################################
# Istio-CA single namespace
################################
# This CA only issues certs/keys for the namespace it runs in.
# For demo only. Please use istio-cluster-ca.yaml for real-world use cases.
# Service account CA runs in.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-ca-service-account
  namespace: {ISTIO_NAMESPACE}
---
# Istio CA
apiVersion: v1
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: istio-ca
  namespace: {ISTIO_NAMESPACE}
spec:
  replicas: 1
  template:
    metadata:
      labels:
        istio: istio-ca
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: istio-ca-service-account
      containers:
      - name: istio-ca
        image: {CA_HUB}/istio-ca:{CA_TAG}
        imagePullPolicy: IfNotPresent
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
---
