Added chart versions:
btp/chronicle:
- 0.1.27
kuma/kuma:
- 2.8.4
speedscale/speedscale-operator:
- 2.2.509
pull/1071/head
github-actions[bot]
parent
1ce16f5243
commit
5a5c1d3ab4
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1 @@
|
|||
# Charts to ignore from helm-docs
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: Kuma
|
||||
catalog.cattle.io/namespace: kuma-system
|
||||
catalog.cattle.io/release-name: kuma
|
||||
apiVersion: v2
|
||||
appVersion: 2.8.4
|
||||
description: A Helm chart for the Kuma Control Plane
|
||||
home: https://github.com/kumahq/kuma
|
||||
icon: file://assets/icons/kuma.svg
|
||||
keywords:
|
||||
- service mesh
|
||||
- control plane
|
||||
maintainers:
|
||||
- email: jakub.dyszkiewicz@konghq.com
|
||||
name: Jakub Dyszkiewicz
|
||||
url: https://github.com/jakubdyszkiewicz
|
||||
- email: charly.molter@konghq.com
|
||||
name: Charly Molter
|
||||
url: https://github.com/lahabana
|
||||
- email: michael.beaumont@konghq.com
|
||||
name: Mike Beaumont
|
||||
url: https://github.com/michaelbeaumont
|
||||
name: kuma
|
||||
type: application
|
||||
version: 2.8.4
|
||||
|
|
@ -0,0 +1,256 @@
|
|||
[![][kuma-logo]][kuma-url]
|
||||
|
||||
A Helm chart for the Kuma Control Plane
|
||||
|
||||
  
|
||||
|
||||
**Homepage:** <https://github.com/kumahq/kuma>
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| global.image.registry | string | `"docker.io/kumahq"` | Default registry for all Kuma Images |
|
||||
| global.image.tag | string | `nil` | The default tag for all Kuma images, which itself defaults to .Chart.AppVersion |
|
||||
| global.imagePullSecrets | list | `[]` | Add `imagePullSecrets` to all the service accounts used for Kuma components |
|
||||
| patchSystemNamespace | bool | `true` | Whether to patch the target namespace with the system label |
|
||||
| installCrdsOnUpgrade.enabled | bool | `true` | Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma) |
|
||||
| installCrdsOnUpgrade.imagePullSecrets | list | `[]` | The `imagePullSecrets` to attach to the Service Account running CRD installation. This field will be deprecated in a future release, please use .global.imagePullSecrets |
|
||||
| noHelmHooks | bool | `false` | Whether to disable all helm hooks |
|
||||
| restartOnSecretChange | bool | `true` | Whether to restart control-plane by calculating a new checksum for the secret |
|
||||
| controlPlane.environment | string | `"kubernetes"` | Environment that control plane is run in, useful when running universal global control plane on k8s |
|
||||
| controlPlane.extraLabels | object | `{}` | Labels to add to resources in addition to default labels |
|
||||
| controlPlane.logLevel | string | `"info"` | Kuma CP log level: one of off,info,debug |
|
||||
| controlPlane.logOutputPath | string | `""` | Kuma CP log output path: Defaults to /dev/stdout |
|
||||
| controlPlane.mode | string | `"zone"` | Kuma CP modes: one of zone,global |
|
||||
| controlPlane.zone | string | `nil` | Kuma CP zone, if running multizone |
|
||||
| controlPlane.kdsGlobalAddress | string | `""` | Only used in `zone` mode |
|
||||
| controlPlane.replicas | int | `1` | Number of replicas of the Kuma CP. Ignored when autoscaling is enabled |
|
||||
| controlPlane.minReadySeconds | int | `0` | Minimum number of seconds for which a newly created pod should be ready for it to be considered available. |
|
||||
| controlPlane.deploymentAnnotations | object | `{}` | Annotations applied only to the `Deployment` resource |
|
||||
| controlPlane.podAnnotations | object | `{}` | Annotations applied only to the `Pod` resource |
|
||||
| controlPlane.autoscaling.enabled | bool | `false` | Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster |
|
||||
| controlPlane.autoscaling.minReplicas | int | `2` | The minimum CP pods to allow |
|
||||
| controlPlane.autoscaling.maxReplicas | int | `5` | The max CP pods to scale to |
|
||||
| controlPlane.autoscaling.targetCPUUtilizationPercentage | int | `80` | For clusters that don't support autoscaling/v2, autoscaling/v1 is used |
|
||||
| controlPlane.autoscaling.metrics | list | `[{"resource":{"name":"cpu","target":{"averageUtilization":80,"type":"Utilization"}},"type":"Resource"}]` | For clusters that do support autoscaling/v2, use metrics |
|
||||
| controlPlane.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for the Kuma Control Plane pods |
|
||||
| controlPlane.tolerations | list | `[]` | Tolerations for the Kuma Control Plane pods |
|
||||
| controlPlane.podDisruptionBudget.enabled | bool | `false` | Whether to create a pod disruption budget |
|
||||
| controlPlane.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
|
||||
| controlPlane.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["{{ include \"kuma.name\" . }}-control-plane"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Control Plane pods. This is rendered as a template, so you can reference other helm variables or includes. |
|
||||
| controlPlane.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Control Plane pods. This is rendered as a template, so you can use variables to generate match labels. |
|
||||
| controlPlane.injectorFailurePolicy | string | `"Fail"` | Failure policy of the mutating webhook implemented by the Kuma Injector component |
|
||||
| controlPlane.service.apiServer.http.nodePort | int | `30681` | Port on which Http api server Service is exposed on Node for service of type NodePort |
|
||||
| controlPlane.service.apiServer.https.nodePort | int | `30682` | Port on which Https api server Service is exposed on Node for service of type NodePort |
|
||||
| controlPlane.service.enabled | bool | `true` | Whether to create a service resource. |
|
||||
| controlPlane.service.name | string | `nil` | Optionally override of the Kuma Control Plane Service's name |
|
||||
| controlPlane.service.type | string | `"ClusterIP"` | Service type of the Kuma Control Plane |
|
||||
| controlPlane.service.annotations | object | `{"prometheus.io/port":"5680","prometheus.io/scrape":"true"}` | Annotations to put on the Kuma Control Plane |
|
||||
| controlPlane.ingress.enabled | bool | `false` | Install K8s Ingress resource that exposes GUI and API |
|
||||
| controlPlane.ingress.ingressClassName | string | `nil` | IngressClass defines which controller will implement the resource |
|
||||
| controlPlane.ingress.hostname | string | `nil` | Ingress hostname |
|
||||
| controlPlane.ingress.annotations | object | `{}` | Map of ingress annotations. |
|
||||
| controlPlane.ingress.path | string | `"/"` | Ingress path. |
|
||||
| controlPlane.ingress.pathType | string | `"ImplementationSpecific"` | Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix) |
|
||||
| controlPlane.ingress.servicePort | int | `5681` | Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port |
|
||||
| controlPlane.globalZoneSyncService.enabled | bool | `true` | Whether to create a k8s service for the global zone sync service. It will only be created when enabled and deploying the global control plane. |
|
||||
| controlPlane.globalZoneSyncService.type | string | `"LoadBalancer"` | Service type of the Global-zone sync |
|
||||
| controlPlane.globalZoneSyncService.loadBalancerIP | string | `nil` | Optionally specify IP to be used by cloud provider when configuring load balancer |
|
||||
| controlPlane.globalZoneSyncService.loadBalancerSourceRanges | list | `[]` | Optionally specify allowed source ranges that can access the load balancer |
|
||||
| controlPlane.globalZoneSyncService.annotations | object | `{}` | Additional annotations to put on the Global Zone Sync Service |
|
||||
| controlPlane.globalZoneSyncService.nodePort | int | `30685` | Port on which Global Zone Sync Service is exposed on Node for service of type NodePort |
|
||||
| controlPlane.globalZoneSyncService.port | int | `5685` | Port on which Global Zone Sync Service is exposed |
|
||||
| controlPlane.globalZoneSyncService.protocol | string | `"grpc"` | Protocol of the Global Zone Sync service port |
|
||||
| controlPlane.defaults.skipMeshCreation | bool | `false` | Whether to skip creating the default Mesh |
|
||||
| controlPlane.automountServiceAccountToken | bool | `true` | Whether to automountServiceAccountToken for cp. Optionally set to false |
|
||||
| controlPlane.resources | object | `{"limits":{"memory":"256Mi"},"requests":{"cpu":"500m","memory":"256Mi"}}` | Optionally override the resource spec |
|
||||
| controlPlane.lifecycle | object | `{}` | Pod lifecycle settings (useful for adding a preStop hook, when using AWS ALB or NLB) |
|
||||
| controlPlane.terminationGracePeriodSeconds | int | `30` | Number of seconds to wait before force killing the pod. Make sure to update this if you add a preStop hook. |
|
||||
| controlPlane.tls.general.secretName | string | `""` | Secret that contains tls.crt, tls.key [and ca.crt when no controlPlane.tls.general.caSecretName specified] for protecting Kuma in-cluster communication |
|
||||
| controlPlane.tls.general.caSecretName | string | `""` | Secret that contains ca.crt that was used to sign cert for protecting Kuma in-cluster communication (ca.crt present in this secret have precedence over the one provided in the controlPlane.tls.general.secretName) |
|
||||
| controlPlane.tls.general.caBundle | string | `""` | Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt) |
|
||||
| controlPlane.tls.apiServer.secretName | string | `""` | Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS |
|
||||
| controlPlane.tls.apiServer.clientCertsSecretName | string | `""` | Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS |
|
||||
| controlPlane.tls.kdsGlobalServer.secretName | string | `""` | Name of the K8s TLS Secret resource. If you set this and don't set create=true, you have to create the secret manually. |
|
||||
| controlPlane.tls.kdsGlobalServer.create | bool | `false` | Whether to create the TLS secret in helm. |
|
||||
| controlPlane.tls.kdsGlobalServer.cert | string | `""` | The TLS certificate to offer. |
|
||||
| controlPlane.tls.kdsGlobalServer.key | string | `""` | The TLS key to use. |
|
||||
| controlPlane.tls.kdsZoneClient.secretName | string | `""` | Name of the K8s Secret resource that contains ca.crt which was used to sign the certificate of KDS Global Server. If you set this and don't set create=true, you have to create the secret manually. |
|
||||
| controlPlane.tls.kdsZoneClient.create | bool | `false` | Whether to create the TLS secret in helm. |
|
||||
| controlPlane.tls.kdsZoneClient.cert | string | `""` | CA bundle that was used to sign the certificate of KDS Global Server. |
|
||||
| controlPlane.tls.kdsZoneClient.skipVerify | bool | `false` | If true, TLS cert of the server is not verified. |
|
||||
| controlPlane.serviceAccountAnnotations | object | `{}` | Annotations to add for Control Plane's Service Account |
|
||||
| controlPlane.image.pullPolicy | string | `"IfNotPresent"` | Kuma CP ImagePullPolicy |
|
||||
| controlPlane.image.repository | string | `"kuma-cp"` | Kuma CP image repository |
|
||||
| controlPlane.image.tag | string | `nil` | Kuma CP Image tag. When not specified, the value is copied from global.tag |
|
||||
| controlPlane.secrets | object with { Env: string, Secret: string, Key: string } | `nil` | Secrets to add as environment variables, where `Env` is the name of the env variable, `Secret` is the name of the Secret, and `Key` is the key of the Secret value to use |
|
||||
| controlPlane.envVars | object | `{}` | Additional environment variables that will be passed to the control plane |
|
||||
| controlPlane.extraConfigMaps | list | `[]` | Additional config maps to mount into the control plane, with optional inline values |
|
||||
| controlPlane.extraSecrets | object with { name: string, mountPath: string, readOnly: string } | `nil` | Additional secrets to mount into the control plane, where `Env` is the name of the env variable, `Secret` is the name of the Secret, and `Key` is the key of the Secret value to use |
|
||||
| controlPlane.webhooks.validator.additionalRules | string | `""` | Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma. |
|
||||
| controlPlane.webhooks.ownerReference.additionalRules | string | `""` | Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma. |
|
||||
| controlPlane.hostNetwork | bool | `false` | Specifies if the deployment should be started in hostNetwork mode. |
|
||||
| controlPlane.admissionServerPort | int | `5443` | Define a new server port for the admission controller. Recommended to set in combination with hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS). |
|
||||
| controlPlane.podSecurityContext | object | `{"runAsNonRoot":true}` | Security context at the pod level for control plane. |
|
||||
| controlPlane.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for control plane. |
|
||||
| controlPlane.supportGatewaySecretsInAllNamespaces | bool | `false` | If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace. The downside is that control plane requires permission to read Secrets in all namespaces. |
|
||||
| cni.enabled | bool | `false` | Install Kuma with CNI instead of proxy init container |
|
||||
| cni.chained | bool | `false` | Install CNI in chained mode |
|
||||
| cni.netDir | string | `"/etc/cni/multus/net.d"` | Set the CNI install directory |
|
||||
| cni.binDir | string | `"/var/lib/cni/bin"` | Set the CNI bin directory |
|
||||
| cni.confName | string | `"kuma-cni.conf"` | Set the CNI configuration name |
|
||||
| cni.logLevel | string | `"info"` | CNI log level: one of off,info,debug |
|
||||
| cni.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node Selector for the CNI pods |
|
||||
| cni.tolerations | list | `[]` | Tolerations for the CNI pods |
|
||||
| cni.podAnnotations | object | `{}` | Additional pod annotations |
|
||||
| cni.namespace | string | `"kube-system"` | Set the CNI namespace |
|
||||
| cni.image.repository | string | `"kuma-cni"` | CNI image repository |
|
||||
| cni.image.tag | string | `nil` | CNI image tag - defaults to .Chart.AppVersion |
|
||||
| cni.image.imagePullPolicy | string | `"IfNotPresent"` | CNI image pull policy |
|
||||
| cni.delayStartupSeconds | int | `0` | it's only useful in tests to trigger a possible race condition |
|
||||
| cni.experimental | object | `{"imageEbpf":{"registry":"docker.io/kumahq","repository":"merbridge","tag":"0.8.5"}}` | use new CNI (experimental) |
|
||||
| cni.experimental.imageEbpf.registry | string | `"docker.io/kumahq"` | CNI experimental eBPF image registry |
|
||||
| cni.experimental.imageEbpf.repository | string | `"merbridge"` | CNI experimental eBPF image repository |
|
||||
| cni.experimental.imageEbpf.tag | string | `"0.8.5"` | CNI experimental eBPF image tag |
|
||||
| cni.resources.requests.cpu | string | `"100m"` | |
|
||||
| cni.resources.requests.memory | string | `"100Mi"` | |
|
||||
| cni.resources.limits.memory | string | `"100Mi"` | |
|
||||
| cni.podSecurityContext | object | `{}` | Security context at the pod level for cni |
|
||||
| cni.containerSecurityContext | object | `{"readOnlyRootFilesystem":true,"runAsGroup":0,"runAsNonRoot":false,"runAsUser":0}` | Security context at the container level for cni |
|
||||
| dataPlane.dnsLogging | bool | `false` | If true, then turn on CoreDNS query logging |
|
||||
| dataPlane.image.repository | string | `"kuma-dp"` | The Kuma DP image repository |
|
||||
| dataPlane.image.pullPolicy | string | `"IfNotPresent"` | Kuma DP ImagePullPolicy |
|
||||
| dataPlane.image.tag | string | `nil` | Kuma DP Image Tag. When not specified, the value is copied from global.tag |
|
||||
| dataPlane.initImage.repository | string | `"kuma-init"` | The Kuma DP init image repository |
|
||||
| dataPlane.initImage.tag | string | `nil` | Kuma DP init image tag When not specified, the value is copied from global.tag |
|
||||
| ingress.enabled | bool | `false` | If true, it deploys Ingress for cross cluster communication |
|
||||
| ingress.extraLabels | object | `{}` | Labels to add to resources, in addition to default labels |
|
||||
| ingress.drainTime | string | `"30s"` | Time for which old listener will still be active as draining |
|
||||
| ingress.replicas | int | `1` | Number of replicas of the Ingress. Ignored when autoscaling is enabled. |
|
||||
| ingress.logLevel | string | `"info"` | Log level for ingress (available values: off|info|debug) |
|
||||
| ingress.resources | object | `{"limits":{"cpu":"1000m","memory":"512Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}` | Define the resources to allocate to mesh ingress |
|
||||
| ingress.lifecycle | object | `{}` | Pod lifecycle settings (useful for adding a preStop hook, when using AWS ALB or NLB) |
|
||||
| ingress.terminationGracePeriodSeconds | int | `40` | Number of seconds to wait before force killing the pod. Make sure to update this if you add a preStop hook. |
|
||||
| ingress.autoscaling.enabled | bool | `false` | Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster |
|
||||
| ingress.autoscaling.minReplicas | int | `2` | The minimum CP pods to allow |
|
||||
| ingress.autoscaling.maxReplicas | int | `5` | The max CP pods to scale to |
|
||||
| ingress.autoscaling.targetCPUUtilizationPercentage | int | `80` | For clusters that don't support autoscaling/v2, autoscaling/v1 is used |
|
||||
| ingress.autoscaling.metrics | list | `[{"resource":{"name":"cpu","target":{"averageUtilization":80,"type":"Utilization"}},"type":"Resource"}]` | For clusters that do support autoscaling/v2, use metrics |
|
||||
| ingress.service.enabled | bool | `true` | Whether to create a Service resource. |
|
||||
| ingress.service.type | string | `"LoadBalancer"` | Service type of the Ingress |
|
||||
| ingress.service.loadBalancerIP | string | `nil` | Optionally specify IP to be used by cloud provider when configuring load balancer |
|
||||
| ingress.service.annotations | object | `{}` | Additional annotations to put on the Ingress service |
|
||||
| ingress.service.port | int | `10001` | Port on which Ingress is exposed |
|
||||
| ingress.service.nodePort | string | `nil` | Port on which service is exposed on Node for service of type NodePort |
|
||||
| ingress.annotations | object | `{}` | Additional pod annotations (deprecated favor `podAnnotations`) |
|
||||
| ingress.podAnnotations | object | `{}` | Additional pod annotations |
|
||||
| ingress.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node Selector for the Ingress pods |
|
||||
| ingress.tolerations | list | `[]` | Tolerations for the Ingress pods |
|
||||
| ingress.podDisruptionBudget.enabled | bool | `false` | Whether to create a pod disruption budget |
|
||||
| ingress.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
|
||||
| ingress.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["kuma-ingress"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Ingress pods This is rendered as a template, so you can reference other helm variables or includes. |
|
||||
| ingress.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Mesh Ingress pods. This is rendered as a template, so you can use variables to generate match labels. |
|
||||
| ingress.podSecurityContext | object | `{"runAsGroup":5678,"runAsNonRoot":true,"runAsUser":5678}` | Security context at the pod level for ingress |
|
||||
| ingress.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for ingress |
|
||||
| ingress.serviceAccountAnnotations | object | `{}` | Annotations to add for Control Plane's Service Account |
|
||||
| ingress.automountServiceAccountToken | bool | `true` | Whether to automountServiceAccountToken for cp. Optionally set to false |
|
||||
| egress.enabled | bool | `false` | If true, it deploys Egress for cross cluster communication |
|
||||
| egress.extraLabels | object | `{}` | Labels to add to resources, in addition to the default labels. |
|
||||
| egress.drainTime | string | `"30s"` | Time for which old listener will still be active as draining |
|
||||
| egress.replicas | int | `1` | Number of replicas of the Egress. Ignored when autoscaling is enabled. |
|
||||
| egress.logLevel | string | `"info"` | Log level for egress (available values: off|info|debug) |
|
||||
| egress.autoscaling.enabled | bool | `false` | Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster |
|
||||
| egress.autoscaling.minReplicas | int | `2` | The minimum CP pods to allow |
|
||||
| egress.autoscaling.maxReplicas | int | `5` | The max CP pods to scale to |
|
||||
| egress.autoscaling.targetCPUUtilizationPercentage | int | `80` | For clusters that don't support autoscaling/v2, autoscaling/v1 is used |
|
||||
| egress.autoscaling.metrics | list | `[{"resource":{"name":"cpu","target":{"averageUtilization":80,"type":"Utilization"}},"type":"Resource"}]` | For clusters that do support autoscaling/v2, use metrics |
|
||||
| egress.resources.requests.cpu | string | `"50m"` | |
|
||||
| egress.resources.requests.memory | string | `"64Mi"` | |
|
||||
| egress.resources.limits.cpu | string | `"1000m"` | |
|
||||
| egress.resources.limits.memory | string | `"512Mi"` | |
|
||||
| egress.service.enabled | bool | `true` | Whether to create the service object |
|
||||
| egress.service.type | string | `"ClusterIP"` | Service type of the Egress |
|
||||
| egress.service.loadBalancerIP | string | `nil` | Optionally specify IP to be used by cloud provider when configuring load balancer |
|
||||
| egress.service.annotations | object | `{}` | Additional annotations to put on the Egress service |
|
||||
| egress.service.port | int | `10002` | Port on which Egress is exposed |
|
||||
| egress.service.nodePort | string | `nil` | Port on which service is exposed on Node for service of type NodePort |
|
||||
| egress.annotations | object | `{}` | Additional pod annotations (deprecated favor `podAnnotations`) |
|
||||
| egress.podAnnotations | object | `{}` | Additional pod annotations |
|
||||
| egress.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node Selector for the Egress pods |
|
||||
| egress.tolerations | list | `[]` | Tolerations for the Egress pods |
|
||||
| egress.podDisruptionBudget.enabled | bool | `false` | Whether to create a pod disruption budget |
|
||||
| egress.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
|
||||
| egress.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["kuma-egress"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Egress pods. This is rendered as a template, so you can reference other helm variables or includes. |
|
||||
| egress.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Egress pods. This is rendered as a template, so you can use variables to generate match labels. |
|
||||
| egress.podSecurityContext | object | `{"runAsGroup":5678,"runAsNonRoot":true,"runAsUser":5678}` | Security context at the pod level for egress |
|
||||
| egress.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for egress |
|
||||
| egress.serviceAccountAnnotations | object | `{}` | Annotations to add for Control Plane's Service Account |
|
||||
| egress.automountServiceAccountToken | bool | `true` | Whether to automountServiceAccountToken for cp. Optionally set to false |
|
||||
| kumactl.image.repository | string | `"kumactl"` | The kumactl image repository |
|
||||
| kumactl.image.tag | string | `nil` | The kumactl image tag. When not specified, the value is copied from global.tag |
|
||||
| kubectl.image.registry | string | `"docker.io"` | The kubectl image registry |
|
||||
| kubectl.image.repository | string | `"bitnami/kubectl"` | The kubectl image repository |
|
||||
| kubectl.image.tag | string | `"1.27.5"` | The kubectl image tag |
|
||||
| hooks.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for the HELM hooks |
|
||||
| hooks.tolerations | list | `[]` | Tolerations for the HELM hooks |
|
||||
| hooks.podSecurityContext | object | `{"runAsNonRoot":true}` | Security context at the pod level for crd/webhook/ns |
|
||||
| hooks.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for crd/webhook/ns |
|
||||
| hooks.ebpfCleanup | object | `{"containerSecurityContext":{"readOnlyRootFilesystem":false},"podSecurityContext":{"runAsNonRoot":false}}` | ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs Changing below values will potentially break ebpf cleanup completely, so be cautious when doing so. |
|
||||
| hooks.ebpfCleanup.podSecurityContext | object | `{"runAsNonRoot":false}` | Security context at the pod level for crd/webhook/cleanup-ebpf |
|
||||
| hooks.ebpfCleanup.containerSecurityContext | object | `{"readOnlyRootFilesystem":false}` | Security context at the container level for crd/webhook/cleanup-ebpf |
|
||||
| experimental.ebpf.enabled | bool | `false` | If true, ebpf will be used instead of using iptables to install/configure transparent proxy |
|
||||
| experimental.ebpf.instanceIPEnvVarName | string | `"INSTANCE_IP"` | Name of the environmental variable which will contain the IP address of a pod |
|
||||
| experimental.ebpf.bpffsPath | string | `"/sys/fs/bpf"` | Path where BPF file system should be mounted |
|
||||
| experimental.ebpf.cgroupPath | string | `"/sys/fs/cgroup"` | Host's cgroup2 path |
|
||||
| experimental.ebpf.tcAttachIface | string | `""` | Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty |
|
||||
| experimental.ebpf.programsSourcePath | string | `"/tmp/kuma-ebpf"` | Path where compiled eBPF programs which will be installed can be found |
|
||||
| experimental.deltaKds | bool | `true` | If false, it uses legacy API for resource synchronization |
|
||||
| experimental.sidecarContainers | bool | `false` | If true, enable native Kubernetes sidecars. This requires at least Kubernetes v1.29 |
|
||||
| postgres.port | string | `"5432"` | Postgres port, password should be provided as a secret reference in "controlPlane.secrets" with the Env value "KUMA_STORE_POSTGRES_PASSWORD". Example: controlPlane: secrets: - Secret: postgres-postgresql Key: postgresql-password Env: KUMA_STORE_POSTGRES_PASSWORD |
|
||||
| postgres.tls.mode | string | `"disable"` | Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull" |
|
||||
| postgres.tls.disableSSLSNI | bool | `false` | Whether to disable SNI the postgres `sslsni` option. |
|
||||
| postgres.tls.caSecretName | string | `nil` | Secret name that contains the ca.crt |
|
||||
| postgres.tls.secretName | string | `nil` | Secret name that contains the client tls.crt, tls.key |
|
||||
|
||||
## Custom Resource Definitions
|
||||
|
||||
All Kuma CRDs are loaded via the [`crds`](crds) directory. For more detailed information on CRDs and Helm,
|
||||
please refer to [the Helm documentation][helm-crd].
|
||||
|
||||
## Deleting
|
||||
|
||||
As part of [Helm's limitations][helm-crd-limitations], CRDs will not be deleted when the `kuma` chart is deleted and
|
||||
must be deleted manually. When a CRD is deleted Kubernetes deletes all resources of that kind as well, so this should
|
||||
be done carefully.
|
||||
|
||||
To do this with `kubectl` on *nix platforms, run:
|
||||
|
||||
```shell
|
||||
kubectl get crds | grep kuma.io | tr -s " " | cut -d " " -f1 | xargs kubectl delete crd
|
||||
|
||||
# or with jq
|
||||
kubectl get crds -o json | jq '.items[].metadata.name | select(.|test(".*kuma\\.io"))' | xargs kubectl delete crd
|
||||
```
|
||||
|
||||
## Autoscaling
|
||||
|
||||
In production, it is advisable to enable Control Plane autoscaling for High Availability. Autoscaling uses the
|
||||
`HorizontalPodAutoscaler` resource to add redundancy and scale the CP pods based on CPU utilization, which requires
|
||||
the [k8s metrics-server][kube-metrics-server] to be running on the cluster.
|
||||
|
||||
## Development
|
||||
|
||||
The charts are used internally in `kumactl install`, therefore the following rules apply when developing new chat features:
|
||||
* all templates that start with `pre-` and `post-` are omitted when processing in `kumactl install`
|
||||
|
||||
### Installing Metrics Server for Autoscaling
|
||||
|
||||
If running on kind, or on a cluster with a similarly self-signed cert, the metrics server must be configured to allow
|
||||
insecure kubelet TLS. The make task `kind/deploy/metrics-server` installs this patched version of the server.
|
||||
|
||||
[kuma-url]: https://kuma.io/
|
||||
[kuma-logo]: https://kuma-public-assets.s3.amazonaws.com/kuma-logo-v2.png
|
||||
[helm-crd]: https://helm.sh/docs/chart_best_practices/custom_resource_definitions/
|
||||
[helm-crd-limitations]: https://helm.sh/docs/topics/charts/#limitations-on-crds
|
||||
[kube-metrics-server]: https://github.com/kubernetes-sigs/metrics-server
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
[![][kuma-logo]][kuma-url]
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.typeBadge" . }}{{ template "chart.versionBadge" . }}{{ template "chart.appVersionBadge" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
## Custom Resource Definitions
|
||||
|
||||
All Kuma CRDs are loaded via the [`crds`](crds) directory. For more detailed information on CRDs and Helm,
|
||||
please refer to [the Helm documentation][helm-crd].
|
||||
|
||||
## Deleting
|
||||
|
||||
As part of [Helm's limitations][helm-crd-limitations], CRDs will not be deleted when the `kuma` chart is deleted and
|
||||
must be deleted manually. When a CRD is deleted Kubernetes deletes all resources of that kind as well, so this should
|
||||
be done carefully.
|
||||
|
||||
To do this with `kubectl` on *nix platforms, run:
|
||||
|
||||
```shell
|
||||
kubectl get crds | grep kuma.io | tr -s " " | cut -d " " -f1 | xargs kubectl delete crd
|
||||
|
||||
# or with jq
|
||||
kubectl get crds -o json | jq '.items[].metadata.name | select(.|test(".*kuma\\.io"))' | xargs kubectl delete crd
|
||||
```
|
||||
|
||||
## Autoscaling
|
||||
|
||||
In production, it is advisable to enable Control Plane autoscaling for High Availability. Autoscaling uses the
|
||||
`HorizontalPodAutoscaler` resource to add redundancy and scale the CP pods based on CPU utilization, which requires
|
||||
the [k8s metrics-server][kube-metrics-server] to be running on the cluster.
|
||||
|
||||
## Development
|
||||
|
||||
The charts are used internally in `kumactl install`, therefore the following rules apply when developing new chat features:
|
||||
* all templates that start with `pre-` and `post-` are omitted when processing in `kumactl install`
|
||||
|
||||
### Installing Metrics Server for Autoscaling
|
||||
|
||||
If running on kind, or on a cluster with a similarly self-signed cert, the metrics server must be configured to allow
|
||||
insecure kubelet TLS. The make task `kind/deploy/metrics-server` installs this patched version of the server.
|
||||
|
||||
|
||||
[kuma-url]: https://kuma.io/
|
||||
[kuma-logo]: https://kuma-public-assets.s3.amazonaws.com/kuma-logo-v2.png
|
||||
[helm-crd]: https://helm.sh/docs/chart_best_practices/custom_resource_definitions/
|
||||
[helm-crd-limitations]: https://helm.sh/docs/topics/charts/#limitations-on-crds
|
||||
[kube-metrics-server]: https://github.com/kubernetes-sigs/metrics-server
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: circuitbreakers.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: CircuitBreaker
|
||||
listKind: CircuitBreakerList
|
||||
plural: circuitbreakers
|
||||
singular: circuitbreaker
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma CircuitBreaker resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,114 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: containerpatches.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ContainerPatch
|
||||
listKind: ContainerPatchList
|
||||
plural: containerpatches
|
||||
singular: containerpatch
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ContainerPatch stores a list of patches to apply to init and
|
||||
sidecar containers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ContainerPatchSpec specifies the options available for a
|
||||
ContainerPatch
|
||||
properties:
|
||||
initPatch:
|
||||
description: InitPatch specifies jsonpatch to apply to an init container.
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string, used by move and
|
||||
copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value must be a string representing a valid json object used
|
||||
by replace and add operations. String has to be escaped with " to be valid a json object.
|
||||
type: string
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
sidecarPatch:
|
||||
description: SidecarPatch specifies jsonpatch to apply to a sidecar
|
||||
container.
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string, used by move and
|
||||
copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value must be a string representing a valid json object used
|
||||
by replace and add operations. String has to be escaped with " to be valid a json object.
|
||||
type: string
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: dataplaneinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: DataplaneInsight
|
||||
listKind: DataplaneInsightList
|
||||
plural: dataplaneinsights
|
||||
singular: dataplaneinsight
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
status:
|
||||
description: Status is the status the Kuma resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: dataplanes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: Dataplane
|
||||
listKind: DataplaneList
|
||||
plural: dataplanes
|
||||
singular: dataplane
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Service tag of the first inbound
|
||||
jsonPath: .spec.networking.inbound[0].tags['kuma\.io/service']
|
||||
name: kuma.io/service
|
||||
type: string
|
||||
- description: Service tag of the second inbound
|
||||
jsonPath: .spec.networking.inbound[1].tags['kuma\.io/service']
|
||||
name: kuma.io/service
|
||||
type: string
|
||||
- description: Service tag of the third inbound
|
||||
jsonPath: .spec.networking.inbound[2].tags['kuma\.io/service']
|
||||
name: kuma.io/service
|
||||
priority: 1
|
||||
type: string
|
||||
- description: Service tag of the fourth inbound
|
||||
jsonPath: .spec.networking.inbound[3].tags['kuma\.io/service']
|
||||
name: kuma.io/service
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma Dataplane resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: externalservices.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ExternalService
|
||||
listKind: ExternalServiceList
|
||||
plural: externalservices
|
||||
singular: externalservice
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ExternalService resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: faultinjections.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: FaultInjection
|
||||
listKind: FaultInjectionList
|
||||
plural: faultinjections
|
||||
singular: faultinjection
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma FaultInjection resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: healthchecks.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: HealthCheck
|
||||
listKind: HealthCheckList
|
||||
plural: healthchecks
|
||||
singular: healthcheck
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma HealthCheck resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: hostnamegenerators.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: HostnameGenerator
|
||||
listKind: HostnameGeneratorList
|
||||
plural: hostnamegenerators
|
||||
singular: hostnamegenerator
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma HostnameGenerator resource.
|
||||
properties:
|
||||
selector:
|
||||
properties:
|
||||
meshExternalService:
|
||||
properties:
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
meshService:
|
||||
properties:
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
template:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,556 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshaccesslogs.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshAccessLog
|
||||
listKind: MeshAccessLogList
|
||||
plural: meshaccesslogs
|
||||
singular: meshaccesslog
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshAccessLog resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of clients referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
backends:
|
||||
items:
|
||||
properties:
|
||||
file:
|
||||
description: FileBackend defines configuration for
|
||||
file based access logs
|
||||
properties:
|
||||
format:
|
||||
description: |-
|
||||
Format of access logs. Placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
properties:
|
||||
json:
|
||||
example:
|
||||
- key: start_time
|
||||
value: '%START_TIME%'
|
||||
- key: bytes_received
|
||||
value: '%BYTES_RECEIVED%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
omitEmptyValues:
|
||||
default: false
|
||||
type: boolean
|
||||
plain:
|
||||
example: '[%START_TIME%] %KUMA_MESH% %UPSTREAM_HOST%'
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- Plain
|
||||
- Json
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
path:
|
||||
description: Path to a file that logs will be
|
||||
written to
|
||||
example: /tmp/access.log
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
openTelemetry:
|
||||
description: Defines an OpenTelemetry logging backend.
|
||||
properties:
|
||||
attributes:
|
||||
description: |-
|
||||
Attributes can contain placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
example:
|
||||
- key: mesh
|
||||
value: '%KUMA_MESH%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
body:
|
||||
description: |-
|
||||
Body is a raw string or an OTLP any value as described at
|
||||
https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/logs/data-model.md#field-body
|
||||
It can contain placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
example:
|
||||
kvlistValue:
|
||||
values:
|
||||
- key: mesh
|
||||
value:
|
||||
stringValue: '%KUMA_MESH%'
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
endpoint:
|
||||
description: Endpoint of OpenTelemetry collector.
|
||||
An empty port defaults to 4317.
|
||||
example: otel-collector:4317
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
tcp:
|
||||
description: TCPBackend defines a TCP logging backend.
|
||||
properties:
|
||||
address:
|
||||
description: Address of the TCP logging backend
|
||||
example: 127.0.0.1:5000
|
||||
minLength: 1
|
||||
type: string
|
||||
format:
|
||||
description: |-
|
||||
Format of access logs. Placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
properties:
|
||||
json:
|
||||
example:
|
||||
- key: start_time
|
||||
value: '%START_TIME%'
|
||||
- key: bytes_received
|
||||
value: '%BYTES_RECEIVED%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
omitEmptyValues:
|
||||
default: false
|
||||
type: boolean
|
||||
plain:
|
||||
example: '[%START_TIME%] %KUMA_MESH% %UPSTREAM_HOST%'
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- Plain
|
||||
- Json
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- address
|
||||
type: object
|
||||
type:
|
||||
enum:
|
||||
- Tcp
|
||||
- File
|
||||
- OpenTelemetry
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
clients.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined in-place.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between the consumed services and
|
||||
corresponding configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
backends:
|
||||
items:
|
||||
properties:
|
||||
file:
|
||||
description: FileBackend defines configuration for
|
||||
file based access logs
|
||||
properties:
|
||||
format:
|
||||
description: |-
|
||||
Format of access logs. Placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
properties:
|
||||
json:
|
||||
example:
|
||||
- key: start_time
|
||||
value: '%START_TIME%'
|
||||
- key: bytes_received
|
||||
value: '%BYTES_RECEIVED%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
omitEmptyValues:
|
||||
default: false
|
||||
type: boolean
|
||||
plain:
|
||||
example: '[%START_TIME%] %KUMA_MESH% %UPSTREAM_HOST%'
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- Plain
|
||||
- Json
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
path:
|
||||
description: Path to a file that logs will be
|
||||
written to
|
||||
example: /tmp/access.log
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
openTelemetry:
|
||||
description: Defines an OpenTelemetry logging backend.
|
||||
properties:
|
||||
attributes:
|
||||
description: |-
|
||||
Attributes can contain placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
example:
|
||||
- key: mesh
|
||||
value: '%KUMA_MESH%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
body:
|
||||
description: |-
|
||||
Body is a raw string or an OTLP any value as described at
|
||||
https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/logs/data-model.md#field-body
|
||||
It can contain placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
example:
|
||||
kvlistValue:
|
||||
values:
|
||||
- key: mesh
|
||||
value:
|
||||
stringValue: '%KUMA_MESH%'
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
endpoint:
|
||||
description: Endpoint of OpenTelemetry collector.
|
||||
An empty port defaults to 4317.
|
||||
example: otel-collector:4317
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
tcp:
|
||||
description: TCPBackend defines a TCP logging backend.
|
||||
properties:
|
||||
address:
|
||||
description: Address of the TCP logging backend
|
||||
example: 127.0.0.1:5000
|
||||
minLength: 1
|
||||
type: string
|
||||
format:
|
||||
description: |-
|
||||
Format of access logs. Placeholders available on
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators
|
||||
properties:
|
||||
json:
|
||||
example:
|
||||
- key: start_time
|
||||
value: '%START_TIME%'
|
||||
- key: bytes_received
|
||||
value: '%BYTES_RECEIVED%'
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
omitEmptyValues:
|
||||
default: false
|
||||
type: boolean
|
||||
plain:
|
||||
example: '[%START_TIME%] %KUMA_MESH% %UPSTREAM_HOST%'
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- Plain
|
||||
- Json
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- address
|
||||
type: object
|
||||
type:
|
||||
enum:
|
||||
- Tcp
|
||||
- File
|
||||
- OpenTelemetry
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,738 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshcircuitbreakers.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshCircuitBreaker
|
||||
listKind: MeshCircuitBreakerList
|
||||
plural: meshcircuitbreakers
|
||||
singular: meshcircuitbreaker
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshCircuitBreaker
|
||||
resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations
|
||||
referenced in 'targetRef'
|
||||
properties:
|
||||
connectionLimits:
|
||||
description: |-
|
||||
ConnectionLimits contains configuration of each circuit breaking limit,
|
||||
which when exceeded makes the circuit breaker to become open (no traffic
|
||||
is allowed like no current is allowed in the circuits when physical
|
||||
circuit breaker ir open)
|
||||
properties:
|
||||
maxConnectionPools:
|
||||
description: |-
|
||||
The maximum number of connection pools per cluster that are concurrently
|
||||
supported at once. Set this for clusters which create a large number of
|
||||
connection pools.
|
||||
format: int32
|
||||
type: integer
|
||||
maxConnections:
|
||||
description: |-
|
||||
The maximum number of connections allowed to be made to the upstream
|
||||
cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
maxPendingRequests:
|
||||
description: |-
|
||||
The maximum number of pending requests that are allowed to the upstream
|
||||
cluster. This limit is applied as a connection limit for non-HTTP
|
||||
traffic.
|
||||
format: int32
|
||||
type: integer
|
||||
maxRequests:
|
||||
description: |-
|
||||
The maximum number of parallel requests that are allowed to be made
|
||||
to the upstream cluster. This limit does not apply to non-HTTP traffic.
|
||||
format: int32
|
||||
type: integer
|
||||
maxRetries:
|
||||
description: |-
|
||||
The maximum number of parallel retries that will be allowed to
|
||||
the upstream cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
outlierDetection:
|
||||
description: |-
|
||||
OutlierDetection contains the configuration of the process of dynamically
|
||||
determining whether some number of hosts in an upstream cluster are
|
||||
performing unlike the others and removing them from the healthy load
|
||||
balancing set. Performance might be along different axes such as
|
||||
consecutive failures, temporal success rate, temporal latency, etc.
|
||||
Outlier detection is a form of passive health checking.
|
||||
properties:
|
||||
baseEjectionTime:
|
||||
description: |-
|
||||
The base time that a host is ejected for. The real time is equal to
|
||||
the base time multiplied by the number of times the host has been
|
||||
ejected.
|
||||
type: string
|
||||
detectors:
|
||||
description: Contains configuration for supported outlier
|
||||
detectors
|
||||
properties:
|
||||
failurePercentage:
|
||||
description: |-
|
||||
Failure Percentage based outlier detection functions similarly to success
|
||||
rate detection, in that it relies on success rate data from each host in
|
||||
a cluster. However, rather than compare those values to the mean success
|
||||
rate of the cluster as a whole, they are compared to a flat
|
||||
user-configured threshold. This threshold is configured via the
|
||||
outlierDetection.failurePercentageThreshold field.
|
||||
The other configuration fields for failure percentage based detection are
|
||||
similar to the fields for success rate detection. As with success rate
|
||||
detection, detection will not be performed for a host if its request
|
||||
volume over the aggregation interval is less than the
|
||||
outlierDetection.detectors.failurePercentage.requestVolume value.
|
||||
Detection also will not be performed for a cluster if the number of hosts
|
||||
with the minimum required request volume in an interval is less than the
|
||||
outlierDetection.detectors.failurePercentage.minimumHosts value.
|
||||
properties:
|
||||
minimumHosts:
|
||||
description: |-
|
||||
The minimum number of hosts in a cluster in order to perform failure
|
||||
percentage-based ejection. If the total number of hosts in the cluster is
|
||||
less than this value, failure percentage-based ejection will not be
|
||||
performed.
|
||||
format: int32
|
||||
type: integer
|
||||
requestVolume:
|
||||
description: |-
|
||||
The minimum number of total requests that must be collected in one
|
||||
interval (as defined by the interval duration above) to perform failure
|
||||
percentage-based ejection for this host. If the volume is lower than this
|
||||
setting, failure percentage-based ejection will not be performed for this
|
||||
host.
|
||||
format: int32
|
||||
type: integer
|
||||
threshold:
|
||||
description: |-
|
||||
The failure percentage to use when determining failure percentage-based
|
||||
outlier detection. If the failure percentage of a given host is greater
|
||||
than or equal to this value, it will be ejected.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
gatewayFailures:
|
||||
description: |-
|
||||
In the default mode (outlierDetection.splitExternalLocalOriginErrors is
|
||||
false) this detection type takes into account a subset of 5xx errors,
|
||||
called "gateway errors" (502, 503 or 504 status code) and local origin
|
||||
failures, such as timeout, TCP reset etc.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true)
|
||||
this detection type takes into account a subset of 5xx errors, called
|
||||
"gateway errors" (502, 503 or 504 status code) and is supported only by
|
||||
the http router.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive gateway failures (502, 503, 504 status codes)
|
||||
before a consecutive gateway failure ejection occurs.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
localOriginFailures:
|
||||
description: |-
|
||||
This detection type is enabled only when
|
||||
outlierDetection.splitExternalLocalOriginErrors is true and takes into
|
||||
account only locally originated errors (timeout, reset, etc).
|
||||
If Envoy repeatedly cannot connect to an upstream host or communication
|
||||
with the upstream host is repeatedly interrupted, it will be ejected.
|
||||
Various locally originated problems are detected: timeout, TCP reset,
|
||||
ICMP errors, etc. This detection type is supported by http router and
|
||||
tcp proxy.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive locally originated failures before ejection
|
||||
occurs. Parameter takes effect only when splitExternalAndLocalErrors
|
||||
is set to true.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
successRate:
|
||||
description: |-
|
||||
Success Rate based outlier detection aggregates success rate data from
|
||||
every host in a cluster. Then at given intervals ejects hosts based on
|
||||
statistical outlier detection. Success Rate outlier detection will not be
|
||||
calculated for a host if its request volume over the aggregation interval
|
||||
is less than the outlierDetection.detectors.successRate.requestVolume
|
||||
value.
|
||||
Moreover, detection will not be performed for a cluster if the number of
|
||||
hosts with the minimum required request volume in an interval is less
|
||||
than the outlierDetection.detectors.successRate.minimumHosts value.
|
||||
In the default configuration mode
|
||||
(outlierDetection.splitExternalLocalOriginErrors is false) this detection
|
||||
type takes into account all types of errors: locally and externally
|
||||
originated.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true),
|
||||
locally originated errors and externally originated (transaction) errors
|
||||
are counted and treated separately.
|
||||
properties:
|
||||
minimumHosts:
|
||||
description: |-
|
||||
The number of hosts in a cluster that must have enough request volume to
|
||||
detect success rate outliers. If the number of hosts is less than this
|
||||
setting, outlier detection via success rate statistics is not performed
|
||||
for any host in the cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
requestVolume:
|
||||
description: |-
|
||||
The minimum number of total requests that must be collected in one
|
||||
interval (as defined by the interval duration configured in
|
||||
outlierDetection section) to include this host in success rate based
|
||||
outlier detection. If the volume is lower than this setting, outlier
|
||||
detection via success rate statistics is not performed for that host.
|
||||
format: int32
|
||||
type: integer
|
||||
standardDeviationFactor:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
This factor is used to determine the ejection threshold for success rate
|
||||
outlier ejection. The ejection threshold is the difference between
|
||||
the mean success rate, and the product of this factor and the standard
|
||||
deviation of the mean success rate: mean - (standard_deviation *
|
||||
success_rate_standard_deviation_factor).
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
totalFailures:
|
||||
description: |-
|
||||
In the default mode (outlierDetection.splitExternalAndLocalErrors is
|
||||
false) this detection type takes into account all generated errors:
|
||||
locally originated and externally originated (transaction) errors.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true)
|
||||
this detection type takes into account only externally originated
|
||||
(transaction) errors, ignoring locally originated errors.
|
||||
If an upstream host is an HTTP-server, only 5xx types of error are taken
|
||||
into account (see Consecutive Gateway Failure for exceptions).
|
||||
Properly formatted responses, even when they carry an operational error
|
||||
(like index not found, access denied) are not taken into account.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive server-side error responses (for HTTP traffic,
|
||||
5xx responses; for TCP traffic, connection failures; for Redis, failure
|
||||
to respond PONG; etc.) before a consecutive total failure ejection
|
||||
occurs.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
disabled:
|
||||
description: When set to true, outlierDetection configuration
|
||||
won't take any effect
|
||||
type: boolean
|
||||
interval:
|
||||
description: |-
|
||||
The time interval between ejection analysis sweeps. This can result in
|
||||
both new ejections and hosts being returned to service.
|
||||
type: string
|
||||
maxEjectionPercent:
|
||||
description: |-
|
||||
The maximum % of an upstream cluster that can be ejected due to outlier
|
||||
detection. Defaults to 10% but will eject at least one host regardless of
|
||||
the value.
|
||||
format: int32
|
||||
type: integer
|
||||
splitExternalAndLocalErrors:
|
||||
description: |-
|
||||
Determines whether to distinguish local origin failures from external
|
||||
errors. If set to true the following configuration parameters are taken
|
||||
into account: detectors.localOriginFailures.consecutive
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined in place.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: |-
|
||||
To list makes a match between the consumed services and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations
|
||||
referenced in 'targetRef'
|
||||
properties:
|
||||
connectionLimits:
|
||||
description: |-
|
||||
ConnectionLimits contains configuration of each circuit breaking limit,
|
||||
which when exceeded makes the circuit breaker to become open (no traffic
|
||||
is allowed like no current is allowed in the circuits when physical
|
||||
circuit breaker ir open)
|
||||
properties:
|
||||
maxConnectionPools:
|
||||
description: |-
|
||||
The maximum number of connection pools per cluster that are concurrently
|
||||
supported at once. Set this for clusters which create a large number of
|
||||
connection pools.
|
||||
format: int32
|
||||
type: integer
|
||||
maxConnections:
|
||||
description: |-
|
||||
The maximum number of connections allowed to be made to the upstream
|
||||
cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
maxPendingRequests:
|
||||
description: |-
|
||||
The maximum number of pending requests that are allowed to the upstream
|
||||
cluster. This limit is applied as a connection limit for non-HTTP
|
||||
traffic.
|
||||
format: int32
|
||||
type: integer
|
||||
maxRequests:
|
||||
description: |-
|
||||
The maximum number of parallel requests that are allowed to be made
|
||||
to the upstream cluster. This limit does not apply to non-HTTP traffic.
|
||||
format: int32
|
||||
type: integer
|
||||
maxRetries:
|
||||
description: |-
|
||||
The maximum number of parallel retries that will be allowed to
|
||||
the upstream cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
outlierDetection:
|
||||
description: |-
|
||||
OutlierDetection contains the configuration of the process of dynamically
|
||||
determining whether some number of hosts in an upstream cluster are
|
||||
performing unlike the others and removing them from the healthy load
|
||||
balancing set. Performance might be along different axes such as
|
||||
consecutive failures, temporal success rate, temporal latency, etc.
|
||||
Outlier detection is a form of passive health checking.
|
||||
properties:
|
||||
baseEjectionTime:
|
||||
description: |-
|
||||
The base time that a host is ejected for. The real time is equal to
|
||||
the base time multiplied by the number of times the host has been
|
||||
ejected.
|
||||
type: string
|
||||
detectors:
|
||||
description: Contains configuration for supported outlier
|
||||
detectors
|
||||
properties:
|
||||
failurePercentage:
|
||||
description: |-
|
||||
Failure Percentage based outlier detection functions similarly to success
|
||||
rate detection, in that it relies on success rate data from each host in
|
||||
a cluster. However, rather than compare those values to the mean success
|
||||
rate of the cluster as a whole, they are compared to a flat
|
||||
user-configured threshold. This threshold is configured via the
|
||||
outlierDetection.failurePercentageThreshold field.
|
||||
The other configuration fields for failure percentage based detection are
|
||||
similar to the fields for success rate detection. As with success rate
|
||||
detection, detection will not be performed for a host if its request
|
||||
volume over the aggregation interval is less than the
|
||||
outlierDetection.detectors.failurePercentage.requestVolume value.
|
||||
Detection also will not be performed for a cluster if the number of hosts
|
||||
with the minimum required request volume in an interval is less than the
|
||||
outlierDetection.detectors.failurePercentage.minimumHosts value.
|
||||
properties:
|
||||
minimumHosts:
|
||||
description: |-
|
||||
The minimum number of hosts in a cluster in order to perform failure
|
||||
percentage-based ejection. If the total number of hosts in the cluster is
|
||||
less than this value, failure percentage-based ejection will not be
|
||||
performed.
|
||||
format: int32
|
||||
type: integer
|
||||
requestVolume:
|
||||
description: |-
|
||||
The minimum number of total requests that must be collected in one
|
||||
interval (as defined by the interval duration above) to perform failure
|
||||
percentage-based ejection for this host. If the volume is lower than this
|
||||
setting, failure percentage-based ejection will not be performed for this
|
||||
host.
|
||||
format: int32
|
||||
type: integer
|
||||
threshold:
|
||||
description: |-
|
||||
The failure percentage to use when determining failure percentage-based
|
||||
outlier detection. If the failure percentage of a given host is greater
|
||||
than or equal to this value, it will be ejected.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
gatewayFailures:
|
||||
description: |-
|
||||
In the default mode (outlierDetection.splitExternalLocalOriginErrors is
|
||||
false) this detection type takes into account a subset of 5xx errors,
|
||||
called "gateway errors" (502, 503 or 504 status code) and local origin
|
||||
failures, such as timeout, TCP reset etc.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true)
|
||||
this detection type takes into account a subset of 5xx errors, called
|
||||
"gateway errors" (502, 503 or 504 status code) and is supported only by
|
||||
the http router.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive gateway failures (502, 503, 504 status codes)
|
||||
before a consecutive gateway failure ejection occurs.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
localOriginFailures:
|
||||
description: |-
|
||||
This detection type is enabled only when
|
||||
outlierDetection.splitExternalLocalOriginErrors is true and takes into
|
||||
account only locally originated errors (timeout, reset, etc).
|
||||
If Envoy repeatedly cannot connect to an upstream host or communication
|
||||
with the upstream host is repeatedly interrupted, it will be ejected.
|
||||
Various locally originated problems are detected: timeout, TCP reset,
|
||||
ICMP errors, etc. This detection type is supported by http router and
|
||||
tcp proxy.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive locally originated failures before ejection
|
||||
occurs. Parameter takes effect only when splitExternalAndLocalErrors
|
||||
is set to true.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
successRate:
|
||||
description: |-
|
||||
Success Rate based outlier detection aggregates success rate data from
|
||||
every host in a cluster. Then at given intervals ejects hosts based on
|
||||
statistical outlier detection. Success Rate outlier detection will not be
|
||||
calculated for a host if its request volume over the aggregation interval
|
||||
is less than the outlierDetection.detectors.successRate.requestVolume
|
||||
value.
|
||||
Moreover, detection will not be performed for a cluster if the number of
|
||||
hosts with the minimum required request volume in an interval is less
|
||||
than the outlierDetection.detectors.successRate.minimumHosts value.
|
||||
In the default configuration mode
|
||||
(outlierDetection.splitExternalLocalOriginErrors is false) this detection
|
||||
type takes into account all types of errors: locally and externally
|
||||
originated.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true),
|
||||
locally originated errors and externally originated (transaction) errors
|
||||
are counted and treated separately.
|
||||
properties:
|
||||
minimumHosts:
|
||||
description: |-
|
||||
The number of hosts in a cluster that must have enough request volume to
|
||||
detect success rate outliers. If the number of hosts is less than this
|
||||
setting, outlier detection via success rate statistics is not performed
|
||||
for any host in the cluster.
|
||||
format: int32
|
||||
type: integer
|
||||
requestVolume:
|
||||
description: |-
|
||||
The minimum number of total requests that must be collected in one
|
||||
interval (as defined by the interval duration configured in
|
||||
outlierDetection section) to include this host in success rate based
|
||||
outlier detection. If the volume is lower than this setting, outlier
|
||||
detection via success rate statistics is not performed for that host.
|
||||
format: int32
|
||||
type: integer
|
||||
standardDeviationFactor:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
This factor is used to determine the ejection threshold for success rate
|
||||
outlier ejection. The ejection threshold is the difference between
|
||||
the mean success rate, and the product of this factor and the standard
|
||||
deviation of the mean success rate: mean - (standard_deviation *
|
||||
success_rate_standard_deviation_factor).
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
totalFailures:
|
||||
description: |-
|
||||
In the default mode (outlierDetection.splitExternalAndLocalErrors is
|
||||
false) this detection type takes into account all generated errors:
|
||||
locally originated and externally originated (transaction) errors.
|
||||
In split mode (outlierDetection.splitExternalLocalOriginErrors is true)
|
||||
this detection type takes into account only externally originated
|
||||
(transaction) errors, ignoring locally originated errors.
|
||||
If an upstream host is an HTTP-server, only 5xx types of error are taken
|
||||
into account (see Consecutive Gateway Failure for exceptions).
|
||||
Properly formatted responses, even when they carry an operational error
|
||||
(like index not found, access denied) are not taken into account.
|
||||
properties:
|
||||
consecutive:
|
||||
description: |-
|
||||
The number of consecutive server-side error responses (for HTTP traffic,
|
||||
5xx responses; for TCP traffic, connection failures; for Redis, failure
|
||||
to respond PONG; etc.) before a consecutive total failure ejection
|
||||
occurs.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
disabled:
|
||||
description: When set to true, outlierDetection configuration
|
||||
won't take any effect
|
||||
type: boolean
|
||||
interval:
|
||||
description: |-
|
||||
The time interval between ejection analysis sweeps. This can result in
|
||||
both new ejections and hosts being returned to service.
|
||||
type: string
|
||||
maxEjectionPercent:
|
||||
description: |-
|
||||
The maximum % of an upstream cluster that can be ejected due to outlier
|
||||
detection. Defaults to 10% but will eject at least one host regardless of
|
||||
the value.
|
||||
format: int32
|
||||
type: integer
|
||||
splitExternalAndLocalErrors:
|
||||
description: |-
|
||||
Determines whether to distinguish local origin failures from external
|
||||
errors. If set to true the following configuration parameters are taken
|
||||
into account: detectors.localOriginFailures.consecutive
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: Mesh
|
||||
listKind: MeshList
|
||||
plural: meshes
|
||||
singular: mesh
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma Mesh resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,333 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshexternalservices.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshExternalService
|
||||
listKind: MeshExternalServiceList
|
||||
plural: meshexternalservices
|
||||
singular: meshexternalservice
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshExternalService
|
||||
resource.
|
||||
properties:
|
||||
endpoints:
|
||||
description: Endpoints defines a list of destinations to send traffic
|
||||
to.
|
||||
items:
|
||||
properties:
|
||||
address:
|
||||
description: Address defines an address to which a user want
|
||||
to send a request. Is possible to provide `domain`, `ip` and
|
||||
`unix` sockets.
|
||||
example: unix:///tmp/example.sock
|
||||
minLength: 1
|
||||
type: string
|
||||
port:
|
||||
description: Port of the endpoint
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
required:
|
||||
- address
|
||||
type: object
|
||||
type: array
|
||||
extension:
|
||||
description: Extension struct for a plugin configuration, in the presence
|
||||
of an extension `endpoints` and `tls` are not required anymore -
|
||||
it's up to the extension to validate them independently.
|
||||
properties:
|
||||
config:
|
||||
description: Config freeform configuration for the extension.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type:
|
||||
description: Type of the extension.
|
||||
type: string
|
||||
required:
|
||||
- config
|
||||
- type
|
||||
type: object
|
||||
match:
|
||||
description: Match defines traffic that should be routed through the
|
||||
sidecar.
|
||||
properties:
|
||||
port:
|
||||
description: Port defines a port to which a user does request.
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
protocol:
|
||||
default: tcp
|
||||
description: 'Protocol defines a protocol of the communication.
|
||||
Possible values: `tcp`, `grpc`, `http`, `http2`.'
|
||||
enum:
|
||||
- tcp
|
||||
- grpc
|
||||
- http
|
||||
- http2
|
||||
type: string
|
||||
type:
|
||||
default: HostnameGenerator
|
||||
description: Type of the match, only `HostnameGenerator` is available
|
||||
at the moment.
|
||||
enum:
|
||||
- HostnameGenerator
|
||||
type: string
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
tls:
|
||||
description: Tls provides a TLS configuration when proxy is resposible
|
||||
for a TLS origination
|
||||
properties:
|
||||
allowRenegotiation:
|
||||
default: false
|
||||
description: |-
|
||||
AllowRenegotiation defines if TLS sessions will allow renegotiation.
|
||||
Setting this to true is not recommended for security reasons.
|
||||
type: boolean
|
||||
enabled:
|
||||
default: false
|
||||
description: Enabled defines if proxy should originate TLS.
|
||||
type: boolean
|
||||
verification:
|
||||
description: Verification section for providing TLS verification
|
||||
details.
|
||||
properties:
|
||||
caCert:
|
||||
description: CaCert defines a certificate of CA.
|
||||
properties:
|
||||
inline:
|
||||
description: Data source is inline bytes.
|
||||
format: byte
|
||||
type: string
|
||||
inlineString:
|
||||
description: Data source is inline string`
|
||||
type: string
|
||||
secret:
|
||||
description: Data source is a secret with given Secret
|
||||
key.
|
||||
type: string
|
||||
type: object
|
||||
clientCert:
|
||||
description: ClientCert defines a certificate of a client.
|
||||
properties:
|
||||
inline:
|
||||
description: Data source is inline bytes.
|
||||
format: byte
|
||||
type: string
|
||||
inlineString:
|
||||
description: Data source is inline string`
|
||||
type: string
|
||||
secret:
|
||||
description: Data source is a secret with given Secret
|
||||
key.
|
||||
type: string
|
||||
type: object
|
||||
clientKey:
|
||||
description: ClientKey defines a client private key.
|
||||
properties:
|
||||
inline:
|
||||
description: Data source is inline bytes.
|
||||
format: byte
|
||||
type: string
|
||||
inlineString:
|
||||
description: Data source is inline string`
|
||||
type: string
|
||||
secret:
|
||||
description: Data source is a secret with given Secret
|
||||
key.
|
||||
type: string
|
||||
type: object
|
||||
mode:
|
||||
default: Secured
|
||||
description: Mode defines if proxy should skip verification,
|
||||
one of `SkipSAN`, `SkipCA`, `Secured`, `SkipAll`. Default
|
||||
`Secured`.
|
||||
enum:
|
||||
- SkipSAN
|
||||
- SkipCA
|
||||
- Secured
|
||||
- SkipAll
|
||||
type: string
|
||||
serverName:
|
||||
description: ServerName overrides the default Server Name
|
||||
Indicator set by Kuma.
|
||||
type: string
|
||||
subjectAltNames:
|
||||
description: SubjectAltNames list of names to verify in the
|
||||
certificate.
|
||||
items:
|
||||
properties:
|
||||
type:
|
||||
default: Exact
|
||||
description: 'Type specifies matching type, one of `Exact`,
|
||||
`Prefix`. Default: `Exact`'
|
||||
enum:
|
||||
- Exact
|
||||
- Prefix
|
||||
type: string
|
||||
value:
|
||||
description: Value to match.
|
||||
type: string
|
||||
required:
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
version:
|
||||
description: Version section for providing version specification.
|
||||
properties:
|
||||
max:
|
||||
default: TLSAuto
|
||||
description: Max defines maximum supported version. One of
|
||||
`TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
|
||||
enum:
|
||||
- TLSAuto
|
||||
- TLS10
|
||||
- TLS11
|
||||
- TLS12
|
||||
- TLS13
|
||||
type: string
|
||||
min:
|
||||
default: TLSAuto
|
||||
description: Min defines minimum supported version. One of
|
||||
`TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
|
||||
enum:
|
||||
- TLSAuto
|
||||
- TLS10
|
||||
- TLS11
|
||||
- TLS12
|
||||
- TLS13
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
status:
|
||||
description: Status is the current status of the Kuma MeshExternalService
|
||||
resource.
|
||||
properties:
|
||||
addresses:
|
||||
description: Addresses section for generated domains
|
||||
items:
|
||||
properties:
|
||||
hostname:
|
||||
type: string
|
||||
hostnameGeneratorRef:
|
||||
properties:
|
||||
coreName:
|
||||
type: string
|
||||
required:
|
||||
- coreName
|
||||
type: object
|
||||
origin:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
hostnameGenerators:
|
||||
items:
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions is an array of hostname generator conditions.
|
||||
items:
|
||||
properties:
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
hostnameGeneratorRef:
|
||||
properties:
|
||||
coreName:
|
||||
type: string
|
||||
required:
|
||||
- coreName
|
||||
type: object
|
||||
required:
|
||||
- hostnameGeneratorRef
|
||||
type: object
|
||||
type: array
|
||||
vip:
|
||||
description: Vip section for allocated IP
|
||||
properties:
|
||||
ip:
|
||||
description: Value allocated IP for a provided domain with `HostnameGenerator`
|
||||
type in a match section.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,419 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshfaultinjections.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshFaultInjection
|
||||
listKind: MeshFaultInjectionList
|
||||
plural: meshfaultinjections
|
||||
singular: meshfaultinjection
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshFaultInjection
|
||||
resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
http:
|
||||
description: Http allows to define list of Http faults between
|
||||
dataplanes.
|
||||
items:
|
||||
description: FaultInjection defines the configuration
|
||||
of faults between dataplanes.
|
||||
properties:
|
||||
abort:
|
||||
description: |-
|
||||
Abort defines a configuration of not delivering requests to destination
|
||||
service and replacing the responses from destination dataplane by
|
||||
predefined status code
|
||||
properties:
|
||||
httpStatus:
|
||||
description: HTTP status code which will be returned
|
||||
to source side
|
||||
format: int32
|
||||
type: integer
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which abort will be injected, has to be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- httpStatus
|
||||
- percentage
|
||||
type: object
|
||||
delay:
|
||||
description: Delay defines configuration of delaying
|
||||
a response from a destination
|
||||
properties:
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which delay will be injected, has to be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
value:
|
||||
description: The duration during which the response
|
||||
will be delayed
|
||||
type: string
|
||||
required:
|
||||
- percentage
|
||||
- value
|
||||
type: object
|
||||
responseBandwidth:
|
||||
description: |-
|
||||
ResponseBandwidth defines a configuration to limit the speed of
|
||||
responding to the requests
|
||||
properties:
|
||||
limit:
|
||||
description: |-
|
||||
Limit is represented by value measure in Gbps, Mbps, kbps, e.g.
|
||||
10kbps
|
||||
type: string
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which response bandwidth limit will be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- limit
|
||||
- percentage
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
http:
|
||||
description: Http allows to define list of Http faults between
|
||||
dataplanes.
|
||||
items:
|
||||
description: FaultInjection defines the configuration
|
||||
of faults between dataplanes.
|
||||
properties:
|
||||
abort:
|
||||
description: |-
|
||||
Abort defines a configuration of not delivering requests to destination
|
||||
service and replacing the responses from destination dataplane by
|
||||
predefined status code
|
||||
properties:
|
||||
httpStatus:
|
||||
description: HTTP status code which will be returned
|
||||
to source side
|
||||
format: int32
|
||||
type: integer
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which abort will be injected, has to be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- httpStatus
|
||||
- percentage
|
||||
type: object
|
||||
delay:
|
||||
description: Delay defines configuration of delaying
|
||||
a response from a destination
|
||||
properties:
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which delay will be injected, has to be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
value:
|
||||
description: The duration during which the response
|
||||
will be delayed
|
||||
type: string
|
||||
required:
|
||||
- percentage
|
||||
- value
|
||||
type: object
|
||||
responseBandwidth:
|
||||
description: |-
|
||||
ResponseBandwidth defines a configuration to limit the speed of
|
||||
responding to the requests
|
||||
properties:
|
||||
limit:
|
||||
description: |-
|
||||
Limit is represented by value measure in Gbps, Mbps, kbps, e.g.
|
||||
10kbps
|
||||
type: string
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests on which response bandwidth limit will be
|
||||
either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- limit
|
||||
- percentage
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,364 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshgatewayinstances.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshGatewayInstance
|
||||
listKind: MeshGatewayInstanceList
|
||||
plural: meshgatewayinstances
|
||||
singular: meshgatewayinstance
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
MeshGatewayInstance represents a managed instance of a dataplane proxy for a Kuma
|
||||
Gateway.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: MeshGatewayInstanceSpec specifies the options available for
|
||||
a GatewayDataplane.
|
||||
properties:
|
||||
podTemplate:
|
||||
description: PodTemplate configures the Pod owned by this config.
|
||||
properties:
|
||||
metadata:
|
||||
description: Metadata holds metadata configuration for a Service.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Annotations holds annotations to be set on an
|
||||
object.
