chore(release): Add a new release: metrics-server
A new release is added to the cluster: Name: metrics-server Namespace: kube-system Version: 3.11.0 Chart: metrics-server/metrics-server
This commit is contained in:
Nikolai Rodionov
12
charts/istiod-istiod/Chart.yaml
Normal file
12
charts/istiod-istiod/Chart.yaml
Normal file
@ -0,0 +1,12 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.23.0
|
||||
description: Helm chart for istio control plane
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
- istiod
|
||||
- istio-discovery
|
||||
name: istiod
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
version: 1.23.0
|
||||
73
charts/istiod-istiod/README.md
Normal file
73
charts/istiod-istiod/README.md
Normal file
@ -0,0 +1,73 @@
|
||||
# Istiod Helm Chart
|
||||
|
||||
This chart installs an Istiod deployment.
|
||||
|
||||
## Setup Repo Info
|
||||
|
||||
```console
|
||||
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
|
||||
|
||||
To install the chart with the release name `istiod`:
|
||||
|
||||
```console
|
||||
kubectl create namespace istio-system
|
||||
helm install istiod istio/istiod --namespace istio-system
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `istiod` deployment:
|
||||
|
||||
```console
|
||||
helm delete istiod --namespace istio-system
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To view support configuration options and documentation, run:
|
||||
|
||||
```console
|
||||
helm show values istio/istiod
|
||||
```
|
||||
|
||||
### Profiles
|
||||
|
||||
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||
These can be set with `--set profile=<profile>`.
|
||||
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||
|
||||
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||
|
||||
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||
|
||||
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||
When configuring the chart, you should not include this.
|
||||
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||
|
||||
### Examples
|
||||
|
||||
#### Configuring mesh configuration settings
|
||||
|
||||
Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
|
||||
|
||||
```yaml
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
```
|
||||
|
||||
#### Revisions
|
||||
|
||||
Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
|
||||
This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
|
||||
|
||||
```yaml
|
||||
revision: my-revision-name
|
||||
```
|
||||
250
charts/istiod-istiod/files/gateway-injection-template.yaml
Normal file
250
charts/istiod-istiod/files/gateway-injection-template.yaml
Normal file
@ -0,0 +1,250 @@
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }},
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- if .Values.gateways.securityContext }}
|
||||
{{- toYaml .Values.gateways.securityContext | nindent 4 }}
|
||||
{{- else }}
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
env:
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
{{- if .CompliancePolicy }}
|
||||
- name: COMPLIANCE_POLICY
|
||||
value: "{{ .CompliancePolicy }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir: {}
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else}}
|
||||
- emptyDir: {}
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
310
charts/istiod-istiod/files/grpc-agent.yaml
Normal file
310
charts/istiod-istiod/files/grpc-agent.yaml
Normal file
@ -0,0 +1,310 @@
|
||||
{{- define "resources" }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
{{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }},
|
||||
{{- if ge (len $containers) 1 }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false",
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15020
|
||||
protocol: TCP
|
||||
name: mesh-metrics
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
- --url=http://localhost:15020/healthz/ready
|
||||
env:
|
||||
- name: ISTIO_META_GENERATOR
|
||||
value: grpc
|
||||
- name: OUTPUT_CERTS
|
||||
value: /var/lib/istio/data
|
||||
{{- if eq .InboundTrafficPolicyMode "localhost" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
# grpc uses xds:/// to resolve – no need to resolve VIP
|
||||
- name: ISTIO_META_DNS_CAPTURE
|
||||
value: "false"
|
||||
- name: DISABLE_ENVOY
|
||||
value: "true"
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15020
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
{{ if not (eq $container.Name "istio-proxy") }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
|
||||
value: "true"
|
||||
- name: "GRPC_XDS_BOOTSTRAP"
|
||||
value: "/etc/istio/proxy/grpc-bootstrap.json"
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- emptyDir:
|
||||
name: workload-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else }}
|
||||
- emptyDir:
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-xds
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
65
charts/istiod-istiod/files/grpc-simple.yaml
Normal file
65
charts/istiod-istiod/files/grpc-simple.yaml
Normal file
@ -0,0 +1,65 @@
|
||||
metadata:
|
||||
annotations:
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false"
|
||||
spec:
|
||||
initContainers:
|
||||
- name: grpc-bootstrap-init
|
||||
image: busybox:1.28
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
env:
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: ISTIO_NAMESPACE
|
||||
value: |
|
||||
{{ .Values.global.istioNamespace }}
|
||||
command:
|
||||
- sh
|
||||
- "-c"
|
||||
- |-
|
||||
NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
|
||||
SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
|
||||
echo '
|
||||
{
|
||||
"xds_servers": [
|
||||
{
|
||||
"server_uri": "'${SERVER_URI}'",
|
||||
"channel_creds": [{"type": "insecure"}],
|
||||
"server_features" : ["xds_v3"]
|
||||
}
|
||||
],
|
||||
"node": {
|
||||
"id": "'${NODE_ID}'",
|
||||
"metadata": {
|
||||
"GENERATOR": "grpc"
|
||||
}
|
||||
}
|
||||
}' > /var/lib/grpc/data/bootstrap.json
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: GRPC_XDS_BOOTSTRAP
|
||||
value: /var/lib/grpc/data/bootstrap.json
|
||||
- name: GRPC_GO_LOG_VERBOSITY_LEVEL
|
||||
value: "99"
|
||||
- name: GRPC_GO_LOG_SEVERITY_LEVEL
|
||||
value: info
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: grpc-io-proxyless-bootstrap
|
||||
emptyDir: {}
|
||||
545
charts/istiod-istiod/files/injection-template.yaml
Normal file
545
charts/istiod-istiod/files/injection-template.yaml
Normal file
@ -0,0 +1,545 @@
|
||||
{{- define "resources" }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ $nativeSidecar := (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true") }}
|
||||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio" | quote }}
|
||||
{{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
|
||||
networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http" | quote }}
|
||||
{{- end }}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | trunc 63 | trimSuffix "-" | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }},
|
||||
{{- if ge (len $containers) 1 }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pilot.cni.enabled .Values.istio_cni.enabled }}
|
||||
{{- if or (eq .Values.pilot.cni.provider "multus") (eq .Values.istio_cni.provider "multus") (not .Values.istio_cni.chained)}}
|
||||
k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
|
||||
{{- end }}
|
||||
sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
|
||||
traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
|
||||
traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
|
||||
{{- end }}
|
||||
}
|
||||
spec:
|
||||
{{- $holdProxy := and
|
||||
(or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
|
||||
(not $nativeSidecar) }}
|
||||
initContainers:
|
||||
{{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
|
||||
{{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
|
||||
- name: istio-validation
|
||||
{{ else -}}
|
||||
- name: istio-init
|
||||
{{ end -}}
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- istio-iptables
|
||||
- "-p"
|
||||
- {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
|
||||
- "-z"
|
||||
- {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
|
||||
- "-u"
|
||||
- {{ .ProxyUID | default "1337" | quote }}
|
||||
- "-m"
|
||||
- "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
|
||||
- "-i"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
|
||||
- "-x"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
|
||||
- "-b"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
|
||||
- "-d"
|
||||
{{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
|
||||
- "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
|
||||
{{- else }}
|
||||
- "15090,15021"
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
|
||||
- "-q"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
|
||||
- "-o"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
|
||||
- "-k"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
|
||||
- "-c"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
|
||||
{{ end -}}
|
||||
- "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
|
||||
{{ if .Values.global.logAsJson -}}
|
||||
- "--log_as_json"
|
||||
{{ end -}}
|
||||
{{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
|
||||
- "--run-validation"
|
||||
- "--skip-rule-apply"
|
||||
{{ end -}}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
env:
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
{{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsNonRoot: true
|
||||
{{- end }}
|
||||
{{ end -}}
|
||||
{{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
- name: enable-core-dump
|
||||
args:
|
||||
- -c
|
||||
- sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
|
||||
command:
