Skip to content
nanohypenanohype

Istio Service-Mesh Policy

Scaffolds an Istio policy bundle for an HTTP workload on a service mesh: an AuthorizationPolicy that enforces JWT authentication, a RequestAuthentication that configures the JWT issuer + JWKs endpoint, an optional PeerAuthentication enforcing STRICT mTLS, and an optional VirtualService routing template. Designed to drop alongside any containerized service template (spring-boot-service, go-service, ts-service).

Nameistio-policy
Version0.1.0
Categoryinfrastructure
LicenseApache-2.0
Personaengineering
Tagsistio, kubernetes, k8s, service-mesh, authorization, oidc, mtls, security
Sourcetemplates/istio-policy

Render it

Three front doors, one catalog. Pick whichever suits the caller.

# CLI
npx @nanohype/sdk render istio-policy --out ./my-app

# SDK
import { LocalSource, renderTemplate } from "@nanohype/sdk";
const result = await renderTemplate(source, "istio-policy", variables);

# MCP — from an agent
get_template({ name: "istio-policy" })

Prerequisites

ToolVersionWhy
kubectl—Apply Istio policy manifests to the cluster
istioctl (optional)>=1.20Validate Istio resource manifests (`istioctl analyze`) before apply

Variables

Required

ProjectName string
Kebab-case project name, used for resource names and selector labels Must be lowercase kebab-case starting with a letter.
OidcIssuer string
OIDC issuer URL that signs inbound JWTs (e.g. https://auth.example.com)
JwksUri string
JWKs endpoint URL. For standard OIDC providers this is usually {issuer}/.well-known/jwks.json — override if your provider uses a different path.
AllowedAudience string
JWT `aud` claim value required for requests to this service

Optional

Namespace string — defaults to default
Kubernetes namespace the policy resources are applied to
ServiceHost string — defaults to ${ProjectName}.${Namespace}.svc.cluster.local
Fully-qualified service host for the VirtualService
GatewayName string — defaults to mesh
Istio Gateway resource name the VirtualService attaches to. Use "mesh" for internal-only (default) or the name of an external ingress gateway (e.g. "istio-system/public-gateway") for externally-reachable traffic.
IncludeMTls bool — defaults to false
Include a PeerAuthentication resource enforcing STRICT mTLS
IncludeVirtualService bool — defaults to false
Include a VirtualService routing template

What it produces

5 files. Placeholder names such as __APP_NAME__ are what the renderer substitutes into.

authorization-policy.yaml
peer-authentication.yaml
README.md
request-authentication.yaml
virtual-service.yaml

Composes with

Composites that use it

  • Identity-Aware Spring Boot Microservice — Spring Boot 4 microservice on JDK 25 with identity enforced at both the service-mesh edge (Istio RequestAuthentication + AuthorizationPolicy) and the application boundary (Spring Security OAuth 2.0 resource server) — defense in depth against the same OIDC issuer.