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels holds labels to be set on an objects.
|
||||
type: object
|
||||
type: object
|
||||
spec:
|
||||
description: Spec holds some customizable fields of a Pod.
|
||||
properties:
|
||||
container:
|
||||
description: Container corresponds to PodSpec.Container
|
||||
properties:
|
||||
securityContext:
|
||||
description: ContainerSecurityContext corresponds to PodSpec.Container.SecurityContext
|
||||
properties:
|
||||
readOnlyRootFilesystem:
|
||||
description: ReadOnlyRootFilesystem corresponds to
|
||||
PodSpec.Container.SecurityContext.ReadOnlyRootFilesystem
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
securityContext:
|
||||
description: PodSecurityContext corresponds to PodSpec.SecurityContext
|
||||
properties:
|
||||
fsGroup:
|
||||
description: FSGroup corresponds to PodSpec.SecurityContext.FSGroup
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
serviceAccountName:
|
||||
description: ServiceAccountName corresponds to PodSpec.ServiceAccountName.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
replicas:
|
||||
default: 1
|
||||
description: |-
|
||||
Replicas is the number of dataplane proxy replicas to create. For
|
||||
now this is a fixed number, but in the future it could be
|
||||
automatically scaled based on metrics.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
resources:
|
||||
description: |-
|
||||
Resources specifies the compute resources for the proxy container.
|
||||
The default can be set in the control plane config.
|
||||
properties:
|
||||
claims:
|
||||
description: |-
|
||||
Claims lists the names of resources, defined in spec.resourceClaims,
|
||||
that are used by this container.
|
||||
|
||||
|
||||
This is an alpha field and requires enabling the
|
||||
DynamicResourceAllocation feature gate.
|
||||
|
||||
|
||||
This field is immutable. It can only be set for containers.
|
||||
items:
|
||||
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name must match the name of one entry in pod.spec.resourceClaims of
|
||||
the Pod where this field is used. It makes that resource available
|
||||
inside a container.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
limits:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: |-
|
||||
Limits describes the maximum amount of compute resources allowed.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
type: object
|
||||
requests:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: |-
|
||||
Requests describes the minimum amount of compute resources required.
|
||||
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
|
||||
otherwise to an implementation-defined value. Requests cannot exceed Limits.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
type: object
|
||||
type: object
|
||||
serviceTemplate:
|
||||
description: ServiceTemplate configures the Service owned by this
|
||||
config.
|
||||
properties:
|
||||
metadata:
|
||||
description: Metadata holds metadata configuration for a Service.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Annotations holds annotations to be set on an
|
||||
object.
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels holds labels to be set on an objects.
|
||||
type: object
|
||||
type: object
|
||||
spec:
|
||||
description: Spec holds some customizable fields of a Service.
|
||||
properties:
|
||||
loadBalancerIP:
|
||||
description: LoadBalancerIP corresponds to ServiceSpec.LoadBalancerIP.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
serviceType:
|
||||
default: LoadBalancer
|
||||
description: |-
|
||||
ServiceType specifies the type of managed Service that will be
|
||||
created to expose the dataplane proxies to traffic from outside
|
||||
the cluster. The ports to expose will be taken from the matching Gateway
|
||||
resource. If there is no matching Gateway, the managed Service will
|
||||
be deleted.
|
||||
enum:
|
||||
- LoadBalancer
|
||||
- ClusterIP
|
||||
- NodePort
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags specifies the Kuma tags that are propagated to the managed
|
||||
dataplane proxies. These tags should include exactly one
|
||||
`kuma.io/service` tag, and should match exactly one Gateway
|
||||
resource.
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: |-
|
||||
MeshGatewayInstanceStatus holds information about the status of the gateway
|
||||
instance.
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions is an array of gateway instance conditions.
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
loadBalancer:
|
||||
description: |-
|
||||
LoadBalancer contains the current status of the load-balancer,
|
||||
if one is present.
|
||||
properties:
|
||||
ingress:
|
||||
description: |-
|
||||
Ingress is a list containing ingress points for the load-balancer.
|
||||
Traffic intended for the service should be sent to these ingress points.
|
||||
items:
|
||||
description: |-
|
||||
LoadBalancerIngress represents the status of a load-balancer ingress point:
|
||||
traffic intended for the service should be sent to an ingress point.
|
||||
properties:
|
||||
hostname:
|
||||
description: |-
|
||||
Hostname is set for load-balancer ingress points that are DNS based
|
||||
(typically AWS load-balancers)
|
||||
type: string
|
||||
ip:
|
||||
description: |-
|
||||
IP is set for load-balancer ingress points that are IP based
|
||||
(typically GCE or OpenStack load-balancers)
|
||||
type: string
|
||||
ipMode:
|
||||
description: |-
|
||||
IPMode specifies how the load-balancer IP behaves, and may only be specified when the ip field is specified.
|
||||
Setting this to "VIP" indicates that traffic is delivered to the node with
|
||||
the destination set to the load-balancer's IP and port.
|
||||
Setting this to "Proxy" indicates that traffic is delivered to the node or pod with
|
||||
the destination set to the node's IP and node port or the pod's IP and port.
|
||||
Service implementations may use this information to adjust traffic routing.
|
||||
type: string
|
||||
ports:
|
||||
description: |-
|
||||
Ports is a list of records of service ports
|
||||
If used, every port defined in the service should have an entry in it
|
||||
items:
|
||||
properties:
|
||||
error:
|
||||
description: |-
|
||||
Error is to record the problem with the service port
|
||||
The format of the error shall comply with the following rules:
|
||||
- built-in error values shall be specified in this file and those shall use
|
||||
CamelCase names
|
||||
- cloud provider specific error values must have names that comply with the
|
||||
format foo.example.com/CamelCase.
|
||||
---
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
port:
|
||||
description: Port is the port number of the service
|
||||
port of which status is recorded here
|
||||
format: int32
|
||||
type: integer
|
||||
protocol:
|
||||
default: TCP
|
||||
description: |-
|
||||
Protocol is the protocol of the service port of which status is recorded here
|
||||
The supported values are: "TCP", "UDP", "SCTP"
|
||||
type: string
|
||||
required:
|
||||
- port
|
||||
- protocol
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshgatewayroutes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshGatewayRoute
|
||||
listKind: MeshGatewayRouteList
|
||||
plural: meshgatewayroutes
|
||||
singular: meshgatewayroute
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshGatewayRoute resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshgateways.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshGateway
|
||||
listKind: MeshGatewayList
|
||||
plural: meshgateways
|
||||
singular: meshgateway
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshGateway resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,382 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshhealthchecks.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshHealthCheck
|
||||
listKind: MeshHealthCheckList
|
||||
plural: meshhealthchecks
|
||||
singular: meshhealthcheck
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshHealthCheck resource.
|
||||
properties:
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between the consumed services and
|
||||
corresponding configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
alwaysLogHealthCheckFailures:
|
||||
description: |-
|
||||
If set to true, health check failure events will always be logged. If set
|
||||
to false, only the initial health check failure event will be logged. The
|
||||
default value is false.
|
||||
type: boolean
|
||||
eventLogPath:
|
||||
description: |-
|
||||
Specifies the path to the file where Envoy can log health check events.
|
||||
If empty, no event log will be written.
|
||||
type: string
|
||||
failTrafficOnPanic:
|
||||
description: |-
|
||||
If set to true, Envoy will not consider any hosts when the cluster is in
|
||||
'panic mode'. Instead, the cluster will fail all requests as if all hosts
|
||||
are unhealthy. This can help avoid potentially overwhelming a failing
|
||||
service.
|
||||
type: boolean
|
||||
grpc:
|
||||
description: |-
|
||||
GrpcHealthCheck defines gRPC configuration which will instruct the service
|
||||
the health check will be made for is a gRPC service.
|
||||
properties:
|
||||
authority:
|
||||
description: |-
|
||||
The value of the :authority header in the gRPC health check request,
|
||||
by default name of the cluster this health check is associated with
|
||||
type: string
|
||||
disabled:
|
||||
description: If true the GrpcHealthCheck is disabled
|
||||
type: boolean
|
||||
serviceName:
|
||||
description: Service name parameter which will be sent
|
||||
to gRPC service
|
||||
type: string
|
||||
type: object
|
||||
healthyPanicThreshold:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Allows to configure panic threshold for Envoy cluster. If not specified,
|
||||
the default is 50%. To disable panic mode, set to 0%.
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
healthyThreshold:
|
||||
default: 1
|
||||
description: Number of consecutive healthy checks before
|
||||
considering a host healthy.
|
||||
format: int32
|
||||
type: integer
|
||||
http:
|
||||
description: |-
|
||||
HttpHealthCheck defines HTTP configuration which will instruct the service
|
||||
the health check will be made for is an HTTP service.
|
||||
properties:
|
||||
disabled:
|
||||
description: If true the HttpHealthCheck is disabled
|
||||
type: boolean
|
||||
expectedStatuses:
|
||||
description: List of HTTP response statuses which are
|
||||
considered healthy
|
||||
items:
|
||||
format: int32
|
||||
type: integer
|
||||
type: array
|
||||
path:
|
||||
default: /
|
||||
description: |-
|
||||
The HTTP path which will be requested during the health check
|
||||
(ie. /health)
|
||||
type: string
|
||||
requestHeadersToAdd:
|
||||
description: |-
|
||||
The list of HTTP headers which should be added to each health check
|
||||
request
|
||||
properties:
|
||||
add:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
set:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
type: object
|
||||
initialJitter:
|
||||
description: |-
|
||||
If specified, Envoy will start health checking after a random time in
|
||||
ms between 0 and initialJitter. This only applies to the first health
|
||||
check.
|
||||
type: string
|
||||
interval:
|
||||
default: 1m
|
||||
description: Interval between consecutive health checks.
|
||||
type: string
|
||||
intervalJitter:
|
||||
description: |-
|
||||
If specified, during every interval Envoy will add IntervalJitter to the
|
||||
wait time.
|
||||
type: string
|
||||
intervalJitterPercent:
|
||||
description: |-
|
||||
If specified, during every interval Envoy will add IntervalJitter *
|
||||
IntervalJitterPercent / 100 to the wait time. If IntervalJitter and
|
||||
IntervalJitterPercent are both set, both of them will be used to
|
||||
increase the wait time.
|
||||
format: int32
|
||||
type: integer
|
||||
noTrafficInterval:
|
||||
description: |-
|
||||
The "no traffic interval" is a special health check interval that is used
|
||||
when a cluster has never had traffic routed to it. This lower interval
|
||||
allows cluster information to be kept up to date, without sending a
|
||||
potentially large amount of active health checking traffic for no reason.
|
||||
Once a cluster has been used for traffic routing, Envoy will shift back
|
||||
to using the standard health check interval that is defined. Note that
|
||||
this interval takes precedence over any other. The default value for "no
|
||||
traffic interval" is 60 seconds.
|
||||
type: string
|
||||
reuseConnection:
|
||||
description: Reuse health check connection between health
|
||||
checks. Default is true.
|
||||
type: boolean
|
||||
tcp:
|
||||
description: |-
|
||||
TcpHealthCheck defines configuration for specifying bytes to send and
|
||||
expected response during the health check
|
||||
properties:
|
||||
disabled:
|
||||
description: If true the TcpHealthCheck is disabled
|
||||
type: boolean
|
||||
receive:
|
||||
description: |-
|
||||
List of Base64 encoded blocks of strings expected as a response. When checking the response,
|
||||
"fuzzy" matching is performed such that each block must be found, and
|
||||
in the order specified, but not necessarily contiguous.
|
||||
If not provided or empty, checks will be performed as "connect only" and be marked as successful when TCP connection is successfully established.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
send:
|
||||
description: Base64 encoded content of the message which
|
||||
will be sent during the health check to the target
|
||||
type: string
|
||||
type: object
|
||||
timeout:
|
||||
default: 15s
|
||||
description: Maximum time to wait for a health check response.
|
||||
type: string
|
||||
unhealthyThreshold:
|
||||
default: 5
|
||||
description: |-
|
||||
Number of consecutive unhealthy checks before considering a host
|
||||
unhealthy.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,664 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshhttproutes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshHTTPRoute
|
||||
listKind: MeshHTTPRouteList
|
||||
plural: meshhttproutes
|
||||
singular: meshhttproute
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshHTTPRoute resource.
|
||||
properties:
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To matches destination services of requests and holds
|
||||
configuration.
|
||||
items:
|
||||
properties:
|
||||
hostnames:
|
||||
description: |-
|
||||
Hostnames is only valid when targeting MeshGateway and limits the
|
||||
effects of the rules to requests to this hostname.
|
||||
Given hostnames must intersect with the hostname of the listeners the
|
||||
route attaches to.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
rules:
|
||||
description: |-
|
||||
Rules contains the routing rules applies to a combination of top-level
|
||||
targetRef and the targetRef in this entry.
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default holds routing rules that can be merged with rules from other
|
||||
policies.
|
||||
properties:
|
||||
backendRefs:
|
||||
items:
|
||||
description: BackendRef defines where to forward
|
||||
traffic.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use
|
||||
to identify cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
port:
|
||||
description: Port is only supported when this
|
||||
ref refers to a real MeshService object
|
||||
format: int32
|
||||
type: integer
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
weight:
|
||||
default: 1
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
type: array
|
||||
filters:
|
||||
items:
|
||||
properties:
|
||||
requestHeaderModifier:
|
||||
description: |-
|
||||
Only one action is supported per header name.
|
||||
Configuration to set or add multiple values for a header must use RFC 7230
|
||||
header value formatting, separating each value with a comma.
|
||||
properties:
|
||||
add:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
remove:
|
||||
items:
|
||||
type: string
|
||||
maxItems: 16
|
||||
type: array
|
||||
set:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
requestMirror:
|
||||
properties:
|
||||
backendRef:
|
||||
description: TODO forbid weight
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced
|
||||
resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future
|
||||
use to identify cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
port:
|
||||
description: Port is only supported
|
||||
when this ref refers to a real MeshService
|
||||
object
|
||||
format: int32
|
||||
type: integer
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
weight:
|
||||
default: 1
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Percentage of requests to mirror. If not specified, all requests
|
||||
to the target cluster will be mirrored.
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- backendRef
|
||||
type: object
|
||||
requestRedirect:
|
||||
properties:
|
||||
hostname:
|
||||
description: |-
|
||||
PreciseHostname is the fully qualified domain name of a network host. This
|
||||
matches the RFC 1123 definition of a hostname with 1 notable exception that
|
||||
numeric IP addresses are not allowed.
|
||||
|
||||
|
||||
Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
|
||||
alphanumeric characters or '-', and must start and end with an alphanumeric
|
||||
character. No other punctuation is allowed.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines parameters used to modify the path of the incoming request.
|
||||
The modified path is then used to construct the location header.
|
||||
When empty, the request path is used as-is.
|
||||
properties:
|
||||
replaceFullPath:
|
||||
type: string
|
||||
replacePrefixMatch:
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- ReplaceFullPath
|
||||
- ReplacePrefixMatch
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
port:
|
||||
description: |-
|
||||
Port is the port to be used in the value of the `Location`
|
||||
header in the response.
|
||||
When empty, port (if specified) of the request is used.
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
scheme:
|
||||
enum:
|
||||
- http
|
||||
- https
|
||||
type: string
|
||||
statusCode:
|
||||
default: 302
|
||||
description: StatusCode is the HTTP status
|
||||
code to be used in response.
|
||||
enum:
|
||||
- 301
|
||||
- 302
|
||||
- 303
|
||||
- 307
|
||||
- 308
|
||||
type: integer
|
||||
type: object
|
||||
responseHeaderModifier:
|
||||
description: |-
|
||||
Only one action is supported per header name.
|
||||
Configuration to set or add multiple values for a header must use RFC 7230
|
||||
header value formatting, separating each value with a comma.
|
||||
properties:
|
||||
add:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
remove:
|
||||
items:
|
||||
type: string
|
||||
maxItems: 16
|
||||
type: array
|
||||
set:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
type:
|
||||
enum:
|
||||
- RequestHeaderModifier
|
||||
- ResponseHeaderModifier
|
||||
- RequestRedirect
|
||||
- URLRewrite
|
||||
- RequestMirror
|
||||
type: string
|
||||
urlRewrite:
|
||||
properties:
|
||||
hostToBackendHostname:
|
||||
description: |-
|
||||
HostToBackendHostname rewrites the hostname to the hostname of the
|
||||
upstream host. This option is only available when targeting MeshGateways.
|
||||
type: boolean
|
||||
hostname:
|
||||
description: Hostname is the value to be
|
||||
used to replace the host header value
|
||||
during forwarding.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
path:
|
||||
description: Path defines a path rewrite.
|
||||
properties:
|
||||
replaceFullPath:
|
||||
type: string
|
||||
replacePrefixMatch:
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- ReplaceFullPath
|
||||
- ReplacePrefixMatch
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
matches:
|
||||
description: |-
|
||||
Matches describes how to match HTTP requests this rule should be applied
|
||||
to.
|
||||
items:
|
||||
properties:
|
||||
headers:
|
||||
items:
|
||||
description: |-
|
||||
HeaderMatch describes how to select an HTTP route by matching HTTP request
|
||||
headers.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the HTTP Header to be matched. Name MUST be lower case
|
||||
as they will be handled with case insensitivity (See https://tools.ietf.org/html/rfc7230#section-3.2).
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
type:
|
||||
default: Exact
|
||||
description: Type specifies how to match against
|
||||
the value of the header.
|
||||
enum:
|
||||
- Exact
|
||||
- Present
|
||||
- RegularExpression
|
||||
- Absent
|
||||
- Prefix
|
||||
type: string
|
||||
value:
|
||||
description: Value is the value of HTTP Header
|
||||
to be matched.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
method:
|
||||
enum:
|
||||
- CONNECT
|
||||
- DELETE
|
||||
- GET
|
||||
- HEAD
|
||||
- OPTIONS
|
||||
- PATCH
|
||||
- POST
|
||||
- PUT
|
||||
- TRACE
|
||||
type: string
|
||||
path:
|
||||
properties:
|
||||
type:
|
||||
enum:
|
||||
- Exact
|
||||
- PathPrefix
|
||||
- RegularExpression
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Exact or prefix matches must be an absolute path. A prefix matches only
|
||||
if separated by a slash or the entire path.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- value
|
||||
type: object
|
||||
queryParams:
|
||||
description: |-
|
||||
QueryParams matches based on HTTP URL query parameters. Multiple matches
|
||||
are ANDed together such that all listed matches must succeed.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
minLength: 1
|
||||
type: string
|
||||
type:
|
||||
enum:
|
||||
- Exact
|
||||
- RegularExpression
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- type
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
- default
|
||||
- matches
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
request destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshInsight
|
||||
listKind: MeshInsightList
|
||||
plural: meshinsights
|
||||
singular: meshinsight
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshInsight resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,572 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshloadbalancingstrategies.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshLoadBalancingStrategy
|
||||
listKind: MeshLoadBalancingStrategyList
|
||||
plural: meshloadbalancingstrategies
|
||||
singular: meshloadbalancingstrategy
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshLoadBalancingStrategy
|
||||
resource.
|
||||
properties:
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between the consumed services and
|
||||
corresponding configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
loadBalancer:
|
||||
description: LoadBalancer allows to specify load balancing
|
||||
algorithm.
|
||||
properties:
|
||||
leastRequest:
|
||||
description: |-
|
||||
LeastRequest selects N random available hosts as specified in 'choiceCount' (2 by default)
|
||||
and picks the host which has the fewest active requests
|
||||
properties:
|
||||
activeRequestBias:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
ActiveRequestBias refers to dynamic weights applied when hosts have varying load
|
||||
balancing weights. A higher value here aggressively reduces the weight of endpoints
|
||||
that are currently handling active requests. In essence, the higher the ActiveRequestBias
|
||||
value, the more forcefully it reduces the load balancing weight of endpoints that are
|
||||
actively serving requests.
|
||||
x-kubernetes-int-or-string: true
|
||||
choiceCount:
|
||||
description: |-
|
||||
ChoiceCount is the number of random healthy hosts from which the host with
|
||||
the fewest active requests will be chosen. Defaults to 2 so that Envoy performs
|
||||
two-choice selection if the field is not set.
|
||||
format: int32
|
||||
minimum: 2
|
||||
type: integer
|
||||
type: object
|
||||
maglev:
|
||||
description: |-
|
||||
Maglev implements consistent hashing to upstream hosts. Maglev can be used as
|
||||
a drop in replacement for the ring hash load balancer any place in which
|
||||
consistent hashing is desired.
|
||||
properties:
|
||||
hashPolicies:
|
||||
description: |-
|
||||
HashPolicies specify a list of request/connection properties that are used to calculate a hash.
|
||||
These hash policies are executed in the specified order. If a hash policy has the “terminal” attribute
|
||||
set to true, and there is already a hash generated, the hash is returned immediately,
|
||||
ignoring the rest of the hash policy list.
|
||||
items:
|
||||
properties:
|
||||
connection:
|
||||
properties:
|
||||
sourceIP:
|
||||
description: Hash on source IP address.
|
||||
type: boolean
|
||||
type: object
|
||||
cookie:
|
||||
properties:
|
||||
name:
|
||||
description: The name of the cookie that
|
||||
will be used to obtain the hash key.
|
||||
minLength: 1
|
||||
type: string
|
||||
path:
|
||||
description: The name of the path for
|
||||
the cookie.
|
||||
type: string
|
||||
ttl:
|
||||
description: If specified, a cookie with
|
||||
the TTL will be generated if the cookie
|
||||
is not present.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
filterState:
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
The name of the Object in the per-request filterState, which is
|
||||
an Envoy::Hashable object. If there is no data associated with the key,
|
||||
or the stored object is not Envoy::Hashable, no hash will be produced.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
header:
|
||||
properties:
|
||||
name:
|
||||
description: The name of the request header
|
||||
that will be used to obtain the hash
|
||||
key.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
queryParameter:
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
The name of the URL query parameter that will be used to obtain the hash key.
|
||||
If the parameter is not present, no hash will be produced. Query parameter names
|
||||
are case-sensitive.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
terminal:
|
||||
description: |-
|
||||
Terminal is a flag that short-circuits the hash computing. This field provides
|
||||
a ‘fallback’ style of configuration: “if a terminal policy doesn’t work, fallback
|
||||
to rest of the policy list”, it saves time when the terminal policy works.
|
||||
If true, and there is already a hash computed, ignore rest of the list of hash polices.
|
||||
type: boolean
|
||||
type:
|
||||
enum:
|
||||
- Header
|
||||
- Cookie
|
||||
- SourceIP
|
||||
- QueryParameter
|
||||
- FilterState
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
tableSize:
|
||||
description: |-
|
||||
The table size for Maglev hashing. Maglev aims for “minimal disruption”
|
||||
rather than an absolute guarantee. Minimal disruption means that when
|
||||
the set of upstream hosts change, a connection will likely be sent
|
||||
to the same upstream as it was before. Increasing the table size reduces
|
||||
the amount of disruption. The table size must be prime number limited to 5000011.
|
||||
If it is not specified, the default is 65537.
|
||||
format: int32
|
||||
maximum: 5000011
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
random:
|
||||
description: |-
|
||||
Random selects a random available host. The random load balancer generally
|
||||
performs better than round-robin if no health checking policy is configured.
|
||||
Random selection avoids bias towards the host in the set that comes after a failed host.
|
||||
type: object
|
||||
ringHash:
|
||||
description: |-
|
||||
RingHash implements consistent hashing to upstream hosts. Each host is mapped
|
||||
onto a circle (the “ring”) by hashing its address; each request is then routed
|
||||
to a host by hashing some property of the request, and finding the nearest
|
||||
corresponding host clockwise around the ring.
|
||||
properties:
|
||||
hashFunction:
|
||||
description: |-
|
||||
HashFunction is a function used to hash hosts onto the ketama ring.
|
||||
The value defaults to XX_HASH. Available values – XX_HASH, MURMUR_HASH_2.
|
||||
enum:
|
||||
- XXHash
|
||||
- MurmurHash2
|
||||
type: string
|
||||
hashPolicies:
|
||||
description: |-
|
||||
HashPolicies specify a list of request/connection properties that are used to calculate a hash.
|
||||
These hash policies are executed in the specified order. If a hash policy has the “terminal” attribute
|
||||
set to true, and there is already a hash generated, the hash is returned immediately,
|
||||
ignoring the rest of the hash policy list.
|
||||
items:
|
||||
properties:
|
||||
connection:
|
||||
properties:
|
||||
sourceIP:
|
||||
description: Hash on source IP address.
|
||||
type: boolean
|
||||
type: object
|
||||
cookie:
|
||||
properties:
|
||||
name:
|
||||
description: The name of the cookie that
|
||||
will be used to obtain the hash key.
|
||||
minLength: 1
|
||||
type: string
|
||||
path:
|
||||
description: The name of the path for
|
||||
the cookie.
|
||||
type: string
|
||||
ttl:
|
||||
description: If specified, a cookie with
|
||||
the TTL will be generated if the cookie
|
||||
is not present.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
filterState:
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
The name of the Object in the per-request filterState, which is
|
||||
an Envoy::Hashable object. If there is no data associated with the key,
|
||||
or the stored object is not Envoy::Hashable, no hash will be produced.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
header:
|
||||
properties:
|
||||
name:
|
||||
description: The name of the request header
|
||||
that will be used to obtain the hash
|
||||
key.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
queryParameter:
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
The name of the URL query parameter that will be used to obtain the hash key.
|
||||
If the parameter is not present, no hash will be produced. Query parameter names
|
||||
are case-sensitive.
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
terminal:
|
||||
description: |-
|
||||
Terminal is a flag that short-circuits the hash computing. This field provides
|
||||
a ‘fallback’ style of configuration: “if a terminal policy doesn’t work, fallback
|
||||
to rest of the policy list”, it saves time when the terminal policy works.
|
||||
If true, and there is already a hash computed, ignore rest of the list of hash polices.
|
||||
type: boolean
|
||||
type:
|
||||
enum:
|
||||
- Header
|
||||
- Cookie
|
||||
- SourceIP
|
||||
- QueryParameter
|
||||
- FilterState
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
maxRingSize:
|
||||
description: |-
|
||||
Maximum hash ring size. Defaults to 8M entries, and limited to 8M entries,
|
||||
but can be lowered to further constrain resource use.
|
||||
format: int32
|
||||
maximum: 8000000
|
||||
minimum: 1
|
||||
type: integer
|
||||
minRingSize:
|
||||
description: |-
|
||||
Minimum hash ring size. The larger the ring is (that is,
|
||||
the more hashes there are for each provided host) the better the request distribution
|
||||
will reflect the desired weights. Defaults to 1024 entries, and limited to 8M entries.
|
||||
format: int32
|
||||
maximum: 8000000
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
roundRobin:
|
||||
description: |-
|
||||
RoundRobin is a load balancing algorithm that distributes requests
|
||||
across available upstream hosts in round-robin order.
|
||||
type: object
|
||||
type:
|
||||
enum:
|
||||
- RoundRobin
|
||||
- LeastRequest
|
||||
- RingHash
|
||||
- Random
|
||||
- Maglev
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
localityAwareness:
|
||||
description: LocalityAwareness contains configuration for
|
||||
locality aware load balancing.
|
||||
properties:
|
||||
crossZone:
|
||||
description: |-
|
||||
CrossZone defines locality aware load balancing priorities when dataplane proxies inside local zone
|
||||
are unavailable
|
||||
properties:
|
||||
failover:
|
||||
description: Failover defines list of load balancing
|
||||
rules in order of priority
|
||||
items:
|
||||
properties:
|
||||
from:
|
||||
description: From defines the list of zones
|
||||
to which the rule applies
|
||||
properties:
|
||||
zones:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- zones
|
||||
type: object
|
||||
to:
|
||||
description: To defines to which zones the
|
||||
traffic should be load balanced
|
||||
properties:
|
||||
type:
|
||||
description: Type defines how target zones
|
||||
will be picked from available zones
|
||||
enum:
|
||||
- None
|
||||
- Only
|
||||
- Any
|
||||
- AnyExcept
|
||||
type: string
|
||||
zones:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- to
|
||||
type: object
|
||||
type: array
|
||||
failoverThreshold:
|
||||
description: |-
|
||||
FailoverThreshold defines the percentage of live destination dataplane proxies below which load balancing to the
|
||||
next priority starts.
|
||||
Example: If you configure failoverThreshold to 70, and you have deployed 10 destination dataplane proxies.
|
||||
Load balancing to next priority will start when number of live destination dataplane proxies drops below 7.
|
||||
Default 50
|
||||
properties:
|
||||
percentage:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- percentage
|
||||
type: object
|
||||
type: object
|
||||
disabled:
|
||||
description: |-
|
||||
Disabled allows to disable locality-aware load balancing.
|
||||
When disabled requests are distributed across all endpoints regardless of locality.
|
||||
type: boolean
|
||||
localZone:
|
||||
description: LocalZone defines locality aware load balancing
|
||||
priorities between dataplane proxies inside a zone
|
||||
properties:
|
||||
affinityTags:
|
||||
description: AffinityTags list of tags for local
|
||||
zone load balancing.
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
description: Key defines tag for which affinity
|
||||
is configured
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight of the tag used for load balancing. The bigger the weight the bigger the priority.
|
||||
Percentage of local traffic load balanced to tag is computed by dividing weight by sum of weights from all tags.
|
||||
For example with two affinity tags first with weight 80 and second with weight 20,
|
||||
then 80% of traffic will be redirected to the first tag, and 20% of traffic will be redirected to second one.
|
||||
Setting weights is not mandatory. When weights are not set control plane will compute default weight based on list order.
|
||||
Default: If you do not specify weight we will adjust them so that 90% traffic goes to first tag, 9% to next, and 1% to third and so on.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,293 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshmetrics.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshMetric
|
||||
listKind: MeshMetricList
|
||||
plural: meshmetrics
|
||||
singular: meshmetric
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshMetric resource.
|
||||
properties:
|
||||
default:
|
||||
description: MeshMetric configuration.
|
||||
properties:
|
||||
applications:
|
||||
description: Applications is a list of application that Dataplane
|
||||
Proxy will scrape
|
||||
items:
|
||||
properties:
|
||||
address:
|
||||
description: Address on which an application listens.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the application to scrape
|
||||
type: string
|
||||
path:
|
||||
default: /metrics/prometheus
|
||||
description: Path on which an application expose HTTP endpoint
|
||||
with metrics.
|
||||
type: string
|
||||
port:
|
||||
description: Port on which an application expose HTTP endpoint
|
||||
with metrics.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
type: array
|
||||
backends:
|
||||
description: Backends list that will be used to collect metrics.
|
||||
items:
|
||||
properties:
|
||||
openTelemetry:
|
||||
description: OpenTelemetry backend configuration
|
||||
properties:
|
||||
endpoint:
|
||||
description: Endpoint for OpenTelemetry collector
|
||||
type: string
|
||||
refreshInterval:
|
||||
description: RefreshInterval defines how frequent metrics
|
||||
should be pushed to collector
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
prometheus:
|
||||
description: Prometheus backend configuration.
|
||||
properties:
|
||||
clientId:
|
||||
description: ClientId of the Prometheus backend. Needed
|
||||
when using MADS for DP discovery.
|
||||
type: string
|
||||
path:
|
||||
default: /metrics
|
||||
description: Path on which a dataplane should expose
|
||||
HTTP endpoint with Prometheus metrics.
|
||||
type: string
|
||||
port:
|
||||
default: 5670
|
||||
description: Port on which a dataplane should expose
|
||||
HTTP endpoint with Prometheus metrics.
|
||||
format: int32
|
||||
type: integer
|
||||
tls:
|
||||
description: Configuration of TLS for prometheus listener.
|
||||
properties:
|
||||
mode:
|
||||
default: Disabled
|
||||
description: Configuration of TLS for Prometheus
|
||||
listener.
|
||||
enum:
|
||||
- Disabled
|
||||
- ProvidedTLS
|
||||
- ActiveMTLSBackend
|
||||
type: string
|
||||
required:
|
||||
- mode
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
- port
|
||||
type: object
|
||||
type:
|
||||
description: Type of the backend that will be used to collect
|
||||
metrics. At the moment only Prometheus backend is available.
|
||||
enum:
|
||||
- Prometheus
|
||||
- OpenTelemetry
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
sidecar:
|
||||
description: Sidecar metrics collection configuration
|
||||
properties:
|
||||
includeUnused:
|
||||
default: false
|
||||
description: |-
|
||||
IncludeUnused if false will scrape only metrics that has been by sidecar (counters incremented
|
||||
at least once, gauges changed at least once, and histograms added to at
|
||||
least once). If true will scrape all metrics (even the ones with zeros).
|
||||
type: boolean
|
||||
profiles:
|
||||
description: Profiles allows to customize which metrics are
|
||||
published.
|
||||
properties:
|
||||
appendProfiles:
|
||||
description: AppendProfiles allows to combine the metrics
|
||||
from multiple predefined profiles.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: 'Name of the predefined profile, one
|
||||
of: all, basic, none'
|
||||
enum:
|
||||
- All
|
||||
- Basic
|
||||
- None
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
exclude:
|
||||
description: |-
|
||||
Exclude makes it possible to exclude groups of metrics from a resulting profile.
|
||||
Exclude is subordinate to Include.
|
||||
items:
|
||||
properties:
|
||||
match:
|
||||
description: Match is the value used to match using
|
||||
particular Type
|
||||
type: string
|
||||
type:
|
||||
description: 'Type defined the type of selector,
|
||||
one of: prefix, regex, exact'
|
||||
enum:
|
||||
- Prefix
|
||||
- Regex
|
||||
- Exact
|
||||
- Contains
|
||||
type: string
|
||||
required:
|
||||
- match
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
include:
|
||||
description: |-
|
||||
Include makes it possible to include additional metrics in a selected profiles.
|
||||
Include takes precedence over Exclude.
|
||||
items:
|
||||
properties:
|
||||
match:
|
||||
description: Match is the value used to match using
|
||||
particular Type
|
||||
type: string
|
||||
type:
|
||||
description: 'Type defined the type of selector,
|
||||
one of: prefix, regex, exact'
|
||||
enum:
|
||||
- Prefix
|
||||
- Regex
|
||||
- Exact
|
||||
- Contains
|
||||
type: string
|
||||
required:
|
||||
- match
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined in-place.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,167 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshpassthroughs.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshPassthrough
|
||||
listKind: MeshPassthroughList
|
||||
plural: meshpassthroughs
|
||||
singular: meshpassthrough
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshPassthrough resource.
|
||||
properties:
|
||||
default:
|
||||
description: MeshPassthrough configuration.
|
||||
properties:
|
||||
appendMatch:
|
||||
description: AppendMatch is a list of destinations that should
|
||||
be allowed through the sidecar.
|
||||
items:
|
||||
properties:
|
||||
port:
|
||||
description: Port defines the port to which a user makes
|
||||
a request.
|
||||
type: integer
|
||||
protocol:
|
||||
default: tcp
|
||||
description: 'Protocol defines the communication protocol.
|
||||
Possible values: `tcp`, `tls`, `grpc`, `http`, `http2`.'
|
||||
enum:
|
||||
- tcp
|
||||
- tls
|
||||
- grpc
|
||||
- http
|
||||
- http2
|
||||
type: string
|
||||
type:
|
||||
description: Type of the match, one of `Domain`, `IP` or
|
||||
`CIDR` is available.
|
||||
enum:
|
||||
- Domain
|
||||
- IP
|
||||
- CIDR
|
||||
type: string
|
||||
value:
|
||||
description: Value for the specified Type.
|
||||
type: string
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
type: array
|
||||
passthroughMode:
|
||||
default: None
|
||||
description: |-
|
||||
Defines the passthrough behavior. Possible values: `All`, `None`, `Matched`
|
||||
When `All` or `None` `appendMatch` has no effect.
|
||||
enum:
|
||||
- All
|
||||
- Matched
|
||||
- None
|
||||
type: string
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined in-place.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,560 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshproxypatches.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshProxyPatch
|
||||
listKind: MeshProxyPatchList
|
||||
plural: meshproxypatches
|
||||
singular: meshproxypatch
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshProxyPatch resource.
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations
|
||||
referenced in 'targetRef'.
|
||||
properties:
|
||||
appendModifications:
|
||||
description: AppendModifications is a list of modifications applied
|
||||
on the selected proxy.
|
||||
items:
|
||||
properties:
|
||||
cluster:
|
||||
description: Cluster is a modification of Envoy's Cluster
|
||||
resource.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: |-
|
||||
JsonPatches specifies list of jsonpatches to apply to on Envoy's Cluster
|
||||
resource
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation
|
||||
block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string,
|
||||
used by move and copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: Value must be a valid json value
|
||||
used by replace and add operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
match:
|
||||
description: Match is a set of conditions that have
|
||||
to be matched for modification operation to happen.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the cluster to match.
|
||||
type: string
|
||||
origin:
|
||||
description: |-
|
||||
Origin is the name of the component or plugin that generated the resource.
|
||||
|
||||
|
||||
Here is the list of well-known origins:
|
||||
inbound - resources generated for handling incoming traffic.
|
||||
outbound - resources generated for handling outgoing traffic.
|
||||
transparent - resources generated for transparent proxy functionality.
|
||||
prometheus - resources generated when Prometheus metrics are enabled.
|
||||
direct-access - resources generated for Direct Access functionality.
|
||||
ingress - resources generated for Zone Ingress.
|
||||
egress - resources generated for Zone Egress.
|
||||
gateway - resources generated for MeshGateway.
|
||||
|
||||
|
||||
The list is not complete, because policy plugins can introduce new resources.
|
||||
For example MeshTrace plugin can create Cluster with "mesh-trace" origin.
|
||||
type: string
|
||||
type: object
|
||||
operation:
|
||||
description: Operation to execute on matched cluster.
|
||||
enum:
|
||||
- Add
|
||||
- Remove
|
||||
- Patch
|
||||
type: string
|
||||
value:
|
||||
description: Value of xDS resource in YAML format to
|
||||
add or patch.
|
||||
type: string
|
||||
required:
|
||||
- operation
|
||||
type: object
|
||||
httpFilter:
|
||||
description: |-
|
||||
HTTPFilter is a modification of Envoy HTTP Filter
|
||||
available in HTTP Connection Manager in a Listener resource.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: |-
|
||||
JsonPatches specifies list of jsonpatches to apply to on Envoy's
|
||||
HTTP Filter available in HTTP Connection Manager in a Listener resource.
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation
|
||||
block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string,
|
||||
used by move and copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: Value must be a valid json value
|
||||
used by replace and add operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
match:
|
||||
description: Match is a set of conditions that have
|
||||
to be matched for modification operation to happen.
|
||||
properties:
|
||||
listenerName:
|
||||
description: Name of the listener to match.
|
||||
type: string
|
||||
listenerTags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Listener tags available in Listener#Metadata#FilterMetadata[io.kuma.tags]
|
||||
type: object
|
||||
name:
|
||||
description: Name of the HTTP filter. For example
|
||||
"envoy.filters.http.local_ratelimit"
|
||||
type: string
|
||||
origin:
|
||||
description: |-
|
||||
Origin is the name of the component or plugin that generated the resource.
|
||||
|
||||
|
||||
Here is the list of well-known origins:
|
||||
inbound - resources generated for handling incoming traffic.
|
||||
outbound - resources generated for handling outgoing traffic.
|
||||
transparent - resources generated for transparent proxy functionality.
|
||||
prometheus - resources generated when Prometheus metrics are enabled.
|
||||
direct-access - resources generated for Direct Access functionality.
|
||||
ingress - resources generated for Zone Ingress.
|
||||
egress - resources generated for Zone Egress.
|
||||
gateway - resources generated for MeshGateway.
|
||||
|
||||
|
||||
The list is not complete, because policy plugins can introduce new resources.
|
||||
For example MeshTrace plugin can create Cluster with "mesh-trace" origin.
|
||||
type: string
|
||||
type: object
|
||||
operation:
|
||||
description: Operation to execute on matched listener.
|
||||
enum:
|
||||
- Remove
|
||||
- Patch
|
||||
- AddFirst
|
||||
- AddBefore
|
||||
- AddAfter
|
||||
- AddLast
|
||||
type: string
|
||||
value:
|
||||
description: Value of xDS resource in YAML format to
|
||||
add or patch.
|
||||
type: string
|
||||
required:
|
||||
- operation
|
||||
type: object
|
||||
listener:
|
||||
description: Listener is a modification of Envoy's Listener
|
||||
resource.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: |-
|
||||
JsonPatches specifies list of jsonpatches to apply to on Envoy's Listener
|
||||
resource
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation
|
||||
block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string,
|
||||
used by move and copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: Value must be a valid json value
|
||||
used by replace and add operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
match:
|
||||
description: Match is a set of conditions that have
|
||||
to be matched for modification operation to happen.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the listener to match.
|
||||
type: string
|
||||
origin:
|
||||
description: |-
|
||||
Origin is the name of the component or plugin that generated the resource.
|
||||
|
||||
|
||||
Here is the list of well-known origins:
|
||||
inbound - resources generated for handling incoming traffic.
|
||||
outbound - resources generated for handling outgoing traffic.
|
||||
transparent - resources generated for transparent proxy functionality.
|
||||
prometheus - resources generated when Prometheus metrics are enabled.
|
||||
direct-access - resources generated for Direct Access functionality.
|
||||
ingress - resources generated for Zone Ingress.
|
||||
egress - resources generated for Zone Egress.
|
||||
gateway - resources generated for MeshGateway.
|
||||
|
||||
|
||||
The list is not complete, because policy plugins can introduce new resources.
|
||||
For example MeshTrace plugin can create Cluster with "mesh-trace" origin.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Tags available in Listener#Metadata#FilterMetadata[io.kuma.tags]
|
||||
type: object
|
||||
type: object
|
||||
operation:
|
||||
description: Operation to execute on matched listener.
|
||||
enum:
|
||||
- Add
|
||||
- Remove
|
||||
- Patch
|
||||
type: string
|
||||
value:
|
||||
description: Value of xDS resource in YAML format to
|
||||
add or patch.
|
||||
type: string
|
||||
required:
|
||||
- operation
|
||||
type: object
|
||||
networkFilter:
|
||||
description: NetworkFilter is a modification of Envoy Listener's
|
||||
filter.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: |-
|
||||
JsonPatches specifies list of jsonpatches to apply to on Envoy Listener's
|
||||
filter.
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation
|
||||
block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string,
|
||||
used by move and copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: Value must be a valid json value
|
||||
used by replace and add operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
match:
|
||||
description: Match is a set of conditions that have
|
||||
to be matched for modification operation to happen.
|
||||
properties:
|
||||
listenerName:
|
||||
description: Name of the listener to match.
|
||||
type: string
|
||||
listenerTags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Listener tags available in Listener#Metadata#FilterMetadata[io.kuma.tags]
|
||||
type: object
|
||||
name:
|
||||
description: Name of the network filter. For example
|
||||
"envoy.filters.network.ratelimit"
|
||||
type: string
|
||||
origin:
|
||||
description: |-
|
||||
Origin is the name of the component or plugin that generated the resource.
|
||||
|
||||
|
||||
Here is the list of well-known origins:
|
||||
inbound - resources generated for handling incoming traffic.
|
||||
outbound - resources generated for handling outgoing traffic.
|
||||
transparent - resources generated for transparent proxy functionality.
|
||||
prometheus - resources generated when Prometheus metrics are enabled.
|
||||
direct-access - resources generated for Direct Access functionality.
|
||||
ingress - resources generated for Zone Ingress.
|
||||
egress - resources generated for Zone Egress.
|
||||
gateway - resources generated for MeshGateway.
|
||||
|
||||
|
||||
The list is not complete, because policy plugins can introduce new resources.
|
||||
For example MeshTrace plugin can create Cluster with "mesh-trace" origin.
|
||||
type: string
|
||||
type: object
|
||||
operation:
|
||||
description: Operation to execute on matched listener.
|
||||
enum:
|
||||
- Remove
|
||||
- Patch
|
||||
- AddFirst
|
||||
- AddBefore
|
||||
- AddAfter
|
||||
- AddLast
|
||||
type: string
|
||||
value:
|
||||
description: Value of xDS resource in YAML format to
|
||||
add or patch.
|
||||
type: string
|
||||
required:
|
||||
- operation
|
||||
type: object
|
||||
virtualHost:
|
||||
description: |-
|
||||
VirtualHost is a modification of Envoy's VirtualHost
|
||||
referenced in HTTP Connection Manager in a Listener resource.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: |-
|
||||
JsonPatches specifies list of jsonpatches to apply to on Envoy's
|
||||
VirtualHost resource
|
||||
items:
|
||||
description: JsonPatchBlock is one json patch operation
|
||||
block.
|
||||
properties:
|
||||
from:
|
||||
description: From is a jsonpatch from string,
|
||||
used by move and copy operations.
|
||||
type: string
|
||||
op:
|
||||
description: Op is a jsonpatch operation string.
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
type: string
|
||||
path:
|
||||
description: Path is a jsonpatch path string.
|
||||
type: string
|
||||
value:
|
||||
description: Value must be a valid json value
|
||||
used by replace and add operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
match:
|
||||
description: Match is a set of conditions that have
|
||||
to be matched for modification operation to happen.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the VirtualHost to match.
|
||||
type: string
|
||||
origin:
|
||||
description: |-
|
||||
Origin is the name of the component or plugin that generated the resource.
|
||||
|
||||
|
||||
Here is the list of well-known origins:
|
||||
inbound - resources generated for handling incoming traffic.
|
||||
outbound - resources generated for handling outgoing traffic.
|
||||
transparent - resources generated for transparent proxy functionality.
|
||||
prometheus - resources generated when Prometheus metrics are enabled.
|
||||
direct-access - resources generated for Direct Access functionality.
|
||||
ingress - resources generated for Zone Ingress.
|
||||
egress - resources generated for Zone Egress.
|
||||
gateway - resources generated for MeshGateway.
|
||||
|
||||
|
||||
The list is not complete, because policy plugins can introduce new resources.
|
||||
For example MeshTrace plugin can create Cluster with "mesh-trace" origin.
|
||||
type: string
|
||||
routeConfigurationName:
|
||||
description: Name of the RouteConfiguration resource
|
||||
to match.
|
||||
type: string
|
||||
type: object
|
||||
operation:
|
||||
description: Operation to execute on matched listener.
|
||||
enum:
|
||||
- Add
|
||||
- Remove
|
||||
- Patch
|
||||
type: string
|
||||
value:
|
||||
description: Value of xDS resource in YAML format to
|
||||
add or patch.
|
||||
type: string
|
||||
required:
|
||||
- match
|
||||
- operation
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- appendModifications
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- default
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,498 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshratelimits.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshRateLimit
|
||||
listKind: MeshRateLimitList
|
||||
plural: meshratelimits
|
||||
singular: meshratelimit
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshRateLimit resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of clients referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
local:
|
||||
description: LocalConf defines local http or/and tcp rate
|
||||
limit configuration
|
||||
properties:
|
||||
http:
|
||||
description: |-
|
||||
LocalHTTP defines configuration of local HTTP rate limiting
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/local_rate_limit_filter
|
||||
properties:
|
||||
disabled:
|
||||
description: Define if rate limiting should be disabled.
|
||||
type: boolean
|
||||
onRateLimit:
|
||||
description: Describes the actions to take on a
|
||||
rate limit event
|
||||
properties:
|
||||
headers:
|
||||
description: The Headers to be added to the
|
||||
HTTP response on a rate limit event
|
||||
properties:
|
||||
add:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
set:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
status:
|
||||
description: The HTTP status code to be set
|
||||
on a rate limit event
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
requestRate:
|
||||
description: Defines how many requests are allowed
|
||||
per interval.
|
||||
properties:
|
||||
interval:
|
||||
description: The interval the number of units
|
||||
is accounted for.
|
||||
type: string
|
||||
num:
|
||||
description: |-
|
||||
Number of units per interval (depending on usage it can be a number of requests,
|
||||
or a number of connections).
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- interval
|
||||
- num
|
||||
type: object
|
||||
type: object
|
||||
tcp:
|
||||
description: |-
|
||||
LocalTCP defines confguration of local TCP rate limiting
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/local_rate_limit_filter
|
||||
properties:
|
||||
connectionRate:
|
||||
description: Defines how many connections are allowed
|
||||
per interval.
|
||||
properties:
|
||||
interval:
|
||||
description: The interval the number of units
|
||||
is accounted for.
|
||||
type: string
|
||||
num:
|
||||
description: |-
|
||||
Number of units per interval (depending on usage it can be a number of requests,
|
||||
or a number of connections).
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- interval
|
||||
- num
|
||||
type: object
|
||||
disabled:
|
||||
description: |-
|
||||
Define if rate limiting should be disabled.
|
||||
Default: false
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
clients.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of clients referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
local:
|
||||
description: LocalConf defines local http or/and tcp rate
|
||||
limit configuration
|
||||
properties:
|
||||
http:
|
||||
description: |-
|
||||
LocalHTTP defines configuration of local HTTP rate limiting
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/local_rate_limit_filter
|
||||
properties:
|
||||
disabled:
|
||||
description: Define if rate limiting should be disabled.
|
||||
type: boolean
|
||||
onRateLimit:
|
||||
description: Describes the actions to take on a
|
||||
rate limit event
|
||||
properties:
|
||||
headers:
|
||||
description: The Headers to be added to the
|
||||
HTTP response on a rate limit event
|
||||
properties:
|
||||
add:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
set:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
status:
|
||||
description: The HTTP status code to be set
|
||||
on a rate limit event
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
requestRate:
|
||||
description: Defines how many requests are allowed
|
||||
per interval.
|
||||
properties:
|
||||
interval:
|
||||
description: The interval the number of units
|
||||
is accounted for.
|
||||
type: string
|
||||
num:
|
||||
description: |-
|
||||
Number of units per interval (depending on usage it can be a number of requests,
|
||||
or a number of connections).
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- interval
|
||||
- num
|
||||
type: object
|
||||
type: object
|
||||
tcp:
|
||||
description: |-
|
||||
LocalTCP defines confguration of local TCP rate limiting
|
||||
https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/local_rate_limit_filter
|
||||
properties:
|
||||
connectionRate:
|
||||
description: Defines how many connections are allowed
|
||||
per interval.
|
||||
properties:
|
||||
interval:
|
||||
description: The interval the number of units
|
||||
is accounted for.
|
||||
type: string
|
||||
num:
|
||||
description: |-
|
||||
Number of units per interval (depending on usage it can be a number of requests,
|
||||
or a number of connections).
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- interval
|
||||
- num
|
||||
type: object
|
||||
disabled:
|
||||
description: |-
|
||||
Define if rate limiting should be disabled.
|
||||
Default: false
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
clients.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,507 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshretries.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshRetry
|
||||
listKind: MeshRetryList
|
||||
plural: meshretries
|
||||
singular: meshretry
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshRetry resource.
|
||||
properties:
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between the consumed services and
|
||||
corresponding configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
grpc:
|
||||
description: GRPC defines a configuration of retries for
|
||||
GRPC traffic
|
||||
properties:
|
||||
backOff:
|
||||
description: |-
|
||||
BackOff is a configuration of durations which will be used in an exponential
|
||||
backoff strategy between retries.
|
||||
properties:
|
||||
baseInterval:
|
||||
default: 25ms
|
||||
description: |-
|
||||
BaseInterval is an amount of time which should be taken between retries.
|
||||
Must be greater than zero. Values less than 1 ms are rounded up to 1 ms.
|
||||
type: string
|
||||
maxInterval:
|
||||
description: |-
|
||||
MaxInterval is a maximal amount of time which will be taken between retries.
|
||||
Default is 10 times the "BaseInterval".
|
||||
type: string
|
||||
type: object
|
||||
numRetries:
|
||||
description: |-
|
||||
NumRetries is the number of attempts that will be made on failed (and
|
||||
retriable) requests. If not set, the default value is 1.
|
||||
format: int32
|
||||
type: integer
|
||||
perTryTimeout:
|
||||
description: |-
|
||||
PerTryTimeout is the maximum amount of time each retry attempt can take
|
||||
before it times out. If not set, the global request timeout for the route
|
||||
will be used. Setting this value to 0 will disable the per-try timeout.
|
||||
type: string
|
||||
rateLimitedBackOff:
|
||||
description: |-
|
||||
RateLimitedBackOff is a configuration of backoff which will be used when
|
||||
the upstream returns one of the headers configured.
|
||||
properties:
|
||||
maxInterval:
|
||||
default: 300s
|
||||
description: MaxInterval is a maximal amount of
|
||||
time which will be taken between retries.
|
||||
type: string
|
||||
resetHeaders:
|
||||
description: |-
|
||||
ResetHeaders specifies the list of headers (like Retry-After or X-RateLimit-Reset)
|
||||
to match against the response. Headers are tried in order, and matched
|
||||
case-insensitive. The first header to be parsed successfully is used.
|
||||
If no headers match the default exponential BackOff is used instead.
|
||||
items:
|
||||
properties:
|
||||
format:
|
||||
description: The format of the reset header.
|
||||
enum:
|
||||
- Seconds
|
||||
- UnixTimestamp
|
||||
type: string
|
||||
name:
|
||||
description: The Name of the reset header.
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
required:
|
||||
- format
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
retryOn:
|
||||
description: RetryOn is a list of conditions which will
|
||||
cause a retry.
|
||||
example:
|
||||
- Canceled
|
||||
- DeadlineExceeded
|
||||
- Internal
|
||||
- ResourceExhausted
|
||||
- Unavailable
|
||||
items:
|
||||
enum:
|
||||
- Canceled
|
||||
- DeadlineExceeded
|
||||
- Internal
|
||||
- ResourceExhausted
|
||||
- Unavailable
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
http:
|
||||
description: HTTP defines a configuration of retries for
|
||||
HTTP traffic
|
||||
properties:
|
||||
backOff:
|
||||
description: |-
|
||||
BackOff is a configuration of durations which will be used in exponential
|
||||
backoff strategy between retries.
|
||||
properties:
|
||||
baseInterval:
|
||||
default: 25ms
|
||||
description: |-
|
||||
BaseInterval is an amount of time which should be taken between retries.
|
||||
Must be greater than zero. Values less than 1 ms are rounded up to 1 ms.
|
||||
type: string
|
||||
maxInterval:
|
||||
description: |-
|
||||
MaxInterval is a maximal amount of time which will be taken between retries.
|
||||
Default is 10 times the "BaseInterval".
|
||||
type: string
|
||||
type: object
|
||||
hostSelection:
|
||||
description: |-
|
||||
HostSelection is a list of predicates that dictate how hosts should be selected
|
||||
when requests are retried.
|
||||
items:
|
||||
properties:
|
||||
predicate:
|
||||
description: Type is requested predicate mode.
|
||||
enum:
|
||||
- OmitPreviousHosts
|
||||
- OmitHostsWithTags
|
||||
- OmitPreviousPriorities
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags is a map of metadata to match against for selecting the omitted hosts. Required if Type is
|
||||
OmitHostsWithTags
|
||||
type: object
|
||||
updateFrequency:
|
||||
default: 2
|
||||
description: |-
|
||||
UpdateFrequency is how often the priority load should be updated based on previously attempted priorities.
|
||||
Used for OmitPreviousPriorities.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- predicate
|
||||
type: object
|
||||
type: array
|
||||
hostSelectionMaxAttempts:
|
||||
description: |-
|
||||
HostSelectionMaxAttempts is the maximum number of times host selection will be
|
||||
reattempted before giving up, at which point the host that was last selected will
|
||||
be routed to. If unspecified, this will default to retrying once.
|
||||
format: int64
|
||||
type: integer
|
||||
numRetries:
|
||||
description: |-
|
||||
NumRetries is the number of attempts that will be made on failed (and
|
||||
retriable) requests. If not set, the default value is 1.
|
||||
format: int32
|
||||
type: integer
|
||||
perTryTimeout:
|
||||
description: |-
|
||||
PerTryTimeout is the amount of time after which retry attempt should time out.
|
||||
If left unspecified, the global route timeout for the request will be used.
|
||||
Consequently, when using a 5xx based retry policy, a request that times out
|
||||
will not be retried as the total timeout budget would have been exhausted.
|
||||
Setting this timeout to 0 will disable it.
|
||||
type: string
|
||||
rateLimitedBackOff:
|
||||
description: |-
|
||||
RateLimitedBackOff is a configuration of backoff which will be used
|
||||
when the upstream returns one of the headers configured.
|
||||
properties:
|
||||
maxInterval:
|
||||
default: 300s
|
||||
description: MaxInterval is a maximal amount of
|
||||
time which will be taken between retries.
|
||||
type: string
|
||||
resetHeaders:
|
||||
description: |-
|
||||
ResetHeaders specifies the list of headers (like Retry-After or X-RateLimit-Reset)
|
||||
to match against the response. Headers are tried in order, and matched
|
||||
case-insensitive. The first header to be parsed successfully is used.
|
||||
If no headers match the default exponential BackOff is used instead.
|
||||
items:
|
||||
properties:
|
||||
format:
|
||||
description: The format of the reset header.
|
||||
enum:
|
||||
- Seconds
|
||||
- UnixTimestamp
|
||||
type: string
|
||||
name:
|
||||
description: The Name of the reset header.
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
required:
|
||||
- format
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
retriableRequestHeaders:
|
||||
description: |-
|
||||
RetriableRequestHeaders is an HTTP headers which must be present in the request
|
||||
for retries to be attempted.
|
||||
items:
|
||||
description: |-
|
||||
HeaderMatch describes how to select an HTTP route by matching HTTP request
|
||||
headers.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the HTTP Header to be matched. Name MUST be lower case
|
||||
as they will be handled with case insensitivity (See https://tools.ietf.org/html/rfc7230#section-3.2).
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
type:
|
||||
default: Exact
|
||||
description: Type specifies how to match against
|
||||
the value of the header.
|
||||
enum:
|
||||
- Exact
|
||||
- Present
|
||||
- RegularExpression
|
||||
- Absent
|
||||
- Prefix
|
||||
type: string
|
||||
value:
|
||||
description: Value is the value of HTTP Header
|
||||
to be matched.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
retriableResponseHeaders:
|
||||
description: |-
|
||||
RetriableResponseHeaders is an HTTP response headers that trigger a retry
|
||||
if present in the response. A retry will be triggered if any of the header
|
||||
matches the upstream response headers.
|
||||
items:
|
||||
description: |-
|
||||
HeaderMatch describes how to select an HTTP route by matching HTTP request
|
||||
headers.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the HTTP Header to be matched. Name MUST be lower case
|
||||
as they will be handled with case insensitivity (See https://tools.ietf.org/html/rfc7230#section-3.2).
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
type:
|
||||
default: Exact
|
||||
description: Type specifies how to match against
|
||||
the value of the header.
|
||||
enum:
|
||||
- Exact
|
||||
- Present
|
||||
- RegularExpression
|
||||
- Absent
|
||||
- Prefix
|
||||
type: string
|
||||
value:
|
||||
description: Value is the value of HTTP Header
|
||||
to be matched.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
retryOn:
|
||||
description: |-
|
||||
RetryOn is a list of conditions which will cause a retry. Available values are:
|
||||
[5XX, GatewayError, Reset, Retriable4xx, ConnectFailure, EnvoyRatelimited,
|
||||
RefusedStream, Http3PostConnectFailure, HttpMethodConnect, HttpMethodDelete,
|
||||
HttpMethodGet, HttpMethodHead, HttpMethodOptions, HttpMethodPatch,
|
||||
HttpMethodPost, HttpMethodPut, HttpMethodTrace].
|
||||
Also, any HTTP status code (500, 503, etc.).
|
||||
example:
|
||||
- 5XX
|
||||
- GatewayError
|
||||
- Reset
|
||||
- Retriable4xx
|
||||
- ConnectFailure
|
||||
- EnvoyRatelimited
|
||||
- RefusedStream
|
||||
- Http3PostConnectFailure
|
||||
- HttpMethodConnect
|
||||
- HttpMethodDelete
|
||||
- HttpMethodGet
|
||||
- HttpMethodHead
|
||||
- HttpMethodOptions
|
||||
- HttpMethodPatch
|
||||
- HttpMethodPost
|
||||
- HttpMethodPut
|
||||
- HttpMethodTrace
|
||||
- "500"
|
||||
- "503"
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
tcp:
|
||||
description: TCP defines a configuration of retries for
|
||||
TCP traffic
|
||||
properties:
|
||||
maxConnectAttempt:
|
||||
description: |-
|
||||
MaxConnectAttempt is a maximal amount of TCP connection attempts
|
||||
which will be made before giving up
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,195 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshservices.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshService
|
||||
listKind: MeshServiceList
|
||||
plural: meshservices
|
||||
singular: meshservice
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshService resource.
|
||||
properties:
|
||||
identities:
|
||||
items:
|
||||
properties:
|
||||
type:
|
||||
enum:
|
||||
- ServiceTag
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
ports:
|
||||
items:
|
||||
properties:
|
||||
appProtocol:
|
||||
default: tcp
|
||||
description: Protocol identifies a protocol supported by a service.
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
port:
|
||||
format: int32
|
||||
type: integer
|
||||
targetPort:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
x-kubernetes-int-or-string: true
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- port
|
||||
- appProtocol
|
||||
x-kubernetes-list-type: map
|
||||
selector:
|
||||
properties:
|
||||
dataplaneRef:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
dataplaneTags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: Status is the current status of the Kuma MeshService resource.
|
||||
properties:
|
||||
addresses:
|
||||
items:
|
||||
properties:
|
||||
hostname:
|
||||
type: string
|
||||
hostnameGeneratorRef:
|
||||
properties:
|
||||
coreName:
|
||||
type: string
|
||||
required:
|
||||
- coreName
|
||||
type: object
|
||||
origin:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
hostnameGenerators:
|
||||
items:
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions is an array of hostname generator conditions.
|
||||
items:
|
||||
properties:
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
hostnameGeneratorRef:
|
||||
properties:
|
||||
coreName:
|
||||
type: string
|
||||
required:
|
||||
- coreName
|
||||
type: object
|
||||
required:
|
||||
- hostnameGeneratorRef
|
||||
type: object
|
||||
type: array
|
||||
tls:
|
||||
properties:
|
||||
status:
|
||||
enum:
|
||||
- Ready
|
||||
- NotReady
|
||||
type: string
|
||||
type: object
|
||||
vips:
|
||||
items:
|
||||
properties:
|
||||
ip:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,281 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshtcproutes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshTCPRoute
|
||||
listKind: MeshTCPRouteList
|
||||
plural: meshtcproutes
|
||||
singular: meshtcproute
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshTCPRoute resource.
|
||||
properties:
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined in-place.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: |-
|
||||
To list makes a match between the consumed services and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
rules:
|
||||
description: |-
|
||||
Rules contains the routing rules applies to a combination of top-level
|
||||
targetRef and the targetRef in this entry.
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default holds routing rules that can be merged with rules from other
|
||||
policies.
|
||||
properties:
|
||||
backendRefs:
|
||||
items:
|
||||
description: BackendRef defines where to forward
|
||||
traffic.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use
|
||||
to identify cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
port:
|
||||
description: Port is only supported when this
|
||||
ref refers to a real MeshService object
|
||||
format: int32
|
||||
type: integer
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
weight:
|
||||
default: 1
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
- backendRefs
|
||||
type: object
|
||||
required:
|
||||
- default
|
||||
type: object
|
||||
maxItems: 1
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,362 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshtimeouts.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshTimeout
|
||||
listKind: MeshTimeoutList
|
||||
plural: meshtimeouts
|
||||
singular: meshtimeout
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshTimeout resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of clients referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
connectionTimeout:
|
||||
description: |-
|
||||
ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
|
||||
Default value is 5 seconds. Cannot be set to 0.
|
||||
type: string
|
||||
http:
|
||||
description: Http provides configuration for HTTP specific
|
||||
timeouts
|
||||
properties:
|
||||
maxConnectionDuration:
|
||||
description: |-
|
||||
MaxConnectionDuration is the time after which a connection will be drained and/or closed,
|
||||
starting from when it was first established. Setting this timeout to 0 will disable it.
|
||||
Disabled by default.
|
||||
type: string
|
||||
maxStreamDuration:
|
||||
description: |-
|
||||
MaxStreamDuration is the maximum time that a stream’s lifetime will span.
|
||||
Setting this timeout to 0 will disable it. Disabled by default.
|
||||
type: string
|
||||
requestHeadersTimeout:
|
||||
description: |-
|
||||
RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
|
||||
activated when the first byte of the headers is received, and is disarmed when the last byte of
|
||||
the headers has been received. If not specified or set to 0, this timeout is disabled.
|
||||
Disabled by default.
|
||||
type: string
|
||||
requestTimeout:
|
||||
description: |-
|
||||
RequestTimeout The amount of time that proxy will wait for the entire request to be received.
|
||||
The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
|
||||
OR when the response is initiated. Setting this timeout to 0 will disable it.
|
||||
Default is 15s.
|
||||
type: string
|
||||
streamIdleTimeout:
|
||||
description: |-
|
||||
StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
|
||||
Setting this timeout to 0 will disable it. Default is 30m
|
||||
type: string
|
||||
type: object
|
||||
idleTimeout:
|
||||
description: |-
|
||||
IdleTimeout is defined as the period in which there are no bytes sent or received on connection
|
||||
Setting this timeout to 0 will disable it. Be cautious when disabling it because
|
||||
it can lead to connection leaking. Default value is 1h.
|
||||
type: string
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
clients.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
to:
|
||||
description: To list makes a match between the consumed services and
|
||||
corresponding configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of destinations referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
connectionTimeout:
|
||||
description: |-
|
||||
ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
|
||||
Default value is 5 seconds. Cannot be set to 0.
|
||||
type: string
|
||||
http:
|
||||
description: Http provides configuration for HTTP specific
|
||||
timeouts
|
||||
properties:
|
||||
maxConnectionDuration:
|
||||
description: |-
|
||||
MaxConnectionDuration is the time after which a connection will be drained and/or closed,
|
||||
starting from when it was first established. Setting this timeout to 0 will disable it.
|
||||
Disabled by default.
|
||||
type: string
|
||||
maxStreamDuration:
|
||||
description: |-
|
||||
MaxStreamDuration is the maximum time that a stream’s lifetime will span.
|
||||
Setting this timeout to 0 will disable it. Disabled by default.
|
||||
type: string
|
||||
requestHeadersTimeout:
|
||||
description: |-
|
||||
RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
|
||||
activated when the first byte of the headers is received, and is disarmed when the last byte of
|
||||
the headers has been received. If not specified or set to 0, this timeout is disabled.
|
||||
Disabled by default.
|
||||
type: string
|
||||
requestTimeout:
|
||||
description: |-
|
||||
RequestTimeout The amount of time that proxy will wait for the entire request to be received.
|
||||
The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
|
||||
OR when the response is initiated. Setting this timeout to 0 will disable it.
|
||||
Default is 15s.
|
||||
type: string
|
||||
streamIdleTimeout:
|
||||
description: |-
|
||||
StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
|
||||
Setting this timeout to 0 will disable it. Default is 30m
|
||||
type: string
|
||||
type: object
|
||||
idleTimeout:
|
||||
description: |-
|
||||
IdleTimeout is defined as the period in which there are no bytes sent or received on connection
|
||||
Setting this timeout to 0 will disable it. Be cautious when disabling it because
|
||||
it can lead to connection leaking. Default value is 1h.
|
||||
type: string
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
destinations.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshtraces.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshTrace
|
||||
listKind: MeshTraceList
|
||||
plural: meshtraces
|
||||
singular: meshtrace
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshTrace resource.
|
||||
properties:
|
||||
default:
|
||||
description: MeshTrace configuration.
|
||||
properties:
|
||||
backends:
|
||||
description: |-
|
||||
A one element array of backend definition.
|
||||
Envoy allows configuring only 1 backend, so the natural way of
|
||||
representing that would be just one object. Unfortunately due to the
|
||||
reasons explained in MADR 009-tracing-policy this has to be a one element
|
||||
array for now.
|
||||
items:
|
||||
description: Only one of zipkin, datadog or openTelemetry can
|
||||
be used.
|
||||
properties:
|
||||
datadog:
|
||||
description: Datadog backend configuration.
|
||||
properties:
|
||||
splitService:
|
||||
default: false
|
||||
description: |-
|
||||
Determines if datadog service name should be split based on traffic
|
||||
direction and destination. For example, with `splitService: true` and a
|
||||
`backend` service that communicates with a couple of databases, you would
|
||||
get service names like `backend_INBOUND`, `backend_OUTBOUND_db1`, and
|
||||
`backend_OUTBOUND_db2` in Datadog.
|
||||
type: boolean
|
||||
url:
|
||||
description: |-
|
||||
Address of Datadog collector, only host and port are allowed (no paths,
|
||||
fragments etc.)