|
||||
- /bin/sh
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- SYS_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{ end }}
|
||||
{{ if not $nativeSidecar }}
|
||||
containers:
|
||||
{{ end }}
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{ if $nativeSidecar }}restartPolicy: Always{{end}}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.outlierLogPath }}
|
||||
- --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- else if $holdProxy }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
{{- else if $nativeSidecar }}
|
||||
{{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- request
|
||||
- --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
|
||||
- POST
|
||||
- drain
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if eq .InboundTrafficPolicyMode "localhost" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
{{- if .CompliancePolicy }}
|
||||
- name: COMPLIANCE_POLICY
|
||||
value: "{{ .CompliancePolicy }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: ISTIO_BOOTSTRAP_OVERRIDE
|
||||
value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
|
||||
{{- end }}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
{{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
{{ if .Values.global.proxy.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 1
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
|
||||
{{ end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
securityContext:
|
||||
{{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
add:
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
|
||||
- NET_ADMIN
|
||||
{{- end }}
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
|
||||
- NET_BIND_SERVICE
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else -}}
|
||||
runAsNonRoot: true
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ template "resources" . }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "kubernetes" }}
|
||||
- mountPath: /var/run/secrets/istio/kubernetes
|
||||
name: kube-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- mountPath: /etc/istio/custom-bootstrap
|
||||
name: custom-bootstrap-volume
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
|
||||
name: lightstep-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- emptyDir:
|
||||
name: workload-socket
|
||||
- emptyDir:
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else }}
|
||||
- emptyDir:
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "kubernetes" }}
|
||||
- name: kube-ca-cert
|
||||
configMap:
|
||||
name: kube-root-ca.crt
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- name: lightstep-certs
|
||||
secret:
|
||||
optional: true
|
||||
secretName: lightstep.cacert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
343
charts/istiod-istiod/files/kube-gateway.yaml
Normal file
343
charts/istiod-istiod/files/kube-gateway.yaml
Normal file
@ -0,0 +1,343 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{.ServiceAccount | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
{{- if ge .KubeVersion 128 }}
|
||||
# Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
"{{.GatewayNameLabel}}": {{.Name}}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toJsonMap
|
||||
(omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
|
||||
(strdict "istio.io/rev" (.Revision | default "default"))
|
||||
(strdict
|
||||
"prometheus.io/path" "/stats/prometheus"
|
||||
"prometheus.io/port" "15020"
|
||||
"prometheus.io/scrape" "true"
|
||||
) | nindent 8 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
(strdict
|
||||
"sidecar.istio.io/inject" "false"
|
||||
"service.istio.io/canonical-name" .DeploymentName
|
||||
"service.istio.io/canonical-revision" "latest"
|
||||
)
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 8 }}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- if .Values.gateways.securityContext }}
|
||||
{{- toYaml .Values.gateways.securityContext | nindent 8 }}
|
||||
{{- else }}
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- if .Values.gateways.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{.ServiceAccount | quote}}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
resources:
|
||||
{{- toYaml .Values.global.proxy.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: {{ .ProxyUID | default "1337" }}
|
||||
runAsGroup: {{ .ProxyGID | default "1337" }}
|
||||
runAsNonRoot: true
|
||||
ports:
|
||||
- containerPort: 15021
|
||||
name: status-port
|
||||
protocol: TCP
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
|
||||
- --proxyComponentLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
|
||||
- --log_output_level
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: "[]"
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: ""
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: {{.|quote}}
|
||||
{{- end }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: {{.DeploymentName|quote}}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- with (index .InfrastructureLabels "topology.istio.io/network") }}
|
||||
- name: ISTIO_META_REQUESTED_NETWORK_VIEW
|
||||
value: {{.|quote}}
|
||||
{{- end }}
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 1
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 15
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- name: credential-socket
|
||||
mountPath: /var/run/secrets/credential-uds
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: workload-certs
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir: {}
|
||||
name: credential-socket
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- else}}
|
||||
- emptyDir: {}
|
||||
name: workload-certs
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: {{.Name}}
|
||||
uid: {{.UID}}
|
||||
spec:
|
||||
ports:
|
||||
{{- range $key, $val := .Ports }}
|
||||
- name: {{ $val.Name | quote }}
|
||||
port: {{ $val.Port }}
|
||||
protocol: TCP
|
||||
appProtocol: {{ $val.AppProtocol }}
|
||||
{{- end }}
|
||||
selector:
|
||||
"{{.GatewayNameLabel}}": {{.Name}}
|
||||
{{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
|
||||
loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
|
||||
{{- end }}
|
||||
type: {{ .ServiceType | quote }}
|
||||
---
|
||||
20
charts/istiod-istiod/files/profile-ambient.yaml
Normal file
20
charts/istiod-istiod/files/profile-ambient.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
|
||||
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||
variant: distroless
|
||||
@ -0,0 +1,26 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.21 behavioral changes
|
||||
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||
ENABLE_AUTO_SNI: "false"
|
||||
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
@ -0,0 +1,19 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
meshConfig:
|
||||
# 1.22 behavioral changes
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
@ -0,0 +1,11 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX": "false"
|
||||
73
charts/istiod-istiod/files/profile-demo.yaml
Normal file
73
charts/istiod-istiod/files/profile-demo.yaml
Normal file
@ -0,0 +1,73 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||
# * Lower resource utilization.
|
||||
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||
# * More ports enabled on the ingress, which is used in some tasks.
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
extensionProviders:
|
||||
- name: otel
|
||||
envoyOtelAls:
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
port: 4317
|
||||
- name: skywalking
|
||||
skywalking:
|
||||
service: tracing.istio-system.svc.cluster.local
|
||||
port: 11800
|
||||
- name: otel-tracing
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
|
||||
global:
|
||||
proxy:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
traceSampling: 100
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 100Mi
|
||||
|
||||
gateways:
|
||||
istio-egressgateway:
|
||||
autoscaleEnabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
istio-ingressgateway:
|
||||
autoscaleEnabled: false
|
||||
ports:
|
||||
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||
# Note that AWS ELB will by default perform health checks on the first port
|
||||
# on this list. Setting this to the health check port will ensure that health
|
||||
# checks always work. https://github.com/istio/istio/issues/12503
|
||||
- port: 15021
|
||||
targetPort: 15021
|
||||
name: status-port
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
name: http2
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
name: https
|
||||
- port: 31400
|
||||
targetPort: 31400
|
||||
name: tcp
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
33
charts/istiod-istiod/files/profile-openshift-ambient.yaml
Normal file
33
charts/istiod-istiod/files/profile-openshift-ambient.yaml
Normal file
@ -0,0 +1,33 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
platform: openshift
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
variant: distroless
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||
platform: openshift
|
||||
variant: distroless
|
||||
seLinuxOptions:
|
||||
type: spc_t
|
||||
20
charts/istiod-istiod/files/profile-openshift.yaml
Normal file
20
charts/istiod-istiod/files/profile-openshift.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||
# CNI must be installed.
|
||||
cni:
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
global:
|
||||
platform: openshift
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
platform: openshift
|
||||
13
charts/istiod-istiod/files/profile-preview.yaml
Normal file
13
charts/istiod-istiod/files/profile-preview.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The preview profile contains features that are experimental.
|
||||
# This is intended to explore new features coming to Istio.
|
||||
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# Enable Istio agent to handle DNS requests for known hosts
|
||||
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||
ISTIO_META_DNS_CAPTURE: "true"
|
||||
8
charts/istiod-istiod/files/profile-stable.yaml
Normal file
8
charts/istiod-istiod/files/profile-stable.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||
experimental:
|
||||
stableValidationPolicy: true
|
||||
312
charts/istiod-istiod/files/waypoint.yaml
Normal file
312
charts/istiod-istiod/files/waypoint.yaml
Normal file
@ -0,0 +1,312 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{.ServiceAccount | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
{{- if ge .KubeVersion 128 }}
|
||||
# Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
annotations:
|
||||
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-mesh-controller"
|
||||
) | nindent 4 }}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
"{{.GatewayNameLabel}}": "{{.Name}}"
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toJsonMap
|
||||
(omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
|
||||
(strdict "istio.io/rev" (.Revision | default "default"))
|
||||
(strdict
|
||||
"prometheus.io/path" "/stats/prometheus"
|
||||
"prometheus.io/port" "15020"
|
||||
"prometheus.io/scrape" "true"
|
||||
) | nindent 8 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
(strdict
|
||||
"sidecar.istio.io/inject" "false"
|
||||
"istio.io/dataplane-mode" "none"
|
||||
"service.istio.io/canonical-name" .DeploymentName
|
||||
"service.istio.io/canonical-revision" "latest"
|
||||
)
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
"gateway.istio.io/managed" "istio.io-mesh-controller"
|
||||
) | nindent 8}}
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 2
|
||||
serviceAccountName: {{.ServiceAccount | quote}}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
ports:
|
||||
- containerPort: 15021
|
||||
name: status-port
|
||||
protocol: TCP
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .ProxyImage }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
args:
|
||||
- proxy
|
||||
- waypoint
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --serviceCluster
|
||||
- {{.ServiceAccount}}.$(POD_NAMESPACE)
|
||||
- --proxyLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
|
||||
- --proxyComponentLogLevel
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
|
||||
- --log_output_level
|
||||
- {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ISTIO_META_SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: ISTIO_META_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: ISTIO_CPU_LIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
{{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
|
||||
{{- if $network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ $network }}"
|
||||
{{- end }}
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: REDIRECT
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: {{.DeploymentName}}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 1
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 4
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 15
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
privileged: false
|
||||
runAsGroup: 1337
|
||||
runAsUser: 1337
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- if .Values.gateways.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: workload-socket
|
||||
mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
- mountPath: /etc/istio/pod
|
||||
name: istio-podinfo
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: workload-socket
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: go-proxy-envoy
|
||||
- emptyDir: {}
|
||||
name: istio-data
|
||||
- emptyDir: {}
|
||||
name: go-proxy-data
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
path: labels
|
||||
- fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
path: annotations
|
||||
name: istio-podinfo
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: istio-ca
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
- configMap:
|
||||
name: istio-ca-root-cert
|
||||
name: istiod-ca-cert
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
|
||||
labels:
|
||||
{{- toJsonMap
|
||||
.InfrastructureLabels
|
||||
(strdict
|
||||
"gateway.networking.k8s.io/gateway-name" .Name
|
||||
"istio.io/gateway-name" .Name
|
||||
) | nindent 4 }}
|
||||
name: {{.DeploymentName | quote}}
|
||||
namespace: {{.Namespace | quote}}
|
||||
ownerReferences:
|
||||
- apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: Gateway
|
||||
name: "{{.Name}}"
|
||||
uid: "{{.UID}}"
|
||||
spec:
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
{{- range $key, $val := .Ports }}
|
||||
- name: {{ $val.Name | quote }}
|
||||
port: {{ $val.Port }}
|
||||
protocol: TCP
|
||||
appProtocol: {{ $val.AppProtocol }}
|
||||
{{- end }}
|
||||
selector:
|
||||
"{{.GatewayNameLabel}}": "{{.Name}}"
|
||||
{{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
|
||||
loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
|
||||
{{- end }}
|
||||
type: {{ .ServiceType | quote }}
|
||||
---
|
||||
79
charts/istiod-istiod/templates/NOTES.txt
Normal file
79
charts/istiod-istiod/templates/NOTES.txt
Normal file
@ -0,0 +1,79 @@
|
||||
"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
|
||||
Next steps:
|
||||
{{- $profile := default "" .Values.profile }}
|
||||
{{- if (eq $profile "ambient") }}
|
||||
* Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
|
||||
* Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
|
||||
{{- else }}
|
||||
* Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
|
||||
* Try out our tasks to get started on common configurations:
|
||||
* https://istio.io/latest/docs/tasks/traffic-management
|
||||
* https://istio.io/latest/docs/tasks/security/
|
||||
* https://istio.io/latest/docs/tasks/policy-enforcement/
|
||||
{{- end }}
|
||||
* Review the list of actively supported releases, CVE publications and our hardening guide:
|
||||
* https://istio.io/latest/docs/releases/supported-releases/
|
||||
* https://istio.io/latest/news/security/
|
||||
* https://istio.io/latest/docs/ops/best-practices/security/
|
||||
|
||||
For further documentation see https://istio.io website
|
||||
|
||||
{{-
|
||||
$deps := dict
|
||||
"global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
|
||||
"global.certificates" "meshConfig.certificates"
|
||||
"global.localityLbSetting" "meshConfig.localityLbSetting"
|
||||
"global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
|
||||
"global.enableTracing" "meshConfig.enableTracing"
|
||||
"global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
|
||||
"global.proxy.accessLogFile" "meshConfig.accessLogFile"
|
||||
"global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
|
||||
"global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
|
||||
"global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
|
||||
"global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
|
||||
"global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
|
||||
"global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
|
||||
"pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
|
||||
"global.mtls.enabled" "the PeerAuthentication resource"
|
||||
"global.mtls.auto" "meshConfig.enableAutoMtls"
|
||||
"global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
|
||||
"global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
|
||||
"global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
|
||||
"global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
|
||||
"global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
|
||||
"global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
|
||||
"global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
|
||||
"global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
|
||||
"global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
|
||||
"istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
|
||||
"meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
|
||||
}}
|
||||
{{- range $dep, $replace := $deps }}
|
||||
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
|
||||
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(") ".Values." (replace "." ")." $dep) ")}}") $}}
|
||||
{{- if not (eq $res "")}}
|
||||
WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{-
|
||||
$failDeps := dict
|
||||
"telemetry.v2.prometheus.configOverride"
|
||||
"telemetry.v2.stackdriver.configOverride"
|
||||
"telemetry.v2.stackdriver.disableOutbound"
|
||||
"telemetry.v2.stackdriver.outboundAccessLogging"
|
||||
}}
|
||||
{{- range $dep, $replace := $failDeps }}
|
||||
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
|
||||
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(") ".Values." (replace "." ")." $dep) ")}}") $}}
|
||||
{{- if not (eq $res "")}}
|
||||
{{fail (print $dep " is removed")}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
23
charts/istiod-istiod/templates/_helpers.tpl
Normal file
23
charts/istiod-istiod/templates/_helpers.tpl
Normal file
@ -0,0 +1,23 @@
|
||||
{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
|
||||
{{ define "default-prometheus" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
|
||||
{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
|
||||
{{ define "default-sd-metrics" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
|
||||
{{/* SD has metrics and logging split. */}}
|
||||
{{ define "default-sd-logs" }}
|
||||
{{- and
|
||||
(not .Values.meshConfig.defaultProviders)
|
||||
.Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
|
||||
}}
|
||||
{{- end }}
|
||||
39
charts/istiod-istiod/templates/autoscale.yaml
Normal file
39
charts/istiod-istiod/templates/autoscale.yaml
Normal file
@ -0,0 +1,39 @@
|
||||
{{- if and .Values.pilot.autoscaleEnabled .Values.pilot.autoscaleMin .Values.pilot.autoscaleMax }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
spec:
|
||||
maxReplicas: {{ .Values.pilot.autoscaleMax }}
|
||||
minReplicas: {{ .Values.pilot.autoscaleMin }}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.pilot.cpu.targetAverageUtilization }}
|
||||
{{- if .Values.pilot.memory.targetAverageUtilization }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.pilot.memory.targetAverageUtilization }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.autoscaleBehavior }}
|
||||
behavior: {{ toYaml .Values.pilot.autoscaleBehavior | nindent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
161
charts/istiod-istiod/templates/clusterrole.yaml
Normal file
161
charts/istiod-istiod/templates/clusterrole.yaml
Normal file
@ -0,0 +1,161 @@
|
||||
{{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
|
||||
# Needed because status reporter sets the config map owner reference to the istiod pod
|
||||
- apiGroups: [""]
|
||||
verbs: ["update"]
|
||||
resources: ["pods/finalizers"]
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status" ]
|
||||
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch" ]
|
||||
resources: [ "serviceentries/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
{{- if .Values.pilot.taint.enabled }}
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch"]
|
||||
{{- end }}
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
|
||||
{{- if or .Values.pilot.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
{{- range .Values.global.certSigners }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
verbs: ["approve"]
|
||||
{{- end}}
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gatewayclasses"]
|
||||
verbs: ["create", "update", "patch", "delete"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: [ "get", "watch", "list", "create", "delete"]
|
||||
|
||||
# Used for MCS serviceimport management
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "deployments" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "services" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "serviceaccounts"]
|
||||
{{- end }}
|
||||
33
charts/istiod-istiod/templates/clusterrolebinding.yaml
Normal file
33
charts/istiod-istiod/templates/clusterrolebinding.yaml
Normal file
@ -0,0 +1,33 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
{{- end }}
|
||||
14
charts/istiod-istiod/templates/configmap-jwks.yaml
Normal file
14
charts/istiod-istiod/templates/configmap-jwks.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
data:
|
||||
extra.pem: {{ .Values.pilot.jwksResolverExtraRootCA | quote }}
|
||||
{{- end }}
|
||||
112
charts/istiod-istiod/templates/configmap.yaml
Normal file
112
charts/istiod-istiod/templates/configmap.yaml
Normal file
@ -0,0 +1,112 @@
|
||||
{{- define "mesh" }}
|
||||
# The trust domain corresponds to the trust root of a system.
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
|
||||
|
||||
{{ $prom := include "default-prometheus" . | eq "true" }}
|
||||
{{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
|
||||
{{ $sdLogs := include "default-sd-logs" . | eq "true" }}
|
||||
{{- if or $prom $sdMetrics $sdLogs }}
|
||||
defaultProviders:
|
||||
{{- if or $prom $sdMetrics }}
|
||||
metrics:
|
||||
{{ if $prom }}- prometheus{{ end }}
|
||||
{{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
|
||||
{{- end }}
|
||||
{{- if and $sdMetrics $sdLogs }}
|
||||
accessLogging:
|
||||
- stackdriver
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
defaultConfig:
|
||||
{{- if .Values.global.meshID }}
|
||||
meshId: "{{ .Values.global.meshID }}"
|
||||
{{- end }}
|
||||
{{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
|
||||
image:
|
||||
imageType: {{. | quote}}
|
||||
{{- end }}
|
||||
{{- if not (eq .Values.global.proxy.tracer "none") }}
|
||||
tracing:
|
||||
{{- if eq .Values.global.proxy.tracer "lightstep" }}
|
||||
lightstep:
|
||||
# Address of the LightStep Satellite pool
|
||||
address: {{ .Values.global.tracer.lightstep.address }}
|
||||
# Access Token used to communicate with the Satellite pool
|
||||
accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
|
||||
{{- else if eq .Values.global.proxy.tracer "zipkin" }}
|
||||
zipkin:
|
||||
# Address of the Zipkin collector
|
||||
address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
|
||||
{{- else if eq .Values.global.proxy.tracer "datadog" }}
|
||||
datadog:
|
||||
# Address of the Datadog Agent
|
||||
address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
|
||||
{{- else if eq .Values.global.proxy.tracer "stackdriver" }}
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
|
||||
{{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
|
||||
{{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
|
||||
{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if .Values.pilot.enabled }}
|
||||
discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
|
||||
{{- else }}
|
||||
discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
|
||||
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
|
||||
{{- $originalMesh := include "mesh" . | fromYaml }}
|
||||
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
|
||||
|
||||
{{- if .Values.pilot.configMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
|
||||
# Configuration file for the mesh networks to be used by the Split Horizon EDS.
|
||||
meshNetworks: |-
|
||||
{{- if .Values.global.meshNetworks }}
|
||||
networks:
|
||||
{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
|
||||
{{- else }}
|
||||
networks: {}
|
||||
{{- end }}
|
||||
|
||||
mesh: |-
|
||||
{{- if .Values.meshConfig }}
|
||||
{{ $mesh | toYaml | indent 4 }}
|
||||
{{- else }}
|
||||
{{- include "mesh" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
270
charts/istiod-istiod/templates/deployment.yaml
Normal file
270
charts/istiod-istiod/templates/deployment.yaml
Normal file
@ -0,0 +1,270 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
{{- range $key, $val := .Values.pilot.deploymentLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.pilot.autoscaleEnabled }}
|
||||
{{- if .Values.pilot.replicaCount }}
|
||||
replicas: {{ .Values.pilot.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.pilot.rollingMaxSurge }}
|
||||
maxUnavailable: {{ .Values.pilot.rollingMaxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- if ne .Values.revision "" }}
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
operator.istio.io/component: "Pilot"
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio: istiod
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.pilot.podLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
istio.io/dataplane-mode: none
|
||||
annotations:
|
||||
prometheus.io/port: "15014"
|
||||
prometheus.io/scrape: "true"
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if .Values.pilot.podAnnotations }}
|
||||
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pilot.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.pilot.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.pilot.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
- key: cni.istio.io/not-ready
|
||||
operator: "Exists"
|
||||
{{- with .Values.pilot.tolerations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.pilot.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.global.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.global.priorityClassName }}"
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: discovery
|
||||
{{- if contains "/" .Values.pilot.image }}
|
||||
image: "{{ .Values.pilot.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Values.global.tag }}{{with (.Values.pilot.variant | default .Values.global.variant)}}-{{.}}{{end}}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "discovery"
|
||||
- --monitoringAddr=:15014
|
||||
{{- if .Values.global.logging.level }}
|
||||
- --log_output_level={{ .Values.global.logging.level }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
- --domain
|
||||
- {{ .Values.global.proxy.clusterDomain }}
|
||||
{{- if .Values.pilot.taint.namespace }}
|
||||
- --cniNamespace={{ .Values.pilot.taint.namespace }}
|
||||
{{- end }}
|
||||
- --keepaliveMaxServerConnectionAge
|
||||
- "{{ .Values.pilot.keepaliveMaxServerConnectionAge }}"
|
||||
{{- if .Values.pilot.extraContainerArgs }}
|
||||
{{- with .Values.pilot.extraContainerArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
- containerPort: 15010
|
||||
protocol: TCP
|
||||
- containerPort: 15017
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 5
|
||||
env:
|
||||
- name: REVISION
|
||||
value: "{{ .Values.revision | default `default` }}"
