From 63505ae86f8b91e1adfc6fffe81909096225eab8 Mon Sep 17 00:00:00 2001
From: Linus Vogel <linus@linvogel.ch>
Date: Sun, 28 Jun 2026 16:16:24 +0200
Subject: [PATCH] better istio?

---
 helm/istiod/templates/ingress-gateway.yaml | 61 +++++++++++++++-------
 1 file changed, 42 insertions(+), 19 deletions(-)

diff --git a/helm/istiod/templates/ingress-gateway.yaml b/helm/istiod/templates/ingress-gateway.yaml
index 888d78d..e873bbd 100644
--- a/helm/istiod/templates/ingress-gateway.yaml
+++ b/helm/istiod/templates/ingress-gateway.yaml
@@ -1,36 +1,59 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: istio-ingress
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: istio-ingressgateway
-  namespace: istio-ingress
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: istio-ingressgateway
   namespace: istio-ingress
 spec:
-  replicas: 1
   selector:
     matchLabels:
       istio: ingressgateway
   template:
     metadata:
-      labels:
-        istio: ingressgateway
       annotations:
+        # Select the gateway injection template (rather than the default sidecar template)
         inject.istio.io/templates: gateway
+      labels:
+        # Set a unique label for the gateway. This is required to ensure Gateways can select this workload
+        istio: ingressgateway
+        # Enable gateway injection. If connecting to a revisioned control plane, replace with "istio.io/rev: revision-name"
         sidecar.istio.io/inject: "true"
     spec:
-      serviceAccountName: istio-ingressgateway
+      # Allow binding to all ports (such as 80 and 443)
+      securityContext:
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
       containers:
       - name: istio-proxy
-        image: auto
-        ports:
-        - containerPort: 8080
-        - containerPort: 15021
\ No newline at end of file
+        image: auto # The image will automatically update each time the pod starts.
+        # Drop all privileges, allowing to run as non-root
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          runAsUser: 1337
+          runAsGroup: 1337
+---
+# Set up roles to allow reading credentials for TLS
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: istio-ingressgateway-sds
+  namespace: istio-ingress
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: istio-ingressgateway-sds
+  namespace: istio-ingress
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: istio-ingressgateway-sds
+subjects:
+- kind: ServiceAccount
+  name: default