<commit_before># Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Config for routing to a CloudRun service using the SNI gateway.
#
# This will be automated as a controller, but useful to see the actual config and also
# debug or create custom entries. The controller will operate on 'create if it doesn't exist' mode, i.e. users can
# either create their own config (ahead of time) or edit or patch the created config.

# K_SERVICE is the first component of the CloudRun URL - example fortio-cr-icq63pqnqq-uc
# WORKLOAD_NAME is the name of the CloudRun service - in this case fortio-cr
# WORKLOAD_NAMESPACE is the k8s namespace where the CR service is 'attached'

# TODO: replace K_SERVICE with K_SERVICE_BASE_URL, WORKLOAD_NAME with K_SERVICE

# Each CloudRun service is mapped to one Service. The new K8S Gateway API is
# not using DestinationRule-style subsetting, we want to represent each CR region
# as a separate subset that can be selected with the Gateawy API or VirtualService.
apiVersion: v1
kind: Service
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  # Service name matches the actual service name in CloudRun.
  # This is used to acccess only the service in cloudrun, in a region. Can be used as a subset
  # TODO: auto-create this if it doesn't exist, in SNIGate
  ports:
    # Port corresponds to the CloudRun app port - default is 8080
    # TODO: support custom ports in cloudrun
    - port: 8080
      name: http
      # TargetPort is the fixed port for the SNI router.
      targetPort: 15443
  selector:
    app: ${WORKLOAD_NAME}
---
# When doing auto-registration, the Service and VirtualService should be 'create if it doesn't exist', i.e. user can
# customize or replace it, we'll just create the initial/default version.
apiVersion: v1
kind: Service
metadata:
  name: ${WORKLOAD_NAME}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  ports:
    - port: 8080
      name: http
      targetPort: 15443
  selector:
    app: ${WORKLOAD_NAME}
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ${WORKLOAD_NAME}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  hosts:
    - ${WORKLOAD_NAME}
    - ${WORKLOAD_NAME}.${WORKLOAD_NAMESPACE}
    - ${WORKLOAD_NAME}.${WORKLOAD_NAMESPACE}.svc
  http:
    - route:
        - destination:
            host: ${K_SERVICE}
---
# The registered cloudrun service only support mTLS, don't generate extra
# config for 'permissive' or plain.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  host: ${K_SERVICE}.fortio.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  selector:
    matchLabels:
      app: ${WORKLOAD_NAME}
  portLevelMtls:
    15003:
      mode: STRICT

---
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: ${WORKLOAD_NAME}-sni
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    app: ${WORKLOAD_NAME}
  serviceAccount: default
  address: ${SNI_GATE_IP}
  ports:
    http: 15442
---

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  namespace: ${WORKLOAD_NAMESPACE}
  name: ${K_SERVICE}
  labels:
     service.istio.io/canonical-name: ${WORKLOAD_NAME}
#    topology.istio.io/network: hbone
spec:
  hosts:
    - ${K_SERVICE}.fortio.svc.cluster.local
  location: MESH_INTERNAL
  ports:
    - number: 8080
      name: http
      protocol: HTTP
      #targetPort: 15443
  resolution: STATIC
  workloadSelector:
    labels:
      app: ${WORKLOAD_NAME}

---
# Sidecar entry - when automating, it'll be 'create if missing', not reconciled, i.e. users can modify it.
# This is needed until Istiod has native support for HBONE.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  workloadSelector:
    labels:
      app: ${WORKLOAD_NAME}
  #  egress:
  #    - hosts:
  #        # For now, visibility only on same namespace and istio-system.
  #        - ${WORKLOAD_NAMESPACE}/*
  #        - istio-system/*
  ingress:
    - port:<commit_msg>Add missing env substitution for namespace.<commit_after># Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Config for routing to a CloudRun service using the SNI gateway.
#
# This will be automated as a controller, but useful to see the actual config and also
# debug or create custom entries. The controller will operate on 'create if it doesn't exist' mode, i.e. users can
# either create their own config (ahead of time) or edit or patch the created config.

