add helm charts
This commit is contained in:
Ybehrooz
12
backing-services/istiod/Chart.yaml
Normal file
12
backing-services/istiod/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.26.1
|
||||
description: Helm chart for istio control plane
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
- istiod
|
||||
- istio-discovery
|
||||
name: istiod
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
version: 1.26.1
|
||||
73
backing-services/istiod/README.md
Normal file
73
backing-services/istiod/README.md
Normal file
@@ -0,0 +1,73 @@
|
||||
# Istiod Helm Chart
|
||||
|
||||
This chart installs an Istiod deployment.
|
||||
|
||||
## Setup Repo Info
|
||||
|
||||
```console
|
||||
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
|
||||
|
||||
To install the chart with the release name `istiod`:
|
||||
|
||||
```console
|
||||
kubectl create namespace istio-system
|
||||
helm install istiod istio/istiod --namespace istio-system
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `istiod` deployment:
|
||||
|
||||
```console
|
||||
helm delete istiod --namespace istio-system
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To view support configuration options and documentation, run:
|
||||
|
||||
```console
|
||||
helm show values istio/istiod
|
||||
```
|
||||
|
||||
### Profiles
|
||||
|
||||
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||
These can be set with `--set profile=<profile>`.
|
||||
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||
|
||||
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||
|
||||
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||
|
||||
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||
When configuring the chart, you should not include this.
|
||||
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||
|
||||
### Examples
|
||||
|
||||
#### Configuring mesh configuration settings
|
||||
|
||||
Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
|
||||
|
||||
```yaml
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
```
|
||||
|
||||
#### Revisions
|
||||
|
||||
Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
|
||||
This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
|
||||
|
||||
```yaml
|
||||
revision: my-revision-name
|
||||
```
|
||||
0
backing-services/istiod/bugx.values.yaml
Normal file
0
backing-services/istiod/bugx.values.yaml
Normal file
261
backing-services/istiod/files/gateway-injection-template.yaml
Normal file
261
backing-services/istiod/files/gateway-injection-template.yaml
Normal file
@@ -0,0 +1,261 @@
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations:
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }}
|
||||
{{- if ge (len $containers) 1 }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
|
||||
{{- end }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- if .Values.gateways.securityContext }}
|
||||
{{- toYaml .Values.gateways.securityContext | nindent 4 }}
|
||||
{{- else }}
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
env:
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
{{- if .CompliancePolicy }}
|
||||
- name: COMPLIANCE_POLICY
|
||||
value: "{{ .CompliancePolicy }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir: {}
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else}}
|
||||
- emptyDir: {}
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
{{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
318
backing-services/istiod/files/grpc-agent.yaml
Normal file
318
backing-services/istiod/files/grpc-agent.yaml
Normal file
@@ -0,0 +1,318 @@
|
||||
{{- define "resources" }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
{{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }},
|
||||
{{- if ge (len $containers) 1 }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false",
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15020
|
||||
protocol: TCP
|
||||
name: mesh-metrics
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
- --url=http://localhost:15020/healthz/ready
|
||||
env:
|
||||
- name: ISTIO_META_GENERATOR
|
||||
value: grpc
|
||||
- name: OUTPUT_CERTS
|
||||
value: /var/lib/istio/data
|
||||
{{- if eq .InboundTrafficPolicyMode "localhost" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
# grpc uses xds:/// to resolve – no need to resolve VIP
|
||||
- name: ISTIO_META_DNS_CAPTURE
|
||||
value: "false"
|
||||
- name: DISABLE_ENVOY
|
||||
value: "true"
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15020
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
{{ if not (eq $container.Name "istio-proxy") }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
|
||||
value: "true"
|
||||
- name: "GRPC_XDS_BOOTSTRAP"
|
||||
value: "/etc/istio/proxy/grpc-bootstrap.json"
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- emptyDir:
|
||||
name: workload-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else }}
|
||||
- emptyDir:
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-xds
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
{{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
65
backing-services/istiod/files/grpc-simple.yaml
Normal file
65
backing-services/istiod/files/grpc-simple.yaml
Normal file
@@ -0,0 +1,65 @@
|
||||
metadata:
|
||||
annotations:
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false"
|
||||
spec:
|
||||
initContainers:
|
||||
- name: grpc-bootstrap-init
|
||||
image: busybox:1.28
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
env:
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: ISTIO_NAMESPACE
|
||||
value: |
|
||||
{{ .Values.global.istioNamespace }}
|
||||
command:
|
||||
- sh
|
||||
- "-c"
|
||||
- |-
|
||||
NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
|
||||
SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
|
||||
echo '
|
||||
{
|
||||
"xds_servers": [
|
||||
{
|
||||
"server_uri": "'${SERVER_URI}'",
|
||||
"channel_creds": [{"type": "insecure"}],
|
||||
"server_features" : ["xds_v3"]
|
||||
}
|
||||
],
|
||||
"node": {
|
||||
"id": "'${NODE_ID}'",
|
||||
"metadata": {
|
||||
"GENERATOR": "grpc"
|
||||
}
|
||||
}
|
||||
}' > /var/lib/grpc/data/bootstrap.json
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: GRPC_XDS_BOOTSTRAP
|
||||
value: /var/lib/grpc/data/bootstrap.json
|
||||
- name: GRPC_GO_LOG_VERBOSITY_LEVEL
|
||||
value: "99"
|
||||
- name: GRPC_GO_LOG_SEVERITY_LEVEL
|
||||
value: info
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: grpc-io-proxyless-bootstrap
|
||||
emptyDir: {}
|
||||
530
backing-services/istiod/files/injection-template.yaml
Normal file
530
backing-services/istiod/files/injection-template.yaml
Normal file
@@ -0,0 +1,530 @@
|
||||
{{- define "resources" }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio" | quote }}
|
||||
{{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
|
||||
networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http" | quote }}
|
||||
{{- end }}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | trunc 63 | trimSuffix "-" | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }},
|
||||
{{- if ge (len $containers) 1 }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.cni.enabled }}
|
||||
{{- if eq .Values.pilot.cni.provider "multus" }}
|
||||
k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
|
||||
{{- end }}
|
||||
sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
|
||||
traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
|
||||
traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
|
||||
{{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
|
||||
{{- end }}
|
||||
}
|
||||
spec:
|
||||
{{- $holdProxy := and
|
||||
(or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
|
||||
(not $nativeSidecar) }}
|
||||
{{- $noInitContainer := and
|
||||
(eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
|
||||
(not $nativeSidecar) }}
|
||||
{{ if $noInitContainer }}
|
||||
initContainers: []
|
||||
{{ else -}}
|
||||
initContainers:
|
||||
{{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
|
||||
{{ if .Values.pilot.cni.enabled -}}
|
||||
- name: istio-validation
|
||||
{{ else -}}
|
||||
- name: istio-init
|
||||
{{ end -}}
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- istio-iptables
|
||||
- "-p"
|
||||
- {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
|
||||
- "-z"
|
||||
- {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
|
||||
- "-u"
|
||||
- {{ .ProxyUID | default "1337" | quote }}
|
||||
- "-m"
|
||||
- "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
|
||||
- "-i"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
|
||||
- "-x"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
|
||||
- "-b"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
|
||||
- "-d"
|
||||
{{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
|
||||
- "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
|
||||
{{- else }}
|
||||
- "15090,15021"
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
|
||||
- "-q"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
|
||||
- "-o"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
|
||||
- "-k"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
|
||||
- "-k"
|
||||
- "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
|
||||
- "-c"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
|
||||
{{ end -}}
|
||||
- "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
|
||||
{{ if .Values.global.logAsJson -}}
|
||||
- "--log_as_json"
|
||||
{{ end -}}
|
||||
{{ if .Values.pilot.cni.enabled -}}
|
||||
- "--run-validation"
|
||||
- "--skip-rule-apply"
|
||||
{{ else if .Values.global.proxy_init.forceApplyIptables -}}
|
||||
- "--force-apply"
|
||||
{{ end -}}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
env:
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{- if not .Values.pilot.cni.enabled }}
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
{{- if not .Values.pilot.cni.enabled }}
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsNonRoot: true
|
||||
{{- end }}
|
||||
{{ end -}}
|
||||
{{ end -}}
|
||||
{{ if not $nativeSidecar }}
|
||||
containers:
|
||||
{{ end }}
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{ if $nativeSidecar }}restartPolicy: Always{{end}}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.outlierLogPath }}
|
||||
- --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- else if $holdProxy }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
{{- else if $nativeSidecar }}
|
||||
{{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- request
|
||||
- --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
|
||||
- POST
