Spring Boot 4 microservice on JDK 25 with identity enforced at both the service-mesh edge (Istio RequestAuthentication + AuthorizationPolicy) and the application boundary (Spring Security OAuth 2.0 resource server) — defense in depth against the same OIDC issuer. Deployed via Kubernetes with optional STRICT mTLS, VirtualService routing, and a Grafana + Prometheus + Loki observability bundle.
Render it
# CLI
npx @nanohype/sdk render-composite identity-aware-service --out ./my-app
# SDK
import { LocalSource, renderComposite } from "@nanohype/sdk";
const result = await renderComposite(source, "identity-aware-service", variables);
# MCP — from an agent
get_composite({ name: "identity-aware-service" })
What it draws together
Variables
Required
ProjectName string- Kebab-case project name, used across service, k8s resources, istio selectors, and repo Must be lowercase kebab-case.
GroupId string- Maven groupId (reverse-DNS, dot-separated, lowercase)
JavaPackage string- Root Java package (dot form)
PackageDir string- Root Java package (slash form) — must match JavaPackage
OidcIssuer string- OIDC issuer URL. Used by both Spring Security (for JWT validation in the app) and Istio RequestAuthentication (for JWT validation at the mesh edge). Same value flows to both — defense in depth.
Optional
Database string — defaults to postgres- Database driver (postgres, mysql, h2)
Namespace string — defaults to default- Kubernetes namespace for deployed resources
Replicas string — defaults to 2- Kubernetes pod replica count
AllowedAudience string — defaults to ${ProjectName}- Expected JWT `aud` claim value
IncludeMTls bool — defaults to false- Include an Istio PeerAuthentication enforcing STRICT mTLS. Only enable when every workload in the namespace is sidecar-injected — STRICT mode rejects non-mesh traffic.
IncludeMonitoring bool — defaults to false- Include the Grafana + Prometheus + Loki observability stack