# K_SERVICE is the first component of the CloudRun URL - example fortio-cr-icq63pqnqq-uc
# WORKLOAD_NAME is the name of the CloudRun service - in this case fortio-cr
# WORKLOAD_NAMESPACE is the k8s namespace where the CR service is 'attached'

# TODO: replace K_SERVICE with K_SERVICE_BASE_URL, WORKLOAD_NAME with K_SERVICE

# Each CloudRun service is mapped to one Service. The new K8S Gateway API is
# not using DestinationRule-style subsetting, we want to represent each CR region
# as a separate subset that can be selected with the Gateawy API or VirtualService.
apiVersion: v1
kind: Service
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  # Service name matches the actual service name in CloudRun.
  # This is used to acccess only the service in cloudrun, in a region. Can be used as a subset
  # TODO: auto-create this if it doesn't exist, in SNIGate
  ports:
    # Port corresponds to the CloudRun app port - default is 8080
    # TODO: support custom ports in cloudrun
    - port: 8080
      name: http
      # TargetPort is the fixed port for the SNI router.
      targetPort: 15443
  selector:
    app: ${WORKLOAD_NAME}
---
# When doing auto-registration, the Service and VirtualService should be 'create if it doesn't exist', i.e. user can
# customize or replace it, we'll just create the initial/default version.
apiVersion: v1
kind: Service
metadata:
  name: ${WORKLOAD_NAME}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  ports:
    - port: 8080
      name: http
      targetPort: 15443
  selector:
    app: ${WORKLOAD_NAME}
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ${WORKLOAD_NAME}
  namespace: ${WORKLOAD_NAMESPACE}
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    mesh-cloudrun: ${WORKLOAD_NAME}
spec:
  hosts:
    - ${WORKLOAD_NAME}
    - ${WORKLOAD_NAME}.${WORKLOAD_NAMESPACE}
    - ${WORKLOAD_NAME}.${WORKLOAD_NAMESPACE}.svc
  http:
    - route:
        - destination:
            host: ${K_SERVICE}
---
# The registered cloudrun service only support mTLS, don't generate extra
# config for 'permissive' or plain.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  host: ${K_SERVICE}.${WORKLOAD_NAMESPACE}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  selector:
    matchLabels:
      app: ${WORKLOAD_NAME}
  portLevelMtls:
    15003:
      mode: STRICT

---
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: ${WORKLOAD_NAME}-sni
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  labels:
    service.istio.io/canonical-name: ${WORKLOAD_NAME}
    app: ${WORKLOAD_NAME}
  serviceAccount: default
  address: ${SNI_GATE_IP}
  ports:
    http: 15442
---

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  namespace: ${WORKLOAD_NAMESPACE}
  name: ${K_SERVICE}
  labels:
     service.istio.io/canonical-name: ${WORKLOAD_NAME}
#    topology.istio.io/network: hbone
spec:
  hosts:
    - ${K_SERVICE}.${WORKLOAD_NAMESPACE}.svc.cluster.local
  location: MESH_INTERNAL
  ports:
    - number: 8080
      name: http
      protocol: HTTP
      #targetPort: 15443
  resolution: STATIC
  workloadSelector:
    labels:
      app: ${WORKLOAD_NAME}

---
# Sidecar entry - when automating, it'll be 'create if missing', not reconciled, i.e. users can modify it.
# This is needed until Istiod has native support for HBONE.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: ${K_SERVICE}
  namespace: ${WORKLOAD_NAMESPACE}
spec:
  workloadSelector:
    labels:
      app: ${WORKLOAD_NAME}
  #  egress:
  #    - hosts:
  #        # For now, visibility only on same namespace and istio-system.
  #        - ${WORKLOAD_NAMESPACE}/*
  #        - istio-system/*
  ingress:
    - port:
{'fraction_non_alphanumeric': 0.09137796808096535, 'fraction_numerical': 0.013040093421564812, 'mean_word_length': 3.6607709750566895, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1194133', 'n_tokens_mistral': 3303, 'n_tokens_neox': 3227, 'n_words': 1100}