|
||||
- drain
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if eq .InboundTrafficPolicyMode "localhost" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
{{- if .CompliancePolicy }}
|
||||
- name: COMPLIANCE_POLICY
|
||||
value: "{{ .CompliancePolicy }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ . }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: ISTIO_BOOTSTRAP_OVERRIDE
|
||||
value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
|
||||
{{- end }}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
{{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
{{ if .Values.global.proxy.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 1
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
|
||||
{{ end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
securityContext:
|
||||
{{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
add:
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
|
||||
- NET_ADMIN
|
||||
{{- end }}
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
|
||||
- NET_BIND_SERVICE
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else -}}
|
||||
runAsNonRoot: true
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- mountPath: /etc/istio/custom-bootstrap
|
||||
name: custom-bootstrap-volume
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
|
||||
name: lightstep-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- emptyDir:
|
||||
name: workload-socket
|
||||
- emptyDir:
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else }}
|
||||
- emptyDir:
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
{{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- name: lightstep-certs
|
||||
secret:
|
||||
optional: true
|
||||
secretName: lightstep.cacert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
401
backing-services/istiod/files/kube-gateway.yaml
Normal file
401
backing-services/istiod/files/kube-gateway.yaml
Normal file
@@ -0,0 +1,401 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{.ServiceAccount | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
{{- if ge .KubeVersion 128 }}
|
||||
# Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-gateway-controller"
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
"{{.GatewayNameLabel}}": {{.Name}}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toJsonMap
|
||||
(omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
|
||||
(strdict "istio.io/rev" (.Revision | default "default"))
|
||||
(strdict
|
||||
"prometheus.io/path" "/stats/prometheus"
|
||||
"prometheus.io/port" "15020"
|
||||
"prometheus.io/scrape" "true"
|
||||
) | nindent 8 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
(strdict
|
||||
"sidecar.istio.io/inject" "false"
|
||||
"service.istio.io/canonical-name" .DeploymentName
|
||||
"service.istio.io/canonical-revision" "latest"
|
||||
)
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-gateway-controller"
|
||||
) | nindent 8 }}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- if .Values.gateways.securityContext }}
|
||||
{{- toYaml .Values.gateways.securityContext | nindent 8 }}
|
||||
{{- else }}
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- if .Values.gateways.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{.ServiceAccount | quote}}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
resources:
|
||||
{{- toYaml .Values.global.proxy.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsNonRoot: true
|
||||
ports:
|
||||
- containerPort: 15020
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
- containerPort: 15021
|
||||
name: status-port
|
||||
protocol: TCP
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
|
||||
- --proxyComponentLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
|
||||
- --log_output_level
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: "[]"
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: ""
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: {{.|quote}}
|
||||
{{- end }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: {{.DeploymentName|quote}}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- with (index .InfrastructureLabels "topology.istio.io/network") }}
|
||||
- name: ISTIO_META_REQUESTED_NETWORK_VIEW
|
||||
value: {{.|quote}}
|
||||
{{- end }}
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 1
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 15
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir: {}
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else}}
|
||||
- emptyDir: {}
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
{{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: {{.UID}}
|
||||
spec:
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
{{- range $key, $val := .Ports }}
|
||||
- name: {{ $val.Name | quote }}
|
||||
port: {{ $val.Port }}
|
||||
protocol: TCP
|
||||
appProtocol: {{ $val.AppProtocol }}
|
||||
{{- end }}
|
||||
selector:
|
||||
"{{.GatewayNameLabel}}": {{.Name}}
|
||||
{{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
|
||||
loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
|
||||
{{- end }}
|
||||
type: {{ .ServiceType | quote }}
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{.DeploymentName | quote}}
|
||||
maxReplicas: 1
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
|
||||
|
||||
17
backing-services/istiod/files/profile-ambient.yaml
Normal file
17
backing-services/istiod/files/profile-ambient.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
@@ -0,0 +1,25 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.24 behavioral changes
|
||||
ENABLE_INBOUND_RETRY_POLICY: "false"
|
||||
EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
|
||||
PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
|
||||
ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
|
||||
PILOT_UNIFIED_SIDECAR_SCOPE: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.24 behaviour changes
|
||||
ENABLE_DEFERRED_STATS_CREATION: "false"
|
||||
BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
|
||||
|
||||
ambient:
|
||||
# Not present in <1.24, defaults to `true` in 1.25+
|
||||
reconcileIptablesOnStartup: false
|
||||
# 1.26 behavioral changes
|
||||
shareHostNetworkNamespace: true
|
||||
@@ -0,0 +1,13 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.24 behavioral changes
|
||||
PILOT_ENABLE_IP_AUTOALLOCATE: "false"
|
||||
ambient:
|
||||
dnsCapture: false
|
||||
reconcileIptablesOnStartup: false
|
||||
# 1.26 behavioral changes
|
||||
shareHostNetworkNamespace: true
|
||||
@@ -0,0 +1,7 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
ambient:
|
||||
# 1.26 behavioral changes
|
||||
shareHostNetworkNamespace: true
|
||||
94
backing-services/istiod/files/profile-demo.yaml
Normal file
94
backing-services/istiod/files/profile-demo.yaml
Normal file
@@ -0,0 +1,94 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||
# * Lower resource utilization.
|
||||
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||
# * More ports enabled on the ingress, which is used in some tasks.
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
extensionProviders:
|
||||
- name: otel
|
||||
envoyOtelAls:
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
port: 4317
|
||||
- name: skywalking
|
||||
skywalking:
|
||||
service: tracing.istio-system.svc.cluster.local
|
||||
port: 11800
|
||||
- name: otel-tracing
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
- name: jaeger
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: jaeger-collector.istio-system.svc.cluster.local
|
||||
|
||||
cni:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
ztunnel:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
global:
|
||||
proxy:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
waypoint:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
traceSampling: 100
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 100Mi
|
||||
|
||||
gateways:
|
||||
istio-egressgateway:
|
||||
autoscaleEnabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
istio-ingressgateway:
|
||||
autoscaleEnabled: false
|
||||
ports:
|
||||
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||
# Note that AWS ELB will by default perform health checks on the first port
|
||||
# on this list. Setting this to the health check port will ensure that health
|
||||
# checks always work. https://github.com/istio/istio/issues/12503
|
||||
- port: 15021
|
||||
targetPort: 15021
|
||||
name: status-port
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
name: http2
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
name: https
|
||||
- port: 31400
|
||||
targetPort: 31400
|
||||
name: tcp
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
10
backing-services/istiod/files/profile-platform-gke.yaml
Normal file
10
backing-services/istiod/files/profile-platform-gke.yaml
Normal file
@@ -0,0 +1,10 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
cni:
|
||||
cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
|
||||
resourceQuotas:
|
||||
enabled: true
|
||||
resourceQuotas:
|
||||
enabled: true
|
||||
7
backing-services/istiod/files/profile-platform-k3d.yaml
Normal file
7
backing-services/istiod/files/profile-platform-k3d.yaml
Normal file
@@ -0,0 +1,7 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
cni:
|
||||
cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
|
||||
cniBinDir: /bin
|
||||
7
backing-services/istiod/files/profile-platform-k3s.yaml
Normal file
7
backing-services/istiod/files/profile-platform-k3s.yaml
Normal file
@@ -0,0 +1,7 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
cni:
|
||||
cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
|
||||
cniBinDir: /var/lib/rancher/k3s/data/cni
|
||||
@@ -0,0 +1,7 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
cni:
|
||||
cniConfDir: /var/snap/microk8s/current/args/cni-network
|
||||
cniBinDir: /var/snap/microk8s/current/opt/cni/bin
|
||||
@@ -0,0 +1,6 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
cni:
|
||||
cniNetnsDir: /var/run/docker/netns
|
||||
@@ -0,0 +1,19 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||
cni:
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
provider: "multus"
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
seLinuxOptions:
|
||||
type: spc_t
|
||||
# Openshift requires privileged pods to run in kube-system
|
||||
trustedZtunnelNamespace: "kube-system"
|
||||
13
backing-services/istiod/files/profile-preview.yaml
Normal file
13
backing-services/istiod/files/profile-preview.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The preview profile contains features that are experimental.