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
openTelemetry:
|
||||
description: OpenTelemetry backend configuration.
|
||||
properties:
|
||||
endpoint:
|
||||
description: Address of OpenTelemetry collector.
|
||||
example: otel-collector:4317
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
type:
|
||||
enum:
|
||||
- Zipkin
|
||||
- Datadog
|
||||
- OpenTelemetry
|
||||
type: string
|
||||
zipkin:
|
||||
description: Zipkin backend configuration.
|
||||
properties:
|
||||
apiVersion:
|
||||
default: httpJson
|
||||
description: |-
|
||||
Version of the API.
|
||||
https://github.com/envoyproxy/envoy/blob/v1.22.0/api/envoy/config/trace/v3/zipkin.proto#L66
|
||||
enum:
|
||||
- httpJson
|
||||
- httpProto
|
||||
type: string
|
||||
sharedSpanContext:
|
||||
default: true
|
||||
description: |-
|
||||
Determines whether client and server spans will share the same span
|
||||
context.
|
||||
https://github.com/envoyproxy/envoy/blob/v1.22.0/api/envoy/config/trace/v3/zipkin.proto#L63
|
||||
type: boolean
|
||||
traceId128bit:
|
||||
default: false
|
||||
description: Generate 128bit traces.
|
||||
type: boolean
|
||||
url:
|
||||
description: Address of Zipkin collector.
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
maxItems: 1
|
||||
type: array
|
||||
sampling:
|
||||
description: |-
|
||||
Sampling configuration.
|
||||
Sampling is the process by which a decision is made on whether to
|
||||
process/export a span or not.
|
||||
properties:
|
||||
client:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
default: 100
|
||||
description: |-
|
||||
Target percentage of requests that will be force traced if the
|
||||
'x-client-trace-id' header is set. Mirror of client_sampling in Envoy
|
||||
https://github.com/envoyproxy/envoy/blob/v1.22.0/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto#L127-L133
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
overall:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
default: 100
|
||||
description: |-
|
||||
Target percentage of requests will be traced
|
||||
after all other sampling checks have been applied (client, force tracing,
|
||||
random sampling). This field functions as an upper limit on the total
|
||||
configured sampling rate. For instance, setting client to 100
|
||||
but overall to 1 will result in only 1% of client requests with
|
||||
the appropriate headers to be force traced. Mirror of
|
||||
overall_sampling in Envoy
|
||||
https://github.com/envoyproxy/envoy/blob/v1.22.0/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto#L142-L150
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
random:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
default: 100
|
||||
description: |-
|
||||
Target percentage of requests that will be randomly selected for trace
|
||||
generation, if not requested by the client or not forced.
|
||||
Mirror of random_sampling in Envoy
|
||||
https://github.com/envoyproxy/envoy/blob/v1.22.0/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto#L135-L140
|
||||
Either int or decimal represented as string.
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
tags:
|
||||
description: |-
|
||||
Custom tags configuration. You can add custom tags to traces based on
|
||||
headers or literal values.
|
||||
items:
|
||||
description: |-
|
||||
Custom tags configuration.
|
||||
Only one of literal or header can be used.
|
||||
properties:
|
||||
header:
|
||||
description: Tag taken from a header.
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default value to use if header is missing.
|
||||
If the default is missing and there is no value the tag will not be
|
||||
included.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the header.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
literal:
|
||||
description: Tag taken from literal value.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the tag.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,203 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: meshtrafficpermissions.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: MeshTrafficPermission
|
||||
listKind: MeshTrafficPermissionList
|
||||
plural: meshtrafficpermissions
|
||||
singular: meshtrafficpermission
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.targetRef.kind
|
||||
name: TargetRef Kind
|
||||
type: string
|
||||
- jsonPath: .spec.targetRef.name
|
||||
name: TargetRef Name
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma MeshTrafficPermission
|
||||
resource.
|
||||
properties:
|
||||
from:
|
||||
description: From list makes a match between clients and corresponding
|
||||
configurations
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
description: |-
|
||||
Default is a configuration specific to the group of clients referenced in
|
||||
'targetRef'
|
||||
properties:
|
||||
action:
|
||||
description: 'Action defines a behavior for the specified
|
||||
group of clients:'
|
||||
enum:
|
||||
- Allow
|
||||
- Deny
|
||||
- AllowWithShadowDeny
|
||||
type: string
|
||||
type: object
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource that represents a group of
|
||||
clients.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify
|
||||
cross mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: array
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is a reference to the resource the policy takes an effect on.
|
||||
The resource could be either a real store object or virtual resource
|
||||
defined inplace.
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the referenced resource
|
||||
enum:
|
||||
- Mesh
|
||||
- MeshSubset
|
||||
- MeshGateway
|
||||
- MeshService
|
||||
- MeshExternalService
|
||||
- MeshServiceSubset
|
||||
- MeshHTTPRoute
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Labels are used to select group of MeshServices that match labels. Either Labels or
|
||||
Name and Namespace can be used.
|
||||
type: object
|
||||
mesh:
|
||||
description: Mesh is reserved for future use to identify cross
|
||||
mesh resources.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced resource. Can only be used with kinds: `MeshService`,
|
||||
`MeshServiceSubset` and `MeshGatewayRoute`
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace specifies the namespace of target resource. If empty only resources in policy namespace
|
||||
will be targeted.
|
||||
type: string
|
||||
proxyTypes:
|
||||
description: |-
|
||||
ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
|
||||
all data plane types are targeted by the policy.
|
||||
items:
|
||||
enum:
|
||||
- Sidecar
|
||||
- Gateway
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is used to target specific section of resource.
|
||||
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
|
||||
type: string
|
||||
tags:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Tags used to select a subset of proxies by tags. Can only be used with kinds
|
||||
`MeshSubset` and `MeshServiceSubset`
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- targetRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: proxytemplates.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ProxyTemplate
|
||||
listKind: ProxyTemplateList
|
||||
plural: proxytemplates
|
||||
singular: proxytemplate
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ProxyTemplate resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: ratelimits.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: RateLimit
|
||||
listKind: RateLimitList
|
||||
plural: ratelimits
|
||||
singular: ratelimit
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma RateLimit resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: retries.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: Retry
|
||||
listKind: RetryList
|
||||
plural: retries
|
||||
singular: retry
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma Retry resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: serviceinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ServiceInsight
|
||||
listKind: ServiceInsightList
|
||||
plural: serviceinsights
|
||||
singular: serviceinsight
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ServiceInsight resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: timeouts.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: Timeout
|
||||
listKind: TimeoutList
|
||||
plural: timeouts
|
||||
singular: timeout
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma Timeout resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: trafficlogs.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: TrafficLog
|
||||
listKind: TrafficLogList
|
||||
plural: trafficlogs
|
||||
singular: trafficlog
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma TrafficLog resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: trafficpermissions.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: TrafficPermission
|
||||
listKind: TrafficPermissionList
|
||||
plural: trafficpermissions
|
||||
singular: trafficpermission
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma TrafficPermission resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: trafficroutes.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: TrafficRoute
|
||||
listKind: TrafficRouteList
|
||||
plural: trafficroutes
|
||||
singular: trafficroute
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma TrafficRoute resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: traffictraces.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: TrafficTrace
|
||||
listKind: TrafficTraceList
|
||||
plural: traffictraces
|
||||
singular: traffictrace
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma TrafficTrace resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: virtualoutbounds.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: VirtualOutbound
|
||||
listKind: VirtualOutboundList
|
||||
plural: virtualoutbounds
|
||||
singular: virtualoutbound
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma VirtualOutbound resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zoneegresses.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ZoneEgress
|
||||
listKind: ZoneEgressList
|
||||
plural: zoneegresses
|
||||
singular: zoneegress
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Zone name
|
||||
jsonPath: .spec.zone
|
||||
name: zone
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ZoneEgress resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zoneegressinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ZoneEgressInsight
|
||||
listKind: ZoneEgressInsightList
|
||||
plural: zoneegressinsights
|
||||
singular: zoneegressinsight
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ZoneEgressInsight resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zoneingresses.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ZoneIngress
|
||||
listKind: ZoneIngressList
|
||||
plural: zoneingresses
|
||||
singular: zoneingress
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Zone name
|
||||
jsonPath: .spec.zone
|
||||
name: zone
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ZoneIngress resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zoneingressinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ZoneIngressInsight
|
||||
listKind: ZoneIngressInsightList
|
||||
plural: zoneingressinsights
|
||||
singular: zoneingressinsight
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ZoneIngressInsight
|
||||
resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zoneinsights.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: ZoneInsight
|
||||
listKind: ZoneInsightList
|
||||
plural: zoneinsights
|
||||
singular: zoneinsight
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma ZoneInsight resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: zones.kuma.io
|
||||
spec:
|
||||
group: kuma.io
|
||||
names:
|
||||
categories:
|
||||
- kuma
|
||||
kind: Zone
|
||||
listKind: ZoneList
|
||||
plural: zones
|
||||
singular: zone
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
mesh:
|
||||
description: |-
|
||||
Mesh is the name of the Kuma mesh this resource belongs to.
|
||||
It may be omitted for cluster-scoped resources.
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec is the specification of the Kuma Zone resource.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{{ .Chart.Name }} has been installed!
|
||||
|
||||
Your release is named '{{ .Release.Name }}'.
|
||||
|
||||
You can access the control-plane via either the GUI, kubectl, the HTTP API, or the kumactl CLI.
|
||||
{{- if .Values.noHelmHooks }}
|
||||
|
||||
-------------------------------------------------------------------------------
|
||||
|
||||
WARNING
|
||||
|
||||
When the "noHelmHooks" value is provided, you will need to manually delete
|
||||
the "ValidatingWebhookConfiguration" responsible for validating {{ include "kuma.name" . }} resources
|
||||
before you can uninstall Helm release. This is because the validation provided
|
||||
by the webhook is not necessary during the release removal and might potentially
|
||||
even prevent you from doing it. You can do this by running the following command:
|
||||
|
||||
kubectl delete ValidatingWebhookConfiguration {{ include "kuma.name" . }}-validating-webhook-configuration
|
||||
|
||||
WARNING
|
||||
|
||||
When the "noHelmHooks" value is set, Helm will not automatically update
|
||||
the CustomResourceDefinitions (CRDs) when upgrading release. You must manually
|
||||
update the CRDs if the new {{ include "kuma.name" . }} version has changes
|
||||
to the CRDs. You can achieve this by calling the following command:
|
||||
|
||||
kumactl install crds --no-config | kubectl apply -f
|
||||
|
||||
{{- if and .Values.experimental.ebpf.enabled (not .Values.cni.enabled) }}
|
||||
|
||||
WARNING
|
||||
|
||||
When the "noHelmHooks" value is set, Helm will not automatically uninstall
|
||||
the eBPF resources. You will need to manually uninstall these resources after
|
||||
uninstalling Helm release. To do this, run the following command:
|
||||
|
||||
kumactl uninstall ebpf --cleanup-image-registry {{ .Values.global.image.registry }} --cleanup-image-repository {{ .Values.dataPlane.initImage.repository }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
-------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,402 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "kuma.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
This is the Kuma version the chart is intended to be used with.
|
||||
*/}}
|
||||
{{- define "kuma.appVersion" -}}
|
||||
{{- .Chart.AppVersion -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
This is only used in the `kuma.formatImage` function below.
|
||||
*/}}
|
||||
{{- define "kuma.defaultRegistry" -}}
|
||||
docker.io/kumahq
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.product" -}}
|
||||
Kuma
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.tagPrefix" -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "kuma.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "kuma.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.controlPlane.serviceName" -}}
|
||||
{{- $defaultSvcName := printf "%s-control-plane" (include "kuma.name" .) -}}
|
||||
{{ printf "%s" (default $defaultSvcName .Values.controlPlane.service.name) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.controlPlane.globalZoneSync.serviceName" -}}
|
||||
{{- $defaultSvcName := printf "%s-global-zone-sync" (include "kuma.name" .) -}}
|
||||
{{ printf "%s" (default $defaultSvcName .Values.controlPlane.globalZoneSyncService.name) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.ingress.serviceName" -}}
|
||||
{{- $defaultSvcName := printf "%s-ingress" (include "kuma.name" .) -}}
|
||||
{{ printf "%s" (default $defaultSvcName .Values.ingress.service.name) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.egress.serviceName" -}}
|
||||
{{- $defaultSvcName := printf "%s-egress" (include "kuma.name" .) -}}
|
||||
{{ printf "%s" (default $defaultSvcName .Values.egress.service.name) }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "kuma.labels" -}}
|
||||
helm.sh/chart: {{ include "kuma.chart" . }}
|
||||
{{ include "kuma.selectorLabels" . }}
|
||||
{{- if (include "kuma.appVersion" .) }}
|
||||
app.kubernetes.io/version: {{ (include "kuma.appVersion" .) | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "kuma.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "kuma.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
CNI labels
|
||||
*/}}
|
||||
{{- define "kuma.cniLabels" -}}
|
||||
app: {{ include "kuma.name" . }}-cni
|
||||
{{ include "kuma.labels" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
control plane labels
|
||||
*/}}
|
||||
{{- define "kuma.cpLabels" -}}
|
||||
app: {{ include "kuma.name" . }}-control-plane
|
||||
{{- range $key, $value := $.Values.controlPlane.extraLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{ include "kuma.labels" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
control plane deployment annotations
|
||||
*/}}
|
||||
{{- define "kuma.cpDeploymentAnnotations" -}}
|
||||
{{- range $key, $value := $.Values.controlPlane.deploymentAnnotations }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
ingress labels
|
||||
*/}}
|
||||
{{- define "kuma.ingressLabels" -}}
|
||||
app: {{ include "kuma.name" . }}-ingress
|
||||
{{- range $key, $value := .Values.ingress.extraLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{ include "kuma.labels" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
egress labels
|
||||
*/}}
|
||||
{{- define "kuma.egressLabels" -}}
|
||||
app: {{ include "kuma.name" . }}-egress
|
||||
{{ range $key, $value := .Values.egress.extraLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{ end }}
|
||||
{{- include "kuma.labels" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
CNI selector labels
|
||||
*/}}
|
||||
{{- define "kuma.cniSelectorLabels" -}}
|
||||
app: {{ include "kuma.name" . }}-cni
|
||||
{{ include "kuma.selectorLabels" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
params: { image: { registry?, repository, tag? }, root: $ }
|
||||
returns: formatted image string
|
||||
*/}}
|
||||
{{- define "kuma.formatImage" -}}
|
||||
{{- $img := .image }}
|
||||
{{- $root := .root }}
|
||||
{{- $registry := ($img.registry | default $root.Values.global.image.registry) -}}
|
||||
{{- $repo := ($img.repository | required "Must specify image repository") -}}
|
||||
{{- $product := (include "kuma.product" .) }}
|
||||
{{- $tagPrefix := (include "kuma.tagPrefix" .) }}
|
||||
{{- $expectedVersion := (include "kuma.appVersion" $root) }}
|
||||
{{- if
|
||||
and
|
||||
$root.Values.global.image.tag
|
||||
(ne $root.Values.global.image.tag (include "kuma.appVersion" $root))
|
||||
(eq $root.Values.global.image.registry (include "kuma.defaultRegistry" .))
|
||||
-}}
|
||||
{{- fail (
|
||||
printf "This chart only supports %s version %q but %sglobal.image.tag is set to %q. Set %sglobal.image.tag to %q or skip this check by setting %s*.image.tag for each individual component."
|
||||
$product $expectedVersion $tagPrefix $root.Values.global.image.tag $tagPrefix $expectedVersion $tagPrefix
|
||||
) -}}
|
||||
{{- end -}}
|
||||
{{- $defaultTag := ($root.Values.global.image.tag | default (include "kuma.appVersion" $root)) -}}
|
||||
{{- $tag := ($img.tag | default $defaultTag) -}}
|
||||
{{- printf "%s/%s:%s" $registry $repo $tag -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kuma.parentEnv" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kuma.parentSecrets" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kuma.pluginPoliciesEnabled" -}}
|
||||
{{- $list := list -}}
|
||||
{{- range $k, $v := .Values.plugins.policies -}}
|
||||
{{- if $v -}}
|
||||
{{- $list = append $list (printf "%s" $k) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{ join "," $list }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kuma.defaultEnv" -}}
|
||||
env:
|
||||
{{ include "kuma.parentEnv" . }}
|
||||
- name: KUMA_ENVIRONMENT
|
||||
value: "kubernetes"
|
||||
- name: KUMA_STORE_TYPE
|
||||
value: "kubernetes"
|
||||
- name: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
|
||||
value: {{ .Release.Namespace | quote }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
|
||||
value: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
- name: KUMA_GENERAL_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/tls-cert/tls.crt
|
||||
- name: KUMA_GENERAL_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/tls-cert/tls.key
|
||||
{{- if eq .Values.controlPlane.mode "zone" }}
|
||||
- name: KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
|
||||
value: {{ .Values.controlPlane.kdsGlobalAddress }}
|
||||
{{- end }}
|
||||
- name: KUMA_DP_SERVER_HDS_ENABLED
|
||||
value: "false"
|
||||
- name: KUMA_API_SERVER_READ_ONLY
|
||||
value: "true"
|
||||
- name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
|
||||
value: {{ .Values.controlPlane.admissionServerPort | default "5443" | quote }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
|
||||
value: /var/run/secrets/kuma.io/tls-cert
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
|
||||
value: {{ .Values.cni.enabled | quote }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
|
||||
value: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.image "root" $) | quote }}
|
||||
- name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
|
||||
value: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.initImage "root" $) | quote }}
|
||||
{{- if .Values.dataPlane.dnsLogging }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/tls-cert/ca.crt
|
||||
- name: KUMA_DEFAULTS_SKIP_MESH_CREATION
|
||||
value: {{ .Values.controlPlane.defaults.skipMeshCreation | quote }}
|
||||
- name: KUMA_MODE
|
||||
value: {{ .Values.controlPlane.mode | quote }}
|
||||
{{- if .Values.controlPlane.zone }}
|
||||
- name: KUMA_MULTIZONE_ZONE_NAME
|
||||
value: {{ .Values.controlPlane.zone | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.secretName }}
|
||||
- name: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/api-server-tls-cert/tls.crt
|
||||
- name: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/api-server-tls-cert/tls.key
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.clientCertsSecretName }}
|
||||
- name: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
|
||||
value: /var/run/secrets/kuma.io/api-server-client-certs/
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.controlPlane.mode "global") (or .Values.controlPlane.tls.kdsGlobalServer.secretName .Values.controlPlane.tls.kdsGlobalServer.create) }}
|
||||
- name: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-server-tls-cert/tls.crt
|
||||
- name: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-server-tls-cert/tls.key
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.controlPlane.mode "zone") (or .Values.controlPlane.tls.kdsZoneClient.secretName .Values.controlPlane.tls.kdsZoneClient.create) }}
|
||||
- name: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-client-tls-cert/ca.crt
|
||||
{{- end }}
|
||||
- name: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
|
||||
value: "false"
|
||||
- name: KUMA_RUNTIME_KUBERNETES_ALLOWED_USERS
|
||||
value: "system:serviceaccount:{{ .Release.Namespace }}:{{ include "kuma.name" . }}-control-plane"
|
||||
{{- if .Values.experimental.sidecarContainers }}
|
||||
- name: KUMA_EXPERIMENTAL_SIDECAR_CONTAINERS
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.cni.enabled }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
|
||||
value: "true"
|
||||
- name: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
|
||||
value: "{{ include "kuma.name" . }}-cni"
|
||||
- name: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
|
||||
value: {{ .Values.cni.namespace }}
|
||||
{{- end }}
|
||||
{{- if .Values.experimental.ebpf.enabled }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
|
||||
value: "true"
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
|
||||
value: {{ .Values.experimental.ebpf.instanceIPEnvVarName }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
|
||||
value: {{ .Values.experimental.ebpf.bpffsPath }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
|
||||
value: {{ .Values.experimental.ebpf.cgroupPath }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
|
||||
value: {{ .Values.experimental.ebpf.tcAttachIface }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
|
||||
value: {{ .Values.experimental.ebpf.programsSourcePath }}
|
||||
{{- end }}
|
||||
{{- if not .Values.experimental.deltaKds }}
|
||||
- name: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
|
||||
value: "false"
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.kdsZoneClient.skipVerify }}
|
||||
- name: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: KUMA_PLUGIN_POLICIES_ENABLED
|
||||
value: {{ include "kuma.pluginPoliciesEnabled" . | quote }}
|
||||
{{- if .Values.controlPlane.supportGatewaySecretsInAllNamespaces }}
|
||||
- name: KUMA_RUNTIME_KUBERNETES_SUPPORT_GATEWAY_SECRETS_IN_ALL_NAMESPACES
|
||||
value: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.controlPlane.tls.general.caSecretName" -}}
|
||||
{{ .Values.controlPlane.tls.general.caSecretName | default .Values.controlPlane.tls.general.secretName | default (printf "%s-tls-cert" (include "kuma.name" .)) | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "kuma.universal.defaultEnv" -}}
|
||||
{{ if eq .Values.controlPlane.mode "zone" }}
|
||||
{{ if .Values.ingress.enabled }}
|
||||
{{ fail "Can't have ingress.enabled when running controlPlane.mode=='universal'" }}
|
||||
{{ end }}
|
||||
{{ if .Values.egress.enabled }}
|
||||
{{ fail "Can't have egress.enabled when running controlPlane.mode=='universal'" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
env:
|
||||
- name: KUMA_PLUGIN_POLICIES_ENABLED
|
||||
value: {{ include "kuma.pluginPoliciesEnabled" . | quote }}
|
||||
- name: KUMA_GENERAL_WORK_DIR
|
||||
value: "/tmp/kuma"
|
||||
- name: KUMA_ENVIRONMENT
|
||||
value: "universal"
|
||||
- name: KUMA_STORE_TYPE
|
||||
value: "postgres"
|
||||
- name: KUMA_STORE_POSTGRES_PORT
|
||||
value: "{{ .Values.postgres.port }}"
|
||||
- name: KUMA_DEFAULTS_SKIP_MESH_CREATION
|
||||
value: {{ .Values.controlPlane.defaults.skipMeshCreation | quote }}
|
||||
{{ if and (eq .Values.controlPlane.mode "zone") .Values.controlPlane.tls.general.secretName }}
|
||||
- name: KUMA_GENERAL_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/tls-cert/tls.crt
|
||||
- name: KUMA_GENERAL_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/tls-cert/tls.key
|
||||
{{ end }}
|
||||
- name: KUMA_MODE
|
||||
value: {{ .Values.controlPlane.mode | quote }}
|
||||
{{- if eq .Values.controlPlane.mode "zone" }}
|
||||
- name: KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
|
||||
value: {{ .Values.controlPlane.kdsGlobalAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.zone }}
|
||||
- name: KUMA_MULTIZONE_ZONE_NAME
|
||||
value: {{ .Values.controlPlane.zone | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.controlPlane.mode "zone") (or .Values.controlPlane.tls.kdsZoneClient.secretName .Values.controlPlane.tls.kdsZoneClient.create) }}
|
||||
- name: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-client-tls-cert/ca.crt
|
||||
{{- end }}
|
||||
{{- if not .Values.experimental.deltaKds }}
|
||||
- name: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
|
||||
value: "false"
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.kdsZoneClient.skipVerify }}
|
||||
- name: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.secretName }}
|
||||
- name: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/api-server-tls-cert/tls.crt
|
||||
- name: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/api-server-tls-cert/tls.key
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.clientCertsSecretName }}
|
||||
- name: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
|
||||
value: /var/run/secrets/kuma.io/api-server-client-certs/
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.kdsGlobalServer.secretName }}
|
||||
- name: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-server-tls-cert/tls.crt
|
||||
- name: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
|
||||
value: /var/run/secrets/kuma.io/kds-server-tls-cert/tls.key
|
||||
{{- end }}
|
||||
- name: KUMA_STORE_POSTGRES_TLS_MODE
|
||||
value: {{ .Values.postgres.tls.mode }}
|
||||
{{- if or (eq .Values.postgres.tls.mode "verifyCa") (eq .Values.postgres.tls.mode "verifyFull") }}
|
||||
{{- if empty .Values.postgres.tls.caSecretName }}
|
||||
{{ fail "if mode is 'verifyCa' or 'verifyFull' then you must provide .Values.postgres.tls.caSecretName" }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.secretName }}
|
||||
- name: KUMA_STORE_POSTGRES_TLS_CERT_PATH
|
||||
value: /var/run/secrets/kuma.io/postgres-tls-cert/tls.crt
|
||||
- name: KUMA_STORE_POSTGRES_TLS_KEY_PATH
|
||||
value: /var/run/secrets/kuma.io/postgres-tls-cert/tls.key
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.caSecretName }}
|
||||
- name: KUMA_STORE_POSTGRES_TLS_CA_PATH
|
||||
value: /var/run/secrets/kuma.io/postgres-tls-cert/ca.crt
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.disableSSLSNI }}
|
||||
- name: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
|
||||
value: {{ .Values.postgres.tls.disableSSLSNI }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{{- if and .Values.cni.enabled (not .Values.experimental.ebpf.enabled) }}
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cni-config
|
||||
namespace: {{ .Values.cni.namespace }}
|
||||
labels: {{ include "kuma.cniLabels" . | nindent 4 }}
|
||||
data:
|
||||
# The CNI network configuration to add to the plugin chain on each node.
|
||||
cni_network_config: |-
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "kuma-cni",
|
||||
"type": "kuma-cni",
|
||||
"log_level": "{{ .Values.cni.logLevel }}",
|
||||
"kubernetes": {
|
||||
"kubeconfig": "__KUBECONFIG_FILEPATH__",
|
||||
"cni_bin_dir": "{{ .Values.cni.binDir }}",
|
||||
"exclude_namespaces": [ "kube-system" ]
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,152 @@
|
|||
{{- if .Values.cni.enabled }}
|
||||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cni-node
|
||||
namespace: {{ .Values.cni.namespace }}
|
||||
annotations:
|
||||
ignore-check.kube-linter.io/run-as-non-root: "The container installs a CNI plugin"
|
||||
labels: {{- include "kuma.cniLabels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.cniSelectorLabels" . | nindent 6 }}
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kuma.cniSelectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/cni-configmap.yaml") . | sha256sum }}
|
||||
{{- range $key, $value := .Values.cni.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
# This, along with the CriticalAddonsOnly toleration below,
|
||||
# marks the pod as a critical add-on, ensuring it gets
|
||||
# priority scheduling and that its resources are reserved
|
||||
# if it ever gets evicted.
|
||||
priorityClassName: system-node-critical
|
||||
{{- with .Values.cni.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cni.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