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: KUBECONFIG
|
||||
value: /var/run/secrets/remote/config
|
||||
# If you explicitly told us where ztunnel lives, use that.
|
||||
# Otherwise, assume it lives in our namespace
|
||||
# Also, check for an explicit ENV override (legacy approach) and prefer that
|
||||
# if present
|
||||
{{ $ztTrustedNS := or .Values.pilot.trustedZtunnelNamespace .Release.Namespace }}
|
||||
{{- if not .Values.pilot.env.CA_TRUSTED_NODE_ACCOUNTS }}
|
||||
- name: CA_TRUSTED_NODE_ACCOUNTS
|
||||
value: "{{ $ztTrustedNS }}/ztunnel"
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.env }}
|
||||
{{- range $key, $val := .Values.pilot.env }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.traceSampling }}
|
||||
- name: PILOT_TRACE_SAMPLING
|
||||
value: "{{ .Values.pilot.traceSampling }}"
|
||||
{{- end }}
|
||||
# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
|
||||
# don't set it here to avoid duplication.
|
||||
{{- if and .Values.global.externalIstiod (eq .Values.pilot.env.EXTERNAL_ISTIOD "")}}
|
||||
- name: EXTERNAL_ISTIOD
|
||||
value: "{{ .Values.global.externalIstiod }}"
|
||||
{{- end }}
|
||||
- name: PILOT_ENABLE_ANALYSIS
|
||||
value: "{{ .Values.global.istiod.enableAnalysis }}"
|
||||
- name: CLUSTER_ID
|
||||
value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
- name: PLATFORM
|
||||
value: "{{ .Values.global.platform }}"
|
||||
resources:
|
||||
{{- if .Values.pilot.resources }}
|
||||
{{ toYaml .Values.pilot.resources | trim | indent 12 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- if .Values.pilot.seccompProfile }}
|
||||
seccompProfile:
|
||||
{{ toYaml .Values.pilot.seccompProfile | trim | indent 14 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: istio-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
readOnly: true
|
||||
- name: local-certs
|
||||
mountPath: /var/run/secrets/istio-dns
|
||||
- name: cacerts
|
||||
mountPath: /etc/cacerts
|
||||
readOnly: true
|
||||
- name: istio-kubeconfig
|
||||
mountPath: /var/run/secrets/remote
|
||||
readOnly: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
mountPath: /cacerts
|
||||
{{- end }}
|
||||
- name: istio-csr-dns-cert
|
||||
mountPath: /var/run/secrets/istiod/tls
|
||||
readOnly: true
|
||||
- name: istio-csr-ca-configmap
|
||||
mountPath: /var/run/secrets/istiod/ca
|
||||
readOnly: true
|
||||
{{- with .Values.pilot.volumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
# Technically not needed on this pod - but it helps debugging/testing SDS
|
||||
# Should be removed after everything works.
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: local-certs
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
# Optional: user-generated root
|
||||
- name: cacerts
|
||||
secret:
|
||||
secretName: cacerts
|
||||
optional: true
|
||||
- name: istio-kubeconfig
|
||||
secret:
|
||||
secretName: istio-kubeconfig
|
||||
optional: true
|
||||
# Optional: istio-csr dns pilot certs
|
||||
- name: istio-csr-dns-cert
|
||||
secret:
|
||||
secretName: istiod-tls
|
||||
optional: true
|
||||
- name: istio-csr-ca-configmap
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
defaultMode: 420
|
||||
optional: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
configMap:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.pilot.volumes }}
|
||||
{{- toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
@ -0,0 +1,80 @@
|
||||
{{- if not .Values.global.omitSidecarInjectorConfigMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
|
||||
values: |-
|
||||
{{ $vals := pick .Values "global" "istio_cni" "sidecarInjectorWebhook" "revision" -}}
|
||||
{{ $pilotVals := pick .Values.pilot "cni" -}}
|
||||
{{ $vals = set $vals "pilot" $pilotVals -}}
|
||||
{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
|
||||
{{ $vals = set $vals "gateways" $gatewayVals -}}
|
||||
{{ $vals | toPrettyJson | indent 4 }}
|
||||
|
||||
# To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
|
||||
# and istiod webhook functionality.
|
||||
#
|
||||
# New fields should not use Values - it is a 'primary' config object, users should be able
|
||||
# to fine tune it or use it with kube-inject.
|
||||
config: |-
|
||||
# defaultTemplates defines the default template to use for pods that do not explicitly specify a template
|
||||
{{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
|
||||
defaultTemplates:
|
||||
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
defaultTemplates: [sidecar]
|
||||
{{- end }}
|
||||
policy: {{ .Values.global.proxy.autoInject }}
|
||||
alwaysInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
|
||||
neverInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
|
||||
injectedAnnotations:
|
||||
{{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
|
||||
"{{ $key }}": {{ $val | quote }}
|
||||
{{- end }}
|
||||
{{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
|
||||
which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
|
||||
This should make it obvious that their installation is broken.
|
||||
*/}}
|
||||
template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
|
||||
templates:
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
|
||||
sidecar: |
|
||||
{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
|
||||
gateway: |
|
||||
{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
|
||||
grpc-simple: |
|
||||
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
|
||||
grpc-agent: |
|
||||
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
|
||||
waypoint: |
|
||||
{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
|
||||
kube-gateway: |
|
||||
{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.sidecarInjectorWebhook.templates }}
|
||||
{{ toYaml . | trim | indent 6 }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
158
charts/istiod-istiod/templates/mutatingwebhook.yaml
Normal file
158
charts/istiod-istiod/templates/mutatingwebhook.yaml
Normal file
@ -0,0 +1,158 @@
|
||||
{{- /* Core defines the common configuration used by all webhook segments */}}
|
||||
{{/* Copy just what we need to avoid expensive deepCopy */}}
|
||||
{{- $whv := dict
|
||||
"revision" .Values.revision
|
||||
"injectionPath" .Values.istiodRemote.injectionPath
|
||||
"injectionURL" .Values.istiodRemote.injectionURL
|
||||
"reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
|
||||
"caBundle" .Values.istiodRemote.injectionCABundle
|
||||
"namespace" .Release.Namespace }}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .injectionURL }}
|
||||
url: "{{ .injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||
namespace: {{ .namespace }}
|
||||
path: "{{ .injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
{{- if .caBundle }}
|
||||
caBundle: "{{ .caBundle }}"
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
reinvocationPolicy: "{{ .reinvocationPolicy }}"
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
|
||||
{{- if not .Values.global.operatorManageWebhooks }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq .Release.Namespace "istio-system"}}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- else }}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ .Release.Name }}
|
||||
webhooks:
|
||||
{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
|
||||
|
||||
{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
|
||||
{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- /* Webhooks for default revision */}}
|
||||
{{- if (eq .Values.revision "") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: "NotIn"
|
||||
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
25
charts/istiod-istiod/templates/poddisruptionbudget.yaml
Normal file
25
charts/istiod-istiod/templates/poddisruptionbudget.yaml
Normal file
@ -0,0 +1,25 @@
|
||||
{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
istio: pilot
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision | quote }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
60
charts/istiod-istiod/templates/reader-clusterrole.yaml
Normal file
60
charts/istiod-istiod/templates/reader-clusterrole.yaml
Normal file
@ -0,0 +1,60 @@
|
||||
{{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
- "telemetry.istio.io"
|
||||
- "extensions.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["gateways"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "list", "watch", "create", "delete"]
|
||||
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
{{- if .Values.global.externalIstiod }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
@ -0,0 +1,15 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
141
charts/istiod-istiod/templates/revision-tags.yaml
Normal file
141
charts/istiod-istiod/templates/revision-tags.yaml
Normal file
@ -0,0 +1,141 @@
|
||||
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||
# Removed paths for legacy and default selectors since a revision tag
|
||||
# is inherently created from a specific revision
|
||||
{{- $whv := dict
|
||||
"revision" .Values.revision
|
||||
