apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ml-pipeline-ui
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: ml-pipeline-ui
  rules:
  # Allow all requests from the ingress gateway
  - from:
    - source:
        principals:
        - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account

  # Allow all requests with an `authorization` header but NOT a `kubeflow-userid` header.
  # This is needed to allow Kubernetes JWTs to be passed to the KFP API.
  - when:
    - key: request.headers[authorization]
      values:
      - "*"
    - key: request.headers[kubeflow-userid]
      notValues:
      - "*"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ml-pipeline
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: ml-pipeline
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/kubeflow/sa/ml-pipeline
        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
  # Allow all requests that dont have a `kubeflow-userid` header.
  - when:
    - key: request.headers[kubeflow-userid]
      notValues: ['*']
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ml-pipeline-visualizationserver
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: ml-pipeline-visualizationserver
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/kubeflow/sa/ml-pipeline
        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: service-cache-server
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: cache-server
  rules:
  - {}

---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline-ui
spec:
  host: ml-pipeline-ui.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline
spec:
  host: ml-pipeline.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
  name: ml-pipeline-visualizationserver
spec:
  host: ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