# Make sure kuma-cni-node gets scheduled on all nodes.
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
# Mark the pod as a critical add-on for rescheduling.
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
serviceAccountName: {{ include "kuma.name" . }}-cni
|
||||
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
|
||||
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
|
||||
terminationGracePeriodSeconds: 5
|
||||
securityContext:
|
||||
{{- toYaml .Values.cni.podSecurityContext | trim | nindent 8 }}
|
||||
containers:
|
||||
- name: install-cni
|
||||
imagePullPolicy: {{ .Values.cni.image.imagePullPolicy }}
|
||||
{{- if not .Values.experimental.ebpf.enabled }}
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.cni.image "root" $) | quote }}
|
||||
readinessProbe:
|
||||
initialDelaySeconds: {{ .Values.cni.delayStartupSeconds }}
|
||||
exec:
|
||||
command:
|
||||
- cat
|
||||
- /tmp/ready
|
||||
command: [ "sh", "-c", "--" ]
|
||||
args: [ "sleep {{.Values.cni.delayStartupSeconds}} && exec /install-cni" ]
|
||||
{{- else }}
|
||||
{{- with .Values.cni.experimental.imageEbpf }}
|
||||
image: {{ printf "%s/%s:%s" .registry .repository .tag | quote }}
|
||||
{{- end }}
|
||||
args:
|
||||
- /app/mbctl
|
||||
- --mode=kuma
|
||||
- --use-reconnect=true
|
||||
- --cni-mode=true
|
||||
{{- if eq .Values.cni.logLevel "debug" }}
|
||||
- --debug=true
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- make
|
||||
- --keep-going
|
||||
- clean
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.cni.containerSecurityContext | trim | nindent 12 }}
|
||||
{{- if .Values.experimental.ebpf.enabled }}
|
||||
privileged: true
|
||||
{{- end }}
|
||||
{{- if not .Values.experimental.ebpf.enabled }}
|
||||
env:
|
||||
# Name of the CNI config file to create.
|
||||
- name: CNI_CONF_NAME
|
||||
value: "{{ .Values.cni.confName }}"
|
||||
# The CNI network config to install on each node.
|
||||
- name: CNI_NETWORK_CONFIG
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "kuma.name" . }}-cni-config
|
||||
key: cni_network_config
|
||||
- name: CNI_NET_DIR
|
||||
value: "{{ .Values.cni.netDir }}"
|
||||
# If true, deploy as a chained CNI plugin, otherwise deploy as a standalone CNI
|
||||
- name: CHAINED_CNI_PLUGIN
|
||||
value: "{{ .Values.cni.chained }}"
|
||||
- name: CNI_LOG_LEVEL
|
||||
value: "{{ .Values.cni.logLevel }}"
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.cni.resources | trim | nindent 12 }}
|
||||
volumeMounts:
|
||||
- mountPath: /host/opt/cni/bin
|
||||
name: cni-bin-dir
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
{{- if .Values.experimental.ebpf.enabled }}
|
||||
- mountPath: /sys/fs/cgroup
|
||||
name: sys-fs-cgroup
|
||||
- mountPath: /host/proc
|
||||
name: host-proc
|
||||
- mountPath: /host/var/run
|
||||
name: host-var-run
|
||||
mountPropagation: Bidirectional
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
# Used to install CNI.
|
||||
- name: cni-bin-dir
|
||||
hostPath:
|
||||
path: {{ .Values.cni.binDir }}
|
||||
- name: cni-net-dir
|
||||
hostPath:
|
||||
path: {{ .Values.cni.netDir }}
|
||||
{{- if .Values.experimental.ebpf.enabled }}
|
||||
- hostPath:
|
||||
path: /var/run
|
||||
name: host-var-run
|
||||
- hostPath:
|
||||
path: /sys/fs/cgroup
|
||||
name: sys-fs-cgroup
|
||||
- hostPath:
|
||||
path: /proc
|
||||
name: host-proc
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{{- if .Values.cni.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cni
|
||||
namespace: {{ .Values.cni.namespace }}
|
||||
labels: {{ include "kuma.cniLabels" . | nindent 4 }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cni
|
||||
labels:
|
||||
{{ include "kuma.cniLabels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
{{- if .Values.experimental.ebpf.enabled }}
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cni
|
||||
labels:
|
||||
{{ include "kuma.cniLabels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-cni
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "kuma.name" . }}-cni
|
||||
namespace: {{ .Values.cni.namespace }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{{ $kumaCpLabels := include "kuma.cpLabels" . }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ $kumaCpLabels | nindent 4 }}
|
||||
data:
|
||||
config.yaml: |
|
||||
# use this file to override default configuration of `kuma-cp`
|
||||
#
|
||||
# see conf/kuma-cp.conf.yml for available settings
|
||||
{{ if .Values.controlPlane.config }}
|
||||
{{ .Values.controlPlane.config | nindent 4 }}
|
||||
{{ end }}
|
||||
|
||||
{{- $releaseNamespace := .Release.Namespace}}
|
||||
{{- range $extraConfigMap := .Values.controlPlane.extraConfigMaps }}
|
||||
{{- if $extraConfigMap.values }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $extraConfigMap.name }}
|
||||
namespace: {{ $releaseNamespace }}
|
||||
labels: {{ $kumaCpLabels | nindent 4 }}
|
||||
data:
|
||||
{{- range $fileName, $fileContents := $extraConfigMap.values }}
|
||||
{{- $fileName | nindent 2 }}: |
|
||||
{{- $fileContents | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,398 @@
|
|||
{{ $kdsGlobalServerTLSSecretName := "" }}
|
||||
{{ if eq .Values.controlPlane.mode "global" }}
|
||||
{{ $kdsGlobalServerTLSSecretName = .Values.controlPlane.tls.kdsGlobalServer.secretName }}
|
||||
{{ if and .Values.controlPlane.tls.kdsGlobalServer.create (not $kdsGlobalServerTLSSecretName) }}
|
||||
{{ $kdsGlobalServerTLSSecretName = print (include "kuma.name" .) "-kds-global-server-tls" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{ $kdsZoneClientTLSSecretName := "" }}
|
||||
{{ if eq .Values.controlPlane.mode "zone" }}
|
||||
{{ $kdsZoneClientTLSSecretName = .Values.controlPlane.tls.kdsZoneClient.secretName }}
|
||||
{{ if and .Values.controlPlane.tls.kdsZoneClient.create (not $kdsZoneClientTLSSecretName) }}
|
||||
{{ $kdsZoneClientTLSSecretName = print (include "kuma.name" .) "-kds-zone-client-tls" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{ if not (or (eq .Values.controlPlane.mode "zone") (eq .Values.controlPlane.mode "global") (eq .Values.controlPlane.mode "standalone")) }}
|
||||
{{ $msg := printf "controlPlane.mode invalid got:'%s' supported values: global,zone,standalone" .Values.controlPlane.mode }}
|
||||
{{ fail $msg }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.controlPlane.mode "zone" }}
|
||||
{{ if not (empty .Values.controlPlane.zone) }}
|
||||
{{ if gt (len .Values.controlPlane.zone) 253 }}
|
||||
{{ fail "controlPlane.zone must be no more than 253 characters" }}
|
||||
{{ else }}
|
||||
{{ if not (regexMatch "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$" .Values.controlPlane.zone) }}
|
||||
{{ fail "controlPlane.zone must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ if not (empty .Values.controlPlane.kdsGlobalAddress) }}
|
||||
{{ $url := urlParse .Values.controlPlane.kdsGlobalAddress }}
|
||||
{{ if not (or (eq $url.scheme "grpcs") (eq $url.scheme "grpc")) }}
|
||||
{{ $msg := printf "controlPlane.kdsGlobalAddress must be a url with scheme grpcs:// or grpc:// got:'%s'" .Values.controlPlane.kdsGlobalAddress }}
|
||||
{{ fail $msg }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ else }}
|
||||
{{ if not (empty .Values.controlPlane.zone) }}
|
||||
{{ fail "Can't specify a controlPlane.zone when controlPlane.mode!='zone'" }}
|
||||
{{ end }}
|
||||
{{ if not (empty .Values.controlPlane.kdsGlobalAddress) }}
|
||||
{{ fail "Can't specify a controlPlane.kdsGlobalAddress when controlPlane.mode!='zone'" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- $defaultEnv := include "kuma.defaultEnv" . | fromYaml | pluck "env" | first }}
|
||||
{{- if eq .Values.controlPlane.environment "universal" }}
|
||||
{{- $defaultEnv = include "kuma.universal.defaultEnv" . | fromYaml | pluck "env" | first }}
|
||||
{{- end }}
|
||||
{{- $defaultEnvDict := dict }}
|
||||
{{- range $index, $item := $defaultEnv }}
|
||||
{{- $name := $item.name | upper }}
|
||||
{{- $defaultEnvDict := set $defaultEnvDict $name $item.value }}
|
||||
{{- end }}
|
||||
{{- $envVarsCopy := deepCopy .Values.controlPlane.envVars }}
|
||||
{{- $mergedEnv := merge $envVarsCopy $defaultEnvDict }}
|
||||
{{- $defaultSecrets := include "kuma.parentSecrets" . | fromYaml }}
|
||||
{{- $extraSecrets := .Values.controlPlane.extraSecrets }}
|
||||
{{- $mergedSecrets := merge $extraSecrets $defaultSecrets }}
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
annotations: {{ include "kuma.cpDeploymentAnnotations" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.controlPlane.autoscaling.enabled }}
|
||||
replicas: {{ .Values.controlPlane.replicas }}
|
||||
{{- end }}
|
||||
minReadySeconds: {{ .Values.controlPlane.minReadySeconds }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-control-plane
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/cp-configmap.yaml") . | sha256sum }}
|
||||
{{- if .Values.restartOnSecretChange }}
|
||||
checksum/tls-secrets: {{ include (print $.Template.BasePath "/cp-webhooks-and-secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $.Values.controlPlane.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.controlPlane.affinity }}
|
||||
affinity: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
{{- with .Values.controlPlane.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.controlPlane.podSecurityContext | trim | nindent 8 }}
|
||||
serviceAccountName: {{ include "kuma.name" . }}-control-plane
|
||||
automountServiceAccountToken: {{ .Values.controlPlane.automountServiceAccountToken }}
|
||||
{{- with .Values.controlPlane.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controlPlane.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostNetwork: {{ .Values.controlPlane.hostNetwork }}
|
||||
terminationGracePeriodSeconds: {{ .Values.controlPlane.terminationGracePeriodSeconds }}
|
||||
{{- if (eq .Values.controlPlane.environment "universal") }}
|
||||
initContainers:
|
||||
- name: migration
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.controlPlane.image "root" $) | quote }}
|
||||
imagePullPolicy: {{ .Values.controlPlane.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.controlPlane.containerSecurityContext | trim | nindent 12 }}
|
||||
env:
|
||||
{{- range $key, $value := $mergedEnv }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $element := .Values.controlPlane.secrets }}
|
||||
- name: {{ $element.Env }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $element.Secret }}
|
||||
key: {{ $element.Key }}
|
||||
{{- end }}
|
||||
args:
|
||||
- migrate
|
||||
- up
|
||||
- --log-level=info
|
||||
- --config-file=/etc/kuma.io/kuma-control-plane/config.yaml
|
||||
resources:
|
||||
{{- if .Values.controlPlane.resources }}
|
||||
{{- .Values.controlPlane.resources | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.postgres.tls.caSecretName }}
|
||||
- name: postgres-tls-cert-ca
|
||||
subPath: ca.crt
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/ca.crt
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.secretName }}
|
||||
- name: postgres-tls-cert
|
||||
subPath: tls.crt
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/tls.crt
|
||||
readOnly: true
|
||||
- name: postgres-tls-cert
|
||||
subPath: tls.key
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/tls.key
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: {{ include "kuma.name" . }}-control-plane-config
|
||||
mountPath: /etc/kuma.io/kuma-control-plane
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: control-plane
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.controlPlane.image "root" $) | quote }}
|
||||
imagePullPolicy: {{ .Values.controlPlane.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.controlPlane.containerSecurityContext | trim | nindent 12 }}
|
||||
env:
|
||||
{{- range $key, $value := $mergedEnv }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $element := .Values.controlPlane.secrets }}
|
||||
- name: {{ $element.Env }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $element.Secret }}
|
||||
key: {{ $element.Key }}
|
||||
{{- end }}
|
||||
- name: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
args:
|
||||
- run
|
||||
- --log-level={{ .Values.controlPlane.logLevel }}
|
||||
- --log-output-path={{ .Values.controlPlane.logOutputPath }}
|
||||
- --config-file=/etc/kuma.io/kuma-control-plane/config.yaml
|
||||
ports:
|
||||
- containerPort: 5680
|
||||
name: diagnostics
|
||||
protocol: TCP
|
||||
- containerPort: 5681
|
||||
- containerPort: 5682
|
||||
- containerPort: {{ .Values.controlPlane.admissionServerPort | default "5443" }}
|
||||
{{- if ne .Values.controlPlane.mode "global" }}
|
||||
- containerPort: 5678
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
timeoutSeconds: 10
|
||||
httpGet:
|
||||
path: /healthy
|
||||
port: 5680
|
||||
readinessProbe:
|
||||
timeoutSeconds: 10
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 5680
|
||||
resources:
|
||||
{{- if .Values.controlPlane.resources }}
|
||||
{{- .Values.controlPlane.resources | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{ with .Values.controlPlane.lifecycle }}
|
||||
lifecycle: {{ . | toYaml | nindent 14 }}
|
||||
{{ end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.controlPlane.environment "kubernetes" }}
|
||||
{{- if not .Values.controlPlane.automountServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: general-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
|
||||
subPath: tls.crt
|
||||
readOnly: true
|
||||
- name: general-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
|
||||
subPath: tls.key
|
||||
readOnly: true
|
||||
- name: general-tls-cert{{- if .Values.controlPlane.tls.general.caSecretName }}-ca{{- end }}
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
|
||||
subPath: ca.crt
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.controlPlane.environment "universal") (eq .Values.controlPlane.mode "zone") }}
|
||||
{{- if .Values.controlPlane.tls.general.secretName }}
|
||||
- name: general-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
|
||||
subPath: tls.crt
|
||||
readOnly: true
|
||||
- name: general-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
|
||||
subPath: tls.key
|
||||
readOnly: true
|
||||
- name: general-tls-cert{{- if .Values.controlPlane.tls.general.caSecretName }}-ca{{- end }}
|
||||
mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
|
||||
subPath: ca.crt
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: {{ include "kuma.name" . }}-control-plane-config
|
||||
mountPath: /etc/kuma.io/kuma-control-plane
|
||||
readOnly: true
|
||||
{{- if .Values.controlPlane.tls.apiServer.secretName }}
|
||||
- name: api-server-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/api-server-tls-cert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.caSecretName }}
|
||||
- name: postgres-tls-cert-ca
|
||||
subPath: ca.crt
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/ca.crt
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.secretName }}
|
||||
- name: postgres-tls-cert
|
||||
subPath: tls.crt
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/tls.crt
|
||||
readOnly: true
|
||||
- name: postgres-tls-cert
|
||||
subPath: tls.key
|
||||
mountPath: /var/run/secrets/kuma.io/postgres-tls-cert/tls.key
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.clientCertsSecretName }}
|
||||
- name: api-server-client-certs
|
||||
mountPath: /var/run/secrets/kuma.io/api-server-client-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $kdsGlobalServerTLSSecretName }}
|
||||
- name: kds-server-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/kds-server-tls-cert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $kdsZoneClientTLSSecretName }}
|
||||
- name: kds-client-tls-cert
|
||||
mountPath: /var/run/secrets/kuma.io/kds-client-tls-cert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- range $extraConfigMap := .Values.controlPlane.extraConfigMaps }}
|
||||
- name: {{ $extraConfigMap.name }}
|
||||
mountPath: {{ $extraConfigMap.mountPath }}
|
||||
readOnly: {{ $extraConfigMap.readOnly }}
|
||||
{{- end }}
|
||||
{{- range $mergedSecret := $mergedSecrets }}
|
||||
- name: {{ $mergedSecret.name }}
|
||||
mountPath: {{ $mergedSecret.mountPath }}
|
||||
subPath: {{ $mergedSecret.subPath }}
|
||||
readOnly: {{ $mergedSecret.readOnly }}
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
{{- if eq .Values.controlPlane.environment "kubernetes" }}
|
||||
{{- if not .Values.controlPlane.automountServiceAccountToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 420
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.general.secretName }}
|
||||
- name: general-tls-cert
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.general.secretName }}
|
||||
{{- else }}
|
||||
- name: general-tls-cert
|
||||
secret:
|
||||
secretName: {{ include "kuma.name" . }}-tls-cert
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.general.caSecretName }}
|
||||
- name: general-tls-cert-ca
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.general.caSecretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.controlPlane.environment "universal") (eq .Values.controlPlane.mode "zone") }}
|
||||
{{- if .Values.controlPlane.tls.general.secretName }}
|
||||
- name: general-tls-cert
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.general.secretName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.general.caSecretName }}
|
||||
- name: general-tls-cert-ca
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.general.caSecretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.secretName }}
|
||||
- name: api-server-tls-cert
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.apiServer.secretName }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.caSecretName }}
|
||||
- name: postgres-tls-cert-ca
|
||||
secret:
|
||||
secretName: {{ .Values.postgres.tls.caSecretName }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgres.tls.secretName }}
|
||||
- name: postgres-tls-cert
|
||||
secret:
|
||||
secretName: {{ .Values.postgres.tls.secretName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.tls.apiServer.clientCertsSecretName }}
|
||||
- name: api-server-client-certs
|
||||
secret:
|
||||
secretName: {{ .Values.controlPlane.tls.apiServer.clientCertsSecretName }}
|
||||
{{- end }}
|
||||
{{- if $kdsGlobalServerTLSSecretName }}
|
||||
- name: kds-server-tls-cert
|
||||
secret:
|
||||
secretName: {{ $kdsGlobalServerTLSSecretName }}
|
||||
{{- end }}
|
||||
{{- if $kdsZoneClientTLSSecretName }}
|
||||
- name: kds-client-tls-cert
|
||||
secret:
|
||||
secretName: {{ $kdsZoneClientTLSSecretName }}
|
||||
{{- end }}
|
||||
- name: {{ include "kuma.name" . }}-control-plane-config
|
||||
configMap:
|
||||
name: {{ include "kuma.name" . }}-control-plane-config
|
||||
{{- range $extraConfigMap := .Values.controlPlane.extraConfigMaps }}
|
||||
- name: {{ $extraConfigMap.name }}
|
||||
configMap:
|
||||
name: {{ $extraConfigMap.name }}
|
||||
{{- end }}
|
||||
{{- range $mergedSecret := $mergedSecrets }}
|
||||
- name: {{ $mergedSecret.name }}
|
||||
secret:
|
||||
secretName: {{ $mergedSecret.name }}
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{{- if and (eq .Values.controlPlane.mode "global") .Values.controlPlane.globalZoneSyncService.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "kuma.controlPlane.globalZoneSync.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.controlPlane.globalZoneSyncService.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.controlPlane.globalZoneSyncService.type }}
|
||||
{{- if .Values.controlPlane.globalZoneSyncService.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.controlPlane.globalZoneSyncService.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.controlPlane.globalZoneSyncService.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- range .Values.controlPlane.globalZoneSyncService.loadBalancerSourceRanges }}
|
||||
- {{.}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.controlPlane.globalZoneSyncService.port }}
|
||||
appProtocol: {{ .Values.controlPlane.globalZoneSyncService.protocol }}
|
||||
{{- if and (eq .Values.controlPlane.globalZoneSyncService.type "NodePort") .Values.controlPlane.globalZoneSyncService.nodePort }}
|
||||
nodePort: {{ .Values.controlPlane.globalZoneSyncService.nodePort }}
|
||||
{{- end }}
|
||||
name: global-zone-sync
|
||||
selector:
|
||||
app: {{ include "kuma.name" . }}-control-plane
|
||||
{{ include "kuma.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{{- if .Values.controlPlane.autoscaling.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
apiVersion: "autoscaling/v2"
|
||||
{{ else }}
|
||||
apiVersion: "autoscaling/v1"
|
||||
{{ end }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
minReplicas: {{ .Values.controlPlane.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.controlPlane.autoscaling.maxReplicas }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
metrics: {{- toYaml .Values.controlPlane.autoscaling.metrics | nindent 4 }}
|
||||
{{ else }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.controlPlane.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{{- if .Values.controlPlane.ingress.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.controlPlane.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
spec:
|
||||
ingressClassName: {{ .Values.controlPlane.ingress.ingressClassName }}
|
||||
rules:
|
||||
- host: {{ .Values.controlPlane.ingress.hostname }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ .Values.controlPlane.ingress.path }}
|
||||
pathType: {{ .Values.controlPlane.ingress.pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
port:
|
||||
number: {{ .Values.controlPlane.ingress.servicePort }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{{ if and (eq .Values.controlPlane.mode "global") .Values.controlPlane.tls.kdsGlobalServer.create }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
{{ with .Values.controlPlane.tls.kdsGlobalServer.secretName }}
|
||||
name: {{ . }}
|
||||
{{ else }}
|
||||
name: {{ include "kuma.name" . }}-kds-global-server-tls
|
||||
{{ end }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
stringData:
|
||||
tls.crt: {{ required "you must provide a kds tls cert" .Values.controlPlane.tls.kdsGlobalServer.cert | quote }}
|
||||
tls.key: {{ required "you must provide a kds tls key" .Values.controlPlane.tls.kdsGlobalServer.key | quote }}
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{{ if and (eq .Values.controlPlane.mode "zone") .Values.controlPlane.tls.kdsZoneClient.create }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
{{ with .Values.controlPlane.tls.kdsZoneClient.secretName }}
|
||||
name: {{ . }}
|
||||
{{ else }}
|
||||
name: {{ include "kuma.name" . }}-kds-zone-client-tls
|
||||
{{ end }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
stringData:
|
||||
ca.crt: {{ required "you must provide a kds cert" .Values.controlPlane.tls.kdsZoneClient.cert | quote }}
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{{ if $.Values.controlPlane.podDisruptionBudget.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
apiVersion: policy/v1
|
||||
{{ else if .Capabilities.APIVersions.Has "policy/v1beta1" }}
|
||||
apiVersion: policy/v1beta1
|
||||
{{ else }}
|
||||
{{ fail "pod disruption budgets are not supported by this version of kubernetes" }}
|
||||
{{ end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.controlPlane.podDisruptionBudget.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-control-plane
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,315 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
{{- with .Values.controlPlane.serviceAccountAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (eq .Values.controlPlane.environment "kubernetes") }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- pods
|
||||
- configmaps
|
||||
- nodes
|
||||
{{- if .Values.controlPlane.supportGatewaySecretsInAllNamespaces }}
|
||||
- secrets
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "discovery.k8s.io"
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "apps"
|
||||
resources:
|
||||
- deployments
|
||||
- replicasets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses
|
||||
- gateways
|
||||
- referencegrants
|
||||
- httproutes
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses/status
|
||||
- gateways/status
|
||||
- httproutes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- delete
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- "discovery.k8s.io"
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kuma.io
|
||||
resources:
|
||||
- dataplanes
|
||||
- dataplaneinsights
|
||||
- meshes
|
||||
- zones
|
||||
- zoneinsights
|
||||
- zoneingresses
|
||||
- zoneingressinsights
|
||||
- zoneegresses
|
||||
- zoneegressinsights
|
||||
- meshinsights
|
||||
- serviceinsights
|
||||
- proxytemplates
|
||||
- ratelimits
|
||||
- trafficpermissions
|
||||
- trafficroutes
|
||||
- timeouts
|
||||
- retries
|
||||
- circuitbreakers
|
||||
- virtualoutbounds
|
||||
- containerpatches
|
||||
- externalservices
|
||||
- faultinjections
|
||||
- healthchecks
|
||||
- trafficlogs
|
||||
- traffictraces
|
||||
- meshgateways
|
||||
- meshgatewayroutes
|
||||
- meshgatewayinstances
|
||||
- meshgatewayconfigs
|
||||
{{- range $policy, $v := .Values.plugins.policies }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{- range $policy, $v := .Values.plugins.resources }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- kuma.io
|
||||
resources:
|
||||
- meshgatewayinstances/status
|
||||
- meshgatewayinstances/finalizers
|
||||
- meshes/finalizers
|
||||
- dataplanes/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- if .Values.cni.enabled }}
|
||||
- apiGroups:
|
||||
- k8s.cni.cncf.io
|
||||
resources:
|
||||
- network-attachment-definitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- "pods"
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
{{- end }}
|
||||
# validate k8s token before issuing mTLS cert
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
# leader-for-life election deletes Pods in some circumstances
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "kuma.name" . }}-control-plane
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{{ if .Values.controlPlane.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.controlPlane.service.annotations }}
|
||||
{{- if $value }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.controlPlane.service.type }}
|
||||
ports:
|
||||
- port: 5680
|
||||
name: diagnostics
|
||||
appProtocol: http
|
||||
- port: 5681
|
||||
name: http-api-server
|
||||
appProtocol: http
|
||||
{{- if and (eq .Values.controlPlane.service.type "NodePort") .Values.controlPlane.service.apiServer.http.nodePort }}
|
||||
nodePort: {{ .Values.controlPlane.service.apiServer.http.nodePort }}
|
||||
{{- end }}
|
||||
- port: 5682
|
||||
name: https-api-server
|
||||
appProtocol: https
|
||||
{{- if and (eq .Values.controlPlane.service.type "NodePort") .Values.controlPlane.service.apiServer.https.nodePort }}
|
||||
nodePort: {{ .Values.controlPlane.service.apiServer.https.nodePort }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.controlPlane.environment "universal" }}
|
||||
- port: 443
|
||||
name: https-admission-server
|
||||
targetPort: {{ .Values.controlPlane.admissionServerPort | default "5443" }}
|
||||
appProtocol: https
|
||||
{{- end }}
|
||||
{{- if ne .Values.controlPlane.mode "global" }}
|
||||
- port: 5676
|
||||
name: mads-server
|
||||
appProtocol: https
|
||||
- port: 5678
|
||||
name: dp-server
|
||||
appProtocol: https
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ include "kuma.name" . }}-control-plane
|
||||
{{- include "kuma.selectorLabels" . | nindent 4 }}
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,337 @@
|
|||
{{- if not (eq (empty .Values.controlPlane.tls.general.caBundle) (empty .Values.controlPlane.tls.general.secretName)) }}
|
||||
{{ fail "You need to send both or neither of controlPlane.tls.general.caBundle and controlPlane.tls.general.secretName"}}
|
||||
{{- end }}
|
||||
{{- $caBundle := .Values.controlPlane.tls.general.caBundle }}
|
||||
{{/*
|
||||
Generate certificates
|
||||
see: https://masterminds.github.io/sprig/crypto.html
|
||||
see: https://medium.com/nuvo-group-tech/move-your-certs-to-helm-4f5f61338aca
|
||||
see: https://github.com/networkservicemesh/networkservicemesh/blob/804ad5026bb5dbd285c220f15395fe25e46f5edb/deployments/helm/nsm/charts/admission-webhook/templates/admission-webhook-secret.tpl
|
||||
|
||||
We only autogenerate certs if user did not chose their own secret.
|
||||
We only autogenerate certs if the cert is not yet generated. This way we keep the secrets between HELM upgrades.
|
||||
*/}}
|
||||
|
||||
{{- if eq .Values.controlPlane.tls.general.secretName "" -}}
|
||||
{{- $cert := "" }}
|
||||
{{- $key := "" }}
|
||||
{{- $secretName := print (include "kuma.name" .) "-tls-cert" }}
|
||||
|
||||
{{- $secret := (lookup "v1" "Secret" .Release.Namespace $secretName) -}}
|
||||
{{- if $secret -}}
|
||||
{{- $cert = index $secret.data "tls.crt" -}}
|
||||
{{- $key = index $secret.data "tls.key" -}}
|
||||
{{- $caBundle = index $secret.data "ca.crt" -}}
|
||||
{{- else -}}
|
||||
{{- $commonName := (include "kuma.controlPlane.serviceName" .) -}}
|
||||
{{- $altNames := list (printf "%s.%s" $commonName .Release.Namespace) (printf "%s.%s.svc" $commonName .Release.Namespace) -}}
|
||||
{{- $certTTL := 3650 -}}
|
||||
{{- $ca := genCA "kuma-ca" $certTTL -}}
|
||||
|
||||
{{- $genCert := genSignedCert $commonName nil $altNames $certTTL $ca -}}
|
||||
{{- $cert = $genCert.Cert | b64enc -}}
|
||||
{{- $key = $genCert.Key | b64enc -}}
|
||||
{{ $caBundle = $ca.Cert | b64enc }}
|
||||
{{- end -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: kubernetes.io/tls
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
data:
|
||||
tls.crt: {{ $cert }}
|
||||
tls.key: {{ $key }}
|
||||
ca.crt: {{ $caBundle }}
|
||||
{{- end }}
|
||||
{{- if (eq .Values.controlPlane.environment "kubernetes") }}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-admission-mutating-webhook-configuration
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- name: mesh.defaulter.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: Fail
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /default-kuma-io-v1alpha1-mesh
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kuma.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- meshes
|
||||
- meshgateways
|
||||
{{- range $policy, $v := .Values.plugins.policies }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{- range $policy, $v := .Values.plugins.resources }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
sideEffects: None
|
||||
- name: owner-reference.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: Fail
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /owner-reference-kuma-io-v1alpha1
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kuma.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- circuitbreakers
|
||||
- externalservices
|
||||
- faultinjections
|
||||
- healthchecks
|
||||
- meshgateways
|
||||
- meshgatewayroutes
|
||||
- proxytemplates
|
||||
- ratelimits
|
||||
- retries
|
||||
- timeouts
|
||||
- trafficlogs
|
||||
- trafficpermissions
|
||||
- trafficroutes
|
||||
- traffictraces
|
||||
- virtualoutbounds
|
||||
{{- range $policy, $v := .Values.plugins.policies }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{- range $policy, $v := .Values.plugins.resources }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{ .Values.controlPlane.webhooks.ownerReference.additionalRules | nindent 6 }}
|
||||
sideEffects: None
|
||||
{{- if ne .Values.controlPlane.mode "global" }}
|
||||
- name: namespace-kuma-injector.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: {{ .Values.controlPlane.injectorFailurePolicy }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
- key: kuma.io/sidecar-injection
|
||||
operator: In
|
||||
values: ["enabled", "true"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /inject-sidecar
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- pods
|
||||
sideEffects: None
|
||||
- name: pods-kuma-injector.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: {{ .Values.controlPlane.injectorFailurePolicy }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
objectSelector:
|
||||
matchLabels:
|
||||
kuma.io/sidecar-injection: enabled
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /inject-sidecar
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- pods
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-validating-webhook-configuration
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.cpLabels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- name: validator.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: Fail
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /validate-kuma-io-v1alpha1
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kuma.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- circuitbreakers
|
||||
- dataplanes
|
||||
- externalservices
|
||||
- faultinjections
|
||||
- meshgatewayinstances
|
||||
- healthchecks
|
||||
- meshes
|
||||
- meshgateways
|
||||
- meshgatewayroutes
|
||||
- proxytemplates
|
||||
- ratelimits
|
||||
- retries
|
||||
- trafficlogs
|
||||
- trafficpermissions
|
||||
- trafficroutes
|
||||
- traffictraces
|
||||
- virtualoutbounds
|
||||
- zones
|
||||
- containerpatches
|
||||
{{- range $policy, $v := .Values.plugins.policies }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{- range $policy, $v := .Values.plugins.resources }}
|
||||
{{- if $v }}
|
||||
- {{ $policy }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{ .Values.controlPlane.webhooks.validator.additionalRules | nindent 6 }}
|
||||
sideEffects: None
|
||||
{{- if ne .Values.controlPlane.mode "global" }}
|
||||
- name: service.validator.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: Ignore
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /validate-v1-service
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- services
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
- name: secret.validator.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
kuma.io/system-namespace: "true"
|
||||
failurePolicy: Ignore
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /validate-v1-secret
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- secrets
|
||||
sideEffects: None
|
||||
- name: gateway.validator.kuma-admission.kuma.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
failurePolicy: Ignore
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: NotIn
|
||||
values: ["kube-system"]
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundle }}
|
||||
service:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ include "kuma.controlPlane.serviceName" . }}
|
||||
path: /validate-gatewayclass
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "gateway.networking.k8s.io"
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- gatewayclasses
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,137 @@
|
|||
{{- if .Values.egress.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-egress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.egressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
{{- if not .Values.egress.autoscaling.enabled }}
|
||||
replicas: {{ .Values.egress.replicas }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-egress
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/egress: enabled
|
||||
{{- range $key, $value := merge .Values.egress.podAnnotations .Values.egress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kuma.egressLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.egress.affinity }}
|
||||
affinity: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
{{- with .Values.egress.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.egress.podSecurityContext | trim | nindent 8 }}
|
||||
serviceAccountName: {{ include "kuma.name" . }}-egress
|
||||
automountServiceAccountToken: {{ .Values.egress.automountServiceAccountToken }}
|
||||
{{- with .Values.egress.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.egress.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: egress
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.image "root" $) | quote }}
|
||||
imagePullPolicy: {{ .Values.dataPlane.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.egress.containerSecurityContext | trim | nindent 12 }}
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KUMA_CONTROL_PLANE_URL
|
||||
value: "https://{{ include "kuma.controlPlane.serviceName" . }}.{{ .Release.Namespace }}:5678"
|
||||
- name: KUMA_CONTROL_PLANE_CA_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/cp-ca/ca.crt
|
||||
- name: KUMA_DATAPLANE_DRAIN_TIME
|
||||
value: {{ .Values.egress.drainTime }}
|
||||
- name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
|
||||
value: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
- name: KUMA_DATAPLANE_PROXY_TYPE
|
||||
value: "egress"
|
||||
args:
|
||||
- run
|
||||
- --log-level={{ .Values.egress.logLevel | default "info" }}
|
||||
ports:
|
||||
- containerPort: 10002
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: "/ready"
|
||||
port: 9901
|
||||
failureThreshold: 12
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: "/ready"
|
||||
port: 9901
|
||||
failureThreshold: 12
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
resources: {{ toYaml .Values.egress.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
{{- if not .Values.egress.automountServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: control-plane-ca
|
||||
mountPath: /var/run/secrets/kuma.io/cp-ca
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
{{- if not .Values.egress.automountServiceAccountToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 420
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
{{- end }}
|
||||
- name: control-plane-ca
|
||||
secret:
|
||||
secretName: {{ include "kuma.controlPlane.tls.general.caSecretName" . }}
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{{- if .Values.egress.autoscaling.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
apiVersion: "autoscaling/v2"
|
||||
{{ else }}
|
||||
apiVersion: "autoscaling/v1"
|
||||
{{ end }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-egress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.egressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "kuma.name" . }}-egress
|
||||
minReplicas: {{ .Values.egress.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.egress.autoscaling.maxReplicas }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
metrics: {{- toYaml .Values.egress.autoscaling.metrics | nindent 4 }}
|
||||
{{ else }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.egress.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{{ if $.Values.egress.podDisruptionBudget.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
apiVersion: policy/v1
|
||||
{{ else if .Capabilities.APIVersions.Has "policy/v1beta1" }}
|
||||
apiVersion: policy/v1beta1
|
||||
{{ else }}
|
||||
{{ fail "pod disruption budgets are not supported by this version of kubernetes" }}
|
||||
{{ end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-egress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.egressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.egress.podDisruptionBudget.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-egress
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{- if .Values.egress.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-egress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.egressLabels" . | nindent 4 }}
|
||||
{{- with .Values.egress.serviceAccountAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{{- if .Values.egress.enabled }}
|
||||
{{- if eq .Values.controlPlane.mode "global" }}
|
||||
{{ fail "You shouldn't run zoneEgress when running the CP in global" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.egress.enabled .Values.egress.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "kuma.egress.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.egressLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.egress.service.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.egress.service.type }}
|
||||
{{- if .Values.egress.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.egress.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.egress.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: 10002
|
||||
{{- if and (eq .Values.egress.service.type "NodePort") .Values.egress.service.nodePort }}
|
||||
nodePort: {{ .Values.egress.service.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ include "kuma.name" . }}-egress
|
||||
{{- include "kuma.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{{- if and (eq .Values.controlPlane.environment "kubernetes") (eq .Values.controlPlane.mode "zone") }}
|
||||
{{- if .Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1/GatewayClass" }}
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: GatewayClass
|
||||
metadata:
|
||||
name: kuma
|
||||
spec:
|
||||
controllerName: "gateways.kuma.io/controller"
|
||||
{{- else if .Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1beta1/GatewayClass" }}
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1beta1
|
||||
kind: GatewayClass
|
||||
metadata:
|
||||
name: kuma
|
||||
spec:
|
||||
controllerName: "gateways.kuma.io/controller"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,141 @@
|
|||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-ingress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.ingressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
{{- if not .Values.ingress.autoscaling.enabled }}
|
||||
replicas: {{ .Values.ingress.replicas }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-ingress
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/ingress: enabled
|
||||
{{- range $key, $value := merge .Values.ingress.podAnnotations .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kuma.ingressLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.ingress.affinity }}
|
||||
affinity: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.ingress.podSecurityContext | trim | nindent 8 }}
|
||||
serviceAccountName: {{ include "kuma.name" . }}-ingress
|
||||
automountServiceAccountToken: {{ .Values.ingress.automountServiceAccountToken }}
|
||||
{{- with .Values.ingress.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.ingress.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: ingress
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.image "root" $) | quote }}
|
||||
imagePullPolicy: {{ .Values.dataPlane.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.ingress.containerSecurityContext | trim | nindent 12 }}
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KUMA_CONTROL_PLANE_URL
|
||||
value: "https://{{ include "kuma.controlPlane.serviceName" . }}.{{ .Release.Namespace }}:5678"
|
||||
- name: KUMA_CONTROL_PLANE_CA_CERT_FILE
|
||||
value: /var/run/secrets/kuma.io/cp-ca/ca.crt
|
||||
- name: KUMA_DATAPLANE_DRAIN_TIME
|
||||
value: {{ .Values.ingress.drainTime }}
|
||||
- name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
|
||||
value: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
- name: KUMA_DATAPLANE_PROXY_TYPE
|
||||
value: "ingress"
|
||||
args:
|
||||
- run
|
||||
- --log-level={{ .Values.ingress.logLevel | default "info" }}
|
||||
ports:
|
||||
- containerPort: 10001
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: "/ready"
|
||||
port: 9901
|
||||
failureThreshold: 12
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: "/ready"
|
||||
port: 9901
|
||||
failureThreshold: 12
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
resources: {{ toYaml .Values.ingress.resources | nindent 12 }}
|
||||
{{ with .Values.ingress.lifecycle}}
|
||||
lifecycle: {{ . | toYaml | nindent 12 }}
|
||||
{{ end }}
|
||||
volumeMounts:
|
||||
{{- if not .Values.ingress.automountServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: control-plane-ca
|
||||
mountPath: /var/run/secrets/kuma.io/cp-ca
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
{{- if not .Values.ingress.automountServiceAccountToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 420
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
{{- end }}
|
||||
- name: control-plane-ca
|
||||
secret:
|
||||
secretName: {{ include "kuma.controlPlane.tls.general.caSecretName" . }}
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{{- if .Values.ingress.autoscaling.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
apiVersion: "autoscaling/v2"
|
||||
{{ else }}
|
||||
apiVersion: "autoscaling/v1"
|
||||
{{ end }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-ingress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.ingressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "kuma.name" . }}-ingress
|
||||
minReplicas: {{ .Values.ingress.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.ingress.autoscaling.maxReplicas }}
|
||||
{{ if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
metrics: {{- toYaml .Values.ingress.autoscaling.metrics | nindent 4 }}
|
||||
{{ else }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.ingress.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{{ if $.Values.ingress.podDisruptionBudget.enabled }}
|
||||
{{ if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
apiVersion: policy/v1
|
||||
{{ else if .Capabilities.APIVersions.Has "policy/v1beta1" }}
|
||||
apiVersion: policy/v1beta1
|
||||
{{ else }}
|
||||
{{ fail "pod disruption budgets are not supported by this version of kubernetes" }}
|
||||
{{ end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-ingress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.ingressLabels" . | nindent 4 }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.ingress.podDisruptionBudget.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kuma.selectorLabels" . | nindent 6 }}
|
||||
app: {{ include "kuma.name" . }}-ingress
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-ingress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.ingressLabels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.serviceAccountAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{{- if .Values.ingress.enabled }}
|
||||
{{- if or (eq .Values.controlPlane.mode "global") (eq .Values.controlPlane.mode "standalone") }}
|
||||
{{ fail "You shouldn't run zoneIngress when running the CP in global or standalone" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.enabled .Values.ingress.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "kuma.ingress.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{ include "kuma.ingressLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.service.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.ingress.service.type }}
|
||||
{{- if .Values.ingress.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.ingress.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.ingress.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: 10001
|
||||
{{- if and (eq .Values.ingress.service.type "NodePort") .Values.ingress.service.nodePort }}
|
||||
nodePort: {{ .Values.ingress.service.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ include "kuma.name" . }}-ingress
|
||||
{{- include "kuma.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,126 @@
|
|||
{{- if and (.Values.experimental.ebpf.enabled) (and (not .Values.cni.enabled) (not .Values.noHelmHooks) (eq .Values.controlPlane.environment "kubernetes")) }}
|
||||
{{- $serviceAccountName := printf "%s-cleanup-node-ebpf-job" (include "kuma.name" .) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cleanup-node-ebpf-job
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- watch
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups: ["batch"]
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- watch
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-cleanup-node-ebpf-job
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-cleanup-node-ebpf-job
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-cleanup-node-ebpf-job
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-delete"
|
||||
{{/* Ensure the job is created after the RBAC resources */}}
|
||||
"helm.sh/hook-weight": "5"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-cleanup-node-ebpf-job
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
{{- with .Values.hooks.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.hooks.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
{{- if .Values.hooks.ebpfCleanup.podSecurityContext }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.hooks.ebpfCleanup.podSecurityContext | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: post-delete-job
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.initImage "root" $) | quote }}
|
||||
{{- if .Values.hooks.ebpfCleanup.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.hooks.ebpfCleanup.containerSecurityContext | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: "20m"
|
||||
memory: "20Mi"
|
||||
limits:
|
||||
cpu: "40m"
|
||||
memory: "40Mi"
|
||||
command:
|
||||
- 'kumactl'
|
||||
- 'uninstall'
|
||||
- 'ebpf'
|
||||
- '--cleanup-image-registry'
|
||||
- {{ .Values.global.image.registry }}
|
||||
- '--cleanup-image-repository'
|
||||
- {{ .Values.dataPlane.initImage.repository }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,109 @@
|
|||
{{- if and (eq .Values.controlPlane.environment "kubernetes") (not .Values.noHelmHooks) }}
|
||||
# HELM first deletes RBAC of Kuma, then it tries to delete Secrets. We've got validating webhook on Secrets.
|
||||
# But even that the policy of this webhook is Ignore, it fails because Kuma does not have permission to access Secrets anymore.
