From 41c52a9b9fdb0849a4de860e9ab898852ba7bac0 Mon Sep 17 00:00:00 2001 From: Alejandro Pedraza Date: Thu, 30 Sep 2021 17:13:01 -0500 Subject: [PATCH] make charts --- assets/linkerd/linkerd2-2.11.0.tgz | Bin 0 -> 24017 bytes charts/linkerd/linkerd2/2.11.0/.helmignore | 22 + charts/linkerd/linkerd2/2.11.0/Chart.yaml | 22 + charts/linkerd/linkerd2/2.11.0/README.md | 226 ++++++++++ .../linkerd/linkerd2/2.11.0/README.md.gotmpl | 119 +++++ charts/linkerd/linkerd2/2.11.0/app-readme.md | 9 + .../2.11.0/charts/partials/.helmignore | 21 + .../2.11.0/charts/partials/Chart.yaml | 6 + .../linkerd2/2.11.0/charts/partials/README.md | 9 + .../2.11.0/charts/partials/README.md.gotmpl | 14 + .../charts/partials/templates/NOTES.txt | 0 .../charts/partials/templates/_affinity.tpl | 22 + .../partials/templates/_capabilities.tpl | 16 + .../charts/partials/templates/_debug.tpl | 6 + .../charts/partials/templates/_helpers.tpl | 14 + .../charts/partials/templates/_metadata.tpl | 16 + .../partials/templates/_nodeselector.tpl | 4 + .../partials/templates/_proxy-config-ann.tpl | 18 + .../charts/partials/templates/_proxy-init.tpl | 62 +++ .../charts/partials/templates/_proxy.tpl | 189 ++++++++ .../partials/templates/_pull-secrets.tpl | 6 + .../charts/partials/templates/_resources.tpl | 21 + .../partials/templates/_tolerations.tpl | 4 + .../charts/partials/templates/_trace.tpl | 5 + .../charts/partials/templates/_validate.tpl | 5 + .../charts/partials/templates/_volumes.tpl | 10 + .../2.11.0/charts/partials/values.yaml | 0 charts/linkerd/linkerd2/2.11.0/questions.yaml | 25 + .../linkerd/linkerd2/2.11.0/requirements.lock | 6 + .../linkerd/linkerd2/2.11.0/requirements.yaml | 4 + .../linkerd2/2.11.0/templates/NOTES.txt | 19 + .../linkerd2/2.11.0/templates/config.yaml | 34 ++ .../2.11.0/templates/destination-rbac.yaml | 198 ++++++++ .../2.11.0/templates/destination.yaml | 311 +++++++++++++ .../2.11.0/templates/heartbeat-rbac.yaml | 73 +++ .../linkerd2/2.11.0/templates/heartbeat.yaml | 63 +++ .../2.11.0/templates/identity-rbac.yaml | 49 ++ .../linkerd2/2.11.0/templates/identity.yaml | 224 +++++++++ .../linkerd2/2.11.0/templates/namespace.yaml | 16 + .../linkerd2/2.11.0/templates/policy-crd.yaml | 426 ++++++++++++++++++ .../2.11.0/templates/proxy-injector-rbac.yaml | 102 +++++ .../2.11.0/templates/proxy-injector.yaml | 163 +++++++ .../linkerd2/2.11.0/templates/psp.yaml | 104 +++++ .../2.11.0/templates/serviceprofile-crd.yaml | 277 ++++++++++++ .../2.11.0/templates/trafficsplit-crd.yaml | 95 ++++ charts/linkerd/linkerd2/2.11.0/values-ha.yaml | 42 ++ charts/linkerd/linkerd2/2.11.0/values.yaml | 370 +++++++++++++++ index.yaml | 31 ++ 48 files changed, 3478 insertions(+) create mode 100644 assets/linkerd/linkerd2-2.11.0.tgz create mode 100644 charts/linkerd/linkerd2/2.11.0/.helmignore create mode 100644 charts/linkerd/linkerd2/2.11.0/Chart.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/README.md create mode 100644 charts/linkerd/linkerd2/2.11.0/README.md.gotmpl create mode 100644 charts/linkerd/linkerd2/2.11.0/app-readme.md create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/.helmignore create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/Chart.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/README.md create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/README.md.gotmpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/NOTES.txt create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_affinity.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_capabilities.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_debug.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_helpers.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_metadata.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_nodeselector.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-config-ann.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-init.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_pull-secrets.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_resources.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_tolerations.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_trace.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_validate.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_volumes.tpl create mode 100644 charts/linkerd/linkerd2/2.11.0/charts/partials/values.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/questions.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/requirements.lock create mode 100644 charts/linkerd/linkerd2/2.11.0/requirements.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/NOTES.txt create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/config.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/destination-rbac.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/destination.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/heartbeat-rbac.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/heartbeat.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/identity-rbac.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/identity.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/namespace.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/policy-crd.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/proxy-injector-rbac.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/proxy-injector.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/psp.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/serviceprofile-crd.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/templates/trafficsplit-crd.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/values-ha.yaml create mode 100644 charts/linkerd/linkerd2/2.11.0/values.yaml diff --git a/assets/linkerd/linkerd2-2.11.0.tgz b/assets/linkerd/linkerd2-2.11.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..b41c0d1b7792f3b965268c2d6f5df5c0855dd3ae GIT binary patch literal 24017 zcmV*0KzY9(iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZncHB6UC_2yl3QVecEV)H0Gj+3bPEC(WQdMaz%NnIz)jb|> z3rQj~QDPEo0+gI(`>g$XUe42gKmWGB;C#Yf2mmB_%Znt-c6G8>mz5+C5x4~+0)dE- zM%N?>x?6{1oCt4 zVw{MGB(=o?%Ht4E-3U)e51p!6Ra-J4A;FyJl6w9*IHtdlgi{vv&`rm|ah(0+0uMss zcD+u=YdZnqenMjbpFTRs;6fvMLpYkU6tMv($qgRRkc#OhN=QhvA2c$Y%jT{uoCif)euglqMwboH3KskA;YNZ);1p z!lTTgz9g*rVT(@ii14kDjhM@#aO!s3?Xed}Bj=h-Z&?!Xp5r1-f;%C6>|CbmUcwc(9ub%RgjnxefQ^G&X z1~8ldZ+G|Fof7}w?(A%@`2S-(Yv_m!aT*GwCIE0m!vUN%bUCIRQI0VB+ri6IcgT_n z7J>w5NJAnE91%an2|+hFp^{H?Bp4bH6l2awfM_I`;;@2D;t&hMJ;zx?u8Urz1Cm5U z5RQ({`sj#BrUooZf=D@W{4nK$B7QQ6d>m>Zmt$hyqlk!GmRzeg+>WU~HtZAy zl>6+4BvaXzm?W|tB=A)8_?V?(;H)7U`C%FmB*p~AEYO>Uf?$AeqCqN9L`Z-lCJI#| zxl`zJp0nnxp&zCwP~E$Ua2TREp*L9Mz>w@Y9upsSSi~6;V=PcYI15v`#UWLUM$Q@% z)0p}=wEK-jH#A|)B?f-S+l&;76yu+1c;HULt>WH#^Ve zuV?D#UQ6}t5%aG}f?(T1aVn{2A@!#Yyg5(9@Em^k(8=(OiSvYT5(!oJl#NhGZb%42 zA^XN>kw{pG;t)sj*Cb|=V;*b+nTh2=!V;?3bCs9xX2PS_Vq%%`F+e_WwFd30V!7f75 zo2G~QgrM_;y`M^n1!jZngBafELXHO4AS?m&!vgfI9Zpmss@PAmvr|qG8=~VVh#8GU zKa@*B4o@;63D3qPAY9N0#7MJX{?%F2kP4N}YLhI26CpcOBq>2sB0{u`>BTdSh6IZ= zk)tq@ONVmAqJIUf`ip$U1r0+)-p3@Nay8)4bLy}ch7=0WXoQ610&GHsYV_Ih<-3EU zmnUb)$FY_i5sl#6dH>v51I7SMLXL$?BPw7FK_El7V-g`6{U*l@fa`LyN3;N`@R+IK zM-;_jI+7?D!eK&iFqIudBQ9_llECpJdJN483N5%yQZ7)!m_S-i_hlcgA0Hm|4>mk> zBG5#Z7yt=3G#~*A(nOM_VS5e@NF=D30<43`mm=Z$@k=ROTQ~y6om0uv<*1ul&Kml6 z&EjAt+Z?+H+Hmof<}U|9K;?wNA+nSZ=z$Pe`Dw6D~hgvucU8&y4`6rh| z(Aoqf@F9&#pHNHB+j5=!LrtB4MAMd2ZfY$C2bp#q$Yy1|TU*xjMs*Xdn`U9QYwAw^ zUb5%STbx80r0SHH5{6XefFThsIQkb9Qpo`;4YGLqg{~zF83ygLuiw%p$b8mweYV1F!asOoojUCdGEOZ$~V0Em6|gJ{)AW?e~Ht5f0CFCA0CA znj`3hsKu&xhMYYJh6uLHGD{B#d{R+hOE5s6X^&4l= z)kYn}qHK>)%o4$^K{^N~G=jHH&4#jA7VDv%&ht)QHxriU)z+&N>bLXyCwj8Yt*N(w2UCNlr!Nc^cEs@XYa?3%w_H#Y6-3>6%0FrRPvEb>V#;16wh&;N8o z1I-0UTWk3zc(DOkWJgS7LnZq|EV9^e20)P_=lw0F;s@xMdCS2$OFaOs6&r`I%z1`lc{r(dU zNrKV(&d$zGZGm&f#V8>FWp`)0TU+RY1eBxoz3u(ywcn3J%mwxP1SkF&tv}yxx9h1T z6Ce9y5}@@?r`zdlAU~ue5*!6g*#tRHCDWXuI3aj42+5{iRfB}!YmNdUac%k--1 zq)piqo3gc=vNfBMCLqj(zs&SdmH+C^947kuz>VdHUxc65pFK7 zoBTA@+wmTB_blVC-K?Ypz1((M2HUi8bu{3+Z?6kAV7L8});C}wn9bA!SU+T({EDej zIr_xc%>BK1DG{AxF;;DxWIxeXl1A2iH3r0-0QbFGOm4{hYh@+-ktOI{pF0Fn`@W=^=SKy7 zRlkScyp>dG`X^IYpNP1MGFMYJbwf6yk*m<^qn-n05lYy5s!o~oISvvDj(Cg{5()J4 z<>mQS7p3ti!BP;_R^Xqzui*{R`&(u}L>Qg-&vSc-ly3(#3J?{hfko?lU$yZ-H_=09 zOb}-cpo}p`141GckT@Y=&Ow|;K0(*dxLk7Ms^ZJk>&c=_%ZY(=kqfVR-V8G0!T zOt8?}GLbl@D1bvs*+=61_@$yR5kSDS*WB>jWkJF+T9=_sn?w|e)BNxa3`v})vdvPX zm7sd4yEAT23hn<@IYYo;$SpoQ#)I~kk-?^`ZE^rZguEbTom6^kxg$pfO7&0=eROQt zFUWMp$Si^e}3RaqRZ~Z+LD-%`yzvRI1^& zV}cVgAh@hZuAzW(5T0a#A7la7MSbhgUNFnLAUnzem9XeHHgL)y3dh%q#bm=>t!)w4 zml}5(k{)WcQ5!v#|Fcd(jEGdP46ARsLagXkYz$#D<1-=9lD>vCB)?>0ftJ5K#Xyy3 zl=fn{l09;ztTD=%dR0K~`S^!43PN&~&0AR$#&1AEcDrG*Qzb5E5~3zM^CHpbo-9!d zc`yZAHs|0lWRVDiLxeeds zbG?F~GnQoGB`zVCowK$8-z+rH=Hd5Z;Wet=+A`d{KvfM(FCF-zT(POJ#{z@<0vxhX zeLj=)9+XRdQyi;tP-iT1fOk&@wj^Ev_i+4daqIx^ZtSfz2{nfUfSSt{OWcvs0l>R4 zJFSN{E@b$8k9AzEzw9zD)?TgRS#n2dAV2fsT@2j=ui3ds@4QsY6RomRO9dW(p)Mtr z^v|soy|7HeonC z4Q5eY5_pe?P9oKhKIR0pTkt5!snF&k)94}rlcE(Rucbx>57-UKU>2)Jgan||X!cgD z4{ZP|7aovM(uI`U&fG=cvsQ9uMaUUat^@LJ zI1D*sLB>7Jg@a8)Eqe3fS>IV}qI8bKM7~jNVb19&a$^>_5evxHn*6U}@f*%sE#*#R z(I)xrfC%grkunZe#`L{egqJKNiFPV4H%E50oYgzR&2LjmlTz%&vrjsjO? zNVggrvz8a)y)S(wGQ0nmUC-J&dv$r-_r!bgP&nq@|8DQ?mhS)U?6mh+_x~Q_kz6&i zsTU5}ZZStZ^?kzmFb%`0wLSd*|KI=n|2WPiLt_%gut7|4ghxbO^fTa$EA(mZSRJls>m|Fwwpa5ur{ z@c(XScfZ8{cRQW#ivK^xLs>OtIDP9{TXX`$dHk z$XBzcp%gy$#^tBkwoJ;#MT$ITo&dZ={at+5JR2yDPv3T}eXhY#6>?N*EvL2<}E ztCXiz6?ZUgArF1}rU9Ng81&R(t0zLPYw3o*lWj~R zsW#85(^5u)R)&y7!2;+j2IP6TD;4gJI5(j$g4HTLALTlk#9~_MFzX`hhE+jfwD6%; zO^uxP!Y$hdB5GQZ&-vEuVrpH_E5!vKk-Usxf5Ve7`}`4!gig>$6wyew1?|Xn@uk__ z>M1=n`@iLzV(mN04@nxTP**snKP4=U zc@Mp5;W*~4w*_~4^rmIpU5QX1Z%8tL4;byHj|(>Y{{ojWn!|JLVA){X~}vUKrBIw+{z`wTsY5H+z%9PSpJb09t+6@ z8A_a{!)G+nL8!`=mTxIf2U5C&1+U;0J^d>niw&Kt0p(*^g1fM`wIsqXGIX$#DjF8} zExU0VhWbVaZ)JHRdLc?E|OL0T}qh4*G?Y&)7TT1g06B+n9&Hx*-o*8Jky|VBC+pTi1 zpK(`&ygbtNt^6Wm{UG|an8u`siU%&T*`|j?C@TqQI&^a~MeBpT9TNFy9W;#ZeC)~5 z+}J36XdEzgYAnkuEp1*w)x(k!@Ee#($qO=FoDii(EuMc9)oJIU0ysLC6G znw1(VjYhw!^UlM9C&_}-Q=gUQCZI1c0kiX3$DKi{b!^b=C}JtFje}6B+MweieIHo$ ztG)-Jc)sx!X{OdHFn7(vZ4$T_*xG6tUWKCotuM^0=B@zk+^~@wwT766sC6=|`2LlE zBg(ax_?Sd+CIdke1v6eCRR9KC%kW-3$>HEWbF+9zPGFk1bWaS6SMc%)T6aZHF-x;L zFUSogw|dorEO^tABH&GDKm_h6F;eLs2)Ww#$P_)iI6k;Mmc?J6AIZPos#qp7gmCy; zM2Ew8j5SjDyQ@pi71%iq$nkIpk`g*&5t+YP>j-9FZo{7G6LgRLy4Mms6Zw43>qByv0$sIyWoAy@Ptg;%rOb0=B-ppa0B0|9coGpxNht-QD(1 z+5cy+v)@^r|2@WYr}IDaW^vOs7hkQ(`ax789upr_A5e`nUpP6JyKg~WUA|3Oa8n~M zkCNC|fkc?pv7WV`?WrIQI2jRfp1-V|I4m_@?wH^pB)p={{xJv6H$$dHq;GWKN~Xkr zfPs626<4v(ssY^5aeM9YD-^xQIA$`_KfnlniKVAQHW!!P^Y;CRY_z;A3m7)b*3MRLF}^Er6`p8v$ifi+LF1KCyrSxNfzZYFISC$ z3HTm-4b7=FtL?_lUY%KLQmYBns#`C)iG9!Zj-Sht5rX3oGScCFWe?G4^g0f($gJ^o zyr*D&HYN?-iPpk_$yr`JSv!Yloh4<{vLBkoxuK31*U8^=Yd!eFqmM|izDQ^^+5ji| zyn|aC8ymUhAE|48Je}yvRy}*=uEPN;`p&!5^m{*GPR_9yqgK6hc54H9a1|1FclUTY zu`!kG@pt7C^QVCYpatZZp?_8a02lLfi@lxO3w`?Z;X`(yQ$4781_de&s$S~X%*EBQ z&b4sXlyONfj=}=F>k_-iA}driJJkZU?!7qYjgVqJcNiSQ`K+a7z*?8!v)ebNrkLKa ziWX#@=PfbzkbH%O-?5r^W??$m3zDs1ACL|e=`E`pjjTIHS2y&)`l~rm<+|7-h4+-*F zwA5MV64m6QgIibX=pM=*F0kX7gB z(etO6N7uw@eY&+odo|d~ z)Y`Ct;$&p8bGMdRyU4{skbK|E%yIf{E|}$URlc9ihh5|ouagbJO->kmZ`CMlvy3Th*-TujXBlwwR* zs@7b1L?2OENtl7aZ22moiVJ203%+7WR<@P78)&xuB-keWga2*Re?NjU=zwdB?JewwnMaw$mKX8 ze9Xe2hxQljE|W%SW`C6=i~95cb7!WtN6v&)l+9+T1f2M3LItF~CGQIjOw#Cpzvd*V zpW&}hj%Kjj8rSB>WOoa#%-Kt?h6xpy?pL-p_m^IqwPQ4QaT@dMTu60`bpI<{r29>a zv@YD<-4bGfny@96QUY?XnmW1!s*amhpqNyw7MZO|%IH=N|)x{ac8q=z1v-`7yCtQ{(( zPvdM!EVf;qCbc41d7Bt29Lww;P~qF%CG=P?uv2{aV2o86Z4p%|%x%M-ToQ-1rmm8u zq?7~9__O6N=ZMV2nqf48%W^2cw43Vc z`AkoZ|96&h>0zQj&5i%K-QDk&{l9lR?Un!cV?0%kR!#b){cen#_|I9Iu8SWI4&n8Z zS4rmFBFZM<1Nu-c8|JAR%tswEPjFlc!waZAa9FVzh~rzB-ZDu(_yw$pK!X`wFNy^QMJjMBEO6#Y8(Q?V?Mo{(HS&Mv^zcCD-?{mJb~@$!Z+koK zmHqcoo(~_aC1ysxBJ!V@57n?Bxe@pga|0Mc?_kKVsy<{^fZVe^Z&^)ndUj2s1VV|G ztZhmxs+#ZW(+%YJR%?yXb4`fkrdm}~uqipG4!-|I!q0!nv3;z-^BJK_TNSM)K7vtk z8ElU~Tn}YZ%!KqW&5XamGh_dMund56;(xU}mH1z~JNvt<{r@qZd++~HMwx;N@k>iN z;x^#Ebi+rF`(rY()L|7+xV4cHa<>4@nIx;we4SkEfxi7|L0h6a7SZF_}o@Cc5igiD*WwLr$L`ztmQt z4d|3>GQ9`xEIs2jna)P7;yqiawOXfxf#@5!6$mEq?%_dsrr#kMXX%1n!kG9>vD?0i z8J|rr><-|ft_nH+vB5?EAo9m7;rS@p;hzfwc8?HHU$?mQ)x~|X8ni&Lyt;^8&+Zkm zD_b$2H`L)*HEs_PZ0$kD?F&Zd`UhI3pDjLD*2=FuI9KlO{Kt&URhVtx(n0tAm&x51 z^_L3BRcP}n8rK5RxK@Fx9w<;%Y3i+_RIQ>^m7-J?cgh*mJ#2`o>halI1JgXtTF>C6z^Y?+XGX$ z0j{#@&48o|JX|22g15&4o*u@_!^jX2F%0>zL7;(bX3;8?&yCzu;U6yek9`e%vD@jD z1-(GzpU-ta{gH!;w2M=_YHGh{M3E|(Z{wo4p?fQ{%-2sDxAc8MsFn$Is{*@dA4N06 zBpQfI$4IQN_*Di-9O96FZ4nY78e)5PAjBHBYEgrlhf zr09Un5{*ehHkO}p-(2X3lC01WH==2KSS-jxeQj4WhnG0+RrZWIhivn6naj)88^H73WhH4wh9sLu( ze$T?1^{-%l`kn`<>PLf0U;j-T}vyycZ;bgwxf?4k;IGV$|6q z0!HBaEc7~Yu~(Pr_`y#{@31(H(SM}8yz9t>;tE0TVWQ>5I7|~9_6qr#IgLhXh!gWx zy&SVdn3ym;xq*z_K8uOPEd%9;&+`s3g04yTZAs1~C#rTd4kcyZp@QHTk@Eb0-5=QZFa3n?~0WyN%o- zC1Jn|Q@Mr+tJ$+D!AXLr4JD``lg8=`HKni~uE}&$C-`Sc{a~O4I$1r}WIF4!p^igV zsTlUZK5+K$8=aO--J%OY7|-BK?s1sVyLC9a~hVF7^leV#DE zd=}o7@IzzltEvQT=iRunw)ndKm@^Nx zm9&R6v#2Qo6SRR5HrJA0f4;mt-|Ecz*lqYYx;Q^<_@o-&@bU7rU)t1_hobsEYfrb| zt+sUQ+iFWM_sD8XU#=;uEq%46ueS8nmVUo29U&Y9U;@G6c|s#Wl0z1zlc;iJb#Cu) zwVhQMf0gMk5o+TBa{{6qg_H{t(P)IML|VUb7AcPi4`!>inP%AaWLcI1GsoD_BBU9y zJ;f`LLm$|*RJfA=P1~93%s~ydrvtmu@U>`&Dt3x8K$WagxB{YRqQbww{ll80=CN4Q zy@Vq_q$CpB+h8(DBXtcHd`3=9wt$4arzFU1op+Fw(Hm8HQzI*ZY7Rc^=BA0siQycSkrP9Yq}Atg=Q&Z`KrkrK&Mt|XQ#xdmStcjqfK!BaFK zFn*G}pn11x6z~?6!zKC!WN$;;T?B7fI1O@6VVEw+kR&AX2}c-RspWo!;5;t!2^vfR z)J%zarW6=sAxIMS(3Ai12D`tv-RE!D-?;j(r{>khU%q=%3xLniw<>LEm~se2FJP$X z@2Qknz)8zYKNeZ@tZ7coYX3}uf5x0ZODbDUHRft`i>VL`=xPhL8QouJLrdswXki6l z0r7vq=G{e)LksJ2Xc2u5Eu)4ls@E+E^da;+w4jcMmeBLiqPiZM*Iu`FWkUG)^0dFe22=9;ywg6TGZ@~NKSK;$r4g$BLnr4_$&qWH zfH*Wq7C?>i06H0>G~z^T+FFf2W=ulHjnK^PiFGlJsgJ{Ox`}WYqLXtjMF&MHIM6-; zgIyya-A5ae zF;7x1kRZu~Mp9wDJnh@Iz?r~?37h0gLH0+$z;Ag<1RCQTg0LNqscC5-l+USI6EXZ;I=1w2paR|Au1p^76F5F>mAux_WwrV&(Vj<4EeODOd6Z z2+OcP<-LIDtoe!%M(W0>hYlj^q6yFldh%1L3EDGtHn=cE#fYT2ER+yS9%>%J2N&cQ zkYX(jb^X7eew?YLZmj>eH@m>o21OQCZXkTUlT?S;#hT8h+1d=@i)v%d))n(Cu7u4p zqvTJ;fL#oH`h)|VS+ia}ODSIWG^`ZcsN$9^*U&k$Qaz2mp$@Z)viSn=3L?G@O73Zr z7k=4Z{$u!BtnAhKv$9vO?A0rKb@r_6)hl~-{j;)HHHFRaKuIuGRFB0^NKKP3{@@w4%_DHZ+ zjS>v(RSAz)V6?JNzm_V&miMKDRji%|f9m4D=!kE>f&KIWvcS%X|FpN)EysV_-`(9= z#eaE>$Byg-u}aa29{4Yk*tIzK?vQ<@0^k9YyxuvF>O3$RYA&nktQ4{*b8V@FB&1x( zvLgcj+%AeKW%OHrkwiPSno;lL?E=FD|ek!!(57cW6?Po`Eh@BFIlz z^cx#M5%_l@L|-J^?N>74m(D|5LAyXEr97u@t7Yffy=xZT3Jr@S?Y)0e+`BaW%Z%#7 zB*@LuI*l0@sP{dJrF=Tf!{!%>_5Q>?e&e_5!}|dsA4@PJ67@+q?9)+1f1h1eL#Y9tpaXy(VZYo>&FdO zo*QPRj#cTZtNUMU-en;(9d{eXcQRMSKmwN&3K;MziE zbm}>b9iau6JIazlw68R#E(R1)e`@3R^W<6ez8%l0}F&Ep> zo7PQ73V_;0P>GRB@K^C4Ogg6?dV^Yr7sm&e$1S7`gjF#c-j#r>_f-L0%E4+PD$$hF zfE*8pAb_c~oR6me&DH-OAO`Gg{lBxlTZ#X=x3{y(|NbaXv;MCWyMJBjJd1PlkDAo8 zW+VERQhPp>FneFM>r18itWf$5B-&JZ6-&ySu^*a6vZ2(jb@KOIs^J2Uh!nqA9}XZk zYKtfSFW>*ijp6%>xw`LT7to)<3vh^wp=_(6pDGO`ftA|J=a+>&?pq<|m ziF$vPT5vXz1zU0A1?v#KU_A| zUF-E?*;E_GXl_o`ott1;#zmg<}wac!O>TrQ{gr#w;8Qjm8)zGaO zv&Hf+HXf}lF}{DiWQmo7=|AF$^aB~u7EpXa?=?D=I@8o11}EngL(iQ$Alq@>=G|0n zRc7lII2jS4w$xJLMNLHcEIDVv5#>n=UYwdgl0l?sWINrSqSiot^#F`OjlKYP&75o&I?x>*t}G?dV+2 zc68o9hc7euO~$19TKrX-)Y1-eg=O||;n;B)vfJ~7-q4VY$T9bEh?Tp%30!WZ&kM%H zk2EBF$_1HZvZ!X*C2M&uswj3Pv5?>p$9O=)?1Gt#&W=s9Q>La@}aW1 znR1k{xC-Im^wdFU%(ysH#)zD9`SRrau=wKq?Bjq+4054N60LU4OWS?bqNytgDsD-PfG4V8xLoy+ez@a{1uS22U;b=tof;75l zLL;e7x7(fkAf<=)c6YaTYe_XVW|THm54mzX{02z1v z$tHS|J0L$P`yD@tSzwfXs6dG-WL%G*q?{CLo#AXOmf?bT>|Nu`{1tR^+4;BD>sL{; zh*R&5CN58lFKf_xalOhN&eg_`wAK3$ZsRFGo4j^^v~0T-`sNRrT??kfGPC;+o^ zjB44SCQ5;eZV4TYtDyiILkTRCL-bdGO@bp1PS;o?BLTu8I7AA?It&M z+fs1QjB@>9pwmoF@OwH*CpzaQVne`0O+X_)W@#9p0YQ}WR9#nqfCYNLsIHyaE2pNh z_0v^3D!^pjuFn=ZZ!+gSR*yl|SM8oj!Z2jD0ds_?%^Ny<3ISJs(5bo@PrQ(bVPi3Y zaV2Afx7p@W#|WEeuC`dHC>gb18v@SG)~~q?)4@2W~hR(1Lsx%w%2WS$ydteFC^Zu|>3= z^0SCaUm%6f;isRU6w39j@I@GVE(??ld)+yPz5LC$Y1dmB>sH3Pm9b7eD`VZtShq6P zt&DXmV_iLrZ^#IQR>rz-qD?DfUG}Vubt_}t%2+q+SsCkQ5cdaZ@yb|Nepbf1GPqn8 z;69Tt&Wr<})RN8Yd#xtlk9zJI54;Fx*RA6)O>kIoN>t`N8jaErC*`m3vEbxA>^Z#5jph2p>bTnj!Yd7N1a;2iNY1Z4E*;*a~*Y{@$SD2m5$? zo8Vw~xcw~XboaVJ@ND}T-tPF%+QS{PyX7YV-+~DTlkM|)9ouu8dkP~^9TWenbv>>l zvyR{SEHcp^6%R7O1XWDg0>@K5XOFlhmWvmaPp6cNTCN7>MP6W`g&r<3Q2SfSi@L#& z`Vmw1FO!#lkxcnDmRP-LYQ7Axe@&vGobGU5Hho&3d#jTE3CHApmYt0awUHL4)pAB| zlu^16UR~Ir=8NKP5@BZut#iddE798%P0y1}^hBMsJgLw7HeZmNF$y((BA1Tp1A<;; zVsf*&yx6#zmb=*}M&+?l3sF~6Nwl-E(Sz1Z&4R~I%Oo_jSH)r(%@&!`b-Bz8rrOip z+3Y62y79F)Zp9A^&x#+`JS%?qQ2elTRyb4b{L=D%`N{M@Z%o1o9Yri54~=7v{@32^ z?v(Vu?M|n&(*GXgSwrW_TLXfns_{p+V-lf3O2dFgBNSu*8jlF~oHdmMoTo9wzCwIV z!Vrx@Hc$tmG#YK9goIeo8v;k0)_WWU&KioyNF{h)SJ|jZpdu*$^M;3BMG%FR7zYv* zlSHad#B;o({=2?l32|QidUkx#ccfxEnXm}`a@a=!O}OKYsMv!4s#ZAO;P+$;{%c;0 zM_ckg<|n_2wsJsnnWr&QhM%V%zm1)z-T+@aPdzb-ou~h|vxa`b31ulqCr8KJ@pNDe z$D;wkTdG{be*5ay_^c;e{};yxM=y`PN$~JEX0QL9&VD8TXSciCUakMfc-D-4qU$(1 zkpvpi8^R%B5F5yyOhq1=!qTSM4-9gQigw}*St2VWXhQvjW#Y~M{-6I#E$@hd@f`VM zu&^81!*iT}ev?^w+Fr+Nzg-^-5%b>G7M+YdK8D@Xqikz{gAv)%giu;Np1hU|m2|BIFg|_yGn=s#2HU(2~CpeF<7rx5lC3|G$ISPFUilQc5>?A-xr8FRK-;C62m#f!rksQ=9 zyY(FBN0y+8+!=f}i4!s=5tkgkK=dY3t;sUT8+=Z{eE#-L7J5bg@}LjS69O}VQ$c!J zih1Nq5pxJJu({(%xjFx2!tBWwn)c|~B;`icurx+kMJz=)^2aQ3ERbsE;z;?dB{nui zI~5#Vlc^^qc22USS%W+$z9Sg=nS>KGm_kcaP7<`9Mj^e{n`g=;9rD|iZa1P47dQ;B z(BbKcJ{IhqAu6+aIJu!TlE@}q2$n!akBR6O~7jO4T_Opz-<;vu=( z^lXuJa0CQ7nxIYeo9yg_#3A8+!l0yK$g)vTqVk|INWk0j-k)Cf{?z}k)&@W{k+riO9VQ?Ic2RusXF3|Y2P)(# z?Bb5|1K~8#t}Q06{?&~-l9=L2cm)FSWOfUr=9#SrHAxeJYZ#U7KfZULf#d$#om5K)B=B<)> z-ry)=Y2-tEP2K?6lmUu<)B?u8>#uL$h+8TJ%(qe+y;Of^q!)zDeu(|+w{JN7<2lY7 zKk|ofd)bb8dwc82S8}&>Dzax@t{}gZifuW02j(@bQ|ii?RhwyJ;(}*1jke@pZn?Zu z=+^}+2js>n%D)ZmlMD2QlH0stdZZUb1ce>l>8eg|YYTqb0k*PH%)#n6cCW$YKF*Ha zZ4pU{HGY~TQWRIbOS25)C7F;+KF@@9zNrP@QGz2OarcJ)p3B)YW}R||m|z-h-O%5+pu4#FDxu`YmksABdYOiTYNf7#Z(@B|7O`Eo zOhMsWft1Sx`!pIAsQ3+&(en6Jtuki)*1{?0+=bHTfJ-?