feat: First draft new Istio 13 helm charts
This commit is contained in:
parent
4c91dc6ca4
commit
09bb5d427e
@ -2,8 +2,7 @@ apiVersion: v2
|
||||
name: kubezero-istio
|
||||
description: KubeZero Umbrella Chart for Istio
|
||||
type: application
|
||||
version: 0.7.6
|
||||
appVersion: 1.11.5
|
||||
version: 0.8.0
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
@ -17,9 +16,11 @@ dependencies:
|
||||
version: ">= 0.1.4"
|
||||
repository: https://cdn.zero-downtime.net/charts/
|
||||
- name: base
|
||||
version: 1.11.5
|
||||
- name: istio-discovery
|
||||
version: 1.11.5
|
||||
version: 1.13.3
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
- name: istiod
|
||||
version: 1.13.3
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
- name: kiali-server
|
||||
version: 1.38.1
|
||||
# repository: https://github.com/kiali/helm-charts/tree/master/docs
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# kubezero-istio
|
||||
|
||||
  
|
||||
 
|
||||
|
||||
KubeZero Umbrella Chart for Istio
|
||||
|
||||
@ -12,18 +12,18 @@ Installs the Istio control plane
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| Quarky9 | | |
|
||||
| Stefan Reimer | stefan@zero-downtime.net | |
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>= 1.18.0`
|
||||
Kubernetes: `>= 1.20.0`
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | base | 1.11.3 |
|
||||
| | istio-discovery | 1.11.3 |
|
||||
| | kiali-server | 1.38.1 |
|
||||
| https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.4 |
|
||||
| https://istio-release.storage.googleapis.com/charts | base | 1.13.3 |
|
||||
| https://istio-release.storage.googleapis.com/charts | istiod | 1.13.3 |
|
||||
|
||||
## Values
|
||||
|
||||
@ -32,12 +32,13 @@ Kubernetes: `>= 1.18.0`
|
||||
| global.defaultPodDisruptionBudget.enabled | bool | `false` | |
|
||||
| global.logAsJson | bool | `true` | |
|
||||
| global.priorityClassName | string | `"system-cluster-critical"` | |
|
||||
| global.tag | string | `"1.11.5-distroless"` | |
|
||||
| istio-discovery.meshConfig.accessLogEncoding | string | `"JSON"` | |
|
||||
| istio-discovery.meshConfig.accessLogFile | string | `"/dev/stdout"` | |
|
||||
| istio-discovery.meshConfig.tcpKeepalive.interval | string | `"60s"` | |
|
||||
| istio-discovery.meshConfig.tcpKeepalive.time | string | `"120s"` | |
|
||||
| istio-discovery.pilot.autoscaleEnabled | bool | `false` | |
|
||||
| istio-discovery.pilot.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
|
||||
| istio-discovery.pilot.nodeSelector."node-role.kubernetes.io/control-plane" | string | `""` | |
|
||||
| istio-discovery.pilot.replicaCount | int | `1` | |
|
||||
| istio-discovery.pilot.resources.requests.cpu | string | `"100m"` | |
|
||||
| istio-discovery.pilot.resources.requests.memory | string | `"128Mi"` | |
|
||||
|
||||
@ -1,11 +0,0 @@
|
||||
apiVersion: v1
|
||||
name: base
|
||||
version: 1.11.5
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for deploying Istio cluster resources and CRDs
|
||||
keywords:
|
||||
- istio
|
||||
sources:
|
||||
- http://github.com/istio/istio
|
||||
engine: gotpl
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
@ -1 +0,0 @@
|
||||
Installs Istio cluster resources: CRDs, cluster bindings and associated service accounts.
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,48 +0,0 @@
|
||||
# SYNC WITH manifests/charts/istio-operator/templates
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: istiooperators.install.istio.io
|
||||
labels:
|
||||
release: istio
|
||||
spec:
|
||||
conversion:
|
||||
strategy: None
|
||||
group: install.istio.io
|
||||
names:
|
||||
kind: IstioOperator
|
||||
listKind: IstioOperatorList
|
||||
plural: istiooperators
|
||||
singular: istiooperator
|
||||
shortNames:
|
||||
- iop
|
||||
- io
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Istio control plane revision
|
||||
jsonPath: .spec.revision
|
||||
name: Revision
|
||||
type: string
|
||||
- description: IOP current state
|
||||
jsonPath: .status.status
|
||||
name: Status
|
||||
type: string
|
||||
- description: 'CreationTimestamp is a timestamp representing the server time
|
||||
when this object was created. It is not guaranteed to be set in happens-before
|
||||
order across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
|
||||
lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
subresources:
|
||||
status: {}
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
served: true
|
||||
storage: true
|
||||
---
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- files/gen-istio-cluster.yaml
|
||||
@ -1,171 +0,0 @@
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
- "kubernetes.io/legacy-unknown"
|
||||
verbs: ["approve"]
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list", "create", "delete"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
{{- if or .Values.global.externalIstiod }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
---
|
||||
@ -1,37 +0,0 @@
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
@ -1,4 +0,0 @@
|
||||
{{- if .Values.base.enableCRDTemplates }}
|
||||
{{ .Files.Get "crds/crd-all.gen.yaml" }}
|
||||
{{ .Files.Get "crds/crd-operator.yaml" }}
|
||||
{{- end }}
|
||||
@ -1,30 +0,0 @@
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: istiod-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