"injectionPath" .Values.istiodRemote.injectionPath
|
||||
"injectionURL" .Values.istiodRemote.injectionURL
|
||||
"reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
|
||||
"namespace" .Release.Namespace }}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .injectionURL }}
|
||||
url: "{{ .injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||
namespace: {{ .namespace }}
|
||||
path: "{{ .injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
{{- range $tagName := $.Values.revisionTags }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq $.Release.Namespace "istio-system"}}
|
||||
name: istio-revision-tag-{{ $tagName }}
|
||||
{{- else }}
|
||||
name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/tag: {{ $tagName }}
|
||||
istio.io/rev: {{ $.Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ $.Release.Name }}
|
||||
webhooks:
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
|
||||
{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
|
||||
{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
|
||||
{{- if (eq $tagName "default") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: "NotIn"
|
||||
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
30
charts/istiod-istiod/templates/role.yaml
Normal file
30
charts/istiod-istiod/templates/role.yaml
Normal file
@ -0,0 +1,30 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
|
||||
# For status controller, so it can delete the distribution report configmap
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["delete"]
|
||||
|
||||
# For gateway deployment controller
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "update", "patch", "create"]
|
||||
16
charts/istiod-istiod/templates/rolebinding.yaml
Normal file
16
charts/istiod-istiod/templates/rolebinding.yaml
Normal file
@ -0,0 +1,16 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
50
charts/istiod-istiod/templates/service.yaml
Normal file
50
charts/istiod-istiod/templates/service.yaml
Normal file
@ -0,0 +1,50 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.pilot.serviceAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.pilot.serviceAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: istiod
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15010
|
||||
name: grpc-xds # plaintext
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
name: https-dns # mTLS with k8s-signed cert
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
name: https-webhook # validation and injection
|
||||
targetPort: 15017
|
||||
protocol: TCP
|
||||
- port: 15014
|
||||
name: http-monitoring # prometheus stats
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision | quote }}
|
||||
{{- else }}
|
||||
# Label used by the 'default' service. For versioned deployments we match with app and version.
|
||||
# This avoids default deployment picking the canary
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.pilot.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- range .Values.pilot.ipFamilies }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
19
charts/istiod-istiod/templates/serviceaccount.yaml
Normal file
19
charts/istiod-istiod/templates/serviceaccount.yaml
Normal file
@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
{{- if .Values.pilot.serviceAccountAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml .Values.pilot.serviceAccountAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
@ -0,0 +1,57 @@
|
||||
{{- if .Values.experimental.stableValidationPolicy }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicy
|
||||
metadata:
|
||||
name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
spec:
|
||||
failurePolicy: Fail
|
||||
matchConstraints:
|
||||
resourceRules:
|
||||
- apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions: ["*"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["*"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
variables:
|
||||
- name: isEnvoyFilter
|
||||
expression: "object.kind == 'EnvoyFilter'"
|
||||
- name: isWasmPlugin
|
||||
expression: "object.kind == 'WasmPlugin'"
|
||||
- name: isProxyConfig
|
||||
expression: "object.kind == 'ProxyConfig'"
|
||||
- name: isTelemetry
|
||||
expression: "object.kind == 'Telemetry'"
|
||||
validations:
|
||||
- expression: "!variables.isEnvoyFilter"
|
||||
- expression: "!variables.isWasmPlugin"
|
||||
- expression: "!variables.isProxyConfig"
|
||||
- expression: |
|
||||
!(
|
||||
variables.isTelemetry && (
|
||||
(has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
|
||||
(has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
|
||||
(has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
|
||||
)
|
||||
)
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicyBinding
|
||||
metadata:
|
||||
name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
spec:
|
||||
policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
|
||||
validationActions: [Deny]
|
||||
{{- end }}
|
||||
@ -0,0 +1,63 @@
|
||||
{{- if .Values.global.configValidation }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
webhooks:
|
||||
# Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
|
||||
# are rejecting invalid configs on a per-revision basis.
|
||||
- name: rev.validation.istio.io
|
||||
clientConfig:
|
||||
# Should change from base but cannot for API compat
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
caBundle: "{{ .Values.base.validationCABundle }}"
|
||||
{{- end }}
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
# Disable webhook controller in Pilot to stop patching it
|
||||
failurePolicy: Fail
|
||||
{{- else }}
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
43
charts/istiod-istiod/templates/zzz_profile.yaml
Normal file
43
charts/istiod-istiod/templates/zzz_profile.yaml
Normal file
@ -0,0 +1,43 @@
|
||||
{{/*
|
||||
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||
The original version of this file is located at /manifests directory.
|
||||
If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
Complex logic ahead...
|
||||
We have three sets of values, in order of precedence (last wins):
|
||||
1. The builtin values.yaml defaults
|
||||
2. The profile the user selects
|
||||
3. Users input (-f or --set)
|
||||
|
||||
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||
|
||||
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||
*/}}
|
||||
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||
{{- $defaults := $.Values.defaults }}
|
||||
{{- $_ := unset $.Values "defaults" }}
|
||||
{{- $profile := dict }}
|
||||
{{- with .Values.profile }}
|
||||
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||
{{- $profile = (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.compatibilityVersion }}
|
||||
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $profile }}
|
||||
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||
{{- end }}
|
||||
# Flatten globals, if defined on a per-chart basis
|
||||
{{- if false }}
|
||||
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||
{{- end }}
|
||||
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||
525
charts/istiod-istiod/values.yaml
Normal file
525
charts/istiod-istiod/values.yaml
Normal file
@ -0,0 +1,525 @@
|
||||
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||
defaults:
|
||||
#.Values.pilot for discovery and mesh wide config
|
||||
|
||||
## Discovery Settings
|
||||
pilot:
|
||||
autoscaleEnabled: true
|
||||
autoscaleMin: 1
|
||||
autoscaleMax: 5
|
||||
autoscaleBehavior: {}
|
||||
replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
||||
hub: ""
|
||||
tag: ""
|
||||
variant: ""
|
||||
|
||||
# Can be a full hub/image:tag
|
||||
image: pilot
|
||||
traceSampling: 1.0
|
||||
|
||||
# Resources for a small pilot install
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2048Mi
|
||||
|
||||
# Set to `type: RuntimeDefault` to use the default profile if available.
|
||||
seccompProfile: {}
|
||||
|
||||
# Whether to use an existing CNI installation
|
||||
cni:
|
||||
enabled: false
|
||||
provider: default
|
||||
|
||||
# Additional container arguments
|
||||
extraContainerArgs: []
|
||||
|
||||
env: {}
|
||||
|
||||
# Settings related to the untaint controller
|
||||
# This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
|
||||
# It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
|
||||
taint:
|
||||
# Controls whether or not the untaint controller is active
|
||||
enabled: false
|
||||
# What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
|
||||
namespace: ""
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
cpu:
|
||||
targetAverageUtilization: 80
|
||||
memory: {}
|
||||
# targetAverageUtilization: 80
|
||||
|
||||
# Additional volumeMounts to the istiod container
|
||||
volumeMounts: []
|
||||
|
||||
# Additional volumes to the istiod pod
|
||||
volumes: []
|
||||
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
serviceAnnotations: {}
|
||||
serviceAccountAnnotations: {}
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# You can use jwksResolverExtraRootCA to provide a root certificate
|
||||
# in PEM format. This will then be trusted by pilot when resolving
|
||||
# JWKS URIs.
|
||||
jwksResolverExtraRootCA: ""
|
||||
|
||||
# The following is used to limit how long a sidecar can be connected
|
||||
# to a pilot. It balances out load across pilot instances at the cost of
|
||||
# increasing system churn.
|
||||
keepaliveMaxServerConnectionAge: 30m
|
||||
|
||||
# Additional labels to apply to the deployment.
|
||||
deploymentLabels: {}
|
||||
|
||||
## Mesh config settings
|
||||
|
||||
# Install the mesh config map, generated from values.yaml.
|
||||
# If false, pilot wil use default values (by default) or user-supplied values.
|
||||
configMap: true
|
||||
|
||||
# Additional labels to apply on the pod level for monitoring and logging configuration.
|
||||
podLabels: {}
|
||||
|
||||
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
|
||||
ipFamilyPolicy: ""
|
||||
ipFamilies: []
|
||||
|
||||
# Ambient mode only.
|
||||
# Set this if you install ztunnel to a different namespace from `istiod`.
|
||||
# If set, `istiod` will allow connections from trusted node proxy ztunnels
|
||||
# in the provided namespace.
|
||||
# If unset, `istiod` will assume the trusted node proxy ztunnel resides
|
||||
# in the same namespace as itself.
|
||||
trustedZtunnelNamespace: ""
|
||||
|
||||
sidecarInjectorWebhook:
|
||||
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
|
||||
# always skip the injection on pods that match that label selector, regardless of the global policy.
|
||||
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
|
||||
neverInjectSelector: []
|
||||
alwaysInjectSelector: []
|
||||
|
||||
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
|
||||
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
|
||||
#
|
||||
# annotations:
|
||||
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
#
|
||||
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
|
||||
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
|
||||
# injectedAnnotations:
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
|
||||
injectedAnnotations: {}
|
||||
|
||||
# This enables injection of sidecar in all namespaces,
|
||||
# with the exception of namespaces with "istio-injection:disabled" annotation
|
||||
# Only one environment should have this enabled.
|
||||
enableNamespacesByDefault: false
|
||||
|
||||
# Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
|
||||
# once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
|
||||
# Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
|
||||
reinvocationPolicy: Never
|
||||
|
||||
rewriteAppHTTPProbe: true
|
||||
|
||||
# Templates defines a set of custom injection templates that can be used. For example, defining:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
|
||||
# being injected with the hello=world labels.
|
||||
# This is intended for advanced configuration only; most users should use the built in template
|
||||
templates: {}
|
||||
|
||||
# Default templates specifies a set of default templates that are used in sidecar injection.
|
||||
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
|
||||
# To inject other additional templates, define it using the `templates` option, and add it to
|
||||
# the default templates list.
|
||||
# For example:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# defaultTemplates: ["sidecar", "hello"]
|
||||
defaultTemplates: []
|
||||
istiodRemote:
|
||||
# Sidecar injector mutating webhook configuration clientConfig.url value.
|
||||
# For example: https://$remotePilotAddress:15017/inject
|
||||
# The host should not refer to a service running in the cluster; use a service reference by specifying
|
||||
# the clientConfig.service field instead.
|
||||
injectionURL: ""
|
||||
|
||||
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
|
||||
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
|
||||
injectionPath: "/inject"
|
||||
|
||||
injectionCABundle: ""
|
||||
telemetry:
|
||||
enabled: true
|
||||
v2:
|
||||
# For Null VM case now.
|
||||
# This also enables metadata exchange.
|
||||
enabled: true
|
||||
# Indicate if prometheus stats filter is enabled or not
|
||||
prometheus:
|
||||
enabled: true
|
||||
# stackdriver filter settings.
|
||||
stackdriver:
|
||||
enabled: false
|
||||
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||
revision: ""
|
||||
|
||||
# Revision tags are aliases to Istio control plane revisions
|
||||
revisionTags: []
|
||||
|
||||
# For Helm compatibility.
|
||||
ownerName: ""
|
||||
|
||||
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
|
||||
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
|
||||
experimental:
|
||||
stableValidationPolicy: false
|
||||
|
||||
global:
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
# List of cert-signers to allow "approve" action in the istio cluster role
|
||||
#
|
||||
# certSigners:
|
||||
# - clusterissuers.cert-manager.io/istio-ca
|
||||
certSigners: []
|
||||
# enable pod disruption budget for the control plane, which is used to
|
||||
# ensure Istio control plane components are gradually upgraded or recovered.
|
||||
defaultPodDisruptionBudget:
|
||||
enabled: true
|
||||
# The values aren't mutable due to a current PodDisruptionBudget limitation
|
||||
# minAvailable: 1
|
||||
|
||||
# A minimal set of requested resources to applied to all deployments so that
|
||||
# Horizontal Pod Autoscaler will be able to function (if set).
|
||||
# Each component can overwrite these default values by adding its own resources
|
||||
# block in the relevant section below and setting the desired resources values.
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
# memory: 128Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# Default hub for Istio images.
|
||||
# Releases are published to docker hub under 'istio' project.
|
||||
# Dev builds from prow are on gcr.io
|
||||
hub: docker.io/istio
|
||||
# Default tag for Istio images.
|
||||
tag: 1.23.0
|
||||
# Variant of the image to use.
|
||||
# Currently supported are: [debug, distroless]
|
||||
variant: ""
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
imagePullPolicy: ""
|
||||
|
||||
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
|
||||
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
# - private-registry-key
|
||||
|
||||
# Enabled by default in master for maximising testing.
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
|
||||
logAsJson: false
|
||||
|
||||
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
|
||||
# The control plane has different scopes depending on component, but can configure default log level across all components
|
||||
# If empty, default scope and level will be used as configured in code
|
||||
logging:
|
||||
level: "default:info"
|
||||
|
||||
omitSidecarInjectorConfigMap: false
|
||||
|
||||
# Configure whether Operator manages webhook configurations. The current behavior
|
||||
# of Istiod is to manage its own webhook configurations.
|
||||
# When this option is set as true, Istio Operator, instead of webhooks, manages the
|
||||
# webhook configurations. When this option is set as false, webhooks manage their
|
||||
# own webhook configurations.
|
||||
operatorManageWebhooks: false
|
||||
|
||||
# Custom DNS config for the pod to resolve names of services in other
|
||||
# clusters. Use this to add additional search domains, and other settings.
|
||||
# see
|
||||
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
|
||||
# This does not apply to gateway pods as they typically need a different
|
||||
# set of DNS settings than the normal application pods (e.g., in
|
||||
# multicluster scenarios).
|
||||
# NOTE: If using templates, follow the pattern in the commented example below.
|
||||
#podDNSSearchNamespaces:
|
||||
#- global
|
||||
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
|
||||
|
||||
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
|
||||
# system-node-critical, it is better to configure this in order to make sure your Istio pods
|
||||
# will not be killed because of low priority class.
|
||||
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
# for more detail.
|
||||
priorityClassName: ""
|
||||
|
||||
proxy:
|
||||
image: proxyv2
|
||||
|
||||
# This controls the 'policy' in the sidecar injector.
|
||||
autoInject: enabled
|
||||
|
||||
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
|
||||
# cluster domain. Default value is "cluster.local".
|
||||
clusterDomain: "cluster.local"
|
||||
|
||||
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
|
||||
# not set, then the global "logLevel" will be used.
|
||||
componentLogLevel: "misc:error"
