kubectl create namespace video-prod
kubectl label namespace video-prod istio-injection=enabled

# peer-authentication-strict.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: video-prod
spec:
  mtls:
    mode: STRICT

# request-authentication.yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-validation
  namespace: video-prod
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "https://auth.yourcorp.com"  # 企业统一身份认证中心
    audiences:
    - "video-conference-api"
    jwksUri: "https://auth.yourcorp.com/.well-known/jwks.json"

# authz-deny-anonymous.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-anonymous
  namespace: video-prod
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: DENY
  rules:
  - from:
    - source:
        notRequestPrincipals: ["*"]

# authz-signaling-to-media.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-to-media
  namespace: video-prod
spec:
  selector:
    matchLabels:
      app: media-sfu
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/video-prod/sa/sa-signaling"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/sessions/*/allocate"]

# authz-recording-readonly.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: recording-read-metadata
  namespace: video-prod
spec:
  selector:
    matchLabels:
      app: media-sfu
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/video-prod/sa/sa-recording"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/api/v1/streams/*/metadata"]

# destination-rule-media.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-sfu-dr
  namespace: video-prod
spec:
  host: media-sfu
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10000
      http:
        h2UpgradePolicy: UPGRADE
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50

# virtual-service-signaling.yaml (片段)
http:
- match:
  - uri:
      prefix: /api/v1/conferences
  route:
  - destination:
      host: signaling-svc
  retries:
    attempts: 3
    perTryTimeout: 2s
    retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes
    retryRemoteLocalities: true

# telemetry-accesslog.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: access-log-json
  namespace: video-prod
spec:
  selector:
    matchLabels:
      app: media-sfu
  accessLogging:
  - providers:
    - name: envoy
    filteredAccessLog:
      logEntryLabels:
        source_principal: "%DYNAMIC_METADATA(istio.mixer:source_principal)%"
        dest_principal: "%DYNAMIC_METADATA(istio.mixer:destination_principal)%"
        authz_result: "%FILTER_STATE(istio.authorization.result)%"

# Primary 集群导出 CA
istioctl x create-ca-cert --self-signed=true --trust-domain=video.corp.global --output-dir=./certs

# Remote 集群导入 (通过 ClusterSecret 资源)
kubectl create secret generic cacerts -n istio-system 
  --from-file=./certs/ca-cert.pem 
  --from-file=./certs/ca-key.pem 
  --from-file=./certs/root-cert.pem 
  --from-file=./certs/cert-chain.pem

# Primary 集群导入边缘媒体服务 (示例: 新加坡集群)
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: media-sfu-sg
  namespace: video-prod
spec:
  hosts:
  - media-sfu.video-prod.svc.sg-cluster.local # 跨集群 FQDN
  location: MESH_EXTERNAL
  ports:
  - number: 443
    name: grpc
    protocol: GRPC
  resolution: DNS
  endpoints:
  - address: media-sfu-gateway.sg.video.corp # 边缘入口网关 VIP
    ports:
      grpc: 443
  workloadSelector:
    labels:
      topology.istio.io/network: sg-network # 标识网络拓扑

# Deployment 片段
resources:
  limits:
    cpu: "2000m"
    memory: "1Gi"
  requests:
    cpu: "1000m"  # 请求设为限制 50%，保证调度优先级同时留出突发余量
    memory: "512Mi"

# envoy-filter-tuning.yaml
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: envoy-runtime-tuning
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: signaling-svc
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 3600s # WebSocket 长连接空闲超时 1 小时
            headers_with_underscores_action: ALLOW # 兼容旧版客户端 Header
          http2_protocol_options:
            max_concurrent_streams: 1000 # 单连接最大并发流，防单连接阻塞
            initial_stream_window_size: 262144 # 256KB 流控窗口
            initial_connection_window_size: 1048576 # 1MB 连接窗口
          stream_idle_timeout: 1800s # 流空闲超时

# constraint-mtls-strict.yaml
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sistiopeerauthenticationstrict
spec:
  crd:
    spec:
      names:
        kind: K8sIstioPeerAuthenticationStrict
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sistiopeerauthenticationstrict
        violation[{"msg": msg}] {
          input.kind == "PeerAuthentication"
          input.spec.mtls.mode != "STRICT"
          msg := "PeerAuthentication must be STRICT mode for Zero Trust"
        }
        violation[{"msg": msg}] {
          input.kind == "Pod"
          input.spec.hostNetwork == true
          msg := "HostNetwork is forbidden in Zero Trust mesh"
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sIstioPeerAuthenticationStrict
metadata:
  name: enforce-mtls-strict
spec:
  match:
    kinds:
      - apiGroups: ["security.istio.io", ""]
        kinds: ["PeerAuthentication", "Pod"]
    namespaces: ["video-prod", "video-staging"]

infra-config/
├── base/
│   ├── peer-authentication.yaml      # 全局 STRICT mTLS
│   ├── authorization-policies/       # 基础拒绝策略
│   └── telemetry.yaml                # 统一审计日志格式
├── overlays/
│   ├── prod/
│   │   ├── kustomization.yaml
│   │   ├── authz-signaling-prod.yaml # 生产环境特定授权
│   │   └── env-specific-patches.yaml # 资源限额、副本数
│   └── staging/
└── policies/                         # OPA Gatekeeper 约束库
    ├── mtls-strict.yaml
    └── no-hostnetwork.yaml

# chaos-network-partition.yaml
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: primary-remote-partition
  namespace: chaos-testing
spec:
  action: partition
  mode: one
  selector:
    namespaces:
      - istio-system
    labelSelectors:
      app: istiod # 仅针对 Primary 控制面
  direction: both
  target:
    mode: one
    selector:
      namespaces:
        - istio-system
      labelSelectors:
        app: istiod # 针对 Remote 控制面 (若为 Multi-Primary)
  duration: "5m"
  scheduler:
    cron: "@once"

# vpa-sidecar-recommender.yaml
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: signaling-sidecar-vpa
  namespace: video-prod
spec:
  targetRef:
    apiVersion: "apps/v1"
    kind: Deployment
    name: signaling-svc
  updatePolicy:
    updateMode: "Off" # 关键：仅推荐，不自动应用
  resourcePolicy:
    containerPolicies:
    - containerName: istio-proxy
      mode: "Auto"
    - containerName: signaling-app
      mode: "Off" # 业务容器资源由 HPA/人工管理