{{- else if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,16 +0,0 @@
|
||||
# This service account aggregates reader permissions for the revisions in a given cluster
|
||||
# Should be used for remote secret creation.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
@ -1,25 +0,0 @@
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
@ -1,21 +0,0 @@
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
@ -1,19 +0,0 @@
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
@ -1,37 +0,0 @@
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
# when istiod is enabled in remote cluster, we can't use istiod service name
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
clusterIP: None
|
||||
{{- else }}
|
||||
# when istiod isn't enabled in remote cluster, we can use istiod service name
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
# if the remotePilotAddress is IP addr, we use clusterIP: None.
|
||||
# else, we use externalName
|
||||
{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
clusterIP: None
|
||||
{{- else }}
|
||||
type: ExternalName
|
||||
externalName: {{ .Values.global.remotePilotAddress }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,27 +0,0 @@
|
||||
global:
|
||||
|
||||
# ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
configValidation: true
|
||||
externalIstiod: false
|
||||
remotePilotAddress: ""
|
||||
|
||||
base:
|
||||
# Used for helm2 to add the CRDs to templates.
|
||||
enableCRDTemplates: false
|
||||
|
||||
# Validation webhook configuration url
|
||||
# For example: https://$remotePilotAddress:15017/validate
|
||||
validationURL: ""
|
||||
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
name: istio-discovery
|
||||
version: 1.11.5
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for istio control plane
|
||||
keywords:
|
||||
- istio
|
||||
- istiod
|
||||
- istio-discovery
|
||||
sources:
|
||||
- http://github.com/istio/istio
|
||||
engine: gotpl
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
@ -1,8 +0,0 @@
|
||||
Minimal control plane for Istio. Pilot and mesh config are included.
|
||||
|
||||
MCP and injector should optionally be installed in the same namespace. Alternatively remote
|
||||
address of an MCP server can be set.
|
||||
|
||||
|
||||
Thank you for installing Istio 1.11. Please take a few minutes to tell us about your install/upgrade experience!
|
||||
https://forms.gle/kWULBRjUv7hHci7T6
|
||||
@ -1,205 +0,0 @@
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }}
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" .Values.global.proxy.image }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (env "ENABLE_LEGACY_FSGROUP_INJECTION" "true") "true" }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,234 +0,0 @@
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
{{ if not (eq $container.Name "istio-proxy") }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: "GRPC_XDS_BOOTSTRAP"
|
||||
value: "/var/lib/istio/data/grpc-bootstrap.json"
|
||||
- name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
|
||||
value: "true"
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
env:
|
||||
- name: "GRPC_XDS_BOOTSTRAP"
|
||||
value: "/var/lib/istio/data/grpc-bootstrap.json"
|
||||
- name: ISTIO_META_GENERATOR
|
||||
value: grpc
|
||||
- name: OUTPUT_CERTS
|
||||
value: /var/lib/istio/data
|
||||
{{- if eq (env "PILOT_ENABLE_INBOUND_PASSTHROUGH" "true") "false" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
# grpc uses xds:/// to resolve – no need to resolve VIP
|
||||
- name: ISTIO_META_DNS_CAPTURE
|
||||
value: "false"
|
||||
- name: DISABLE_ENVOY
|
||||
value: "true"
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: {{ .Values.global.proxy.statusPort }}
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-xds
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
@ -1,58 +0,0 @@
|
||||
spec:
|
||||
initContainers:
|
||||
- name: grpc-bootstrap-init
|
||||
image: busybox:1.28
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
env:
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
command:
|
||||
- sh
|
||||
- "-c"
|
||||
- |-
|
||||
NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
|
||||
echo '
|
||||
{
|
||||
"xds_servers": [
|
||||
{
|
||||
"server_uri": "dns:///istiod.istio-system.svc:15010",
|
||||
"channel_creds": [{"type": "insecure"}],
|
||||
"server_features" : ["xds_v3"]
|
||||
}
|
||||
],
|
||||
"node": {
|
||||
"id": "'${NODE_ID}'",
|
||||
"metadata": {
|
||||
"GENERATOR": "grpc"
|
||||
}
|
||||
}
|
||||
}' > /var/lib/grpc/data/bootstrap.json
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: GRPC_XDS_BOOTSTRAP
|
||||
value: /var/lib/grpc/data/bootstrap.json
|
||||
- name: GRPC_GO_LOG_VERBOSITY_LEVEL
|
||||
value: "99"
|
||||
- name: GRPC_GO_LOG_SEVERITY_LEVEL
|
||||
value: info
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: grpc-io-proxyless-bootstrap
|
||||
emptyDir: {}
|
||||
@ -1,466 +0,0 @@
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio" | quote }}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
{{- if .Values.istio_cni.enabled }}
|
||||
{{- if not .Values.istio_cni.chained }}
|
||||
k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `istio-cni` }}',
|
||||
{{- end }}
|
||||
sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` `*` }}",
|
||||
traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
|
||||
traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
|
||||
{{- end }}
|
||||
}
|
||||
spec:
|
||||
{{- $holdProxy := or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts }}
|
||||
initContainers:
|
||||
{{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
|
||||
{{ if .Values.istio_cni.enabled -}}
|
||||
- name: istio-validation
|
||||
{{ else -}}
|
||||
- name: istio-init
|
||||
{{ end -}}
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- istio-iptables
|
||||
- "-p"
|
||||
- "15001"
|
||||
- "-z"
|
||||
- "15006"
|
||||
- "-u"
|
||||
- "1337"
|
||||
- "-m"
|
||||
- "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
|
||||
- "-i"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
|
||||
- "-x"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
|
||||
- "-b"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` `*` }}"
