From b8a4a260fee9a4fcc9d479c590fb74872046be58 Mon Sep 17 00:00:00 2001
From: Huabing Zhao <zhaohuabing@gmail.com>
Date: Sat, 4 Aug 2018 03:23:24 +0000
Subject: Enable istio RBAC

Issue-ID: MSB-255
Change-Id: I8232c5f49c99a3ab4115ff531efcbdb2d8febfa0
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
---
 install/enable-istio-rbac.yaml  |  8 ++++++++
 install/istio-ingress-rbac.yaml | 24 ++++++++++++++++++++++++
 install/msb-rbac.yaml           | 21 +++++++++++++++++++++
 3 files changed, 53 insertions(+)
 create mode 100644 install/enable-istio-rbac.yaml
 create mode 100644 install/istio-ingress-rbac.yaml
 create mode 100644 install/msb-rbac.yaml

diff --git a/install/enable-istio-rbac.yaml b/install/enable-istio-rbac.yaml
new file mode 100644
index 0000000..3b66fcc
--- /dev/null
+++ b/install/enable-istio-rbac.yaml
@@ -0,0 +1,8 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: RbacConfig
+metadata:
+  name: default
+spec:
+  mode: 'ON_WITH_INCLUSION'
+  inclusion:
+    namespaces: ["onap"]
diff --git a/install/istio-ingress-rbac.yaml b/install/istio-ingress-rbac.yaml
new file mode 100644
index 0000000..81bbca6
--- /dev/null
+++ b/install/istio-ingress-rbac.yaml
@@ -0,0 +1,24 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRole
+metadata:
+  name: service-viewer
+  namespace: onap 
+spec:
+  rules:
+  - services: ["*"]
+    methods: ["GET"]
+---
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRoleBinding
+metadata:
+  name: bind-service-viewer
+  namespace: onap 
+spec:
+  subjects:
+  - properties:
+      source.namespace: "istio-system"
+  - properties:
+      source.namespace: "default"
+  roleRef:
+    kind: ServiceRole
+    name: "service-viewer"
diff --git a/install/msb-rbac.yaml b/install/msb-rbac.yaml
new file mode 100644
index 0000000..bcb1d87
--- /dev/null
+++ b/install/msb-rbac.yaml
@@ -0,0 +1,21 @@
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRole
+metadata:
+  name: msb 
+  namespace: onap 
+spec:
+  rules:
+  - services: ["*"]
+    methods: ["GET"]
+---
+apiVersion: "rbac.istio.io/v1alpha1"
+kind: ServiceRoleBinding
+metadata:
+  name: bind-service-msb
+  namespace: onap 
+spec:
+  subjects:
+  - user: "cluster.local/ns/onap/sa/msb"
+  roleRef:
+    kind: ServiceRole
+    name: "msb"
-- 
cgit