|
||||
# This is intended to explore new features coming to Istio.
|
||||
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# Enable Istio agent to handle DNS requests for known hosts
|
||||
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||
ISTIO_META_DNS_CAPTURE: "true"
|
||||
13
backing-services/istiod/files/profile-remote.yaml
Normal file
13
backing-services/istiod/files/profile-remote.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
|
||||
istiodRemote:
|
||||
enabled: true
|
||||
configMap: false
|
||||
telemetry:
|
||||
enabled: false
|
||||
global:
|
||||
# TODO BML maybe a different profile for a configcluster/revisit this
|
||||
omitSidecarInjectorConfigMap: true
|
||||
8
backing-services/istiod/files/profile-stable.yaml
Normal file
8
backing-services/istiod/files/profile-stable.yaml
Normal file
@@ -0,0 +1,8 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||
experimental:
|
||||
stableValidationPolicy: true
|
||||
396
backing-services/istiod/files/waypoint.yaml
Normal file
396
backing-services/istiod/files/waypoint.yaml
Normal file
@@ -0,0 +1,396 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{.ServiceAccount | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
{{- if ge .KubeVersion 128 }}
|
||||
# Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-mesh-controller"
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
"{{.GatewayNameLabel}}": "{{.Name}}"
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toJsonMap
|
||||
(omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
|
||||
(strdict "istio.io/rev" (.Revision | default "default"))
|
||||
(strdict
|
||||
"prometheus.io/path" "/stats/prometheus"
|
||||
"prometheus.io/port" "15020"
|
||||
"prometheus.io/scrape" "true"
|
||||
) | nindent 8 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
(strdict
|
||||
"sidecar.istio.io/inject" "false"
|
||||
"istio.io/dataplane-mode" "none"
|
||||
"service.istio.io/canonical-name" .DeploymentName
|
||||
"service.istio.io/canonical-revision" "latest"
|
||||
)
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-mesh-controller"
|
||||
) | nindent 8}}
|
||||
spec:
|
||||
{{- if .Values.global.waypoint.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.waypoint.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.waypoint.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.waypoint.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: 2
|
||||
serviceAccountName: {{.ServiceAccount | quote}}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
ports:
|
||||
- containerPort: 15020
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
- containerPort: 15021
|
||||
name: status-port
|
||||
protocol: TCP
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
args:
|
||||
- proxy
|
||||
- waypoint
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --serviceCluster
|
||||
- {{.ServiceAccount}}.$(POD_NAMESPACE)
|
||||
- --proxyLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
|
||||
- --proxyComponentLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
|
||||
- --log_output_level
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.outlierLogPath }}
|
||||
- --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
|
||||
{{- end}}
|
||||
env:
|
||||
- name: ISTIO_META_SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
{{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
|
||||
{{- if $network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ $network }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: REDIRECT
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: {{.DeploymentName}}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.waypoint.resources }}
|
||||
resources:
|
||||
{{- toYaml .Values.global.waypoint.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 1
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 15
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
privileged: false
|
||||
{{- if not (eq .Values.global.platform "openshift") }}
|
||||
runAsGroup: 1337
|
||||
runAsUser: 1337
|
||||
{{- end }}
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- if .Values.gateways.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
name: workload-socket
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
- mountPath: /etc/istio/pod
|
||||
name: istio-podinfo
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: go-proxy-envoy
|
||||
- emptyDir: {}
|
||||
name: istio-data
|
||||
- emptyDir: {}
|
||||
name: go-proxy-data
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
path: labels
|
||||
- fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
path: annotations
|
||||
name: istio-podinfo
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: istio-ca
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
- name: istiod-ca-cert
|
||||
{{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{ toJsonMap
|
||||
(strdict "networking.istio.io/traffic-distribution" "PreferClose")
|
||||
(omit .InfrastructureAnnotations
|
||||
"kubectl.kubernetes.io/last-applied-configuration"
|
||||
"gateway.istio.io/name-override"
|
||||
"gateway.istio.io/service-account"
|
||||
"gateway.istio.io/controller-version"
|
||||
) | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
{{- range $key, $val := .Ports }}
|
||||
- name: {{ $val.Name | quote }}
|
||||
port: {{ $val.Port }}
|
||||
protocol: TCP
|
||||
appProtocol: {{ $val.AppProtocol }}
|
||||
{{- end }}
|
||||
selector:
|
||||
"{{.GatewayNameLabel}}": "{{.Name}}"
|
||||
{{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
|
||||
loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
|
||||
{{- end }}
|
||||
type: {{ .ServiceType | quote }}
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{.DeploymentName | quote}}
|
||||
maxReplicas: 1
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
|
||||
|
||||
82
backing-services/istiod/templates/NOTES.txt
Normal file
82
backing-services/istiod/templates/NOTES.txt
Normal file
@@ -0,0 +1,82 @@
|
||||
"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
|
||||
Next steps:
|
||||
{{- $profile := default "" .Values.profile }}
|
||||
{{- if (eq $profile "ambient") }}
|
||||
* Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
|
||||
* Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
|
||||
{{- else }}
|
||||
* Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
|
||||
* Try out our tasks to get started on common configurations:
|
||||
* https://istio.io/latest/docs/tasks/traffic-management
|
||||
* https://istio.io/latest/docs/tasks/security/
|
||||
* https://istio.io/latest/docs/tasks/policy-enforcement/
|
||||
{{- end }}
|
||||
* Review the list of actively supported releases, CVE publications and our hardening guide:
|
||||
* https://istio.io/latest/docs/releases/supported-releases/
|
||||
* https://istio.io/latest/news/security/
|
||||
* https://istio.io/latest/docs/ops/best-practices/security/
|
||||
|
||||
For further documentation see https://istio.io website
|
||||
|
||||
{{-
|
||||
$deps := dict
|
||||
"global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
|
||||
"global.certificates" "meshConfig.certificates"
|
||||
"global.localityLbSetting" "meshConfig.localityLbSetting"
|
||||
"global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
|
||||
"global.enableTracing" "meshConfig.enableTracing"
|
||||
"global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
|
||||
"global.proxy.accessLogFile" "meshConfig.accessLogFile"
|
||||
"global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
|
||||
"global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
|
||||
"global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
|
||||
"global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
|
||||
"global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
|
||||
"global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
|
||||
"pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
|
||||
"global.mtls.enabled" "the PeerAuthentication resource"
|
||||
"global.mtls.auto" "meshConfig.enableAutoMtls"
|
||||
"global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
|
||||
"global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
|
||||
"global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
|
||||
"global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
|
||||
"global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
|
||||
"istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
|
||||
}}
|
||||
{{- range $dep, $replace := $deps }}
|
||||
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
|
||||
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(") ".Values." (replace "." ")." $dep) ")}}") $}}
|
||||
{{- if not (eq $res "")}}
|
||||
WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{-
|
||||
$failDeps := dict
|
||||
"telemetry.v2.prometheus.configOverride"
|
||||
"telemetry.v2.stackdriver.configOverride"
|
||||
"telemetry.v2.stackdriver.disableOutbound"
|
||||
"telemetry.v2.stackdriver.outboundAccessLogging"
|
||||
"global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
|
||||
"global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
|
||||
"global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
|
||||
"global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
|
||||
}}
|
||||
{{- range $dep, $replace := $failDeps }}
|
||||
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
|
||||
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(") ".Values." (replace "." ")." $dep) ")}}") $}}
|
||||
{{- if not (eq $res "")}}
|
||||
{{fail (print $dep " is removed")}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
|
||||
{{- fail "pilotCertProvider=kubernetes is not supported" }}
|
||||
{{- end }}
|
||||
23
backing-services/istiod/templates/_helpers.tpl
Normal file
23
backing-services/istiod/templates/_helpers.tpl
Normal file
@@ -0,0 +1,23 @@
|
||||
{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
|
||||
{{ define "default-prometheus" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
|
||||
{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
|
||||
{{ define "default-sd-metrics" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
|
||||
{{/* SD has metrics and logging split. */}}
|
||||
{{ define "default-sd-logs" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
44