}uJ88H)xUi&bzZOSwyzxL zBf7{G2=q}MCVWID4bVsDqia1M3;)Q!oR6>%_O`Y>Z_9XgppVG<6RZsABT%Kp2#NIt zk?1a`u|#*IB^&uycA}6WuVQrzL^&Ug`hLV@KcSEMR0DlPS1tX?gLG!CEA-J;{*TW3 zNLPwv%LM}gzyhfQL-QigPTPb3Z9UuUwAdKh$s1Z6{7tRmGGSHi7kP4-KM@$r| zL~(62wqfVjbm(f&3_G&O&}8-vslX8qMmwe~yeQmFJ?#voI;6 zf{MRtBt|IruetFH%e*NyXV$T=_7q@?7em6GTA`A_5Y>h00|0DlM4A3wL2JwGtrd;(+Uj`PU>- znZID_D!nJW?F*w&wKnk*>MV6x5q%tD8UdbDHqt(_8J1$BW`TxOYDLI28nO&9!I7X5J)#EeFwA5xX{tdTirJE)vV zg-S?S%t^v)*PCYg|5}ePzhKO*7O*IsB3j1t;u$wWBN|EeFS&2@uS&Sn@8t$0Xc!{$ zJ|+oOc?LYIy+3zf$D;%X#A>R=4e1jgaQ&L1ky+%P9vY7 z>t`I@bi8f{NXpb^DeWc^4i69Nh&ve;_LaIsVJJ)S3CQ!!hD1oa#uhOeMLlHxb^n^& zLcijuyi;`B92WQiB#{F#ohmU0vTDF=0vL#2lUuNZ!U;&Gb!bVY7Pm1H6i`Mqln9S= zYoo--1)jv&+^rrOc<4lA_V3I(9;At}_u?@0ARmOjHJn*Ar^=d1Wp$ioP#ZwEu+dUz zaV<`94enlwOQ96kqHQTIMN=F~ad+1QXmKl6ToT;f304RM4f%NAJKxOxb7yvT|Lu>R zojJSboad2?hHs}gmW%*x_j9J0f(bahrywmdm1h-Z{Fuq0#c5B>%Mrbkj6G8eI@}En zgRXduJRZgHuBI9^36oZ);U5epRn^rNpvFbL2)f&A_9t?ZRfWqlg?rm=4!%nvAAwgt zD!PHtgf2B;Hh!QHHi?{$iS2*ZfLr)k4_~oTL>O9Rmq6*7uIVNcRfv`J<;vRR#lI?; zx^cX&Bj%M5&G42I=(wKZg#E7&8-%o1jipK|(COsm0lJlAI>muwEB9jqN?l zIFSts>%|w(g$A*)c&(PciZUyW%v{>|WJiZU!bWPLVbx&5Jt{RdG{4&~e{py+qYAk> zX%lzU+2PyIHT0yzEP{X6mJ^ZnxXjtCDh*)0=XH^tnZZ>R{yHlb=!UQI!HaUza`rAG z_)OL$4ny`0%CWl@oL4WM_sih@oN8w}w+)~`(xXaaALqjW%;~(UuL9|DvqvH;DY4yu8j!Po{A{$AHzfwcr51Ht7iD6x@OgiyyO)5=B>3`K`y|1ivN0Dxnt~k|Qs?Ak z9d(+!^DGom%27JZ3^^I_d#AErnHu7P#KtqY;E+N>g};@V&Y_&@Mpd*NQ%3zE@9Z~m z$^S!1(-*x-83m^lv*)gQ`(N0SRz~dXc*%fLmteK&`2+=e{*VG~v(ah&^U0{U&R2Jg z&Hs1`eTFYy9GXyUKtWc*+VwXSZ~G|Ixri(lzZS@BVh2-!$0YxH;TBp& zeFur`+K3FJ$+k&Lr}rr>wIq`g@wpYW1!33LCamlPZS%A(Inw6&(dkx&XEzlslrX0i z7@vn}*x#&%Do}BKjAs*r5`^zT?`|{}%&zX`bikGe6g?B0( z$}q{?m^%OfI@uP|RCrp%{vSk{k@C-jDN0UfvQ0_v7V%#|xlPI9_8X*yiWTd#MlTmO zpQ^lsN&2NhCtYO53)nTT_Je>)`goAcw4J7+3rogwJu=lvS@5A$Ts@s0tZv?${ zXbjq|YRsNx85>YE(20l1O){i~q+Lbe6GZvjb@Dvdxi85ODmP3lE4Sa>VOJ@G{WX>+ z3v7B-@T}iliw>=$Vn4lLeZ5Se8J*C&!|}7KdT5A`iWvN~KtX`koq#pg>A9ZCUGPg| z#klqNgd=&jrqm#qv9L;`u>MmZ$!5VRt#z7k}VR$s(JpNZ5J>48EYT=<+IbK z+y_tJfO8Tz$sev2N)#GOXi&i?UR`Zb<>zm+!5-4M8Z0%orKaomA%X4$&xOwoVNqM- zoOC2WSR_{PL+h__%WASC9Wmhqv+oU!X}}OlR#Q1H)l}=mmm0q$qbvSBB)DC0mqmCX zqAgD!_3*uf+I$;Nk55lro+cU4@@PfB=L|CL3w1Hg58~KxcaqN$?z6xNoR5rFtWz88606qcRe1Fr@zn*|k3T#{%cp~cyThID6aQA3q zev1hJ$pxHQKh0EG3wqDONQ7#XB?M0W8(miuZs*CrcLm=C5f-=Ub>rvY2zD%{q=KF2 z$_M#dKX4e&WOSN!%}@tZXW!ZJI*Ck|O?DVer|iZa5H6>#*9q``k&ZMI`sL%XEs!Ac zGgK^JAJJWucFS4t_5ig;^xV9B9hTAC7^KYT+KmR&yP}{L3OXp>Zqbl|C~z4;SmY@_ z_>^gW*P{b$jAw+AwlGG_(3|;>vV9!pwdrv&H9q9^FbvfAuxuoar6uwhBlhtl$vXFj z%V8!Rs&xAF*lP@F2! z-smHBvcy|gis*hmBSUxac1_L{2Y1tthPwY_Tzudu_)wDizXyQwQ>k*OHh73TkkuEW zcOL8pfmIK7&PE7)XTEMq=t#$?SRvyy49DWWH+FBGj2mgc72Z&vrxbNBKGK|NPO7{yzf!7qv9r}#=uxXA<2=Hkk0+t^ z_kcgkX+||rd^em9*?IWL1eVzPH+AI8# zB(hXfc&TBhpWvfQ%%jE7!%^g40iDO?)8n)o6a?Yy(~n}<##PlU`mQ9qb17(ir1@Mk zV{UJ!!jP0t2)b1{?IVs(N6hCJ74PQbQ+xgM*fSD}-0vYcefC)Iu>2SD`0rNx*ZkVz zdH&g%cit__f%Krly>GMB$|8gG^7@zLTqFc>idciAL$psqo(w|Et4+&?ZL1JFhpy)O z^`lcisAMh@@mLR812%Rhv0iD(TpgjT-*)>Rbxoh>&!ZkcBcIx?eURyC*Jcs_N@*JW z()_5kt?9`IrI9YRrVv!;pJnr1ATULx{IVWWXst_wLyRiD4;mR}rdQ@6oLaw$)T)NUj?0q-`CT^tw@bR3}rrfSZ( zpydqZY@6lYre}rP?J~hWFz{kPp%00CvU>{5#GEDZ*uo#Az@ZPLudV$n< zM3^gA7pqpIZXogR2Vei5b%#;gij_}gfcZNrUl`83(fPvZG3P|d-#)o_6~4MZ@zX@L z?NvS{VlhS>NJg-HJ24Nn&9U4{6y9 z1Zsu|mrSaf*G$*Ouah!doK&dubx*nSsR;_SWycwdUAn?x2qGv{3#*BVp#TXAMPg5o} z6izXlk&~^0qD7EWp~-;T6%t8m?m)o%w1X-0m5JnWOP*d-eZYs5f9=QUa0Chov4}?bG+i4$TE<@t&Dw~f2_f?0s+Ao>9_XXT@b%k)iU{_Ow`K5&uDLT`j8PRarbkWQ(GdgKhDo@DdtVD47^l zjld%#T@>u-Fkbo4+vyLTwOYBj!8}z|`psM;vH=yWM8R z9Ax>a=3ZXSkmq{@ba5%~c=TBU!BHx{vH=TzKb#LraD0>^g;}0L%o%%~>4U&wVY%tA zK_?lnJGbXz!ii8eDmM}vawygX&!j4U*zCHK;}*z~`L&V=e{-y9F2ugMy|ul)wSHPK zI3_?e7*IWK(7e3lbaL7xYAPkgt5RHRt!I`rjU!#2@}j?{L7tz)QHF)sgi9I7){8sP?xN62up&&dB|6R&$HI9=r-Ly-RW1eE25dc(Q3YoQYynB(B6!9H zSDTm*cbAnoea&}t5o4g!7VxC)+vY9EYr8yxCZ-+mW;t|E5s9G0lE(3|7cbj1K}qUq7rvWUeKS<#PWZ>yQo( z{$8kkU3&l0%w3kjWf9C8gRESE-}^He@6k1ehR~nUNB#>a_7C9>&?)a z_QyOy1vH|>>?Z7Y*t&T*+ENs0!RYOk52a{F3xka_(C)G-85Sh<)<-S*emMrK2TDtn zRZnN~GjRvxndddvzT63N_9<>dbC_QQKIZ@2aF05g8gd||j`jR@n!(!Z#*L>XAr+ko zCBe|>kK%paGot!2^qt6i>KT1~WA5Xrte4$=<~?Sq*4=KpAbOBNwrt=M7)7vXB^x-B z+NasP%5zZfF~vnSIz13khba&|H_SpYodwV5LYoLQ)m}w6vY`$Sz{>I~nb~-S`%0Y$ zZ?~yAYZ}xhO_oJfXwmv^;7`APOU})T+t--hl@tn*8GQmiSe+CZgooOlc}zAoBeU0f zG4y%sRt_NpQS1Xh{xNx`L{#%VHRfh zv8UwXE*Tgg_C_Z%XN;R*b9HpEY1d=t_!|`yWiFj%rtI)CP~UT4?o{tco3kkb?&ho79w)BVFyINOB`F_%vDKv&uB!< zyPsbDic^7qdp#95$j?6T!1b{kYZVQg_%sr9p%R}xKFM2hBKT|LwrstW#=p*)ErBmy zOxw>-HthbD?fSuatIE!ZT7dRmpd8?+gJUm5+b%pGGJ@K6qaQ^zw~QO@=M$|Xp9dJ| zp52>u^C~q?u7ecg*q!Xx>5P3}R_+hFCYJMeQFY$87sNRev4Q+0%hv z%3Lf6hH{)^{)$Zn`Yv?=hSST1{OXCdcnk5r=~yCXe)fzgWq&ExvRXslz_xaKb~PQ1 zJ69y0luP$d#z35O_FBl=6;L9;$JNu*8WR#H`DSn1b*$x|A9M+dFi90M72D{gBc%-s z^ElI4*%s@3P@#mzVblf4#Ms_Rma0HhcY=K%Liofea{4YRp+H+YhH8fI8OC`-nit z@){5iI28xLsPqG2$Ji~?o1pso?Z2Zw>Fj`b%RhO)=dzPL07D8iQykEOf3ruUtZGi0 zvmN4a=>RWp-*edI>Y*Cy;s)H%{bZ)BbpmtJ9A{aDN^J5aG*-GetIUQxHP4}cD@SiR zY`A^DOOSG;Cd7ak_614|D_bRw^i$>Jz?X2@z$4_d;Ljb%)mV(z6dUE{#r^Fm~8 zYsOSed{KRhBWB5kY@e3|+nHj;Q?ze1W*#}}gX0h>*VT3q+SGhCBjJE9CQ*E`V$g~e zO^OkrM*fnWa7Y&~F|?S`1J@RlDVtAY(RX!1-fl8{CskBZ44xad^&g*>p(F+bYcLOw zzkhJ!m{MT#rRT9FHPbU(_5d$^Ybn$Rd#fQ=H1B7rwI8(O-^ibn3{q%}l*hVsb~3*I zf=D4S`|LQ6y-5L%H=lKe>L`hR{Yr2nP+ygO-&)~SqZqM#`@Jqh-8-c0_!+W<=62j~WIm;F z-BrvOXWdi29y6)CVxJb$DP_3C$i;UX-i9TtB}BOf<^4iWNW3ek5FmwwHZhxowufipcdZlJIR)5||Dd%s*RKbUzwcqG75!IVf-`!n(L z4j+;bOvz>)+sea0sZ!G}5sEle`UO3Q;W*Ebh&EOX-8r=5XEn6MA?IuQX^uZO<;P|} zlz(Eqt=DI>ZT8E<=|JtIn2mqDWgm+l3_2hFe}ZX{n6EnQzqZ083uFd{bYKCb<@-a= zXT`+pKC#}PP&QIp?7i}sCcQkTaL;!T!d;9GUx?(@WtL6g6eSD;sY(6)2YPJNH&xZ+ z1!7r>p4kHaY8FWb7WpT^NkPTp26I0JK$n?dz8KqqV_`7!P z6e8s0Xw)%j^p*zYa)e`}ZDE{$l19Wgj3P=MNf4R*+iBi4=b=>DDUy z)4ee6sQz6z#*OU#s9?&xzFa-;iCCxM`G8==<=W}#+GBlDa{ow!>$OATRV_SgB@=th z9JQKtqXW8edD`>@HPTzILZ^4XOff8JNpy?9bz_Uu9x3kk`sbiZ&;!0&P$Z86aEl&B z8k{%Q&?u`AQpoPw{jVhaczSv8M?69WNMVAqVn+p>Gc;dw-9P0ExE=?KrDLyw(n7FI z|FE_;q3Hh0C`FE2+$Yb>VPSefP1>0tRAR%GTHtTEd?->T?8P?g&OvCaq`ALFM}UNT zX{fMl?9n<+vTM=l<2vPF$5ofZ~pm>s-D&gyI$2t$PD2Ap)5S;@C z9!2PhPbDOcOCSqSVuoaXrQ!s9eMMaASW#U?MVC1n0TxIP`k~gg9`c-efa5Xejv9}H4?AL$1_X}Zkw?N23(YIOuyfSkwX22(LafR4Cy7YVNk2uM z#_ub}D18%!i5Nvd|KFxeHq+#>tXw1Y9w^`Kw9!fa0^SFvv#fM2w&Cnwi3GnR*Y))Po&&Fo;@-Bik(;m;}qndNd>+QGV$QWNc(Bs+t>Y8~z4&*vsw+aO* zN1+-d%TKCM*BljHG-tmtJ01}pcQ&ZVP{Pxocy{_k(S5~=?%jd+8&aR}VXBgRQ8`ZK zW~SlE4ZFJ597v5f9t?bJoh-}JgMuN?Y!DV!s~Nw3r9-*0>le~_dkmbCZX$<46W*>) z;B*R?+Po&vP>jlOpHdjrI8kmT$HME729kv+r{)2GCeiNQKA)cJzveEW!I=uKNaMY9S?Js%&Po>jePJ>SQW{zwENYD)`7z`7OLmT}EE3)E zu(uk|XYxW3iKZw>$j=wU{De4fk^5N=1jMTLV?P|ym=!99=1.16.0-0' +maintainers: +- email: cncf-linkerd-dev@lists.cncf.io + name: Linkerd authors + url: https://linkerd.io/ +name: linkerd2 +sources: +- https://github.com/linkerd/linkerd2/ +version: 2.11.0 diff --git a/charts/linkerd/linkerd2/2.11.0/README.md b/charts/linkerd/linkerd2/2.11.0/README.md new file mode 100644 index 000000000..716a8d36c --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/README.md @@ -0,0 +1,226 @@ +# linkerd2 + +Linkerd gives you observability, reliability, and security +for your microservices — with no code change required. + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) + +![AppVersion: edge-XX.X.X](https://img.shields.io/badge/AppVersion-edge--XX.X.X-informational?style=flat-square) + +**Homepage:** + +## Quickstart and documentation + +You can run Linkerd on any Kubernetes 1.16+ cluster in a matter of seconds. See +the [Linkerd Getting Started Guide][getting-started] for how. + +For more comprehensive documentation, start with the [Linkerd +docs][linkerd-docs]. + +## Prerequisite: identity certificates + +The identity component of Linkerd requires setting up a trust anchor +certificate, and an issuer certificate with its key. These need to be provided +to Helm by the user (unlike when using the `linkerd install` CLI which can +generate these automatically). You can provide your own, or follow [these +instructions](https://linkerd.io/2/tasks/generate-certificates/) to generate new +ones. + +Note that the provided certificates must be ECDSA certificates. + +## Adding Linkerd's Helm repository + +```bash +# To add the repo for Linkerd2 stable releases: +helm repo add linkerd https://helm.linkerd.io/stable +# To add the repo for Linkerd2 edge releases: +helm repo add linkerd-edge https://helm.linkerd.io/edge +``` + +The following instructions use the `linkerd` repo. For installing an edge +release, just replace with `linkerd-edge`. + +## Installing the chart + +You must provide the certificates and keys described in the preceding section, +and the same expiration date you used to generate the Issuer certificate. + +In this example we set the expiration date to one year ahead: + +```bash +helm install \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + --set identity.issuer.crtExpiry=$(date -d '+8760 hour' +"%Y-%m-%dT%H:%M:%SZ") \ + linkerd/linkerd2 +``` + +## Setting High-Availability + +Besides the default `values.yaml` file, the chart provides a `values-ha.yaml` +file that overrides some default values as to set things up under a +high-availability scenario, analogous to the `--ha` option in `linkerd install`. +Values such as higher number of replicas, higher memory/cpu limits and +affinities are specified in that file. + +You can get ahold of `values-ha.yaml` by fetching the chart files: + +```bash +helm fetch --untar linkerd/linkerd2 +``` + +Then use the `-f` flag to provide the override file, for example: + +```bash +helm install \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + --set identity.issuer.crtExpiry=$(date -d '+8760 hour' +"%Y-%m-%dT%H:%M:%SZ") \ + -f linkerd2/values-ha.yaml + linkerd/linkerd2 +``` + +## Get involved + +* Check out Linkerd's source code at [GitHub][linkerd2]. +* Join Linkerd's [user mailing list][linkerd-users], [developer mailing + list][linkerd-dev], and [announcements mailing list][linkerd-announce]. +* Follow [@linkerd][twitter] on Twitter. +* Join the [Linkerd Slack][slack]. + +[cncf]: https://www.cncf.io/ +[getting-started]: https://linkerd.io/2/getting-started/ +[linkerd2]: https://github.com/linkerd/linkerd2 +[linkerd-announce]: https://lists.cncf.io/g/cncf-linkerd-announce +[linkerd-dev]: https://lists.cncf.io/g/cncf-linkerd-dev +[linkerd-docs]: https://linkerd.io/2/overview/ +[linkerd-users]: https://lists.cncf.io/g/cncf-linkerd-users +[slack]: http://slack.linkerd.io +[twitter]: https://twitter.com/linkerd + +## Extensions for Linkerd + +The current chart installs the core Linkerd components, which grant you +reliability and security features. Other functionality is available through +extensions. Check the corresponding docs for each one of the following +extensions: + +* Observability: + [Linkerd-viz](https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/README.md) +* Multicluster: + [Linkerd-multicluster](https://github.com/linkerd/linkerd2/blob/main/multicluster/charts/linkerd-multicluster/README.md) +* Tracing: + [Linkerd-jaeger](https://github.com/linkerd/linkerd2/blob/main/jaeger/charts/linkerd-jaeger/README.md) + +## Requirements + +Kubernetes: `>=1.16.0-0` + +| Repository | Name | Version | +|------------|------|---------| +| file://../partials | partials | 0.1.0 | + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| clusterDomain | string | `"cluster.local"` | Kubernetes DNS Domain name to use | +| clusterNetworks | string | `"10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"` | The cluster networks for which service discovery is performed. This should include the pod and service networks, but need not include the node network. By default, all private networks are specified so that resolution works in typical Kubernetes environments. | +| cniEnabled | bool | `false` | enabling this omits the NET_ADMIN capability in the PSP and the proxy-init container when injecting the proxy; requires the linkerd-cni plugin to already be installed | +| controlPlaneTracing | bool | `false` | enables control plane tracing | +| controlPlaneTracingNamespace | string | `"linkerd-jaeger"` | namespace to send control plane traces to | +| controllerImage | string | `"cr.l5d.io/linkerd/controller"` | Docker image for the destination and identity components | +| controllerLogFormat | string | `"plain"` | Log format for the control plane components | +| controllerLogLevel | string | `"info"` | Log level for the control plane components | +| controllerReplicas | int | `1` | Number of replicas for each control plane pod | +| controllerUID | int | `2103` | User ID for the control plane components | +| debugContainer.image.name | string | `"cr.l5d.io/linkerd/debug"` | Docker image for the debug container | +| debugContainer.image.pullPolicy | string | imagePullPolicy | Pull policy for the debug container Docker image | +| debugContainer.image.version | string | linkerdVersion | Tag for the debug container Docker image | +| disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob | +| enableEndpointSlices | bool | `false` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on; the feature is still experimental. | +| enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading | +| enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 | +| identity.externalCA | bool | `false` | If the linkerd-identity-trust-roots ConfigMap has already been created | +| identity.issuer.clockSkewAllowance | string | `"20s"` | Amount of time to allow for clock skew within a Linkerd cluster | +| identity.issuer.crtExpiry | string | `nil` | Expiration timestamp for the issuer certificate. It must be provided during install. Must match the expiry date in crtPEM | +| identity.issuer.issuanceLifetime | string | `"24h0m0s"` | Amount of time for which the Identity issuer should certify identity | +| identity.issuer.scheme | string | `"linkerd.io/tls"` | | +| identity.issuer.tls | object | `{"crtPEM":"","keyPEM":""}` | Which scheme is used for the identity issuer secret format | +| identity.issuer.tls.crtPEM | string | `""` | Issuer certificate (ECDSA). It must be provided during install. | +| identity.issuer.tls.keyPEM | string | `""` | Key for the issuer certificate (ECDSA). It must be provided during install | +| identityTrustAnchorsPEM | string | `""` | Trust root certificate (ECDSA). It must be provided during install. | +| identityTrustDomain | string | clusterDomain | Trust domain used for identity | +| imagePullPolicy | string | `"IfNotPresent"` | Docker image pull policy | +| imagePullSecrets | list | `[]` | For Private docker registries, authentication is needed. Registry secrets are applied to the respective service accounts | +| installNamespace | bool | `true` | Set to false when installing Linkerd in a custom namespace. See the [Linkerd documentation](https://linkerd.io/2/tasks/install-helm#customizing-the-namespace) for more information. | +| linkerdVersion | string | `"linkerdVersionValue"` | control plane version. See Proxy section for proxy version | +| namespace | string | `"linkerd"` | Control plane namespace | +| nodeSelector | object | `{"beta.kubernetes.io/os":"linux"}` | NodeSelector section, See the [K8S documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) for more information | +| podAnnotations | object | `{}` | Additional annotations to add to all pods | +| podLabels | object | `{}` | Additional labels to add to all pods | +| policyController.defaultAllowPolicy | string | "all-unauthenticated" | The default allow policy to use when no `Server` selects a pod. One of: "all-authenticated", "all-unauthenticated", "cluster-authenticated", "cluster-unauthenticated", "deny" | +| policyController.image.name | string | `"cr.l5d.io/linkerd/policy-controller"` | Docker image for the proxy | +| policyController.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy container Docker image | +| policyController.image.version | string | linkerdVersion | Tag for the proxy container Docker image | +| policyController.logLevel | string | `"linkerd=info,warn"` | Log level for the policy controller | +| policyController.resources | object | destinationResources | policy controller resource requests & limits | +| policyController.resources.cpu.limit | string | `""` | Maximum amount of CPU units that the policy controller can use | +| policyController.resources.cpu.request | string | `""` | Amount of CPU units that the policy controller requests | +| policyController.resources.memory.limit | string | `""` | Maximum amount of memory that the policy controller can use | +| policyController.resources.memory.request | string | `""` | Maximum amount of memory that the policy controller requests | +| policyValidator.caBundle | string | `""` | Bundle of CA certificates for policy validator. If not provided then Helm will use the certificate generated for `policyValidator.crtPEM`. If `policyValidator.externalSecret` is set to true, this value must be set, as no certificate will be generated. | +| policyValidator.crtPEM | string | `""` | Certificate for the policy validator. If not provided then Helm will generate one. | +| policyValidator.externalSecret | bool | `false` | Do not create a secret resource for the policyValidator webhook. If this is set to `true`, the value `policyValidator.caBundle` must be set (see below). | +| policyValidator.keyPEM | string | `""` | Certificate key for the policy validator. If not provided then Helm will generate one. | +| policyValidator.namespaceSelector | object | `{"matchExpressions":[{"key":"config.linkerd.io/admission-webhooks","operator":"NotIn","values":["disabled"]}]}` | Namespace selector used by admission webhook | +| profileValidator.caBundle | string | `""` | Bundle of CA certificates for service profile validator. If not provided then Helm will use the certificate generated for `profileValidator.crtPEM`. If `profileValidator.externalSecret` is set to true, this value must be set, as no certificate will be generated. | +| profileValidator.crtPEM | string | `""` | Certificate for the service profile validator. If not provided then Helm will generate one. | +| profileValidator.externalSecret | bool | `false` | Do not create a secret resource for the profileValidator webhook. If this is set to `true`, the value `profileValidator.caBundle` must be set (see below). | +| profileValidator.keyPEM | string | `""` | Certificate key for the service profile validator. If not provided then Helm will generate one. | +| profileValidator.namespaceSelector | object | `{"matchExpressions":[{"key":"config.linkerd.io/admission-webhooks","operator":"NotIn","values":["disabled"]}]}` | Namespace selector used by admission webhook | +| proxy.await | bool | `true` | If set, the application container will not start until the proxy is ready | +| proxy.cores | int | `0` | The `cpu.limit` and `cores` should be kept in sync. The value of `cores` must be an integer and should typically be set by rounding up from the limit. E.g. if cpu.limit is '1500m', cores should be 2. | +| proxy.enableExternalProfiles | bool | `false` | Enable service profiles for non-Kubernetes services | +| proxy.image.name | string | `"cr.l5d.io/linkerd/proxy"` | Docker image for the proxy | +| proxy.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy container Docker image | +| proxy.image.version | string | linkerdVersion | Tag for the proxy container Docker image | +| proxy.inboundConnectTimeout | string | `"100ms"` | Maximum time allowed for the proxy to establish an inbound TCP connection | +| proxy.logFormat | string | `"plain"` | Log format (`plain` or `json`) for the proxy | +| proxy.logLevel | string | `"warn,linkerd=info"` | Log level for the proxy | +| proxy.opaquePorts | string | `"25,587,3306,4444,5432,6379,9300,11211"` | Default set of opaque ports - SMTP (25,587) server-first - MYSQL (3306) server-first - Galera (4444) server-first - PostgreSQL (5432) server-first - Redis (6379) server-first - ElasticSearch (9300) server-first - Memcached (11211) clients do not issue any preamble, which breaks detection | +| proxy.outboundConnectTimeout | string | `"1000ms"` | Maximum time allowed for the proxy to establish an outbound TCP connection | +| proxy.ports.admin | int | `4191` | Admin port for the proxy container | +| proxy.ports.control | int | `4190` | Control port for the proxy container | +| proxy.ports.inbound | int | `4143` | Inbound port for the proxy container | +| proxy.ports.outbound | int | `4140` | Outbound port for the proxy container | +| proxy.requireIdentityOnInboundPorts | string | `""` | | +| proxy.resources.cpu.limit | string | `""` | Maximum amount of CPU units that the proxy can use | +| proxy.resources.cpu.request | string | `""` | Amount of CPU units that the proxy requests | +| proxy.resources.memory.limit | string | `""` | Maximum amount of memory that the proxy can use | +| proxy.resources.memory.request | string | `""` | Maximum amount of memory that the proxy requests | +| proxy.uid | int | `2102` | User id under which the proxy runs | +| proxy.waitBeforeExitSeconds | int | `0` | If set the proxy sidecar will stay alive for at least the given period before receiving SIGTERM signal from Kubernetes but no longer than pod's `terminationGracePeriodSeconds`. See [Lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks) for more info on container lifecycle hooks. | +| proxyInit.closeWaitTimeoutSecs | int | `0` | | +| proxyInit.ignoreInboundPorts | string | `"4567,4568"` | Default set of inbound ports to skip via iptables - Galera (4567,4568) | +| proxyInit.ignoreOutboundPorts | string | `"4567,4568"` | Default set of outbound ports to skip via iptables - Galera (4567,4568) | +| proxyInit.image.name | string | `"cr.l5d.io/linkerd/proxy-init"` | Docker image for the proxy-init container | +| proxyInit.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy-init container Docker image | +| proxyInit.image.version | string | `"v1.4.0"` | Tag for the proxy-init container Docker image | +| proxyInit.resources.cpu.limit | string | `"100m"` | Maximum amount of CPU units that the proxy-init container can use | +| proxyInit.resources.cpu.request | string | `"10m"` | Amount of CPU units that the proxy-init container requests | +| proxyInit.resources.memory.limit | string | `"50Mi"` | Maximum amount of memory that the proxy-init container can use | +| proxyInit.resources.memory.request | string | `"10Mi"` | Amount of memory that the proxy-init container requests | +| proxyInit.xtMountPath.mountPath | string | `"/run"` | | +| proxyInit.xtMountPath.name | string | `"linkerd-proxy-init-xtables-lock"` | | +| proxyInjector.caBundle | string | `""` | Bundle of CA certificates for proxy injector. If not provided then Helm will use the certificate generated for `proxyInjector.crtPEM`. If `proxyInjector.externalSecret` is set to true, this value must be set, as no certificate will be generated. | +| proxyInjector.crtPEM | string | `""` | Certificate for the proxy injector. If not provided then Helm will generate one. | +| proxyInjector.externalSecret | bool | `false` | Do not create a secret resource for the profileValidator webhook. If this is set to `true`, the value `proxyInjector.caBundle` must be set (see below) | +| proxyInjector.keyPEM | string | `""` | Certificate key for the proxy injector. If not provided then Helm will generate one. | +| proxyInjector.namespaceSelector | object | `{"matchExpressions":[{"key":"config.linkerd.io/admission-webhooks","operator":"NotIn","values":["disabled"]}]}` | Namespace selector used by admission webhook. If not set defaults to all namespaces without the annotation config.linkerd.io/admission-webhooks=disabled | +| webhookFailurePolicy | string | `"Ignore"` | Failure policy for the proxy injector | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.4.0](https://github.com/norwoodj/helm-docs/releases/v1.4.0) diff --git a/charts/linkerd/linkerd2/2.11.0/README.md.gotmpl b/charts/linkerd/linkerd2/2.11.0/README.md.gotmpl new file mode 100644 index 000000000..e90d4c370 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/README.md.gotmpl @@ -0,0 +1,119 @@ +{{ template "chart.header" . }} +{{ template "chart.description" . }} + +{{ template "chart.versionBadge" . }} +{{ template "chart.typeBadge" . }} +{{ template "chart.appVersionBadge" . }} + +{{ template "chart.homepageLine" . }} + +## Quickstart and documentation + +You can run Linkerd on any Kubernetes 1.16+ cluster in a matter of seconds. See +the [Linkerd Getting Started Guide][getting-started] for how. + +For more comprehensive documentation, start with the [Linkerd +docs][linkerd-docs]. + +## Prerequisite: identity certificates + +The identity component of Linkerd requires setting up a trust anchor +certificate, and an issuer certificate with its key. These need to be provided +to Helm by the user (unlike when using the `linkerd install` CLI which can +generate these automatically). You can provide your own, or follow [these +instructions](https://linkerd.io/2/tasks/generate-certificates/) to generate new +ones. + +Note that the provided certificates must be ECDSA certificates. + +## Adding Linkerd's Helm repository + +```bash +# To add the repo for Linkerd2 stable releases: +helm repo add linkerd https://helm.linkerd.io/stable +# To add the repo for Linkerd2 edge releases: +helm repo add linkerd-edge https://helm.linkerd.io/edge +``` + +The following instructions use the `linkerd` repo. For installing an edge +release, just replace with `linkerd-edge`. + +## Installing the chart + +You must provide the certificates and keys described in the preceding section, +and the same expiration date you used to generate the Issuer certificate. + +In this example we set the expiration date to one year ahead: + +```bash +helm install \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + --set identity.issuer.crtExpiry=$(date -d '+8760 hour' +"%Y-%m-%dT%H:%M:%SZ") \ + linkerd/linkerd2 +``` + +## Setting High-Availability + +Besides the default `values.yaml` file, the chart provides a `values-ha.yaml` +file that overrides some default values as to set things up under a +high-availability scenario, analogous to the `--ha` option in `linkerd install`. +Values such as higher number of replicas, higher memory/cpu limits and +affinities are specified in that file. + +You can get ahold of `values-ha.yaml` by fetching the chart files: + +```bash +helm fetch --untar linkerd/linkerd2 +``` + +Then use the `-f` flag to provide the override file, for example: + +```bash +helm install \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + --set identity.issuer.crtExpiry=$(date -d '+8760 hour' +"%Y-%m-%dT%H:%M:%SZ") \ + -f linkerd2/values-ha.yaml + linkerd/linkerd2 +``` + +## Get involved + +* Check out Linkerd's source code at [GitHub][linkerd2]. +* Join Linkerd's [user mailing list][linkerd-users], [developer mailing + list][linkerd-dev], and [announcements mailing list][linkerd-announce]. +* Follow [@linkerd][twitter] on Twitter. +* Join the [Linkerd Slack][slack]. + +[cncf]: https://www.cncf.io/ +[getting-started]: https://linkerd.io/2/getting-started/ +[linkerd2]: https://github.com/linkerd/linkerd2 +[linkerd-announce]: https://lists.cncf.io/g/cncf-linkerd-announce +[linkerd-dev]: https://lists.cncf.io/g/cncf-linkerd-dev +[linkerd-docs]: https://linkerd.io/2/overview/ +[linkerd-users]: https://lists.cncf.io/g/cncf-linkerd-users +[slack]: http://slack.linkerd.io +[twitter]: https://twitter.com/linkerd + +## Extensions for Linkerd + +The current chart installs the core Linkerd components, which grant you +reliability and security features. Other functionality is available through +extensions. Check the corresponding docs for each one of the following +extensions: + +* Observability: + [Linkerd-viz](https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/README.md) +* Multicluster: + [Linkerd-multicluster](https://github.com/linkerd/linkerd2/blob/main/multicluster/charts/linkerd-multicluster/README.md) +* Tracing: + [Linkerd-jaeger](https://github.com/linkerd/linkerd2/blob/main/jaeger/charts/linkerd-jaeger/README.md) + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +{{ template "helm-docs.versionFooter" . }} diff --git a/charts/linkerd/linkerd2/2.11.0/app-readme.md b/charts/linkerd/linkerd2/2.11.0/app-readme.md new file mode 100644 index 000000000..0bf758574 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/app-readme.md @@ -0,0 +1,9 @@ +# Linkerd 2 Chart + +Linkerd is an ultra light, ultra simple, ultra powerful service mesh. Linkerd +adds security, observability, and reliability to Kubernetes, without the +complexity. + +This particular chart only installs the control plane core. To gain access to +the observability features, please install the linkerd-viz chart. Other +extensions are available (multicluster, jaeger) under the linkerd Helm repo. diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/.helmignore b/charts/linkerd/linkerd2/2.11.0/charts/partials/.helmignore new file mode 100644 index 000000000..f0c131944 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/Chart.yaml b/charts/linkerd/linkerd2/2.11.0/charts/partials/Chart.yaml new file mode 100644 index 000000000..b269da1a2 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +description: | + A Helm chart containing Linkerd partial templates, + depended by the 'linkerd' and 'patch' charts. +name: partials +version: 0.1.0 diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md b/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md new file mode 100644 index 000000000..1663c6eca --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md @@ -0,0 +1,9 @@ +# partials + +A Helm chart containing Linkerd partial templates, +depended by the 'linkerd' and 'patch' charts. + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.4.0](https://github.com/norwoodj/helm-docs/releases/v1.4.0) diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md.gotmpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md.gotmpl new file mode 100644 index 000000000..37f510106 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/README.md.gotmpl @@ -0,0 +1,14 @@ +{{ template "chart.header" . }} +{{ template "chart.description" . }} + +{{ template "chart.versionBadge" . }} +{{ template "chart.typeBadge" . }} +{{ template "chart.appVersionBadge" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +{{ template "helm-docs.versionFooter" . }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/NOTES.txt b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_affinity.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_affinity.tpl new file mode 100644 index 000000000..926a4eea5 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_affinity.tpl @@ -0,0 +1,22 @@ +{{ define "linkerd.pod-affinity" -}} +affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: {{ default "linkerd.io/control-plane-component" .label }} + operator: In + values: + - {{ .component }} + topologyKey: failure-domain.beta.kubernetes.io/zone + weight: 100 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: {{ default "linkerd.io/control-plane-component" .label }} + operator: In + values: + - {{ .component }} + topologyKey: kubernetes.io/hostname +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_capabilities.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_capabilities.tpl new file mode 100644 index 000000000..a595d74c1 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_capabilities.tpl @@ -0,0 +1,16 @@ +{{- define "partials.proxy.capabilities" -}} +capabilities: + {{- if .Values.proxy.capabilities.add }} + add: + {{- toYaml .Values.proxy.capabilities.add | trim | nindent 4 }} + {{- end }} + {{- if .Values.proxy.capabilities.drop }} + drop: + {{- toYaml .Values.proxy.capabilities.drop | trim | nindent 4 }} + {{- end }} +{{- end -}} + +{{- define "partials.proxy-init.capabilities.drop" -}} +drop: +{{ toYaml .Values.proxyInit.capabilities.drop | trim }} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_debug.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_debug.tpl new file mode 100644 index 000000000..cf0eb1417 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_debug.tpl @@ -0,0 +1,6 @@ +{{- define "partials.debug" -}} +image: {{.Values.debugContainer.image.name}}:{{.Values.debugContainer.image.version | default .Values.linkerdVersion}} +imagePullPolicy: {{.Values.debugContainer.image.pullPolicy | default .Values.imagePullPolicy}} +name: linkerd-debug +terminationMessagePolicy: FallbackToLogsOnError +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_helpers.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_helpers.tpl new file mode 100644 index 000000000..b6cdc34d0 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_helpers.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Splits a coma separated list into a list of string values. +For example "11,22,55,44" will become "11","22","55","44" +*/}} +{{- define "partials.splitStringList" -}} +{{- if gt (len (toString .)) 0 -}} +{{- $ports := toString . | splitList "," -}} +{{- $last := sub (len $ports) 1 -}} +{{- range $i,$port := $ports -}} +"{{$port}}"{{ternary "," "" (ne $i $last)}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_metadata.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_metadata.tpl new file mode 100644 index 000000000..7cf074458 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_metadata.tpl @@ -0,0 +1,16 @@ +{{- define "partials.annotations.created-by" -}} +linkerd.io/created-by: {{ .Values.cliVersion | default (printf "linkerd/helm %s" (.Values.cniPluginVersion | default .Values.linkerdVersion)) }} +{{- end -}} + +{{- define "partials.proxy.annotations" -}} +linkerd.io/identity-mode: {{ternary "default" "disabled" (not .Values.proxy.disableIdentity)}} +linkerd.io/proxy-version: {{.Values.proxy.image.version | default .Values.linkerdVersion}} +{{- end -}} + +{{/* +To add labels to the control-plane components, instead update at individual component manifests as +adding here would also update `spec.selector.matchLabels` which are immutable and would fail upgrades. +*/}} +{{- define "partials.proxy.labels" -}} +linkerd.io/proxy-{{.workloadKind}}: {{.component}} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_nodeselector.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_nodeselector.tpl new file mode 100644 index 000000000..4cde0ab16 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_nodeselector.tpl @@ -0,0 +1,4 @@ +{{- define "linkerd.node-selector" -}} +nodeSelector: +{{- toYaml .Values.nodeSelector | trim | nindent 2 }} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-config-ann.