KubeZero/charts/kubezero-istio/templates/istio-private-ingress.yaml

{{- if .Values.ingress.private.enabled }}
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: kubezero-istio-private-ingress
  namespace: istio-system
  labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
spec:
  profile: empty
  components:
    ingressGateways:
    - name: istio-private-ingressgateway
      enabled: true
      namespace: istio-system
      k8s:
        replicaCount: {{ .Values.ingress.replicaCount }}
        {{- if .Values.ingress.autoscaleEnabled }}
        hpaSpec:
          maxReplicas: 5
          metrics:
          - resource:
              name: cpu
              targetAverageUtilization: 80
            type: Resource
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-private-ingressgateway
        {{- end }}
        env:
        # https://github.com/istio/istio/issues/26524
        #- name: TERMINATION_DRAIN_DURATION_SECONDS
        #  value: "60"
        - name: ISTIO_META_HTTP10
          value: '"1"'
        - name: ISTIO_META_ROUTER_MODE
          value: standard
        - name: ISTIO_META_IDLE_TIMEOUT
          value: "3600s"
        {{- if eq .Values.ingress.type "NodePort" }}
        nodeSelector:
          node.kubernetes.io/ingress.private: "{{ .Values.ingress.private.nodeSelector }}"
        {{- end }}
        resources:
          limits:
            # cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 64Mi
        strategy:
          rollingUpdate:
            maxSurge: 100%
            maxUnavailable: 25%
        overlays:
        - apiVersion: apps/v1
          kind: Deployment
          name: istio-private-ingressgateway
          patches:
            - path: spec.template.spec.containers.[name:istio-proxy].lifecycle
              value: {"preStop": {"exec": {"command": ["sh", "-c", "curl -X POST http://localhost:15000/healthcheck/fail && sleep 30"]}}}
            - path: spec.template.spec.terminationGracePeriodSeconds
              value: 90

  values:
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: {{ .Values.ingress.autoscaleEnabled }}
        externalTrafficPolicy: Local
        labels:
          app: istio-private-ingressgateway
          istio: private-ingressgateway
        meshExpansionPorts: []
        podAntiAffinityLabelSelector:
        - key: app
          operator: In
          topologyKey: kubernetes.io/hostname
          values: istio-private-ingressgateway
        type: {{ default "NodePort" .Values.ingress.type }}
        ports:
        - name: http-status
          port: 15021
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31021
          {{- end }}
        - name: http2
          port: 80
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31080
          {{- end }}
        - name: https
          port: 443
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31443
          {{- end }}
        - name: fluentd-forward
          port: 24224
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31224
          {{- end }}
        - name: amqps
          port: 5671
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31671
          {{- end }}
        - name: amqp
          port: 5672
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31672
          {{- end }}
        sds:
          enabled: true
          image: node-agent-k8s
          resources:
            limits:
              cpu: 2000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 128Mi
        secretVolumes:
        - mountPath: /etc/istio/ingressgateway-certs
          name: ingressgateway-certs
          secretName: istio-ingressgateway-certs
        - mountPath: /etc/istio/ingressgateway-ca-certs
          name: ingressgateway-ca-certs
          secretName: istio-ingressgateway-ca-certs

    global:
      jwtPolicy: first-party-jwt
{{- end }}