backing-services/istiod/templates/autoscale.yaml
Normal file
44
backing-services/istiod/templates/autoscale.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
# Not created if istiod is running remotely
|
||||
{{- if not .Values.istiodRemote.enabled }}
|
||||
{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
spec:
|
||||
maxReplicas: {{ .Values.autoscaleMax }}
|
||||
minReplicas: {{ .Values.autoscaleMin }}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
|
||||
{{- if .Values.memory.targetAverageUtilization }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.memory.targetAverageUtilization }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaleBehavior }}
|
||||
behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
206
backing-services/istiod/templates/clusterrole.yaml
Normal file
206
backing-services/istiod/templates/clusterrole.yaml
Normal file
@@ -0,0 +1,206 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["update", "patch"]
|
||||
resources:
|
||||
- authorizationpolicies/status
|
||||
- destinationrules/status
|
||||
- envoyfilters/status
|
||||
- gateways/status
|
||||
- peerauthentications/status
|
||||
- proxyconfigs/status
|
||||
- requestauthentications/status
|
||||
- serviceentries/status
|
||||
- sidecars/status
|
||||
- telemetries/status
|
||||
- virtualservices/status
|
||||
- wasmplugins/status
|
||||
- workloadentries/status
|
||||
- workloadgroups/status
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status", "serviceentries/status" ]
|
||||
- apiGroups: ["security.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "authorizationpolicies/status" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "services/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
{{- if .Values.taint.enabled }}
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch"]
|
||||
{{- end }}
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
|
||||
{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
{{- range .Values.global.certSigners }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
verbs: ["approve"]
|
||||
{{- end}}
|
||||
{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["clustertrustbundles"]
|
||||
verbs: ["update", "create", "delete"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["signers"]
|
||||
resourceNames: ["istio.io/istiod-ca"]
|
||||
verbs: ["attest"]
|
||||
{{- end }}
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["gateway.networking.x-k8s.io"]
|
||||
resources:
|
||||
- xbackendtrafficpolicies/status
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources:
|
||||
- backendtlspolicies/status
|
||||
- gatewayclasses/status
|
||||
- gateways/status
|
||||
- grpcroutes/status
|
||||
- httproutes/status
|
||||
- referencegrants/status
|
||||
- tcproutes/status
|
||||
- tlsroutes/status
|
||||
- udproutes/status
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gatewayclasses"]
|
||||
verbs: ["create", "update", "patch", "delete"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: [ "get", "watch", "list", "create", "delete"]
|
||||
|
||||
# Used for MCS serviceimport management
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "deployments" ]
|
||||
- apiGroups: ["autoscaling"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "horizontalpodautoscalers" ]
|
||||
- apiGroups: ["policy"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "poddisruptionbudgets" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "services" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "serviceaccounts"]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
40
backing-services/istiod/templates/clusterrolebinding.yaml
Normal file
40
backing-services/istiod/templates/clusterrolebinding.yaml
Normal file
@@ -0,0 +1,40 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
19
backing-services/istiod/templates/configmap-jwks.yaml
Normal file
19
backing-services/istiod/templates/configmap-jwks.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
# Not created if istiod is running remotely
|
||||
{{- if not .Values.istiodRemote.enabled }}
|
||||
{{- if .Values.jwksResolverExtraRootCA }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
data:
|
||||
extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
20
backing-services/istiod/templates/configmap-values.yaml
Normal file
20
backing-services/istiod/templates/configmap-values.yaml
Normal file
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
data:
|
||||
original-values: |-
|
||||
{{ .Values._original | toPrettyJson | indent 4 }}
|
||||
{{- $_ := unset $.Values "_original" }}
|
||||
merged-values: |-
|
||||
{{ .Values | toPrettyJson | indent 4 }}
|
||||
107
backing-services/istiod/templates/configmap.yaml
Normal file
107
backing-services/istiod/templates/configmap.yaml
Normal file
@@ -0,0 +1,107 @@
|
||||
{{- define "mesh" }}
|
||||
# The trust domain corresponds to the trust root of a system.
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
|
||||
|
||||
{{ $prom := include "default-prometheus" . | eq "true" }}
|
||||
{{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
|
||||
{{ $sdLogs := include "default-sd-logs" . | eq "true" }}
|
||||
{{- if or $prom $sdMetrics $sdLogs }}
|
||||
defaultProviders:
|
||||
{{- if or $prom $sdMetrics }}
|
||||
metrics:
|
||||
{{ if $prom }}- prometheus{{ end }}
|
||||
{{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
|
||||
{{- end }}
|
||||
{{- if and $sdMetrics $sdLogs }}
|
||||
accessLogging:
|
||||
- stackdriver
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
defaultConfig:
|
||||
{{- if .Values.global.meshID }}
|
||||
meshId: "{{ .Values.global.meshID }}"
|
||||
{{- end }}
|
||||
{{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
|
||||
image:
|
||||
imageType: {{. | quote}}
|
||||
{{- end }}
|
||||
{{- if not (eq .Values.global.proxy.tracer "none") }}
|
||||
tracing:
|
||||
{{- if eq .Values.global.proxy.tracer "lightstep" }}
|
||||
lightstep:
|
||||
# Address of the LightStep Satellite pool
|
||||
address: {{ .Values.global.tracer.lightstep.address }}
|
||||
# Access Token used to communicate with the Satellite pool
|
||||
accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
|
||||
{{- else if eq .Values.global.proxy.tracer "zipkin" }}
|
||||
zipkin:
|
||||
# Address of the Zipkin collector
|
||||
address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
|
||||
{{- else if eq .Values.global.proxy.tracer "datadog" }}
|
||||
datadog:
|
||||
# Address of the Datadog Agent
|
||||
address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
|
||||
{{- else if eq .Values.global.proxy.tracer "stackdriver" }}
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
|
||||
{{- else }}
|
||||
discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
|
||||
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
|
||||
{{- $originalMesh := include "mesh" . | fromYaml }}
|
||||
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
|
||||
|
||||
{{- if .Values.configMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
data:
|
||||
|
||||
# Configuration file for the mesh networks to be used by the Split Horizon EDS.
|
||||
meshNetworks: |-
|
||||
{{- if .Values.global.meshNetworks }}
|
||||
networks:
|
||||
{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
|
||||
{{- else }}
|
||||
networks: {}
|
||||
{{- end }}
|
||||
|
||||
mesh: |-
|
||||
{{- if .Values.meshConfig }}
|
||||
{{ $mesh | toYaml | indent 4 }}
|
||||
{{- else }}
|
||||
{{- include "mesh" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
306
backing-services/istiod/templates/deployment.yaml
Normal file
306
backing-services/istiod/templates/deployment.yaml
Normal file
@@ -0,0 +1,306 @@
|
||||
# Not created if istiod is running remotely
|
||||
{{- if not .Values.istiodRemote.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
{{- range $key, $val := .Values.deploymentLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaleEnabled }}
|
||||
{{- if .Values.replicaCount }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.rollingMaxSurge }}
|
||||
maxUnavailable: {{ .Values.rollingMaxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- if ne .Values.revision "" }}
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
operator.istio.io/component: "Pilot"
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio: istiod
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.podLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
istio.io/dataplane-mode: none
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 8 }}
|
||||
annotations:
|
||||
prometheus.io/port: "15014"
|
||||
prometheus.io/scrape: "true"
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{ toYaml .Values.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
- key: cni.istio.io/not-ready
|
||||
operator: "Exists"
|
||||
{{- with .Values.tolerations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.global.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.global.priorityClassName }}"
|
||||
{{- end }}
|
||||
{{- with .Values.initContainers }}
|
||||
initContainers:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: discovery
|
||||
{{- if contains "/" .Values.image }}
|
||||
image: "{{ .Values.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "discovery"
|
||||
- --monitoringAddr=:15014
|
||||
{{- if .Values.global.logging.level }}
|
||||
- --log_output_level={{ .Values.global.logging.level }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
- --domain
|
||||
- {{ .Values.global.proxy.clusterDomain }}
|
||||
{{- if .Values.taint.namespace }}
|
||||
- --cniNamespace={{ .Values.taint.namespace }}
|
||||
{{- end }}
|
||||
- --keepaliveMaxServerConnectionAge
|
||||
- "{{ .Values.keepaliveMaxServerConnectionAge }}"
|
||||
{{- if .Values.extraContainerArgs }}
|
||||
{{- with .Values.extraContainerArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
name: http-debug
|
||||
- containerPort: 15010
|
||||
protocol: TCP
|
||||
name: grpc-xds
|
||||
- containerPort: 15012
|
||||
protocol: TCP
|
||||
name: tls-xds
|
||||
- containerPort: 15017
|
||||
protocol: TCP
|
||||
name: https-webhooks
|
||||
- containerPort: 15014
|
||||
protocol: TCP
|
||||
name: http-monitoring
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 5
|
||||
env:
|
||||
- name: REVISION
|
||||
value: "{{ .Values.revision | default `default` }}"
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: KUBECONFIG
|
||||
value: /var/run/secrets/remote/config
|
||||
# If you explicitly told us where ztunnel lives, use that.
|
||||
# Otherwise, assume it lives in our namespace
|
||||
# Also, check for an explicit ENV override (legacy approach) and prefer that
|
||||
# if present
|
||||
{{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
|
||||
{{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
|
||||
{{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
|
||||
- name: CA_TRUSTED_NODE_ACCOUNTS
|
||||
value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
|
||||
{{- end }}
|
||||
{{- if .Values.env }}
|
||||
{{- range $key, $val := .Values.env }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envVarFrom }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.traceSampling }}
|
||||
- name: PILOT_TRACE_SAMPLING
|
||||
value: "{{ .Values.traceSampling }}"
|
||||
{{- end }}
|
||||
# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
|
||||
# don't set it here to avoid duplication.
|
||||
# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
|
||||
{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
|
||||
- name: EXTERNAL_ISTIOD
|
||||
value: "{{ .Values.global.externalIstiod }}"
|
||||
{{- end }}
|
||||
- name: PILOT_ENABLE_ANALYSIS
|
||||
value: "{{ .Values.global.istiod.enableAnalysis }}"
|
||||
- name: CLUSTER_ID
|
||||
value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
divisor: "1"
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
divisor: "1"
|
||||
- name: PLATFORM
|
||||
value: "{{ coalesce .Values.global.platform .Values.platform }}"
|
||||
resources:
|
||||
{{- if .Values.resources }}
|
||||
{{ toYaml .Values.resources | trim | indent 12 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- if .Values.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{ toYaml .Values.seccompProfile | trim | indent 14 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: istio-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
readOnly: true
|
||||
- name: local-certs
|
||||
mountPath: /var/run/secrets/istio-dns
|
||||
- name: cacerts
|
||||
mountPath: /etc/cacerts
|
||||
readOnly: true
|
||||
- name: istio-kubeconfig
|
||||
mountPath: /var/run/secrets/remote
|
||||
readOnly: true
|
||||
{{- if .Values.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
mountPath: /cacerts
|
||||
{{- end }}
|
||||
- name: istio-csr-dns-cert
|
||||
mountPath: /var/run/secrets/istiod/tls
|
||||
readOnly: true
|
||||
- name: istio-csr-ca-configmap
|
||||
mountPath: /var/run/secrets/istiod/ca
|
||||
readOnly: true
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
# Technically not needed on this pod - but it helps debugging/testing SDS
|
||||
# Should be removed after everything works.
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: local-certs
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
# Optional: user-generated root
|
||||
- name: cacerts
|
||||
secret:
|
||||
secretName: cacerts
|
||||
optional: true
|
||||
- name: istio-kubeconfig
|
||||
secret:
|
||||
secretName: istio-kubeconfig
|
||||
optional: true
|
||||
# Optional: istio-csr dns pilot certs
|
||||
- name: istio-csr-dns-cert
|
||||
secret:
|
||||
secretName: istiod-tls
|
||||
optional: true
|
||||
- name: istio-csr-ca-configmap
|
||||
{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
|
||||
projected:
|
||||
sources:
|
||||
- clusterTrustBundle:
|
||||
name: istio.io:istiod-ca:root-cert
|
||||
path: root-cert.pem
|
||||
optional: true
|
||||
{{- else }}
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
defaultMode: 420
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- if .Values.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
configMap:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ range $key, $value := .Values.gatewayClasses }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio-{{ $.Values.revision | default "default" }}-gatewayclass-{{$key}}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ $.Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ $.Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
gateway.istio.io/defaults-for-class: {{$key|quote}}
|
||||
{{- include "istio.labels" $ | nindent 4 }}
|
||||
data:
|
||||
{{ range $kind, $overlay := $value }}
|
||||
{{$kind}}: |
|
||||
{{$overlay|toYaml|trim|indent 4}}
|
||||
{{ end }}
|
||||
---
|
||||
{{ end }}
|
||||
@@ -0,0 +1,82 @@
|
||||
{{- if not .Values.global.omitSidecarInjectorConfigMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
|
||||
values: |-
|
||||
{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
|
||||
{{ $pilotVals := pick .Values "cni" "env" -}}
|
||||
{{ $vals = set $vals "pilot" $pilotVals -}}
|
||||
{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
|
||||
{{ $vals = set $vals "gateways" $gatewayVals -}}
|
||||
{{ $vals | toPrettyJson | indent 4 }}
|
||||
|
||||
# To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
|
||||
# and istiod webhook functionality.
|
||||
#
|
||||
# New fields should not use Values - it is a 'primary' config object, users should be able
|
||||
# to fine tune it or use it with kube-inject.
|
||||
config: |-
|
||||
# defaultTemplates defines the default template to use for pods that do not explicitly specify a template
|
||||
{{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
|
||||
defaultTemplates:
|
||||
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
defaultTemplates: [sidecar]
|
||||
{{- end }}
|
||||
policy: {{ .Values.global.proxy.autoInject }}
|
||||
alwaysInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
|
||||
neverInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
|
||||
injectedAnnotations:
|
||||
{{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
|
||||
"{{ $key }}": {{ $val | quote }}
|
||||
{{- end }}
|
||||
{{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
|
||||
which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
|
||||
This should make it obvious that their installation is broken.
|
||||
*/}}
|
||||
template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
|
||||
templates:
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
|
||||
sidecar: |
|
||||
{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
|
||||
gateway: |
|
||||
{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
|
||||
grpc-simple: |
|
||||
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
|
||||
grpc-agent: |
|
||||
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
|
||||
waypoint: |
|
||||
{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
|
||||
kube-gateway: |
|
||||
{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.sidecarInjectorWebhook.templates }}
|
||||
{{ toYaml . | trim | indent 6 }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
165
backing-services/istiod/templates/mutatingwebhook.yaml
Normal file
165
backing-services/istiod/templates/mutatingwebhook.yaml
Normal file
@@ -0,0 +1,165 @@
|
||||
# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
|
||||
{{- /* Core defines the common configuration used by all webhook segments */}}
|
||||
{{/* Copy just what we need to avoid expensive deepCopy */}}
|
||||
{{- $whv := dict
|
||||
"revision" .Values.revision
|
||||
"injectionPath" .Values.istiodRemote.injectionPath
|
||||
"injectionURL" .Values.istiodRemote.injectionURL
|
||||
"reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
|
||||
"caBundle" .Values.istiodRemote.injectionCABundle
|
||||
"namespace" .Release.Namespace }}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .injectionURL }}
|
||||
url: "{{ .injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||
namespace: {{ .namespace }}
|
||||
path: "{{ .injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
{{- if .caBundle }}
|
||||
caBundle: "{{ .caBundle }}"
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
reinvocationPolicy: "{{ .reinvocationPolicy }}"
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
|
||||
{{- if not .Values.global.operatorManageWebhooks }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq .Release.Namespace "istio-system"}}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- else }}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
{{- if $.Values.sidecarInjectorWebhookAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
|
||||
|
||||
{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
|
||||
{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- /* Webhooks for default revision */}}
|
||||
{{- if (eq .Values.revision "") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: "NotIn"
|
||||
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
30
backing-services/istiod/templates/poddisruptionbudget.yaml
Normal file
30
backing-services/istiod/templates/poddisruptionbudget.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
# Not created if istiod is running remotely
|
||||
{{- if not .Values.istiodRemote.enabled }}
|
||||
{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
istio: pilot
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision | quote }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
64
backing-services/istiod/templates/reader-clusterrole.yaml
Normal file
64
backing-services/istiod/templates/reader-clusterrole.yaml
Normal file
@@ -0,0 +1,64 @@
|
||||
{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istio-reader"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
- "telemetry.istio.io"
|
||||
- "extensions.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
# TODO(keithmattix): See if we can conditionally give permission to read secrets and configmaps iff externalIstiod
|
||||
# is enabled. Best I can tell, these two resources are only needed for configuring proxy TLS (i.e. CA certs).
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets", "configmaps"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["gateways"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "list", "watch", "create", "delete"]
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
{{- if .Values.istiodRemote.enabled }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istio-reader"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
@@ -0,0 +1,25 @@
|
||||
# This file is only used for remote `istiod` installs.
|
||||
{{- if .Values.istiodRemote.enabled }}
|
||||
# if the remotePilotAddress is an IP addr
|
||||
{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
- port: 15017
|
||||
name: tcp-webhook
|
||||
protocol: TCP
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
35
backing-services/istiod/templates/remote-istiod-service.yaml
Normal file
35
backing-services/istiod/templates/remote-istiod-service.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
# This file is only used for remote `istiod` installs.
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{ include "istio.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
targetPort: 15017
|
||||
name: tcp-webhook
|
||||
protocol: TCP
|
||||
{{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
|
||||
# if the remotePilotAddress is not an IP addr, we use ExternalName
|
||||
type: ExternalName
|
||||
externalName: {{ .Values.global.remotePilotAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- range .Values.global.ipFamilies }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
149
backing-services/istiod/templates/revision-tags.yaml
Normal file
149
backing-services/istiod/templates/revision-tags.yaml
Normal file
@@ -0,0 +1,149 @@
|
||||
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||
# Removed paths for legacy and default selectors since a revision tag
|
||||
# is inherently created from a specific revision
|
||||
# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
|
||||
{{- $whv := dict
|
||||
"revision" .Values.revision
|
||||
"injectionPath" .Values.istiodRemote.injectionPath
|
||||
"injectionURL" .Values.istiodRemote.injectionURL
|
||||
"reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
|
||||
"namespace" .Release.Namespace }}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .injectionURL }}
|
||||
url: "{{ .injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||
namespace: {{ .namespace }}
|
||||
path: "{{ .injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
reinvocationPolicy: "{{ .reinvocationPolicy }}"
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
{{- range $tagName := $.Values.revisionTags }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq $.Release.Namespace "istio-system"}}
|
||||
name: istio-revision-tag-{{ $tagName }}
|
||||
{{- else }}
|
||||
name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/tag: {{ $tagName }}
|
||||
istio.io/rev: {{ $.Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ $.Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" $ | nindent 4 }}
|
||||
{{- if $.Values.sidecarInjectorWebhookAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
|
||||
{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
|
||||
{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
|
||||
{{- if (eq $tagName "default") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: "NotIn"
|
||||
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
35
backing-services/istiod/templates/role.yaml
Normal file
35
backing-services/istiod/templates/role.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
|
||||
# For status controller, so it can delete the distribution report configmap
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["delete"]
|
||||
|
||||
# For gateway deployment controller
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "update", "patch", "create"]
|
||||
{{- end }}
|
||||
21
backing-services/istiod/templates/rolebinding.yaml
Normal file
21
backing-services/istiod/templates/rolebinding.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
{{- end }}
|
||||
55
backing-services/istiod/templates/service.yaml
Normal file
55
backing-services/istiod/templates/service.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
# Not created if istiod is running remotely
|
||||
{{- if not .Values.istiodRemote.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.serviceAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.serviceAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: istiod
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15010
|
||||
name: grpc-xds # plaintext
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
name: https-dns # mTLS with k8s-signed cert
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
name: https-webhook # validation and injection
|
||||
targetPort: 15017
|
||||
protocol: TCP
|
||||
- port: 15014
|
||||
name: http-monitoring # prometheus stats
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision | quote }}
|
||||
{{- else }}
|
||||
# Label used by the 'default' service. For versioned deployments we match with app and version.
|
||||
# This avoids default deployment picking the canary
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
{{- if .Values.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- range .Values.ipFamilies }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
24
backing-services/istiod/templates/serviceaccount.yaml
Normal file
24
backing-services/istiod/templates/serviceaccount.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
{{- if .Values.serviceAccountAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
@@ -0,0 +1,63 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
{{- if .Values.experimental.stableValidationPolicy }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicy
|
||||
metadata:
|
||||
name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
labels:
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
spec:
|
||||
failurePolicy: Fail
|
||||
matchConstraints:
|
||||
resourceRules:
|
||||
- apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions: ["*"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["*"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
variables:
|
||||
- name: isEnvoyFilter
|
||||
expression: "object.kind == 'EnvoyFilter'"
|
||||
- name: isWasmPlugin
|
||||
expression: "object.kind == 'WasmPlugin'"
|
||||
- name: isProxyConfig
|
||||
expression: "object.kind == 'ProxyConfig'"
|
||||
- name: isTelemetry
|
||||
expression: "object.kind == 'Telemetry'"
|
||||
validations:
|
||||
- expression: "!variables.isEnvoyFilter"
|
||||
- expression: "!variables.isWasmPlugin"
|
||||
- expression: "!variables.isProxyConfig"
|
||||
- expression: |
|
||||
!(
|
||||
variables.isTelemetry && (
|
||||
(has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
|
||||
(has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
|
||||
(has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
|
||||
)
|
||||
)
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicyBinding
|
||||
metadata:
|
||||
name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
spec:
|
||||
policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
validationActions: [Deny]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,68 @@
|
||||
# Created if this is not a remote istiod, OR if it is and is also a config cluster
|
||||
{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
|
||||
{{- if .Values.global.configValidation }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
app.kubernetes.io/name: "istiod"
|
||||
{{- include "istio.labels" . | nindent 4 }}
|
||||
webhooks:
|
||||
# Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
|
||||
# are rejecting invalid configs on a per-revision basis.
|
||||
- name: rev.validation.istio.io
|
||||
clientConfig:
|
||||
# Should change from base but cannot for API compat
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
caBundle: "{{ .Values.base.validationCABundle }}"
|
||||
{{- end }}
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
# Disable webhook controller in Pilot to stop patching it
|
||||
failurePolicy: Fail
|
||||
{{- else }}
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,3 @@
|
||||
{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
|
||||
Due to the file naming, this always happens after zzz_profile.yaml */}}
|
||||
{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
|
||||
75
backing-services/istiod/templates/zzz_profile.yaml
Normal file
75
backing-services/istiod/templates/zzz_profile.yaml
Normal file
@@ -0,0 +1,75 @@
|
||||
{{/*
|
||||
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||
The original version of this file is located at /manifests directory.
|
||||
If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
Complex logic ahead...
|
||||
We have three sets of values, in order of precedence (last wins):
|
||||
1. The builtin values.yaml defaults
|
||||
2. The profile the user selects
|
||||
3. Users input (-f or --set)
|
||||
|
||||
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||
|
||||
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||
*/}}
|
||||
{{- if $.Values.defaults}}
|
||||
{{ fail (cat
|
||||
"Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
|
||||
($.Values.defaults | toYaml |nindent 4)
|
||||
) }}
|
||||
{{- end }}
|
||||
{{- $defaults := $.Values._internal_defaults_do_not_set }}
|
||||
{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
|
||||
{{- $profile := dict }}
|
||||
{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
|
||||
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||
{{- $profile = (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown profile" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.compatibilityVersion }}
|
||||
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
|
||||
{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown platform" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $profile }}
|
||||
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||
{{- end }}
|
||||
# Flatten globals, if defined on a per-chart basis
|
||||
{{- if false }}
|
||||
{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict) }}
|
||||
{{- end }}
|
||||
{{- $x := set $.Values "_original" (deepCopy $.Values) }}
|
||||
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||
|
||||
{{/*
|
||||
Labels that should be applied to ALL resources.
|
||||
*/}}
|
||||
{{- define "istio.labels" -}}
|
||||
{{- if .Release.Service -}}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
{{- end }}
|
||||
{{- if .Release.Name }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/part-of: "istio"
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Chart.Name .Chart.Version }}
|
||||
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
553
backing-services/istiod/values.yaml
Normal file
553
backing-services/istiod/values.yaml
Normal file
@@ -0,0 +1,553 @@
|
||||
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
|
||||
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
|
||||
_internal_defaults_do_not_set:
|
||||
autoscaleEnabled: true
|
||||
autoscaleMin: 1
|
||||
autoscaleMax: 5
|
||||
autoscaleBehavior: {}
|
||||
replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
||||
hub: ""
|
||||
tag: ""
|
||||
variant: ""
|
||||
|
||||
# Can be a full hub/image:tag
|
||||
image: pilot
|
||||
traceSampling: 1.0
|
||||
|
||||
# Resources for a small pilot install
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2048Mi
|
||||
|
||||
# Set to `type: RuntimeDefault` to use the default profile if available.
|
||||
seccompProfile: {}
|
||||
|
||||
# Whether to use an existing CNI installation
|
||||
cni:
|
||||
enabled: false
|
||||
provider: default
|
||||
|
||||
# Additional container arguments
|
||||
extraContainerArgs: []
|
||||
|
||||
env: {}
|
||||
|
||||
envVarFrom: []
|
||||
|
||||
# Settings related to the untaint controller
|
||||
# This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
|
||||
# It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
|
||||
taint:
|
||||
# Controls whether or not the untaint controller is active
|
||||
enabled: false
|
||||
# What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
|
||||
namespace: ""
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
cpu:
|
||||
targetAverageUtilization: 80
|
||||
memory: {}
|
||||
# targetAverageUtilization: 80
|
||||
|
||||
# Additional volumeMounts to the istiod container
|
||||
volumeMounts: []
|
||||
|
||||
# Additional volumes to the istiod pod
|
||||
volumes: []
|
||||
|
||||
# Inject initContainers into the istiod pod
|
||||
initContainers: []
|
||||
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
serviceAnnotations: {}
|
||||
serviceAccountAnnotations: {}
|
||||
sidecarInjectorWebhookAnnotations: {}
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# You can use jwksResolverExtraRootCA to provide a root certificate
|
||||
# in PEM format. This will then be trusted by pilot when resolving
|
||||
# JWKS URIs.
|
||||
jwksResolverExtraRootCA: ""
|
||||
|
||||
# The following is used to limit how long a sidecar can be connected
|
||||
# to a pilot. It balances out load across pilot instances at the cost of
|
||||
# increasing system churn.
|
||||
keepaliveMaxServerConnectionAge: 30m
|
||||
|
||||
# Additional labels to apply to the deployment.
|
||||
deploymentLabels: {}
|
||||
|
||||
## Mesh config settings
|
||||
|
||||
# Install the mesh config map, generated from values.yaml.
|
||||
# If false, pilot wil use default values (by default) or user-supplied values.
|
||||
configMap: true
|
||||
|
||||
# Additional labels to apply on the pod level for monitoring and logging configuration.
|
||||
podLabels: {}
|
||||
|
||||
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
|
||||
ipFamilyPolicy: ""
|
||||
ipFamilies: []
|
||||
|
||||
# Ambient mode only.
|
||||
# Set this if you install ztunnel to a different namespace from `istiod`.
|
||||
# If set, `istiod` will allow connections from trusted node proxy ztunnels
|
||||
# in the provided namespace.
|
||||
# If unset, `istiod` will assume the trusted node proxy ztunnel resides
|
||||
# in the same namespace as itself.
|
||||
trustedZtunnelNamespace: ""
|
||||
# Set this if you install ztunnel with a name different from the default.
|
||||
trustedZtunnelName: ""
|
||||
|
||||
sidecarInjectorWebhook:
|
||||
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
|
||||
# always skip the injection on pods that match that label selector, regardless of the global policy.
|
||||
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
|
||||
neverInjectSelector: []
|
||||
alwaysInjectSelector: []
|
||||
|
||||
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
|
||||
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
|
||||
#
|
||||
# annotations:
|
||||
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
#
|
||||
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
|
||||
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
|
||||
# injectedAnnotations:
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
|
||||
injectedAnnotations: {}
|
||||
|
||||
# This enables injection of sidecar in all namespaces,
|
||||
# with the exception of namespaces with "istio-injection:disabled" annotation
|
||||
# Only one environment should have this enabled.
|
||||
enableNamespacesByDefault: false
|
||||
|
||||
# Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
|
||||
# once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
|
||||
# Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
|
||||
reinvocationPolicy: Never
|
||||
|
||||
rewriteAppHTTPProbe: true
|
||||
|
||||
# Templates defines a set of custom injection templates that can be used. For example, defining:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
|
||||
# being injected with the hello=world labels.
|
||||
# This is intended for advanced configuration only; most users should use the built in template
|
||||
templates: {}
|
||||
|
||||
# Default templates specifies a set of default templates that are used in sidecar injection.
|
||||
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
|
||||
# To inject other additional templates, define it using the `templates` option, and add it to
|
||||
# the default templates list.
|
||||
# For example:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# defaultTemplates: ["sidecar", "hello"]
|
||||
defaultTemplates: []
|
||||
istiodRemote:
|
||||
# If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
|
||||
# and istiod itself will NOT be installed in this cluster - only the support resources necessary
|
||||
# to utilize a remote instance.
|
||||
enabled: false
|
||||
# Sidecar injector mutating webhook configuration clientConfig.url value.
|
||||
# For example: https://$remotePilotAddress:15017/inject
|
||||
# The host should not refer to a service running in the cluster; use a service reference by specifying
|
||||
# the clientConfig.service field instead.
|
||||
injectionURL: ""
|
||||
|
||||
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
|
||||
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
|
||||
injectionPath: "/inject"
|
||||
|
||||
injectionCABundle: ""
|
||||
telemetry:
|
||||
enabled: true
|
||||
v2:
|
||||
# For Null VM case now.
|
||||
# This also enables metadata exchange.
|
||||
enabled: true
|
||||
# Indicate if prometheus stats filter is enabled or not
|
||||
prometheus:
|
||||
enabled: true
|
||||
# stackdriver filter settings.
|
||||
stackdriver:
|
||||
enabled: false
|
||||
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||
revision: ""
|
||||
|
||||
# Revision tags are aliases to Istio control plane revisions
|
||||
revisionTags: []
|
||||
|
||||
# For Helm compatibility.
|
||||
ownerName: ""
|
||||
|
||||
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
|
||||
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
|
||||
experimental:
|
||||
stableValidationPolicy: false
|
||||
|
||||
global:
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
# List of cert-signers to allow "approve" action in the istio cluster role
|
||||
#
|
||||
# certSigners:
|
||||
# - clusterissuers.cert-manager.io/istio-ca
|
||||
certSigners: []
|
||||
# enable pod disruption budget for the control plane, which is used to
|
||||
# ensure Istio control plane components are gradually upgraded or recovered.
|
||||
defaultPodDisruptionBudget:
|
||||
enabled: true
|
||||
# The values aren't mutable due to a current PodDisruptionBudget limitation
|
||||
# minAvailable: 1
|
||||
|
||||
# A minimal set of requested resources to applied to all deployments so that
|
||||
# Horizontal Pod Autoscaler will be able to function (if set).
|
||||
# Each component can overwrite these default values by adding its own resources
|
||||
# block in the relevant section below and setting the desired resources values.
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
# memory: 128Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# Default hub for Istio images.
|
||||
# Releases are published to docker hub under 'istio' project.
|
||||
# Dev builds from prow are on gcr.io
|
||||
hub: docker.io/istio
|
||||
# Default tag for Istio images.
|
||||
tag: 1.26.1
|
||||
# Variant of the image to use.
|
||||
# Currently supported are: [debug, distroless]
|
||||
variant: ""
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
imagePullPolicy: ""
|
||||
|
||||
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
|
||||
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
# - private-registry-key
|
||||
|
||||
# Enabled by default in master for maximising testing.
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
|
||||
logAsJson: false
|
||||
|
||||
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
|
||||
# The control plane has different scopes depending on component, but can configure default log level across all components
|
||||
# If empty, default scope and level will be used as configured in code
|
||||
logging:
|
||||
level: "default:info"
|
||||
|
||||
omitSidecarInjectorConfigMap: false
|
||||
|
||||
# Configure whether Operator manages webhook configurations. The current behavior
|
||||
# of Istiod is to manage its own webhook configurations.
|
||||
# When this option is set as true, Istio Operator, instead of webhooks, manages the
|
||||
# webhook configurations. When this option is set as false, webhooks manage their
|
||||
# own webhook configurations.
|
||||
operatorManageWebhooks: false
|
||||
|
||||
# Custom DNS config for the pod to resolve names of services in other
|
||||
# clusters. Use this to add additional search domains, and other settings.
|
||||
# see
|
||||
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
|
||||
# This does not apply to gateway pods as they typically need a different
|
||||
# set of DNS settings than the normal application pods (e.g., in
|
||||
# multicluster scenarios).
|
||||
# NOTE: If using templates, follow the pattern in the commented example below.
|
||||
#podDNSSearchNamespaces:
|
||||
#- global
|
||||
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
|
||||
|
||||
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
|
||||
# system-node-critical, it is better to configure this in order to make sure your Istio pods
|
||||
# will not be killed because of low priority class.
|
||||
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
# for more detail.
|
||||
priorityClassName: ""
|
||||
|
||||
proxy:
|
||||
image: proxyv2
|
||||
|
||||
# This controls the 'policy' in the sidecar injector.
|
||||
autoInject: enabled
|
||||
|
||||
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
|
||||
# cluster domain. Default value is "cluster.local".
|
||||
clusterDomain: "cluster.local"
|
||||
|
||||
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
|
||||
# not set, then the global "logLevel" will be used.
|
||||
componentLogLevel: "misc:error"
|
||||
|
||||
# istio ingress capture allowlist
|
||||
# examples:
|
||||
# Redirect only selected ports: --includeInboundPorts="80,8080"
|
||||
excludeInboundPorts: ""
|
||||
includeInboundPorts: "*"
|
||||
|
||||
# istio egress capture allowlist
|
||||
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
|
||||
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
|
||||
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
|
||||
# be allowed by the sidecar
|
||||
includeIPRanges: "*"
|
||||
excludeIPRanges: ""
|
||||
includeOutboundPorts: ""
|
||||
excludeOutboundPorts: ""
|
||||
|
||||
# Log level for proxy, applies to gateways and sidecars.
|
||||
# Expected values are: trace|debug|info|warning|error|critical|off
|
||||
logLevel: warning
|
||||
|
||||
# Specify the path to the outlier event log.
|
||||
# Example: /dev/stdout
|
||||
outlierLogPath: ""
|
||||
|
||||
#If set to true, istio-proxy container will have privileged securityContext
|
||||
privileged: false
|
||||
|
||||
# The number of successive failed probes before indicating readiness failure.
|
||||
readinessFailureThreshold: 4
|
||||
|
||||
# The initial delay for readiness probes in seconds.
|
||||
readinessInitialDelaySeconds: 0
|
||||
|
||||
# The period between readiness probes.
|
||||
readinessPeriodSeconds: 15
|
||||
|
||||
# Enables or disables a startup probe.
|
||||
# For optimal startup times, changing this should be tied to the readiness probe values.
|
||||
#
|
||||
# If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
|
||||
# This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
|
||||
# and doesn't spam the readiness endpoint too much
|
||||
#
|
||||
# If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
|
||||
# This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
|
||||
startupProbe:
|
||||
enabled: true
|
||||
failureThreshold: 600 # 10 minutes
|
||||
|
||||
# Resources for the sidecar.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
|
||||
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
|
||||
statusPort: 15020
|
||||
|
||||
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
|
||||
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
|
||||
tracer: "none"
|
||||
|
||||
proxy_init:
|
||||
# Base name for the proxy_init container, used to configure iptables.
|
||||
image: proxyv2
|
||||
# Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
|
||||
# Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
|
||||
forceApplyIptables: false
|
||||
|
||||
# configure remote pilot and istiod service and endpoint
|
||||
remotePilotAddress: ""
|
||||
|
||||
##############################################################################################
|
||||
# The following values are found in other charts. To effectively modify these values, make #
|
||||
# make sure they are consistent across your Istio helm charts #
|
||||
##############################################################################################
|
||||
|
||||
# The customized CA address to retrieve certificates for the pods in the cluster.
|
||||
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
|
||||
# If not set explicitly, default to the Istio discovery address.
|
||||
caAddress: ""
|
||||
|
||||
# Enable control of remote clusters.
|
||||
externalIstiod: false
|
||||
|
||||
# Configure a remote cluster as the config cluster for an external istiod.
|
||||
configCluster: false
|
||||
|
||||
# configValidation enables the validation webhook for Istio configuration.
|
||||
configValidation: true
|
||||
|
||||
# Mesh ID means Mesh Identifier. It should be unique within the scope where
|
||||
# meshes will interact with each other, but it is not required to be
|
||||
# globally/universally unique. For example, if any of the following are true,
|
||||
# then two meshes must have different Mesh IDs:
|
||||
# - Meshes will have their telemetry aggregated in one place
|
||||
# - Meshes will be federated together
|
||||
# - Policy will be written referencing one mesh from the other
|
||||
#
|
||||
# If an administrator expects that any of these conditions may become true in
|
||||
# the future, they should ensure their meshes have different Mesh IDs
|
||||
# assigned.
|
||||
#
|
||||
# Within a multicluster mesh, each cluster must be (manually or auto)
|
||||
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
|
||||
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
|
||||
# of migration TBD, and it may be a disruptive operation to change the Mesh
|
||||
# ID post-install.
|
||||
#
|
||||
# If the mesh admin does not specify a value, Istio will use the value of the
|
||||
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
|
||||
# value.
|
||||
meshID: ""
|
||||
|
||||
# Configure the mesh networks to be used by the Split Horizon EDS.
|
||||
#
|
||||
# The following example defines two networks with different endpoints association methods.
|
||||
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
|
||||
# mapped to network1. The gateway for this network example is specified by its public IP
|
||||
# address and port.
|
||||
# The second network, `network2`, in this example is defined differently with all endpoints
|
||||
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
|
||||
# gateway is also defined differently with the name of the gateway service on the remote
|
||||
# cluster. The public IP for the gateway will be determined from that remote service (only
|
||||
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
|
||||
# it still need to be configured manually).
|
||||
#
|
||||
# meshNetworks:
|
||||
# network1:
|
||||
# endpoints:
|
||||
# - fromCidr: "192.168.0.1/24"
|
||||
# gateways:
|
||||
# - address: 1.1.1.1
|
||||
# port: 80
|
||||
# network2:
|
||||
# endpoints:
|
||||
# - fromRegistry: reg1
|
||||
# gateways:
|
||||
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
|
||||
# port: 443
|
||||
#
|
||||
meshNetworks: {}
|
||||
|
||||
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
|
||||
mountMtlsCerts: false
|
||||
|
||||
multiCluster:
|
||||
# Set to true to connect two kubernetes clusters via their respective
|
||||
# ingressgateway services when pods in each cluster cannot directly
|
||||
# talk to one another. All clusters should be using Istio mTLS and must
|
||||
# have a shared root CA for this model to work.
|
||||
enabled: false
|
||||
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
|
||||
# to properly label proxies
|
||||
clusterName: ""
|
||||
|
||||
# Network defines the network this cluster belong to. This name
|
||||
# corresponds to the networks in the map of mesh networks.
|
||||
network: ""
|
||||
|
||||
# Configure the certificate provider for control plane communication.
|
||||
# Currently, two providers are supported: "kubernetes" and "istiod".
|
||||
# As some platforms may not have kubernetes signing APIs,
|
||||
# Istiod is the default
|
||||
pilotCertProvider: istiod
|
||||
|
||||
sds:
|
||||
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
|
||||
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
|
||||
# JWT is intended for the CA.
|
||||
token:
|
||||
aud: istio-ca
|
||||
|
||||
sts:
|
||||
# The service port used by Security Token Service (STS) server to handle token exchange requests.
|
||||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# The name of the CA for workload certificates.
|
||||
# For example, when caName=GkeWorkloadCertificate, GKE workload certificates
|
||||
# will be used as the certificates for workloads.
|
||||
# The default value is "" and when caName="", the CA will be configured by other
|
||||
# mechanisms (e.g., environmental variable CA_PROVIDER).
|
||||
caName: ""
|
||||
|
||||
waypoint:
|
||||
# Resources for the waypoint proxy.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
|
||||
# If specified, affinity defines the scheduling constraints of waypoint pods.
|
||||
affinity: {}
|
||||
|
||||
# Topology Spread Constraints for the waypoint proxy.
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# Node labels for the waypoint proxy.
|
||||
nodeSelector: {}
|
||||
|
||||
# Tolerations for the waypoint proxy.
|
||||
tolerations: []
|
||||
|
||||
base:
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
|
||||
# Gateway Settings
|
||||
gateways:
|
||||
# Define the security context for the pod.
|
||||
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
|
||||
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
|
||||
securityContext: {}
|
||||
|
||||
# Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
|
||||
seccompProfile: {}
|
||||
|
||||
# gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
|
||||
# For example:
|
||||
# gatewayClasses:
|
||||
# istio:
|
||||
# service:
|
||||
# spec:
|
||||
# type: ClusterIP
|
||||
# Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
|
||||
gatewayClasses: {}
|
||||
Reference in New Issue
Block a user