|
||||
- "-d"
|
||||
{{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
|
||||
- "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
|
||||
{{- else }}
|
||||
- "15090,15021"
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
|
||||
- "-q"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
|
||||
- "-o"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
|
||||
- "-k"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
|
||||
{{ end -}}
|
||||
{{ if .Values.istio_cni.enabled -}}
|
||||
- "--run-validation"
|
||||
- "--skip-rule-apply"
|
||||
{{ end -}}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
env:
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{- if not .Values.istio_cni.enabled }}
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
{{- if not .Values.istio_cni.enabled }}
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1337
|
||||
runAsUser: 1337
|
||||
runAsNonRoot: true
|
||||
{{- end }}
|
||||
restartPolicy: Always
|
||||
{{ end -}}
|
||||
{{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
- name: enable-core-dump
|
||||
args:
|
||||
- -c
|
||||
- sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
|
||||
command:
|
||||
- /bin/sh
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- SYS_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{ end }}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if gt .EstimatedConcurrency 0 }}
|
||||
- --concurrency
|
||||
- "{{ .EstimatedConcurrency }}"
|
||||
{{- end -}}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- else if $holdProxy }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if eq (env "PILOT_ENABLE_INBOUND_PASSTHROUGH" "true") "false" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: ISTIO_BOOTSTRAP_OVERRIDE
|
||||
value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
|
||||
{{- end }}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
{{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
add:
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
|
||||
- NET_ADMIN
|
||||
{{- end }}
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
|
||||
- NET_BIND_SERVICE
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
runAsGroup: 1337
|
||||
fsGroup: 1337
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else -}}
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1337
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- mountPath: /etc/istio/custom-bootstrap
|
||||
name: custom-bootstrap-volume
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
|
||||
name: lightstep-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- name: lightstep-certs
|
||||
secret:
|
||||
optional: true
|
||||
secretName: lightstep.cacert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (env "ENABLE_LEGACY_FSGROUP_INJECTION" "true") "true" }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
{{- end }}
|
||||
@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- files/gen-istio.yaml
|
||||
@ -1,26 +0,0 @@
|
||||
{{- if and .Values.pilot.autoscaleEnabled .Values.pilot.autoscaleMin .Values.pilot.autoscaleMax }}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
spec:
|
||||
maxReplicas: {{ .Values.pilot.autoscaleMax }}
|
||||
minReplicas: {{ .Values.pilot.autoscaleMin }}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
targetAverageUtilization: {{ .Values.pilot.cpu.targetAverageUtilization }}
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,112 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
- "kubernetes.io/legacy-unknown"
|
||||
verbs: ["approve"]
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list", "create", "delete"]
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
@ -1,14 +0,0 @@
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
data:
|
||||
extra.pem: {{ .Values.pilot.jwksResolverExtraRootCA | quote }}
|
||||
{{- end }}
|
||||
@ -1,100 +0,0 @@
|
||||
{{- define "mesh" }}
|
||||
# The trust domain corresponds to the trust root of a system.
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
|
||||
|
||||
defaultConfig:
|
||||
{{- if .Values.global.meshID }}
|
||||
meshId: {{ .Values.global.meshID }}
|
||||
{{- end }}
|
||||
tracing:
|
||||
{{- if eq .Values.global.proxy.tracer "lightstep" }}
|
||||
lightstep:
|
||||
# Address of the LightStep Satellite pool
|
||||
address: {{ .Values.global.tracer.lightstep.address }}
|
||||
# Access Token used to communicate with the Satellite pool
|
||||
accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
|
||||
{{- else if eq .Values.global.proxy.tracer "zipkin" }}
|
||||
zipkin:
|
||||
# Address of the Zipkin collector
|
||||
address: {{ .Values.global.tracer.zipkin.address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
|
||||
{{- else if eq .Values.global.proxy.tracer "datadog" }}
|
||||
datadog:
|
||||
# Address of the Datadog Agent
|
||||
address: {{ .Values.global.tracer.datadog.address | default "$(HOST_IP):8126" }}
|
||||
{{- else if eq .Values.global.proxy.tracer "stackdriver" }}
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
{{- if $.Values.global.tracer.stackdriver.debug }}
|
||||
debug: {{ $.Values.global.tracer.stackdriver.debug }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: {{ $.Values.global.tracer.stackdriver.maxNumberOfAttributes | default "200" }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: {{ $.Values.global.tracer.stackdriver.maxNumberOfAnnotations | default "200" }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: {{ $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents | default "200" }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
|
||||
{{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
|
||||
{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
|
||||
{{- else }}
|
||||
{}
|
||||
{{- end }}
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
|
||||
{{- else }}
|
||||
discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
|
||||
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
|
||||
{{- $originalMesh := include "mesh" . | fromYaml }}
|
||||
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
|
||||
|
||||
{{- if .Values.pilot.configMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
