diff --git a/examples/TestAuthorizationForHTTPServices.txt b/examples/TestAuthorizationForHTTPServices.txt deleted file mode 100644 index fabb8bcf47..0000000000 --- a/examples/TestAuthorizationForHTTPServices.txt +++ /dev/null @@ -1,153 +0,0 @@ -$snippet enabling_istio_authorization.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/rbac-config-ON.yaml@ -$endsnippet - -$snippet enforcing_namespace_level_access_control_apply.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/namespace-policy.yaml@ -$endsnippet - -$snippet enforcing_namespace_level_access_control_apply.sh_output -servicerole.rbac.istio.io/service-viewer created -servicerolebinding.rbac.istio.io/bind-service-viewer created -$endsnippet - -$snippet enforcing_namespace_level_access_control_delete.sh syntax="bash" -$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/namespace-policy.yaml@ -$endsnippet - -$snippet enforcing_namespace_level_access_control_service_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRole -metadata: - name: service-viewer - namespace: default -spec: - rules: - - services: ["*"] - methods: ["GET"] - constraints: - - key: "destination.labels[app]" - values: ["productpage", "details", "reviews", "ratings"] -$endsnippet - -$snippet enforcing_namespace_level_access_control_bind_service_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRoleBinding -metadata: - name: bind-service-viewer - namespace: default -spec: - subjects: - - properties: - source.namespace: "istio-system" - - properties: - source.namespace: "default" - roleRef: - kind: ServiceRole - name: "service-viewer" -$endsnippet - -$snippet enforcing_service_level_access_control_step1_apply.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/productpage-policy.yaml@ -$endsnippet - -$snippet enforcing_service_level_access_control_step1_productpage_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRole -metadata: - name: productpage-viewer - namespace: default -spec: - rules: - - services: ["productpage.default.svc.cluster.local"] - methods: ["GET"] -$endsnippet - -$snippet enforcing_service_level_access_control_step1_bind_productpage_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRoleBinding -metadata: - name: bind-productpage-viewer - namespace: default -spec: - subjects: - - user: "*" - roleRef: - kind: ServiceRole - name: "productpage-viewer" -$endsnippet - -$snippet enforcing_service_level_access_control_step2_apply.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/details-reviews-policy.yaml@ -$endsnippet - -$snippet enforcing_service_level_access_control_step2_details_reviews_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRole -metadata: - name: details-reviews-viewer - namespace: default -spec: - rules: - - services: ["details.default.svc.cluster.local", "reviews.default.svc.cluster.local"] - methods: ["GET"] -$endsnippet - -$snippet enforcing_service_level_access_control_step2_bind_details_reviews.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRoleBinding -metadata: - name: bind-details-reviews - namespace: default -spec: - subjects: - - user: "cluster.local/ns/default/sa/bookinfo-productpage" - roleRef: - kind: ServiceRole - name: "details-reviews-viewer" -$endsnippet - -$snippet enforcing_service_level_access_control_step3_apply.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/ratings-policy.yaml@ -$endsnippet - -$snippet enforcing_service_level_access_control_step3_ratings_viewer.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRole -metadata: - name: ratings-viewer - namespace: default -spec: - rules: - - services: ["ratings.default.svc.cluster.local"] - methods: ["GET"] -$endsnippet - -$snippet enforcing_service_level_access_control_step3_bind_ratings.yaml syntax="yaml" -apiVersion: "rbac.istio.io/v1alpha1" -kind: ServiceRoleBinding -metadata: - name: bind-ratings - namespace: default -spec: - subjects: - - user: "cluster.local/ns/default/sa/bookinfo-reviews" - roleRef: - kind: ServiceRole - name: "ratings-viewer" -$endsnippet - -$snippet remove_istio_authorization_policy.sh syntax="bash" -$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/ratings-policy.yaml@ -$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/details-reviews-policy.yaml@ -$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/productpage-policy.yaml@ -$endsnippet - -$snippet remove_istio_authorization_policy_alternative.sh syntax="bash" -$ kubectl delete servicerole --all -$ kubectl delete servicerolebinding --all -$endsnippet - -$snippet disabling_istio_authorization.sh syntax="bash" -$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/rbac-config-ON.yaml@ -$endsnippet diff --git a/examples/examples__bookinfo.snippets.txt b/examples/examples__bookinfo.snippets.txt deleted file mode 100644 index 9592635f7f..0000000000 --- a/examples/examples__bookinfo.snippets.txt +++ /dev/null @@ -1,39 +0,0 @@ -# Created by TestBookinfo. DO NOT EDIT THIS FILE MANUALLY! - -$snippet automatic_sidecar_injection.sh syntax="bash" -$ kubectl label namespace default istio-injection=enabled -$endsnippet - -$snippet deploy_bookinfo_application.sh syntax="bash" -$ kubectl apply -f @samples/bookinfo/platform/kube/bookinfo.yaml@ -$endsnippet - -$snippet verify_service.sh syntax="bash" -$ kubectl get services -$endsnippet - -$snippet verify_service.sh_output.txt syntax="text" -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -details ClusterIP 10.96.60.64 9080/TCP 0s -kubernetes ClusterIP 10.96.0.1 443/TCP 7m50s -productpage ClusterIP 10.111.146.105 9080/TCP 0s -ratings ClusterIP 10.104.124.247 9080/TCP 0s -reviews ClusterIP 10.105.106.39 9080/TCP 0s - -$endsnippet - -$snippet verify_pods.sh syntax="bash" -$ kubectl get pods -$endsnippet - -$snippet verify_pods.sh_output.txt syntax="text" -NAME READY STATUS RESTARTS AGE -details-v1-74f858558f-2ttbx 2/2 Running 0 39s -productpage-v1-76589d9fdc-gvvmf 2/2 Running 0 38s -ratings-v1-7855f5bcb9-lss29 2/2 Running 0 39s -reviews-v1-64bc5454b9-6rzvb 2/2 Running 0 39s -reviews-v2-76c64d4bdf-kbgqd 2/2 Running 0 39s -reviews-v3-5545c7c78f-q8zf9 2/2 Running 0 39s - -$endsnippet - diff --git a/examples/tasks__security__mututal_tls_migration.snippets.txt b/examples/tasks__security__mututal_tls_migration.snippets.txt deleted file mode 100644 index 2acb91beb3..0000000000 --- a/examples/tasks__security__mututal_tls_migration.snippets.txt +++ /dev/null @@ -1,78 +0,0 @@ -# Created by TestMutualTLSMigration. DO NOT EDIT THIS FILE MANUALLY! - -$snippet create_ns_foo_bar_legacy.sh syntax="bash" -$ kubectl create ns foo -$ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@) -n foo -$ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@) -n foo -$ kubectl create ns bar -$ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@) -n bar -$ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@) -n bar -$ kubectl create ns legacy -$ kubectl apply -f samples/sleep/sleep.yaml -n legacy -$endsnippet - -$snippet curl_foo_bar_legacy.sh syntax="bash" outputis="text" -$ for from in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl http://httpbin.foo:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.foo: %{http_code}\n"; done -sleep.foo to httpbin.foo: 200 -sleep.bar to httpbin.foo: 200 -sleep.legacy to httpbin.foo: 200 -$endsnippet - -$snippet verify_initial_policies.sh syntax="bash" outputis="text" -$ kubectl get policies.authentication.istio.io --all-namespaces -NAMESPACE NAME AGE -istio-system grafana-ports-mtls-disabled 2m8s -$endsnippet - -$snippet configure_mtls_destinationrule.sh syntax="bash" -$ cat <