com/istio/istio/issues/43105
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
---

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
{{- range .Values.spireIdentities }}
---
apiVersion: networking.istio.io/v1beta1

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable - however this should be resolved soonish.
# https://github.com/istio/istio/issues/28712
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
{{- range .Values.spireIdentities }}
---

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable - however this should be resolved soonish.
# https://github.com/istio/istio/issues/28712
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
{{- range .Values.spireIdentities }}
---

bleggett

Istio DestinationRule hax

#

bleggett

#!/usr/bin/env sh

su-exec root apt-get update && su-exec root apt-get install -y cmake-data
export DOCKER_SOCKET_MOUNT="-v /var/run/docker.sock.raw:/var/run/docker.sock"
export BUILD_ZTUNNEL=1
export BUILD_ZTUNNEL_REPO="$(pwd)/ztunnel"
export TAG=bm-ambienttest
export HUB=docker.io/bmleggett
export IMAGE_VERSION=master-7b5c2064d06c417cc34d4ed760fd65134055c301
export DOCKER_ARCHITECTURES=linux/arm64

bleggett

# TODO destination rules need to be created for any SPIFFE IDs that don't follow the
# format that Istio expects (ns/NAMESPACE/sa/TARGET_POD_SVC_ACCOUNT)
# because ATM Istio defaults to clientside SAN checks that assume that SPIFFE ID format
# and this is not currently configurable - however this should be resolved soonish.
# https://github.com/istio/istio/issues/28712
#
# Additionally, since DestinationRules override Istio's "default automTLS" settings, we need `mode: ISTIO_MUTUAL`
# in each DestRule to tell Istio that even though we have a custom destination config, we still want mTLS.
{{- range .Values.spireIdentities }}
---

bleggett

#!/usr/bin/env python3

import pathlib
import subprocess
import sys
import shutil
import math

root = pathlib.Path(__file__).parent.resolve()
target_root = root / 'dsd'