Merge pull request #7 from Bonial-International-GmbH/DS_sync_upstream

chore: sync with upstream

Author: sydorovdmytro

.gitignore

@@ -6,3 +6,9 @@
 __pycache__
 .pytest_cache
 *.pyc
+
+*bin/
+.DS_Store
+.vscode/
+
+.project

Documentation/istio.md

@@ -17,28 +17,24 @@ To install istio with this configuration, run:
 
 ```sh
 kubectl apply -f istio/istio-system-namespace.yaml
-kubectl apply -f istio/src
+istioctl install -f istio/gerrit.profile.yaml
 ```
 
 To install Gerrit using istio for networking, the namespace running Gerrit has to
 be configured to enable sidecar injection, by setting the `istio-injection: enabled`
 label. An example for such a namespace can be found at `./istio/namespace.yaml`.
+
 ## Uninstall istio
 
 To uninstall istio, run:
 
 ```sh
-kubectl delete -f istio/src
+istioctl uninstall -f istio/gerrit.profile.yaml
 ```
 
 ## Restricting access to a list of allowed IPs
 
 In development setups, it might be wanted to allow access to the setup only from
-specified IPs. This can usually be done using an AuthorizationPolicy. On AWS this
-does not work, since the load balancer hides the original IP. However, the
-istio-ingressgateway can be patched to enable access only from a given range of
-IPs. To do this, use the following command:
-
-```sh
-kubectl patch service istio-ingressgateway -n istio-system -p '{"spec":{"loadBalancerSourceRanges":["1.2.3.4"]}}'
-```
+specified IPs. This can be done by patching the `spec.loadBalancerSourceRanges`
+value of the service used for the IngressGateway. A patch doing that can be
+uncommented in `istio/gerrit.profile.yaml`.