|
||||
# Therefore we first need to delete webhook so we can delete the rest of the deployment
|
||||
{{- $serviceAccountName := printf "%s-pre-delete-job" (include "kuma.name" .) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-pre-delete-job
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
resourceNames:
|
||||
- {{ include "kuma.name" . }}-validating-webhook-configuration
|
||||
verbs:
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-pre-delete-job
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-delete"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-pre-delete-job
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-delete-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-delete"
|
||||
{{/* Ensure the job is created after the RBAC resources */}}
|
||||
"helm.sh/hook-weight": "5"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-delete-webhook
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
{{- with .Values.hooks.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.hooks.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
{{- toYaml .Values.hooks.podSecurityContext | trim | nindent 8 }}
|
||||
containers:
|
||||
- name: pre-delete-job
|
||||
image: "{{ .Values.kubectl.image.registry }}/{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
|
||||
command:
|
||||
- 'kubectl'
|
||||
- 'delete'
|
||||
- 'ValidatingWebhookConfiguration'
|
||||
- '--ignore-not-found'
|
||||
- {{ include "kuma.name" . }}-validating-webhook-configuration
|
||||
securityContext:
|
||||
{{- toYaml (mergeOverwrite (dict "runAsUser" 65534) .Values.hooks.containerSecurityContext) | trim | nindent 12 }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,124 @@
|
|||
{{- if and ( .Values.noHelmHooks ) (eq .Values.controlPlane.environment "kubernetes") }}
|
||||
{{- $errorMessage := ".Values.noHelmHooks is set. You must manually create and label the system namespace with kuma.io/system-namespace: \"true\" before installing or upgrading the chart" }}
|
||||
{{- $systemNamespace := (lookup "v1" "Namespace" "" .Release.Namespace) }}
|
||||
{{- if not $systemNamespace }}
|
||||
{{- fail $errorMessage }}
|
||||
{{- end }}
|
||||
{{- $systemNamespaceLabels := ($systemNamespace).metadata.labels }}
|
||||
{{- if ne (get $systemNamespaceLabels "kuma.io/system-namespace") "true" }}
|
||||
{{- fail $errorMessage }}
|
||||
{{- end }}
|
||||
{{- else}}
|
||||
{{- if .Values.patchSystemNamespace }}
|
||||
{{- $serviceAccountName := printf "%s-patch-ns-job" (include "kuma.name" .) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-patch-ns-job
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
resourceNames:
|
||||
- {{ .Release.Namespace }}
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-patch-ns-job
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-patch-ns-job
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-patch-ns
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install"
|
||||
{{/* Ensure the job is created after the RBAC resources */}}
|
||||
"helm.sh/hook-weight": "5"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-patch-ns-script
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
{{- with .Values.hooks.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.hooks.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
{{- toYaml .Values.hooks.podSecurityContext | trim | nindent 8 }}
|
||||
containers:
|
||||
- name: pre-install-job
|
||||
image: "{{ .Values.kubectl.image.registry }}/{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
|
||||
securityContext:
|
||||
{{- toYaml (mergeOverwrite (dict "runAsUser" 65534) .Values.hooks.containerSecurityContext) | trim | nindent 12 }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
command:
|
||||
- 'kubectl'
|
||||
- 'patch'
|
||||
- 'namespace'
|
||||
- {{ .Release.Namespace | quote }}
|
||||
- '--type'
|
||||
- 'merge'
|
||||
- '--patch'
|
||||
- '{ "metadata": { "labels": { "kuma.io/system-namespace": "true" } } }'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,171 @@
|
|||
{{- if (and .Values.installCrdsOnUpgrade.enabled (and (not .Values.noHelmHooks) (eq .Values.controlPlane.environment "kubernetes"))) }}
|
||||
{{ $hook := "pre-upgrade,pre-install" }}
|
||||
{{- $serviceAccountName := printf "%s-install-crds" (include "kuma.name" .) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "{{ $hook }}"
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
{{- with concat .Values.installCrdsOnUpgrade.imagePullSecrets .Values.global.imagePullSecrets | uniq }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-install-crds
|
||||
annotations:
|
||||
"helm.sh/hook": "{{ $hook }}"
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "apiextensions.k8s.io"
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
- list
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-install-crds
|
||||
annotations:
|
||||
"helm.sh/hook": "{{ $hook }}"
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "kuma.name" . }}-install-crds
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kuma.name" . }}-install-crds-scripts
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": "{{ $hook }}"
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
labels:
|
||||
{{- include "kuma.labels" . | nindent 4 }}
|
||||
data:
|
||||
install_crds.sh: |
|
||||
#!/usr/bin/env sh
|
||||
set -e
|
||||
|
||||
if [ -s /kuma/crds/crds.yaml ]; then
|
||||
echo "/kuma/crds/crds.yaml found and is not empty, adding crds"
|
||||
kubectl apply -f /kuma/crds/crds.yaml
|
||||
else
|
||||
echo "/kuma/crds/crds.yaml not found or empty, it looks like there is no crds to install"
|
||||
fi
|
||||
save_crds.sh: |
|
||||
set -e
|
||||
|
||||
crds="$(kumactl install crds --no-config)"
|
||||
|
||||
if [ -n "${crds}" ]; then
|
||||
echo "found crds - saving to /kuma/crds/crds.yaml"
|
||||
echo "${crds}" > /kuma/crds/crds.yaml
|
||||
fi
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-install-crds
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "{{ $hook }}"
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "kuma.name" . }}-install-crds-job
|
||||
labels:
|
||||
{{ include "kuma.labels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
{{- with .Values.hooks.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.hooks.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
{{- toYaml .Values.hooks.podSecurityContext | trim | nindent 8 }}
|
||||
containers:
|
||||
- name: pre-upgrade-job
|
||||
image: "{{ .Values.kubectl.image.registry }}/{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
|
||||
securityContext:
|
||||
{{- toYaml (mergeOverwrite (dict "runAsUser" 65534) .Values.hooks.containerSecurityContext) | trim | nindent 12 }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
command: ["/kuma/scripts/install_crds.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: /kuma/crds
|
||||
name: crds
|
||||
readOnly: true
|
||||
- mountPath: /kuma/scripts
|
||||
name: scripts
|
||||
readOnly: true
|
||||
initContainers:
|
||||
- name: pre-upgrade-job-init
|
||||
image: {{ include "kuma.formatImage" (dict "image" .Values.kumactl.image "root" $) | quote }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.hooks.containerSecurityContext | trim | nindent 12 }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
volumeMounts:
|
||||
- mountPath: /kuma/crds
|
||||
name: crds
|
||||
- mountPath: /kuma/scripts
|
||||
name: scripts
|
||||
readOnly: true
|
||||
command: ["sh", "-c"]
|
||||
args: ["/kuma/scripts/save_crds.sh"]
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ include "kuma.name" . }}-install-crds-scripts
|
||||
defaultMode: 0755
|
||||
- name: crds
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,748 @@
|
|||
global:
|
||||
image:
|
||||
# -- Default registry for all Kuma Images
|
||||
registry: "docker.io/kumahq"
|
||||
# -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
|
||||
tag:
|
||||
# -- Add `imagePullSecrets` to all the service accounts used for Kuma components
|
||||
imagePullSecrets: []
|
||||
|
||||
# -- Whether to patch the target namespace with the system label
|
||||
patchSystemNamespace: true
|
||||
|
||||
installCrdsOnUpgrade:
|
||||
# -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
|
||||
enabled: true
|
||||
# -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
|
||||
# This field will be deprecated in a future release, please use .global.imagePullSecrets
|
||||
imagePullSecrets: []
|
||||
|
||||
# -- Whether to disable all helm hooks
|
||||
noHelmHooks: false
|
||||
|
||||
# -- Whether to restart control-plane by calculating a new checksum for the secret
|
||||
restartOnSecretChange: true
|
||||
|
||||
controlPlane:
|
||||
# -- Environment that control plane is run in, useful when running universal global control plane on k8s
|
||||
environment: "kubernetes"
|
||||
|
||||
# -- Labels to add to resources in addition to default labels
|
||||
extraLabels: {}
|
||||
|
||||
# -- Kuma CP log level: one of off,info,debug
|
||||
logLevel: "info"
|
||||
|
||||
# -- Kuma CP log output path: Defaults to /dev/stdout
|
||||
logOutputPath: ""
|
||||
|
||||
# -- Kuma CP modes: one of zone,global
|
||||
mode: "zone"
|
||||
|
||||
# -- (string) Kuma CP zone, if running multizone
|
||||
zone:
|
||||
|
||||
# -- Only used in `zone` mode
|
||||
kdsGlobalAddress: ""
|
||||
|
||||
# -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
|
||||
replicas: 1
|
||||
|
||||
# -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
|
||||
minReadySeconds: 0
|
||||
|
||||
# -- Annotations applied only to the `Deployment` resource
|
||||
deploymentAnnotations: {}
|
||||
|
||||
# -- Annotations applied only to the `Pod` resource
|
||||
podAnnotations: {}
|
||||
|
||||
# Horizontal Pod Autoscaling configuration
|
||||
autoscaling:
|
||||
# -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
|
||||
enabled: false
|
||||
|
||||
# -- The minimum CP pods to allow
|
||||
minReplicas: 2
|
||||
# -- The max CP pods to scale to
|
||||
maxReplicas: 5
|
||||
|
||||
# -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# -- For clusters that do support autoscaling/v2, use metrics
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
|
||||
# -- Node selector for the Kuma Control Plane pods
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
# -- Tolerations for the Kuma Control Plane pods
|
||||
tolerations: []
|
||||
|
||||
podDisruptionBudget:
|
||||
# -- Whether to create a pod disruption budget
|
||||
enabled: false
|
||||
# -- The maximum number of unavailable pods allowed by the budget
|
||||
maxUnavailable: 1
|
||||
|
||||
# -- Affinity placement rule for the Kuma Control Plane pods.
|
||||
# This is rendered as a template, so you can reference other helm variables or includes.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
# These match the selector labels used on the deployment.
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- '{{ include "kuma.name" . }}'
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- '{{ .Release.Name }}'
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- '{{ include "kuma.name" . }}-control-plane'
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
# -- Topology spread constraints rule for the Kuma Control Plane pods.
|
||||
# This is rendered as a template, so you can use variables to generate match labels.
|
||||
topologySpreadConstraints:
|
||||
|
||||
# -- Failure policy of the mutating webhook implemented by the Kuma Injector component
|
||||
injectorFailurePolicy: Fail
|
||||
|
||||
service:
|
||||
apiServer:
|
||||
http:
|
||||
# -- Port on which Http api server Service is exposed on Node for service of type NodePort
|
||||
nodePort: 30681
|
||||
https:
|
||||
# -- Port on which Https api server Service is exposed on Node for service of type NodePort
|
||||
nodePort: 30682
|
||||
|
||||
# -- Whether to create a service resource.
|
||||
enabled: true
|
||||
|
||||
# -- (string) Optionally override of the Kuma Control Plane Service's name
|
||||
name:
|
||||
|
||||
# -- Service type of the Kuma Control Plane
|
||||
type: ClusterIP
|
||||
|
||||
# -- Annotations to put on the Kuma Control Plane
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "5680"
|
||||
|
||||
# Kuma API and GUI ingress settings. Useful if you want to expose the
|
||||
# API and GUI of Kuma outside the k8s cluster.
|
||||
ingress:
|
||||
# -- Install K8s Ingress resource that exposes GUI and API
|
||||
enabled: false
|
||||
# -- IngressClass defines which controller will implement the resource
|
||||
ingressClassName:
|
||||
# -- Ingress hostname
|
||||
hostname:
|
||||
# -- Map of ingress annotations.
|
||||
annotations: {}
|
||||
# -- Ingress path.
|
||||
path: /
|
||||
# -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
|
||||
pathType: ImplementationSpecific
|
||||
# -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
|
||||
servicePort: 5681
|
||||
|
||||
globalZoneSyncService:
|
||||
# -- Whether to create a k8s service for the global zone sync
|
||||
# service. It will only be created when enabled and deploying the global
|
||||
# control plane.
|
||||
enabled: true
|
||||
# -- Service type of the Global-zone sync
|
||||
type: LoadBalancer
|
||||
# -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
|
||||
loadBalancerIP:
|
||||
# -- Optionally specify allowed source ranges that can access the load balancer
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Additional annotations to put on the Global Zone Sync Service
|
||||
annotations: { }
|
||||
# -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
|
||||
nodePort: 30685
|
||||
# -- Port on which Global Zone Sync Service is exposed
|
||||
port: 5685
|
||||
# -- Protocol of the Global Zone Sync service port
|
||||
protocol: grpc
|
||||
|
||||
defaults:
|
||||
# -- Whether to skip creating the default Mesh
|
||||
skipMeshCreation: false
|
||||
|
||||
# -- Whether to automountServiceAccountToken for cp. Optionally set to false
|
||||
automountServiceAccountToken: true
|
||||
|
||||
# -- Optionally override the resource spec
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
|
||||
# -- Pod lifecycle settings (useful for adding a preStop hook, when
|
||||
# using AWS ALB or NLB)
|
||||
lifecycle: {}
|
||||
|
||||
# -- Number of seconds to wait before force killing the pod. Make sure to
|
||||
# update this if you add a preStop hook.
|
||||
terminationGracePeriodSeconds: 30
|
||||
|
||||
# TLS for various servers
|
||||
tls:
|
||||
general:
|
||||
# -- Secret that contains tls.crt, tls.key [and ca.crt when no
|
||||
# controlPlane.tls.general.caSecretName specified] for protecting
|
||||
# Kuma in-cluster communication
|
||||
secretName: ""
|
||||
# -- Secret that contains ca.crt that was used to sign cert for protecting
|
||||
# Kuma in-cluster communication (ca.crt present in this secret
|
||||
# have precedence over the one provided in the controlPlane.tls.general.secretName)
|
||||
caSecretName: ""
|
||||
# -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
|
||||
caBundle: ""
|
||||
apiServer:
|
||||
# -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
|
||||
secretName: ""
|
||||
# -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
|
||||
clientCertsSecretName: ""
|
||||
# - if not creating the global control plane, then do nothing
|
||||
# - if secretName is empty and create is false, then do nothing
|
||||
# - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
|
||||
# - if secretName is empty and create is true, then create a secret with a default name and use it
|
||||
# - if secretName is non-empty and create is true, then create the secret using the provided name
|
||||
kdsGlobalServer:
|
||||
# -- Name of the K8s TLS Secret resource. If you set this and don't set
|
||||
# create=true, you have to create the secret manually.
|
||||
secretName: ""
|
||||
# -- Whether to create the TLS secret in helm.
|
||||
create: false
|
||||
# -- The TLS certificate to offer.
|
||||
cert: ""
|
||||
# -- The TLS key to use.
|
||||
key: ""
|
||||
# - if not creating the zonal control plane, then do nothing
|
||||
# - if secretName is empty and create is false, then do nothing
|
||||
# - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
|
||||
# - if secretName is empty and create is true, then create a secret with a default name and use it
|
||||
# - if secretName is non-empty and create is true, then create the secret using the provided name
|
||||
kdsZoneClient:
|
||||
# -- Name of the K8s Secret resource that contains ca.crt which was
|
||||
# used to sign the certificate of KDS Global Server. If you set this
|
||||
# and don't set create=true, you have to create the secret manually.
|
||||
secretName: ""
|
||||
# -- Whether to create the TLS secret in helm.
|
||||
create: false
|
||||
# -- CA bundle that was used to sign the certificate of KDS Global Server.
|
||||
cert: ""
|
||||
# -- If true, TLS cert of the server is not verified.
|
||||
skipVerify: false
|
||||
|
||||
# -- Annotations to add for Control Plane's Service Account
|
||||
serviceAccountAnnotations: { }
|
||||
|
||||
image:
|
||||
# -- Kuma CP ImagePullPolicy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Kuma CP image repository
|
||||
repository: "kuma-cp"
|
||||
# -- Kuma CP Image tag. When not specified, the value is copied from global.tag
|
||||
tag:
|
||||
|
||||
# -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
|
||||
# where `Env` is the name of the env variable,
|
||||
# `Secret` is the name of the Secret,
|
||||
# and `Key` is the key of the Secret value to use
|
||||
secrets:
|
||||
# someSecret:
|
||||
# Secret: some-secret
|
||||
# Key: secret_key
|
||||
# Env: SOME_SECRET
|
||||
|
||||
# -- Additional environment variables that will be passed to the control plane
|
||||
envVars: { }
|
||||
|
||||
# -- Additional config maps to mount into the control plane, with optional inline values
|
||||
extraConfigMaps: [ ]
|
||||
# - name: extra-config
|
||||
# mountPath: /etc/extra-config
|
||||
# readOnly: true
|
||||
# values:
|
||||
# extra-config-key: |
|
||||
# extra-config-value
|
||||
|
||||
# -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
|
||||
# where `Env` is the name of the env variable,
|
||||
# `Secret` is the name of the Secret,
|
||||
# and `Key` is the key of the Secret value to use
|
||||
extraSecrets:
|
||||
# extraConfig:
|
||||
# name: extra-config
|
||||
# mountPath: /etc/extra-config
|
||||
# readOnly: true
|
||||
|
||||
webhooks:
|
||||
validator:
|
||||
# -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
|
||||
additionalRules: ""
|
||||
ownerReference:
|
||||
# -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
|
||||
additionalRules: ""
|
||||
|
||||
# -- Specifies if the deployment should be started in hostNetwork mode.
|
||||
hostNetwork: false
|
||||
# -- Define a new server port for the admission controller. Recommended to set in combination with
|
||||
# hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
|
||||
admissionServerPort: 5443
|
||||
|
||||
# -- Security context at the pod level for control plane.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# -- Security context at the container level for control plane.
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
# -- If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace.
|
||||
# The downside is that control plane requires permission to read Secrets in all namespaces.
|
||||
supportGatewaySecretsInAllNamespaces: false
|
||||
|
||||
cni:
|
||||
# -- Install Kuma with CNI instead of proxy init container
|
||||
enabled: false
|
||||
# -- Install CNI in chained mode
|
||||
chained: false
|
||||
# -- Set the CNI install directory
|
||||
netDir: /etc/cni/multus/net.d
|
||||
# -- Set the CNI bin directory
|
||||
binDir: /var/lib/cni/bin
|
||||
# -- Set the CNI configuration name
|
||||
confName: kuma-cni.conf
|
||||
# -- CNI log level: one of off,info,debug
|
||||
logLevel: info
|
||||
# -- Node Selector for the CNI pods
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- Tolerations for the CNI pods
|
||||
tolerations: []
|
||||
# -- Additional pod annotations
|
||||
podAnnotations: { }
|
||||
# -- Set the CNI namespace
|
||||
namespace: kube-system
|
||||
|
||||
image:
|
||||
# -- CNI image repository
|
||||
repository: "kuma-cni"
|
||||
# -- CNI image tag - defaults to .Chart.AppVersion
|
||||
tag:
|
||||
# -- CNI image pull policy
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
# -- it's only useful in tests to trigger a possible race condition
|
||||
delayStartupSeconds: 0
|
||||
|
||||
# -- use new CNI (experimental)
|
||||
experimental:
|
||||
imageEbpf:
|
||||
# -- CNI experimental eBPF image registry
|
||||
registry: "docker.io/kumahq"
|
||||
# -- CNI experimental eBPF image repository
|
||||
repository: "merbridge"
|
||||
# -- CNI experimental eBPF image tag
|
||||
tag: "0.8.5"
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
limits:
|
||||
memory: 100Mi
|
||||
|
||||
# -- Security context at the pod level for cni
|
||||
podSecurityContext: {}
|
||||
|
||||
# -- Security context at the container level for cni
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
|
||||
dataPlane:
|
||||
# -- If true, then turn on CoreDNS query logging
|
||||
dnsLogging: false
|
||||
image:
|
||||
# -- The Kuma DP image repository
|
||||
repository: "kuma-dp"
|
||||
# -- Kuma DP ImagePullPolicy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
|
||||
tag:
|
||||
|
||||
initImage:
|
||||
# -- The Kuma DP init image repository
|
||||
repository: "kuma-init"
|
||||
# -- Kuma DP init image tag When not specified, the value is copied from global.tag
|
||||
tag:
|
||||
|
||||
ingress:
|
||||
# -- If true, it deploys Ingress for cross cluster communication
|
||||
enabled: false
|
||||
|
||||
# -- Labels to add to resources, in addition to default labels
|
||||
extraLabels: {}
|
||||
|
||||
# -- Time for which old listener will still be active as draining
|
||||
drainTime: 30s
|
||||
|
||||
# -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
|
||||
replicas: 1
|
||||
|
||||
# -- Log level for ingress (available values: off|info|debug)
|
||||
logLevel: info
|
||||
|
||||
# -- Define the resources to allocate to mesh ingress
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
|
||||
# -- Pod lifecycle settings (useful for adding a preStop hook, when
|
||||
# using AWS ALB or NLB)
|
||||
lifecycle: {}
|
||||
|
||||
# -- Number of seconds to wait before force killing the pod. Make sure to
|
||||
# update this if you add a preStop hook.
|
||||
terminationGracePeriodSeconds: 40
|
||||
|
||||
# Horizontal Pod Autoscaling configuration
|
||||
autoscaling:
|
||||
# -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
|
||||
enabled: false
|
||||
|
||||
# -- The minimum CP pods to allow
|
||||
minReplicas: 2
|
||||
# -- The max CP pods to scale to
|
||||
maxReplicas: 5
|
||||
|
||||
# -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# -- For clusters that do support autoscaling/v2, use metrics
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
|
||||
service:
|
||||
# -- Whether to create a Service resource.
|
||||
enabled: true
|
||||
# -- Service type of the Ingress
|
||||
type: LoadBalancer
|
||||
# -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
|
||||
loadBalancerIP:
|
||||
# -- Additional annotations to put on the Ingress service
|
||||
annotations: { }
|
||||
# -- Port on which Ingress is exposed
|
||||
port: 10001
|
||||
# -- Port on which service is exposed on Node for service of type NodePort
|
||||
nodePort:
|
||||
# -- Additional pod annotations (deprecated favor `podAnnotations`)
|
||||
annotations: { }
|
||||
# -- Additional pod annotations
|
||||
podAnnotations: { }
|
||||
# -- Node Selector for the Ingress pods
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- Tolerations for the Ingress pods
|
||||
tolerations: []
|
||||
podDisruptionBudget:
|
||||
# -- Whether to create a pod disruption budget
|
||||
enabled: false
|
||||
# -- The maximum number of unavailable pods allowed by the budget
|
||||
maxUnavailable: 1
|
||||
|
||||
# -- Affinity placement rule for the Kuma Ingress pods
|
||||
# This is rendered as a template, so you can reference other helm variables
|
||||
# or includes.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
# These match the selector labels used on the deployment.
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- '{{ include "kuma.name" . }}'
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- '{{ .Release.Name }}'
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- kuma-ingress
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
# -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
|
||||
# This is rendered as a template, so you can use variables to generate match labels.
|
||||
topologySpreadConstraints:
|
||||
|
||||
# -- Security context at the pod level for ingress
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 5678
|
||||
runAsGroup: 5678
|
||||
|
||||
# -- Security context at the container level for ingress
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
# -- Annotations to add for Control Plane's Service Account
|
||||
serviceAccountAnnotations: { }
|
||||
# -- Whether to automountServiceAccountToken for cp. Optionally set to false
|
||||
automountServiceAccountToken: true
|
||||
|
||||
egress:
|
||||
# -- If true, it deploys Egress for cross cluster communication
|
||||
enabled: false
|
||||
# -- Labels to add to resources, in addition to the default labels.
|
||||
extraLabels: {}
|
||||
# -- Time for which old listener will still be active as draining
|
||||
drainTime: 30s
|
||||
# -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
|
||||
replicas: 1
|
||||
|
||||
# -- Log level for egress (available values: off|info|debug)
|
||||
logLevel: info
|
||||
|
||||
# Horizontal Pod Autoscaling configuration
|
||||
autoscaling:
|
||||
# -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
|
||||
enabled: false
|
||||
|
||||
# -- The minimum CP pods to allow
|
||||
minReplicas: 2
|
||||
# -- The max CP pods to scale to
|
||||
maxReplicas: 5
|
||||
|
||||
# -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# -- For clusters that do support autoscaling/v2, use metrics
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
|
||||
service:
|
||||
# -- Whether to create the service object
|
||||
enabled: true
|
||||
# -- Service type of the Egress
|
||||
type: ClusterIP
|
||||
# -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
|
||||
loadBalancerIP:
|
||||
# -- Additional annotations to put on the Egress service
|
||||
annotations: { }
|
||||
# -- Port on which Egress is exposed
|
||||
port: 10002
|
||||
# -- Port on which service is exposed on Node for service of type NodePort
|
||||
nodePort:
|
||||
# -- Additional pod annotations (deprecated favor `podAnnotations`)
|
||||
annotations: { }
|
||||
# -- Additional pod annotations
|
||||
podAnnotations: { }
|
||||
# -- Node Selector for the Egress pods
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- Tolerations for the Egress pods
|
||||
tolerations: []
|
||||
podDisruptionBudget:
|
||||
# -- Whether to create a pod disruption budget
|
||||
enabled: false
|
||||
# -- The maximum number of unavailable pods allowed by the budget
|
||||
maxUnavailable: 1
|
||||
|
||||
# -- Affinity placement rule for the Kuma Egress pods.
|
||||
# This is rendered as a template, so you can reference other helm variables or includes.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
# These match the selector labels used on the deployment.
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- '{{ include "kuma.name" . }}'
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- '{{ .Release.Name }}'
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- kuma-egress
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
# -- Topology spread constraints rule for the Kuma Egress pods.
|
||||
# This is rendered as a template, so you can use variables to generate match labels.
|
||||
topologySpreadConstraints:
|
||||
|
||||
# -- Security context at the pod level for egress
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 5678
|
||||
runAsGroup: 5678
|
||||
|
||||
# -- Security context at the container level for egress
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
# -- Annotations to add for Control Plane's Service Account
|
||||
serviceAccountAnnotations: { }
|
||||
# -- Whether to automountServiceAccountToken for cp. Optionally set to false
|
||||
automountServiceAccountToken: true
|
||||
|
||||
kumactl:
|
||||
image:
|
||||
# -- The kumactl image repository
|
||||
repository: kumactl
|
||||
# -- The kumactl image tag. When not specified, the value is copied from global.tag
|
||||
tag:
|
||||
|
||||
kubectl:
|
||||
image:
|
||||
# -- The kubectl image registry
|
||||
registry: docker.io
|
||||
# -- The kubectl image repository
|
||||
repository: bitnami/kubectl
|
||||
# -- The kubectl image tag
|
||||
tag: "1.27.5"
|
||||
hooks:
|
||||
# -- Node selector for the HELM hooks
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- Tolerations for the HELM hooks
|
||||
tolerations: []
|
||||
# -- Security context at the pod level for crd/webhook/ns
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# -- Security context at the container level for crd/webhook/ns
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
# -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
|
||||
# Changing below values will potentially break ebpf cleanup completely,
|
||||
# so be cautious when doing so.
|
||||
ebpfCleanup:
|
||||
# -- Security context at the pod level for crd/webhook/cleanup-ebpf
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
# -- Security context at the container level for crd/webhook/cleanup-ebpf
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
experimental:
|
||||
# Configuration for the experimental ebpf mode for transparent proxy
|
||||
ebpf:
|
||||
# -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
|
||||
enabled: false
|
||||
# -- Name of the environmental variable which will contain the IP address of a pod
|
||||
instanceIPEnvVarName: INSTANCE_IP
|
||||
# -- Path where BPF file system should be mounted
|
||||
bpffsPath: /sys/fs/bpf
|
||||
# -- Host's cgroup2 path
|
||||
cgroupPath: /sys/fs/cgroup
|
||||
# -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
|
||||
tcAttachIface: ""
|
||||
# -- Path where compiled eBPF programs which will be installed can be found
|
||||
programsSourcePath: /tmp/kuma-ebpf
|
||||
# -- If false, it uses legacy API for resource synchronization
|
||||
deltaKds: true
|
||||
# -- If true, enable native Kubernetes sidecars. This requires at least
|
||||
# Kubernetes v1.29
|
||||
sidecarContainers: false
|
||||
|
||||
# Postgres' settings for universal control plane on k8s
|
||||
postgres:
|
||||
# -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
|
||||
# with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
|
||||
# Example:
|
||||
# controlPlane:
|
||||
# secrets:
|
||||
# - Secret: postgres-postgresql
|
||||
# Key: postgresql-password
|
||||
# Env: KUMA_STORE_POSTGRES_PASSWORD
|
||||
port: "5432"
|
||||
# TLS settings
|
||||
tls:
|
||||
# -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
|
||||
mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
|
||||
# -- Whether to disable SNI the postgres `sslsni` option.
|
||||
disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
|
||||
# -- Secret name that contains the ca.crt
|
||||
caSecretName:
|
||||
# -- Secret name that contains the client tls.crt, tls.key
|
||||
secretName:
|
||||
|
||||
# @ignored for helm-docs
|
||||
plugins:
|
||||
resources:
|
||||
hostnamegenerators: true
|
||||
meshexternalservices: true
|
||||
meshservices: true
|
||||
policies:
|
||||
meshaccesslogs: true
|
||||
meshcircuitbreakers: true
|
||||
meshfaultinjections: true
|
||||
meshhealthchecks: true
|
||||
meshhttproutes: true
|
||||
meshloadbalancingstrategies: true
|
||||
meshmetrics: true
|
||||
meshpassthroughs: true
|
||||
meshproxypatches: true
|
||||
meshratelimits: true
|
||||
meshretries: true
|
||||
meshtcproutes: true
|
||||
meshtimeouts: true
|
||||
meshtraces: true
|
||||
meshtrafficpermissions: true
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: Speedscale Operator
|
||||
catalog.cattle.io/kube-version: '>= 1.17.0-0'
|
||||
catalog.cattle.io/release-name: speedscale-operator
|
||||
apiVersion: v1
|
||||
appVersion: 2.2.509
|
||||
description: Stress test your APIs with real world scenarios. Collect and replay
|
||||
traffic without scripting.