|
||||
# Configuration file for the mesh networks to be used by the Split Horizon EDS.
|
||||
meshNetworks: |-
|
||||
{{- if .Values.global.meshNetworks }}
|
||||
networks:
|
||||
{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
|
||||
{{- else }}
|
||||
networks: {}
|
||||
{{- end }}
|
||||
|
||||
mesh: |-
|
||||
{{- if .Values.meshConfig }}
|
||||
{{ $mesh | toYaml | indent 4 }}
|
||||
{{- else }}
|
||||
{{- include "mesh" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,222 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
{{- range $key, $val := .Values.pilot.deploymentLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.pilot.autoscaleEnabled }}
|
||||
{{- if .Values.pilot.replicaCount }}
|
||||
replicas: {{ .Values.pilot.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.pilot.rollingMaxSurge }}
|
||||
maxUnavailable: {{ .Values.pilot.rollingMaxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- if ne .Values.revision "" }}
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
operator.istio.io/component: "Pilot"
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio: istiod
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.meshConfig.enablePrometheusMerge }}
|
||||
prometheus.io/port: "15014"
|
||||
prometheus.io/scrape: "true"
|
||||
{{- end }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if .Values.pilot.podAnnotations }}
|
||||
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pilot.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.pilot.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.global.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.global.priorityClassName }}"
|
||||
{{- end }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
containers:
|
||||
- name: discovery
|
||||
{{- if contains "/" .Values.pilot.image }}
|
||||
image: "{{ .Values.pilot.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Values.global.tag }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "discovery"
|
||||
- --monitoringAddr=:15014
|
||||
{{- if .Values.global.logging.level }}
|
||||
- --log_output_level={{ .Values.global.logging.level }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
- --domain
|
||||
- {{ .Values.global.proxy.clusterDomain }}
|
||||
{{- if .Values.global.oneNamespace }}
|
||||
- "-a"
|
||||
- {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.plugins }}
|
||||
- --plugins={{ .Values.pilot.plugins }}
|
||||
{{- end }}
|
||||
- --keepaliveMaxServerConnectionAge
|
||||
- "{{ .Values.pilot.keepaliveMaxServerConnectionAge }}"
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
- containerPort: 15010
|
||||
protocol: TCP
|
||||
- containerPort: 15017
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 5
|
||||
env:
|
||||
- name: REVISION
|
||||
value: "{{ .Values.revision | default `default` }}"
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: KUBECONFIG
|
||||
value: /var/run/secrets/remote/config
|
||||
{{- if .Values.pilot.env }}
|
||||
{{- range $key, $val := .Values.pilot.env }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.traceSampling }}
|
||||
- name: PILOT_TRACE_SAMPLING
|
||||
value: "{{ .Values.pilot.traceSampling }}"
|
||||
{{- end }}
|
||||
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
|
||||
value: "{{ .Values.pilot.enableProtocolSniffingForOutbound }}"
|
||||
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
|
||||
value: "{{ .Values.pilot.enableProtocolSniffingForInbound }}"
|
||||
- name: ISTIOD_ADDR
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Release.Namespace }}.svc:15012
|
||||
- name: PILOT_ENABLE_ANALYSIS
|
||||
value: "{{ .Values.global.istiod.enableAnalysis }}"
|
||||
- name: CLUSTER_ID
|
||||
value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
|
||||
{{- if not .Values.telemetry.v2.enabled }}
|
||||
- name: PILOT_ENDPOINT_TELEMETRY_LABEL
|
||||
value: "false"
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if .Values.pilot.resources }}
|
||||
{{ toYaml .Values.pilot.resources | trim | indent 12 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsUser: 1337
|
||||
runAsGroup: 1337
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: local-certs
|
||||
mountPath: /var/run/secrets/istio-dns
|
||||
- name: cacerts
|
||||
mountPath: /etc/cacerts
|
||||
readOnly: true
|
||||
- name: istio-kubeconfig
|
||||
mountPath: /var/run/secrets/remote
|
||||
readOnly: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
mountPath: /cacerts
|
||||
{{- end }}
|
||||
volumes:
|
||||
# Technically not needed on this pod - but it helps debugging/testing SDS
|
||||
# Should be removed after everything works.
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: local-certs
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
{{- end }}
|
||||
# Optional: user-generated root
|
||||
- name: cacerts
|
||||
secret:
|
||||
secretName: cacerts
|
||||
optional: true
|
||||
- name: istio-kubeconfig
|
||||
secret:
|
||||
secretName: istio-kubeconfig
|
||||
optional: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
configMap:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
@ -1,67 +0,0 @@
|
||||
{{- if not .Values.global.omitSidecarInjectorConfigMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
|
||||
values: |-
|
||||
{{ pick .Values "global" "istio_cni" "sidecarInjectorWebhook" "revision" | toPrettyJson | indent 4 }}
|
||||
|
||||
# To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
|
||||
# and istiod webhook functionality.
|
||||
#
|
||||
# New fields should not use Values - it is a 'primary' config object, users should be able
|
||||
# to fine tune it or use it with kube-inject.
|
||||
config: |-
|
||||
# defaultTemplates defines the default template to use for pods that do not explicitly specify a template
|
||||
{{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
|
||||
defaultTemplates:
|
||||
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
defaultTemplates: [sidecar]
|
||||
{{- end }}
|
||||
policy: {{ .Values.global.proxy.autoInject }}
|
||||
alwaysInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
|
||||
neverInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
|
||||
injectedAnnotations:
|
||||
{{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
|
||||
"{{ $key }}": "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
|
||||
which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
|
||||
This should make it obvious that their installation is broken.
|
||||
*/}}
|
||||
template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
|
||||
templates:
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
|
||||
sidecar: |
|
||||
{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
|
||||
gateway: |
|
||||
{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
|
||||
grpc-simple: |
|
||||
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
|
||||
grpc-agent: |
|
||||
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.sidecarInjectorWebhook.templates }}
|
||||
{{ toYaml . | trim | indent 6 }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@ -1,144 +0,0 @@
|
||||
{{- /* Core defines the common configuration used by all webhook segments */}}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.istiodRemote.injectionURL }}
|
||||
url: "{{ .Values.istiodRemote.injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: "{{ .Values.istiodRemote.injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
caBundle: ""
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
{{- end }}
|
||||
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
|
||||
{{- if not .Values.global.operatorManageWebhooks }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq .Release.Namespace "istio-system"}}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- else }}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ .Release.Name }}
|
||||
webhooks:
|
||||
{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
|
||||
|
||||
{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
|
||||
{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- /* Webhooks for default revision */}}
|
||||
{{- if (eq .Values.revision "") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,25 +0,0 @@
|
||||
{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
istio: pilot
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,48 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
{{- if .Values.global.externalIstiod }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
@ -1,113 +0,0 @@
|
||||
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||
# Removed paths for legacy and default selectors since a revision tag
|
||||
# is inherently created from a specific revision
|
||||
{{- define "core" }}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.istiodRemote.injectionURL }}
|
||||
url: "{{ .Values.istiodRemote.injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: "{{ .Values.istiodRemote.injectionPath }}"
|
||||
{{- end }}
|
||||
caBundle: ""
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
{{- end }}
|
||||
|
||||
{{- range $tagName := $.Values.revisionTags }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq $.Release.Namespace "istio-system"}}
|
||||
name: istio-revision-tag-{{ $tagName }}
|
||||
{{- else }}
|
||||
name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/tag: {{ $tagName }}
|
||||
istio.io/rev: {{ $.Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ $.Release.Name }}
|
||||
webhooks:
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
|
||||
{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
|
||||
{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
|
||||
{{- if (eq $tagName "default") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
