ingress, istio, promehteus init
This commit is contained in:
root
parent
bac2466df4
commit
88587dc8a1
|
|
@ -0,0 +1,28 @@
|
||||||
|
# This section includes base Calico installation configuration.
|
||||||
|
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: Installation
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
# Configures Calico networking.
|
||||||
|
calicoNetwork:
|
||||||
|
ipPools:
|
||||||
|
- name: default-ipv4-ippool
|
||||||
|
blockSize: 26
|
||||||
|
cidr: 10.1.0.0/16
|
||||||
|
encapsulation: VXLANCrossSubnet
|
||||||
|
natOutgoing: Enabled
|
||||||
|
nodeSelector: all()
|
||||||
|
registry: reg.inje-private.com
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# This section configures the Calico API server.
|
||||||
|
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: APIServer
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec: {}
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,663 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
name: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resourceNames:
|
||||||
|
- ingress-nginx-leader
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- nodes
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- admissionregistration.k8s.io
|
||||||
|
resources:
|
||||||
|
- validatingwebhookconfigurations
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
allow-snippet-annotations: "false"
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ipFamilies:
|
||||||
|
- IPv4
|
||||||
|
ipFamilyPolicy: SingleStack
|
||||||
|
ports:
|
||||||
|
- appProtocol: http
|
||||||
|
name: http
|
||||||
|
port: 80
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: http
|
||||||
|
nodePort: 30100 # by.sdjo
|
||||||
|
- appProtocol: https
|
||||||
|
name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
nodePort: 30101 # by.sdjo
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: NodePort
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- appProtocol: https
|
||||||
|
name: https-webhook
|
||||||
|
port: 443
|
||||||
|
targetPort: webhook
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
minReadySeconds: 0
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- /nginx-ingress-controller
|
||||||
|
- --election-id=ingress-nginx-leader
|
||||||
|
- --controller-class=k8s.io/ingress-nginx
|
||||||
|
- --ingress-class=nginx
|
||||||
|
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||||
|
- --validating-webhook=:8443
|
||||||
|
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||||
|
- --validating-webhook-key=/usr/local/certificates/key
|
||||||
|
- --enable-metrics=false
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: LD_PRELOAD
|
||||||
|
value: /usr/local/lib/libmimalloc.so
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /wait-shutdown
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
name: controller
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 443
|
||||||
|
name: https
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 8443
|
||||||
|
name: webhook
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 90Mi
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 101
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /usr/local/certificates/
|
||||||
|
name: webhook-cert
|
||||||
|
readOnly: true
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
serviceAccountName: ingress-nginx
|
||||||
|
terminationGracePeriodSeconds: 300
|
||||||
|
volumes:
|
||||||
|
- name: webhook-cert
|
||||||
|
secret:
|
||||||
|
secretName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- create
|
||||||
|
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: create
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- patch
|
||||||
|
- --webhook-name=ingress-nginx-admission
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --patch-mutating=false
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
- --patch-failure-policy=Fail
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: patch
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: IngressClass
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: nginx
|
||||||
|
spec:
|
||||||
|
controller: k8s.io/ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
webhooks:
|
||||||
|
- admissionReviewVersions:
|
||||||
|
- v1
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
path: /networking/v1/ingresses
|
||||||
|
failurePolicy: Fail
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
name: validate.nginx.ingress.kubernetes.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
apiVersions:
|
||||||
|
- v1
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
sideEffects: None
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
|
||||||
|
import os
|
||||||
|
import time
|
||||||
|
|
||||||
|
img_list = [
|
||||||
|
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
|
||||||
|
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
|
||||||
|
]
|
||||||
|
|
||||||
|
public_registry_list = [
|
||||||
|
"registry.k8s.io",
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
registry_path = "reg.inje-private.com"
|
||||||
|
|
||||||
|
harbor_project_name = "nnd002"
|
||||||
|
|
||||||
|
for var in img_list:
|
||||||
|
os.system(f"docker pull {var}")
|
||||||
|
for foo in public_registry_list:
|
||||||
|
if var.startswith(foo):
|
||||||
|
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
|
||||||
|
break
|
||||||
|
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||||
|
# else: ljh 수정
|
||||||
|
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||||
|
time.sleep(1)
|
||||||
|
# os.system(f"echo {private_img_path}")
|
||||||
|
os.system(f"docker tag {var} {private_img_path}")
|
||||||
|
os.system(f"docker push {private_img_path}")
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Source: prometheus/templates/pvc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: prometheus
|
||||||
|
app.kubernetes.io/instance: prometheus
|
||||||
|
app.kubernetes.io/version: v2.54.1
|
||||||
|
helm.sh/chart: prometheus-25.27.0
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/part-of: prometheus
|
||||||
|
name: prometheus-server
|
||||||
|
namespace: monitoring
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
# storageClassName: sc-monitoring
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
admin:$apr1$hrZESu7L$dp3Bc9wcEbfdIVhaP1MHN0
|
||||||
|
|
@ -15,6 +15,7 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
accessModes:
|
accessModes:
|
||||||
- ReadWriteOnce
|
- ReadWriteOnce
|
||||||
|
# storageClassName: sc-monitoring
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: "8Gi"
|
storage: "8Gi"
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
apiVersion: storage.k8s.io/v1
|
||||||
|
kind: StorageClass
|
||||||
|
metadata:
|
||||||
|
name: sc-monitoring # pvc에서 사용할 SC Name
|
||||||
|
annotations:
|
||||||
|
storageclass.kubernetes.io/is-default-class: "true"
|
||||||
|
labels:
|
||||||
|
name: provision
|
||||||
|
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner # provisioner에서 생성한 PROVISIONER_NAME
|
||||||
|
parameters:
|
||||||
|
# server: 172.17.128.249
|
||||||
|
# share: /nfs/monitoring
|
||||||
|
# pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
|
||||||
|
onDelete: Retain
|
||||||
|
#onDelete: delete
|
||||||
|
archiveOnDelete: "false"
|
||||||
|
reclaimPolicy: Retain
|
||||||
|
volumeBindingMode: Immediate
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
admin:$apr1$hrZESu7L$dp3Bc9wcEbfdIVhaP1MHN0
|
||||||
|
|
@ -44,7 +44,7 @@ spec:
|
||||||
serviceAccountName: prometheus-prometheus-node-exporter
|
serviceAccountName: prometheus-prometheus-node-exporter
|
||||||
containers:
|
containers:
|
||||||
- name: node-exporter
|
- name: node-exporter
|
||||||
image: quay.io/prometheus/node-exporter:v1.8.2
|
image: reg.inje-private.com/nnd002/prometheus/node-exporter:v1.8.2
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
args:
|
args:
|
||||||
- --path.procfs=/host/proc
|
- --path.procfs=/host/proc
|
||||||
|
|
@ -48,7 +48,7 @@ spec:
|
||||||
- --port=8080
|
- --port=8080
|
||||||
- --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
|
- --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
|
image: reg.inje-private.com/nnd002/kube-state-metrics/kube-state-metrics:v2.13.0
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
name: "http"
|
name: "http"
|
||||||
|
|
@ -116,7 +116,7 @@ spec:
|
||||||
automountServiceAccountToken: true
|
automountServiceAccountToken: true
|
||||||
containers:
|
containers:
|
||||||
- name: pushgateway
|
- name: pushgateway
|
||||||
image: "quay.io/prometheus/pushgateway:v1.9.0"
|
image: "reg.inje-private.com/nnd002/prometheus/pushgateway:v1.9.0"
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
ports:
|
ports:
|
||||||
- name: metrics
|
- name: metrics
|
||||||
|
|
@ -186,7 +186,7 @@ spec:
|
||||||
serviceAccountName: prometheus-server
|
serviceAccountName: prometheus-server
|
||||||
containers:
|
containers:
|
||||||
- name: prometheus-server-configmap-reload
|
- name: prometheus-server-configmap-reload
|
||||||
image: "quay.io/prometheus-operator/prometheus-config-reloader:v0.76.0"
|
image: "reg.inje-private.com/nnd002/prometheus-operator/prometheus-config-reloader:v0.76.0"
|
||||||
imagePullPolicy: "IfNotPresent"
|
imagePullPolicy: "IfNotPresent"
|
||||||
args:
|
args:
|
||||||
- --watched-dir=/etc/config
|
- --watched-dir=/etc/config
|
||||||
|
|
@ -216,7 +216,7 @@ spec:
|
||||||
mountPath: /etc/config/alerts
|
mountPath: /etc/config/alerts
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- name: prometheus-server
|
- name: prometheus-server
|
||||||
image: "quay.io/prometheus/prometheus:v2.54.1"
|
image: "reg.inje-private.com/nnd002/prometheus/prometheus:v2.54.1"
|
||||||
imagePullPolicy: "IfNotPresent"
|
imagePullPolicy: "IfNotPresent"
|
||||||
args:
|
args:
|
||||||
- --storage.tsdb.retention.time=15d
|
- --storage.tsdb.retention.time=15d
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: vm-nfs
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
name: provision
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: vm-nfs
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: vm-nfs
|
||||||
|
spec:
|
||||||
|
serviceAccountName: nfs-pod-provisioner-sa
|
||||||
|
containers:
|
||||||
|
- name: nfs-client-provisioner
|
||||||
|
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
||||||
|
volumeMounts:
|
||||||
|
- name: nfs-provisioner
|
||||||
|
mountPath: persistentvolumes
|
||||||
|
env:
|
||||||
|
- name: PROVISIONER_NAME
|
||||||
|
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
||||||
|
- name: NFS_SERVER
|
||||||
|
value: 172.17.128.249 # 주소변경
|
||||||
|
- name: NFS_PATH
|
||||||
|
value: /nfs/monitoring # nfs 연결 주소
|
||||||
|
volumes:
|
||||||
|
- name: nfs-provisioner
|
||||||
|
nfs:
|
||||||
|
server: 172.17.128.249
|
||||||
|
path: /nfs/monitoring
|
||||||
|
|
@ -20,19 +20,19 @@ spec:
|
||||||
serviceAccountName: nfs-pod-provisioner-sa
|
serviceAccountName: nfs-pod-provisioner-sa
|
||||||
containers:
|
containers:
|
||||||
- name: nfs-client-provisioner
|
- name: nfs-client-provisioner
|
||||||
image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: nfs-provisioner
|
- name: nfs-provisioner
|
||||||
mountPath: /persistentvolumes
|
mountPath: /persistentvolumes
|
||||||
env:
|
env:
|
||||||
- name: PROVISIONER_NAME
|
- name: PROVISIONER_NAME
|
||||||
value: vm-nfs # SC에서 provisioner의 이름으로 사용
|
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
||||||
- name: NFS_SERVER
|
- name: NFS_SERVER
|
||||||
value: 192.168.0.211
|
value: 172.17.128.249 # 주소변경
|
||||||
- name: NFS_PATH
|
- name: NFS_PATH
|
||||||
value: /nfs # nfs 연결 주소
|
value: /nfs/monitoring # nfs 연결 주소
|
||||||
volumes:
|
volumes:
|
||||||
- name: nfs-provisioner
|
- name: nfs-provisioner
|
||||||
nfs:
|
nfs:
|
||||||
server: 192.168.0.211
|
server: 172.17.128.249
|
||||||
path: /nfs
|
path: /nfs/monitoring
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,202 @@
|
||||||
|
|
||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright {yyyy} {name of copyright owner}
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
@ -0,0 +1,120 @@
|
||||||
|
# Istio
|
||||||
|
|
||||||
|
[](https://bestpractices.coreinfrastructure.org/projects/1395)
|
||||||
|
[](https://goreportcard.com/report/github.com/istio/istio)
|
||||||
|
[](https://godoc.org/istio.io/istio)
|
||||||
|
|
||||||
|
<a href="https://istio.io/">
|
||||||
|
<img src="https://github.com/istio/istio/raw/master/logo/istio-bluelogo-whitebackground-unframed.svg"
|
||||||
|
alt="Istio logo" title="Istio" height="100" width="100" />
|
||||||
|
</a>
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Istio is an open source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio is the path to load balancing, service-to-service authentication, and monitoring – with few or no service code changes.
|
||||||
|
|
||||||
|
- For in-depth information about how to use Istio, visit [istio.io](https://istio.io)
|
||||||
|
- To ask questions and get assistance from our community, visit [Github Discussions](https://github.com/istio/istio/discussions)
|
||||||
|
- To learn how to participate in our overall community, visit [our community page](https://istio.io/about/community)
|
||||||
|
|
||||||
|
In this README:
|
||||||
|
|
||||||
|
- [Introduction](#introduction)
|
||||||
|
- [Repositories](#repositories)
|
||||||
|
- [Issue management](#issue-management)
|
||||||
|
|
||||||
|
In addition, here are some other documents you may wish to read:
|
||||||
|
|
||||||
|
- [Istio Community](https://github.com/istio/community#istio-community) - describes how to get involved and contribute to the Istio project
|
||||||
|
- [Istio Developer's Guide](https://github.com/istio/istio/wiki/Preparing-for-Development) - explains how to set up and use an Istio development environment
|
||||||
|
- [Project Conventions](https://github.com/istio/istio/wiki/Development-Conventions) - describes the conventions we use within the code base
|
||||||
|
- [Creating Fast and Lean Code](https://github.com/istio/istio/wiki/Writing-Fast-and-Lean-Code) - performance-oriented advice and guidelines for the code base
|
||||||
|
|
||||||
|
You'll find many other useful documents on our [Wiki](https://github.com/istio/istio/wiki).
|
||||||
|
|
||||||
|
## Introduction
|
||||||
|
|
||||||
|
[Istio](https://istio.io/latest/docs/concepts/what-is-istio/) is an open platform for providing a uniform way to [integrate
|
||||||
|
microservices](https://istio.io/latest/docs/examples/microservices-istio/), manage [traffic flow](https://istio.io/latest/docs/concepts/traffic-management/) across microservices, enforce policies
|
||||||
|
and aggregate telemetry data. Istio's control plane provides an abstraction
|
||||||
|
layer over the underlying cluster management platform, such as Kubernetes.
|
||||||
|
|
||||||
|
Istio is composed of these components:
|
||||||
|
|
||||||
|
- **Envoy** - Sidecar proxies per microservice to handle ingress/egress traffic
|
||||||
|
between services in the cluster and from a service to external
|
||||||
|
services. The proxies form a _secure microservice mesh_ providing a rich
|
||||||
|
set of functions like discovery, rich layer-7 routing, circuit breakers,
|
||||||
|
policy enforcement and telemetry recording/reporting
|
||||||
|
functions.
|
||||||
|
|
||||||
|
> Note: The service mesh is not an overlay network. It
|
||||||
|
> simplifies and enhances how microservices in an application talk to each
|
||||||
|
> other over the network provided by the underlying platform.
|
||||||
|
|
||||||
|
- **Istiod** - The Istio control plane. It provides service discovery, configuration and certificate management. It consists of the following sub-components:
|
||||||
|
|
||||||
|
- **Pilot** - Responsible for configuring the proxies at runtime.
|
||||||
|
|
||||||
|
- **Citadel** - Responsible for certificate issuance and rotation.
|
||||||
|
|
||||||
|
- **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.
|
||||||
|
|
||||||
|
- **Operator** - The component provides user friendly options to operate the Istio service mesh.
|
||||||
|
|
||||||
|
## Repositories
|
||||||
|
|
||||||
|
The Istio project is divided across a few GitHub repositories:
|
||||||
|
|
||||||
|
- [istio/api](https://github.com/istio/api). This repository defines
|
||||||
|
component-level APIs and common configuration formats for the Istio platform.
|
||||||
|
|
||||||
|
- [istio/community](https://github.com/istio/community). This repository contains
|
||||||
|
information on the Istio community, including the various documents that govern
|
||||||
|
the Istio open source project.
|
||||||
|
|
||||||
|
- [istio/istio](README.md). This is the main code repository. It hosts Istio's
|
||||||
|
core components, install artifacts, and sample programs. It includes:
|
||||||
|
|
||||||
|
- [istioctl](istioctl/). This directory contains code for the
|
||||||
|
[_istioctl_](https://istio.io/latest/docs/reference/commands/istioctl/) command line utility.
|
||||||
|
|
||||||
|
- [operator](operator/). This directory contains code for the
|
||||||
|
[Istio Operator](https://istio.io/latest/docs/setup/install/operator/).
|
||||||
|
|
||||||
|
- [pilot](pilot/). This directory
|
||||||
|
contains platform-specific code to populate the
|
||||||
|
[abstract service model](https://istio.io/docs/concepts/traffic-management/#pilot), dynamically reconfigure the proxies
|
||||||
|
when the application topology changes, as well as translate
|
||||||
|
[routing rules](https://istio.io/latest/docs/reference/config/networking/) into proxy specific configuration.
|
||||||
|
|
||||||
|
- [security](security/). This directory contains [security](https://istio.io/latest/docs/concepts/security/) related code,
|
||||||
|
including Citadel (acting as Certificate Authority), citadel agent, etc.
|
||||||
|
|
||||||
|
- [istio/proxy](https://github.com/istio/proxy). The Istio proxy contains
|
||||||
|
extensions to the [Envoy proxy](https://github.com/envoyproxy/envoy) (in the form of
|
||||||
|
Envoy filters) that support authentication, authorization, and telemetry collection.
|
||||||
|
|
||||||
|
- [istio/ztunnel](https://github.com/istio/ztunnel). The repository contains the Rust implementation of the ztunnel
|
||||||
|
component of Ambient mesh.
|
||||||
|
|
||||||
|
## Issue management
|
||||||
|
|
||||||
|
We use GitHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:
|
||||||
|
|
||||||
|
- **Epic**. An epic represents a feature area for Istio as a whole. Epics are fairly broad in scope and are basically product-level things.
|
||||||
|
Each issue is ultimately part of an epic.
|
||||||
|
|
||||||
|
- **Milestone**. Each issue is assigned a milestone. This is 0.1, 0.2, ..., or 'Nebulous Future'. The milestone indicates when we
|
||||||
|
think the issue should get addressed.
|
||||||
|
|
||||||
|
- **Priority**. Each issue has a priority which is represented by the column in the [Prioritization](https://github.com/orgs/istio/projects/6) project. Priority can be one of
|
||||||
|
P0, P1, P2, or >P2. The priority indicates how important it is to address the issue within the milestone. P0 says that the
|
||||||
|
milestone cannot be considered achieved if the issue isn't resolved.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
<div align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/cncf/artwork/master/other/cncf/horizontal/color/cncf-color.svg" width="300" alt="Cloud Native Computing Foundation logo"/>
|
||||||
|
<p>Istio is a <a href="https://cncf.io">Cloud Native Computing Foundation</a> project.</p>
|
||||||
|
</div>
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,108 @@
|
||||||
|
### download
|
||||||
|
```bash
|
||||||
|
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.23.1 TARGET_ARCH=x86_64 sh -
|
||||||
|
```
|
||||||
|
|
||||||
|
### set istioctl
|
||||||
|
```bash
|
||||||
|
cd ~/istio-1.23.1/bin
|
||||||
|
```
|
||||||
|
```bash
|
||||||
|
chmod +x istioctl
|
||||||
|
```
|
||||||
|
```bash
|
||||||
|
ln istioctl /usr/bin/istioctl
|
||||||
|
```
|
||||||
|
|
||||||
|
### install
|
||||||
|
|
||||||
|
```bash
|
||||||
|
istioctl install --manifests=manifests/
|
||||||
|
```
|
||||||
|
Istioctl은 istio 설치를 위해 manifests/ 디렉토리 내에서 기본적으로 필요한 파일과 폴더들을 참조합니다.
|
||||||
|
|
||||||
|
기본적으로 참조되는 폴더와 파일
|
||||||
|
| 구성요소 | 내용 |
|
||||||
|
| --- | --- |
|
||||||
|
| base | Istio의 기본 리소스 및 CRD 배포, 네임스페이스, 서비스 계정, 클러스터 역할, 클러스터 역할 바인딩 등|
|
||||||
|
| istio-control | Istio의 컨트롤 플레인(예: istiod) 설치에 사용됩니다. |
|
||||||
|
|gateways| Ingress 및 Egress Gateway 설치에 필요하며, 서비스 타입 변경(예: NodePort) 등의 설정을 관리. |
|
||||||
|
| default |
|
||||||
|
|
||||||
|
default/ 폴더는 default 프로필을 사용하는 기본 설치 구성을 포함하고 있습니다. Istio 설치 시 이 폴더의 파일들이 기본적으로 참조되며, 다양한 설치 옵션이 포함된 프로필 파일이 여기에서 사용됩니다.
|
||||||
|
참조 이유: Istio를 설치할 때 default 프로필의 기본 설정을 참조하며, 사용자 정의 구성이 없다면 이 프로필을 따릅니다.
|
||||||
|
istio-operator/
|
||||||
|
|
||||||
|
istio-operator/ 폴더는 IstioOperator 리소스 및 설정을 정의하는 매니페스트가 포함되어 있습니다. 이 파일들은 Istio 설치를 제어하고, 다양한 구성 요소의 활성화/비활성화를 관리하는 데 사용됩니다.
|
||||||
|
참조 이유: IstioOperator 리소스를 통해 Istio 설치의 구체적인 설정과 구성을 관리합니다.
|
||||||
|
istio-cni/ (옵션)
|
||||||
|
|
||||||
|
istio-cni/는 Istio의 CNI(Container Network Interface)를 설정하기 위한 매니페스트 파일을 포함하고 있습니다. Istio CNI는 사이드카 프록시 주입을 지원하며, Kubernetes 네트워크 플러그인과 통합됩니다.
|
||||||
|
참조 이유: CNI 기반 설치를 활성화할 경우 사용됩니다.
|
||||||
|
ztunnel/ (옵션)
|
||||||
|
|
||||||
|
ztunnel/은 Istio의 Zero Trust 기반 네트워크 보안을 지원하는 구성 요소와 관련된 파일이 포함되어 있습니다. 보안 네트워크 통신과 관련된 설정을 정의합니다.
|
||||||
|
참조 이유: Zero Trust 보안 설치를 사용하는 경우 참조됩니다.
|
||||||
|
추가 파일들
|
||||||
|
README.md
|
||||||
|
|
||||||
|
Istio 차트에 대한 간단한 설명이 포함된 파일입니다. Istio의 구성 요소와 설치 방법에 대한 정보를 제공합니다.
|
||||||
|
참조 이유: 설치 중 직접 참조되지는 않지만, 사용자에게 정보를 제공합니다.
|
||||||
|
UPDATING-CHARTS.md
|
||||||
|
|
||||||
|
차트 업데이트와 관련된 정보가 포함된 문서입니다. Istio 차트를 어떻게 업데이트할 수 있는지에 대한 가이드를 제공합니다.
|
||||||
|
참조 이유: 설치 중 직접 참조되지는 않지만, Helm 차트 관리 및 업데이트에 대한 정보를 제공합니다.
|
||||||
|
install-OpenShift.md
|
||||||
|
|
||||||
|
OpenShift에 Istio를 설치할 때 참고할 수 있는 문서입니다. OpenShift에 맞춘 설치 관련 정보가 포함되어 있습니다.
|
||||||
|
참조 이유: OpenShift 설치 시에만 유용하며, 일반적인 Kubernetes 설치에서는 참조되지 않습니다.
|
||||||
|
기본적으로 참조되는 주요 구성 요소
|
||||||
|
CRD: Istio의 모든 설치에서 사용되는 주요 Custom Resource Definitions.
|
||||||
|
istiod: Istio 컨트롤 플레인의 핵심 컴포넌트.
|
||||||
|
Ingress Gateway: Istio Ingress Gateway 설치 파일.
|
||||||
|
IstioOperator: 설치 설정을 조정하는 파일.
|
||||||
|
결론
|
||||||
|
istioctl install --manifests=manifests/ 명령어는 기본적으로 base/, istio-control/, gateways/, default/, istio-operator/ 폴더의 파일들을 참조합니다. 이들 폴더는 Istio의 핵심 구성 요소인 CRD, istiod, 게이트웨이 설정 등을 관리하며, 기본적인 Istio 설치에 필요한 리소스들을 제공합니다.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
나의 말:
|
||||||
|
gateway 폴더와 gateways 폴더의 차이는?
|
||||||
|
ChatGPT의 말:
|
||||||
|
ChatGPT
|
||||||
|
gateway 폴더와 gateways 폴더는 Istio 설치 시 각각 다른 목적을 가진 폴더로, 중요한 차이가 있습니다. 이 두 폴더는 Istio의 게이트웨이(Gateway) 구성과 관련이 있지만, 다루는 범위와 역할이 다릅니다.
|
||||||
|
|
||||||
|
1. gateway/ 폴더
|
||||||
|
목적: Istio의 개별적인 Gateway 구성과 관련된 설정이 포함됩니다. 주로 istio-ingressgateway 또는 istio-egressgateway와 같은 구체적인 게이트웨이 인스턴스를 정의하고, 설치할 때 필요한 매니페스트가 여기에 저장됩니다.
|
||||||
|
내용: Istio에서 Ingress 또는 Egress Gateway를 정의하는 Kubernetes 리소스의 매니페스트가 있을 수 있습니다. 이 폴더는 특정 게이트웨이 인스턴스와 관련된 세부 설정을 포함하는 경우가 많습니다.
|
||||||
|
예시 파일:
|
||||||
|
ingress-gateway.yaml
|
||||||
|
egress-gateway.yaml
|
||||||
|
역할:
|
||||||
|
|
||||||
|
개별 Ingress Gateway와 Egress Gateway를 정의하는 파일을 포함.
|
||||||
|
특정 Gateway 리소스를 Kubernetes 클러스터에 설치할 때 참조됩니다.
|
||||||
|
Ingress Gateway와 Egress Gateway의 서비스 설정(예: NodePort, ClusterIP) 등을 제어할 수 있습니다.
|
||||||
|
2. gateways/ 폴더
|
||||||
|
목적: Istio의 게이트웨이 관련 전반적인 설정이 포함되어 있습니다. 여기에는 Ingress 및 Egress Gateway를 위한 공통적인 설정, 또는 여러 게이트웨이를 관리하는 설정들이 포함됩니다.
|
||||||
|
내용: 여러 게이트웨이와 관련된 설정이나 매니페스트 파일이 들어 있을 수 있으며, 설치할 때 다양한 게이트웨이 구성 요소를 설정하는 데 사용됩니다.
|
||||||
|
예시 파일:
|
||||||
|
ingress.yaml
|
||||||
|
egress.yaml
|
||||||
|
역할:
|
||||||
|
|
||||||
|
Istio에서 게이트웨이와 관련된 전반적인 리소스들을 정의.
|
||||||
|
다양한 게이트웨이 설정 파일을 포함하여 전체 게이트웨이 설치 및 관리에 사용.
|
||||||
|
여러 게이트웨이 인스턴스 간의 공통 설정을 관리하는데 도움을 줍니다.
|
||||||
|
주요 차이점 요약
|
||||||
|
항목 gateway/ 폴더 gateways/ 폴더
|
||||||
|
목적 개별 Gateway 인스턴스(Ingress, Egress 등)를 정의 게이트웨이 관련 전반적인 설정 및 리소스들을 관리
|
||||||
|
내용 특정 Ingress/Egress Gateway의 설정 파일 다양한 게이트웨이와 관련된 매니페스트 및 설정 파일
|
||||||
|
사용 예 istio-ingressgateway 또는 istio-egressgateway 설정 게이트웨이 설치 및 여러 게이트웨이 구성 요소를 관리
|
||||||
|
설정 범위 개별 Gateway 리소스에 대한 세부 설정 게이트웨이 전반에 걸친 공통 설정을 포함
|
||||||
|
결론
|
||||||
|
gateway/ 폴더: 특정 Gateway 인스턴스(예: istio-ingressgateway 또는 istio-egressgateway)의 설정 파일들이 포함되어, 개별 게이트웨이를 정의하고 관리하는 데 사용됩니다.
|
||||||
|
gateways/ 폴더: Istio의 게이트웨이와 관련된 전반적인 설정 파일들을 포함하고 있으며, 여러 게이트웨이 리소스에 공통된 설정을 관리하거나, 다양한 게이트웨이 설치 파일들을 포함할 수 있습니다.
|
||||||
|
따라서, **gateway/**는 개별 게이트웨이에 집중하고, **gateways/**는 게이트웨이 관련 설정을 광범위하게 관리하는 역할을 합니다.
|
||||||
|
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
architectures:
|
||||||
|
- linux/amd64
|
||||||
|
- linux/arm64
|
||||||
|
dashboards:
|
||||||
|
istio-extension-dashboard: 13277
|
||||||
|
istio-mesh-dashboard: 7639
|
||||||
|
istio-performance-dashboard: 11829
|
||||||
|
istio-service-dashboard: 7636
|
||||||
|
istio-workload-dashboard: 7630
|
||||||
|
pilot-dashboard: 7645
|
||||||
|
ztunnel-dashboard: 0
|
||||||
|
dependencies:
|
||||||
|
api:
|
||||||
|
goversionenabled: true
|
||||||
|
sha: 978ac3b543c0bb4c27bfd1ed3bec42128159118f
|
||||||
|
client-go:
|
||||||
|
goversionenabled: true
|
||||||
|
sha: 42f73330498cb7ec2bb222f83207a7bf05d16d29
|
||||||
|
envoy:
|
||||||
|
sha: 43f5f370dfa3805242e8a48997f99d24c46c68fa
|
||||||
|
istio:
|
||||||
|
sha: 64cfafb98498c62fa35e981b95cb5c7a36678af8
|
||||||
|
proxy:
|
||||||
|
sha: 9da6ab5663bca846996adcb4414dc6bf7bf0d3eb
|
||||||
|
release-builder:
|
||||||
|
sha: f01976c12ca64a1d12437350200fe7c552ac9c72
|
||||||
|
test-infra:
|
||||||
|
sha: 8785582b9a015250a260495ab97fe96930c95bb8
|
||||||
|
tools:
|
||||||
|
sha: 22bc85faf18d262409ec3210405e8e90f8ec5052
|
||||||
|
ztunnel:
|
||||||
|
sha: 245ecc111ba1cbe9bd2923f24be609e656a191ad
|
||||||
|
docker: docker.io/istio
|
||||||
|
dockerOutput: tar
|
||||||
|
skipGenerateBillOfMaterials: false
|
||||||
|
version: 1.23.1
|
||||||
|
|
@ -0,0 +1,136 @@
|
||||||
|
# Istio Installer
|
||||||
|
|
||||||
|
Note: If making any changes to the charts or values.yaml in this dir, first read [UPDATING-CHARTS.md](UPDATING-CHARTS.md)
|
||||||
|
|
||||||
|
Istio installer is a modular, 'a-la-carte' installer for Istio. It is based on a
|
||||||
|
fork of the Istio helm templates, refactored to increase modularity and isolation.
|
||||||
|
|
||||||
|
Goals:
|
||||||
|
- Improve upgrade experience: users should be able to gradually roll upgrades, with proper
|
||||||
|
canary deployments for Istio components. It should be possible to deploy a new version while keeping the
|
||||||
|
stable version in place and gradually migrate apps to the new version.
|
||||||
|
|
||||||
|
- More flexibility: the new installer allows multiple 'environments', allowing applications to select
|
||||||
|
a set of control plane settings and components. While the entire mesh respects the same APIs and config,
|
||||||
|
apps may target different 'environments' which contain different instances and variants of Istio.
|
||||||
|
|
||||||
|
- Better security: separate Istio components reside in different namespaces, allowing different teams or
|
||||||
|
roles to manage different parts of Istio. For example, a security team would maintain the
|
||||||
|
root CA and policy, a telemetry team may only have access to Prometheus,
|
||||||
|
and a different team may maintain the control plane components (which are highly security sensitive).
|
||||||
|
|
||||||
|
The install is organized in 'environments' - each environment consists of a set of components
|
||||||
|
in different namespaces that are configured to work together. Regardless of 'environment',
|
||||||
|
workloads can talk with each other and obey the Istio configuration resources, but each environment
|
||||||
|
can use different Istio versions and different configuration defaults.
|
||||||
|
|
||||||
|
`istioctl kube-inject` or the automatic sidecar injector are used to select the environment.
|
||||||
|
In the case of the sidecar injector, the namespace label `istio-env: <NAME_OF_ENV>` is used instead
|
||||||
|
of the conventional `istio-injected: true`. The name of the environment is defined as the namespace
|
||||||
|
where the corresponding control plane components (config, discovery, auto-injection) are running.
|
||||||
|
In the examples below, by default this is the `istio-control` namespace. Pod annotations can also
|
||||||
|
be used to select a different 'environment'.
|
||||||
|
|
||||||
|
## Installing
|
||||||
|
|
||||||
|
The new installer is intended to be modular and very explicit about what is installed. It has
|
||||||
|
far more steps than the Istio installer - but each step is smaller and focused on a specific
|
||||||
|
feature, and can be performed by different people/teams at different times.
|
||||||
|
|
||||||
|
It is strongly recommended that different namespaces are used, with different service accounts.
|
||||||
|
In particular access to the security-critical production components (root CA, policy, control)
|
||||||
|
should be locked down and restricted. The new installer allows multiple instances of
|
||||||
|
policy/control/telemetry - so testing/staging of new settings and versions can be performed
|
||||||
|
by a different role than the prod version.
|
||||||
|
|
||||||
|
The intended users of this repo are users running Istio in production who want to select, tune
|
||||||
|
and understand each binary that gets deployed, and select which combination to use.
|
||||||
|
|
||||||
|
Note: each component can be installed in parallel with an existing Istio 1.0 or 1.1 installation in
|
||||||
|
`istio-system`. The new components will not interfere with existing apps, but can interoperate,
|
||||||
|
and it is possible to gradually move apps from Istio 1.0/1.1 to the new environments and
|
||||||
|
across environments ( for example canary -> prod )
|
||||||
|
|
||||||
|
Note: there are still some cluster roles that may need to be fixed, most likely cluster permissions
|
||||||
|
will need to move to the security component.
|
||||||
|
|
||||||
|
## Everything is Optional
|
||||||
|
|
||||||
|
Each component in the new installer is optional. Users can install the component defined in the new installer,
|
||||||
|
use the equivalent component in `istio-system`, configured with the official installer, or use a different
|
||||||
|
version or implementation.
|
||||||
|
|
||||||
|
For example, you may use your own Prometheus and Grafana installs, or you may use a specialized/custom
|
||||||
|
certificate provisioning tool, or use components that are centrally managed and running in a different cluster.
|
||||||
|
|
||||||
|
This is a work in progress - building on top of the multi-cluster installer.
|
||||||
|
|
||||||
|
As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component
|
||||||
|
in that cluster. Currently, the minimum we require is the security provider (node agent or citadel).
|
||||||
|
|
||||||
|
### Install Istio CRDs
|
||||||
|
|
||||||
|
This is the first step of the installation. Please do not remove or edit any CRD - config currently requires
|
||||||
|
all CRDs to be present. On each upgrade it is recommended to reapply the file, to make sure
|
||||||
|
you get all CRDs. CRDs are separated by release and by component type in the CRD directory.
|
||||||
|
|
||||||
|
Istio has strong integration with certmanager. Some operators may want to keep their current certmanager
|
||||||
|
CRDs in place and not have Istio modify them. In this case, it is necessary to apply CRD files individually.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl apply -k github.com/istio/installer/base
|
||||||
|
```
|
||||||
|
|
||||||
|
or
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl apply -f base/files
|
||||||
|
```
|
||||||
|
|
||||||
|
### Install Istio-CNI
|
||||||
|
|
||||||
|
This is an optional step - CNI must run in a dedicated namespace, it is a 'singleton' and extremely
|
||||||
|
security sensitive. Access to the CNI namespace must be highly restricted.
|
||||||
|
|
||||||
|
**NOTE:** The environment variable `ISTIO_CLUSTER_ISGKE` is assumed to be set to `true` if the cluster
|
||||||
|
is a GKE cluster.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ISTIO_CNI_ARGS=
|
||||||
|
# TODO: What k8s data can we use for this check for whether GKE?
|
||||||
|
if [[ "${ISTIO_CLUSTER_ISGKE}" == "true" ]]; then
|
||||||
|
ISTIO_CNI_ARGS="--set cni.cniBinDir=/home/kubernetes/bin"
|
||||||
|
fi
|
||||||
|
iop kube-system istio-cni $IBASE/istio-cni/ ${ISTIO_CNI_ARGS}
|
||||||
|
```
|
||||||
|
|
||||||
|
TODO. It is possible to add Istio-CNI later, and gradually migrate.
|
||||||
|
|
||||||
|
### Install Control plane
|
||||||
|
|
||||||
|
This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
|
||||||
|
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
|
||||||
|
--set global.istioNamespace=istio-system
|
||||||
|
|
||||||
|
# Second istio-discovery, using master version of istio
|
||||||
|
TAG=latest HUB=gcr.io/istio-testing iop istio-master istio-discovery-master $IBASE/istio-control/istio-discovery \
|
||||||
|
--set policy.enable=false \
|
||||||
|
--set global.istioNamespace=istio-master
|
||||||
|
```
|
||||||
|
|
||||||
|
### Gateways
|
||||||
|
|
||||||
|
A cluster may use multiple Gateways, each with a different load balancer IP, domains and certificates.
|
||||||
|
|
||||||
|
Since the domain certificates are stored in the gateway namespace, it is recommended to keep each
|
||||||
|
gateway in a dedicated namespace and restrict access.
|
||||||
|
|
||||||
|
For large-scale gateways it is optionally possible to use a dedicated pilot in the gateway namespace.
|
||||||
|
|
||||||
|
### Additional test templates
|
||||||
|
|
||||||
|
A number of helm test setups are general-purpose and should be installable in any cluster, to confirm
|
||||||
|
Istio works properly and allow testing the specific installation.
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
# Updating charts and values.yaml
|
||||||
|
|
||||||
|
## Acceptable Pull Requests
|
||||||
|
|
||||||
|
Helm charts `values.yaml` represent a complex user facing API that tends to grow uncontrollably over time
|
||||||
|
due to design choices in Helm.
|
||||||
|
The underlying Kubernetes resources we configure have 1000s of fields; given enough users and bespoke use cases,
|
||||||
|
eventually someone will want to customize every one of those fields.
|
||||||
|
If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly.
|
||||||
|
|
||||||
|
To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.
|
||||||
|
|
||||||
|
If the change is a dynamic runtime configuration, it probably belongs in the [MeshConfig API](https://github.com/istio/api/blob/master/mesh/v1alpha1/config.proto).
|
||||||
|
This allows configuration without re-installing or restarting deployments.
|
||||||
|
|
||||||
|
If the change is to a Kubernetes field (such as modifying a Deployment attribute), it will likely need to be install-time configuration.
|
||||||
|
However, that doesn't necessarily mean a PR to add a value will be accepted.
|
||||||
|
The `values.yaml` API is intended to maintain a *minimal core set of configuration* that most users will use.
|
||||||
|
For bespoke use cases, [Helm Chart Customization](https://istio.io/latest/docs/setup/additional-setup/customize-installation-helm/#advanced-helm-chart-customization) can be used
|
||||||
|
to allow arbitrary customizations.
|
||||||
|
|
||||||
|
If the change truly is generally purpose, it is generally preferred to have broader APIs. For example, instead of providing
|
||||||
|
direct access to each of the complex fields in [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/), just providing
|
||||||
|
a single `affinity` field that is passed through as-is to the Kubernetes resource.
|
||||||
|
This provides maximum flexibility with minimal API surface overhead.
|
||||||
|
|
||||||
|
## Making changes
|
||||||
|
|
||||||
|
## Step 1. Make changes in charts and values.yaml in `manifests` directory
|
||||||
|
|
||||||
|
Be sure to provide sufficient documentation and example usage in values.yaml.
|
||||||
|
If the chart has a `values.schema.json`, that should be updated as well.
|
||||||
|
|
||||||
|
## Step 2. Update the istioctl/Operator values
|
||||||
|
|
||||||
|
If you are modifying the `gateway` chart, you can stop here.
|
||||||
|
All other charts, however, are exposed by `istioctl` and need to follow the steps below.
|
||||||
|
|
||||||
|
The charts in the `manifests` directory are used in istioctl to generate an installation manifest.
|
||||||
|
|
||||||
|
If `values.yaml` is changed, be sure to update corresponding values changes in [../profiles/default.yaml](../profiles/default.yaml)
|
||||||
|
|
||||||
|
## Step 3. Update istioctl schema
|
||||||
|
|
||||||
|
Istioctl uses a [schema](../../operator/pkg/apis/istio/v1alpha1/values_types.proto) to validate the values. Any changes to
|
||||||
|
the schema must be added here, otherwise istioctl users will see errors.
|
||||||
|
Once the schema file is updated, run:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ make operator-proto
|
||||||
|
```
|
||||||
|
|
||||||
|
This will regenerate the Go structs used for schema validation.
|
||||||
|
|
||||||
|
## Step 4. Update the generated manifests
|
||||||
|
|
||||||
|
Tests of istioctl use the auto-generated manifests to ensure that the istioctl binary has the correct version of the charts.
|
||||||
|
To regenerate the manifests, run:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ make copy-templates update-golden
|
||||||
|
```
|
||||||
|
|
||||||
|
## Step 5. Create a PR using outputs from Steps 1 to 4
|
||||||
|
|
||||||
|
Your PR should pass all the checks if you followed these steps.
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: 1.23.1
|
||||||
|
description: Helm chart for deploying Istio cluster resources and CRDs
|
||||||
|
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||||
|
keywords:
|
||||||
|
- istio
|
||||||
|
name: base
|
||||||
|
sources:
|
||||||
|
- https://github.com/istio/istio
|
||||||
|
version: 1.23.1
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
# Istio base Helm Chart
|
||||||
|
|
||||||
|
This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
|
||||||
|
|
||||||
|
## Setup Repo Info
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||||
|
helm repo update
|
||||||
|
```
|
||||||
|
|
||||||
|
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||||
|
|
||||||
|
## Installing the Chart
|
||||||
|
|
||||||
|
To install the chart with the release name `istio-base`:
|
||||||
|
|
||||||
|
```console
|
||||||
|
kubectl create namespace istio-system
|
||||||
|
helm install istio-base istio/base -n istio-system
|
||||||
|
```
|
||||||
|
|
||||||
|
### Profiles
|
||||||
|
|
||||||
|
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||||
|
These can be set with `--set profile=<profile>`.
|
||||||
|
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||||
|
|
||||||
|
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||||
|
|
||||||
|
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||||
|
|
||||||
|
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||||
|
When configuring the chart, you should not include this.
|
||||||
|
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
variant: distroless
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||||
|
variant: distroless
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.21 behavioral changes
|
||||||
|
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||||
|
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||||
|
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||||
|
ENABLE_AUTO_SNI: "false"
|
||||||
|
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
@ -0,0 +1,73 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||||
|
# * Lower resource utilization.
|
||||||
|
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||||
|
# * More ports enabled on the ingress, which is used in some tasks.
|
||||||
|
meshConfig:
|
||||||
|
accessLogFile: /dev/stdout
|
||||||
|
extensionProviders:
|
||||||
|
- name: otel
|
||||||
|
envoyOtelAls:
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
port: 4317
|
||||||
|
- name: skywalking
|
||||||
|
skywalking:
|
||||||
|
service: tracing.istio-system.svc.cluster.local
|
||||||
|
port: 11800
|
||||||
|
- name: otel-tracing
|
||||||
|
opentelemetry:
|
||||||
|
port: 4317
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
|
||||||
|
global:
|
||||||
|
proxy:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
traceSampling: 100
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 100Mi
|
||||||
|
|
||||||
|
gateways:
|
||||||
|
istio-egressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
istio-ingressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
ports:
|
||||||
|
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||||
|
# Note that AWS ELB will by default perform health checks on the first port
|
||||||
|
# on this list. Setting this to the health check port will ensure that health
|
||||||
|
# checks always work. https://github.com/istio/istio/issues/12503
|
||||||
|
- port: 15021
|
||||||
|
targetPort: 15021
|
||||||
|
name: status-port
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
name: http2
|
||||||
|
- port: 443
|
||||||
|
targetPort: 8443
|
||||||
|
name: https
|
||||||
|
- port: 31400
|
||||||
|
targetPort: 31400
|
||||||
|
name: tcp
|
||||||
|
# This is the port where sni routing happens
|
||||||
|
- port: 15443
|
||||||
|
targetPort: 15443
|
||||||
|
name: tls
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
variant: distroless
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||||
|
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||||
|
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||||
|
platform: openshift
|
||||||
|
variant: distroless
|
||||||
|
seLinuxOptions:
|
||||||
|
type: spc_t
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||||
|
# CNI must be installed.
|
||||||
|
cni:
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
platform: openshift
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The preview profile contains features that are experimental.
|
||||||
|
# This is intended to explore new features coming to Istio.
|
||||||
|
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# Enable Istio agent to handle DNS requests for known hosts
|
||||||
|
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||||
|
ISTIO_META_DNS_CAPTURE: "true"
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||||
|
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||||
|
experimental:
|
||||||
|
stableValidationPolicy: true
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
Istio base successfully installed!
|
||||||
|
|
||||||
|
To learn more about the release, try:
|
||||||
|
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||||
|
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
{{- if .Values.base.enableCRDTemplates }}
|
||||||
|
{{ .Files.Get "crds/crd-all.gen.yaml" }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,54 @@
|
||||||
|
{{- if not (eq .Values.defaultRevision "") }}
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: istiod-default-validator
|
||||||
|
labels:
|
||||||
|
app: istiod
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
istio: istiod
|
||||||
|
istio.io/rev: {{ .Values.defaultRevision | quote }}
|
||||||
|
webhooks:
|
||||||
|
- name: validation.istio.io
|
||||||
|
clientConfig:
|
||||||
|
{{- if .Values.base.validationURL }}
|
||||||
|
url: {{ .Values.base.validationURL }}
|
||||||
|
{{- else }}
|
||||||
|
service:
|
||||||
|
{{- if (eq .Values.defaultRevision "default") }}
|
||||||
|
name: istiod
|
||||||
|
{{- else }}
|
||||||
|
name: istiod-{{ .Values.defaultRevision }}
|
||||||
|
{{- end }}
|
||||||
|
namespace: {{ .Values.global.istioNamespace }}
|
||||||
|
path: "/validate"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.base.validationCABundle }}
|
||||||
|
caBundle: "{{ .Values.base.validationCABundle }}"
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
apiGroups:
|
||||||
|
- security.istio.io
|
||||||
|
- networking.istio.io
|
||||||
|
- telemetry.istio.io
|
||||||
|
- extensions.istio.io
|
||||||
|
apiVersions:
|
||||||
|
- "*"
|
||||||
|
resources:
|
||||||
|
- "*"
|
||||||
|
|
||||||
|
{{- if .Values.base.validationCABundle }}
|
||||||
|
# Disable webhook controller in Pilot to stop patching it
|
||||||
|
failurePolicy: Fail
|
||||||
|
{{- else }}
|
||||||
|
# Fail open until the validation webhook is ready. The webhook controller
|
||||||
|
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||||
|
# endpoint is ready.
|
||||||
|
failurePolicy: Ignore
|
||||||
|
{{- end }}
|
||||||
|
sideEffects: None
|
||||||
|
admissionReviewVersions: ["v1"]
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||||
|
# if the remotePilotAddress is an IP addr
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Endpoints
|
||||||
|
metadata:
|
||||||
|
{{- if .Values.pilot.enabled }}
|
||||||
|
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
|
||||||
|
{{- else }}
|
||||||
|
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
subsets:
|
||||||
|
- addresses:
|
||||||
|
- ip: {{ .Values.global.remotePilotAddress }}
|
||||||
|
ports:
|
||||||
|
- port: 15012
|
||||||
|
name: tcp-istiod
|
||||||
|
protocol: TCP
|
||||||
|
- port: 15017
|
||||||
|
name: tcp-webhook
|
||||||
|
protocol: TCP
|
||||||
|
---
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# This service account aggregates reader permissions for the revisions in a given cluster
|
||||||
|
# Should be used for remote secret creation.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
{{- if .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
metadata:
|
||||||
|
name: istio-reader-service-account
|
||||||
|
namespace: {{ .Values.global.istioNamespace }}
|
||||||
|
labels:
|
||||||
|
app: istio-reader
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
{{- if .Values.global.remotePilotAddress }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
{{- if .Values.pilot.enabled }}
|
||||||
|
# when local istiod is enabled, we can't use istiod service name to reach the remote control plane
|
||||||
|
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
|
||||||
|
{{- else }}
|
||||||
|
# when local istiod isn't enabled, we can use istiod service name to reach the remote control plane
|
||||||
|
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 15012
|
||||||
|
name: tcp-istiod
|
||||||
|
protocol: TCP
|
||||||
|
- port: 443
|
||||||
|
targetPort: 15017
|
||||||
|
name: tcp-webhook
|
||||||
|
protocol: TCP
|
||||||
|
{{- if not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress) }}
|
||||||
|
# if the remotePilotAddress is not an IP addr, we use ExternalName
|
||||||
|
type: ExternalName
|
||||||
|
externalName: {{ .Values.global.remotePilotAddress }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.global.ipFamilyPolicy }}
|
||||||
|
ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.global.ipFamilies }}
|
||||||
|
ipFamilies:
|
||||||
|
{{- range .Values.global.ipFamilies }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
---
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingAdmissionPolicy
|
||||||
|
metadata:
|
||||||
|
name: "stable-channel-default-policy.istio.io"
|
||||||
|
labels:
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
istio: istiod
|
||||||
|
istio.io/rev: {{ .Values.defaultRevision }}
|
||||||
|
spec:
|
||||||
|
failurePolicy: Fail
|
||||||
|
matchConstraints:
|
||||||
|
resourceRules:
|
||||||
|
- apiGroups:
|
||||||
|
- security.istio.io
|
||||||
|
- networking.istio.io
|
||||||
|
- telemetry.istio.io
|
||||||
|
- extensions.istio.io
|
||||||
|
apiVersions: ["*"]
|
||||||
|
operations: ["CREATE", "UPDATE"]
|
||||||
|
resources: ["*"]
|
||||||
|
variables:
|
||||||
|
- name: isEnvoyFilter
|
||||||
|
expression: "object.kind == 'EnvoyFilter'"
|
||||||
|
- name: isWasmPlugin
|
||||||
|
expression: "object.kind == 'WasmPlugin'"
|
||||||
|
- name: isProxyConfig
|
||||||
|
expression: "object.kind == 'ProxyConfig'"
|
||||||
|
- name: isTelemetry
|
||||||
|
expression: "object.kind == 'Telemetry'"
|
||||||
|
validations:
|
||||||
|
- expression: "!variables.isEnvoyFilter"
|
||||||
|
- expression: "!variables.isWasmPlugin"
|
||||||
|
- expression: "!variables.isProxyConfig"
|
||||||
|
- expression: |
|
||||||
|
!(
|
||||||
|
variables.isTelemetry && (
|
||||||
|
(has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
|
||||||
|
(has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
|
||||||
|
(has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
|
||||||
|
)
|
||||||
|
)
|
||||||
|
---
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingAdmissionPolicyBinding
|
||||||
|
metadata:
|
||||||
|
name: "stable-channel-default-policy-binding.istio.io"
|
||||||
|
spec:
|
||||||
|
policyName: "stable-channel-default-policy.istio.io"
|
||||||
|
validationActions: [Deny]
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
{{/*
|
||||||
|
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||||
|
The original version of this file is located at /manifests directory.
|
||||||
|
If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
Complex logic ahead...
|
||||||
|
We have three sets of values, in order of precedence (last wins):
|
||||||
|
1. The builtin values.yaml defaults
|
||||||
|
2. The profile the user selects
|
||||||
|
3. Users input (-f or --set)
|
||||||
|
|
||||||
|
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||||
|
|
||||||
|
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||||
|
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||||
|
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||||
|
*/}}
|
||||||
|
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||||
|
{{- $defaults := $.Values.defaults }}
|
||||||
|
{{- $_ := unset $.Values "defaults" }}
|
||||||
|
{{- $profile := dict }}
|
||||||
|
{{- with .Values.profile }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||||
|
{{- $profile = (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.compatibilityVersion }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||||
|
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $profile }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||||
|
{{- end }}
|
||||||
|
# Flatten globals, if defined on a per-chart basis
|
||||||
|
{{- if false }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||||
|
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||||
|
defaults:
|
||||||
|
global:
|
||||||
|
|
||||||
|
# ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
|
||||||
|
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||||
|
# Must be set for any cluster configured with private docker registry.
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
# Used to locate istiod.
|
||||||
|
istioNamespace: istio-system
|
||||||
|
|
||||||
|
externalIstiod: false
|
||||||
|
remotePilotAddress: ""
|
||||||
|
|
||||||
|
# Platform where Istio is deployed. Possible values are: "openshift", "gcp".
|
||||||
|
# An empty value means it is a vanilla Kubernetes distribution, therefore no special
|
||||||
|
# treatment will be considered.
|
||||||
|
platform: ""
|
||||||
|
|
||||||
|
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
|
||||||
|
# This is intended only for use with external istiod.
|
||||||
|
ipFamilyPolicy: ""
|
||||||
|
ipFamilies: []
|
||||||
|
|
||||||
|
base:
|
||||||
|
# Used for helm2 to add the CRDs to templates.
|
||||||
|
enableCRDTemplates: false
|
||||||
|
|
||||||
|
# Validation webhook configuration url
|
||||||
|
# For example: https://$remotePilotAddress:15017/validate
|
||||||
|
validationURL: ""
|
||||||
|
# Validation webhook caBundle value. Useful when running pilot with a well known cert
|
||||||
|
validationCABundle: ""
|
||||||
|
|
||||||
|
# For istioctl usage to disable istio config crds in base
|
||||||
|
enableIstioConfigCRDs: true
|
||||||
|
|
||||||
|
defaultRevision: "default"
|
||||||
|
experimental:
|
||||||
|
stableValidationPolicy: false
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v2
|
||||||
|
name: istio-default
|
||||||
|
# This version is never actually shipped. istio/release-builder will replace it at build-time
|
||||||
|
# with the appropriate version
|
||||||
|
version: 1.0.0
|
||||||
|
appVersion: 1.0.0
|
||||||
|
description: Helm chart for istio default revision components.
|
||||||
|
keywords:
|
||||||
|
- istio
|
||||||
|
sources:
|
||||||
|
- https://github.com/istio/istio
|
||||||
|
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
variant: distroless
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||||
|
variant: distroless
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.21 behavioral changes
|
||||||
|
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||||
|
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||||
|
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||||
|
ENABLE_AUTO_SNI: "false"
|
||||||
|
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
@ -0,0 +1,73 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||||
|
# * Lower resource utilization.
|
||||||
|
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||||
|
# * More ports enabled on the ingress, which is used in some tasks.
|
||||||
|
meshConfig:
|
||||||
|
accessLogFile: /dev/stdout
|
||||||
|
extensionProviders:
|
||||||
|
- name: otel
|
||||||
|
envoyOtelAls:
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
port: 4317
|
||||||
|
- name: skywalking
|
||||||
|
skywalking:
|
||||||
|
service: tracing.istio-system.svc.cluster.local
|
||||||
|
port: 11800
|
||||||
|
- name: otel-tracing
|
||||||
|
opentelemetry:
|
||||||
|
port: 4317
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
|
||||||
|
global:
|
||||||
|
proxy:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
traceSampling: 100
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 100Mi
|
||||||
|
|
||||||
|
gateways:
|
||||||
|
istio-egressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
istio-ingressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
ports:
|
||||||
|
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||||
|
# Note that AWS ELB will by default perform health checks on the first port
|
||||||
|
# on this list. Setting this to the health check port will ensure that health
|
||||||
|
# checks always work. https://github.com/istio/istio/issues/12503
|
||||||
|
- port: 15021
|
||||||
|
targetPort: 15021
|
||||||
|
name: status-port
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
name: http2
|
||||||
|
- port: 443
|
||||||
|
targetPort: 8443
|
||||||
|
name: https
|
||||||
|
- port: 31400
|
||||||
|
targetPort: 31400
|
||||||
|
name: tcp
|
||||||
|
# This is the port where sni routing happens
|
||||||
|
- port: 15443
|
||||||
|
targetPort: 15443
|
||||||
|
name: tls
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
variant: distroless
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||||
|
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||||
|
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||||
|
platform: openshift
|
||||||
|
variant: distroless
|
||||||
|
seLinuxOptions:
|
||||||
|
type: spc_t
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||||
|
# CNI must be installed.
|
||||||
|
cni:
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
platform: openshift
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The preview profile contains features that are experimental.
|
||||||
|
# This is intended to explore new features coming to Istio.
|
||||||
|
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# Enable Istio agent to handle DNS requests for known hosts
|
||||||
|
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||||
|
ISTIO_META_DNS_CAPTURE: "true"
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||||
|
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||||
|
experimental:
|
||||||
|
stableValidationPolicy: true
|
||||||
|
|
@ -0,0 +1,125 @@
|
||||||
|
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||||
|
# Removed paths for legacy and default selectors since a revision tag
|
||||||
|
# is inherently created from a specific revision
|
||||||
|
{{/* Copy just what we need to avoid expensive deepCopy */}}
|
||||||
|
{{- $whv := dict
|
||||||
|
"revision" .Values.revision
|
||||||
|
"injectionURL" .Values.istiodRemote.injectionURL
|
||||||
|
"namespace" .Release.Namespace }}
|
||||||
|
{{- define "core" }}
|
||||||
|
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||||
|
clientConfig:
|
||||||
|
{{- if .injectionURL }}
|
||||||
|
url: {{ .injectionURL }}
|
||||||
|
{{- else }}
|
||||||
|
service:
|
||||||
|
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||||
|
namespace: {{ .namespace }}
|
||||||
|
path: "/inject"
|
||||||
|
{{- end }}
|
||||||
|
sideEffects: None
|
||||||
|
rules:
|
||||||
|
- operations: [ "CREATE" ]
|
||||||
|
apiGroups: [""]
|
||||||
|
apiVersions: ["v1"]
|
||||||
|
resources: ["pods"]
|
||||||
|
failurePolicy: Fail
|
||||||
|
admissionReviewVersions: ["v1"]
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: MutatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: istio-revision-tag-default
|
||||||
|
labels:
|
||||||
|
istio.io/tag: "default"
|
||||||
|
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||||
|
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||||
|
operator.istio.io/component: "Pilot"
|
||||||
|
app: sidecar-injector
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
webhooks:
|
||||||
|
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- "default"
|
||||||
|
- key: istio-injection
|
||||||
|
operator: DoesNotExist
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: sidecar.istio.io/inject
|
||||||
|
operator: NotIn
|
||||||
|
values:
|
||||||
|
- "false"
|
||||||
|
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
- key: istio-injection
|
||||||
|
operator: DoesNotExist
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: sidecar.istio.io/inject
|
||||||
|
operator: NotIn
|
||||||
|
values:
|
||||||
|
- "false"
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- "default"
|
||||||
|
|
||||||
|
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||||
|
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio-injection
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- enabled
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: sidecar.istio.io/inject
|
||||||
|
operator: NotIn
|
||||||
|
values:
|
||||||
|
- "false"
|
||||||
|
|
||||||
|
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||||
|
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio-injection
|
||||||
|
operator: DoesNotExist
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: sidecar.istio.io/inject
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- "true"
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
|
||||||
|
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||||
|
{{- /* Special case 3: no labels at all */}}
|
||||||
|
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio-injection
|
||||||
|
operator: DoesNotExist
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
- key: "kubernetes.io/metadata.name"
|
||||||
|
operator: "NotIn"
|
||||||
|
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: sidecar.istio.io/inject
|
||||||
|
operator: DoesNotExist
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,44 @@
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: istiod-default-validator
|
||||||
|
labels:
|
||||||
|
app: istiod
|
||||||
|
istio: istiod
|
||||||
|
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||||
|
istio.io/tag: "default"
|
||||||
|
# Required to make sure this resource is removed
|
||||||
|
# when purging Istio resources
|
||||||
|
operator.istio.io/component: Pilot
|
||||||
|
webhooks:
|
||||||
|
- name: validation.istio.io
|
||||||
|
clientConfig:
|
||||||
|
{{- if .Values.base.validationURL }}
|
||||||
|
url: {{ .Values.base.validationURL }}
|
||||||
|
{{- else }}
|
||||||
|
service:
|
||||||
|
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||||
|
namespace: {{ .Values.global.istioNamespace }}
|
||||||
|
path: "/validate"
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
apiGroups:
|
||||||
|
- security.istio.io
|
||||||
|
- networking.istio.io
|
||||||
|
- telemetry.istio.io
|
||||||
|
- extensions.istio.io
|
||||||
|
apiVersions:
|
||||||
|
- "*"
|
||||||
|
resources:
|
||||||
|
- "*"
|
||||||
|
failurePolicy: Ignore
|
||||||
|
sideEffects: None
|
||||||
|
admissionReviewVersions: ["v1"]
|
||||||
|
objectSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: istio.io/rev
|
||||||
|
operator: DoesNotExist
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
{{/*
|
||||||
|
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||||
|
The original version of this file is located at /manifests directory.
|
||||||
|
If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
Complex logic ahead...
|
||||||
|
We have three sets of values, in order of precedence (last wins):
|
||||||
|
1. The builtin values.yaml defaults
|
||||||
|
2. The profile the user selects
|
||||||
|
3. Users input (-f or --set)
|
||||||
|
|
||||||
|
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||||
|
|
||||||
|
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||||
|
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||||
|
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||||
|
*/}}
|
||||||
|
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||||
|
{{- $defaults := $.Values.defaults }}
|
||||||
|
{{- $_ := unset $.Values "defaults" }}
|
||||||
|
{{- $profile := dict }}
|
||||||
|
{{- with .Values.profile }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||||
|
{{- $profile = (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.compatibilityVersion }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||||
|
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $profile }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||||
|
{{- end }}
|
||||||
|
# Flatten globals, if defined on a per-chart basis
|
||||||
|
{{- if false }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||||
|
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||||
|
defaults:
|
||||||
|
global:
|
||||||
|
# Used to locate istiod.
|
||||||
|
istioNamespace: "istio-system"
|
||||||
|
|
||||||
|
base:
|
||||||
|
# Validation webhook configuration url
|
||||||
|
# For example: https://$remotePilotAddress:15017/validate
|
||||||
|
validationURL: ""
|
||||||
|
|
||||||
|
istiodRemote:
|
||||||
|
# Sidecar injector mutating webhook configuration url
|
||||||
|
# For example: https://$remotePilotAddress:15017/inject
|
||||||
|
injectionURL: ""
|
||||||
|
|
||||||
|
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||||
|
revision: ""
|
||||||
|
|
||||||
|
sidecarInjectorWebhook:
|
||||||
|
# This enables injection of sidecar in all namespaces,
|
||||||
|
enableNamespacesByDefault: false
|
||||||
|
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: 1.23.1
|
||||||
|
description: Helm chart for deploying Istio gateways
|
||||||
|
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||||
|
keywords:
|
||||||
|
- istio
|
||||||
|
- gateways
|
||||||
|
name: gateway
|
||||||
|
sources:
|
||||||
|
- https://github.com/istio/istio
|
||||||
|
type: application
|
||||||
|
version: 1.23.1
|
||||||
|
|
@ -0,0 +1,170 @@
|
||||||
|
# Istio Gateway Helm Chart
|
||||||
|
|
||||||
|
This chart installs an Istio gateway deployment.
|
||||||
|
|
||||||
|
## Setup Repo Info
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||||
|
helm repo update
|
||||||
|
```
|
||||||
|
|
||||||
|
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||||
|
|
||||||
|
## Installing the Chart
|
||||||
|
|
||||||
|
To install the chart with the release name `istio-ingressgateway`:
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm install istio-ingressgateway istio/gateway
|
||||||
|
```
|
||||||
|
|
||||||
|
## Uninstalling the Chart
|
||||||
|
|
||||||
|
To uninstall/delete the `istio-ingressgateway` deployment:
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm delete istio-ingressgateway
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
To view support configuration options and documentation, run:
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm show values istio/gateway
|
||||||
|
```
|
||||||
|
|
||||||
|
### Profiles
|
||||||
|
|
||||||
|
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||||
|
These can be set with `--set profile=<profile>`.
|
||||||
|
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||||
|
|
||||||
|
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||||
|
|
||||||
|
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||||
|
|
||||||
|
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||||
|
When configuring the chart, you should not include this.
|
||||||
|
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||||
|
|
||||||
|
### OpenShift
|
||||||
|
|
||||||
|
When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm install istio-ingressgateway istio/gateway --set profile=openshift
|
||||||
|
```
|
||||||
|
|
||||||
|
### `image: auto` Information
|
||||||
|
|
||||||
|
The image used by the chart, `auto`, may be unintuitive.
|
||||||
|
This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
|
||||||
|
This allows the same configurations and lifecycle to apply to gateways as sidecars.
|
||||||
|
|
||||||
|
Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
|
||||||
|
See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
|
||||||
|
|
||||||
|
### Examples
|
||||||
|
|
||||||
|
#### Egress Gateway
|
||||||
|
|
||||||
|
Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
service:
|
||||||
|
# Egress gateways do not need an external LoadBalancer IP
|
||||||
|
type: ClusterIP
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Multi-network/VM Gateway
|
||||||
|
|
||||||
|
Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
networkGateway: network-1
|
||||||
|
```
|
||||||
|
|
||||||
|
### Migrating from other installation methods
|
||||||
|
|
||||||
|
Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
|
||||||
|
following the guidance below.
|
||||||
|
If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
|
||||||
|
|
||||||
|
WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
|
||||||
|
|
||||||
|
#### Legacy Gateway Helm charts
|
||||||
|
|
||||||
|
Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
|
||||||
|
These are replaced by this chart.
|
||||||
|
While not required, it is recommended all new users use this chart, and existing users migrate when possible.
|
||||||
|
|
||||||
|
This chart has the following benefits and differences:
|
||||||
|
* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
|
||||||
|
* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
|
||||||
|
* Published to official Istio Helm repository.
|
||||||
|
* Single chart for all gateways (Ingress, Egress, East West).
|
||||||
|
|
||||||
|
#### General concerns
|
||||||
|
|
||||||
|
For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
|
||||||
|
|
||||||
|
If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
app: istio-gateway
|
||||||
|
istio: gateway # the release name with leading istio- prefix stripped
|
||||||
|
```
|
||||||
|
|
||||||
|
If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
|
||||||
|
`foo=bar,istio=ingressgateway`:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
name: my-custom-gateway # Override the name to match existing resources
|
||||||
|
labels:
|
||||||
|
app: "" # Unset default app selector label
|
||||||
|
istio: ingressgateway # override default istio selector label
|
||||||
|
foo: bar # Add the existing custom selector label
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Migrating an existing Helm release
|
||||||
|
|
||||||
|
An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
|
||||||
|
installation was done like:
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
|
||||||
|
```
|
||||||
|
|
||||||
|
It could be upgraded with
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
|
||||||
|
```
|
||||||
|
|
||||||
|
Note the name and labels are overridden to match the names of the existing installation.
|
||||||
|
|
||||||
|
Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
|
||||||
|
If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
|
||||||
|
or customize the ports to match the old defaults.
|
||||||
|
See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
|
||||||
|
|
||||||
|
#### Other migrations
|
||||||
|
|
||||||
|
If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
|
||||||
|
|
||||||
|
The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
|
||||||
|
|
||||||
|
```console
|
||||||
|
KINDS=(service deployment)
|
||||||
|
RELEASE=istio-ingressgateway
|
||||||
|
NAMESPACE=istio-system
|
||||||
|
for KIND in "${KINDS[@]}"; do
|
||||||
|
kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
|
||||||
|
kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
|
||||||
|
kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
|
You may ignore errors about resources not being found.
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
variant: distroless
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||||
|
variant: distroless
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.21 behavioral changes
|
||||||
|
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||||
|
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||||
|
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||||
|
ENABLE_AUTO_SNI: "false"
|
||||||
|
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||||
|
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||||
|
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_DELTA_XDS: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
tracing:
|
||||||
|
zipkin:
|
||||||
|
address: zipkin.istio-system:9411
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# 1.22 behavioral changes
|
||||||
|
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||||
|
# 1.23 behavioral changes
|
||||||
|
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||||
|
|
@ -0,0 +1,73 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||||
|
# * Lower resource utilization.
|
||||||
|
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||||
|
# * More ports enabled on the ingress, which is used in some tasks.
|
||||||
|
meshConfig:
|
||||||
|
accessLogFile: /dev/stdout
|
||||||
|
extensionProviders:
|
||||||
|
- name: otel
|
||||||
|
envoyOtelAls:
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
port: 4317
|
||||||
|
- name: skywalking
|
||||||
|
skywalking:
|
||||||
|
service: tracing.istio-system.svc.cluster.local
|
||||||
|
port: 11800
|
||||||
|
- name: otel-tracing
|
||||||
|
opentelemetry:
|
||||||
|
port: 4317
|
||||||
|
service: opentelemetry-collector.observability.svc.cluster.local
|
||||||
|
|
||||||
|
global:
|
||||||
|
proxy:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
||||||
|
pilot:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
traceSampling: 100
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 100Mi
|
||||||
|
|
||||||
|
gateways:
|
||||||
|
istio-egressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
istio-ingressgateway:
|
||||||
|
autoscaleEnabled: false
|
||||||
|
ports:
|
||||||
|
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||||
|
# Note that AWS ELB will by default perform health checks on the first port
|
||||||
|
# on this list. Setting this to the health check port will ensure that health
|
||||||
|
# checks always work. https://github.com/istio/istio/issues/12503
|
||||||
|
- port: 15021
|
||||||
|
targetPort: 15021
|
||||||
|
name: status-port
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
name: http2
|
||||||
|
- port: 443
|
||||||
|
targetPort: 8443
|
||||||
|
name: https
|
||||||
|
- port: 31400
|
||||||
|
targetPort: 31400
|
||||||
|
name: tcp
|
||||||
|
# This is the port where sni routing happens
|
||||||
|
- port: 15443
|
||||||
|
targetPort: 15443
|
||||||
|
name: tls
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 40Mi
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
variant: distroless
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||||
|
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||||
|
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||||
|
platform: openshift
|
||||||
|
variant: distroless
|
||||||
|
seLinuxOptions:
|
||||||
|
type: spc_t
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||||
|
# CNI must be installed.
|
||||||
|
cni:
|
||||||
|
cniBinDir: /var/lib/cni/bin
|
||||||
|
cniConfDir: /etc/cni/multus/net.d
|
||||||
|
chained: false
|
||||||
|
cniConfFileName: "istio-cni.conf"
|
||||||
|
logLevel: info
|
||||||
|
provider: "multus"
|
||||||
|
global:
|
||||||
|
platform: openshift
|
||||||
|
pilot:
|
||||||
|
cni:
|
||||||
|
enabled: true
|
||||||
|
provider: "multus"
|
||||||
|
platform: openshift
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The preview profile contains features that are experimental.
|
||||||
|
# This is intended to explore new features coming to Istio.
|
||||||
|
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
# Enable Istio agent to handle DNS requests for known hosts
|
||||||
|
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||||
|
ISTIO_META_DNS_CAPTURE: "true"
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||||
|
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||||
|
experimental:
|
||||||
|
stableValidationPolicy: true
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
"{{ include "gateway.name" . }}" successfully installed!
|
||||||
|
|
||||||
|
To learn more about the release, try:
|
||||||
|
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||||
|
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||||
|
|
||||||
|
Next steps:
|
||||||
|
* Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
|
||||||
|
* Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
{{- define "gateway.name" -}}
|
||||||
|
{{- if eq .Release.Name "RELEASE-NAME" -}}
|
||||||
|
{{- .Values.name | default "istio-ingressgateway" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the helm.sh/chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "gateway.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "gateway.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "gateway.chart" . }}
|
||||||
|
{{ include "gateway.selectorLabels" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "gateway.name" . }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- range $key, $val := .Values.labels }}
|
||||||
|
{{- if and (ne $key "app") (ne $key "istio") }}
|
||||||
|
{{ $key | quote }}: {{ $val | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "gateway.selectorLabels" -}}
|
||||||
|
app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
|
||||||
|
istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Keep sidecar injection labels together
|
||||||
|
https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
|
||||||
|
*/}}
|
||||||
|
{{- define "gateway.sidecarInjectionLabels" -}}
|
||||||
|
sidecar.istio.io/inject: "true"
|
||||||
|
{{- with .Values.revision }}
|
||||||
|
istio.io/rev: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "gateway.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- .Values.serviceAccount.name | default (include "gateway.name" .) }}
|
||||||
|
{{- else }}
|
||||||
|
{{- .Values.serviceAccount.name | default "default" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,115 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: {{ .Values.kind | default "Deployment" }}
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.name" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4}}
|
||||||
|
annotations:
|
||||||
|
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.autoscaling.enabled }}
|
||||||
|
{{- with .Values.replicaCount }}
|
||||||
|
replicas: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "gateway.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
|
||||||
|
{{- include "gateway.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/name: {{ include "gateway.name" . }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- range $key, $val := .Values.labels }}
|
||||||
|
{{- if and (ne $key "app") (ne $key "istio") }}
|
||||||
|
{{ $key | quote }}: {{ $val | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
securityContext:
|
||||||
|
{{- if .Values.securityContext }}
|
||||||
|
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||||
|
{{- else }}
|
||||||
|
# Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
|
||||||
|
sysctls:
|
||||||
|
- name: net.ipv4.ip_unprivileged_port_start
|
||||||
|
value: "0"
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.volumes }}
|
||||||
|
volumes:
|
||||||
|
{{ toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: istio-proxy
|
||||||
|
# "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
|
||||||
|
image: auto
|
||||||
|
{{- with .Values.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
securityContext:
|
||||||
|
{{- if .Values.containerSecurityContext }}
|
||||||
|
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
{{- if not (eq .Values.platform "openshift") }}
|
||||||
|
runAsUser: 1337
|
||||||
|
runAsGroup: 1337
|
||||||
|
{{- end }}
|
||||||
|
runAsNonRoot: true
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
{{- with .Values.networkGateway }}
|
||||||
|
- name: ISTIO_META_REQUESTED_NETWORK_VIEW
|
||||||
|
value: "{{.}}"
|
||||||
|
{{- end }}
|
||||||
|
{{- range $key, $val := .Values.env }}
|
||||||
|
- name: {{ $key }}
|
||||||
|
value: {{ $val | quote }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: 15090
|
||||||
|
protocol: TCP
|
||||||
|
name: http-envoy-prom
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
{{- with .Values.volumeMounts }}
|
||||||
|
volumeMounts:
|
||||||
|
{{ toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
|
||||||
|
{{- with .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
|
||||||
|
apiVersion: autoscaling/v2
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.name" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: {{ .Values.kind | default "Deployment" }}
|
||||||
|
name: {{ include "gateway.name" . }}
|
||||||
|
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
target:
|
||||||
|
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
type: Utilization
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: memory
|
||||||
|
target:
|
||||||
|
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
type: Utilization
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.autoscaling.autoscaleBehavior }}
|
||||||
|
behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
{{- if .Values.podDisruptionBudget }}
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.name" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4}}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "gateway.selectorLabels" . | nindent 6 }}
|
||||||
|
{{- with .Values.podDisruptionBudget }}
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
|
||||||
|
{{- if .Values.rbac.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4}}
|
||||||
|
annotations:
|
||||||
|
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "watch", "list"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4}}
|
||||||
|
annotations:
|
||||||
|
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,64 @@
|
||||||
|
{{- if not (eq .Values.service.type "None") }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.name" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.networkGateway }}
|
||||||
|
topology.istio.io/network: "{{.}}"
|
||||||
|
{{- end }}
|
||||||
|
annotations:
|
||||||
|
{{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.service.loadBalancerIP }}
|
||||||
|
loadBalancerIP: "{{ . }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||||
|
{{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
|
||||||
|
allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.ipFamilyPolicy }}
|
||||||
|
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.ipFamilies }}
|
||||||
|
ipFamilies:
|
||||||
|
{{- range .Values.service.ipFamilies }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||||
|
loadBalancerSourceRanges:
|
||||||
|
{{ toYaml . | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.service.externalTrafficPolicy }}
|
||||||
|
externalTrafficPolicy: "{{ . }}"
|
||||||
|
{{- end }}
|
||||||
|
type: {{ .Values.service.type }}
|
||||||
|
ports:
|
||||||
|
{{- if .Values.networkGateway }}
|
||||||
|
- name: status-port
|
||||||
|
port: 15021
|
||||||
|
targetPort: 15021
|
||||||
|
- name: tls
|
||||||
|
port: 15443
|
||||||
|
targetPort: 15443
|
||||||
|
- name: tls-istiod
|
||||||
|
port: 15012
|
||||||
|
targetPort: 15012
|
||||||
|
- name: tls-webhook
|
||||||
|
port: 15017
|
||||||
|
targetPort: 15017
|
||||||
|
{{- else }}
|
||||||
|
{{ .Values.service.ports | toYaml | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.externalIPs }}
|
||||||
|
externalIPs: {{- range .Values.service.externalIPs }}
|
||||||
|
- {{.}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
{{- include "gateway.selectorLabels" . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "gateway.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gateway.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
{{/*
|
||||||
|
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||||
|
The original version of this file is located at /manifests directory.
|
||||||
|
If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
Complex logic ahead...
|
||||||
|
We have three sets of values, in order of precedence (last wins):
|
||||||
|
1. The builtin values.yaml defaults
|
||||||
|
2. The profile the user selects
|
||||||
|
3. Users input (-f or --set)
|
||||||
|
|
||||||
|
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||||
|
|
||||||
|
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||||
|
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||||
|
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||||
|
*/}}
|
||||||
|
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||||
|
{{- $defaults := $.Values.defaults }}
|
||||||
|
{{- $_ := unset $.Values "defaults" }}
|
||||||
|
{{- $profile := dict }}
|
||||||
|
{{- with .Values.profile }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||||
|
{{- $profile = (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.compatibilityVersion }}
|
||||||
|
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||||
|
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||||
|
{{- else }}
|
||||||
|
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $profile }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||||
|
{{- end }}
|
||||||
|
# Flatten globals, if defined on a per-chart basis
|
||||||
|
{{- if false }}
|
||||||
|
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||||
|
|
@ -0,0 +1,301 @@
|
||||||
|
{
|
||||||
|
"$schema": "http://json-schema.org/schema#",
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"$defs": {
|
||||||
|
"values": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"global": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"affinity": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"securityContext": {
|
||||||
|
"type": [
|
||||||
|
"object",
|
||||||
|
"null"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"containerSecurityContext": {
|
||||||
|
"type": [
|
||||||
|
"object",
|
||||||
|
"null"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"kind": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": [
|
||||||
|
"Deployment",
|
||||||
|
"DaemonSet"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"annotations": {
|
||||||
|
"additionalProperties": {
|
||||||
|
"type": [
|
||||||
|
"string",
|
||||||
|
"integer"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"autoscaling": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"maxReplicas": {
|
||||||
|
"type": "integer"
|
||||||
|
},
|
||||||
|
"minReplicas": {
|
||||||
|
"type": "integer"
|
||||||
|
},
|
||||||
|
"targetCPUUtilizationPercentage": {
|
||||||
|
"type": "integer"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"env": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"labels": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"name": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"nodeSelector": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"podAnnotations": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"inject.istio.io/templates": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"prometheus.io/path": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"prometheus.io/port": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"prometheus.io/scrape": {
|
||||||
|
"type": "string"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"replicaCount": {
|
||||||
|
"type": [
|
||||||
|
"integer",
|
||||||
|
"null"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"resources": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"limits": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"cpu": {
|
||||||
|
"type": ["string", "null"]
|
||||||
|
},
|
||||||
|
"memory": {
|
||||||
|
"type": ["string", "null"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"requests": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"cpu": {
|
||||||
|
"type": ["string", "null"]
|
||||||
|
},
|
||||||
|
"memory": {
|
||||||
|
"type": ["string", "null"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"revision": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"compatibilityVersion": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"runAsRoot": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"unprivilegedPort": {
|
||||||
|
"type": [
|
||||||
|
"string",
|
||||||
|
"boolean"
|
||||||
|
],
|
||||||
|
"enum": [
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
"auto"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"service": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"annotations": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"externalTrafficPolicy": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"loadBalancerIP": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"loadBalancerSourceRanges": {
|
||||||
|
"type": "array"
|
||||||
|
},
|
||||||
|
"ipFamilies": {
|
||||||
|
"items": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": [
|
||||||
|
"IPv4",
|
||||||
|
"IPv6"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"ipFamilyPolicy": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": [
|
||||||
|
"",
|
||||||
|
"SingleStack",
|
||||||
|
"PreferDualStack",
|
||||||
|
"RequireDualStack"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"ports": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"name": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"port": {
|
||||||
|
"type": "integer"
|
||||||
|
},
|
||||||
|
"protocol": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"targetPort": {
|
||||||
|
"type": "integer"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"type": {
|
||||||
|
"type": "string"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"serviceAccount": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"annotations": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
|
"name": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"create": {
|
||||||
|
"type": "boolean"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"rbac": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"tolerations": {
|
||||||
|
"type": "array"
|
||||||
|
},
|
||||||
|
"topologySpreadConstraints": {
|
||||||
|
"type": "array"
|
||||||
|
},
|
||||||
|
"networkGateway": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"imagePullPolicy": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": [
|
||||||
|
"",
|
||||||
|
"Always",
|
||||||
|
"IfNotPresent",
|
||||||
|
"Never"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"imagePullSecrets": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"name": {
|
||||||
|
"type": "string"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"podDisruptionBudget": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"minAvailable": {
|
||||||
|
"type": [
|
||||||
|
"integer",
|
||||||
|
"string"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"maxUnavailable": {
|
||||||
|
"type": [
|
||||||
|
"integer",
|
||||||
|
"string"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unhealthyPodEvictionPolicy": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": [
|
||||||
|
"",
|
||||||
|
"IfHealthyBudget",
|
||||||
|
"AlwaysAllow"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"terminationGracePeriodSeconds": {
|
||||||
|
"type": "number"
|
||||||
|
},
|
||||||
|
"volumes": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"volumeMounts": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"priorityClassName": {
|
||||||
|
"type": "string"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"defaults": {
|
||||||
|
"$ref": "#/$defs/values"
|
||||||
|
},
|
||||||
|
"$ref": "#/$defs/values"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||||
|
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||||
|
defaults:
|
||||||
|
# Name allows overriding the release name. Generally this should not be set
|
||||||
|
name: ""
|
||||||
|
# revision declares which revision this gateway is a part of
|
||||||
|
revision: ""
|
||||||
|
|
||||||
|
# Controls the spec.replicas setting for the Gateway deployment if set.
|
||||||
|
# Otherwise defaults to Kubernetes Deployment default (1).
|
||||||
|
replicaCount:
|
||||||
|
|
||||||
|
kind: Deployment
|
||||||
|
|
||||||
|
rbac:
|
||||||
|
# If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
|
||||||
|
# when using http://gateway-api.org/.
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# If set, a service account will be created. Otherwise, the default is used
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set, the release name is used
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
podAnnotations:
|
||||||
|
prometheus.io/port: "15020"
|
||||||
|
prometheus.io/scrape: "true"
|
||||||
|
prometheus.io/path: "/stats/prometheus"
|
||||||
|
inject.istio.io/templates: "gateway"
|
||||||
|
sidecar.istio.io/inject: "true"
|
||||||
|
|
||||||
|
# Define the security context for the pod.
|
||||||
|
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
|
||||||
|
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
|
||||||
|
securityContext: {}
|
||||||
|
containerSecurityContext: {}
|
||||||
|
|
||||||
|
service:
|
||||||
|
# Type of service. Set to "None" to disable the service entirely
|
||||||
|
type: LoadBalancer
|
||||||
|
ports:
|
||||||
|
- name: status-port
|
||||||
|
port: 15021
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 15021
|
||||||
|
- name: http2
|
||||||
|
port: 80
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 80
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 443
|
||||||
|
annotations: {}
|
||||||
|
loadBalancerIP: ""
|
||||||
|
loadBalancerSourceRanges: []
|
||||||
|
externalTrafficPolicy: ""
|
||||||
|
externalIPs: []
|
||||||
|
ipFamilyPolicy: ""
|
||||||
|
ipFamilies: []
|
||||||
|
## Whether to automatically allocate NodePorts (only for LoadBalancers).
|
||||||
|
# allocateLoadBalancerNodePorts: false
|
||||||
|
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
limits:
|
||||||
|
cpu: 2000m
|
||||||
|
memory: 1024Mi
|
||||||
|
|
||||||
|
autoscaling:
|
||||||
|
enabled: true
|
||||||
|
minReplicas: 1
|
||||||
|
maxReplicas: 5
|
||||||
|
targetCPUUtilizationPercentage: 80
|
||||||
|
targetMemoryUtilizationPercentage: {}
|
||||||
|
autoscaleBehavior: {}
|
||||||
|
|
||||||
|
# Pod environment variables
|
||||||
|
env: {}
|
||||||
|
|
||||||
|
# Labels to apply to all resources
|
||||||
|
labels: {}
|
||||||
|
|
||||||
|
# Annotations to apply to all resources
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
nodeSelector: {}
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
# If specified, the gateway will act as a network gateway for the given network.
|
||||||
|
networkGateway: ""
|
||||||
|
|
||||||
|
# Specify image pull policy if default behavior isn't desired.
|
||||||
|
# Default behavior: latest images will be Always else IfNotPresent
|
||||||
|
imagePullPolicy: ""
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
# This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
|
||||||
|
#
|
||||||
|
# By default, the `podDisruptionBudget` is disabled (set to `{}`),
|
||||||
|
# which means that no PodDisruptionBudget resource will be created.
|
||||||
|
#
|
||||||
|
# To enable the PodDisruptionBudget, configure it by specifying the
|
||||||
|
# `minAvailable` or `maxUnavailable`. For example, to set the
|
||||||
|
# minimum number of available replicas to 1, you can update this value as follows:
|
||||||
|
#
|
||||||
|
# podDisruptionBudget:
|
||||||
|
# minAvailable: 1
|
||||||
|
#
|
||||||
|
# Or, to allow a maximum of 1 unavailable replica, you can set:
|
||||||
|
#
|
||||||
|
# podDisruptionBudget:
|
||||||
|
# maxUnavailable: 1
|
||||||
|
#
|
||||||
|
# You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
|
||||||
|
# For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
|
||||||
|
#
|
||||||
|
# podDisruptionBudget:
|
||||||
|
# minAvailable: 1
|
||||||
|
# unhealthyPodEvictionPolicy: AlwaysAllow
|
||||||
|
#
|
||||||
|
# To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
|
||||||
|
#
|
||||||
|
# podDisruptionBudget: {}
|
||||||
|
#
|
||||||
|
podDisruptionBudget: {}
|
||||||
|
|
||||||
|
terminationGracePeriodSeconds: 30
|
||||||
|
|
||||||
|
# A list of `Volumes` added into the Gateway Pods. See
|
||||||
|
# https://kubernetes.io/docs/concepts/storage/volumes/.
|
||||||
|
volumes: []
|
||||||
|
|
||||||
|
# A list of `VolumeMounts` added into the Gateway Pods. See
|
||||||
|
# https://kubernetes.io/docs/concepts/storage/volumes/.
|
||||||
|
volumeMounts: []
|
||||||
|
|
||||||
|
# Configure this to a higher priority class in order to make sure your Istio gateway pods
|
||||||
|
# will not be killed because of low priority class.
|
||||||
|
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||||
|
# for more detail.
|
||||||
|
priorityClassName: ""
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: 1.23.1
|
||||||
|
description: Helm chart for deploying Istio gateways
|
||||||
|
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||||
|
keywords:
|
||||||
|
- istio
|
||||||
|
- egressgateway
|
||||||
|
- gateways
|
||||||
|
name: istio-egress
|
||||||
|
sources:
|
||||||
|
- https://github.com/istio/istio
|
||||||
|
version: 1.23.1
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
|
||||||
|
Changes:
|
||||||
|
- separate namespace allows:
|
||||||
|
-- easier reconfig of just the gateway
|
||||||
|
-- TLS secrets and domain name management is isolated, for better security
|
||||||
|
-- simplified configuration
|
||||||
|
-- multiple versions of the ingress can be used, to minize upgrade risks
|
||||||
|
|
||||||
|
- the new chart uses the default namespace service account, and doesn't require
|
||||||
|
additional RBAC permissions.
|
||||||
|
|
||||||
|
- simplified label structure. Label change is not supported on upgrade.
|
||||||
|
|
||||||
|
- for 'internal load balancer' you should deploy a separate gateway, in a different
|
||||||
|
namespace.
|
||||||
|
|
||||||
|
All ingress gateway have a "app:ingressgateway" label, used to identify it as an
|
||||||
|
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.
|
||||||
|
|
||||||
|
The Gateways use "istio: ingressgateway$SUFFIX" selectors.
|
||||||
|
|
||||||
|
|
||||||
|
# Multiple gateway versions
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Using different pilot versions
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Migration from istio-system
|
||||||
|
|
||||||
|
Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
|
||||||
|
with the Service and bound to the namespace, it is recommended to:
|
||||||
|
|
||||||
|
1. Install the new gateway in a new namespace.
|
||||||
|
2. Copy any TLS certificate to the new namespace, and configure the domains.
|
||||||
|
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
|
||||||
|
4. Modify the DNS server to add the A record of the new namespace
|
||||||
|
5. Check traffic
|
||||||
|
6. Delete the A record corresponding to the gateway in istio-system
|
||||||
|
7. Upgrade istio-system, disabling the ingressgateway
|
||||||
|
8. Delete the domain TLS certs from istio-system.
|
||||||
|
|
||||||
|
If using certmanager, all Certificate and associated configs must be moved as well.
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||||
|
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||||
|
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||||
|
|
||||||
|
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||||
|
meshConfig:
|
||||||
|
defaultConfig:
|
||||||
|
proxyMetadata:
|
||||||
|
ISTIO_META_ENABLE_HBONE: "true"
|
||||||
|
global:
|
||||||
|
variant: distroless
|
||||||
|
pilot:
|
||||||
|
env:
|
||||||
|
PILOT_ENABLE_AMBIENT: "true"
|
||||||
|
cni:
|
||||||
|
ambient:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||||
|
variant: distroless
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue