Istio and Linkerd

# Istio: strict mTLS for the namespace, a 90/10 canary, and an authorisation rule
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: { name: default, namespace: payments }
spec: { mtls: { mode: STRICT } }
---
apiVersion: networking.istio.io/v1
kind: VirtualService
spec:
  hosts: [ledger]
  http: [ { route: [ { destination: { host: ledger, subset: v1 }, weight: 90 }, { destination: { host: ledger, subset: v2 }, weight: 10 } ],
            timeout: 2s, retries: { attempts: 2, retryOn: connect-failure,refused-stream } } ]
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
spec:
  selector: { matchLabels: { app: ledger } }
  rules: [ { from: [ { source: { principals: ["cluster.local/ns/payments/sa/transfers"] } } ] } ]