|
||||
|
||||
# If set, newly injected sidecars will have core dumps enabled.
|
||||
enableCoreDump: false
|
||||
|
||||
# istio ingress capture allowlist
|
||||
# examples:
|
||||
# Redirect only selected ports: --includeInboundPorts="80,8080"
|
||||
excludeInboundPorts: ""
|
||||
includeInboundPorts: "*"
|
||||
|
||||
# istio egress capture allowlist
|
||||
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
|
||||
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
|
||||
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
|
||||
# be allowed by the sidecar
|
||||
includeIPRanges: "*"
|
||||
excludeIPRanges: ""
|
||||
includeOutboundPorts: ""
|
||||
excludeOutboundPorts: ""
|
||||
|
||||
# Log level for proxy, applies to gateways and sidecars.
|
||||
# Expected values are: trace|debug|info|warning|error|critical|off
|
||||
logLevel: warning
|
||||
|
||||
# Specify the path to the outlier event log.
|
||||
# Example: /dev/stdout
|
||||
outlierLogPath: ""
|
||||
|
||||
#If set to true, istio-proxy container will have privileged securityContext
|
||||
privileged: false
|
||||
|
||||
# The number of successive failed probes before indicating readiness failure.
|
||||
readinessFailureThreshold: 4
|
||||
|
||||
# The initial delay for readiness probes in seconds.
|
||||
readinessInitialDelaySeconds: 0
|
||||
|
||||
# The period between readiness probes.
|
||||
readinessPeriodSeconds: 15
|
||||
|
||||
# Enables or disables a startup probe.
|
||||
# For optimal startup times, changing this should be tied to the readiness probe values.
|
||||
#
|
||||
# If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
|
||||
# This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
|
||||
# and doesn't spam the readiness endpoint too much
|
||||
#
|
||||
# If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
|
||||
# This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
|
||||
startupProbe:
|
||||
enabled: true
|
||||
failureThreshold: 600 # 10 minutes
|
||||
|
||||
# Resources for the sidecar.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
|
||||
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
|
||||
statusPort: 15020
|
||||
|
||||
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
|
||||
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
|
||||
tracer: "none"
|
||||
|
||||
proxy_init:
|
||||
# Base name for the proxy_init container, used to configure iptables.
|
||||
image: proxyv2
|
||||
|
||||
# configure remote pilot and istiod service and endpoint
|
||||
remotePilotAddress: ""
|
||||
|
||||
##############################################################################################
|
||||
# The following values are found in other charts. To effectively modify these values, make #
|
||||
# make sure they are consistent across your Istio helm charts #
|
||||
##############################################################################################
|
||||
|
||||
# The customized CA address to retrieve certificates for the pods in the cluster.
|
||||
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
|
||||
# If not set explicitly, default to the Istio discovery address.
|
||||
caAddress: ""
|
||||
|
||||
# Configure a remote cluster data plane controlled by an external istiod.
|
||||
# When set to true, istiod is not deployed locally and only a subset of the other
|
||||
# discovery charts are enabled.
|
||||
externalIstiod: false
|
||||
|
||||
# Configure a remote cluster as the config cluster for an external istiod.
|
||||
configCluster: false
|
||||
|
||||
# configValidation enables the validation webhook for Istio configuration.
|
||||
configValidation: true
|
||||
|
||||
# Mesh ID means Mesh Identifier. It should be unique within the scope where
|
||||
# meshes will interact with each other, but it is not required to be
|
||||
# globally/universally unique. For example, if any of the following are true,
|
||||
# then two meshes must have different Mesh IDs:
|
||||
# - Meshes will have their telemetry aggregated in one place
|
||||
# - Meshes will be federated together
|
||||
# - Policy will be written referencing one mesh from the other
|
||||
#
|
||||
# If an administrator expects that any of these conditions may become true in
|
||||
# the future, they should ensure their meshes have different Mesh IDs
|
||||
# assigned.
|
||||
#
|
||||
# Within a multicluster mesh, each cluster must be (manually or auto)
|
||||
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
|
||||
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
|
||||
# of migration TBD, and it may be a disruptive operation to change the Mesh
|
||||
# ID post-install.
|
||||
#
|
||||
# If the mesh admin does not specify a value, Istio will use the value of the
|
||||
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
|
||||
# value.
|
||||
meshID: ""
|
||||
|
||||
# Configure the mesh networks to be used by the Split Horizon EDS.
|
||||
#
|
||||
# The following example defines two networks with different endpoints association methods.
|
||||
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
|
||||
# mapped to network1. The gateway for this network example is specified by its public IP
|
||||
# address and port.
|
||||
# The second network, `network2`, in this example is defined differently with all endpoints
|
||||
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
|
||||
# gateway is also defined differently with the name of the gateway service on the remote
|
||||
# cluster. The public IP for the gateway will be determined from that remote service (only
|
||||
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
|
||||
# it still need to be configured manually).
|
||||
#
|
||||
# meshNetworks:
|
||||
# network1:
|
||||
# endpoints:
|
||||
# - fromCidr: "192.168.0.1/24"
|
||||
# gateways:
|
||||
# - address: 1.1.1.1
|
||||
# port: 80
|
||||
# network2:
|
||||
# endpoints:
|
||||
# - fromRegistry: reg1
|
||||
# gateways:
|
||||
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
|
||||
# port: 443
|
||||
#
|
||||
meshNetworks: {}
|
||||
|
||||
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
|
||||
mountMtlsCerts: false
|
||||
|
||||
multiCluster:
|
||||
# Set to true to connect two kubernetes clusters via their respective
|
||||
# ingressgateway services when pods in each cluster cannot directly
|
||||
# talk to one another. All clusters should be using Istio mTLS and must
|
||||
# have a shared root CA for this model to work.
|
||||
enabled: false
|
||||
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
|
||||
# to properly label proxies
|
||||
clusterName: ""
|
||||
|
||||
# Network defines the network this cluster belong to. This name
|
||||
# corresponds to the networks in the map of mesh networks.
|
||||
network: ""
|
||||
|
||||
# Configure the certificate provider for control plane communication.
|
||||
# Currently, two providers are supported: "kubernetes" and "istiod".
|
||||
# As some platforms may not have kubernetes signing APIs,
|
||||
# Istiod is the default
|
||||
pilotCertProvider: istiod
|
||||
|
||||
sds:
|
||||
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
|
||||
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
|
||||
# JWT is intended for the CA.
|
||||
token:
|
||||
aud: istio-ca
|
||||
|
||||
sts:
|
||||
# The service port used by Security Token Service (STS) server to handle token exchange requests.
|
||||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# The name of the CA for workload certificates.
|
||||
# For example, when caName=GkeWorkloadCertificate, GKE workload certificates
|
||||
# will be used as the certificates for workloads.
|
||||
# The default value is "" and when caName="", the CA will be configured by other
|
||||
# mechanisms (e.g., environmental variable CA_PROVIDER).
|
||||
caName: ""
|
||||
|
||||
# whether to use autoscaling/v2 template for HPA settings
|
||||
# for internal usage only, not to be configured by users.
|
||||
autoscalingv2API: true
|
||||
|
||||
base:
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
|
||||
# `istio_cni` has been deprecated and will be removed in a future release. use `pilot.cni` instead
|
||||
istio_cni:
|
||||
# `chained` has been deprecated and will be removed in a future release. use `provider` instead
|
||||
chained: true
|
||||
provider: default
|
||||
|
||||
# Gateway Settings
|
||||
gateways:
|
||||
# Define the security context for the pod.
|
||||
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
|
||||
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
|
||||
securityContext: {}
|
||||
|
||||
# Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
|
||||
seccompProfile: {}
|
||||
Reference in New Issue
Block a user