@ -1,16 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
@ -1,37 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: istiod
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15010
|
||||
name: grpc-xds # plaintext
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
name: https-dns # mTLS with k8s-signed cert
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
name: https-webhook # validation and injection
|
||||
targetPort: 15017
|
||||
protocol: TCP
|
||||
- port: 15014
|
||||
name: http-monitoring # prometheus stats
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision }}
|
||||
{{- else }}
|
||||
# Label used by the 'default' service. For versioned deployments we match with app and version.
|
||||
# This avoids default deployment picking the canary
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
---
|
||||
@ -1,783 +0,0 @@
|
||||
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
|
||||
# Note: metadata exchange filter is wasm enabled only in sidecars.
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: metadata-exchange-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{}
|
||||
vm_config:
|
||||
{{- if .Values.telemetry.v2.metadataExchange.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/metadata-exchange-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.metadata_exchange
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{}
|
||||
vm_config:
|
||||
{{- if .Values.telemetry.v2.metadataExchange.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/metadata-exchange-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.metadata_exchange
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{}
|
||||
vm_config:
|
||||
{{- if .Values.telemetry.v2.metadataExchange.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/metadata-exchange-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.metadata_exchange
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-metadata-exchange-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener: {}
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
|
||||
value:
|
||||
protocol: istio-peer-exchange
|
||||
- applyTo: CLUSTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
cluster: {}
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
filters:
|
||||
- name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
|
||||
value:
|
||||
protocol: istio-peer-exchange
|
||||
- applyTo: CLUSTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
cluster: {}
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
filters:
|
||||
- name: istio.metadata_exchange
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
|
||||
value:
|
||||
protocol: istio-peer-exchange
|
||||
---
|
||||
# Note: http stats filter is wasm enabled only in sidecars.
|
||||
{{- if .Values.telemetry.v2.prometheus.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stats-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true,
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
---
|
||||
# Note: tcp stats filter is wasm enabled only in sidecars.
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stats-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.v2.stackdriver.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stackdriver-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
{{- if .Values.telemetry.v2.accessLogPolicy.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-sampling-accesslog-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "istio.stackdriver"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.access_log
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{
|
||||
"log_window_duration": "{{ .Values.telemetry.v2.accessLogPolicy.logWindowDuration }}"
|
||||
}
|
||||
vm_config:
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: "envoy.wasm.access_log_policy" }
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,86 +0,0 @@
|
||||
{{- if .Values.global.configValidation }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
webhooks:
|
||||
# Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
|
||||
# are rejecting invalid configs on a per-revision basis.
|
||||
- name: rev.validation.istio.io
|
||||
clientConfig:
|
||||
# Should change from base but cannot for API compat
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
caBundle: "" # patched at runtime when the webhook is ready.
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
# Webhook handling default validation
|
||||
- name: validation.istio.io
|
||||
clientConfig:
|
||||
# Should change from base but cannot for API compat
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
caBundle: ""
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
failurePolicy: Ignore
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
---
|
||||
{{- end }}
|
||||
@ -1,525 +0,0 @@
|
||||
#.Values.pilot for discovery and mesh wide config
|
||||
|
||||
## Discovery Settings
|
||||
pilot:
|
||||
autoscaleEnabled: true
|
||||
autoscaleMin: 1
|
||||
autoscaleMax: 5
|
||||
replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
||||
hub: ""
|
||||
tag: ""
|
||||
|
||||
# Can be a full hub/image:tag
|
||||
image: pilot
|
||||
traceSampling: 1.0
|
||||
|
||||
# Resources for a small pilot install
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2048Mi
|
||||
|
||||
env: {}
|
||||
|
||||
cpu:
|
||||
targetAverageUtilization: 80
|
||||
|
||||
# if protocol sniffing is enabled for outbound
|
||||
enableProtocolSniffingForOutbound: true
|
||||
# if protocol sniffing is enabled for inbound
|
||||
enableProtocolSniffingForInbound: true
|
||||
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
|
||||
# You can use jwksResolverExtraRootCA to provide a root certificate
|
||||
# in PEM format. This will then be trusted by pilot when resolving
|
||||
# JWKS URIs.
|
||||
jwksResolverExtraRootCA: ""
|
||||
|
||||
# This is used to set the source of configuration for
|
||||
# the associated address in configSource, if nothing is specificed
|
||||
# the default MCP is assumed.
|
||||
configSource:
|
||||
subscribedResources: []
|
||||
|
||||
plugins: []
|
||||
|
||||
# The following is used to limit how long a sidecar can be connected
|
||||
# to a pilot. It balances out load across pilot instances at the cost of
|
||||
# increasing system churn.
|
||||
keepaliveMaxServerConnectionAge: 30m
|
||||
|
||||
# Additional labels to apply to the deployment.
|
||||
deploymentLabels: {}
|
||||
|
||||
|
||||
## Mesh config settings
|
||||
|
||||
# Install the mesh config map, generated from values.yaml.
|
||||
# If false, pilot wil use default values (by default) or user-supplied values.
|
||||
configMap: true
|
||||
|
||||
|
||||
sidecarInjectorWebhook:
|
||||
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
|
||||
# always skip the injection on pods that match that label selector, regardless of the global policy.
|
||||
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
|
||||
neverInjectSelector: []
|
||||
alwaysInjectSelector: []
|
||||
|
||||
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
|
||||
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
|
||||
#
|
||||
# annotations:
|
||||
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
#
|
||||
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
|
||||
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
|
||||
# injectedAnnotations:
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
|
||||
injectedAnnotations: {}
|
||||
|
||||
# This enables injection of sidecar in all namespaces,
|
||||
# with the exception of namespaces with "istio-injection:disabled" annotation
|
||||
# Only one environment should have this enabled.
|
||||
enableNamespacesByDefault: false
|
||||
|
||||
# Enable objectSelector to filter out pods with no need for sidecar before calling istiod.
|
||||
# It is enabled by default as the minimum supported Kubernetes version is 1.15+
|
||||
objectSelector:
|
||||
enabled: true
|
||||
autoInject: true
|
||||
|
||||
rewriteAppHTTPProbe: true
|
||||
|
||||
# Templates defines a set of custom injection templates that can be used. For example, defining:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
|
||||
# being injected with the hello=world labels.
|
||||
# This is intended for advanced configuration only; most users should use the built in template
|
||||
templates: {}
|
||||
|
||||
# Default templates specifies a set of default templates that are used in sidecar injection.
|
||||
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
|
||||
# To inject other additional templates, define it using the `templates` option, and add it to
|
||||
# the default templates list.
|
||||
# For example:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# defaultTemplates: ["sidecar", "hello"]
|
||||
defaultTemplates: []
|
||||
istiodRemote:
|
||||
# Sidecar injector mutating webhook configuration clientConfig.url value.
|
||||
# For example: https://$remotePilotAddress:15017/inject
|
||||
# The host should not refer to a service running in the cluster; use a service reference by specifying
|
||||
# the clientConfig.service field instead.
|
||||
injectionURL: ""
|
||||
|
||||
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
|
||||
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
|
||||
injectionPath: "/inject"
|
||||
telemetry:
|
||||
enabled: true
|
||||
v2:
|
||||
# For Null VM case now.
|
||||
# This also enables metadata exchange.
|
||||
enabled: true
|
||||
metadataExchange:
|
||||
# Indicates whether to enable WebAssembly runtime for metadata exchange filter.
|
||||
wasmEnabled: false
|
||||
# Indicate if prometheus stats filter is enabled or not
|
||||
prometheus:
|
||||
enabled: true
|
||||
# Indicates whether to enable WebAssembly runtime for stats filter.
|
||||
wasmEnabled: false
|
||||
# overrides stats EnvoyFilter configuration.
|
||||
configOverride:
|
||||
gateway: {}
|
||||
inboundSidecar: {}
|
||||
outboundSidecar: {}
|
||||
# stackdriver filter settings.
|
||||
stackdriver:
|
||||
enabled: false
|
||||
logging: false
|
||||
monitoring: false
|
||||
topology: false # deprecated. setting this to true will have no effect, as this option is no longer supported.
|
||||
disableOutbound: false
|
||||
# configOverride parts give you the ability to override the low level configuration params passed to envoy filter.
|
||||
|
||||
configOverride: {}
|
||||
# e.g.
|
||||
# disable_server_access_logging: false
|
||||
# disable_host_header_fallback: true
|
||||
# Access Log Policy Filter Settings. This enables filtering of access logs from stackdriver.
|
||||
accessLogPolicy:
|
||||
enabled: false
|
||||
# To reduce the number of successful logs, default log window duration is
|
||||
# set to 12 hours.
|
||||
logWindowDuration: "43200s"
|
||||
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||
revision: ""
|
||||
|
||||
# Revision tags are aliases to Istio control plane revisions
|
||||
revisionTags: []
|
||||
|
||||
# For Helm compatibility.
|
||||
ownerName: ""
|
||||
|
||||
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
|
||||
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
# Config for the default ProxyConfig.
|
||||
# Initially using directly the proxy metadata - can also be activated using annotations
|
||||
# on the pod. This is an unsupported low-level API, pending review and decisions on
|
||||
# enabling the feature. Enabling the DNS listener is safe - and allows further testing
|
||||
# and gradual adoption by setting capture only on specific workloads. It also allows
|
||||
# VMs to use other DNS options, like dnsmasq or unbound.
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
|
||||
rootNamespace:
|
||||
|
||||
# The trust domain corresponds to the trust root of a system
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# TODO: the intent is to eventually have this enabled by default when security is used.
|
||||
# It is not clear if user should normally need to configure - the metadata is typically
|
||||
# used as an escape and to control testing and rollout, but it is not intended as a long-term
|
||||
# stable API.
|
||||
|
||||
# What we may configure in mesh config is the ".global" - and use of other suffixes.
|
||||
# No hurry to do this in 1.6, we're trying to prove the code.
|
||||
|
||||
global:
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
# enable pod disruption budget for the control plane, which is used to
|
||||
# ensure Istio control plane components are gradually upgraded or recovered.
|
||||
defaultPodDisruptionBudget:
|
||||
enabled: true
|
||||
# The values aren't mutable due to a current PodDisruptionBudget limitation
|
||||
# minAvailable: 1
|
||||
|
||||
# A minimal set of requested resources to applied to all deployments so that
|
||||
# Horizontal Pod Autoscaler will be able to function (if set).
|
||||
# Each component can overwrite these default values by adding its own resources
|
||||
# block in the relevant section below and setting the desired resources values.
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
# memory: 128Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# Default hub for Istio images.
|
||||
# Releases are published to docker hub under 'istio' project.
|
||||
# Dev builds from prow are on gcr.io
|
||||
hub: docker.io/istio
|
||||
# Default tag for Istio images.
|
||||
tag: 1.11.5
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
imagePullPolicy: ""
