emojivoto is working.

But... need to do major rework

only a single networkauthentication may be set
the required authenticationRefs in the authorization policy are anded
together so we should use a separate authorization policy for each
communication link

cmd/policygen/templates/linkerd/application/meshtlsauthentication.yaml

@@ -2,12 +2,13 @@
 apiVersion: policy.linkerd.io/v1alpha1
 kind: MeshTLSAuthentication
 metadata:
-  name: {{ .app.Name }}-{{.port}}
+  name: {{ .app.Name }}-p{{.port}}
   namespace: {{ .app.Namespace.Name }}
 spec:
   identityRefs:
   {{- range $sa := .serviceAccounts }}
     - kind: ServiceAccount
-      name: {{ $sa }}
+      name: {{ $sa.Name }}
+      namespace: {{ $sa.Namespace }}
   {{- end }}
 

cmd/policygen/templates/linkerd/application/server.yaml

@@ -1,7 +1,7 @@
 {{- range $port := .Ports }}
 {{- if or (eq $port.Protocol "TCP") (not $port.Protocol) }}
 ---
-apiVersion: policy.linkerd.io/v1beta1
+apiVersion: policy.linkerd.io/v1beta3
 kind: Server
 metadata:
   name: {{ $.Name }}-p{{ $port.Port }}