Enable istio RBAC

Issue-ID: MSB-255
Change-Id: I8232c5f49c99a3ab4115ff531efcbdb2d8febfa0
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

diff --git a/install/enable-istio-rbac.yaml b/install/enable-istio-rbac.yaml
new file mode 100644 (file)
index 0000000..3b66fcc
--- /dev/null
+++ b/install/enable-istio-rbac.yaml
@@ -0,0 +1,8 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: RbacConfig
+metadata:
+  name: default
+spec:
+  mode: 'ON_WITH_INCLUSION'
+  inclusion:
+    namespaces: ["onap"]

diff --git a/install/istio-ingress-rbac.yaml b/install/istio-ingress-rbac.yaml
new file mode 100644 (file)
index 0000000..81bbca6
--- /dev/null
+++ b/install/istio-ingress-rbac.yaml
@@ -0,0 +1,24 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRole
+metadata:
+  name: service-viewer
+  namespace: onap 
+spec:
+  rules:
+  - services: ["*"]
+    methods: ["GET"]
+---
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRoleBinding
+metadata:
+  name: bind-service-viewer
+  namespace: onap 
+spec:
+  subjects:
+  - properties:
+      source.namespace: "istio-system"
+  - properties:
+      source.namespace: "default"
+  roleRef:
+    kind: ServiceRole
+    name: "service-viewer"

diff --git a/install/msb-rbac.yaml b/install/msb-rbac.yaml
new file mode 100644 (file)
index 0000000..bcb1d87
--- /dev/null
+++ b/install/msb-rbac.yaml
@@ -0,0 +1,21 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRole
+metadata:
+  name: msb 
+  namespace: onap 
+spec:
+  rules:
+  - services: ["*"]
+    methods: ["GET"]
+---
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRoleBinding
+metadata:
+  name: bind-service-msb
+  namespace: onap 
+spec:
+  subjects:
+  - user: "cluster.local/ns/onap/sa/msb"
+  roleRef:
+    kind: ServiceRole
+    name: "msb"