|
||||
home: https://speedscale.com
|
||||
icon: file://assets/icons/speedscale-operator.png
|
||||
keywords:
|
||||
- speedscale
|
||||
- test
|
||||
- testing
|
||||
- regression
|
||||
- reliability
|
||||
- load
|
||||
- replay
|
||||
- network
|
||||
- traffic
|
||||
kubeVersion: '>= 1.17.0-0'
|
||||
maintainers:
|
||||
- email: support@speedscale.com
|
||||
name: Speedscale Support
|
||||
name: speedscale-operator
|
||||
version: 2.2.509
|
||||
|
|
@ -0,0 +1,201 @@
|
|||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright 2021 Speedscale
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
|
||||
|
||||
|
||||
# Speedscale Operator
|
||||
|
||||
The [Speedscale](https://www.speedscale.com) Operator is a [Kubernetes operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/)
|
||||
that watches for deployments to be applied to the cluster and takes action based on annotations. The operator
|
||||
can inject a proxy to capture traffic into or out of applications, or setup an isolation test environment around
|
||||
a deployment for testing. The operator itself is a deployment that will be always present on the cluster once
|
||||
the helm chart is installed.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.20+
|
||||
- Helm 3+
|
||||
- Appropriate [network and firewall configuration](https://docs.speedscale.com/reference/networking) for Speedscale cloud and webhook traffic
|
||||
|
||||
## Get Repo Info
|
||||
|
||||
```bash
|
||||
helm repo add speedscale https://speedscale.github.io/operator-helm/
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Install Chart
|
||||
|
||||
An API key is required. Sign up for a [free Speedscale trial](https://speedscale.com/free-trial/) if you do not have one.
|
||||
|
||||
```bash
|
||||
helm install speedscale-operator speedscale/speedscale-operator \
|
||||
-n speedscale \
|
||||
--create-namespace \
|
||||
--set apiKey=<YOUR-SPEEDSCALE-API-KEY> \
|
||||
--set clusterName=<YOUR-CLUSTER-NAME>
|
||||
```
|
||||
|
||||
_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
|
||||
|
||||
### Pre-install job failure
|
||||
|
||||
We use pre-install job to check provided API key and provision some of the required resources.
|
||||
|
||||
If the job failed during the installation, you'll see the following error during install:
|
||||
|
||||
```
|
||||
Error: INSTALLATION FAILED: failed pre-install: job failed: BackoffLimitExceeded
|
||||
```
|
||||
|
||||
You can inspect the logs using this command:
|
||||
|
||||
```bash
|
||||
kubectl -n speedscale logs job/speedscale-operator-pre-install
|
||||
```
|
||||
|
||||
After fixing the error, uninstall the helm release, delete the failed job
|
||||
and try installing again:
|
||||
|
||||
```bash
|
||||
helm -n speedscale uninstall speedscale-operator
|
||||
kubectl -n speedscale delete job speedscale-operator-pre-install
|
||||
```
|
||||
|
||||
## Uninstall Chart
|
||||
|
||||
```bash
|
||||
helm -n speedscale uninstall speedscale-operator
|
||||
```
|
||||
|
||||
This removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
|
||||
|
||||
CRDs created by this chart are not removed by default and should be manually cleaned up:
|
||||
|
||||
```bash
|
||||
kubectl delete crd trafficreplays.speedscale.com
|
||||
```
|
||||
|
||||
## Upgrading Chart
|
||||
|
||||
```bash
|
||||
helm repo update
|
||||
helm -n speedscale upgrade speedscale-operator speedscale/speedscale-operator
|
||||
```
|
||||
|
||||
Resources capturing traffic will need to be rolled to pick up the latest
|
||||
Speedscale sidecar. Use the rollout restart command for each namespace and
|
||||
resource type:
|
||||
|
||||
```bash
|
||||
kubectl -n <namespace> rollout restart deployment
|
||||
```
|
||||
|
||||
With Helm v3, CRDs created by this chart are not updated by default
|
||||
and should be manually updated.
|
||||
Consult also the [Helm Documentation on CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions).
|
||||
|
||||
_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
|
||||
|
||||
### Upgrading an existing Release to a new version
|
||||
|
||||
A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an
|
||||
incompatible breaking change needing manual actions.
|
||||
|
||||
|
||||
## Help
|
||||
|
||||
Speedscale docs information available at [docs.speedscale.com](https://docs.speedscale.com) or join us
|
||||
on the [Speedscale community Slack](https://join.slack.com/t/speedscalecommunity/shared_invite/zt-x5rcrzn4-XHG1QqcHNXIM~4yozRrz8A)!
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
|
||||
|
||||
|
||||
# Speedscale Operator
|
||||
|
||||
The [Speedscale](https://www.speedscale.com) Operator is a [Kubernetes operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/)
|
||||
that watches for deployments to be applied to the cluster and takes action based on annotations. The operator
|
||||
can inject a proxy to capture traffic into or out of applications, or setup an isolation test environment around
|
||||
a deployment for testing. The operator itself is a deployment that will be always present on the cluster once
|
||||
the helm chart is installed.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.20+
|
||||
- Helm 3+
|
||||
- Appropriate [network and firewall configuration](https://docs.speedscale.com/reference/networking) for Speedscale cloud and webhook traffic
|
||||
|
||||
## Get Repo Info
|
||||
|
||||
```bash
|
||||
helm repo add speedscale https://speedscale.github.io/operator-helm/
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Install Chart
|
||||
|
||||
An API key is required. Sign up for a [free Speedscale trial](https://speedscale.com/free-trial/) if you do not have one.
|
||||
|
||||
```bash
|
||||
helm install speedscale-operator speedscale/speedscale-operator \
|
||||
-n speedscale \
|
||||
--create-namespace \
|
||||
--set apiKey=<YOUR-SPEEDSCALE-API-KEY> \
|
||||
--set clusterName=<YOUR-CLUSTER-NAME>
|
||||
```
|
||||
|
||||
_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
|
||||
|
||||
### Pre-install job failure
|
||||
|
||||
We use pre-install job to check provided API key and provision some of the required resources.
|
||||
|
||||
If the job failed during the installation, you'll see the following error during install:
|
||||
|
||||
```
|
||||
Error: INSTALLATION FAILED: failed pre-install: job failed: BackoffLimitExceeded
|
||||
```
|
||||
|
||||
You can inspect the logs using this command:
|
||||
|
||||
```bash
|
||||
kubectl -n speedscale logs job/speedscale-operator-pre-install
|
||||
```
|
||||
|
||||
After fixing the error, uninstall the helm release, delete the failed job
|
||||
and try installing again:
|
||||
|
||||
```bash
|
||||
helm -n speedscale uninstall speedscale-operator
|
||||
kubectl -n speedscale delete job speedscale-operator-pre-install
|
||||
```
|
||||
|
||||
## Uninstall Chart
|
||||
|
||||
```bash
|
||||
helm -n speedscale uninstall speedscale-operator
|
||||
```
|
||||
|
||||
This removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
|
||||
|
||||
CRDs created by this chart are not removed by default and should be manually cleaned up:
|
||||
|
||||
```bash
|
||||
kubectl delete crd trafficreplays.speedscale.com
|
||||
```
|
||||
|
||||
## Upgrading Chart
|
||||
|
||||
```bash
|
||||
helm repo update
|
||||
helm -n speedscale upgrade speedscale-operator speedscale/speedscale-operator
|
||||
```
|
||||
|
||||
Resources capturing traffic will need to be rolled to pick up the latest
|
||||
Speedscale sidecar. Use the rollout restart command for each namespace and
|
||||
resource type:
|
||||
|
||||
```bash
|
||||
kubectl -n <namespace> rollout restart deployment
|
||||
```
|
||||
|
||||
With Helm v3, CRDs created by this chart are not updated by default
|
||||
and should be manually updated.
|
||||
Consult also the [Helm Documentation on CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions).
|
||||
|
||||
_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
|
||||
|
||||
### Upgrading an existing Release to a new version
|
||||
|
||||
A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an
|
||||
incompatible breaking change needing manual actions.
|
||||
|
||||
|
||||
## Help
|
||||
|
||||
Speedscale docs information available at [docs.speedscale.com](https://docs.speedscale.com) or join us
|
||||
on the [Speedscale community Slack](https://join.slack.com/t/speedscalecommunity/shared_invite/zt-x5rcrzn4-XHG1QqcHNXIM~4yozRrz8A)!
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
questions:
|
||||
- variable: apiKey
|
||||
default: "fffffffffffffffffffffffffffffffffffffffffffff"
|
||||
description: "An API key is required to connect to the Speedscale cloud."
|
||||
required: true
|
||||
type: string
|
||||
label: API Key
|
||||
group: Authentication
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
Thank you for installing the Speedscale Operator!
|
||||
|
||||
Next you'll need to add the Speedscale Proxy Sidecar to your deployments.
|
||||
See https://docs.speedscale.com/setup/sidecar/install/
|
||||
|
||||
If upgrading use the rollout restart command for each namespace and resource
|
||||
type to ensure Speedscale sidecars are updated:
|
||||
|
||||
kubectl -n <namespace> rollout restart deployment
|
||||
|
||||
Once your deployment is running the sidecar your service will show up on
|
||||
https://app.speedscale.com/.
|
||||
|
|
@ -0,0 +1,209 @@
|
|||
{{- $cacrt := "" -}}
|
||||
{{- $crt := "" -}}
|
||||
{{- $key := "" -}}
|
||||
{{- $s := (lookup "v1" "Secret" .Release.Namespace "speedscale-webhook-certs") -}}
|
||||
{{- if $s -}}
|
||||
{{- $cacrt = index $s.data "ca.crt" | default (index $s.data "tls.crt") | b64dec -}}
|
||||
{{- $crt = index $s.data "tls.crt" | b64dec -}}
|
||||
{{- $key = index $s.data "tls.key" | b64dec -}}
|
||||
{{ else }}
|
||||
{{- $altNames := list ( printf "speedscale-operator.%s" .Release.Namespace ) ( printf "speedscale-operator.%s.svc" .Release.Namespace ) -}}
|
||||
{{- $ca := genCA "speedscale-operator" 3650 -}}
|
||||
{{- $cert := genSignedCert "speedscale-operator" nil $altNames 3650 $ca -}}
|
||||
{{- $cacrt = $ca.Cert -}}
|
||||
{{- $crt = $cert.Cert -}}
|
||||
{{- $key = $cert.Key -}}
|
||||
{{- end -}}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: speedscale-operator
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $cacrt | b64enc }}
|
||||
service:
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate
|
||||
failurePolicy: Ignore
|
||||
name: sidecar.speedscale.com
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- kube-system
|
||||
- kube-node-lease
|
||||
{{- if .Values.namespaceSelector }}
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "In"
|
||||
values:
|
||||
{{- range .Values.namespaceSelector }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
reinvocationPolicy: IfNeeded
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apps
|
||||
- batch
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
- jobs
|
||||
- replicasets
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- pods
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- rollouts
|
||||
sideEffects: None
|
||||
timeoutSeconds: 10
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: speedscale-operator-replay
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $cacrt | b64enc }}
|
||||
service:
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate-speedscale-com-v1-trafficreplay
|
||||
failurePolicy: Fail
|
||||
name: replay.speedscale.com
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- kube-system
|
||||
- kube-node-lease
|
||||
{{- if .Values.namespaceSelector }}
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "In"
|
||||
values:
|
||||
{{- range .Values.namespaceSelector }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- speedscale.com
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- trafficreplays
|
||||
sideEffects: None
|
||||
timeoutSeconds: 10
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: speedscale-operator-replay
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $cacrt | b64enc }}
|
||||
service:
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-speedscale-com-v1-trafficreplay
|
||||
failurePolicy: Fail
|
||||
name: replay.speedscale.com
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- kube-system
|
||||
- kube-node-lease
|
||||
{{- if .Values.namespaceSelector }}
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: "In"
|
||||
values:
|
||||
{{- range .Values.namespaceSelector }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- speedscale.com
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
- DELETE
|
||||
resources:
|
||||
- trafficreplays
|
||||
sideEffects: None
|
||||
timeoutSeconds: 10
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/hook-delete-policy: before-hook-creation
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
creationTimestamp: null
|
||||
name: speedscale-webhook-certs
|
||||
namespace: {{ .Release.Namespace }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $cacrt | b64enc }}
|
||||
tls.crt: {{ $crt | b64enc }}
|
||||
tls.key: {{ $key | b64enc }}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
data:
|
||||
CLUSTER_NAME: {{ .Values.clusterName }}
|
||||
IMAGE_PULL_POLICY: {{ .Values.image.pullPolicy }}
|
||||
IMAGE_PULL_SECRETS: ""
|
||||
IMAGE_REGISTRY: {{ .Values.image.registry }}
|
||||
IMAGE_TAG: {{ .Values.image.tag }}
|
||||
INSTANCE_ID: '{{- $cm := (lookup "v1" "ConfigMap" .Release.Namespace "speedscale-operator") -}}{{ if $cm }}{{ $cm.data.INSTANCE_ID }}{{ else }}{{ ( printf "%s-%s" .Values.clusterName uuidv4 ) }}{{ end }}'
|
||||
LOG_LEVEL: {{ .Values.logLevel }}
|
||||
SPEEDSCALE_DLP_CONFIG: {{ .Values.dlp.config }}
|
||||
SPEEDSCALE_FILTER_RULE: {{ .Values.filterRule }}
|
||||
TELEMETRY_INTERVAL: 1s
|
||||
WITH_DLP: {{ .Values.dlp.enabled | quote }}
|
||||
WITH_INSPECTOR: {{ .Values.dashboardAccess | quote }}
|
||||
API_KEY_SECRET_NAME: {{ .Values.apiKeySecret | quote }}
|
||||
DEPLOY_DEMO: {{ .Values.deployDemo | quote }}
|
||||
GLOBAL_ANNOTATIONS: {{ .Values.globalAnnotations | toJson | quote }}
|
||||
GLOBAL_LABELS: {{ .Values.globalLabels | toJson | quote }}
|
||||
{{- if .Values.http_proxy }}
|
||||
HTTP_PROXY: {{ .Values.http_proxy }}
|
||||
{{- end }}
|
||||
{{- if .Values.https_proxy }}
|
||||
HTTPS_PROXY: {{ .Values.https_proxy }}
|
||||
{{- end }}
|
||||
{{- if .Values.no_proxy }}
|
||||
NO_PROXY: {{ .Values.no_proxy }}
|
||||
{{- end }}
|
||||
PRIVILEGED_SIDECARS: {{ .Values.privilegedSidecars | quote }}
|
||||
DISABLE_SMARTDNS: {{ .Values.disableSidecarSmartReverseDNS | quote }}
|
||||
SIDECAR_CONFIG: {{ .Values.sidecar | toJson | quote }}
|
||||
FORWARDER_CONFIG: {{ .Values.forwarder | toJson | quote }}
|
||||
TEST_PREP_TIMEOUT: {{ .Values.operator.test_prep_timeout }}
|
||||
CONTROL_PLANE_TIMEOUT: {{ .Values.operator.control_plane_timeout }}
|
||||
|
|
@ -0,0 +1,525 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
creationTimestamp: null
|
||||
name: trafficreplays.speedscale.com
|
||||
spec:
|
||||
group: speedscale.com
|
||||
names:
|
||||
kind: TrafficReplay
|
||||
listKind: TrafficReplayList
|
||||
plural: trafficreplays
|
||||
shortNames:
|
||||
- replay
|
||||
singular: trafficreplay
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.active
|
||||
name: Active
|
||||
type: boolean
|
||||
- jsonPath: .spec.mode
|
||||
name: Mode
|
||||
type: string
|
||||
- jsonPath: .status.conditions[-1:].message
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: TrafficReplay is the Schema for the trafficreplays API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TrafficReplaySpec defines the desired state of TrafficReplay
|
||||
properties:
|
||||
buildTag:
|
||||
description: |-
|
||||
BuildTag links a unique tag, build hash, etc. to the generated
|
||||
traffic replay report. That way you can connect the report results to the
|
||||
version of the code that was tested.
|
||||
type: string
|
||||
cleanup:
|
||||
description: |-
|
||||
Cleanup is the name of cleanup mode used for this TrafficReplay. Set to
|
||||
"none" to leave resources in the state they were during the replay. The
|
||||
default mode "inventory" will revert the environment to the state it was
|
||||
before the replay.
|
||||
enum:
|
||||
- inventory
|
||||
- all
|
||||
- none
|
||||
type: string
|
||||
collectLogs:
|
||||
description: |-
|
||||
CollectLogs enables or disables log collection from target
|
||||
workload. Defaults to true.
|
||||
DEPRECATED: use TestReport.ActualConfig.Cluster.CollectLogs
|
||||
type: boolean
|
||||
configChecksum:
|
||||
description: |-
|
||||
ConfigChecksum, managed my the operator, is the SHA1 checksum of the
|
||||
configuration.
|
||||
type: string
|
||||
customURL:
|
||||
description: |-
|
||||
CustomURL specifies a custom URL to send *ALL* traffic to. Use
|
||||
Workload.CustomURI to send traffic to a specific URL for only that
|
||||
workload.
|
||||
type: string
|
||||
generatorLowData:
|
||||
description: |-
|
||||
GeneratorLowData forces the generator into a high
|
||||
efficiency/low data output mode. This is ideal for high volume
|
||||
performance tests. Defaults to false.
|
||||
DEPRECATED
|
||||
type: boolean
|
||||
mode:
|
||||
description: Mode is the name of replay mode used for this TrafficReplay.
|
||||
enum:
|
||||
- full-replay
|
||||
- responder-only
|
||||
- generator-only
|
||||
type: string
|
||||
needsReport:
|
||||
description: Indicates whether a responder-only replay needs a report.
|
||||
type: boolean
|
||||
proxyMode:
|
||||
description: |-
|
||||
ProxyMode defines proxy operational mode used with injected sidecar.
|
||||
DEPRECATED
|
||||
type: string
|
||||
responderLowData:
|
||||
description: |-
|
||||
ResponderLowData forces the responder into a high
|
||||
efficiency/low data output mode. This is ideal for high volume
|
||||
performance tests. Defaults to false.
|
||||
DEPRECATED
|
||||
type: boolean
|
||||
secretRefs:
|
||||
description: |-
|
||||
SecretRefs hold the references to the secrets which contain
|
||||
various secrets like (e.g. short-lived JWTs to be used by the generator
|
||||
for authorization with HTTP calls).
|
||||
items:
|
||||
description: |-
|
||||
LocalObjectReference contains enough information to locate the referenced
|
||||
Kubernetes resource object.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the referent.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
sidecar:
|
||||
description: |-
|
||||
Sidecar defines sidecar specific configuration.
|
||||
DEPRECATED: use Workloads
|
||||
properties:
|
||||
inject:
|
||||
description: 'DEPRECATED: do not use'
|
||||
type: boolean
|
||||
patch:
|
||||
description: Patch is .yaml file patch for the Workload
|
||||
format: byte
|
||||
type: string
|
||||
tls:
|
||||
properties:
|
||||
in:
|
||||
description: In provides configuration for sidecar inbound
|
||||
TLS.
|
||||
properties:
|
||||
private:
|
||||
description: Private is the filename of the TLS inbound
|
||||
private key.
|
||||
type: string
|
||||
public:
|
||||
description: Public is the filename of the TLS inbound
|
||||
public key.
|
||||
type: string
|
||||
secret:
|
||||
description: Secret is a secret with the TLS keys to use
|
||||
for inbound traffic.
|
||||
type: string
|
||||
type: object
|
||||
mutual:
|
||||
description: Mutual provides configuration for sidecar mutual
|
||||
TLS.
|
||||
properties:
|
||||
private:
|
||||
description: Private is the filename of the mutual TLS
|
||||
private key.
|
||||
type: string
|
||||
public:
|
||||
description: Public is the filename of the mutual TLS
|
||||
public key.
|
||||
type: string
|
||||
secret:
|
||||
description: Secret is a secret with the mutual TLS keys.
|
||||
type: string
|
||||
type: object
|
||||
out:
|
||||
description: |-
|
||||
Out enables or disables TLS out on the
|
||||
sidecar during replay.
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
snapshotID:
|
||||
description: |-
|
||||
SnapshotID is the id of the traffic snapshot for this
|
||||
TrafficReplay.
|
||||
type: string
|
||||
testConfigID:
|
||||
description: |-
|
||||
TestConfigID is the id of the replay configuration to be used
|
||||
by the generator and responder for the TrafficReplay.
|
||||
type: string
|
||||
timeout:
|
||||
description: |-
|
||||
Timeout is the time to wait for replay test to finish. Defaults
|
||||
to value of the `TIMEOUT` setting of the operator.
|
||||
type: string
|
||||
ttlAfterReady:
|
||||
description: |-
|
||||
TTLAfterReady provides a TTL (time to live) mechanism to limit
|
||||
the lifetime of TrafficReplay object that have finished the execution and
|
||||
reached its final state (either complete or failed).
|
||||
type: string
|
||||
workloadRef:
|
||||
description: |-
|
||||
WorkloadRef is the reference to the target workload (SUT) for
|
||||
TrafficReplay. The operations will be performed in the namespace of the
|
||||
target object.
|
||||
DEPRECATED: use Workloads
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referenced object.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind of the referenced object. Defaults to "Deployment".
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced object. Required when defining for a test unless a
|
||||
custom URI is provided. Always required when defining mocks.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the referenced object. Defaults to the
|
||||
TrafficReplay namespace.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
workloads:
|
||||
description: |-
|
||||
Workloads define target workloads (SUT) for a TrafficReplay. Many
|
||||
workloads may be provided, or none. Workloads may be modified and
|
||||
restarted during replay to configure communication with a responder.
|
||||
items:
|
||||
description: |-
|
||||
Workload represents a Kubernetes workload to be targeted during replay and
|
||||
associated settings.
|
||||
properties:
|
||||
customURI:
|
||||
description: |-
|
||||
CustomURI will be target of the traffic instead of directly targeting
|
||||
workload. This is required if a Ref is not specified.
|
||||
type: string
|
||||
inTrafficKey:
|
||||
description: 'DEPRECATED: use Tests'
|
||||
type: string
|
||||
inTrafficKeys:
|
||||
description: 'DEPRECATED: use Tests'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
mocks:
|
||||
description: |-
|
||||
Mocks are strings used to identify slices of outbound snapshot traffic to
|
||||
mock for this workload and maps directly to a snapshot's `OutTraffic`
|
||||
field. Snapshot egress traffic can be split across multiple slices where
|
||||
each slice contains part of the traffic. A workload may specify multiple
|
||||
keys and multiple workloads may specify the same key.
|
||||
|
||||
|
||||
Only the traffic slices defined here will be mocked. A workload with no
|
||||
keys defined will not mock any traffic. Pass '*' to mock all traffic.
|
||||
|
||||
|
||||
Mock strings may only match part of the snapshot's `OutTraffic` key if the
|
||||
string matches exactly one key. For example, the test string
|
||||
`foo.example.com` would match the `OutTraffic` key of
|
||||
my-service:foo.example.com:8080, as long as no other keys would match
|
||||
`foo.example.com`. Multiple mocks must be specified for multiple keys
|
||||
unless using '*'.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
outTrafficKeys:
|
||||
description: 'DEPRECATED: use Mocks'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
ref:
|
||||
description: |-
|
||||
Ref is a reference to a cluster workload, like a deployment or a
|
||||
statefulset. This is required unless a CustomURI is specified.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referenced object.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind of the referenced object. Defaults to
|
||||
"Deployment".
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referenced object. Required when defining for a test unless a
|
||||
custom URI is provided. Always required when defining mocks.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the referenced object. Defaults
|
||||
to the TrafficReplay namespace.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
routing:
|
||||
description: Routing configures how workloads route egress traffic
|
||||
to responders
|
||||
enum:
|
||||
- hostalias
|
||||
- nat
|
||||
type: string
|
||||
sidecar:
|
||||
description: |-
|
||||
TODO: this is not implemented, come back and replace deprecated Sidecar with workload specific settings
|
||||
Sidecar defines sidecar specific configuration.
|
||||
properties:
|
||||
inject:
|
||||
description: 'DEPRECATED: do not use'
|
||||
type: boolean
|
||||
patch:
|
||||
description: Patch is .yaml file patch for the Workload
|
||||
format: byte
|
||||
type: string
|
||||
tls:
|
||||
properties:
|
||||
in:
|
||||
description: In provides configuration for sidecar inbound
|
||||
TLS.
|
||||
properties:
|
||||
private:
|
||||
description: Private is the filename of the TLS
|
||||
inbound private key.
|
||||
type: string
|
||||
public:
|
||||
description: Public is the filename of the TLS inbound
|
||||
public key.
|
||||
type: string
|
||||
secret:
|
||||
description: Secret is a secret with the TLS keys
|
||||
to use for inbound traffic.
|
||||
type: string
|
||||
type: object
|
||||
mutual:
|
||||
description: Mutual provides configuration for sidecar
|
||||
mutual TLS.
|
||||
properties:
|
||||
private:
|
||||
description: Private is the filename of the mutual
|
||||
TLS private key.
|
||||
type: string
|
||||
public:
|
||||
description: Public is the filename of the mutual
|
||||
TLS public key.
|
||||
type: string
|
||||
secret:
|
||||
description: Secret is a secret with the mutual
|
||||
TLS keys.
|
||||
type: string
|
||||
type: object
|
||||
out:
|
||||
description: |-
|
||||
Out enables or disables TLS out on the
|
||||
sidecar during replay.
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
tests:
|
||||
description: |-
|
||||
Tests are strings used to identify slices of inbound snapshot traffic this
|
||||
workload is targeting and maps directly to a snapshot's `InTraffic` field.
|
||||
Snapshot ingress traffic can be split across multiple slices where each
|
||||
slice contains part of the traffic. A key must only be specified once
|
||||
across all workloads, but a workload may specify multiple keys. Pass '*'
|
||||
to match all keys.
|
||||
|
||||
|
||||
Test strings may only match part of the snapshot's `InTraffic` key if the
|
||||
string matches exactly one key. For example, the test string
|
||||
`foo.example.com` would match the `InTraffic` key of
|
||||
my-service:foo.example.com:8080, as long as no other keys would match
|
||||
`foo.example.com`
|
||||
|
||||
|
||||
This field is optional in the spec to provide support for single-workload
|
||||
and legacy replays, but must be specified for multi-workload replays in
|
||||
order to provide deterministic replay configuration.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- snapshotID
|
||||
- testConfigID
|
||||
type: object
|
||||
status:
|
||||
default:
|
||||
observedGeneration: -1
|
||||
description: TrafficReplayStatus defines the observed state of TrafficReplay
|
||||
properties:
|
||||
active:
|
||||
description: Active indicates whether this traffic replay is currently
|
||||
underway or not.
|
||||
type: boolean
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
finishedTime:
|
||||
description: Information when the traffic replay has finished.
|
||||
format: date-time
|
||||
type: string
|
||||
initializedTime:
|
||||
description: Information when the test environment was successfully
|
||||
prepared.
|
||||
format: date-time
|
||||
type: string
|
||||
lastHeartbeatTime:
|
||||
description: 'DEPRECATED: will not be set'
|
||||
format: date-time
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: ObservedGeneration is the last observed generation.
|
||||
format: int64
|
||||
type: integer
|
||||
reconcileFailures:
|
||||
description: |-
|
||||
ReconcileFailures is the number of times the traffic replay controller
|
||||
experienced an error during the reconciliation process. The traffic
|
||||
replay will be deleted if too many errors occur.
|
||||
format: int64
|
||||
type: integer
|
||||
reportID:
|
||||
description: The id of the traffic replay report created.
|
||||
type: string
|
||||
reportURL:
|
||||
description: The url to the traffic replay report.
|
||||
type: string
|
||||
startedTime:
|
||||
description: Information when the traffic replay has started.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
operator.speedscale.com/ignore: "true"
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
{{- if .Values.globalLabels }}
|
||||
{{ toYaml .Values.globalLabels | indent 4}}
|
||||
{{- end }}
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 8}}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
{{- if .Values.globalLabels }}
|
||||
{{ toYaml .Values.globalLabels | indent 8}}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- /operator
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: speedscale-operator
|
||||
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#container-v1-core
|
||||
# When a key exists in multiple sources, the value associated with the last source will take precedence.
|
||||
# Values defined by an Env with a duplicate key will take precedence.
|
||||
- configMapRef:
|
||||
name: speedscale-operator-override
|
||||
optional: true
|
||||
- secretRef:
|
||||
name: '{{ ne .Values.apiKeySecret "" | ternary .Values.apiKeySecret "speedscale-apikey" }}'
|
||||
optional: false
|
||||
image: '{{ .Values.image.registry }}/operator:{{ .Values.image.tag }}'
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: health-check
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: operator
|
||||
ports:
|
||||
- containerPort: 443
|
||||
name: webhook-server
|
||||
- containerPort: 8081
|
||||
name: health-check
|
||||
readinessProbe:
|
||||
failureThreshold: 10
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: health-check
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {{- toYaml .Values.operator.resources | nindent 10 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: false
|
||||
# Run as root to bind 443 https://github.com/kubernetes/kubernetes/issues/56374
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: webhook-certs
|
||||
readOnly: true
|
||||
- mountPath: /etc/ssl/speedscale
|
||||
name: speedscale-tls-out
|
||||
readOnly: true
|
||||
hostNetwork: {{ .Values.hostNetwork }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: speedscale-operator
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: tmp
|
||||
- name: webhook-certs
|
||||
secret:
|
||||
secretName: speedscale-webhook-certs
|
||||
- name: speedscale-tls-out
|
||||
secret:
|
||||
secretName: speedscale-certs
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{ toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{ toYaml .Values.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
helm.sh/hook-weight: "4"
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
creationTimestamp: null
|
||||
name: speedscale-operator-pre-install
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- if .Values.globalLabels }}
|
||||
{{ toYaml .Values.globalLabels | indent 4}}
|
||||
{{- end }}
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
ttlSecondsAfterFinished: 30
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 8}}
|
||||
{{- end }}
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
{{- if .Values.globalLabels }}
|
||||
{{ toYaml .Values.globalLabels | indent 8}}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- |-
|
||||
# ensure valid settings before the chart reports a successfull install
|
||||
{{- if .Values.http_proxy }}
|
||||
HTTP_PROXY={{ .Values.http_proxy | quote }} \
|
||||
{{- end }}
|
||||
{{- if .Values.https_proxy }}
|
||||
HTTPS_PROXY={{ .Values.https_proxy | quote }} \
|
||||
{{- end }}
|
||||
{{- if .Values.no_proxy }}
|
||||
NO_PROXY={{ .Values.no_proxy | quote }} \
|
||||
{{- end }}
|
||||
speedctl init --overwrite --no-rcfile-update \
|
||||
--api-key $SPEEDSCALE_API_KEY \
|
||||
--app-url $SPEEDSCALE_APP_URL
|
||||
|
||||
# in case we're in istio
|
||||
curl -X POST http://127.0.0.1:15000/quitquitquit || true
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ ne .Values.apiKeySecret "" | ternary .Values.apiKeySecret "speedscale-apikey" }}'
|
||||
optional: false
|
||||
image: '{{ .Values.image.registry }}/speedscale-cli:{{ .Values.image.tag }}'
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: speedscale-cli
|
||||
resources: {}
|
||||
restartPolicy: Never
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{ toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{ toYaml .Values.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,244 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: speedscale-operator
|
||||
{{- if .Values.globalAnnotations }}
|
||||
annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterrolebindings
|
||||
- clusterroles
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
- pods
|
||||
- services
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- metrics.k8s.io
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
- roles
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.istio.io
|
||||
resources:
|
||||
- envoyfilters
|
||||
- sidecars
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- security.istio.io
|
||||
resources:
|
||||
- peerauthentications
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- speedscale.com
|
||||
resources:
|
||||
- trafficreplays
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- speedscale.com
|
||||
resources:
|
||||
- trafficreplays/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- rollouts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: speedscale-operator
|
||||
{{- if .Values.globalAnnotations }}
|
||||
annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: speedscale-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.globalAnnotations }}
|
||||
annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
{{ if .Values.apiKey }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: speedscale-apikey
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/hook-weight: "3"
|
||||
{{- if .Values.globalAnnotations }}
|
||||
{{ toYaml .Values.globalAnnotations | indent 4}}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
SPEEDSCALE_API_KEY: {{ .Values.apiKey | b64enc }}
|
||||
SPEEDSCALE_APP_URL: {{ .Values.appUrl | b64enc }}
|
||||
{{ end }}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
name: speedscale-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.globalAnnotations }}
|
||||
annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: speedscale-operator
|
||||
controlplane.speedscale.com/component: operator
|
||||
status:
|
||||
loadBalancer: {}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue