################################
# Deploy Citadel as a stand alone service in a cluster
################################
apiVersion: v1
kind: Namespace
metadata:
 name: istio-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: istio-citadel-istio-system
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "get", "watch", "list", "update", "delete"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "watch", "list"]
---
# Grant permissions to Citadel.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: istio-citadel-role-binding-istio-system
subjects:
- kind: ServiceAccount
  name: istio-citadel-service-account
  namespace: istio-system
roleRef:
  kind: ClusterRole
  name: istio-citadel-istio-system
  apiGroup: rbac.authorization.k8s.io
---
# Service account for Citadel
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-citadel-service-account
  namespace: istio-system
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: istio-standalone-citadel
  namespace: istio-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        istio: standalone-citadel
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: istio-citadel-service-account
      containers:
      - name: citadel
        image: gcr.io/istio-release/citadel:1.1.0.snapshot.0
        imagePullPolicy: IfNotPresent
        command: ["/usr/local/bin/istio_ca"]
        args:
          - --citadel-storage-namespace=istio-system
          - --grpc-port=8060
          - --grpc-host-identities=istio-standalone-citadel
          - --self-signed-ca=true
          - --self-signed-ca-org=test-org
          - --self-signed-ca-cert-ttl=24000h
          - --sign-ca-certs=true # Whether Citadel issues certs for other Citadels.
          - --workload-cert-ttl=21h
          - --logtostderr
          - --stderrthreshold
          - INFO
---
apiVersion: v1
kind: Service
metadata:
  name: standalone-citadel-ilb
  namespace: istio-system
  annotations:
    cloud.google.com/load-balancer-type: "internal"
  labels:
    istio: standalone-citadel
spec:
  type: LoadBalancer
  ports:
  - port: 8060
    protocol: TCP
  selector:
    istio: standalone-citadel
