Example Manifest with Istio

appsec.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-minio-config
data:
  default.conf: |
    server {
        listen       80;
        listen  [::]:80;
        server_name  localhost;

        #access_log  /var/log/nginx/host.access.log  main;

        location / {
            #root   /usr/share/nginx/html;
            #index  index.html index.htm;
            #try_files $uri $uri/ =404;

            # ENABLE THIS IF YOU WANT FETCH FROM MINIO - CHANGE tempggg to YOUR BUCKETNAME & CHANGE your.s3.com to your S3 ENDPOINT
            rewrite ^/$ /bucket-1/index.html break;
            rewrite ^/(.*)/$ /bucket-1/$1/index.html break;
            proxy_pass https://s3.gbesar.link:9000/bucket-1/;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-minio-deployment
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: nginx-minio
  template:
    metadata:
      labels:
        app: nginx-minio
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80
      hostAliases:
      - ip: "192.168.100.254"
        hostnames:
        - "s3.gbesar.link"
          volumeMounts:
            - name: nginx-config-volume
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
      volumes:
        - name: nginx-config-volume
          configMap:
            name: nginx-minio-config
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-minio-service
spec:
  selector:
    app: nginx-minio
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: LoadBalancer
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: app-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: tls-secret
    hosts:
    - "*.appsec.gbesar.link"
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.appsec.gbesar.link"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-minio-svc
spec:
  hosts:
  - "live.appsec.gbesar.link"
  gateways:
  - app-gateway
  http:
  - route:
    - destination:
        host: nginx-minio-service
        port:
          number: 80