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-config-ann.tpl new file mode 100644 index 000000000..9651b3bd1 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-config-ann.tpl @@ -0,0 +1,18 @@ +{{- define "partials.proxy.config.annotations" -}} +{{- with .cpu }} +{{- with .request -}} +config.linkerd.io/proxy-cpu-request: {{. | quote}} +{{end}} +{{- with .limit -}} +config.linkerd.io/proxy-cpu-limit: {{. | quote}} +{{- end}} +{{- end}} +{{- with .memory }} +{{- with .request }} +config.linkerd.io/proxy-memory-request: {{. | quote}} +{{end}} +{{- with .limit -}} +config.linkerd.io/proxy-memory-limit: {{. | quote}} +{{- end}} +{{- end }} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-init.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-init.tpl new file mode 100644 index 000000000..324115520 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy-init.tpl @@ -0,0 +1,62 @@ +{{- define "partials.proxy-init" -}} +args: +- --incoming-proxy-port +- {{.Values.proxy.ports.inbound | quote}} +- --outgoing-proxy-port +- {{.Values.proxy.ports.outbound | quote}} +- --proxy-uid +- {{.Values.proxy.uid | quote}} +- --inbound-ports-to-ignore +- "{{.Values.proxy.ports.control}},{{.Values.proxy.ports.admin}}{{ternary (printf ",%s" (.Values.proxyInit.ignoreInboundPorts | toString)) "" (not (empty .Values.proxyInit.ignoreInboundPorts)) }}" +{{- if .Values.proxyInit.ignoreOutboundPorts }} +- --outbound-ports-to-ignore +- {{.Values.proxyInit.ignoreOutboundPorts | quote}} +{{- end }} +{{- if .Values.proxyInit.closeWaitTimeoutSecs }} +- --timeout-close-wait-secs +- {{ .Values.proxyInit.closeWaitTimeoutSecs | quote}} +{{- end }} +image: {{.Values.proxyInit.image.name}}:{{.Values.proxyInit.image.version}} +imagePullPolicy: {{.Values.proxyInit.image.pullPolicy | default .Values.imagePullPolicy}} +name: linkerd-init +{{ include "partials.resources" .Values.proxyInit.resources }} +securityContext: + {{- if .Values.proxyInit.closeWaitTimeoutSecs }} + allowPrivilegeEscalation: true + {{- else }} + allowPrivilegeEscalation: false + {{- end }} + capabilities: + add: + - NET_ADMIN + - NET_RAW + {{- if .Values.proxyInit.capabilities -}} + {{- if .Values.proxyInit.capabilities.add }} + {{- toYaml .Values.proxyInit.capabilities.add | trim | nindent 4 }} + {{- end }} + {{- if .Values.proxyInit.capabilities.drop -}} + {{- include "partials.proxy-init.capabilities.drop" . | nindent 4 -}} + {{- end }} + {{- end }} + {{- if .Values.proxyInit.closeWaitTimeoutSecs }} + privileged: true + {{- else }} + privileged: false + {{- end }} + readOnlyRootFilesystem: true + runAsNonRoot: false + runAsUser: 0 +terminationMessagePolicy: FallbackToLogsOnError +{{- if or (not .Values.cniEnabled) .Values.proxyInit.saMountPath }} +volumeMounts: +{{- end -}} +{{- if not .Values.cniEnabled }} +- mountPath: {{.Values.proxyInit.xtMountPath.mountPath}} + name: {{.Values.proxyInit.xtMountPath.name}} +{{- end -}} +{{- if .Values.proxyInit.saMountPath }} +- mountPath: {{.Values.proxyInit.saMountPath.mountPath}} + name: {{.Values.proxyInit.saMountPath.name}} + readOnly: {{.Values.proxyInit.saMountPath.readOnly}} +{{- end -}} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy.tpl new file mode 100644 index 000000000..b91404e71 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_proxy.tpl @@ -0,0 +1,189 @@ +{{ define "partials.proxy" -}} +{{- $trustDomain := (.Values.identityTrustDomain | default .Values.clusterDomain) -}} +env: +- name: _pod_name + valueFrom: + fieldRef: + fieldPath: metadata.name +- name: _pod_ns + valueFrom: + fieldRef: + fieldPath: metadata.namespace +- name: _pod_nodeName + valueFrom: + fieldRef: + fieldPath: spec.nodeName +{{- if .Values.proxy.cores }} +- name: LINKERD2_PROXY_CORES + value: {{.Values.proxy.cores | quote}} +{{- end }} +{{ if .Values.proxy.requireIdentityOnInboundPorts -}} +- name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_IDENTITY + value: {{.Values.proxy.requireIdentityOnInboundPorts | quote}} +{{ end -}} +{{ if .Values.proxy.requireTLSOnInboundPorts -}} +- name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS + value: {{.Values.proxy.requireTLSOnInboundPorts | quote}} +{{ end -}} +- name: LINKERD2_PROXY_LOG + value: {{.Values.proxy.logLevel | quote}} +- name: LINKERD2_PROXY_LOG_FORMAT + value: {{.Values.proxy.logFormat | quote}} +- name: LINKERD2_PROXY_DESTINATION_SVC_ADDR + value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s.:8086" .Values.namespace .Values.clusterDomain) (eq (toString .Values.proxy.component) "linkerd-destination")}} +- name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS + value: {{.Values.clusterNetworks | quote}} +- name: LINKERD2_PROXY_POLICY_SVC_ADDR + value: {{ternary "localhost.:8090" (printf "linkerd-policy.%s.svc.%s.:8090" .Values.namespace .Values.clusterDomain) (eq (toString .Values.proxy.component) "linkerd-destination")}} +- name: LINKERD2_PROXY_POLICY_WORKLOAD + value: "$(_pod_ns):$(_pod_name)" +- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY + value: {{.Values.proxy.defaultInboundPolicy | default .Values.policyController.defaultAllowPolicy}} +- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS + value: {{.Values.clusterNetworks | quote}} +{{ if .Values.proxy.inboundConnectTimeout -}} +- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT + value: {{.Values.proxy.inboundConnectTimeout | quote}} +{{ end -}} +{{ if .Values.proxy.outboundConnectTimeout -}} +- name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT + value: {{.Values.proxy.outboundConnectTimeout | quote}} +{{ end -}} +- name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR + value: 0.0.0.0:{{.Values.proxy.ports.control}} +- name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR + value: 0.0.0.0:{{.Values.proxy.ports.admin}} +- name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR + value: 127.0.0.1:{{.Values.proxy.ports.outbound}} +- name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR + value: 0.0.0.0:{{.Values.proxy.ports.inbound}} +- name: LINKERD2_PROXY_INBOUND_IPS + valueFrom: + fieldRef: + fieldPath: status.podIPs +{{ if .Values.proxy.podInboundPorts -}} +- name: LINKERD2_PROXY_INBOUND_PORTS + value: {{ .Values.proxy.podInboundPorts | quote }} +{{ end -}} +{{ if .Values.proxy.isGateway -}} +- name: LINKERD2_PROXY_INBOUND_GATEWAY_SUFFIXES + value: {{printf "svc.%s." .Values.clusterDomain}} +{{ end -}} +{{ if .Values.proxy.isIngress -}} +- name: LINKERD2_PROXY_INGRESS_MODE + value: "true" +{{ end -}} +- name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES + {{- $internalDomain := printf "svc.%s." .Values.clusterDomain }} + value: {{ternary "." $internalDomain .Values.proxy.enableExternalProfiles}} +- name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE + value: 10000ms +- name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE + value: 10000ms +{{ if .Values.proxy.opaquePorts -}} +- name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION + value: {{.Values.proxy.opaquePorts | quote}} +{{ end -}} +- name: LINKERD2_PROXY_DESTINATION_CONTEXT + value: | + {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)"} +{{ if .Values.proxy.disableIdentity -}} +- name: LINKERD2_PROXY_IDENTITY_DISABLED + value: disabled +{{ else -}} +- name: _pod_sa + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName +- name: _l5d_ns + value: {{.Values.namespace}} +- name: _l5d_trustdomain + value: {{$trustDomain}} +- name: LINKERD2_PROXY_IDENTITY_DIR + value: /var/run/linkerd/identity/end-entity +- name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS +{{- /* +Pods in the `linkerd` namespace are not injected by the proxy injector and instead obtain +the trust anchor bundle from the `linkerd-identity-trust-roots` configmap. This should not +be used in other contexts. +*/}} +{{- if .Values.proxy.loadTrustBundleFromConfigMap }} + valueFrom: + configMapKeyRef: + name: linkerd-identity-trust-roots + key: ca-bundle.crt +{{ else }} + value: | + {{- required "Please provide the identity trust anchors" .Values.identityTrustAnchorsPEM | trim | nindent 4 }} +{{ end -}} +- name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE + value: /var/run/secrets/kubernetes.io/serviceaccount/token +- name: LINKERD2_PROXY_IDENTITY_SVC_ADDR + value: {{ternary "localhost.:8080" (printf "linkerd-identity-headless.%s.svc.%s.:8080" .Values.namespace .Values.clusterDomain) (eq (toString .Values.proxy.component) "linkerd-identity")}} +- name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME + value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.{{.Values.namespace}}.{{$trustDomain}} +- name: LINKERD2_PROXY_IDENTITY_SVC_NAME + value: linkerd-identity.{{.Values.namespace}}.serviceaccount.identity.{{.Values.namespace}}.{{$trustDomain}} +- name: LINKERD2_PROXY_DESTINATION_SVC_NAME + value: linkerd-destination.{{.Values.namespace}}.serviceaccount.identity.{{.Values.namespace}}.{{$trustDomain}} +- name: LINKERD2_PROXY_POLICY_SVC_NAME + value: linkerd-destination.{{.Values.namespace}}.serviceaccount.identity.{{.Values.namespace}}.{{$trustDomain}} +{{ end -}} +image: {{.Values.proxy.image.name}}:{{.Values.proxy.image.version | default .Values.linkerdVersion}} +imagePullPolicy: {{.Values.proxy.image.pullPolicy | default .Values.imagePullPolicy}} +livenessProbe: + httpGet: + path: /live + port: {{.Values.proxy.ports.admin}} + initialDelaySeconds: 10 +name: linkerd-proxy +ports: +- containerPort: {{.Values.proxy.ports.inbound}} + name: linkerd-proxy +- containerPort: {{.Values.proxy.ports.admin}} + name: linkerd-admin +readinessProbe: + httpGet: + path: /ready + port: {{.Values.proxy.ports.admin}} + initialDelaySeconds: 2 +{{- if .Values.proxy.resources }} +{{ include "partials.resources" .Values.proxy.resources }} +{{- end }} +securityContext: + allowPrivilegeEscalation: false + {{- if .Values.proxy.capabilities -}} + {{- include "partials.proxy.capabilities" . | nindent 2 -}} + {{- end }} + readOnlyRootFilesystem: true + runAsUser: {{.Values.proxy.uid}} +terminationMessagePolicy: FallbackToLogsOnError +{{- if or (.Values.proxy.await) (.Values.proxy.waitBeforeExitSeconds) }} +lifecycle: +{{- if .Values.proxy.await }} + postStart: + exec: + command: + - /usr/lib/linkerd/linkerd-await +{{- end }} +{{- if .Values.proxy.waitBeforeExitSeconds }} + preStop: + exec: + command: + - /bin/sleep + - {{.Values.proxy.waitBeforeExitSeconds | quote}} +{{- end }} +{{- end }} +{{- if or (not .Values.proxy.disableIdentity) (.Values.proxy.saMountPath) }} +volumeMounts: +{{- if not .Values.proxy.disableIdentity }} +- mountPath: /var/run/linkerd/identity/end-entity + name: linkerd-identity-end-entity +{{- end -}} +{{- if .Values.proxy.saMountPath }} +- mountPath: {{.Values.proxy.saMountPath.mountPath}} + name: {{.Values.proxy.saMountPath.name}} + readOnly: {{.Values.proxy.saMountPath.readOnly}} +{{- end -}} +{{- end -}} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_pull-secrets.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_pull-secrets.tpl new file mode 100644 index 000000000..0c9aa4f01 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_pull-secrets.tpl @@ -0,0 +1,6 @@ +{{- define "partials.image-pull-secrets"}} +{{- if . }} +imagePullSecrets: +{{ toYaml . | indent 2 }} +{{- end }} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_resources.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_resources.tpl new file mode 100644 index 000000000..0f33725af --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_resources.tpl @@ -0,0 +1,21 @@ +{{- define "partials.resources" -}} +resources: + {{- if or .cpu.limit .memory.limit }} + limits: + {{- with .cpu.limit }} + cpu: {{. | quote}} + {{- end }} + {{- with .memory.limit }} + memory: {{. | quote}} + {{- end }} + {{- end }} + {{- if or .cpu.request .memory.request }} + requests: + {{- with .cpu.request }} + cpu: {{. | quote}} + {{- end }} + {{- with .memory.request }} + memory: {{. | quote}} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_tolerations.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_tolerations.tpl new file mode 100644 index 000000000..c2292b146 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_tolerations.tpl @@ -0,0 +1,4 @@ +{{- define "linkerd.tolerations" -}} +tolerations: +{{ toYaml .Values.tolerations | trim | indent 2 }} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_trace.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_trace.tpl new file mode 100644 index 000000000..dee059541 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_trace.tpl @@ -0,0 +1,5 @@ +{{ define "partials.linkerd.trace" -}} +{{ if .Values.controlPlaneTracing -}} +- -trace-collector=collector.{{.Values.controlPlaneTracingNamespace}}.svc.{{.Values.clusterDomain}}:55678 +{{ end -}} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_validate.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_validate.tpl new file mode 100644 index 000000000..3eeb70c6c --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_validate.tpl @@ -0,0 +1,5 @@ +{{- define "linkerd.proxy.validation" -}} +{{- if .disableIdentity -}} +{{- fail (printf "Can't disable identity mTLS for %s. Set '.Values.proxy.disableIdentity' to 'false'" .component) -}} +{{- end -}} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_volumes.tpl b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_volumes.tpl new file mode 100644 index 000000000..7debc9fe3 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/charts/partials/templates/_volumes.tpl @@ -0,0 +1,10 @@ +{{ define "partials.proxy.volumes.identity" -}} +emptyDir: + medium: Memory +name: linkerd-identity-end-entity +{{- end -}} + +{{ define "partials.proxyInit.volumes.xtables" -}} +emptyDir: {} +name: {{ .Values.proxyInit.xtMountPath.name }} +{{- end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/charts/partials/values.yaml b/charts/linkerd/linkerd2/2.11.0/charts/partials/values.yaml new file mode 100644 index 000000000..e69de29bb diff --git a/charts/linkerd/linkerd2/2.11.0/questions.yaml b/charts/linkerd/linkerd2/2.11.0/questions.yaml new file mode 100644 index 000000000..a58084d05 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/questions.yaml @@ -0,0 +1,25 @@ +questions: +- variable: identityTrustAnchorsPEM + label: "Trust root certificate (ECDSA)" + description: "Root certificate used to support mTLS connections between meshed pods" + required: true + type: multiline + group: Identity +- variable: identity.issuer.tls.crtPEM + label: "Issuer certificate (ECDSA)" + description: "Intermediate certificate, rooted on identityTrustAnchorsPEM, used to sign the Linkerd proxies' CSR" + required: true + type: multiline + group: Identity +- variable: identity.issuer.tls.keyPEM + label: "Key for the issuer certificate (ECDSA)" + description: "Private key for the certificate entered on crtPEM" + required: true + type: multiline + group: Identity +- variable: identity.issuer.crtExpiry + label: "Expiration timestamp for the issuer certificate" + description: "This must match the expiry date in crtPEM" + required: true + type: string + group: Identity diff --git a/charts/linkerd/linkerd2/2.11.0/requirements.lock b/charts/linkerd/linkerd2/2.11.0/requirements.lock new file mode 100644 index 000000000..968cd6e43 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/requirements.lock @@ -0,0 +1,6 @@ +dependencies: +- name: partials + repository: file://../partials + version: 0.1.0 +digest: sha256:8e42f9c9d4a2dc883f17f94d6044c97518ced19ad0922f47b8760e47135369ba +generated: "2020-12-21T17:47:25.811707816Z" diff --git a/charts/linkerd/linkerd2/2.11.0/requirements.yaml b/charts/linkerd/linkerd2/2.11.0/requirements.yaml new file mode 100644 index 000000000..a17d782a8 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/requirements.yaml @@ -0,0 +1,4 @@ +dependencies: +- name: partials + version: 0.1.0 + repository: file://../partials diff --git a/charts/linkerd/linkerd2/2.11.0/templates/NOTES.txt b/charts/linkerd/linkerd2/2.11.0/templates/NOTES.txt new file mode 100644 index 000000000..d890a793f --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/NOTES.txt @@ -0,0 +1,19 @@ +The Linkerd control plane was successfully installed 🎉 + +To help you manage your Linkerd service mesh you can install the Linkerd CLI by running: + + curl -sL https://run.linkerd.io/install | sh + +Alternatively, you can download the CLI directly via the Linkerd releases page: + + https://github.com/linkerd/linkerd2/releases/ + +To make sure everything works as expected, run the following: + + linkerd check + +Linkerd Viz extension can be installed by running: + + linkerd viz install | kubectl apply -f - + +Looking for more? Visit https://linkerd.io/2/getting-started/ diff --git a/charts/linkerd/linkerd2/2.11.0/templates/config.yaml b/charts/linkerd/linkerd2/2.11.0/templates/config.yaml new file mode 100644 index 000000000..707a65e7b --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/config.yaml @@ -0,0 +1,34 @@ +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: linkerd-config + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: controller + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +data: + values: | + {{- $values := deepCopy .Values }} + {{- /* + WARNING! All sensitive or private data such as TLS keys must be removed + here to avoid it being publicly readable. + */ -}} + {{- if kindIs "map" $values.identity.issuer.tls -}} + {{- $_ := unset $values.identity.issuer.tls "keyPEM"}} + {{- end -}} + {{- if kindIs "map" $values.profileValidator -}} + {{- $_ := unset $values.profileValidator "keyPEM"}} + {{- end -}} + {{- if kindIs "map" $values.proxyInjector -}} + {{- $_ := unset $values.proxyInjector "keyPEM"}} + {{- end -}} + {{- if (empty $values.identityTrustDomain) -}} + {{- $_ := set $values "identityTrustDomain" $values.clusterDomain}} + {{- end -}} + {{- $_ := unset $values "partials"}} + {{- $_ := unset $values "configs"}} + {{- $_ := unset $values "stage"}} + {{- toYaml $values | trim | nindent 4 }} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/destination-rbac.yaml b/charts/linkerd/linkerd2/2.11.0/templates/destination-rbac.yaml new file mode 100644 index 000000000..918ca8fb3 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/destination-rbac.yaml @@ -0,0 +1,198 @@ +--- +### +### Destination Controller Service +### +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-destination + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: ["apps"] + resources: ["replicasets"] + verbs: ["list", "get", "watch"] +- apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["list", "get", "watch"] +- apiGroups: [""] + resources: ["pods", "endpoints", "services", "nodes", "namespaces"] + verbs: ["list", "get", "watch"] +- apiGroups: ["linkerd.io"] + resources: ["serviceprofiles"] + verbs: ["list", "get", "watch"] +- apiGroups: ["split.smi-spec.io"] + resources: ["trafficsplits"] + verbs: ["list", "get", "watch"] + {{- if .Values.enableEndpointSlices }} +- apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["list", "get", "watch"] + {{- end }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-destination + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: linkerd-{{.Values.namespace}}-destination +subjects: +- kind: ServiceAccount + name: linkerd-destination + namespace: {{.Values.namespace}} +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: linkerd-destination + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }} +--- +{{- $host := printf "linkerd-sp-validator.%s.svc" .Values.namespace }} +{{- $ca := genSelfSignedCert $host (list) (list $host) 365 }} +{{- if (not .Values.profileValidator.externalSecret) }} +kind: Secret +apiVersion: v1 +metadata: + name: linkerd-sp-validator-k8s-tls + namespace: {{ .Values.namespace }} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +type: kubernetes.io/tls +data: + tls.crt: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.profileValidator.crtPEM)) (empty .Values.profileValidator.crtPEM) }} + tls.key: {{ ternary (b64enc (trim $ca.Key)) (b64enc (trim .Values.profileValidator.keyPEM)) (empty .Values.profileValidator.keyPEM) }} +--- +{{- end }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: linkerd-sp-validator-webhook-config + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +webhooks: +- name: linkerd-sp-validator.linkerd.io + namespaceSelector: + {{- toYaml .Values.profileValidator.namespaceSelector | trim | nindent 4 }} + clientConfig: + service: + name: linkerd-sp-validator + namespace: {{ .Values.namespace }} + path: "/" +{{- if and (.Values.profileValidator.externalSecret) (empty .Values.profileValidator.caBundle) }} + {{- fail "If profileValidator.externalSecret is true then you need to provide profileValidator.caBundle" }} +{{- end }} + caBundle: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.profileValidator.caBundle)) (empty .Values.profileValidator.caBundle) }} + failurePolicy: {{.Values.webhookFailurePolicy}} + admissionReviewVersions: ["v1", "v1beta1"] + rules: + - operations: ["CREATE", "UPDATE"] + apiGroups: ["linkerd.io"] + apiVersions: ["v1alpha1", "v1alpha2"] + resources: ["serviceprofiles"] + sideEffects: None +--- +{{- $host := printf "linkerd-policy-validator.%s.svc" .Values.namespace }} +{{- $ca := genSelfSignedCert $host (list) (list $host) 365 }} +{{- if (not .Values.policyValidator.externalSecret) }} +kind: Secret +apiVersion: v1 +metadata: + name: linkerd-policy-validator-k8s-tls + namespace: {{ .Values.namespace }} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +type: kubernetes.io/tls +data: + tls.crt: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.policyValidator.crtPEM)) (empty .Values.policyValidator.crtPEM) }} + tls.key: {{ ternary (b64enc (trim $ca.Key)) (b64enc (trim .Values.policyValidator.keyPEM)) (empty .Values.policyValidator.keyPEM) }} +--- +{{- end }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: linkerd-policy-validator-webhook-config + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +webhooks: +- name: linkerd-policy-validator.linkerd.io + namespaceSelector: + {{- toYaml .Values.policyValidator.namespaceSelector | trim | nindent 4 }} + clientConfig: + service: + name: linkerd-policy-validator + namespace: {{ .Values.namespace }} + path: "/" +{{- if and (.Values.policyValidator.externalSecret) (empty .Values.policyValidator.caBundle) }} + {{- fail "If policyValidator.externalSecret is true then you need to provide policyValidator.caBundle" }} +{{- end }} + caBundle: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.policyValidator.caBundle)) (empty .Values.policyValidator.caBundle) }} + failurePolicy: {{.Values.webhookFailurePolicy}} + admissionReviewVersions: ["v1", "v1beta1"] + rules: + - operations: ["CREATE", "UPDATE"] + apiGroups: ["policy.linkerd.io"] + apiVersions: ["v1alpha1", "v1beta1"] + resources: ["servers"] + sideEffects: None +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: linkerd-policy + labels: + app.kubernetes.io/part-of: Linkerd + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - policy.linkerd.io + resources: + - servers + - serverauthorizations + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: linkerd-destination-policy + labels: + app.kubernetes.io/part-of: Linkerd + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: linkerd-policy +subjects: + - kind: ServiceAccount + name: linkerd-destination + namespace: {{.Values.namespace}} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/destination.yaml b/charts/linkerd/linkerd2/2.11.0/templates/destination.yaml new file mode 100644 index 000000000..6ef5208de --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/destination.yaml @@ -0,0 +1,311 @@ +--- +### +### Destination Controller Service +### +kind: Service +apiVersion: v1 +metadata: + name: linkerd-dst + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + type: ClusterIP + selector: + linkerd.io/control-plane-component: destination + ports: + - name: grpc + port: 8086 + targetPort: 8086 +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-dst-headless + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + clusterIP: None + selector: + linkerd.io/control-plane-component: destination + ports: + - name: grpc + port: 8086 + targetPort: 8086 +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-sp-validator + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + type: ClusterIP + selector: + linkerd.io/control-plane-component: destination + ports: + - name: sp-validator + port: 443 + targetPort: sp-validator +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-policy + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + clusterIP: None + selector: + linkerd.io/control-plane-component: destination + ports: + - name: grpc + port: 8090 + targetPort: 8090 +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-policy-validator + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + type: ClusterIP + selector: + linkerd.io/control-plane-component: destination + ports: + - name: policy-https + port: 443 + targetPort: policy-https +{{- if .Values.enablePodAntiAffinity }} +--- +kind: PodDisruptionBudget +apiVersion: policy/v1beta1 +metadata: + name: linkerd-dst + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + maxUnavailable: 1 + selector: + matchLabels: + linkerd.io/control-plane-component: destination +{{- end }} +--- +{{- $tree := deepCopy . }} +{{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}} +{{ $_ := set $tree.Values.proxy "component" "linkerd-destination" -}} +{{ include "linkerd.proxy.validation" .Values.proxy -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + app.kubernetes.io/name: destination + app.kubernetes.io/part-of: Linkerd + app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.controllerImageVersion}} + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + name: linkerd-destination + namespace: {{.Values.namespace}} +spec: + replicas: {{.Values.controllerReplicas}} + selector: + matchLabels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + {{- include "partials.proxy.labels" $tree.Values.proxy | nindent 6}} + {{- if .Values.enablePodAntiAffinity }} + strategy: + rollingUpdate: + maxUnavailable: 1 + {{- end }} + template: + metadata: + annotations: + {{- if (or (empty .Values.cliVersion) (not (eq (.Values.stage | toString) "control-plane"))) }} + checksum/config: {{ include (print $.Template.BasePath "/destination-rbac.yaml") . | sha256sum }} + {{- end }} + {{ include "partials.annotations.created-by" . }} + {{- include "partials.proxy.annotations" . | nindent 8}} + {{- with .Values.podAnnotations }}{{ toYaml . | trim | nindent 8 }}{{- end }} + config.linkerd.io/default-inbound-policy: "all-unauthenticated" + labels: + linkerd.io/control-plane-component: destination + linkerd.io/control-plane-ns: {{.Values.namespace}} + linkerd.io/workload-ns: {{.Values.namespace}} + {{- include "partials.proxy.labels" $tree.Values.proxy | nindent 8}} + {{- with .Values.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }} + spec: + {{- if .Values.tolerations -}} + {{- include "linkerd.tolerations" . | nindent 6 }} + {{- end -}} + {{- include "linkerd.node-selector" . | nindent 6 }} + {{- if .Values.enablePodAntiAffinity -}} + {{- $local := dict "component" "destination" -}} + {{- include "linkerd.pod-affinity" $local | nindent 6 -}} + {{- end }} + containers: + {{- if not (empty .Values.destinationProxyResources) }} + {{- $r := merge .Values.destinationProxyResources .Values.proxy.resources }} + {{- $_ := set $tree.Values.proxy "resources" $r }} + {{- end }} + {{- $_ := set $tree.Values.proxy "await" true }} + {{- $_ := set $tree.Values.proxy "loadTrustBundleFromConfigMap" true }} + {{- $_ := set $tree.Values.proxy "podInboundPorts" "8086,8090,8443,9443,9990,9996,9997" }} + {{- /* + The pod needs to accept webhook traffic, and we can't rely on that originating in the + cluster network. + */}} + {{- $_ := set $tree.Values.proxy "defaultInboundPolicy" "all-unauthenticated" }} + - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + - args: + - destination + - -addr=:8086 + - -controller-namespace={{.Values.namespace}} + - -enable-h2-upgrade={{.Values.enableH2Upgrade}} + - -log-level={{.Values.controllerLogLevel}} + - -log-format={{.Values.controllerLogFormat}} + - -enable-endpoint-slices={{.Values.enableEndpointSlices}} + - -cluster-domain={{.Values.clusterDomain}} + - -identity-trust-domain={{.Values.identityTrustDomain | default .Values.clusterDomain}} + - -default-opaque-ports={{.Values.proxy.opaquePorts}} + {{- include "partials.linkerd.trace" . | nindent 8 -}} + image: {{.Values.controllerImage}}:{{default .Values.linkerdVersion .Values.controllerImageVersion}} + imagePullPolicy: {{.Values.imagePullPolicy}} + livenessProbe: + httpGet: + path: /ping + port: 9996 + initialDelaySeconds: 10 + name: destination + ports: + - containerPort: 8086 + name: grpc + - containerPort: 9996 + name: admin-http + readinessProbe: + failureThreshold: 7 + httpGet: + path: /ready + port: 9996 + {{- if .Values.destinationResources -}} + {{- include "partials.resources" .Values.destinationResources | nindent 8 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} + - args: + - sp-validator + - -log-level={{.Values.controllerLogLevel}} + - -log-format={{.Values.controllerLogFormat}} + image: {{.Values.controllerImage}}:{{.Values.controllerImageVersion | default .Values.linkerdVersion}} + imagePullPolicy: {{.Values.imagePullPolicy}} + livenessProbe: + httpGet: + path: /ping + port: 9997 + initialDelaySeconds: 10 + name: sp-validator + ports: + - containerPort: 8443 + name: sp-validator + - containerPort: 9997 + name: admin-http + readinessProbe: + failureThreshold: 7 + httpGet: + path: /ready + port: 9997 + {{- if .Values.spValidatorResources -}} + {{- include "partials.resources" .Values.spValidatorResources | nindent 8 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} + volumeMounts: + - mountPath: /var/run/linkerd/tls + name: sp-tls + readOnly: true + - args: + - --admin-addr=0.0.0.0:9990 + - --grpc-addr=0.0.0.0:8090 + - --admission-addr=0.0.0.0:9443 + - --cluster-networks={{.Values.clusterNetworks}} + - --identity-domain={{.Values.identityTrustDomain | default .Values.clusterDomain}} + - --default-policy={{.Values.policyController.defaultAllowPolicy}} + - --log-level={{.Values.policyController.logLevel | default "linkerd=info,warn"}} + - --log-format={{.Values.controllerLogFormat}} + image: {{.Values.policyController.image.name}}:{{.Values.policyController.image.version | default .Values.linkerdVersion}} + imagePullPolicy: {{.Values.policyController.image.pullPolicy | default .Values.imagePullPolicy}} + livenessProbe: + httpGet: + path: /ready + port: admin-http + initialDelaySeconds: 10 + name: policy + ports: + - containerPort: 8090 + name: grpc + - containerPort: 9990 + name: admin-http + - containerPort: 9443 + name: policy-https + readinessProbe: + failureThreshold: 7 + httpGet: + path: /ready + port: admin-http + {{- $res := .Values.policyController.resources | default .Values.destinationResources }} + {{- if $res }} + {{- include "partials.resources" $res | nindent 8 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} + volumeMounts: + - mountPath: /var/run/linkerd/tls + name: policy-tls + readOnly: true + {{ if not .Values.cniEnabled -}} + initContainers: + {{- /* + The destination controller needs to connect to the Kubernetes API before the proxy is able + to proxy requests, so we always skip these connections. + */}} + {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" "443" }} + - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + serviceAccountName: linkerd-destination + volumes: + - name: sp-tls + secret: + secretName: linkerd-sp-validator-k8s-tls + - name: policy-tls + secret: + secretName: linkerd-policy-validator-k8s-tls + {{ if not .Values.cniEnabled -}} + - {{- include "partials.proxyInit.volumes.xtables" . | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/heartbeat-rbac.yaml b/charts/linkerd/linkerd2/2.11.0/templates/heartbeat-rbac.yaml new file mode 100644 index 000000000..0126d24f4 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/heartbeat-rbac.yaml @@ -0,0 +1,73 @@ +{{ if not .Values.disableHeartBeat -}} +--- +### +### Heartbeat RBAC +### +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: linkerd-heartbeat + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["linkerd-config"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: linkerd-heartbeat + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + kind: Role + name: linkerd-heartbeat + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: linkerd-heartbeat + namespace: {{.Values.namespace}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: linkerd-heartbeat + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: [""] + resources: ["namespaces"] + verbs: ["list"] +- apiGroups: ["linkerd.io"] + resources: ["serviceprofiles"] + verbs: ["list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: linkerd-heartbeat + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + kind: ClusterRole + name: linkerd-heartbeat + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: linkerd-heartbeat + namespace: {{.Values.namespace}} +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: linkerd-heartbeat + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: heartbeat + linkerd.io/control-plane-ns: {{.Values.namespace}} +{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/heartbeat.yaml b/charts/linkerd/linkerd2/2.11.0/templates/heartbeat.yaml new file mode 100644 index 000000000..28327696b --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/heartbeat.yaml @@ -0,0 +1,63 @@ +{{ if not .Values.disableHeartBeat -}} +--- +### +### Heartbeat +### +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: linkerd-heartbeat + namespace: {{.Values.namespace}} + labels: + app.kubernetes.io/name: heartbeat + app.kubernetes.io/part-of: Linkerd + app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.controllerImageVersion}} + linkerd.io/control-plane-component: heartbeat + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + concurrencyPolicy: Replace + {{ if .Values.heartbeatSchedule -}} + schedule: "{{.Values.heartbeatSchedule}}" + {{ else -}} + schedule: "{{ dateInZone "04 15 * * *" (now | mustDateModify "+10m") "UTC"}}" + {{ end -}} + successfulJobsHistoryLimit: 0 + jobTemplate: + spec: + template: + metadata: + labels: + linkerd.io/control-plane-component: heartbeat + linkerd.io/workload-ns: {{.Values.namespace}} + {{- with .Values.podLabels }}{{ toYaml . | trim | nindent 12 }}{{- end }} + annotations: + {{ include "partials.annotations.created-by" . }} + {{- with .Values.podAnnotations }}{{ toYaml . | trim | nindent 12 }}{{- end }} + spec: + {{- if .Values.tolerations -}} + {{- include "linkerd.tolerations" . | nindent 10 }} + {{- end -}} + {{- include "linkerd.node-selector" . | nindent 10 }} + serviceAccountName: linkerd-heartbeat + restartPolicy: Never + containers: + - name: heartbeat + image: {{.Values.controllerImage}}:{{default .Values.linkerdVersion .Values.controllerImageVersion}} + imagePullPolicy: {{.Values.imagePullPolicy}} + env: + - name: LINKERD_DISABLED + value: "the heartbeat controller does not use the proxy" + args: + - "heartbeat" + - "-controller-namespace={{.Values.namespace}}" + - "-log-level={{.Values.controllerLogLevel}}" + - "-log-format={{.Values.controllerLogFormat}}" + - "-prometheus-url=http://prometheus.linkerd-viz.svc.{{.Values.clusterDomain}}:9090" + {{- if .Values.heartbeatResources -}} + {{- include "partials.resources" .Values.heartbeatResources | nindent 12 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/identity-rbac.yaml b/charts/linkerd/linkerd2/2.11.0/templates/identity-rbac.yaml new file mode 100644 index 000000000..a64b47c17 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/identity-rbac.yaml @@ -0,0 +1,49 @@ +{{if .Values.identity -}} +--- +### +### Identity Controller Service RBAC +### +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-identity + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["create"] +- apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["get"] +- apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-identity + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: linkerd-{{.Values.namespace}}-identity +subjects: +- kind: ServiceAccount + name: linkerd-identity + namespace: {{.Values.namespace}} +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: linkerd-identity + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} +{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }} +{{ end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/identity.yaml b/charts/linkerd/linkerd2/2.11.0/templates/identity.yaml new file mode 100644 index 000000000..fa1c75dbc --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/identity.yaml @@ -0,0 +1,224 @@ +{{if .Values.identity -}} +--- +### +### Identity Controller Service +### +{{ if and (.Values.identity.issuer) (eq .Values.identity.issuer.scheme "linkerd.io/tls") -}} +--- +kind: Secret +apiVersion: v1 +metadata: + name: linkerd-identity-issuer + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} + linkerd.io/identity-issuer-expiry: {{required "Please provide the identity issuer certificate expiry date" .Values.identity.issuer.crtExpiry}} +data: + crt.pem: {{b64enc (required "Please provide the identity issuer certificate" .Values.identity.issuer.tls.crtPEM | trim)}} + key.pem: {{b64enc (required "Please provide the identity issue private key" .Values.identity.issuer.tls.keyPEM | trim)}} +{{- end}} +{{ if not (.Values.identity.externalCA) -}} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: linkerd-identity-trust-roots + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +data: + ca-bundle.crt: |{{.Values.identityTrustAnchorsPEM | trim | nindent 4}} +{{- end}} +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-identity + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + type: ClusterIP + selector: + linkerd.io/control-plane-component: identity + ports: + - name: grpc + port: 8080 + targetPort: 8080 +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-identity-headless + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + clusterIP: None + selector: + linkerd.io/control-plane-component: identity + ports: + - name: grpc + port: 8080 + targetPort: 8080 +{{- if .Values.enablePodAntiAffinity }} +--- +kind: PodDisruptionBudget +apiVersion: policy/v1beta1 +metadata: + name: linkerd-identity + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + maxUnavailable: 1 + selector: + matchLabels: + linkerd.io/control-plane-component: identity +{{- end }} +--- +{{- $tree := deepCopy . }} +{{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}} +{{ $_ := set $tree.Values.proxy "component" "linkerd-identity" -}} +{{ include "linkerd.proxy.validation" .Values.proxy -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + app.kubernetes.io/name: identity + app.kubernetes.io/part-of: Linkerd + app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.controllerImageVersion}} + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + name: linkerd-identity + namespace: {{.Values.namespace}} +spec: + replicas: {{.Values.controllerReplicas}} + selector: + matchLabels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + {{- include "partials.proxy.labels" $tree.Values.proxy | nindent 6}} + {{- if .Values.enablePodAntiAffinity }} + strategy: + rollingUpdate: + maxUnavailable: 1 + {{- end }} + template: + metadata: + annotations: + {{ include "partials.annotations.created-by" . }} + {{- include "partials.proxy.annotations" . | nindent 8}} + {{- with .Values.podAnnotations }}{{ toYaml . | trim | nindent 8 }}{{- end }} + config.linkerd.io/default-inbound-policy: "all-unauthenticated" + labels: + linkerd.io/control-plane-component: identity + linkerd.io/control-plane-ns: {{.Values.namespace}} + linkerd.io/workload-ns: {{.Values.namespace}} + {{- include "partials.proxy.labels" $tree.Values.proxy | nindent 8}} + {{- with .Values.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }} + spec: + {{- if .Values.tolerations -}} + {{- include "linkerd.tolerations" . | nindent 6 }} + {{- end -}} + {{- include "linkerd.node-selector" . | nindent 6 }} + {{- if .Values.enablePodAntiAffinity -}} + {{- $local := dict "component" "identity" -}} + {{- include "linkerd.pod-affinity" $local | nindent 6 -}} + {{- end }} + containers: + - args: + - identity + - -log-level={{.Values.controllerLogLevel}} + - -log-format={{.Values.controllerLogFormat}} + - -controller-namespace={{.Values.namespace}} + - -identity-trust-domain={{.Values.identityTrustDomain | default .Values.clusterDomain}} + - -identity-issuance-lifetime={{.Values.identity.issuer.issuanceLifetime}} + - -identity-clock-skew-allowance={{.Values.identity.issuer.clockSkewAllowance}} + - -identity-scheme={{.Values.identity.issuer.scheme}} + {{- include "partials.linkerd.trace" . | nindent 8 -}} + env: + - name: LINKERD_DISABLED + value: "linkerd-await cannot block the identity controller" + image: {{.Values.controllerImage}}:{{default .Values.linkerdVersion .Values.controllerImageVersion}} + imagePullPolicy: {{.Values.imagePullPolicy}} + livenessProbe: + httpGet: + path: /ping + port: 9990 + initialDelaySeconds: 10 + name: identity + ports: + - containerPort: 8080 + name: grpc + - containerPort: 9990 + name: admin-http + readinessProbe: + failureThreshold: 7 + httpGet: + path: /ready + port: 9990 + {{- if .Values.identityResources -}} + {{- include "partials.resources" .Values.identityResources | nindent 8 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} + volumeMounts: + - mountPath: /var/run/linkerd/identity/issuer + name: identity-issuer + - mountPath: /var/run/linkerd/identity/trust-roots/ + name: trust-roots + {{- if not (empty .Values.identityProxyResources) }} + {{- $r := merge .Values.identityProxyResources .Values.proxy.resources }} + {{- $_ := set $tree.Values.proxy "resources" $r }} + {{- end }} + {{- $_ := set $tree.Values.proxy "await" false }} + {{- $_ := set $tree.Values.proxy "loadTrustBundleFromConfigMap" true }} + {{- $_ := set $tree.Values.proxy "podInboundPorts" "8080,9990" }} + {{- /* + The identity controller cannot discover policies, so we configure it with defaults that + enforce TLS on the identity service. + */}} + {{- $_ := set $tree.Values.proxy "defaultInboundPolicy" "cluster-unauthenticated" }} + {{- $_ := set $tree.Values.proxy "requireTLSOnInboundPorts" "8080" }} + - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + {{ if not .Values.cniEnabled -}} + initContainers: + {{- /* + The identity controller needs to connect to the Kubernetes API before the proxy is able to + proxy requests, so we always skip these connections. The identity controller makes no other + outbound connections (so it's not important to persist any other skip ports here) + */}} + {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" "443" }} + - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + serviceAccountName: linkerd-identity + volumes: + - name: identity-issuer + secret: + secretName: linkerd-identity-issuer + - configMap: + name: linkerd-identity-trust-roots + name: trust-roots + {{ if not .Values.cniEnabled -}} + - {{- include "partials.proxyInit.volumes.xtables" . | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }} +{{end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/namespace.yaml b/charts/linkerd/linkerd2/2.11.0/templates/namespace.yaml new file mode 100644 index 000000000..dded77782 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/namespace.yaml @@ -0,0 +1,16 @@ +{{- if (.Values.installNamespace) -}} +--- +### +### Linkerd Namespace +### +kind: Namespace +apiVersion: v1 +metadata: + name: {{ .Values.namespace }} + annotations: + linkerd.io/inject: disabled + labels: + linkerd.io/is-control-plane: "true" + config.linkerd.io/admission-webhooks: disabled + linkerd.io/control-plane-ns: {{.Values.namespace}} +{{ end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/policy-crd.yaml b/charts/linkerd/linkerd2/2.11.0/templates/policy-crd.yaml new file mode 100644 index 000000000..f18954046 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/policy-crd.yaml @@ -0,0 +1,426 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: servers.policy.linkerd.io + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +spec: + group: policy.linkerd.io + names: + kind: Server + plural: servers + singular: server + shortNames: [srv] + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + type: object + required: [spec] + properties: + spec: + type: object + required: + - podSelector + - port + properties: + podSelector: + type: object + description: >- + Selects pods in the same namespace. + oneOf: + - required: [matchExpressions] + - required: [matchLabels] + properties: + matchLabels: + type: object + x-kubernetes-preserve-unknown-fields: true + matchExpressions: + type: array + items: + type: object + required: [key, operator] + properties: + key: + type: string + operator: + type: string + enum: [In, NotIn, Exists, DoesNotExist] + values: + type: array + items: + type: string + port: + description: >- + A port name or number. Must exist in a pod spec. + x-kubernetes-int-or-string: true + proxyProtocol: + description: >- + Configures protocol discovery for inbound connections. + + Supersedes the `config.linkerd.io/opaque-ports` annotation. + type: string + default: unknown + enum: + - unknown + - HTTP/1 + - HTTP/2 + - gRPC + - opaque + - TLS + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + required: [spec] + properties: + spec: + type: object + required: + - podSelector + - port + properties: + podSelector: + type: object + description: >- + Selects pods in the same namespace. + oneOf: + - required: [matchExpressions] + - required: [matchLabels] + properties: + matchLabels: + type: object + x-kubernetes-preserve-unknown-fields: true + matchExpressions: + type: array + items: + type: object + required: [key, operator] + properties: + key: + type: string + operator: + type: string + enum: [In, NotIn, Exists, DoesNotExist] + values: + type: array + items: + type: string + port: + description: >- + A port name or number. Must exist in a pod spec. + x-kubernetes-int-or-string: true + proxyProtocol: + description: >- + Configures protocol discovery for inbound connections. + + Supersedes the `config.linkerd.io/opaque-ports` annotation. + type: string + default: unknown + enum: + - unknown + - HTTP/1 + - HTTP/2 + - gRPC + - opaque + - TLS + additionalPrinterColumns: + - name: Port + type: string + description: The port the server is listening on + jsonPath: .spec.port + - name: Protocol + type: string + description: The protocol of the server + jsonPath: .spec.proxyProtocol +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: serverauthorizations.policy.linkerd.io + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +spec: + group: policy.linkerd.io + scope: Namespaced + names: + kind: ServerAuthorization + plural: serverauthorizations + singular: serverauthorization + shortNames: [saz] + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + type: object + required: [spec] + properties: + spec: + description: >- + Authorizes clients to communicate with Linkerd-proxied servers. + type: object + required: [server, client] + properties: + server: + description: >- + Identifies servers in the same namespace for which this + authorization applies. + + Only one of `name` or `selector` may be specified. + type: object + oneOf: + - required: [name] + - required: [selector] + properties: + name: + description: References a `Server` instance by name + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + selector: + description: >- + A label query over servers on which this authorization applies. + type: object + oneOf: + - required: [matchLabels] + - required: [matchExpressions] + properties: + matchLabels: + type: object + x-kubernetes-preserve-unknown-fields: true + matchExpressions: + type: array + items: + type: object + required: [key, operator] + properties: + key: + type: string + operator: + type: string + enum: [In, NotIn, Exists, DoesNotExist] + values: + type: array + items: + type: string + client: + description: Describes clients authorized to access a server. + type: object + oneOf: + - required: [meshTLS] + - required: [unauthenticated] + properties: + networks: + description: >- + Limits the client IP addresses to which this + authorization applies. If unset, the server chooses a + default (typically, all IPs or the cluster's pod + network). + type: array + items: + type: object + required: [cidr] + properties: + cidr: + type: string + except: + type: array + items: + type: string + unauthenticated: + description: >- + Authorizes unauthenticated clients to access a server. + type: boolean + meshTLS: + type: object + oneOf: + - required: [unauthenticatedTLS] + - required: [identities] + - required: [serviceAccounts] + properties: + unauthenticatedTLS: + type: boolean + description: >- + Indicates that no client identity is required for + communication. + + This is mostly important for the identity + controller, which must terminate TLS connections + from clients that do not yet have a certificate. + identities: + description: >- + Authorizes clients with the provided proxy identity + strings (as provided via MTLS) + + The `*` prefix can be used to match all identities in + a domain. An identity string of `*` indicates that + all authentication clients are authorized. + type: array + items: + type: string + pattern: '^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$' + serviceAccounts: + description: >- + Authorizes clients with the provided proxy identity + service accounts (as provided via MTLS) + type: array + items: + type: object + required: [name] + properties: + name: + description: The ServiceAccount's name. + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + namespace: + description: >- + The ServiceAccount's namespace. If unset, the + authorization's namespace is used. + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + required: [spec] + properties: + spec: + description: >- + Authorizes clients to communicate with Linkerd-proxied servers. + type: object + required: [server, client] + properties: + server: + description: >- + Identifies servers in the same namespace for which this + authorization applies. + + Only one of `name` or `selector` may be specified. + type: object + oneOf: + - required: [name] + - required: [selector] + properties: + name: + description: References a `Server` instance by name + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + selector: + description: >- + A label query over servers on which this authorization applies. + type: object + oneOf: + - required: [matchLabels] + - required: [matchExpressions] + properties: + matchLabels: + type: object + x-kubernetes-preserve-unknown-fields: true + matchExpressions: + type: array + items: + type: object + required: [key, operator] + properties: + key: + type: string + operator: + type: string + enum: [In, NotIn, Exists, DoesNotExist] + values: + type: array + items: + type: string + client: + description: Describes clients authorized to access a server. + type: object + oneOf: + - required: [meshTLS] + - required: [unauthenticated] + properties: + networks: + description: >- + Limits the client IP addresses to which this + authorization applies. If unset, the server chooses a + default (typically, all IPs or the cluster's pod + network). + type: array + items: + type: object + required: [cidr] + properties: + cidr: + type: string + except: + type: array + items: + type: string + unauthenticated: + description: >- + Authorizes unauthenticated clients to access a server. + type: boolean + meshTLS: + type: object + oneOf: + - required: [unauthenticatedTLS] + - required: [identities] + - required: [serviceAccounts] + properties: + unauthenticatedTLS: + type: boolean + description: >- + Indicates that no client identity is required for + communication. + + This is mostly important for the identity + controller, which must terminate TLS connections + from clients that do not yet have a certificate. + identities: + description: >- + Authorizes clients with the provided proxy identity + strings (as provided via MTLS) + + The `*` prefix can be used to match all identities in + a domain. An identity string of `*` indicates that + all authentication clients are authorized. + type: array + items: + type: string + pattern: '^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$' + serviceAccounts: + description: >- + Authorizes clients with the provided proxy identity + service accounts (as provided via MTLS) + type: array + items: + type: object + required: [name] + properties: + name: + description: The ServiceAccount's name. + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + namespace: + description: >- + The ServiceAccount's namespace. If unset, the + authorization's namespace is used. + type: string + pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$' + additionalPrinterColumns: + - name: Server + type: string + description: The server that this grants access to + jsonPath: .spec.server.name diff --git a/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector-rbac.yaml b/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector-rbac.yaml new file mode 100644 index 000000000..33b5f1f30 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector-rbac.yaml @@ -0,0 +1,102 @@ +--- +### +### Proxy Injector RBAC +### +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-proxy-injector + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +- apiGroups: [""] + resources: ["namespaces", "replicationcontrollers"] + verbs: ["list", "get", "watch"] +- apiGroups: [""] + resources: ["pods"] + verbs: ["list", "watch"] +- apiGroups: ["extensions", "apps"] + resources: ["deployments", "replicasets", "daemonsets", "statefulsets"] + verbs: ["list", "get", "watch"] +- apiGroups: ["extensions", "batch"] + resources: ["cronjobs", "jobs"] + verbs: ["list", "get", "watch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: linkerd-{{.Values.namespace}}-proxy-injector + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} +subjects: +- kind: ServiceAccount + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} + apiGroup: "" +roleRef: + kind: ClusterRole + name: linkerd-{{.Values.namespace}}-proxy-injector + apiGroup: rbac.authorization.k8s.io +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} +{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }} +--- +{{- $host := printf "linkerd-proxy-injector.%s.svc" .Values.namespace }} +{{- $ca := genSelfSignedCert $host (list) (list $host) 365 }} +{{- if (not .Values.proxyInjector.externalSecret) }} +kind: Secret +apiVersion: v1 +metadata: + name: linkerd-proxy-injector-k8s-tls + namespace: {{ .Values.namespace }} + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +type: kubernetes.io/tls +data: + tls.crt: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.proxyInjector.crtPEM)) (empty .Values.proxyInjector.crtPEM) }} + tls.key: {{ ternary (b64enc (trim $ca.Key)) (b64enc (trim .Values.proxyInjector.keyPEM)) (empty .Values.proxyInjector.keyPEM) }} +--- +{{- end }} +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: linkerd-proxy-injector-webhook-config + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} +webhooks: +- name: linkerd-proxy-injector.linkerd.io + namespaceSelector: + {{- toYaml .Values.proxyInjector.namespaceSelector | trim | nindent 4 }} + clientConfig: + service: + name: linkerd-proxy-injector + namespace: {{ .Values.namespace }} + path: "/" +{{- if and (.Values.proxyInjector.externalSecret) (empty .Values.proxyInjector.caBundle) }} + {{- fail "If proxyInjector.externalSecret is true then you need to provide proxyInjector.caBundle" }} +{{- end }} + caBundle: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.proxyInjector.caBundle)) (empty .Values.proxyInjector.caBundle) }} + failurePolicy: {{.Values.webhookFailurePolicy}} + admissionReviewVersions: ["v1", "v1beta1"] + rules: + - operations: [ "CREATE" ] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods", "services"] + sideEffects: None diff --git a/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector.yaml b/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector.yaml new file mode 100644 index 000000000..cb9adaac3 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/proxy-injector.yaml @@ -0,0 +1,163 @@ +--- +### +### Proxy Injector +### +{{- $tree := deepCopy . }} +{{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}} +{{ $_ := set $tree.Values.proxy "component" "linkerd-proxy-injector" -}} +{{ include "linkerd.proxy.validation" .Values.proxy -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + app.kubernetes.io/name: proxy-injector + app.kubernetes.io/part-of: Linkerd + app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.controllerImageVersion}} + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} +spec: + replicas: {{.Values.controllerReplicas}} + selector: + matchLabels: + linkerd.io/control-plane-component: proxy-injector + {{- if .Values.enablePodAntiAffinity }} + strategy: + rollingUpdate: + maxUnavailable: 1 + {{- end }} + template: + metadata: + annotations: + {{- if (or (empty .Values.cliVersion) (not (eq (.Values.stage | toString) "control-plane"))) }} + checksum/config: {{ include (print $.Template.BasePath "/proxy-injector-rbac.yaml") . | sha256sum }} + {{- end }} + {{ include "partials.annotations.created-by" . }} + {{- include "partials.proxy.annotations" . | nindent 8}} + {{- with .Values.podAnnotations }}{{ toYaml . | trim | nindent 8 }}{{- end }} + config.linkerd.io/opaque-ports: "8443" + config.linkerd.io/default-inbound-policy: "all-unauthenticated" + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} + linkerd.io/workload-ns: {{.Values.namespace}} + {{- include "partials.proxy.labels" $tree.Values.proxy | nindent 8}} + {{- with .Values.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }} + spec: + {{- if .Values.tolerations -}} + {{- include "linkerd.tolerations" . | nindent 6 }} + {{- end -}} + {{- include "linkerd.node-selector" . | nindent 6 }} + {{- if .Values.enablePodAntiAffinity -}} + {{- $local := dict "component" "proxy-injector" "label" -}} + {{- include "linkerd.pod-affinity" $local | nindent 6 -}} + {{- end }} + containers: + {{- if not (empty .Values.proxyInjectorProxyResources) }} + {{- $r := merge .Values.proxyInjectorProxyResources .Values.proxy.resources }} + {{- $_ := set $tree.Values.proxy "resources" $r }} + {{- end }} + {{- $_ := set $tree.Values.proxy "await" true }} + {{- $_ := set $tree.Values.proxy "loadTrustBundleFromConfigMap" true }} + {{- $_ := set $tree.Values.proxy "podInboundPorts" "8443,9995" }} + {{- /* + The pod needs to accept webhook traffic, and we can't rely on that originating in the + cluster network. + */}} + {{- $_ := set $tree.Values.proxy "defaultInboundPolicy" "all-unauthenticated" }} + - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + - args: + - proxy-injector + - -log-level={{.Values.controllerLogLevel}} + - -log-format={{.Values.controllerLogFormat}} + image: {{.Values.controllerImage}}:{{default .Values.linkerdVersion .Values.controllerImageVersion}} + imagePullPolicy: {{.Values.imagePullPolicy}} + livenessProbe: + httpGet: + path: /ping + port: 9995 + initialDelaySeconds: 10 + name: proxy-injector + ports: + - containerPort: 8443 + name: proxy-injector + - containerPort: 9995 + name: admin-http + readinessProbe: + failureThreshold: 7 + httpGet: + path: /ready + port: 9995 + {{- if .Values.proxyInjectorResources -}} + {{- include "partials.resources" .Values.proxyInjectorResources | nindent 8 }} + {{- end }} + securityContext: + runAsUser: {{.Values.controllerUID}} + volumeMounts: + - mountPath: /var/run/linkerd/config + name: config + - mountPath: /var/run/linkerd/identity/trust-roots + name: trust-roots + - mountPath: /var/run/linkerd/tls + name: tls + readOnly: true + {{ if not .Values.cniEnabled -}} + initContainers: + - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + serviceAccountName: linkerd-proxy-injector + volumes: + - configMap: + name: linkerd-config + name: config + - configMap: + name: linkerd-identity-trust-roots + name: trust-roots + - name: tls + secret: + secretName: linkerd-proxy-injector-k8s-tls + {{ if not .Values.cniEnabled -}} + - {{- include "partials.proxyInit.volumes.xtables" . | indent 8 | trimPrefix (repeat 7 " ") }} + {{ end -}} + - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }} +--- +kind: Service +apiVersion: v1 +metadata: + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} + config.linkerd.io/opaque-ports: "443" +spec: + type: ClusterIP + selector: + linkerd.io/control-plane-component: proxy-injector + ports: + - name: proxy-injector + port: 443 + targetPort: proxy-injector +{{- if .Values.enablePodAntiAffinity }} +--- +kind: PodDisruptionBudget +apiVersion: policy/v1beta1 +metadata: + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-component: proxy-injector + linkerd.io/control-plane-ns: {{.Values.namespace}} + annotations: + {{ include "partials.annotations.created-by" . }} +spec: + maxUnavailable: 1 + selector: + matchLabels: + linkerd.io/control-plane-component: proxy-injector +{{- end }} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/psp.yaml b/charts/linkerd/linkerd2/2.11.0/templates/psp.yaml new file mode 100644 index 000000000..ee4fed4ca --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/psp.yaml @@ -0,0 +1,104 @@ +{{ if .Values.enablePSP -}} +--- +### +### Control Plane PSP +### +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: linkerd-{{.Values.namespace}}-control-plane + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +spec: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + {{- if empty .Values.cniEnabled }} + allowedCapabilities: + - NET_ADMIN + - NET_RAW + {{- end}} + requiredDropCapabilities: + - ALL + hostNetwork: false + hostIPC: false + hostPID: false + seLinux: + rule: RunAsAny + runAsUser: + {{- if .Values.cniEnabled }} + rule: MustRunAsNonRoot + {{- else }} + rule: RunAsAny + {{- end }} + supplementalGroups: + rule: MustRunAs + ranges: + {{- if .Values.cniEnabled }} + - min: 10001 + max: 65535 + {{- else }} + - min: 1 + max: 65535 + {{- end }} + fsGroup: + rule: MustRunAs + ranges: + {{- if .Values.cniEnabled }} + - min: 10001 + max: 65535 + {{- else }} + - min: 1 + max: 65535 + {{- end }} + volumes: + - configMap + - emptyDir + - secret + - projected + - downwardAPI + - persistentVolumeClaim +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: linkerd-psp + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +rules: +- apiGroups: ['policy', 'extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - linkerd-{{.Values.namespace}}-control-plane +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: linkerd-psp + namespace: {{.Values.namespace}} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +roleRef: + kind: Role + name: linkerd-psp + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: linkerd-destination + namespace: {{.Values.namespace}} +{{ if not .Values.disableHeartBeat -}} +- kind: ServiceAccount + name: linkerd-heartbeat + namespace: {{.Values.namespace}} +{{ end -}} +- kind: ServiceAccount + name: linkerd-identity + namespace: {{.Values.namespace}} +- kind: ServiceAccount + name: linkerd-proxy-injector + namespace: {{.Values.namespace}} +- kind: ServiceAccount + name: linkerd-sp-validator + namespace: {{.Values.namespace}} +{{ end -}} diff --git a/charts/linkerd/linkerd2/2.11.0/templates/serviceprofile-crd.yaml b/charts/linkerd/linkerd2/2.11.0/templates/serviceprofile-crd.yaml new file mode 100644 index 000000000..1b0e29a9a --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/serviceprofile-crd.yaml @@ -0,0 +1,277 @@ +--- +### +### Service Profile CRD +### +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: serviceprofiles.linkerd.io + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +spec: + group: linkerd.io + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + description: Spec is the custom resource spec + required: + - routes + properties: + dstOverrides: + type: array + required: + - authority + - weight + items: + type: object + description: WeightedDst is a weighted alternate destination. + properties: + authority: + type: string + weight: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + opaquePorts: + type: array + items: + type: string + retryBudget: + type: object + required: + - minRetriesPerSecond + - retryRatio + - ttl + description: RetryBudget describes the maximum number of retries that should be issued to this service. + properties: + minRetriesPerSecond: + format: int32 + type: integer + retryRatio: + type: number + format: float + ttl: + type: string + routes: + type: array + items: + type: object + description: RouteSpec specifies a Route resource. + required: + - condition + - name + properties: + condition: + type: object + description: RequestMatch describes the conditions under which to match a Route. + properties: + pathRegex: + type: string + method: + type: string + all: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + any: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + not: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + isRetryable: + type: boolean + name: + type: string + timeout: + type: string + responseClasses: + type: array + items: + type: object + required: + - condition + description: ResponseClass describes how to classify a response (e.g. success or failures). + properties: + condition: + type: object + description: ResponseMatch describes the conditions under + which to classify a response. + properties: + all: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + any: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + not: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + status: + type: object + description: Range describes a range of integers (e.g. status codes). + properties: + max: + format: int32 + type: integer + min: + format: int32 + type: integer + isFailure: + type: boolean + - name: v1alpha2 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + description: Spec is the custom resource spec + properties: + dstOverrides: + type: array + required: + - authority + - weight + items: + type: object + description: WeightedDst is a weighted alternate destination. + properties: + authority: + type: string + weight: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + opaquePorts: + type: array + items: + type: string + retryBudget: + type: object + required: + - minRetriesPerSecond + - retryRatio + - ttl + description: RetryBudget describes the maximum number of retries that should be issued to this service. + properties: + minRetriesPerSecond: + format: int32 + type: integer + retryRatio: + type: number + format: float + ttl: + type: string + routes: + type: array + items: + type: object + description: RouteSpec specifies a Route resource. + required: + - condition + - name + properties: + condition: + type: object + description: RequestMatch describes the conditions under which to match a Route. + properties: + pathRegex: + type: string + method: + type: string + all: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + any: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + not: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + isRetryable: + type: boolean + name: + type: string + timeout: + type: string + responseClasses: + type: array + items: + type: object + required: + - condition + description: ResponseClass describes how to classify a response (e.g. success or failures). + properties: + condition: + type: object + description: ResponseMatch describes the conditions under + which to classify a response. + properties: + all: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + any: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + not: + type: array + items: + type: object + x-kubernetes-preserve-unknown-fields: true + status: + type: object + description: Range describes a range of integers (e.g. status codes). + properties: + max: + format: int32 + type: integer + min: + format: int32 + type: integer + isFailure: + type: boolean + scope: Namespaced + preserveUnknownFields: false + names: + plural: serviceprofiles + singular: serviceprofile + kind: ServiceProfile + shortNames: + - sp diff --git a/charts/linkerd/linkerd2/2.11.0/templates/trafficsplit-crd.yaml b/charts/linkerd/linkerd2/2.11.0/templates/trafficsplit-crd.yaml new file mode 100644 index 000000000..3170ce9d3 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/templates/trafficsplit-crd.yaml @@ -0,0 +1,95 @@ +--- +### +### TrafficSplit CRD +### Copied from github.com/servicemeshinterface/smi-sdk-go/blob/d4e76b1cd7a33ead5f38d1262dd838a31c80f4e5/crds/split.yaml +### +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: trafficsplits.split.smi-spec.io + annotations: + {{ include "partials.annotations.created-by" . }} + labels: + linkerd.io/control-plane-ns: {{.Values.namespace}} +spec: + group: split.smi-spec.io + scope: Namespaced + conversion: + strategy: None + names: + kind: TrafficSplit + listKind: TrafficSplitList + shortNames: + - ts + plural: trafficsplits + singular: trafficsplit + versions: + - name: v1alpha1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + required: + - service + - backends + properties: + service: + description: The apex service of this split. + type: string + backends: + description: The backend services of this split. + type: array + items: + type: object + required: ['service', 'weight'] + properties: + service: + description: Name of the Kubernetes service. + type: string + weight: + description: Traffic weight value of this backend. + x-kubernetes-int-or-string: true + additionalPrinterColumns: + - name: Service + type: string + description: The apex service of this split. + jsonPath: .spec.service + - name: v1alpha2 + served: true + storage: false + additionalPrinterColumns: + - name: Service + type: string + description: The apex service of this split. + jsonPath: .spec.service + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + required: + - service + - backends + properties: + service: + description: The apex service of this split. + type: string + backends: + description: The backend services of this split. + type: array + items: + type: object + required: ['service', 'weight'] + properties: + service: + description: Name of the Kubernetes service. + type: string + weight: + description: Traffic weight value of this backend. + type: number + preserveUnknownFields: false diff --git a/charts/linkerd/linkerd2/2.11.0/values-ha.yaml b/charts/linkerd/linkerd2/2.11.0/values-ha.yaml new file mode 100644 index 000000000..c309faeb5 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/values-ha.yaml @@ -0,0 +1,42 @@ +# This values.yaml file contains the values needed to enable HA mode. +# Usage: +# helm install -f values.yaml -f values-ha.yaml + +enablePodAntiAffinity: true + +# proxy configuration +proxy: + resources: + cpu: + request: 100m + memory: + limit: 250Mi + request: 20Mi + +# controller configuration +controllerReplicas: 3 +controllerResources: &controller_resources + cpu: &controller_resources_cpu + limit: "" + request: 100m + memory: + limit: 250Mi + request: 50Mi +destinationResources: *controller_resources + +# identity configuration +identityResources: + cpu: *controller_resources_cpu + memory: + limit: 250Mi + request: 10Mi + +# heartbeat configuration +heartbeatResources: *controller_resources + +# proxy injector configuration +proxyInjectorResources: *controller_resources +webhookFailurePolicy: Fail + +# service profile validator configuration +spValidatorResources: *controller_resources diff --git a/charts/linkerd/linkerd2/2.11.0/values.yaml b/charts/linkerd/linkerd2/2.11.0/values.yaml new file mode 100644 index 000000000..c093aca32 --- /dev/null +++ b/charts/linkerd/linkerd2/2.11.0/values.yaml @@ -0,0 +1,370 @@ +# Default values for linkerd. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# -- Kubernetes DNS Domain name to use +clusterDomain: cluster.local + +# -- The cluster networks for which service discovery is performed. This should +# include the pod and service networks, but need not include the node network. +# +# By default, all private networks are specified so that resolution works in +# typical Kubernetes environments. +clusterNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" +# -- Docker image pull policy +imagePullPolicy: IfNotPresent +# -- Log level for the control plane components +controllerLogLevel: info +# -- Log format for the control plane components +controllerLogFormat: plain +# -- enables control plane tracing +controlPlaneTracing: false +# -- namespace to send control plane traces to +controlPlaneTracingNamespace: linkerd-jaeger +# -- control plane version. See Proxy section for proxy version +linkerdVersion: stable-2.11.0 +# -- Control plane namespace +namespace: linkerd +# -- enables the use of EndpointSlice informers for the destination service; +# enableEndpointSlices should be set to true only if EndpointSlice K8s feature +# gate is on; the feature is still experimental. +enableEndpointSlices: false +# -- enabling this omits the NET_ADMIN capability in the PSP +# and the proxy-init container when injecting the proxy; +# requires the linkerd-cni plugin to already be installed +cniEnabled: false +# -- Trust root certificate (ECDSA). It must be provided during install. +identityTrustAnchorsPEM: | +# -- Trust domain used for identity +# @default -- clusterDomain +identityTrustDomain: "" +# -- Additional annotations to add to all pods +podAnnotations: {} +# -- Additional labels to add to all pods +podLabels: {} + +# policy controller configuration +policyController: + # image -- Docker image for the policy controller + image: + # -- Docker image for the proxy + name: cr.l5d.io/linkerd/policy-controller + # -- Pull policy for the proxy container Docker image + # @default -- imagePullPolicy + pullPolicy: "" + # -- Tag for the proxy container Docker image + # @default -- linkerdVersion + version: "" + + # -- The default allow policy to use when no `Server` selects a pod. One of: "all-authenticated", + # "all-unauthenticated", "cluster-authenticated", "cluster-unauthenticated", "deny" + # @default -- "all-unauthenticated" + defaultAllowPolicy: "all-unauthenticated" + + # -- Log level for the policy controller + logLevel: linkerd=info,warn + + # -- policy controller resource requests & limits + # @default -- destinationResources + resources: + cpu: + # -- Maximum amount of CPU units that the policy controller can use + limit: "" + # -- Amount of CPU units that the policy controller requests + request: "" + memory: + # -- Maximum amount of memory that the policy controller can use + limit: "" + # -- Maximum amount of memory that the policy controller requests + request: "" + +# proxy configuration +proxy: + # -- Enable service profiles for non-Kubernetes services + enableExternalProfiles: false + # -- Maximum time allowed for the proxy to establish an outbound TCP + # connection + outboundConnectTimeout: 1000ms + # -- Maximum time allowed for the proxy to establish an inbound TCP + # connection + inboundConnectTimeout: 100ms + image: + # -- Docker image for the proxy + name: cr.l5d.io/linkerd/proxy + # -- Pull policy for the proxy container Docker image + # @default -- imagePullPolicy + pullPolicy: "" + # -- Tag for the proxy container Docker image + # @default -- linkerdVersion + version: "" + # -- Log level for the proxy + logLevel: warn,linkerd=info + # -- Log format (`plain` or `json`) for the proxy + logFormat: plain + ports: + # -- Admin port for the proxy container + admin: 4191 + # -- Control port for the proxy container + control: 4190 + # -- Inbound port for the proxy container + inbound: 4143 + # -- Outbound port for the proxy container + outbound: 4140 + # -- The `cpu.limit` and `cores` should be kept in sync. The value of `cores` + # must be an integer and should typically be set by rounding up from the + # limit. E.g. if cpu.limit is '1500m', cores should be 2. + cores: 0 + resources: + cpu: + # -- Maximum amount of CPU units that the proxy can use + limit: "" + # -- Amount of CPU units that the proxy requests + request: "" + memory: + # -- Maximum amount of memory that the proxy can use + limit: "" + # -- Maximum amount of memory that the proxy requests + request: "" + # -- User id under which the proxy runs + uid: 2102 + # -- If set the proxy sidecar will stay alive for at + # least the given period before receiving SIGTERM signal from Kubernetes but + # no longer than pod's `terminationGracePeriodSeconds`. See [Lifecycle + # hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks) + # for more info on container lifecycle hooks. + waitBeforeExitSeconds: 0 + # -- If set, the application container will not start until the proxy is + # ready + await: true + requireIdentityOnInboundPorts: "" + # -- Default set of opaque ports + # - SMTP (25,587) server-first + # - MYSQL (3306) server-first + # - Galera (4444) server-first + # - PostgreSQL (5432) server-first + # - Redis (6379) server-first + # - ElasticSearch (9300) server-first + # - Memcached (11211) clients do not issue any preamble, which breaks detection + opaquePorts: "25,587,3306,4444,5432,6379,9300,11211" + +# proxy-init configuration +proxyInit: + # -- Default set of inbound ports to skip via iptables + # - Galera (4567,4568) + ignoreInboundPorts: "4567,4568" + # -- Default set of outbound ports to skip via iptables + # - Galera (4567,4568) + ignoreOutboundPorts: "4567,4568" + image: + # -- Docker image for the proxy-init container + name: cr.l5d.io/linkerd/proxy-init + # -- Pull policy for the proxy-init container Docker image + # @default -- imagePullPolicy + pullPolicy: "" + # -- Tag for the proxy-init container Docker image + version: v1.4.0 + resources: + cpu: + # -- Maximum amount of CPU units that the proxy-init container can use + limit: 100m + # -- Amount of CPU units that the proxy-init container requests + request: 10m + memory: + # -- Maximum amount of memory that the proxy-init container can use + limit: 50Mi + # -- Amount of memory that the proxy-init container requests + request: 10Mi + closeWaitTimeoutSecs: 0 + xtMountPath: + mountPath: /run + name: linkerd-proxy-init-xtables-lock +# -- For Private docker registries, authentication is needed. +# Registry secrets are applied to the respective service accounts +imagePullSecrets: [] +# - name: my-private-docker-registry-login-secret + +# -- Allow proxies to perform transparent HTTP/2 upgrading +enableH2Upgrade: true + +# -- Add a PSP resource and bind it to the control plane ServiceAccounts. Note +# PSP has been deprecated since k8s v1.21 +enablePSP: false + +# -- Failure policy for the proxy injector +webhookFailurePolicy: Ignore + + +# controllerImage -- Docker image for the destination and identity components +controllerImage: cr.l5d.io/linkerd/controller +# -- Number of replicas for each control plane pod +controllerReplicas: 1 +# -- User ID for the control plane components +controllerUID: 2103 + + +# destination configuration +# set resources for the sp-validator and its linkerd proxy respectively +# see proxy.resources for details. +# destinationResources -- CPU and Memory resources required by destination (see `proxy.resources` for sub-fields) +#destinationResources: +#destinationProxyResources -- CPU and Memory resources required by proxy +# injected into destination pod (see `proxy.resources` for sub-fields) +#destinationProxyResources: + +# debug configuration +debugContainer: + image: + # -- Docker image for the debug container + name: cr.l5d.io/linkerd/debug + # -- Pull policy for the debug container Docker image + # @default -- imagePullPolicy + pullPolicy: "" + # -- Tag for the debug container Docker image + # @default -- linkerdVersion + version: "" + +identity: + # -- If the linkerd-identity-trust-roots ConfigMap has already been created + externalCA: false + issuer: + scheme: linkerd.io/tls + + # -- Amount of time to allow for clock skew within a Linkerd cluster + clockSkewAllowance: 20s + + # -- Expiration timestamp for the issuer certificate. It must be provided during install. Must match the expiry date in crtPEM + crtExpiry: + + # -- Amount of time for which the Identity issuer should certify identity + issuanceLifetime: 24h0m0s + + # -- Which scheme is used for the identity issuer secret format + tls: + # -- Issuer certificate (ECDSA). It must be provided during install. + crtPEM: | + + # -- Key for the issuer certificate (ECDSA). It must be provided during + # install + keyPEM: | + + +# -|- CPU and Memory resources required by the identity controller (see `proxy.resources` for sub-fields) +#identityResources: +# -|- CPU and Memory resources required by proxy injected into identity pod (see `proxy.resources` for sub-fields) +#identityProxyResources: + +# heartbeat configuration +# disableHeartBeat -- Set to true to not start the heartbeat cronjob +disableHeartBeat: false +# -- Config for the heartbeat cronjob +# heartbeatSchedule: "0 0 * * *" + +# proxy injector configuration +proxyInjector: + # -- Do not create a secret resource for the profileValidator webhook. If this is set to `true`, the value `proxyInjector.caBundle` must be set (see below) + externalSecret: false + + # -- Namespace selector used by admission webhook. If not set defaults to all + # namespaces without the annotation + # config.linkerd.io/admission-webhooks=disabled + namespaceSelector: + matchExpressions: + - key: config.linkerd.io/admission-webhooks + operator: NotIn + values: + - disabled + + # -- Certificate for the proxy injector. If not provided then Helm will generate one. + crtPEM: | + + # -- Certificate key for the proxy injector. If not provided then Helm will generate one. + keyPEM: | + + # -- Bundle of CA certificates for proxy injector. If not provided then Helm will use the certificate generated for `proxyInjector.crtPEM`. If `proxyInjector.externalSecret` is set to true, this value must be set, as no certificate will be generated. + caBundle: | + +# -|- CPU and Memory resources required by the proxy injector (see +#`proxy.resources` for sub-fields) +#proxyInjectorResources: +#-|- CPU and Memory resources required by proxy injected into the proxy injector +#pod (see `proxy.resources` for sub-fields) +#proxyInjectorProxyResources: + +# service profile validator configuration +profileValidator: + # -- Do not create a secret resource for the profileValidator webhook. If this is set to `true`, the value `profileValidator.caBundle` must be set (see below). + externalSecret: false + + # -- Namespace selector used by admission webhook + namespaceSelector: + matchExpressions: + - key: config.linkerd.io/admission-webhooks + operator: NotIn + values: + - disabled + + # -- Certificate for the service profile validator. If not provided then Helm + # will generate one. + crtPEM: | + + # -- Certificate key for the service profile validator. If not provided then + # Helm will generate one. + keyPEM: | + + # -- Bundle of CA certificates for service profile validator. If not provided + # then Helm will use the certificate generated for `profileValidator.crtPEM`. + # If `profileValidator.externalSecret` is set to true, this value must be set, + # as no certificate will be generated. + caBundle: | + +# policy validator configuration +policyValidator: + # -- Do not create a secret resource for the policyValidator webhook. If this is set to `true`, the value `policyValidator.caBundle` must be set (see below). + externalSecret: false + + # -- Namespace selector used by admission webhook + namespaceSelector: + matchExpressions: + - key: config.linkerd.io/admission-webhooks + operator: NotIn + values: + - disabled + + # -- Certificate for the policy validator. If not provided then Helm + # will generate one. + crtPEM: | + + # -- Certificate key for the policy validator. If not provided then + # Helm will generate one. + keyPEM: | + + # -- Bundle of CA certificates for policy validator. If not provided + # then Helm will use the certificate generated for `policyValidator.crtPEM`. + # If `policyValidator.externalSecret` is set to true, this value must be set, + # as no certificate will be generated. + caBundle: | + +# -|- CPU and Memory resources required by the SP validator (see +#`proxy.resources` for sub-fields) +#spValidatorResources: + +# If the namespace is controlled by an external tool or can't be installed with Helm +# you can disable its installation. In this case: +# - The namespace created by the external tool must match the namespace value above +# - The external tool needs to create the namespace with the label: +# config.linkerd.io/admission-webhooks: disabled + +# installNamespace -- Set to false when installing Linkerd in a custom namespace. See the +# [Linkerd documentation](https://linkerd.io/2/tasks/install-helm#customizing-the-namespace) for more information. +installNamespace: true + +# -- NodeSelector section, See the [K8S +# documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) +# for more information +nodeSelector: + beta.kubernetes.io/os: linux + +# -|- Tolerations section, See the +# [K8S documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) +# for more information +#tolerations: diff --git a/index.yaml b/index.yaml index 68008a848..f1c22a36c 100755 --- a/index.yaml +++ b/index.yaml @@ -1202,6 +1202,37 @@ entries: urls: - assets/kong/kong-2.3.1.tgz version: 2.3.1 + linkerd2: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Linkerd + catalog.cattle.io/release-name: linkerd + apiVersion: v1 + appVersion: stable-2.11.0 + created: "2021-09-30T17:11:34.121631235-05:00" + dependencies: + - name: partials + repository: file://../partials + version: 0.1.0 + description: | + Linkerd gives you observability, reliability, and security + for your microservices — with no code change required. + digest: 1c5f3b2c1fdaf34db6bb08fc0f9d234f35946c15d025e223519530397b225327 + home: https://linkerd.io + icon: https://linkerd.io/images/logo-only-200h.png + keywords: + - service-mesh + kubeVersion: '>=1.16.0-0' + maintainers: + - email: cncf-linkerd-dev@lists.cncf.io + name: Linkerd authors + url: https://linkerd.io/ + name: linkerd2 + sources: + - https://github.com/linkerd/linkerd2/ + urls: + - assets/linkerd/linkerd2-2.11.0.tgz + version: 2.11.0 neuvector: - annotations: catalog.cattle.io/certified: partner