Enable Istio mTLS for NATS Cluster

resources/nats/templates/destination-rule.yaml

@@ -14,5 +14,5 @@ spec:
   host: {{ include "nats.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
   trafficPolicy:
     tls:
-      mode: DISABLE
+      mode: ISTIO_MUTUAL
 {{- end }}

resources/nats/templates/peer-authentication.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.istio.enabled }}
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: {{ include "nats.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "nats.labels" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations:
+    {{- toYaml .Values.commonAnnotations | nindent 4 }}
+  {{- end }}
+spec:
+  mtls:
+    mode: STRICT
+  selector:
+    matchLabels:
+      {{- include "nats.selectorLabels" . | nindent 6 }}
+  {{- end }}

resources/nats/values.yaml

@@ -292,7 +292,7 @@ affinity:
 # Annotations to add to the NATS pods
 # ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
 podAnnotations: {
-  sidecar.istio.io/inject: "false"
+  sidecar.istio.io/inject: "true"
 }
 
 # Annotations to add to the NATS StatefulSet