|
||||
|
||||
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
|
||||
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
# - private-registry-key
|
||||
|
||||
# Enabled by default in master for maximising testing.
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
|
||||
logAsJson: false
|
||||
|
||||
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
|
||||
# The control plane has different scopes depending on component, but can configure default log level across all components
|
||||
# If empty, default scope and level will be used as configured in code
|
||||
logging:
|
||||
level: "default:info"
|
||||
|
||||
omitSidecarInjectorConfigMap: false
|
||||
|
||||
# Whether to restrict the applications namespace the controller manages;
|
||||
# If not set, controller watches all namespaces
|
||||
oneNamespace: false
|
||||
|
||||
# Configure whether Operator manages webhook configurations. The current behavior
|
||||
# of Istiod is to manage its own webhook configurations.
|
||||
# When this option is set as true, Istio Operator, instead of webhooks, manages the
|
||||
# webhook configurations. When this option is set as false, webhooks manage their
|
||||
# own webhook configurations.
|
||||
operatorManageWebhooks: false
|
||||
|
||||
# Custom DNS config for the pod to resolve names of services in other
|
||||
# clusters. Use this to add additional search domains, and other settings.
|
||||
# see
|
||||
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
|
||||
# This does not apply to gateway pods as they typically need a different
|
||||
# set of DNS settings than the normal application pods (e.g., in
|
||||
# multicluster scenarios).
|
||||
# NOTE: If using templates, follow the pattern in the commented example below.
|
||||
#podDNSSearchNamespaces:
|
||||
#- global
|
||||
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
|
||||
|
||||
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
|
||||
# system-node-critical, it is better to configure this in order to make sure your Istio pods
|
||||
# will not be killed because of low priority class.
|
||||
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
# for more detail.
|
||||
priorityClassName: ""
|
||||
|
||||
proxy:
|
||||
image: proxyv2
|
||||
|
||||
# This controls the 'policy' in the sidecar injector.
|
||||
autoInject: enabled
|
||||
|
||||
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
|
||||
# cluster domain. Default value is "cluster.local".
|
||||
clusterDomain: "cluster.local"
|
||||
|
||||
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
|
||||
# not set, then the global "logLevel" will be used.
|
||||
componentLogLevel: "misc:error"
|
||||
|
||||
# If set, newly injected sidecars will have core dumps enabled.
|
||||
enableCoreDump: false
|
||||
|
||||
# istio ingress capture allowlist
|
||||
# examples:
|
||||
# Redirect only selected ports: --includeInboundPorts="80,8080"
|
||||
excludeInboundPorts: ""
|
||||
|
||||
# istio egress capture allowlist
|
||||
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
|
||||
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
|
||||
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
|
||||
# be allowed by the sidecar
|
||||
includeIPRanges: "*"
|
||||
excludeIPRanges: ""
|
||||
excludeOutboundPorts: ""
|
||||
|
||||
# Log level for proxy, applies to gateways and sidecars.
|
||||
# Expected values are: trace|debug|info|warning|error|critical|off
|
||||
logLevel: warning
|
||||
|
||||
#If set to true, istio-proxy container will have privileged securityContext
|
||||
privileged: false
|
||||
|
||||
# The number of successive failed probes before indicating readiness failure.
|
||||
readinessFailureThreshold: 30
|
||||
|
||||
# The initial delay for readiness probes in seconds.
|
||||
readinessInitialDelaySeconds: 1
|
||||
|
||||
# The period between readiness probes.
|
||||
readinessPeriodSeconds: 2
|
||||
|
||||
# Resources for the sidecar.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
|
||||
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
|
||||
statusPort: 15020
|
||||
|
||||
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver.
|
||||
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
|
||||
tracer: "zipkin"
|
||||
|
||||
# Controls if sidecar is injected at the front of the container list and blocks the start of the other containers until the proxy is ready
|
||||
holdApplicationUntilProxyStarts: false
|
||||
|
||||
proxy_init:
|
||||
# Base name for the proxy_init container, used to configure iptables.
|
||||
image: proxyv2
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 10Mi
|
||||
|
||||
# configure remote pilot and istiod service and endpoint
|
||||
remotePilotAddress: ""
|
||||
|
||||
##############################################################################################
|
||||
# The following values are found in other charts. To effectively modify these values, make #
|
||||
# make sure they are consistent across your Istio helm charts #
|
||||
##############################################################################################
|
||||
|
||||
# The customized CA address to retrieve certificates for the pods in the cluster.
|
||||
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
|
||||
# If not set explicitly, default to the Istio discovery address.
|
||||
caAddress: ""
|
||||
|
||||
# Configure a remote cluster data plane controlled by an external istiod.
|
||||
# When set to true, istiod is not deployed locally and only a subset of the other
|
||||
# discovery charts are enabled.
|
||||
externalIstiod: false
|
||||
|
||||
# Configure a remote cluster as the config cluster for an external istiod.
|
||||
configCluster: false
|
||||
|
||||
# Configure the policy for validating JWT.
|
||||
# Currently, two options are supported: "third-party-jwt" and "first-party-jwt".
|
||||
jwtPolicy: "third-party-jwt"
