Merge pull request #936 from nflondo/remove-upbound-tetrate-kdube
Removing dkube, tetrate, and upbound per Issues #923, #925, #929pull/937/head
alex-isv
GitHub
commit
d9551735e3
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,19 +0,0 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: Dkube
|
||||
catalog.cattle.io/release-name: dkube
|
||||
apiVersion: v2
|
||||
appVersion: 3.2.0.1
|
||||
description: A Kubernetes-based MLOps platform based on open standards Kubeflow and
|
||||
MLflow
|
||||
home: https://dkube.io
|
||||
icon: https://www.dkube.io/img/logo_new.png
|
||||
keywords:
|
||||
- kubernetes
|
||||
- MLOps
|
||||
- Kubeflow
|
||||
- AI
|
||||
kubeVersion: "1.20"
|
||||
name: dkube-deployer
|
||||
type: application
|
||||
version: 1.0.602
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# Dkube
|
||||
|
||||
[DKube](https://dkube.io/) is an MLOps product based on best of Kubeflow and MLFlow. It is optimized for implementation on-prem or in the cloud. You get the flexibility and innovation of open source ref architectures like Kubeflow and MLFlow as a supported product.
|
||||
|
||||
With DKube you can prepare your data including feature engineering, train AI models, optimize, tune and publish AI models and be able to deploy/serve those models. Kubeflow pipelines, KF Serving, MLFlow experiment tracking and comparison are all provided while allowing you to track the model and data versioning for reproducibility, audits and governance.
|
||||
|
||||
## Installation
|
||||
|
||||
### Requirements
|
||||
The following is the minimum configuration required to deploy DKube on a Rancher cluster
|
||||
- The minimal configuration for each of the worker nodes is as follows:
|
||||
- 16 cores
|
||||
- 64 GB RAM
|
||||
- 300 GB storage for Root Volume
|
||||
- The worker nodes could be brought up with any of the following OS distributions
|
||||
- Ubuntu 20.04
|
||||
- CentOS / RHEL 7.9
|
||||
- Amazon Linux 2 for installations on AWS
|
||||
- Storage
|
||||
- The recommended storage option for DKube meta-data and user ML resources is an external NFS server with a min of 1TB storage available.
|
||||
- For evaluation purposes, one of the worker nodes can be configured as the storage option. In this case the recommended size of storage on the worker node is 1 TB and a minimum size of 400 GB.
|
||||
- Dkube requires a Kubernetes version of 1.20.
|
||||
- Dkube images registry details are required for installation. Please send a mail to support@dkube.io for the details.
|
||||
- The following sections in the installation guide needs to be followed to prepare Rancher cluster for Dkube installation.
|
||||
- [Getting the Dkube Files](https://dkube.io/install/install3_x/Install-Getting-Started.html#getting-the-dkube-files)
|
||||
- [Setting up the Rancher Cluster](https://dkube.io/install/install3_x/Install-Rancher.html#setting-up-the-rancher-cluster)
|
||||
- [Preparing the Rancher Cluster](https://dkube.io/install/install3_x/Install-Rancher.html#preparing-the-rancher-cluster).
|
||||
- [Node Setup](https://dkube.io/install/install3_x/Install-Rancher.html#node-setup). This is optional for a non-GPU cluster.
|
||||
|
||||
For more information on installation, refer to the [Dkube Installation Guide](https://dkube.io/install/install3_x/Install-Advanced.html).
|
||||
|
|
@ -1,326 +0,0 @@
|
|||
questions:
|
||||
- variable: EULA
|
||||
description: "The Dkube EULA is available at www.oneconvergence.com/EULA/One-Convergence-EULA.pdf . By accepting this license agreement you acknowledge that you have read and understood the terms and conditions mentioned. Please refer to Basic Configuration section of the installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#basic-configuration"
|
||||
type: enum
|
||||
label: DKUBE-EULA
|
||||
required: true
|
||||
group: "General"
|
||||
options:
|
||||
- "yes"
|
||||
- variable: username
|
||||
default: ""
|
||||
description: "Dkube operator's local sigh-in username: Username cannot be same as that of a namespace's name. Also, following names are restricted - dkube, dkube-infra, kubeflow, istio-system, knative-serving, harbor-system. Please refer to Basic Configuration section of the installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#basic-configuration"
|
||||
type: string
|
||||
label: Username
|
||||
required: true
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: password
|
||||
default: ""
|
||||
description: "Dkube operator's local sigh-in password"
|
||||
type: password
|
||||
label: Password
|
||||
required: true
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: version
|
||||
default: "3.2.0.1"
|
||||
description: "Version of dkube to be installed"
|
||||
type: string
|
||||
label: Dkube version
|
||||
required: true
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: provider
|
||||
default: "dkube"
|
||||
description: "Kubernetes provider: Choose one of dkube/gke/okd/eks/ntnx/tanzu"
|
||||
type: enum
|
||||
label: Kube Provider
|
||||
required: true
|
||||
options:
|
||||
- "dkube"
|
||||
- "gke"
|
||||
- "okd"
|
||||
- "eks"
|
||||
- "ntnx"
|
||||
- "tanzu"
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: ha
|
||||
default: "false"
|
||||
description: "When HA=true k8s cluster must have min 3 schedulable nodes. Please refer to resilient operation section of the installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#resilient-operation"
|
||||
type: boolean
|
||||
label: HA
|
||||
required: true
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: wipedata
|
||||
default: yes
|
||||
description: "Wipe dkube data during helm operation install/uninstall. Choose one of yes/no"
|
||||
type: enum
|
||||
label: Wipe Data
|
||||
required: true
|
||||
options:
|
||||
- "yes"
|
||||
- "no"
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: minimal
|
||||
default: no
|
||||
description: "To install minimal version of dkube. Choose one of yes/no"
|
||||
type: enum
|
||||
label: Minimal
|
||||
required: true
|
||||
options:
|
||||
- "yes"
|
||||
- "no"
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: airgap
|
||||
default: no
|
||||
description: "To install air-gapped version of dkube. Choose one of yes/no"
|
||||
type: enum
|
||||
label: Airgap
|
||||
required: true
|
||||
options:
|
||||
- "yes"
|
||||
- "no"
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
# registry
|
||||
- variable: registry.name
|
||||
default: "docker.io/ocdr"
|
||||
description: "Repository from where Dkube images can be picked. Format: registry/[repo]. Please contact support@dkube.io for Dkube registry details"
|
||||
type: string
|
||||
label: Dkube images registry
|
||||
required: true
|
||||
group: "Registry"
|
||||
show_if: "EULA=yes"
|
||||
- variable: registry.username
|
||||
default: ""
|
||||
description: "Container registry username"
|
||||
type: string
|
||||
label: Dkube images registry username
|
||||
required: true
|
||||
group: "Registry"
|
||||
show_if: "EULA=yes"
|
||||
- variable: registry.password
|
||||
default: ""
|
||||
description: "Container registry password"
|
||||
type: password
|
||||
label: Dkube images registry password
|
||||
required: true
|
||||
group: "Registry"
|
||||
show_if: "EULA=yes"
|
||||
# STORAGE
|
||||
- variable: optional.storage.type
|
||||
default: "disk"
|
||||
description: "Type of storage. Note: ceph storage type can only be use with HA=true And pv or sc can only be used with HA=false. Please refer to Storage options section of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#storage-options"
|
||||
type: enum
|
||||
label: Dkube storage type
|
||||
options:
|
||||
- "disk"
|
||||
- "nfs"
|
||||
- "ceph"
|
||||
- "pv"
|
||||
- "sc"
|
||||
group: "Storage"
|
||||
show_if: "EULA=yes"
|
||||
subquestions:
|
||||
- variable: optional.storage.path
|
||||
default: "/var/dkube"
|
||||
description: "Localpath on the storage node"
|
||||
type: string
|
||||
label: Dkube storage disk path
|
||||
show_if: "optional.storage.type=disk"
|
||||
- variable: optional.storage.node
|
||||
default: ""
|
||||
description: "Node name for dkube storage. Provide hostname of the master node if Kube provider is dkube"
|
||||
type: string
|
||||
label: Dkube storage disk node
|
||||
show_if: "optional.storage.type=disk"
|
||||
- variable: optional.storage.persistentVolume
|
||||
default: ""
|
||||
description: "Name of persistent volume to be used for storage"
|
||||
type: string
|
||||
label: Storage PV
|
||||
show_if: "ha=false&&optional.storage.type=pv"
|
||||
- variable: optional.storage.storageClass
|
||||
default: ""
|
||||
description: "Name of storage class to be used for storage. Make sure dynamic provisioner is running for the storage class name"
|
||||
type: string
|
||||
label: Storage class
|
||||
show_if: "ha=false&&optional.storage.type=sc"
|
||||
- variable: optional.storage.nfsServer
|
||||
default: ""
|
||||
description: "NFS server ip to be used for storage"
|
||||
type: string
|
||||
label: NFS Server
|
||||
show_if: "optional.storage.type=nfs"
|
||||
- variable: optional.storage.nfsPath
|
||||
default: ""
|
||||
description: "NFS path (Make sure the path exists)"
|
||||
type: string
|
||||
label: NFS path
|
||||
show_if: "optional.storage.type=nfs"
|
||||
- variable: optional.storage.cephMonitors
|
||||
default: ""
|
||||
description: "Comma separated IPs of ceph monitors"
|
||||
type: string
|
||||
label: Ceph monitors
|
||||
show_if: "optional.storage.type=ceph"
|
||||
- variable: optional.storage.cephSecret
|
||||
default: ""
|
||||
description: "Ceph secret"
|
||||
type: string
|
||||
label: Ceph Secret
|
||||
show_if: "optional.storage.type=ceph"
|
||||
- variable: optional.storage.cephFilesystem
|
||||
default: ""
|
||||
description: "Ceph Filesystem"
|
||||
type: string
|
||||
label: Ceph Filesystem
|
||||
show_if: "optional.storage.type=ceph"
|
||||
- variable: optional.storage.cephNamespace
|
||||
default: ""
|
||||
description: "Ceph Namespace"
|
||||
type: string
|
||||
label: Ceph Namespace
|
||||
show_if: "optional.storage.type=ceph"
|
||||
- variable: optional.storage.cephPath
|
||||
default: "/var/lib/rook"
|
||||
description: "Ceph data and configuration path for internal ceph. Internal ceph is installed when HA=true and Storage type is not equal to nfs or ceph"
|
||||
type: string
|
||||
label: Ceph storage path
|
||||
#show_if: "ha=true&&optional.storage.type!=ceph&&optional.storage.type!=nfs"
|
||||
show_if: "ha=true"
|
||||
- variable: optional.storage.cephDisk
|
||||
default: ""
|
||||
description: "Only for internal ceph from release 2.2.1.12. Disk name for internal ceph storage. It should be a raw formatted disk. E.g: sdb"
|
||||
type: string
|
||||
label: Ceph Storage Disk
|
||||
#show_if: "ha=true&&optional.storage.type!=ceph&&optional.storage.type!=nfs"
|
||||
show_if: "ha=true"
|
||||
# Loadbalancer
|
||||
- variable: optional.loadbalancer.access
|
||||
default: "nodeport"
|
||||
description: "Type of dkube proxy service, possible values are nodeport and loadbalancer; Please use loadbalancer if kubeProvider is gke."
|
||||
type: enum
|
||||
label: Dkube access type
|
||||
group: "Loadbalancer"
|
||||
#show_if: "EULA=yes&&ha=true"
|
||||
#show_if: "EULA=yes&&ha=true&&optional.storage.type!=ceph&&optional.storage.type!=nfs"
|
||||
#show_if: "ha=true&&optional.storage.type=ceph"
|
||||
options:
|
||||
- "loadbalancer"
|
||||
- "nodeport"
|
||||
show_subquestion_if: loadbalancer
|
||||
show_if: "EULA=yes"
|
||||
subquestions:
|
||||
- variable: optional.loadbalancer.metallb
|
||||
default: false
|
||||
description: "Set true to install MetalLB Loadbalancer. Please refer to Load Balancer options section of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#load-balancer-options"
|
||||
type: string
|
||||
label: MetalLB Loadbalancer
|
||||
- variable: optional.loadbalancer.vipPool
|
||||
default: ""
|
||||
description: "Valid only if installLoadbalancer is true; Only CIDR notation is allowed. E.g: 192.168.2.0/24"
|
||||
type: string
|
||||
label: Loadbalancer VipPool
|
||||
show_if: "EULA=yes"
|
||||
# Modelmonitor
|
||||
- variable: optional.modelmonitor.enabled
|
||||
default: "false"
|
||||
description: "To enable modelmonitor in dkube. (true / false). Please refer to Model Monitor section of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#model-monitor"
|
||||
type: boolean
|
||||
label: Enable Modelmonitor
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
# DBAAS
|
||||
- variable: optional.DBAAS.database
|
||||
default: ""
|
||||
description: "To configure external database for dkube. Supported mysql, sqlserver(mssql). Empty will pickup default sql db installed with dkube. Please refer to section External Database of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#external-database"
|
||||
type: string
|
||||
label: database
|
||||
group: "DBAAS"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.DBAAS.dsn
|
||||
default: ""
|
||||
description: "Syntaxes here can be followed to specify dsn https://gorm.io/docs/connecting_to_the_database.html"
|
||||
type: string
|
||||
label: dsn
|
||||
group: "DBAAS"
|
||||
show_if: "EULA=yes"
|
||||
# CICD
|
||||
- variable: optional.CICD.enabled
|
||||
default: "false"
|
||||
description: "To enable tekton cicd with dkube. (true / false). Please refer to CICD section of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#ci-cd"
|
||||
type: boolean
|
||||
label: CICD Enabled
|
||||
group: "CICD"
|
||||
show_if: "EULA=yes"
|
||||
show_subquestion_if: true
|
||||
subquestions:
|
||||
- variable: optional.CICD.registryName
|
||||
default: false
|
||||
description: "Docker registry where CICD built images will be saved"
|
||||
type: string
|
||||
label: Docker registry name
|
||||
- variable: optional.CICD.registryUsername
|
||||
default: false
|
||||
description: "Docker registry Username"
|
||||
type: string
|
||||
label: Docker registry Username
|
||||
- variable: optional.CICD.registryPassword
|
||||
default: false
|
||||
description: "Docker registry password"
|
||||
type: string
|
||||
label: Docker registry Password
|
||||
- variable: optional.CICD.IAMRole
|
||||
default: false
|
||||
description: "For AWS ECR on EKS K8S cluster, enter registry as aws_account_id.dkr.ecr.region.amazonaws.com. registryName: 'aws_account_id.dkr.ecr.region.amazonaws.com' Worker nodes should either have AmazonEC2ContainerRegistryFullAccess or if you are using KIAM based IAM control, provide an IAM role which has AmazonEC2ContainerRegistryFullAccess; IAMRole: 'arn:aws:iam::<aws_account_id>:role/<iam-role>'"
|
||||
type: string
|
||||
label: IAMRole
|
||||
# Node Affinity
|
||||
- variable: optional.nodeAffinity.dkubeNodesLabel
|
||||
default: ""
|
||||
description: "Nodes identified by labels on which the dkube pods must be scheduled.. Say management nodes. Unfilled means no binding. When filled there needs to be minimum of 3nodes in case of HA and one node in case of non-HA. Example: DKUBE_NODES_LABEL: key1=value1. Please refer to section Node Affinity of installation guide. https://dkube.io/install/install3_x/Install-Advanced.html#node-affinity"
|
||||
type: string
|
||||
label: DKUBE_NODES_LABEL
|
||||
group: "NodeAffinity"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.nodeAffinity.dkubeNodesTaints
|
||||
default: ""
|
||||
description: "Nodes to be tolerated by dkube control plane pods so that only they can be scheduled on the nodes. Example: DKUBE_NODES_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule"
|
||||
type: string
|
||||
label: DKUBE_NODES_TAINTS
|
||||
group: "NodeAffinity"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.nodeAffinity.gpuWorkloadTaints
|
||||
default: ""
|
||||
description: "Taints of the nodes where gpu workloads must be scheduled. Example: GPU_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule"
|
||||
type: string
|
||||
label: GPU_WORKLOADS_TAINTS
|
||||
group: "NodeAffinity"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.nodeAffinity.productionWorkloadTaints
|
||||
default: ""
|
||||
description: "Taints of the nodes where production workloads must be scheduled. Example: PRODUCTION_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule"
|
||||
type: string
|
||||
label: PRODUCTION_WORKLOADS_TAINTS
|
||||
group: "NodeAffinity"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.dkubeDockerhubCredentialsSecret
|
||||
default: ""
|
||||
description: "Dockerhub Secrets for OCDR images. If you don't create, this will be auto-created with default values."
|
||||
type: string
|
||||
label: DKUBE DOCKERHUB CREDENTIALS SECRET
|
||||
group: "General"
|
||||
show_if: "EULA=yes"
|
||||
- variable: optional.IAMRole
|
||||
default: ""
|
||||
description: "AWS IAM role. Valid only if KUBE_PROVIDER=eks. This will be set as an annotation in few deployments. Format should be like: IAMRole: '<key>: <iam role>' eg: IAMRole: 'iam.amazonaws.com/role: arn:aws:iam::123456789012:role/myrole'"
|
||||
type: string
|
||||
label: IAMRole
|
||||
group: "General"
|
||||
show_if: "EULA=yes&&provider=eks"
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
Installing Dkube {{ .Values.version }}
|
||||
|
||||
DKube Installation has started. Please use the commands below to view the installation progress. The commands are for installation only. Do not use them for upgrade.
|
||||
|
||||
kubectl wait --for=condition=ready --timeout=5m pod -l job-name=dkube-helm-installer
|
||||
|
||||
kubectl logs -l job-name=dkube-helm-installer --follow --tail=-1 && kubectl wait --for=condition=complete --timeout=30m job/dkube-helm-installer
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "dkube-deployer.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "dkube-deployer.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "dkube-deployer.labels" -}}
|
||||
helm.sh/chart: {{ include "dkube-deployer.chart" . }}
|
||||
{{ include "dkube-deployer.selectorLabels" . }}
|
||||
app.kubernetes.io/version: {{ .Values.version | quote }}
|
||||
app.kubernetes.io/managed-by: "dkube.io"
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "dkube-deployer.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "dkube-deployer.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Image pull secret
|
||||
*/}}
|
||||
{{- define "dkube-deployer.imagePullSecretData" -}}
|
||||
{{- with .Values.registry }}
|
||||
{{- printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"ocdlgit@oneconvergence.com\",\"auth\":\"%s\"}}}" .name .username .password (printf "%s:%s" .username .password | b64enc) | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
model catalog enable flag
|
||||
*/}}
|
||||
{{- define "dkube-deployer.modelCatalog" -}}
|
||||
{{- if hasPrefix "2.1" .Values.version }}
|
||||
{{- printf "false" }}
|
||||
{{- else }}
|
||||
{{- printf "true" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,167 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: dkube-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
data:
|
||||
dkube.ini: |
|
||||
#################################################################
|
||||
# #
|
||||
# DKUBE CONFIG FILE #
|
||||
# #
|
||||
#################################################################
|
||||
|
||||
[REQUIRED]
|
||||
# Choose one of dkube/gke/okd/eks/ntnx
|
||||
KUBE_PROVIDER={{ .Values.provider }}
|
||||
# When HA=true k8s cluster must have min 3 schedulable nodes
|
||||
HA={{ .Values.ha }}
|
||||
# Operator's Local Sign In Details
|
||||
# Username cannot be same as that of a namespace's name.
|
||||
# Also, following names are restricted- dkube, monitoring, kubeflow
|
||||
# '$' is not supported
|
||||
USERNAME={{ .Values.username }}
|
||||
PASSWORD={{ .Values.password }}
|
||||
# To wipe dkube storage
|
||||
# Accepted values: yes/no
|
||||
WIPEDATA={{ .Values.wipedata }}
|
||||
# To install minimal version of dkube
|
||||
# Accepted values: yes/no
|
||||
MINIMAL={{ .Values.minimal }}
|
||||
# To install air-gapped version of dkube
|
||||
# Accepted values: yes/no
|
||||
AIRGAP={{ .Values.airgap }}
|
||||
|
||||
|
||||
[NODE-AFFINITY]
|
||||
# Nodes identified by labels on which the dkube pods must be scheduled.. Say management nodes. Unfilled means no binding. When filled there needs to be minimum of 3nodes in case of HA and one node in case of non-HA
|
||||
# Example: DKUBE_NODES_LABEL: key1=value1
|
||||
DKUBE_NODES_LABEL: {{ .Values.optional.nodeAffinity.dkubeNodesLabel }}
|
||||
# Nodes to be tolerated by dkube control plane pods so that only they can be scheduled on the nodes
|
||||
# Example: DKUBE_NODES_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
DKUBE_NODES_TAINTS: {{ .Values.optional.nodeAffinity.dkubeNodesTaints }}
|
||||
# Taints of the nodes where gpu workloads must be scheduled.
|
||||
# Example: GPU_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
GPU_WORKLOADS_TAINTS: {{ .Values.optional.nodeAffinity.gpuWorkloadTaints }}
|
||||
# Taints of the nodes where production workloads must be scheduled.
|
||||
# Example: PRODUCTION_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
PRODUCTION_WORKLOADS_TAINTS: {{ .Values.optional.nodeAffinity.productionWorkloadTaints }}
|
||||
|
||||
[OPTIONAL]
|
||||
# version of dkube installer to be used
|
||||
DKUBE_INSTALLER_VERSION={{ .Values.version }}
|
||||
# version of dkube to be installed
|
||||
DKUBE_VERSION={{ .Values.version }}
|
||||
# Dockerhub Secrets for OCDR images
|
||||
# If you don't create, this will be auto-created with default values.
|
||||
DKUBE_DOCKERHUB_CREDENTIALS_SECRET={{ .Values.optional.dkubeDockerhubCredentialsSecret }}
|
||||
# TLS Secret of Operator's Certificate & Private Key
|
||||
# If you don't create, place your certificate and private key in $HOME/.dkube
|
||||
DKUBE_OPERATOR_CERTIFICATE=
|
||||
# Repository from where Dkube images can be picked.
|
||||
# Format: registry/[repo]
|
||||
DKUBE_REGISTRY={{ .Values.registry.name }}
|
||||
# Container registry username
|
||||
REGISTRY_UNAME={{ .Values.registry.username }}
|
||||
# Container registry password
|
||||
REGISTRY_PASSWD={{ .Values.registry.password }}
|
||||
# AWS IAM role
|
||||
# Valid only if KUBE_PROVIDER=eks
|
||||
# This will be set as an annotation in few deployments
|
||||
# Format should be like:
|
||||
# IAM_ROLE=<key>: <iam role>
|
||||
# eg: IAM_ROLE=iam.amazonaws.com/role: arn:aws:iam::123456789012:role/myrole
|
||||
# Note: Don't enclose with quotes
|
||||
IAM_ROLE={{ .Values.optional.IAMRole }}
|
||||
|
||||
[EXTERNAL]
|
||||
# Type of dkube proxy service, possible values are nodeport and loadbalancer
|
||||
ACCESS={{ .Values.optional.loadbalancer.access }}
|
||||
# 'true' - to install MetalLB Loadbalancer
|
||||
# Must fill LB_VIP_POOL if true
|
||||
INSTALL_LOADBALANCER={{ .Values.optional.loadbalancer.metallb }}
|
||||
# Only CIDR notation is allowed. E.g: 192.168.2.0/24
|
||||
# Valid only if INSTALL_LOADBALANCER=true
|
||||
LB_VIP_POOL={{ .Values.optional.loadbalancer.vipPool }}
|
||||
|
||||
[STORAGE]
|
||||
# Type of storage
|
||||
# Possible values: disk, pv, sc, nfs
|
||||
# Following are required fields for corresponding storage type
|
||||
# -------------------------------------------------------
|
||||
# STORAGE_TYPE REQUIRED_FIELDS
|
||||
# -------------------------------------------------------
|
||||
# disk STORAGE_DISK_NODE and STORAGE_DISK_PATH
|
||||
# pv STORAGE_PV
|
||||
# sc STORAGE_SC
|
||||
# nfs STORAGE_NFS_SERVER and STORAGE_NFS_PATH
|
||||
# ceph STORAGE_CEPH_MONITORS and STORAGE_CEPH_SECRET
|
||||
# For 2.2.1.12 and later
|
||||
# ceph STORAGE_CEPH_FILESYSTEM and STORAGE_CEPH_NAMESPACE
|
||||
|
||||
STORAGE_TYPE={{ .Values.optional.storage.type }}
|
||||
# Localpath on the storage node
|
||||
STORAGE_DISK_PATH={{ .Values.optional.storage.path }}
|
||||
# Nodename of the storage node
|
||||
# Possible values: AUTO/<nodename>
|
||||
# AUTO - Master node will be chosen for storage if KUBE_PROVIDER=dkube
|
||||
STORAGE_DISK_NODE={{ .Values.optional.storage.node }}
|
||||
# Name of persistent volume
|
||||
STORAGE_PV={{ .Values.optional.storage.persistentVolume }}
|
||||
# Name of storage class name
|
||||
# Make sure dynamic provisioner is running for the storage class name
|
||||
STORAGE_SC={{ .Values.optional.storage.storageClass }}
|
||||
# NFS server ip
|
||||
STORAGE_NFS_SERVER={{ .Values.optional.storage.nfsServer }}
|
||||
# NFS path (Make sure the path exists)
|
||||
STORAGE_NFS_PATH={{ .Values.optional.storage.nfsPath }}
|
||||
# Comma separated IPs of ceph monitors
|
||||
STORAGE_CEPH_MONITORS={{ .Values.optional.storage.cephMonitors }}
|
||||
# Ceph secret
|
||||
STORAGE_CEPH_SECRET={{ .Values.optional.storage.cephSecret }}
|
||||
# Name of the ceph filesystem
|
||||
# E.g: dkubefs
|
||||
STORAGE_CEPH_FILESYSTEM={{ .Values.optional.storage.cephFilesystem }}
|
||||
# Name of the namespace where ceph is installed
|
||||
# E.g: rook-ceph
|
||||
STORAGE_CEPH_NAMESPACE={{ .Values.optional.storage.cephNamespace }}
|
||||
|
||||
# Internal Ceph
|
||||
# Internal ceph is installed when HA=true and STORAGE_TYPE is not in ("nfs", "ceph")
|
||||
# Both the following fields are compulsory
|
||||
# Configuration path for internal ceph
|
||||
STORAGE_CEPH_PATH={{ .Values.optional.storage.cephPath }}
|
||||
# Disk name for internal ceph storage
|
||||
# It should be a raw formatted disk
|
||||
# E.g: sdb
|
||||
STORAGE_CEPH_DISK={{ .Values.optional.storage.cephDisk }}
|
||||
[MODELMONITOR]
|
||||
#To enable modelmonitor in dkube. (true / false)
|
||||
ENABLED={{ .Values.optional.modelmonitor.enabled }}
|
||||
[CICD]
|
||||
#To enable tekton cicd with dkube. (true / false)
|
||||
ENABLED={{ .Values.optional.CICD.enabled }}
|
||||
#Docker registry where CICD built images will be saved.
|
||||
#For DockerHub, enter docker.io/<username>
|
||||
DOCKER_REGISTRY={{ .Values.optional.CICD.registryName }}
|
||||
REGISTRY_USERNAME={{ .Values.optional.CICD.registryUsername }}
|
||||
REGISTRY_PASSWORD={{ .Values.optional.CICD.registryPassword }}
|
||||
|
||||
#For AWS ECR on EKS K8S cluster, enter registry as aws_account_id.dkr.ecr.region.amazonaws.com.
|
||||
#DOCKER_REGISTRY=aws_account_id.dkr.ecr.region.amazonaws.com
|
||||
#Worker nodes should either have AmazonEC2ContainerRegistryFullAccess or if you are using KIAM
|
||||
#based IAM control, provide an IAM role which has AmazonEC2ContainerRegistryFullAccess
|
||||
IAM_ROLE={{ .Values.optional.CICD.IAMRole }}
|
||||
[MODEL-CATALOG]
|
||||
#To enable model catalog with dkube. (true / false)
|
||||
ENABLED={{ template "dkube-deployer.modelCatalog" . }}
|
||||
|
||||
#To configure external database for dkube
|
||||
[DBAAS]
|
||||
#Supported mysql, sqlserver(mssql)
|
||||
#Empty will pickup default sql db installed with dkube.
|
||||
DATABASE={{ .Values.optional.DBAAS.database }}
|
||||
#Syntaxes here can be followed to specify dsn https://gorm.io/docs/connecting_to_the_database.html
|
||||
DSN={{ .Values.optional.DBAAS.dsn }}
|
||||
|
|
@ -1,47 +0,0 @@
|
|||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "dkube-uninstaller-hook"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# This is what defines this resource as a hook. Without this line, the
|
||||
# job is considered part of the release.
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-weight": "-5"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
template:
|
||||
metadata:
|
||||
name: "dkube-uninstaller-hook"
|
||||
labels:
|
||||
{{- include "dkube-deployer.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
hostPID: true
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: dkube-dockerhub-secret
|
||||
containers:
|
||||
- name: dkube-uninstaller-hook
|
||||
image: {{ .Values.registry.name }}/dkubeadm:{{ .Values.version }}
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
-
|
||||
mountPath: /root/.dkube/dkube.ini
|
||||
name: dkube-config
|
||||
subPath: dkube.ini
|
||||
{{- if eq .Values.wipedata "yes" }}
|
||||
command: ["/opt/dkubeadm/dkubeadm.sh", "dkube", "uninstall", "--wipe-data"]
|
||||
{{- else }}
|
||||
command: ["/opt/dkubeadm/dkubeadm.sh", "dkube", "uninstall"]
|
||||
{{- end }}
|
||||
serviceAccountName: dkube-deployer-sa
|
||||
volumes:
|
||||
-
|
||||
configMap:
|
||||
name: dkube-config
|
||||
name: dkube-config
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "dkube-upgrade-hook"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# This is what defines this resource as a hook. Without this line, the
|
||||
# job is considered part of the release.
|
||||
"helm.sh/hook": post-upgrade
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
template:
|
||||
metadata:
|
||||
name: "dkube-upgrade-hook"
|
||||
labels:
|
||||
{{- include "dkube-deployer.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: dkube-dockerhub-secret
|
||||
containers:
|
||||
- name: dkube-upgrade-hook
|
||||
image: {{ .Values.registry.name }}/dkubeadm:{{ .Values.version }}
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
privileged: true
|
||||
command: ["/opt/dkubeadm/dkubeadm.sh", "dkube", "upgrade", {{ .Values.version | quote}}]
|
||||
serviceAccountName: dkube-deployer-sa
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "dkube-installer-job-cleanup-hook"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# This is what defines this resource as a hook. Without this line, the
|
||||
# job is considered part of the release.
|
||||
"helm.sh/hook": pre-upgrade,post-upgrade
|
||||
"helm.sh/hook-weight": "-2"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
template:
|
||||
metadata:
|
||||
name: "dkube-installer-job-cleanup-hook"
|
||||
labels:
|
||||
{{- include "dkube-deployer.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: dkube-dockerhub-secret
|
||||
containers:
|
||||
- name: dkube-installer-job-cleanup-hook
|
||||
image: {{ .Values.registry.name }}/dkubeadm:{{ .Values.version }}
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
privileged: true
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- kubectl delete job dkube-helm-installer --ignore-not-found=true
|
||||
serviceAccountName: dkube-deployer-sa
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "dkube-helm-installer"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
template:
|
||||
metadata:
|
||||
name: "dkube-helm-installer"
|
||||
labels:
|
||||
{{- include "dkube-deployer.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
hostPID: true
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: dkube-dockerhub-secret
|
||||
containers:
|
||||
- name: dkube-helm-installer
|
||||
image: {{ .Values.registry.name }}/dkubeadm:{{ .Values.version }}
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
-
|
||||
mountPath: /root/.dkube/dkube.ini
|
||||
name: dkube-config
|
||||
subPath: dkube.ini
|
||||
{{- if eq .Values.wipedata "yes" }}
|
||||
command: ["/opt/dkubeadm/dkubeadm.sh", "dkube", "install", "--accept-eula=yes", "--wipe-data"]
|
||||
{{- else }}
|
||||
command: ["/opt/dkubeadm/dkubeadm.sh", "dkube", "install", "--accept-eula={{ .Values.EULA }}"]
|
||||
{{- end }}
|
||||
serviceAccountName: dkube-deployer-sa
|
||||
volumes:
|
||||
-
|
||||
configMap:
|
||||
name: dkube-config
|
||||
name: dkube-config
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: dkube-dockerhub-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: {{ template "dkube-deployer.imagePullSecretData" . }}
|
||||
|
|
@ -1,136 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: dkube-deployer-binding
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: dkube-deployer-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: dkube-deployer-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: dkube-deployer-clusterrole
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "dkube-deployer.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/exec
|
||||
- pods/portforward
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- create
|
||||
- delete
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- tfjobs
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- mpijobs
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumes
|
||||
- persistentvolumeclaims
|
||||
- services
|
||||
- endpoints
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- nodes
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
- cronjobs
|
||||
verbs:
|
||||
- '*'
|
||||
|
|
@ -1,205 +0,0 @@
|
|||
{
|
||||
"$schema":"http://json-schema.org/draft-07/schema",
|
||||
"type":"object",
|
||||
"title":"The root schema",
|
||||
"description":"The root schema comprises the entire JSON document.",
|
||||
"required":[
|
||||
"EULA",
|
||||
"username",
|
||||
"password",
|
||||
"version",
|
||||
"provider",
|
||||
"ha",
|
||||
"wipedata",
|
||||
"registry",
|
||||
"optional"
|
||||
],
|
||||
"properties":{
|
||||
"provider":{
|
||||
"$id":"#/properties/provider",
|
||||
"enum": ["dkube", "gke", "okd", "eks", "ntnx", "tanzu"]
|
||||
},
|
||||
"username":{
|
||||
"$id":"#/properties/username",
|
||||
"type":"string",
|
||||
"minLength":1
|
||||
},
|
||||
"password":{
|
||||
"$id":"#/properties/password",
|
||||
"type":"string",
|
||||
"minLength":1
|
||||
},
|
||||
"EULA":{
|
||||
"$id":"#/properties/EULA",
|
||||
"type":"string",
|
||||
"enum": ["yes"]
|
||||
},
|
||||
"ha":{
|
||||
"$id":"#/properties/ha",
|
||||
"type":"boolean"
|
||||
},
|
||||
"wipedata":{
|
||||
"$id":"#/properties/wipedata",
|
||||
"type":"string",
|
||||
"enum": ["yes", "no"]
|
||||
},
|
||||
"registry":{
|
||||
"$id":"#/properties/registry",
|
||||
"type":"object",
|
||||
"required": [
|
||||
"name",
|
||||
"username",
|
||||
"password"
|
||||
],
|
||||
"properties":{
|
||||
"name":{
|
||||
"$id":"#/properties/registry/properties/name",
|
||||
"type":"string",
|
||||
"minLength":1
|
||||
},
|
||||
"username":{
|
||||
"$id":"#/properties/registry/properties/username",
|
||||
"type":"string",
|
||||
"minLength":1
|
||||
},
|
||||
"password":{
|
||||
"$id":"#/properties/registry/properties/password",
|
||||
"type":"string",
|
||||
"minLength":1
|
||||
}
|
||||
}
|
||||
},
|
||||
"optional":{
|
||||
"$id":"#/properties/optional",
|
||||
"type":"object",
|
||||
"required": [
|
||||
"storage"
|
||||
],
|
||||
"properties":{
|
||||
"storage":{
|
||||
"$id":"#/properties/optional/properties/storage",
|
||||
"type":"object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"enum": ["disk", "pv", "sc", "nfs", "ceph"]
|
||||
}
|
||||
},
|
||||
"allOf":[
|
||||
{
|
||||
"if": {
|
||||
"properties": {"type": {"const": "disk"}}
|
||||
},
|
||||
"then": {
|
||||
"$ref": "#/properties/optional/definitions/disk"
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {"type": {"const": "pv"}}
|
||||
},
|
||||
"then": {
|
||||
"$ref": "#/properties/optional/definitions/pv"
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {"type": {"const": "sc"}}
|
||||
},
|
||||
"then": {
|
||||
"$ref": "#/properties/optional/definitions/sc"
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {"type": {"const": "nfs"}}
|
||||
},
|
||||
"then": {
|
||||
"$ref": "#/properties/optional/definitions/nfs"
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {"type": {"const": "ceph"}}
|
||||
},
|
||||
"then": {
|
||||
"$ref": "#/properties/optional/definitions/ceph"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"definitions":{
|
||||
"disk":{
|
||||
"properties":{
|
||||
"path":{
|
||||
"type":"string",
|
||||
"pattern":"^(/[^/ ]*)+/?$"
|
||||
},
|
||||
"node":{
|
||||
"type":"string",
|
||||
"minLength": 1
|
||||
}
|
||||
},
|
||||
"required":[
|
||||
"path",
|
||||
"node"
|
||||
]
|
||||
},
|
||||
"pv":{
|
||||
"properties":{
|
||||
"persistentVolume":{
|
||||
"type":"string",
|
||||
"minLength": 1
|
||||
}
|
||||
},
|
||||
"required":[
|
||||
"persistentVolume"
|
||||
]
|
||||
},
|
||||
"sc":{
|
||||
"properties":{
|
||||
"storageClass":{
|
||||
"type":"string",
|
||||
"minLength": 1
|
||||
}
|
||||
},
|
||||
"required":[
|
||||
"storageClass"
|
||||
]
|
||||
},
|
||||
"nfs":{
|
||||
"properties":{
|
||||
"nfsPath":{
|
||||
"type":"string",
|
||||
"pattern":"^(/[^/ ]*)+/?$"
|
||||
},
|
||||
"nfsServer":{
|
||||
"type":"string",
|
||||
"minLength": 1
|
||||
}
|
||||
},
|
||||
"required":[
|
||||
"nfsPath",
|
||||
"nfsServer"
|
||||
]
|
||||
},
|
||||
"ceph":{
|
||||
"properties":{
|
||||
"cephMonitors":{
|
||||
"type":"string"
|
||||
},
|
||||
"cephSecret":{
|
||||
"type":"string"
|
||||
},
|
||||
"cephFilesystem":{
|
||||
"type":"string"
|
||||
},
|
||||
"cephNamespace":{
|
||||
"type":"string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,182 +0,0 @@
|
|||
# The DKube EULA is available at: www.oneconvergence.com/EULA/One-Convergence-EULA.pdf
|
||||
# By accepting this license agreement you acknowledge that you agree to the terms and conditions.
|
||||
# The installation will only proceed if the EULA is accepted by defining the EULA value as "yes".
|
||||
EULA: ""
|
||||
|
||||
# Operator's Local Sign In Details.
|
||||
# Username cannot be same as that of a kubernetes namespace's name.
|
||||
# Names like dkube, monitoring, kubeflow are restricted.
|
||||
username: ""
|
||||
password: ""
|
||||
|
||||
# dkube version
|
||||
version: "3.2.0.1"
|
||||
|
||||
# Choose one of dkube/gke/okd/eks/ntnx/tanzu kube provider
|
||||
provider: "dkube"
|
||||
|
||||
# For ha deployment, k8s cluster must have min 3 schedulable nodes
|
||||
ha: false
|
||||
|
||||
# Wipe dkube data during helm operation install/uninstall.
|
||||
# Choose one of yes/no
|
||||
wipedata: ""
|
||||
|
||||
# To install minimal version of dkube
|
||||
# Accepted values: yes/no
|
||||
minimal: "no"
|
||||
|
||||
# To install air-gapped version of dkube
|
||||
# Accepted values: yes/no
|
||||
airgap: "no"
|
||||
|
||||
# Docker registry for DKube installation
|
||||
registry:
|
||||
# Format: registry/[repo]
|
||||
name: "docker.io/ocdr"
|
||||
|
||||
# Container registry username
|
||||
username: ""
|
||||
|
||||
# Container registry password
|
||||
password: ""
|
||||
|
||||
optional:
|
||||
storage:
|
||||
# Type of storage
|
||||
# Possible values: disk, pv, sc, nfs, ceph
|
||||
# Following are required fields for corresponding storage type
|
||||
# -------------------------------------------------------
|
||||
# STORAGE_TYPE REQUIRED_FIELDS
|
||||
# -------------------------------------------------------
|
||||
# disk node and path
|
||||
# pv persistentVolume
|
||||
# sc storageClass
|
||||
# nfs nfsServer and nfsPath
|
||||
# ceph cephMonitors and cephSecret
|
||||
# For release 2.2.1.12 and later
|
||||
# ceph cephFilesystem and cephNamespace
|
||||
type: "disk"
|
||||
|
||||
# Localpath on the storage node
|
||||
path: "/var/dkube"
|
||||
|
||||
# Nodename of the storage node
|
||||
# Possible values: AUTO/<nodename>
|
||||
# AUTO - Master node will be chosen for storage if KUBE_PROVIDER=dkube
|
||||
node: ""
|
||||
|
||||
# Name of persistent volume
|
||||
persistentVolume: ""
|
||||
|
||||
# Name of storage class name
|
||||
# Make sure dynamic provisioner is running for the storage class name
|
||||
storageClass: ""
|
||||
|
||||
# NFS server ip
|
||||
nfsServer: ""
|
||||
|
||||
# NFS path (Make sure the path exists)
|
||||
nfsPath: ""
|
||||
|
||||
# Only for external ceph before release 2.2.1.12
|
||||
# Comma separated IPs of ceph monitors
|
||||
cephMonitors: ""
|
||||
|
||||
# Only for external ceph before release 2.2.1.12
|
||||
# Ceph secret
|
||||
cephSecret: ""
|
||||
|
||||
# Only for external ceph from release 2.2.1.12
|
||||
# Name of the ceph filesystem
|
||||
# E.g: dkubefs
|
||||
cephFilesystem: ""
|
||||
|
||||
# Only for external ceph from release 2.2.1.12
|
||||
# Name of the namespace where ceph is installed
|
||||
# E.g: rook-ceph
|
||||
cephNamespace: ""
|
||||
|
||||
# Internal Ceph
|
||||
# Internal ceph is installed when HA=true and STORAGE_TYPE is not in ("nfs", "ceph")
|
||||
|
||||
# Configuration path for internal ceph
|
||||
cephPath: "/var/lib/rook"
|
||||
|
||||
# Only for internal ceph from release 2.2.1.12
|
||||
# Disk name for internal ceph storage
|
||||
# It should be a raw formatted disk
|
||||
# E.g: sdb
|
||||
cephDisk: ""
|
||||
|
||||
loadbalancer:
|
||||
# Type of dkube proxy service, possible values are nodeport and loadbalancer
|
||||
# Please use loadbalancer if kubeProvider is gke.
|
||||
access: "nodeport"
|
||||
|
||||
# 'true' - to install MetalLB Loadbalancer
|
||||
# Must fill LB_VIP_POOL if true
|
||||
metallb: "false"
|
||||
|
||||
# Only CIDR notation is allowed. E.g: 192.168.2.0/24
|
||||
# Valid only if installLoadbalancer is true
|
||||
vipPool: ""
|
||||
|
||||
modelmonitor:
|
||||
#To enable modelmonitor in dkube. (true / false)
|
||||
enabled: false
|
||||
|
||||
DBAAS:
|
||||
# To configure external database for dkube
|
||||
# Supported mysql, sqlserver(mssql)
|
||||
# Empty will pickup default sql db installed with dkube
|
||||
database: ""
|
||||
|
||||
# Syntaxes here can be followed to specify dsn https://gorm.io/docs/connecting_to_the_database.html
|
||||
dsn: ""
|
||||
|
||||
CICD:
|
||||
#To enable tekton cicd with dkube. (true / false)
|
||||
enabled: false
|
||||
|
||||
#Docker registry where CICD built images will be saved.
|
||||
registryName: "docker.io/ocdr"
|
||||
registryUsername: ""
|
||||
registryPassword: ""
|
||||
|
||||
#For AWS ECR on EKS K8S cluster, enter registry as aws_account_id.dkr.ecr.region.amazonaws.com.
|
||||
#registryName: "aws_account_id.dkr.ecr.region.amazonaws.com"
|
||||
#Worker nodes should either have AmazonEC2ContainerRegistryFullAccess or if you are using KIAM
|
||||
#based IAM control, provide an IAM role which has AmazonEC2ContainerRegistryFullAccess
|
||||
#IAMRole: "arn:aws:iam::<aws_account_id>:role/<iam-role>"
|
||||
IAMRole: ""
|
||||
|
||||
nodeAffinity:
|
||||
# Nodes identified by labels on which the dkube pods must be scheduled.. Say management nodes. Unfilled means no binding. When filled there needs to be minimum of 3nodes in case of HA and one node in case of non-HA
|
||||
# Example: DKUBE_NODES_LABEL: key1=value1
|
||||
dkubeNodesLabel: ""
|
||||
|
||||
# Nodes to be tolerated by dkube control plane pods so that only they can be scheduled on the nodes
|
||||
# Example: DKUBE_NODES_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
dkubeNodesTaints: ""
|
||||
|
||||
# Taints of the nodes where gpu workloads must be scheduled.
|
||||
# Example: GPU_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
gpuWorkloadTaints: ""
|
||||
|
||||
# Taints of the nodes where production workloads must be scheduled.
|
||||
# Example: PRODUCTION_WORKLOADS_TAINTS: key1=value1:NoSchedule,key2=value2:NoSchedule
|
||||
productionWorkloadTaints: ""
|
||||
|
||||
# Dockerhub Secrets for OCDR images
|
||||
# If you don't create, this will be auto-created with default values.
|
||||
dkubeDockerhubCredentialsSecret: "dkube-dockerhub-secret"
|
||||
|
||||
# AWS IAM role
|
||||
# Valid only if KUBE_PROVIDER=eks
|
||||
# This will be set as an annotation in few deployments
|
||||
# Format should be like:
|
||||
# IAMRole: "<key>: <iam role>"
|
||||
# eg: IAMRole: "iam.amazonaws.com/role: arn:aws:iam::123456789012:role/myrole"
|
||||
IAMRole: ""
|
||||
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: Tetrate Istio Distro
|
||||
catalog.cattle.io/namespace: istio-system
|
||||
catalog.cattle.io/release-name: istiod-tid
|
||||
catalog.cattle.io/upstream-version: 1.12.6
|
||||
apiVersion: v1
|
||||
appVersion: 1.12.6
|
||||
description: Tetrate Istio Distro Istiod is simple, safe enterprise-grade Service
|
||||
Mesh.
|
||||
home: https://istio.tetratelabs.io
|
||||
icon: https://istio.tetratelabs.io/images/getistio-favicon.png
|
||||
keywords:
|
||||
- istio
|
||||
- istiod
|
||||
- istio-discovery
|
||||
- tid
|
||||
- tetrate
|
||||
- distribution
|
||||
- networking
|
||||
- infrastructure
|
||||
kubeVersion: '>= 1.19.0-0 < 1.23.0-0'
|
||||
maintainers:
|
||||
- email: tetrate@tetrate.io
|
||||
name: tetrate
|
||||
name: istiod-tid
|
||||
version: 1.12.600
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
# Tetrate Istio Distro Istiod module
|
||||
|
||||
[Tetrate Istio Distro](https://istio.tetratelabs.io/) is simple, safe enterprise-grade Istio distro.
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
Istio-base is being installed as part of this Chart, no need to separately deploy CRDs as they are installed in the cluster in the form of dependancy.
|
||||
|
||||
Please specify the correct version during next step. The full list is available at: https://istio.tetratelabs.io/download
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
apiVersion: v1
|
||||
appVersion: 1.12.6
|
||||
description: Helm chart for deploying Istio cluster resources and CRDs
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
name: tid-base
|
||||
version: 1.12.6
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,48 +0,0 @@
|
|||
# SYNC WITH manifests/charts/istio-operator/templates
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: istiooperators.install.istio.io
|
||||
labels:
|
||||
release: istio
|
||||
spec:
|
||||
conversion:
|
||||
strategy: None
|
||||
group: install.istio.io
|
||||
names:
|
||||
kind: IstioOperator
|
||||
listKind: IstioOperatorList
|
||||
plural: istiooperators
|
||||
singular: istiooperator
|
||||
shortNames:
|
||||
- iop
|
||||
- io
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Istio control plane revision
|
||||
jsonPath: .spec.revision
|
||||
name: Revision
|
||||
type: string
|
||||
- description: IOP current state
|
||||
jsonPath: .status.status
|
||||
name: Status
|
||||
type: string
|
||||
- description: 'CreationTimestamp is a timestamp representing the server time
|
||||
when this object was created. It is not guaranteed to be set in happens-before
|
||||
order across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
|
||||
lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
subresources:
|
||||
status: {}
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
served: true
|
||||
storage: true
|
||||
---
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,5 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- files/gen-istio-cluster.yaml
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
Istio base successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }}
|
||||
$ helm get all {{ .Release.Name }}
|
||||
|
|
@ -1,178 +0,0 @@
|
|||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
- "kubernetes.io/legacy-unknown"
|
||||
verbs: ["approve"]
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list", "create", "delete"]
|
||||
|
||||
# Used for MCS serviceimport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
{{- if or .Values.global.externalIstiod }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
---
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
{{- if .Values.base.enableCRDTemplates }}
|
||||
{{ .Files.Get "crds/crd-all.gen.yaml" }}
|
||||
{{ .Files.Get "crds/crd-operator.yaml" }}
|
||||
{{- end }}
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
{{- if not (eq .Values.defaultRevision "") }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istiod-default-validator
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.defaultRevision }}
|
||||
webhooks:
|
||||
- name: validation.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
{{- if (eq .Values.defaultRevision "default") }}
|
||||
name: istiod
|
||||
{{- else }}
|
||||
name: istiod-{{ .Values.defaultRevision }}
|
||||
{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
{{- end }}
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: istiod-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
{{- else if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# This service account aggregates reader permissions for the revisions in a given cluster
|
||||
# Should be used for remote secret creation.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
# DO NOT EDIT!
|
||||
# THIS IS A LEGACY CHART HERE FOR BACKCOMPAT
|
||||
# UPDATED CHART AT manifests/charts/istio-control/istio-discovery
|
||||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
# when istiod is enabled in remote cluster, we can't use istiod service name
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
clusterIP: None
|
||||
{{- else }}
|
||||
# when istiod isn't enabled in remote cluster, we can use istiod service name
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
# if the remotePilotAddress is IP addr, we use clusterIP: None.
|
||||
# else, we use externalName
|
||||
{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
clusterIP: None
|
||||
{{- else }}
|
||||
type: ExternalName
|
||||
externalName: {{ .Values.global.remotePilotAddress }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
global:
|
||||
|
||||
# ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
configValidation: true
|
||||
externalIstiod: false
|
||||
remotePilotAddress: ""
|
||||
|
||||
base:
|
||||
# Used for helm2 to add the CRDs to templates.
|
||||
enableCRDTemplates: false
|
||||
|
||||
# Validation webhook configuration url
|
||||
# For example: https://$remotePilotAddress:15017/validate
|
||||
validationURL: ""
|
||||
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
|
||||
defaultRevision: "default"
|
||||
|
|
@ -1,215 +0,0 @@
|
|||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
istio.io/rev: {{ .Revision | default "default" | quote }}
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" .Values.global.proxy.image }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
volumes:
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (env "ENABLE_LEGACY_FSGROUP_INJECTION" "true") "true" }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,233 +0,0 @@
|
|||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false",
|
||||
}
|
||||
spec:
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
{{ if not (eq $container.Name "istio-proxy") }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
|
||||
value: "true"
|
||||
- name: "GRPC_XDS_BOOTSTRAP"
|
||||
value: "/etc/istio/proxy/grpc-bootstrap.json"
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ISTIO_META_GENERATOR
|
||||
value: grpc
|
||||
- name: OUTPUT_CERTS
|
||||
value: /var/lib/istio/data
|
||||
{{- if eq (env "PILOT_ENABLE_INBOUND_PASSTHROUGH" "true") "false" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
# grpc uses xds:/// to resolve – no need to resolve VIP
|
||||
- name: ISTIO_META_DNS_CAPTURE
|
||||
value: "false"
|
||||
- name: DISABLE_ENVOY
|
||||
value: "true"
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: {{ .Values.global.proxy.statusPort }}
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-xds
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
# UDS channel between istioagent and gRPC client for XDS/SDS
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-xds
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
metadata:
|
||||
sidecar.istio.io/rewriteAppHTTPProbers: "false"
|
||||
spec:
|
||||
initContainers:
|
||||
- name: grpc-bootstrap-init
|
||||
image: busybox:1.28
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
env:
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: ISTIO_NAMESPACE
|
||||
value: |
|
||||
{{ .Values.global.istioNamespace }}
|
||||
command:
|
||||
- sh
|
||||
- "-c"
|
||||
- |-
|
||||
NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
|
||||
SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
|
||||
echo '
|
||||
{
|
||||
"xds_servers": [
|
||||
{
|
||||
"server_uri": "'${SERVER_URI}'",
|
||||
"channel_creds": [{"type": "insecure"}],
|
||||
"server_features" : ["xds_v3"]
|
||||
}
|
||||
],
|
||||
"node": {
|
||||
"id": "'${NODE_ID}'",
|
||||
"metadata": {
|
||||
"GENERATOR": "grpc"
|
||||
}
|
||||
}
|
||||
}' > /var/lib/grpc/data/bootstrap.json
|
||||
containers:
|
||||
{{- range $index, $container := .Spec.Containers }}
|
||||
- name: {{ $container.Name }}
|
||||
env:
|
||||
- name: GRPC_XDS_BOOTSTRAP
|
||||
value: /var/lib/grpc/data/bootstrap.json
|
||||
- name: GRPC_GO_LOG_VERBOSITY_LEVEL
|
||||
value: "99"
|
||||
- name: GRPC_GO_LOG_SEVERITY_LEVEL
|
||||
value: info
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grpc/data/
|
||||
name: grpc-io-proxyless-bootstrap
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: grpc-io-proxyless-bootstrap
|
||||
emptyDir: {}
|
||||
|
|
@ -1,491 +0,0 @@
|
|||
{{- $containers := list }}
|
||||
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
|
||||
metadata:
|
||||
labels:
|
||||
security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio" | quote }}
|
||||
service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }}
|
||||
service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }}
|
||||
annotations: {
|
||||
{{- if eq (len $containers) 1 }}
|
||||
kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
|
||||
kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
|
||||
{{ end }}
|
||||
{{- if .Values.istio_cni.enabled }}
|
||||
{{- if not .Values.istio_cni.chained }}
|
||||
k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `istio-cni` }}',
|
||||
{{- end }}
|
||||
sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
|
||||
{{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
|
||||
traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
|
||||
traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
|
||||
{{- end }}
|
||||
{{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
|
||||
{{- end }}
|
||||
}
|
||||
spec:
|
||||
{{- $holdProxy := or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts }}
|
||||
initContainers:
|
||||
{{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
|
||||
{{ if .Values.istio_cni.enabled -}}
|
||||
- name: istio-validation
|
||||
{{ else -}}
|
||||
- name: istio-init
|
||||
{{ end -}}
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
args:
|
||||
- istio-iptables
|
||||
- "-p"
|
||||
- {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
|
||||
- "-z"
|
||||
- "15006"
|
||||
- "-u"
|
||||
- "1337"
|
||||
- "-m"
|
||||
- "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
|
||||
- "-i"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
|
||||
- "-x"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
|
||||
- "-b"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
|
||||
- "-d"
|
||||
{{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
|
||||
- "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
|
||||
{{- else }}
|
||||
- "15090,15021"
|
||||
{{- end }}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
|
||||
- "-q"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
|
||||
- "-o"
|
||||
- "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
|
||||
{{ end -}}
|
||||
{{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
|
||||
- "-k"
|
||||
- "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
|
||||
{{ end -}}
|
||||
{{ if .Values.istio_cni.enabled -}}
|
||||
- "--run-validation"
|
||||
- "--skip-rule-apply"
|
||||
{{ end -}}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{- if .ProxyConfig.ProxyMetadata }}
|
||||
env:
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{- if not .Values.istio_cni.enabled }}
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
{{- if not .Values.istio_cni.enabled }}
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1337
|
||||
runAsUser: 1337
|
||||
runAsNonRoot: true
|
||||
{{- end }}
|
||||
restartPolicy: Always
|
||||
{{ end -}}
|
||||
{{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
- name: enable-core-dump
|
||||
args:
|
||||
- -c
|
||||
- sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
|
||||
command:
|
||||
- /bin/sh
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- SYS_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{ end }}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
{{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
|
||||
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
|
||||
- --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
|
||||
- --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
|
||||
- --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
|
||||
{{- if .Values.global.sts.servicePort }}
|
||||
- --stsPort={{ .Values.global.sts.servicePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
{{- if gt .EstimatedConcurrency 0 }}
|
||||
- --concurrency
|
||||
- "{{ .EstimatedConcurrency }}"
|
||||
{{- end -}}
|
||||
{{- if .Values.global.proxy.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
|
||||
{{- else if $holdProxy }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- pilot-agent
|
||||
- wait
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if eq (env "PILOT_ENABLE_INBOUND_PASSTHROUGH" "true") "false" }}
|
||||
- name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: CA_ADDR
|
||||
{{- if .Values.global.caAddress }}
|
||||
value: {{ .Values.global.caAddress }}
|
||||
{{- else }}
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{{ protoToJSON .ProxyConfig }}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{{- $first := true }}
|
||||
{{- range $index1, $c := .Spec.Containers }}
|
||||
{{- range $index2, $p := $c.Ports }}
|
||||
{{- if (structToJSON $p) }}
|
||||
{{if not $first}},{{end}}{{ structToJSON $p }}
|
||||
{{- $first = false }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: "{{ $containers | join "," }}"
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
|
||||
{{- if .Values.global.network }}
|
||||
- name: ISTIO_META_NETWORK
|
||||
value: "{{ .Values.global.network }}"
|
||||
{{- end }}
|
||||
{{- if .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_WORKLOAD_NAME
|
||||
value: "{{ .DeploymentMeta.Name }}"
|
||||
{{ end }}
|
||||
{{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
|
||||
- name: ISTIO_META_OWNER
|
||||
value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
|
||||
{{- end}}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: ISTIO_BOOTSTRAP_OVERRIDE
|
||||
value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
|
||||
{{- end }}
|
||||
{{- if .Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ .Values.global.meshID }}"
|
||||
{{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
|
||||
{{- end }}
|
||||
{{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
{{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $value }}"
|
||||
{{- end }}
|
||||
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
|
||||
{{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
|
||||
periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
|
||||
{{ end -}}
|
||||
securityContext:
|
||||
{{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
drop:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
runAsGroup: 1337
|
||||
fsGroup: 1337
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else }}
|
||||
allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
|
||||
capabilities:
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
add:
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
|
||||
- NET_ADMIN
|
||||
{{- end }}
|
||||
{{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
|
||||
- NET_BIND_SERVICE
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
drop:
|
||||
- ALL
|
||||
privileged: {{ .Values.global.proxy.privileged }}
|
||||
readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
|
||||
runAsGroup: 1337
|
||||
fsGroup: 1337
|
||||
{{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
{{- else -}}
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1337
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
|
||||
requests:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
|
||||
limits:
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
|
||||
cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
|
||||
{{ end }}
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
|
||||
memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.global.proxy.resources }}
|
||||
{{ toYaml .Values.global.proxy.resources | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
{{- end }}
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- mountPath: /etc/istio/custom-bootstrap
|
||||
name: custom-bootstrap-volume
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- mountPath: /etc/certs/
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: istio-podinfo
|
||||
mountPath: /etc/istio/pod
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
|
||||
name: lightstep-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
|
||||
{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 6 }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
|
||||
- name: gke-workload-certificate
|
||||
csi:
|
||||
driver: workloadcertificates.security.cloud.google.com
|
||||
{{- end }}
|
||||
{{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
|
||||
- name: custom-bootstrap-volume
|
||||
configMap:
|
||||
name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
|
||||
{{- end }}
|
||||
# SDS channel between istioagent and Envoy
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- name: istio-data
|
||||
emptyDir: {}
|
||||
- name: istio-podinfo
|
||||
downwardAPI:
|
||||
items:
|
||||
- path: "labels"
|
||||
fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
- path: "annotations"
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: istio-token
|
||||
expirationSeconds: 43200
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.global.pilotCertProvider "istiod" }}
|
||||
- name: istiod-ca-cert
|
||||
configMap:
|
||||
name: istio-ca-root-cert
|
||||
{{- end }}
|
||||
{{- if .Values.global.mountMtlsCerts }}
|
||||
# Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
|
||||
- name: istio-certs
|
||||
secret:
|
||||
optional: true
|
||||
{{ if eq .Spec.ServiceAccountName "" }}
|
||||
secretName: istio.default
|
||||
{{ else -}}
|
||||
secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
|
||||
{{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
|
||||
- name: "{{ $index }}"
|
||||
{{ toYaml $value | indent 4 }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
|
||||
- name: lightstep-certs
|
||||
secret:
|
||||
optional: true
|
||||
secretName: lightstep.cacert
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (env "ENABLE_LEGACY_FSGROUP_INJECTION" "true") "true" }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
{{- end }}
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- files/gen-istio.yaml
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
questions:
|
||||
- variable: global.tag
|
||||
default: "1.12.6-tetrate-v0"
|
||||
description: "Istiod-tag"
|
||||
type: enum
|
||||
label: Operator image tag
|
||||
group: "Image version"
|
||||
required: true
|
||||
options:
|
||||
- "1.12.6-tetrate-v0"
|
||||
- "1.12.6-tetratefips-v0"
|
||||
- "1.12.6-istio-v0"
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }}
|
||||
$ helm get all {{ .Release.Name }}
|
||||
|
||||
Next steps:
|
||||
* Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
|
||||
* Try out our tasks to get started on common configurations:
|
||||
* https://istio.io/latest/docs/tasks/traffic-management
|
||||
* https://istio.io/latest/docs/tasks/security/
|
||||
* https://istio.io/latest/docs/tasks/policy-enforcement/
|
||||
* https://istio.io/latest/docs/tasks/policy-enforcement/
|
||||
* Review the list of actively supported releases, CVE publications and our hardening guide:
|
||||
* https://istio.io/latest/docs/releases/supported-releases/
|
||||
* https://istio.io/latest/news/security/
|
||||
* https://istio.io/latest/docs/ops/best-practices/security/
|
||||
|
||||
For further documentation see https://istio.io website
|
||||
|
||||
Tell us how your install/upgrade experience went at https://forms.gle/FegQbc9UvePd4Z9z7
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
{{- if and .Values.pilot.autoscaleEnabled .Values.pilot.autoscaleMin .Values.pilot.autoscaleMax }}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
spec:
|
||||
maxReplicas: {{ .Values.pilot.autoscaleMax }}
|
||||
minReplicas: {{ .Values.pilot.autoscaleMin }}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
targetAverageUtilization: {{ .Values.pilot.cpu.targetAverageUtilization }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,134 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# sidecar injection controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# configuration validation webhook controller
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
|
||||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
{{- end }}
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "workloadentries/status" ]
|
||||
|
||||
# auto-detect installed CRD definitions
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# discovery and routing
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# ingress controller
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
{{- end}}
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["*"]
|
||||
|
||||
# required for CA's namespace controller
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
|
||||
# Istiod and bootstrap.
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "certificatesigningrequests"
|
||||
- "certificatesigningrequests/approval"
|
||||
- "certificatesigningrequests/status"
|
||||
verbs: ["update", "create", "get", "delete", "watch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources:
|
||||
- "signers"
|
||||
resourceNames:
|
||||
- "kubernetes.io/legacy-unknown"
|
||||
verbs: ["approve"]
|
||||
|
||||
# Used by Istiod to verify the JWT tokens
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Used by Istiod to verify gateway SDS
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
# Use for Kubernetes Service APIs
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update", "patch"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: [ "get", "watch", "list", "create", "delete"]
|
||||
|
||||
# Used for MCS serviceimport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "deployments" ]
|
||||
- apiGroups: [""]
|
||||
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
|
||||
resources: [ "services" ]
|
||||
{{- end }}
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
---
|
||||
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
{{- end }}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
data:
|
||||
extra.pem: {{ .Values.pilot.jwksResolverExtraRootCA | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -1,100 +0,0 @@
|
|||
{{- define "mesh" }}
|
||||
# The trust domain corresponds to the trust root of a system.
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
|
||||
|
||||
defaultConfig:
|
||||
{{- if .Values.global.meshID }}
|
||||
meshId: {{ .Values.global.meshID }}
|
||||
{{- end }}
|
||||
tracing:
|
||||
{{- if eq .Values.global.proxy.tracer "lightstep" }}
|
||||
lightstep:
|
||||
# Address of the LightStep Satellite pool
|
||||
address: {{ .Values.global.tracer.lightstep.address }}
|
||||
# Access Token used to communicate with the Satellite pool
|
||||
accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
|
||||
{{- else if eq .Values.global.proxy.tracer "zipkin" }}
|
||||
zipkin:
|
||||
# Address of the Zipkin collector
|
||||
address: {{ .Values.global.tracer.zipkin.address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
|
||||
{{- else if eq .Values.global.proxy.tracer "datadog" }}
|
||||
datadog:
|
||||
# Address of the Datadog Agent
|
||||
address: {{ .Values.global.tracer.datadog.address | default "$(HOST_IP):8126" }}
|
||||
{{- else if eq .Values.global.proxy.tracer "stackdriver" }}
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
{{- if $.Values.global.tracer.stackdriver.debug }}
|
||||
debug: {{ $.Values.global.tracer.stackdriver.debug }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: {{ $.Values.global.tracer.stackdriver.maxNumberOfAttributes | default "200" }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: {{ $.Values.global.tracer.stackdriver.maxNumberOfAnnotations | default "200" }}
|
||||
{{- end }}
|
||||
{{- if $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: {{ $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents | default "200" }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
|
||||
{{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
|
||||
{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
|
||||
{{- else }}
|
||||
{}
|
||||
{{- end }}
|
||||
{{- if .Values.global.remotePilotAddress }}
|
||||
{{- if not .Values.global.externalIstiod }}
|
||||
discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
|
||||
{{- else }}
|
||||
discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
|
||||
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
|
||||
{{- $originalMesh := include "mesh" . | fromYaml }}
|
||||
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
|
||||
|
||||
{{- if .Values.pilot.configMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
|
||||
# Configuration file for the mesh networks to be used by the Split Horizon EDS.
|
||||
meshNetworks: |-
|
||||
{{- if .Values.global.meshNetworks }}
|
||||
networks:
|
||||
{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
|
||||
{{- else }}
|
||||
networks: {}
|
||||
{{- end }}
|
||||
|
||||
mesh: |-
|
||||
{{- if .Values.meshConfig }}
|
||||
{{ $mesh | toYaml | indent 4 }}
|
||||
{{- else }}
|
||||
{{- include "mesh" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,219 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
{{- range $key, $val := .Values.pilot.deploymentLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.pilot.autoscaleEnabled }}
|
||||
{{- if .Values.pilot.replicaCount }}
|
||||
replicas: {{ .Values.pilot.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.pilot.rollingMaxSurge }}
|
||||
maxUnavailable: {{ .Values.pilot.rollingMaxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- if ne .Values.revision "" }}
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
operator.istio.io/component: "Pilot"
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio: istiod
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.pilot.podLabels }}
|
||||
{{ $key }}: "{{ $val }}"
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.meshConfig.enablePrometheusMerge }}
|
||||
prometheus.io/port: "15014"
|
||||
prometheus.io/scrape: "true"
|
||||
{{- end }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if .Values.pilot.podAnnotations }}
|
||||
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pilot.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.pilot.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.global.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.global.priorityClassName }}"
|
||||
{{- end }}
|
||||
securityContext:
|
||||
fsGroup: 1337
|
||||
containers:
|
||||
- name: discovery
|
||||
{{- if contains "/" .Values.pilot.image }}
|
||||
image: "{{ .Values.pilot.image }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Values.global.tag }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "discovery"
|
||||
- --monitoringAddr=:15014
|
||||
{{- if .Values.global.logging.level }}
|
||||
- --log_output_level={{ .Values.global.logging.level }}
|
||||
{{- end}}
|
||||
{{- if .Values.global.logAsJson }}
|
||||
- --log_as_json
|
||||
{{- end }}
|
||||
- --domain
|
||||
- {{ .Values.global.proxy.clusterDomain }}
|
||||
{{- if .Values.global.oneNamespace }}
|
||||
- "-a"
|
||||
- {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.plugins }}
|
||||
- --plugins={{ .Values.pilot.plugins }}
|
||||
{{- end }}
|
||||
- --keepaliveMaxServerConnectionAge
|
||||
- "{{ .Values.pilot.keepaliveMaxServerConnectionAge }}"
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
- containerPort: 15010
|
||||
protocol: TCP
|
||||
- containerPort: 15017
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 5
|
||||
env:
|
||||
- name: REVISION
|
||||
value: "{{ .Values.revision | default `default` }}"
|
||||
- name: JWT_POLICY
|
||||
value: {{ .Values.global.jwtPolicy }}
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: {{ .Values.global.pilotCertProvider }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: KUBECONFIG
|
||||
value: /var/run/secrets/remote/config
|
||||
{{- if .Values.pilot.env }}
|
||||
{{- range $key, $val := .Values.pilot.env }}
|
||||
- name: {{ $key }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pilot.traceSampling }}
|
||||
- name: PILOT_TRACE_SAMPLING
|
||||
value: "{{ .Values.pilot.traceSampling }}"
|
||||
{{- end }}
|
||||
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
|
||||
value: "{{ .Values.pilot.enableProtocolSniffingForOutbound }}"
|
||||
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
|
||||
value: "{{ .Values.pilot.enableProtocolSniffingForInbound }}"
|
||||
- name: ISTIOD_ADDR
|
||||
value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Release.Namespace }}.svc:15012
|
||||
- name: PILOT_ENABLE_ANALYSIS
|
||||
value: "{{ .Values.global.istiod.enableAnalysis }}"
|
||||
- name: CLUSTER_ID
|
||||
value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
|
||||
resources:
|
||||
{{- if .Values.pilot.resources }}
|
||||
{{ toYaml .Values.pilot.resources | trim | indent 12 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1337
|
||||
runAsGroup: 1337
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumeMounts:
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: local-certs
|
||||
mountPath: /var/run/secrets/istio-dns
|
||||
- name: cacerts
|
||||
mountPath: /etc/cacerts
|
||||
readOnly: true
|
||||
- name: istio-kubeconfig
|
||||
mountPath: /var/run/secrets/remote
|
||||
readOnly: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
mountPath: /cacerts
|
||||
{{- end }}
|
||||
volumes:
|
||||
# Technically not needed on this pod - but it helps debugging/testing SDS
|
||||
# Should be removed after everything works.
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: local-certs
|
||||
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: {{ .Values.global.sds.token.aud }}
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
{{- end }}
|
||||
# Optional: user-generated root
|
||||
- name: cacerts
|
||||
secret:
|
||||
secretName: cacerts
|
||||
optional: true
|
||||
- name: istio-kubeconfig
|
||||
secret:
|
||||
secretName: istio-kubeconfig
|
||||
optional: true
|
||||
{{- if .Values.pilot.jwksResolverExtraRootCA }}
|
||||
- name: extracacerts
|
||||
configMap:
|
||||
name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
{{- if not .Values.global.omitSidecarInjectorConfigMap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
data:
|
||||
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
|
||||
values: |-
|
||||
{{ pick .Values "global" "istio_cni" "sidecarInjectorWebhook" "revision" | toPrettyJson | indent 4 }}
|
||||
|
||||
# To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
|
||||
# and istiod webhook functionality.
|
||||
#
|
||||
# New fields should not use Values - it is a 'primary' config object, users should be able
|
||||
# to fine tune it or use it with kube-inject.
|
||||
config: |-
|
||||
# defaultTemplates defines the default template to use for pods that do not explicitly specify a template
|
||||
{{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
|
||||
defaultTemplates:
|
||||
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
defaultTemplates: [sidecar]
|
||||
{{- end }}
|
||||
policy: {{ .Values.global.proxy.autoInject }}
|
||||
alwaysInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
|
||||
neverInjectSelector:
|
||||
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
|
||||
injectedAnnotations:
|
||||
{{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
|
||||
"{{ $key }}": "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
|
||||
which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
|
||||
This should make it obvious that their installation is broken.
|
||||
*/}}
|
||||
template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
|
||||
templates:
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
|
||||
sidecar: |
|
||||
{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
|
||||
gateway: |
|
||||
{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
|
||||
grpc-simple: |
|
||||
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
|
||||
grpc-agent: |
|
||||
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.sidecarInjectorWebhook.templates }}
|
||||
{{ toYaml . | trim | indent 6 }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
|
|
@ -1,144 +0,0 @@
|
|||
{{- /* Core defines the common configuration used by all webhook segments */}}
|
||||
{{- define "core" }}
|
||||
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
|
||||
a unique prefix to each. */}}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.istiodRemote.injectionURL }}
|
||||
url: "{{ .Values.istiodRemote.injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: "{{ .Values.istiodRemote.injectionPath }}"
|
||||
port: 443
|
||||
{{- end }}
|
||||
caBundle: ""
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
{{- end }}
|
||||
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
|
||||
{{- if not .Values.global.operatorManageWebhooks }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq .Release.Namespace "istio-system"}}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- else }}
|
||||
name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ .Release.Name }}
|
||||
webhooks:
|
||||
{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
|
||||
|
||||
{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
|
||||
{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- /* Webhooks for default revision */}}
|
||||
{{- if (eq .Values.revision "") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy .) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
release: {{ .Release.Name }}
|
||||
istio: pilot
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision }}
|
||||
{{- else }}
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "config.istio.io"
|
||||
- "security.istio.io"
|
||||
- "networking.istio.io"
|
||||
- "authentication.istio.io"
|
||||
- "rbac.istio.io"
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
resources: [ "workloadentries" ]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceimports"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["replicasets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
{{- if .Values.global.externalIstiod }}
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "update"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
{{- end}}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
|
|
@ -1,130 +0,0 @@
|
|||
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||
# Removed paths for legacy and default selectors since a revision tag
|
||||
# is inherently created from a specific revision
|
||||
{{- define "core" }}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.istiodRemote.injectionURL }}
|
||||
url: "{{ .Values.istiodRemote.injectionURL }}"
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: "{{ .Values.istiodRemote.injectionPath }}"
|
||||
{{- end }}
|
||||
caBundle: ""
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
{{- end }}
|
||||
|
||||
{{- range $tagName := $.Values.revisionTags }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if eq $.Release.Namespace "istio-system"}}
|
||||
name: istio-revision-tag-{{ $tagName }}
|
||||
{{- else }}
|
||||
name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/tag: {{ $tagName }}
|
||||
istio.io/rev: {{ $.Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ $.Release.Name }}
|
||||
webhooks:
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "{{ $tagName }}"
|
||||
|
||||
{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
|
||||
{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
|
||||
{{- if (eq $tagName "default") }}
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
rules:
|
||||
# permissions to verify the webhook is ready and rejecting
|
||||
# invalid config. We use --server-dry-run so no config is persisted.
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
verbs: ["create"]
|
||||
resources: ["gateways"]
|
||||
|
||||
# For storing CA secret
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
|
||||
verbs: ["create", "get", "watch", "list", "update", "delete"]
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.pilot.serviceAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.pilot.serviceAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: istiod
|
||||
istio: pilot
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15010
|
||||
name: grpc-xds # plaintext
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
name: https-dns # mTLS with k8s-signed cert
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
name: https-webhook # validation and injection
|
||||
targetPort: 15017
|
||||
protocol: TCP
|
||||
- port: 15014
|
||||
name: http-monitoring # prometheus stats
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: istiod
|
||||
{{- if ne .Values.revision "" }}
|
||||
istio.io/rev: {{ .Values.revision }}
|
||||
{{- else }}
|
||||
# Label used by the 'default' service. For versioned deployments we match with app and version.
|
||||
# This avoids default deployment picking the canary
|
||||
istio: pilot
|
||||
{{- end }}
|
||||
---
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
---
|
||||
|
|
@ -1,601 +0,0 @@
|
|||
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
|
||||
---
|
||||
# Note: http stats filter is wasm enabled only in sidecars.
|
||||
{{- if .Values.telemetry.v2.prometheus.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stats-filter-1.10{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true,
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
---
|
||||
# Note: tcp stats filter is wasm enabled only in sidecars.
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stats-filter-1.10{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.v2.stackdriver.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-filter-1.10{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stackdriver-filter-1.10{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
{{- if .Values.telemetry.v2.accessLogPolicy.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-sampling-accesslog-filter-1.10{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '1\.10.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "istio.stackdriver"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.access_log
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{
|
||||
"log_window_duration": "{{ .Values.telemetry.v2.accessLogPolicy.logWindowDuration }}"
|
||||
}
|
||||
vm_config:
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: "envoy.wasm.access_log_policy" }
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,601 +0,0 @@
|
|||
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
|
||||
---
|
||||
# Note: http stats filter is wasm enabled only in sidecars.
|
||||
{{- if .Values.telemetry.v2.prometheus.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stats-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true,
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
---
|
||||
# Note: tcp stats filter is wasm enabled only in sidecars.
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stats-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.v2.stackdriver.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stackdriver-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
{{- if .Values.telemetry.v2.accessLogPolicy.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-sampling-accesslog-filter-1.11{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '1\.11.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "istio.stackdriver"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.access_log
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{
|
||||
"log_window_duration": "{{ .Values.telemetry.v2.accessLogPolicy.logWindowDuration }}"
|
||||
}
|
||||
vm_config:
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: "envoy.wasm.access_log_policy" }
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,601 +0,0 @@
|
|||
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
|
||||
---
|
||||
# Note: http stats filter is wasm enabled only in sidecars.
|
||||
{{- if .Values.telemetry.v2.prometheus.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stats-filter-1.12{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true,
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"disable_host_header_fallback": true
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: envoy.wasm.stats
|
||||
{{- end }}
|
||||
---
|
||||
# Note: tcp stats filter is wasm enabled only in sidecars.
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stats-filter-1.12{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.inboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio",
|
||||
"metrics": [
|
||||
{
|
||||
"dimensions": {
|
||||
"destination_cluster": "node.metadata['CLUSTER_ID']",
|
||||
"source_cluster": "downstream_peer.cluster_id"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.inboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_inbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.outboundSidecar }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.outboundSidecar | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stats
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stats_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.prometheus.configOverride.gateway }}
|
||||
{
|
||||
"debug": "false",
|
||||
"stat_prefix": "istio"
|
||||
}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.prometheus.configOverride.gateway | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: tcp_stats_outbound
|
||||
{{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
|
||||
runtime: envoy.wasm.runtime.v8
|
||||
allow_precompiled: true
|
||||
code:
|
||||
local:
|
||||
filename: /etc/istio/extensions/stats-filter.compiled.wasm
|
||||
{{- else }}
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local:
|
||||
inline_string: "envoy.wasm.stats"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.v2.stackdriver.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-filter-1.12{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "envoy.filters.http.router"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}", "disable_host_header_fallback": true}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: tcp-stackdriver-filter-1.12{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
{{- if not .Values.telemetry.v2.stackdriver.disableOutbound }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_OUTBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
{{- end }}
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_inbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "access_logging": "{{ .Values.telemetry.v2.stackdriver.inboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_inbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
- applyTo: NETWORK_FILTER
|
||||
match:
|
||||
context: GATEWAY
|
||||
proxy:
|
||||
proxyVersion: '^1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.tcp_proxy"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.stackdriver
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
root_id: stackdriver_outbound
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{{- if not .Values.telemetry.v2.stackdriver.configOverride }}
|
||||
{"access_logging": "{{ .Values.telemetry.v2.stackdriver.outboundAccessLogging }}"}
|
||||
{{- else }}
|
||||
{{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
|
||||
{{- end }}
|
||||
vm_config:
|
||||
vm_id: stackdriver_outbound
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: envoy.wasm.null.stackdriver }
|
||||
---
|
||||
{{- if .Values.telemetry.v2.accessLogPolicy.enabled }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: stackdriver-sampling-accesslog-filter-1.12{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
{{- if .Values.meshConfig.rootNamespace }}
|
||||
namespace: {{ .Values.meshConfig.rootNamespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
spec:
|
||||
configPatches:
|
||||
- applyTo: HTTP_FILTER
|
||||
match:
|
||||
context: SIDECAR_INBOUND
|
||||
proxy:
|
||||
proxyVersion: '1\.12.*'
|
||||
listener:
|
||||
filterChain:
|
||||
filter:
|
||||
name: "envoy.filters.network.http_connection_manager"
|
||||
subFilter:
|
||||
name: "istio.stackdriver"
|
||||
patch:
|
||||
operation: INSERT_BEFORE
|
||||
value:
|
||||
name: istio.access_log
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
|
||||
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
|
||||
value:
|
||||
config:
|
||||
configuration:
|
||||
"@type": "type.googleapis.com/google.protobuf.StringValue"
|
||||
value: |
|
||||
{
|
||||
"log_window_duration": "{{ .Values.telemetry.v2.accessLogPolicy.logWindowDuration }}"
|
||||
}
|
||||
vm_config:
|
||||
runtime: envoy.wasm.runtime.null
|
||||
code:
|
||||
local: { inline_string: "envoy.wasm.access_log_policy" }
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,56 +0,0 @@
|
|||
{{- if .Values.global.configValidation }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
webhooks:
|
||||
# Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
|
||||
# are rejecting invalid configs on a per-revision basis.
|
||||
- name: rev.validation.istio.io
|
||||
clientConfig:
|
||||
# Should change from base but cannot for API compat
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
caBundle: "" # patched at runtime when the webhook is ready.
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1beta1", "v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
{{- if (eq .Values.revision "") }}
|
||||
- "default"
|
||||
{{- else }}
|
||||
- "{{ .Values.revision }}"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -1,536 +0,0 @@
|
|||
#.Values.pilot for discovery and mesh wide config
|
||||
|
||||
## Discovery Settings
|
||||
pilot:
|
||||
autoscaleEnabled: true
|
||||
autoscaleMin: 1
|
||||
autoscaleMax: 5
|
||||
replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
||||
hub: ""
|
||||
tag: ""
|
||||
|
||||
# Can be a full hub/image:tag
|
||||
image: pilot
|
||||
traceSampling: 1.0
|
||||
|
||||
# Resources for a small pilot install
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2048Mi
|
||||
|
||||
env: {}
|
||||
|
||||
cpu:
|
||||
targetAverageUtilization: 80
|
||||
|
||||
# if protocol sniffing is enabled for outbound
|
||||
enableProtocolSniffingForOutbound: true
|
||||
# if protocol sniffing is enabled for inbound
|
||||
enableProtocolSniffingForInbound: true
|
||||
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
serviceAnnotations: {}
|
||||
|
||||
# You can use jwksResolverExtraRootCA to provide a root certificate
|
||||
# in PEM format. This will then be trusted by pilot when resolving
|
||||
# JWKS URIs.
|
||||
jwksResolverExtraRootCA: ""
|
||||
|
||||
# This is used to set the source of configuration for
|
||||
# the associated address in configSource, if nothing is specificed
|
||||
# the default MCP is assumed.
|
||||
configSource:
|
||||
subscribedResources: []
|
||||
|
||||
plugins: []
|
||||
|
||||
# The following is used to limit how long a sidecar can be connected
|
||||
# to a pilot. It balances out load across pilot instances at the cost of
|
||||
# increasing system churn.
|
||||
keepaliveMaxServerConnectionAge: 30m
|
||||
|
||||
# Additional labels to apply to the deployment.
|
||||
deploymentLabels: {}
|
||||
|
||||
|
||||
## Mesh config settings
|
||||
|
||||
# Install the mesh config map, generated from values.yaml.
|
||||
# If false, pilot wil use default values (by default) or user-supplied values.
|
||||
configMap: true
|
||||
|
||||
# Additional labels to apply on the pod level for monitoring and logging configuration.
|
||||
podLabels: {}
|
||||
|
||||
|
||||
sidecarInjectorWebhook:
|
||||
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
|
||||
# always skip the injection on pods that match that label selector, regardless of the global policy.
|
||||
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
|
||||
neverInjectSelector: []
|
||||
alwaysInjectSelector: []
|
||||
|
||||
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
|
||||
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
|
||||
#
|
||||
# annotations:
|
||||
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
#
|
||||
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
|
||||
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
|
||||
# injectedAnnotations:
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
|
||||
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
|
||||
injectedAnnotations: {}
|
||||
|
||||
# This enables injection of sidecar in all namespaces,
|
||||
# with the exception of namespaces with "istio-injection:disabled" annotation
|
||||
# Only one environment should have this enabled.
|
||||
enableNamespacesByDefault: false
|
||||
|
||||
# Enable objectSelector to filter out pods with no need for sidecar before calling istiod.
|
||||
# It is enabled by default as the minimum supported Kubernetes version is 1.15+
|
||||
objectSelector:
|
||||
enabled: true
|
||||
autoInject: true
|
||||
|
||||
rewriteAppHTTPProbe: true
|
||||
|
||||
# Templates defines a set of custom injection templates that can be used. For example, defining:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
|
||||
# being injected with the hello=world labels.
|
||||
# This is intended for advanced configuration only; most users should use the built in template
|
||||
templates: {}
|
||||
|
||||
# Default templates specifies a set of default templates that are used in sidecar injection.
|
||||
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
|
||||
# To inject other additional templates, define it using the `templates` option, and add it to
|
||||
# the default templates list.
|
||||
# For example:
|
||||
#
|
||||
# templates:
|
||||
# hello: |
|
||||
# metadata:
|
||||
# labels:
|
||||
# hello: world
|
||||
#
|
||||
# defaultTemplates: ["sidecar", "hello"]
|
||||
defaultTemplates: []
|
||||
istiodRemote:
|
||||
# Sidecar injector mutating webhook configuration clientConfig.url value.
|
||||
# For example: https://$remotePilotAddress:15017/inject
|
||||
# The host should not refer to a service running in the cluster; use a service reference by specifying
|
||||
# the clientConfig.service field instead.
|
||||
injectionURL: ""
|
||||
|
||||
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
|
||||
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
|
||||
injectionPath: "/inject"
|
||||
telemetry:
|
||||
enabled: true
|
||||
v2:
|
||||
# For Null VM case now.
|
||||
# This also enables metadata exchange.
|
||||
enabled: true
|
||||
metadataExchange:
|
||||
# Indicates whether to enable WebAssembly runtime for metadata exchange filter.
|
||||
wasmEnabled: false
|
||||
# Indicate if prometheus stats filter is enabled or not
|
||||
prometheus:
|
||||
enabled: true
|
||||
# Indicates whether to enable WebAssembly runtime for stats filter.
|
||||
wasmEnabled: false
|
||||
# overrides stats EnvoyFilter configuration.
|
||||
configOverride:
|
||||
gateway: {}
|
||||
inboundSidecar: {}
|
||||
outboundSidecar: {}
|
||||
# stackdriver filter settings.
|
||||
stackdriver:
|
||||
enabled: false
|
||||
logging: false
|
||||
monitoring: false
|
||||
topology: false # deprecated. setting this to true will have no effect, as this option is no longer supported.
|
||||
disableOutbound: false
|
||||
# configOverride parts give you the ability to override the low level configuration params passed to envoy filter.
|
||||
|
||||
configOverride: {}
|
||||
# e.g.
|
||||
# disable_server_access_logging: false
|
||||
# disable_host_header_fallback: true
|
||||
# Access Log Policy Filter Settings. This enables filtering of access logs from stackdriver.
|
||||
accessLogPolicy:
|
||||
enabled: false
|
||||
# To reduce the number of successful logs, default log window duration is
|
||||
# set to 12 hours.
|
||||
logWindowDuration: "43200s"
|
||||
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||
revision: ""
|
||||
|
||||
# Revision tags are aliases to Istio control plane revisions
|
||||
revisionTags: []
|
||||
|
||||
# For Helm compatibility.
|
||||
ownerName: ""
|
||||
|
||||
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
|
||||
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
# Config for the default ProxyConfig.
|
||||
# Initially using directly the proxy metadata - can also be activated using annotations
|
||||
# on the pod. This is an unsupported low-level API, pending review and decisions on
|
||||
# enabling the feature. Enabling the DNS listener is safe - and allows further testing
|
||||
# and gradual adoption by setting capture only on specific workloads. It also allows
|
||||
# VMs to use other DNS options, like dnsmasq or unbound.
|
||||
|
||||
# The namespace to treat as the administrative root namespace for Istio configuration.
|
||||
# When processing a leaf namespace Istio will search for declarations in that namespace first
|
||||
# and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
|
||||
# is processed as if it were declared in the leaf namespace.
|
||||
|
||||
rootNamespace:
|
||||
|
||||
# The trust domain corresponds to the trust root of a system
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
# TODO: the intent is to eventually have this enabled by default when security is used.
|
||||
# It is not clear if user should normally need to configure - the metadata is typically
|
||||
# used as an escape and to control testing and rollout, but it is not intended as a long-term
|
||||
# stable API.
|
||||
|
||||
# What we may configure in mesh config is the ".global" - and use of other suffixes.
|
||||
# No hurry to do this in 1.6, we're trying to prove the code.
|
||||
|
||||
global:
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
# enable pod disruption budget for the control plane, which is used to
|
||||
# ensure Istio control plane components are gradually upgraded or recovered.
|
||||
defaultPodDisruptionBudget:
|
||||
enabled: true
|
||||
# The values aren't mutable due to a current PodDisruptionBudget limitation
|
||||
# minAvailable: 1
|
||||
|
||||
# A minimal set of requested resources to applied to all deployments so that
|
||||
# Horizontal Pod Autoscaler will be able to function (if set).
|
||||
# Each component can overwrite these default values by adding its own resources
|
||||
# block in the relevant section below and setting the desired resources values.
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
# memory: 128Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# Default hub for Istio images.
|
||||
# Releases are published to docker hub under 'istio' project.
|
||||
# Dev builds from prow are on gcr.io
|
||||
hub: containers.istio.tetratelabs.com
|
||||
# Default tag for Istio images.
|
||||
tag: 1.12.6-tetrate-v0
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
imagePullPolicy: ""
|
||||
|
||||
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
|
||||
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
# - private-registry-key
|
||||
|
||||
# Enabled by default in master for maximising testing.
|
||||
istiod:
|
||||
enableAnalysis: false
|
||||
|
||||
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
|
||||
logAsJson: false
|
||||
|
||||
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
|
||||
# The control plane has different scopes depending on component, but can configure default log level across all components
|
||||
# If empty, default scope and level will be used as configured in code
|
||||
logging:
|
||||
level: "default:info"
|
||||
|
||||
omitSidecarInjectorConfigMap: false
|
||||
|
||||
# Whether to restrict the applications namespace the controller manages;
|
||||
# If not set, controller watches all namespaces
|
||||
oneNamespace: false
|
||||
|
||||
# Configure whether Operator manages webhook configurations. The current behavior
|
||||
# of Istiod is to manage its own webhook configurations.
|
||||
# When this option is set as true, Istio Operator, instead of webhooks, manages the
|
||||
# webhook configurations. When this option is set as false, webhooks manage their
|
||||
# own webhook configurations.
|
||||
operatorManageWebhooks: false
|
||||
|
||||
# Custom DNS config for the pod to resolve names of services in other
|
||||
# clusters. Use this to add additional search domains, and other settings.
|
||||
# see
|
||||
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
|
||||
# This does not apply to gateway pods as they typically need a different
|
||||
# set of DNS settings than the normal application pods (e.g., in
|
||||
# multicluster scenarios).
|
||||
# NOTE: If using templates, follow the pattern in the commented example below.
|
||||
#podDNSSearchNamespaces:
|
||||
#- global
|
||||
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
|
||||
|
||||
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
|
||||
# system-node-critical, it is better to configure this in order to make sure your Istio pods
|
||||
# will not be killed because of low priority class.
|
||||
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
# for more detail.
|
||||
priorityClassName: ""
|
||||
|
||||
proxy:
|
||||
image: proxyv2
|
||||
|
||||
# This controls the 'policy' in the sidecar injector.
|
||||
autoInject: enabled
|
||||
|
||||
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
|
||||
# cluster domain. Default value is "cluster.local".
|
||||
clusterDomain: "cluster.local"
|
||||
|
||||
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
|
||||
# not set, then the global "logLevel" will be used.
|
||||
componentLogLevel: "misc:error"
|
||||
|
||||
# If set, newly injected sidecars will have core dumps enabled.
|
||||
enableCoreDump: false
|
||||
|
||||
# istio ingress capture allowlist
|
||||
# examples:
|
||||
# Redirect only selected ports: --includeInboundPorts="80,8080"
|
||||
excludeInboundPorts: ""
|
||||
includeInboundPorts: "*"
|
||||
|
||||
|
||||
# istio egress capture allowlist
|
||||
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
|
||||
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
|
||||
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
|
||||
# be allowed by the sidecar
|
||||
includeIPRanges: "*"
|
||||
excludeIPRanges: ""
|
||||
includeOutboundPorts: ""
|
||||
excludeOutboundPorts: ""
|
||||
|
||||
# Log level for proxy, applies to gateways and sidecars.
|
||||
# Expected values are: trace|debug|info|warning|error|critical|off
|
||||
logLevel: warning
|
||||
|
||||
#If set to true, istio-proxy container will have privileged securityContext
|
||||
privileged: false
|
||||
|
||||
# The number of successive failed probes before indicating readiness failure.
|
||||
readinessFailureThreshold: 30
|
||||
|
||||
# The initial delay for readiness probes in seconds.
|
||||
readinessInitialDelaySeconds: 1
|
||||
|
||||
# The period between readiness probes.
|
||||
readinessPeriodSeconds: 2
|
||||
|
||||
# Resources for the sidecar.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
|
||||
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
|
||||
statusPort: 15020
|
||||
|
||||
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver.
|
||||
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
|
||||
tracer: "zipkin"
|
||||
|
||||
# Controls if sidecar is injected at the front of the container list and blocks the start of the other containers until the proxy is ready
|
||||
holdApplicationUntilProxyStarts: false
|
||||
|
||||
proxy_init:
|
||||
# Base name for the proxy_init container, used to configure iptables.
|
||||
image: proxyv2
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 10Mi
|
||||
|
||||
# configure remote pilot and istiod service and endpoint
|
||||
remotePilotAddress: ""
|
||||
|
||||
##############################################################################################
|
||||
# The following values are found in other charts. To effectively modify these values, make #
|
||||
# make sure they are consistent across your Istio helm charts #
|
||||
##############################################################################################
|
||||
|
||||
# The customized CA address to retrieve certificates for the pods in the cluster.
|
||||
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
|
||||
# If not set explicitly, default to the Istio discovery address.
|
||||
caAddress: ""
|
||||
|
||||
# Configure a remote cluster data plane controlled by an external istiod.
|
||||
# When set to true, istiod is not deployed locally and only a subset of the other
|
||||
# discovery charts are enabled.
|
||||
externalIstiod: false
|
||||
|
||||
# Configure a remote cluster as the config cluster for an external istiod.
|
||||
configCluster: false
|
||||
|
||||
# Configure the policy for validating JWT.
|
||||
# Currently, two options are supported: "third-party-jwt" and "first-party-jwt".
|
||||
jwtPolicy: "third-party-jwt"
|
||||
|
||||
# Mesh ID means Mesh Identifier. It should be unique within the scope where
|
||||
# meshes will interact with each other, but it is not required to be
|
||||
# globally/universally unique. For example, if any of the following are true,
|
||||
# then two meshes must have different Mesh IDs:
|
||||
# - Meshes will have their telemetry aggregated in one place
|
||||
# - Meshes will be federated together
|
||||
# - Policy will be written referencing one mesh from the other
|
||||
#
|
||||
# If an administrator expects that any of these conditions may become true in
|
||||
# the future, they should ensure their meshes have different Mesh IDs
|
||||
# assigned.
|
||||
#
|
||||
# Within a multicluster mesh, each cluster must be (manually or auto)
|
||||
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
|
||||
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
|
||||
# of migration TBD, and it may be a disruptive operation to change the Mesh
|
||||
# ID post-install.
|
||||
#
|
||||
# If the mesh admin does not specify a value, Istio will use the value of the
|
||||
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
|
||||
# value.
|
||||
meshID: ""
|
||||
|
||||
# Configure the mesh networks to be used by the Split Horizon EDS.
|
||||
#
|
||||
# The following example defines two networks with different endpoints association methods.
|
||||
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
|
||||
# mapped to network1. The gateway for this network example is specified by its public IP
|
||||
# address and port.
|
||||
# The second network, `network2`, in this example is defined differently with all endpoints
|
||||
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
|
||||
# gateway is also defined differently with the name of the gateway service on the remote
|
||||
# cluster. The public IP for the gateway will be determined from that remote service (only
|
||||
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
|
||||
# it still need to be configured manually).
|
||||
#
|
||||
# meshNetworks:
|
||||
# network1:
|
||||
# endpoints:
|
||||
# - fromCidr: "192.168.0.1/24"
|
||||
# gateways:
|
||||
# - address: 1.1.1.1
|
||||
# port: 80
|
||||
# network2:
|
||||
# endpoints:
|
||||
# - fromRegistry: reg1
|
||||
# gateways:
|
||||
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
|
||||
# port: 443
|
||||
#
|
||||
meshNetworks: {}
|
||||
|
||||
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
|
||||
mountMtlsCerts: false
|
||||
|
||||
multiCluster:
|
||||
# Set to true to connect two kubernetes clusters via their respective
|
||||
# ingressgateway services when pods in each cluster cannot directly
|
||||
# talk to one another. All clusters should be using Istio mTLS and must
|
||||
# have a shared root CA for this model to work.
|
||||
enabled: false
|
||||
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
|
||||
# to properly label proxies
|
||||
clusterName: ""
|
||||
|
||||
# Network defines the network this cluster belong to. This name
|
||||
# corresponds to the networks in the map of mesh networks.
|
||||
network: ""
|
||||
|
||||
# Configure the certificate provider for control plane communication.
|
||||
# Currently, two providers are supported: "kubernetes" and "istiod".
|
||||
# As some platforms may not have kubernetes signing APIs,
|
||||
# Istiod is the default
|
||||
pilotCertProvider: istiod
|
||||
|
||||
sds:
|
||||
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
|
||||
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
|
||||
# JWT is intended for the CA.
|
||||
token:
|
||||
aud: istio-ca
|
||||
|
||||
sts:
|
||||
# The service port used by Security Token Service (STS) server to handle token exchange requests.
|
||||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# Configuration for each of the supported tracers
|
||||
tracer:
|
||||
# Configuration for envoy to send trace data to LightStep.
|
||||
# Disabled by default.
|
||||
# address: the <host>:<port> of the satellite pool
|
||||
# accessToken: required for sending data to the pool
|
||||
#
|
||||
datadog:
|
||||
# Host:Port for submitting traces to the Datadog agent.
|
||||
address: "$(HOST_IP):8126"
|
||||
lightstep:
|
||||
address: "" # example: lightstep-satellite:443
|
||||
accessToken: "" # example: abcdefg1234567
|
||||
stackdriver:
|
||||
# enables trace output to stdout.
|
||||
debug: false
|
||||
# The global default max number of message events per span.
|
||||
maxNumberOfMessageEvents: 200
|
||||
# The global default max number of annotation events per span.
|
||||
maxNumberOfAnnotations: 200
|
||||
# The global default max number of attributes per span.
|
||||
maxNumberOfAttributes: 200
|
||||
zipkin:
|
||||
# Host:Port for reporting trace data in zipkin format. If not specified, will default to
|
||||
# zipkin service (port 9411) in the same namespace as the other istio components.
|
||||
address: ""
|
||||
|
||||
# Use the Mesh Control Protocol (MCP) for configuring Istiod. Requires an MCP source.
|
||||
useMCP: false
|
||||
|
||||
# The name of the CA for workload certificates.
|
||||
# For example, when caName=GkeWorkloadCertificate, GKE workload certificates
|
||||
# will be used as the certificates for workloads.
|
||||
# The default value is "" and when caName="", the CA will be configured by other
|
||||
# mechanisms (e.g., environmental variable CA_PROVIDER).
|
||||
caName: ""
|
||||
|
||||
base:
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: Upbound Universal Crossplane
|
||||
catalog.cattle.io/release-name: universal-crossplane
|
||||
apiVersion: v1
|
||||
appVersion: 1.6.1001
|
||||
description: Upbound Universal Crossplane (UXP) is Upbound's official enterprise-grade
|
||||
distribution of Crossplane.
|
||||
home: https://upbound.io
|
||||
icon: https://raw.githubusercontent.com/upbound/universal-crossplane/66ce9eb2c5a0c3af8ed7d19551a2c4d743b933b9/docs/media/logo.png
|
||||
keywords:
|
||||
- cloud
|
||||
- infrastructure
|
||||
- services
|
||||
- application
|
||||
- database
|
||||
- cache
|
||||
- bucket
|
||||
- infra
|
||||
- app
|
||||
- ops
|
||||
- oam
|
||||
- gcp
|
||||
- azure
|
||||
- aws
|
||||
- alibaba
|
||||
- cloudsql
|
||||
- rds
|
||||
- s3
|
||||
- azuredatabase
|
||||
- asparadb
|
||||
- gke
|
||||
- aks
|
||||
- eks
|
||||
kubeVersion: '>= 1.15'
|
||||
maintainers:
|
||||
- email: info@upbound.io
|
||||
name: Upbound Inc.
|
||||
name: universal-crossplane
|
||||
version: 1.6.100101
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# Upbound Universal Crossplane (UXP)
|
||||
|
||||
Upbound Universal Crossplane (UXP) is [Upbound's](https://upbound.io) official enterprise-grade distribution of [Crossplane](https://crossplane.io). It's fully compatible with upstream Crossplane, [open source](https://github.com/upbound/universal-crossplane), capable of connecting to [Upbound Cloud](https://cloud.upbound.io) for real-time dashboard visibility, and maintained by Upbound. It's the easiest way for both individual community members and enterprises to build their production control planes.
|
||||
|
||||
## Connecting to Upbound Cloud
|
||||
|
||||
You can optionally connect your Universal Crossplane instance to Upbound Cloud.
|
||||
Follow the steps below to connect your Universal Crossplane cluster to your Upbound Cloud Console.
|
||||
|
||||
1. Install Upbound CLI
|
||||
|
||||
You will need to make sure you have the Upbound CLI installed before you continue. If you need more information on how to install the Upbound CLI, you can read the [Installing Upbound CLI Documentation](https://cloud.upbound.io/docs/cli).
|
||||
|
||||
```
|
||||
curl -sL https://cli.upbound.io | sh
|
||||
```
|
||||
|
||||
2. Log in to Upbound Cloud
|
||||
|
||||
```
|
||||
up cloud login --profile=rancher --account=$UPBOUND_ACCOUNT
|
||||
```
|
||||
|
||||
Or, to log in using an Upbound [API token](https://cloud.upbound.io/account/settings/tokens):
|
||||
|
||||
```
|
||||
up cloud login --profile=rancher --account=$UPBOUND_ACCOUNT --token=$API_TOKEN
|
||||
```
|
||||
|
||||
3. Create a Self-Hosted Control Plane
|
||||
|
||||
```
|
||||
up cloud controlplane attach $CONTROL_PLANE_NAME --profile=rancher
|
||||
```
|
||||
|
||||
4. Provide the token obtained in the previous step as `upbound.controlPlane.token` under `Upbound Cloud` section
|
||||
|
|
@ -1,184 +0,0 @@
|
|||
questions:
|
||||
# Upbound Cloud configuration
|
||||
- variable: upbound.controlPlane.token
|
||||
label: upbound.controlPlane.token
|
||||
required: false
|
||||
type: password
|
||||
description: Token used to connect Upbound Cloud
|
||||
group: "Upbound Cloud"
|
||||
- variable: upbound.controlPlane.permission
|
||||
label: upbound.controlPlane.permission
|
||||
required: false
|
||||
type: enum
|
||||
default: "edit"
|
||||
options:
|
||||
- "edit"
|
||||
- "view"
|
||||
description: Cluster permissions for Upbound Cloud
|
||||
group: "Upbound Cloud"
|
||||
# Basic Crossplane configuration
|
||||
- variable: replicas
|
||||
label: replicas
|
||||
description: Number of replicas to run for Crossplane pods
|
||||
type: int
|
||||
default: 1
|
||||
required: true
|
||||
group: "Crossplane"
|
||||
# Advanced Crossplane configuration
|
||||
- variable: advancedCrossplaneConfiguration
|
||||
description: View advanced configuration settings
|
||||
label: View advanced configuration
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: true
|
||||
group: "Crossplane"
|
||||
subquestions:
|
||||
- variable: leaderElection
|
||||
label: leaderElection
|
||||
description: "Enable leader election for Crossplane Managers pod"
|
||||
type: boolean
|
||||
default: true
|
||||
required: false
|
||||
group: "Crossplane"
|
||||
- variable: deploymentStrategy
|
||||
label: deploymentStrategy
|
||||
description: "The deployment strategy for the Crossplane and RBAC Manager (if enabled) pods"
|
||||
type: enum
|
||||
default: "RollingUpdate"
|
||||
options:
|
||||
- "RollingUpdate"
|
||||
- "Recreate"
|
||||
required: true
|
||||
group: "Crossplane"
|
||||
- variable: priorityClassName
|
||||
label: priorityClassName
|
||||
description: "Priority class name for Crossplane and RBAC Manager (if enabled) pods"
|
||||
type: string
|
||||
required: false
|
||||
group: "Crossplane"
|
||||
- variable: metrics.enabled
|
||||
label: metrics.enabled
|
||||
description: "Expose Crossplane and RBAC Manager metrics endpoint"
|
||||
type: boolean
|
||||
required: false
|
||||
group: "Crossplane"
|
||||
# Basic Crossplane RBAC Manager configuration
|
||||
- variable: rbacManager.deploy
|
||||
label: rbacManager.deploy
|
||||
description: "Deploy RBAC Manager"
|
||||
type: boolean
|
||||
default: true
|
||||
required: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
- variable: rbacManager.replicas
|
||||
label: rbacManager.replicas
|
||||
description: "The number of replicas to run for the RBAC Manager pods"
|
||||
type: int
|
||||
default: 1
|
||||
required: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
# Advanced Crossplane RBAC Manager configuration
|
||||
- variable: advancedRBACManagerConfiguration
|
||||
description: View advanced configuration settings
|
||||
label: View advanced configuration
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
subquestions:
|
||||
- variable: rbacManager.leaderElection
|
||||
label: rbacManager.leaderElection
|
||||
description: "Enable leader election for RBAC Managers pod"
|
||||
type: boolean
|
||||
default: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
- variable: rbacManager.managementPolicy
|
||||
label: rbacManager.managementPolicy
|
||||
description: RBAC manager permissions. 'All' enables management for every Crossplane controller and user role. 'Basic' enables management just for Crossplane controller roles and the crossplane-admin, crossplane-edit, and crossplane-view user roles.
|
||||
type: enum
|
||||
default: "Basic"
|
||||
options:
|
||||
- "Basic"
|
||||
- "All"
|
||||
required: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
- variable: rbacManager.skipAggregatedClusterRoles
|
||||
label: rbacManager.skipAggregatedClusterRoles
|
||||
description: "Opt out of deploying aggregated ClusterRoles"
|
||||
type: boolean
|
||||
default: true
|
||||
group: "Crossplane RBAC Manager"
|
||||
# Basic Package configuration
|
||||
- variable: provider.packages
|
||||
label: provider.packages
|
||||
description: List of Provider packages to install with Crossplane. Select 'Edit as YAML' for the best editing experience.
|
||||
type: string
|
||||
required: false
|
||||
group: "Packages"
|
||||
- variable: configuration.packages
|
||||
label: configuration.packages
|
||||
description: List of Configuration packages to install with Crossplane. Select 'Edit as YAML' for the best editing experience.
|
||||
type: string
|
||||
required: false
|
||||
group: "Packages"
|
||||
# Advanced Package configuration
|
||||
- variable: advancedPackageConfiguration
|
||||
description: View advanced configuration settings
|
||||
label: View advanced configuration
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: true
|
||||
group: "Packages"
|
||||
subquestions:
|
||||
- variable: packageCache.sizeLimit
|
||||
label: packageCache.sizeLimit
|
||||
description: "Size limit for package cache. If medium is Memory then maximum usage would be the minimum of this value the sum of all memory limits on containers in the Crossplane pod"
|
||||
type: string
|
||||
default: "5Mi"
|
||||
group: "Packages"
|
||||
- variable: packageCache.medium
|
||||
label: packageCache.medium
|
||||
description: "Storage medium for package cache. Memory means volume will be backed by tmpfs, which can be useful for development"
|
||||
type: string
|
||||
group: "Packages"
|
||||
- variable: packageCache.pvc
|
||||
label: packageCache.pvc
|
||||
description: "Name of the PersistentVolumeClaim to be used as the package cache. Providing a value will cause the default emptyDir volume to not be mounted"
|
||||
type: string
|
||||
group: "Packages"
|
||||
# Basic XGQL configuration
|
||||
- variable: xgql.config.debugMode
|
||||
label: xgql.config.debugMode
|
||||
description: "Enable debug mode for XGQL"
|
||||
type: boolean
|
||||
default: false
|
||||
group: "XGQL"
|
||||
# Advanced Crossplane configuration
|
||||
- variable: advancedXGQLConfiguration
|
||||
description: View advanced configuration settings
|
||||
label: View advanced configuration
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: true
|
||||
group: "XGQL"
|
||||
subquestions:
|
||||
- variable: xgql.metrics.enabled
|
||||
label: xgql.metrics.enabled
|
||||
description: "Expose XGQL metrics endpoint"
|
||||
type: boolean
|
||||
required: false
|
||||
group: "XGQL"
|
||||
# Basic Agent configuration
|
||||
- variable: agent.config.debugMode
|
||||
label: agent.config.debugMode
|
||||
description: "Enable debug mode for Upbound Agent"
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Upbound Agent"
|
||||
# Basic Bootstrapper configuration
|
||||
- variable: bootstrapper.config.debugMode
|
||||
label: bootstrapper.config.debugMode
|
||||
description: "Enable debug mode for Bootstrapper"
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Bootstrapper"
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
By proceeding, you are accepting to comply with terms and conditions in https://licenses.upbound.io/upbound-software-license.html
|
||||
|
||||
✨ Thank you for installing Universal Crossplane!
|
||||
{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }}
|
||||
🚀 You can now connect your cluster to Upbound Cloud!
|
||||
|
||||
Example command:
|
||||
{{ if eq .Values.upbound.controlPlane.permission "edit" }}
|
||||
$ up cloud controlplane attach <control plane name> | \
|
||||
up uxp connect --token-secret-name {{ .Values.upbound.controlPlane.tokenSecretName }} --namespace {{ .Release.Namespace }} -
|
||||
{{- else if eq .Values.upbound.controlPlane.permission "view" }}
|
||||
$ up cloud controlplane attach --view-only <control plane name> | \
|
||||
up uxp connect --token-secret-name {{ .Values.upbound.controlPlane.tokenSecretName }} --namespace {{ .Release.Namespace }} -
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "labels" -}}
|
||||
helm.sh/chart: {{ include "crossplane.chart" . }}
|
||||
{{ include "selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "crossplane.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "bootstrapper-name" -}}
|
||||
{{- "upbound-bootstrapper" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels - bootstrapper
|
||||
*/}}
|
||||
{{- define "labelsBootstrapper" -}}
|
||||
{{ include "labels" . }}
|
||||
app.kubernetes.io/component: bootstrapper
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels - bootstrapper
|
||||
*/}}
|
||||
{{- define "selectorLabelsBootstrapper" -}}
|
||||
{{ include "selectorLabels" . }}
|
||||
app.kubernetes.io/component: bootstrapper
|
||||
{{- end }}
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
rules:
|
||||
# Bootstrapper needs to identify the cluster uniquely and it does that by using
|
||||
# UID of kube-system namespace.
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
resourceNames:
|
||||
- "kube-system"
|
||||
verbs:
|
||||
- "get"
|
||||
# Controller-runtime requires watch and list permissions to build its resource
|
||||
# cache of the kind that any client query is made for.
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- "list"
|
||||
- "watch"
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "selectorLabelsBootstrapper" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "selectorLabelsBootstrapper" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "bootstrapper-name" . }}
|
||||
{{- if .Values.billing.awsMarketplace.enabled }}
|
||||
securityContext:
|
||||
# Providing this is not required for 1.19 or later clusters.
|
||||
# See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
|
||||
fsGroup: 1337
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range $index, $secret := .Values.imagePullSecrets }}
|
||||
- name: {{ $secret }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
containers:
|
||||
- name: bootstrapper
|
||||
image: "{{ .Values.bootstrapper.image.repository }}:{{ .Values.bootstrapper.image.tag }}"
|
||||
args:
|
||||
- start
|
||||
- --namespace
|
||||
- {{ .Release.Namespace }}
|
||||
- --upbound-api-url
|
||||
- {{ .Values.upbound.apiURL }}
|
||||
- --upbound-token-secret
|
||||
- {{ .Values.upbound.controlPlane.tokenSecretName }}
|
||||
- --agent-manifest
|
||||
- {{ include "agent-spec" . | b64enc }}
|
||||
- --controller
|
||||
- upbound-agent
|
||||
- --controller
|
||||
- tls-secrets
|
||||
{{- if .Values.billing.awsMarketplace.enabled }}
|
||||
- --controller
|
||||
- aws-marketplace
|
||||
{{- end }}
|
||||
{{- if .Values.bootstrapper.config.debugMode }}
|
||||
- "--debug"
|
||||
{{- end }}
|
||||
{{- range $arg := .Values.bootstrapper.config.args }}
|
||||
- {{ $arg }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- range $key, $value := .Values.bootstrapper.config.envVars }}
|
||||
- name: {{ $key | replace "." "_" }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end}}
|
||||
imagePullPolicy: {{ .Values.bootstrapper.image.pullPolicy }}
|
||||
resources:
|
||||
{{- toYaml .Values.bootstrapper.resources | nindent 12 }}
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["watch", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
resourceNames:
|
||||
- uxp-ca
|
||||
- upbound-agent-public-certs
|
||||
- upbound-agent-tls
|
||||
- xgql-tls
|
||||
- {{ .Values.upbound.controlPlane.tokenSecretName }}
|
||||
{{- if .Values.billing.awsMarketplace.enabled }}
|
||||
- upbound-entitlement
|
||||
{{- end}}
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["create", "update", "watch", "list"]
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
{{- if .Values.billing.awsMarketplace.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: upbound-entitlement
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
type: Opaque
|
||||
{{- end }}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "bootstrapper-name" . }}
|
||||
{{- if and .Values.billing.awsMarketplace.enabled .Values.billing.awsMarketplace.iamRoleARN }}
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: {{ .Values.billing.awsMarketplace.iamRoleARN | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: uxp-ca
|
||||
labels:
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: universal-crossplane-config
|
||||
labels:
|
||||
{{- include "labelsBootstrapper" . | nindent 4 }}
|
||||
data:
|
||||
crossplaneVersion: {{ (trimPrefix "v" .Values.image.tag) }}
|
||||
xgqlVersion: {{ (trimPrefix "v" .Values.xgql.image.tag) }}
|
||||
agentVersion: {{ (trimPrefix "v" .Values.agent.image.tag) }}
|
||||
uxpVersion: {{ .Chart.Version }}
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
Release: {{.Release.Name}}
|
||||
|
||||
Chart Name: {{.Chart.Name}}
|
||||
Chart Description: {{.Chart.Description}}
|
||||
Chart Version: {{.Chart.Version}}
|
||||
Chart Application Version: {{.Chart.AppVersion}}
|
||||
|
||||
Kube Version: {{.Capabilities.KubeVersion}}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "crossplane.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "crossplane.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate basic labels
|
||||
*/}}
|
||||
{{- define "crossplane.labels" }}
|
||||
helm.sh/chart: {{ include "crossplane.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/component: cloud-infrastructure-controller
|
||||
app.kubernetes.io/part-of: {{ template "crossplane.name" . }}
|
||||
app.kubernetes.io/name: {{ include "crossplane.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.customLabels }}
|
||||
{{ toYaml .Values.customLabels }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,89 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-crossplane: "true"
|
||||
rules: []
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:system:aggregate-to-crossplane
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
crossplane.io/scope: "system"
|
||||
rbac.crossplane.io/aggregate-to-crossplane: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
- pkg.crossplane.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- watch
|
||||
- delete
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "crossplane.name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "crossplane.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
|
|
@ -1,122 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
strategy:
|
||||
type: {{ .Values.deploymentStrategy }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: "8080"
|
||||
prometheus.io/scrape: "true"
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- include "crossplane.labels" . | indent 8 }}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContextCrossplane | nindent 8 }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "crossplane.name" . }}
|
||||
initContainers:
|
||||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
args:
|
||||
- core
|
||||
- init
|
||||
{{- range $arg := .Values.provider.packages }}
|
||||
- --provider
|
||||
- "{{ $arg }}"
|
||||
{{- end }}
|
||||
{{- range $arg := .Values.configuration.packages }}
|
||||
- --configuration
|
||||
- "{{ $arg }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: {{ .Chart.Name }}-init
|
||||
resources:
|
||||
{{- toYaml .Values.resourcesCrossplane | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContextCrossplane | nindent 12 }}
|
||||
containers:
|
||||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
args:
|
||||
- core
|
||||
- start
|
||||
{{- range $arg := .Values.args }}
|
||||
- {{ $arg }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: {{ .Chart.Name }}
|
||||
resources:
|
||||
{{- toYaml .Values.resourcesCrossplane | nindent 12 }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8080
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContextCrossplane | nindent 12 }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LEADER_ELECTION
|
||||
value: "{{ .Values.leaderElection }}"
|
||||
{{- if .Values.registryCaBundleConfig.key }}
|
||||
- name: CA_BUNDLE_PATH
|
||||
value: "/certs/{{ .Values.registryCaBundleConfig.key }}"
|
||||
{{- end}}
|
||||
{{- range $key, $value := .Values.extraEnvVarsCrossplane }}
|
||||
- name: {{ $key | replace "." "_" }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end}}
|
||||
volumeMounts:
|
||||
- mountPath: /cache
|
||||
name: package-cache
|
||||
{{- if .Values.registryCaBundleConfig.name }}
|
||||
- mountPath: /certs
|
||||
name: ca-certs
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: package-cache
|
||||
{{- if .Values.packageCache.pvc }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.packageCache.pvc }}
|
||||
{{- else }}
|
||||
emptyDir:
|
||||
medium: {{ .Values.packageCache.medium }}
|
||||
sizeLimit: {{ .Values.packageCache.sizeLimit }}
|
||||
{{- end }}
|
||||
{{- if .Values.registryCaBundleConfig.name }}
|
||||
- name: ca-certs
|
||||
configMap:
|
||||
name: {{ .Values.registryCaBundleConfig.name }}
|
||||
items:
|
||||
- key: {{ .Values.registryCaBundleConfig.key }}
|
||||
path: {{ .Values.registryCaBundleConfig.key }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{ toYaml .Values.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{ toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:allowed-provider-permissions
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true"
|
||||
{{- end}}
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-rbac-manager
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
resources:
|
||||
- compositeresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- pkg.crossplane.io
|
||||
resources:
|
||||
- providerrevisions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- roles
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
# The RBAC manager may grant access it does not have.
|
||||
- escalate
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
verbs:
|
||||
- bind
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- ""
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- watch
|
||||
- delete
|
||||
{{- end}}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-rbac-manager
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "crossplane.name" . }}-rbac-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: rbac-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end}}
|
||||
|
|
@ -1,87 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-rbac-manager
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}-rbac-manager
|
||||
release: {{ .Release.Name }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.rbacManager.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "crossplane.name" . }}-rbac-manager
|
||||
release: {{ .Release.Name }}
|
||||
strategy:
|
||||
type: {{ .Values.deploymentStrategy }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: "8080"
|
||||
prometheus.io/scrape: "true"
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}-rbac-manager
|
||||
release: {{ .Release.Name }}
|
||||
{{- include "crossplane.labels" . | indent 8 }}
|
||||
spec:
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContextRBACManager | nindent 8 }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
serviceAccountName: rbac-manager
|
||||
initContainers:
|
||||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
args:
|
||||
- rbac
|
||||
- init
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: {{ .Chart.Name }}-init
|
||||
resources:
|
||||
{{- toYaml .Values.resourcesRBACManager | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContextRBACManager | nindent 12 }}
|
||||
containers:
|
||||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
args:
|
||||
- rbac
|
||||
- start
|
||||
{{- if .Values.rbacManager.managementPolicy }}
|
||||
- --manage={{ .Values.rbacManager.managementPolicy }}
|
||||
{{- end }}
|
||||
{{- range $arg := .Values.rbacManager.args }}
|
||||
- {{ $arg }}
|
||||
{{- end }}
|
||||
- --provider-clusterrole={{ template "crossplane.name" . }}:allowed-provider-permissions
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: {{ .Chart.Name }}
|
||||
resources:
|
||||
{{- toYaml .Values.resourcesRBACManager | nindent 12 }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8080
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContextRBACManager | nindent 12 }}
|
||||
env:
|
||||
- name: LEADER_ELECTION
|
||||
value: "{{ .Values.rbacManager.leaderElection }}"
|
||||
{{- range $key, $value := .Values.extraEnvVarsRBACManager }}
|
||||
- name: {{ $key | replace "." "_" }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end}}
|
||||
{{- if .Values.rbacManager.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.rbacManager.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.rbacManager.tolerations }}
|
||||
tolerations: {{ toYaml .Values.rbacManager.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.rbacManager.affinity }}
|
||||
affinity: {{ toYaml .Values.rbacManager.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
|
|
@ -1,260 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-admin
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "crossplane.name" . }}-admin
|
||||
subjects:
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: Group
|
||||
name: {{ template "crossplane.name" . }}:masters
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-admin
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-admin: "true"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-edit
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-edit: "true"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-view
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-view: "true"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}-browse
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.crossplane.io/aggregate-to-browse: "true"
|
||||
{{- if not .Values.rbacManager.skipAggregatedClusterRoles }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-admin
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-admin: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane administrators have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane administrators must create provider credential secrets, and may
|
||||
# need to read or otherwise interact with connection secrets. They may also need
|
||||
# to create or annotate namespaces.
|
||||
- apiGroups: [""]
|
||||
resources: [secrets, namespaces]
|
||||
verbs: ["*"]
|
||||
# Crossplane administrators have access to view the roles that they may be able
|
||||
# to grant to other subjects.
|
||||
- apiGroups: [rbac.authorization.k8s.io]
|
||||
resources: [clusterroles, roles]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane administrators have access to grant the access they have to other
|
||||
# subjects.
|
||||
- apiGroups: [rbac.authorization.k8s.io]
|
||||
resources: [clusterrolebindings, rolebindings]
|
||||
verbs: ["*"]
|
||||
# Crossplane administrators have full access to built in Crossplane types.
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
resources: ["*"]
|
||||
verbs: ["*"]
|
||||
- apiGroups:
|
||||
- pkg.crossplane.io
|
||||
resources: [providers, configurations, providerrevisions, configurationrevisions]
|
||||
verbs: ["*"]
|
||||
# Crossplane administrators have access to view CRDs in order to debug XRDs.
|
||||
- apiGroups: [apiextensions.k8s.io]
|
||||
resources: [customresourcedefinitions]
|
||||
verbs: [get, list, watch]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-edit
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-edit: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane editors have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane editors must create provider credential secrets, and may need to
|
||||
# read or otherwise interact with connection secrets.
|
||||
- apiGroups: [""]
|
||||
resources: [secrets]
|
||||
verbs: ["*"]
|
||||
# Crossplane editors may see which namespaces exist, but not edit them.
|
||||
- apiGroups: [""]
|
||||
resources: [namespaces]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane editors have full access to built in Crossplane types.
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
resources: ["*"]
|
||||
verbs: ["*"]
|
||||
- apiGroups:
|
||||
- pkg.crossplane.io
|
||||
resources: [providers, configurations, providerrevisions, configurationrevisions]
|
||||
verbs: ["*"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-view
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-view: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane viewers have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane viewers may see which namespaces exist.
|
||||
- apiGroups: [""]
|
||||
resources: [namespaces]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane viewers have read-only access to built in Crossplane types.
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
resources: ["*"]
|
||||
verbs: [get, list, watch]
|
||||
- apiGroups:
|
||||
- pkg.crossplane.io
|
||||
resources: [providers, configurations, providerrevisions, configurationrevisions]
|
||||
verbs: [get, list, watch]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-browse
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-browse: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane browsers have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane browsers have read-only access to compositions and XRDs. This
|
||||
# allows them to discover and select an appropriate composition when creating a
|
||||
# resource claim.
|
||||
- apiGroups:
|
||||
- apiextensions.crossplane.io
|
||||
resources: ["*"]
|
||||
verbs: [get, list, watch]
|
||||
{{- if .Values.rbacManager.managementPolicy }}
|
||||
---
|
||||
# The below ClusterRoles are aggregated to the namespaced RBAC roles created by
|
||||
# the Crossplane RBAC manager when it is running in --manage=All mode.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-ns-admin
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-ns-admin: "true"
|
||||
rbac.crossplane.io/base-of-ns-admin: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane namespace admins have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane namespace admins may need to read or otherwise interact with
|
||||
# resource claim connection secrets.
|
||||
- apiGroups: [""]
|
||||
resources: [secrets]
|
||||
verbs: ["*"]
|
||||
# Crossplane namespace admins have access to view the roles that they may be
|
||||
# able to grant to other subjects.
|
||||
- apiGroups: [rbac.authorization.k8s.io]
|
||||
resources: [roles]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane namespace admins have access to grant the access they have to other
|
||||
# subjects.
|
||||
- apiGroups: [rbac.authorization.k8s.io]
|
||||
resources: [rolebindings]
|
||||
verbs: ["*"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-ns-edit
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-ns-edit: "true"
|
||||
rbac.crossplane.io/base-of-ns-edit: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane namespace editors have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
# Crossplane namespace editors may need to read or otherwise interact with
|
||||
# resource claim connection secrets.
|
||||
- apiGroups: [""]
|
||||
resources: [secrets]
|
||||
verbs: ["*"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}:aggregate-to-ns-view
|
||||
labels:
|
||||
rbac.crossplane.io/aggregate-to-ns-view: "true"
|
||||
rbac.crossplane.io/base-of-ns-view: "true"
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
rules:
|
||||
# Crossplane namespace viewers have access to view events.
|
||||
- apiGroups: [""]
|
||||
resources: [events]
|
||||
verbs: [get, list, watch]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
{{- if .Values.rbacManager.deploy }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: rbac-manager
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range $index, $secret := .Values.imagePullSecrets }}
|
||||
- name: {{ $secret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "crossplane.name" . }}
|
||||
labels:
|
||||
app: {{ template "crossplane.name" . }}
|
||||
{{- include "crossplane.labels" . | indent 4 }}
|
||||
{{- with .Values.serviceAccount.customAnnotations }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range $index, $secret := .Values.imagePullSecrets }}
|
||||
- name: {{ $secret }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue