apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
  name: ml-pipeline-ui
  namespace: kubeflow
spec:
  rules:
  - services:
    - ml-pipeline-ui.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
  name: ml-pipeline-services
  namespace: kubeflow
spec:
  rules:
  - services:
    - ml-pipeline.kubeflow.svc.cluster.local
    - ml-pipeline-ui.kubeflow.svc.cluster.local
    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
    - mysql.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
  name: bind-gateway-ml-pipeline-ui
  namespace: kubeflow
spec:
  subjects:
  - properties:
      source.namespace: istio-system # gateway
  roleRef:
    kind: ServiceRole
    name: ml-pipeline-ui
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
  name: bind-ml-pipeline-internal
  namespace: kubeflow
spec:
  subjects:
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
  - properties:
      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
  roleRef:
    kind: ServiceRole
    name: ml-pipeline-services
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline-ui
spec:
  host: ml-pipeline-ui.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline
spec:
  host: ml-pipeline.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline-visualizationserver
spec:
  host: ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline-mysql
spec:
  host: mysql.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
  name: cache-server
  namespace: kubeflow
spec:
  rules:
  - services:
    - cache-server.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
  name: bind-cache-server-admission-webhook
  namespace: kubeflow
spec:
  subjects:
  - user: "*"
  roleRef:
    kind: ServiceRole
    name: cache-server