|
||||
|
||||
# Mesh ID means Mesh Identifier. It should be unique within the scope where
|
||||
# meshes will interact with each other, but it is not required to be
|
||||
# globally/universally unique. For example, if any of the following are true,
|
||||
# then two meshes must have different Mesh IDs:
|
||||
# - Meshes will have their telemetry aggregated in one place
|
||||
# - Meshes will be federated together
|
||||
# - Policy will be written referencing one mesh from the other
|
||||
#
|
||||
# If an administrator expects that any of these conditions may become true in
|
||||
# the future, they should ensure their meshes have different Mesh IDs
|
||||
# assigned.
|
||||
#
|
||||
# Within a multicluster mesh, each cluster must be (manually or auto)
|
||||
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
|
||||
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
|
||||
# of migration TBD, and it may be a disruptive operation to change the Mesh
|
||||
# ID post-install.
|
||||
#
|
||||
# If the mesh admin does not specify a value, Istio will use the value of the
|
||||
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
|
||||
# value.
|
||||
meshID: ""
|
||||
|
||||
# Configure the mesh networks to be used by the Split Horizon EDS.
|
||||
#
|
||||
# The following example defines two networks with different endpoints association methods.
|
||||
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
|
||||
# mapped to network1. The gateway for this network example is specified by its public IP
|
||||
# address and port.
|
||||
# The second network, `network2`, in this example is defined differently with all endpoints
|
||||
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
|
||||
# gateway is also defined differently with the name of the gateway service on the remote
|
||||
# cluster. The public IP for the gateway will be determined from that remote service (only
|
||||
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
|
||||
# it still need to be configured manually).
|
||||
#
|
||||
# meshNetworks:
|
||||
# network1:
|
||||
# endpoints:
|
||||
# - fromCidr: "192.168.0.1/24"
|
||||
# gateways:
|
||||
# - address: 1.1.1.1
|
||||
# port: 80
|
||||
# network2:
|
||||
# endpoints:
|
||||
# - fromRegistry: reg1
|
||||
# gateways:
|
||||
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
|
||||
# port: 443
|
||||
#
|
||||
meshNetworks: {}
|
||||
|
||||
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
|
||||
mountMtlsCerts: false
|
||||
|
||||
multiCluster:
|
||||
# Set to true to connect two kubernetes clusters via their respective
|
||||
# ingressgateway services when pods in each cluster cannot directly
|
||||
# talk to one another. All clusters should be using Istio mTLS and must
|
||||
# have a shared root CA for this model to work.
|
||||
enabled: false
|
||||
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
|
||||
# to properly label proxies
|
||||
clusterName: ""
|
||||
|
||||
# Network defines the network this cluster belong to. This name
|
||||
# corresponds to the networks in the map of mesh networks.
|
||||
network: ""
|
||||
|
||||
# Configure the certificate provider for control plane communication.
|
||||
# Currently, two providers are supported: "kubernetes" and "istiod".
|
||||
# As some platforms may not have kubernetes signing APIs,
|
||||
# Istiod is the default
|
||||
pilotCertProvider: istiod
|
||||
|
||||
sds:
|
||||
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
|
||||
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
|
||||
# JWT is intended for the CA.
|
||||
token:
|
||||
aud: istio-ca
|
||||
|
||||
sts:
|
||||
# The service port used by Security Token Service (STS) server to handle token exchange requests.
|
||||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# Configuration for each of the supported tracers
|
||||
tracer:
|
||||
# Configuration for envoy to send trace data to LightStep.
|
||||
# Disabled by default.
|
||||
# address: the <host>:<port> of the satellite pool
|
||||
# accessToken: required for sending data to the pool
|
||||
#
|
||||
datadog:
|
||||
# Host:Port for submitting traces to the Datadog agent.
|
||||
address: "$(HOST_IP):8126"
|
||||
lightstep:
|
||||
address: "" # example: lightstep-satellite:443
|
||||
accessToken: "" # example: abcdefg1234567
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
debug: false
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: 200
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: 200
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: 200
|
||||
zipkin:
|
||||
# Host:Port for reporting trace data in zipkin format. If not specified, will default to
|
||||
# zipkin service (port 9411) in the same namespace as the other istio components.
|
||||
address: ""
|
||||
|
||||
# Use the Mesh Control Protocol (MCP) for configuring Istiod. Requires an MCP source.
|
||||
useMCP: false
|
||||
|
||||
# Determines whether this istiod performs resource validation.
|
||||
configValidation: true
|
||||
|
||||
base:
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
@ -1,4 +1,4 @@
|
||||
{{- if index .Values "istio-discovery" "telemetry" "enabled" }}
|
||||
{{- if .Values.istiod.telemetry.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
{{- if and (index .Values "istio-discovery" "telemetry" "enabled") .Values.rateLimiting.enabled }}
|
||||
{{- if and .Values.istiod.telemetry.enabled .Values.rateLimiting.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
{{- if index .Values "istio-discovery" "telemetry" "enabled" }}
|
||||
{{- if .Values.istiod.telemetry.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
|
||||
@ -7,13 +7,9 @@ set -ex
|
||||
export ISTIO_VERSION=$(yq eval '.dependencies[] | select(.name=="base") | .version' Chart.yaml)
|
||||
export KIALI_VERSION=$(yq eval '.dependencies[] | select(.name=="kiali-server") | .version' Chart.yaml)
|
||||
|
||||
rm -rf istio
|
||||
curl -sL "https://github.com/istio/istio/releases/download/${ISTIO_VERSION}/istio-${ISTIO_VERSION}-linux-amd64.tar.gz" | tar xz
|
||||
mv istio-${ISTIO_VERSION} istio
|
||||
helm dep update
|
||||
|
||||
# remove unused old telemetry filters
|
||||
rm -f istio/manifests/charts/istio-control/istio-discovery/templates/telemetryv2_1.[6789].yaml
|
||||
rm -f istio/manifests/charts/istio-control/istio-discovery/templates/telemetryv2_1.10.yaml
|
||||
exit 0
|
||||
|
||||
# Patch
|
||||
#exit 0
|
||||
|
||||
@ -9,7 +9,7 @@ global:
|
||||
|
||||
priorityClassName: "system-cluster-critical"
|
||||
|
||||
istio-discovery:
|
||||
istiod:
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
replicaCount: 1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user