ingress, istio, promehteus init
This commit is contained in:
root
parent
bac2466df4
commit
88587dc8a1
|
|
@ -0,0 +1,28 @@
|
|||
# This section includes base Calico installation configuration.
|
||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
|
||||
apiVersion: operator.tigera.io/v1
|
||||
kind: Installation
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
# Configures Calico networking.
|
||||
calicoNetwork:
|
||||
ipPools:
|
||||
- name: default-ipv4-ippool
|
||||
blockSize: 26
|
||||
cidr: 10.1.0.0/16
|
||||
encapsulation: VXLANCrossSubnet
|
||||
natOutgoing: Enabled
|
||||
nodeSelector: all()
|
||||
registry: reg.inje-private.com
|
||||
|
||||
---
|
||||
|
||||
# This section configures the Calico API server.
|
||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
|
||||
apiVersion: operator.tigera.io/v1
|
||||
kind: APIServer
|
||||
metadata:
|
||||
name: default
|
||||
spec: {}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,663 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
name: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
allow-snippet-annotations: "false"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
nodePort: 30100 # by.sdjo
|
||||
- appProtocol: https
|
||||
name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
nodePort: 30101 # by.sdjo
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: NodePort
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: https
|
||||
name: https-webhook
|
||||
port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
minReadySeconds: 0
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- /nginx-ingress-controller
|
||||
- --election-id=ingress-nginx-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --ingress-class=nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
- --enable-metrics=false
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: controller
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: 300
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
import os
|
||||
import time
|
||||
|
||||
img_list = [
|
||||
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
|
||||
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
|
||||
]
|
||||
|
||||
public_registry_list = [
|
||||
"registry.k8s.io",
|
||||
|
||||
]
|
||||
|
||||
registry_path = "reg.inje-private.com"
|
||||
|
||||
harbor_project_name = "nnd002"
|
||||
|
||||
for var in img_list:
|
||||
os.system(f"docker pull {var}")
|
||||
for foo in public_registry_list:
|
||||
if var.startswith(foo):
|
||||
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
|
||||
break
|
||||
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||
# else: ljh 수정
|
||||
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||
time.sleep(1)
|
||||
# os.system(f"echo {private_img_path}")
|
||||
os.system(f"docker tag {var} {private_img_path}")
|
||||
os.system(f"docker push {private_img_path}")
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# Source: prometheus/templates/pvc.yaml
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: prometheus
|
||||
app.kubernetes.io/instance: prometheus
|
||||
app.kubernetes.io/version: v2.54.1
|
||||
helm.sh/chart: prometheus-25.27.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/part-of: prometheus
|
||||
name: prometheus-server
|
||||
namespace: monitoring
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
# storageClassName: sc-monitoring
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -0,0 +1 @@
|
|||
admin:$apr1$hrZESu7L$dp3Bc9wcEbfdIVhaP1MHN0
|
||||
|
|
@ -15,6 +15,7 @@ metadata:
|
|||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
# storageClassName: sc-monitoring
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: sc-monitoring # pvc에서 사용할 SC Name
|
||||
annotations:
|
||||
storageclass.kubernetes.io/is-default-class: "true"
|
||||
labels:
|
||||
name: provision
|
||||
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner # provisioner에서 생성한 PROVISIONER_NAME
|
||||
parameters:
|
||||
# server: 172.17.128.249
|
||||
# share: /nfs/monitoring
|
||||
# pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
|
||||
onDelete: Retain
|
||||
#onDelete: delete
|
||||
archiveOnDelete: "false"
|
||||
reclaimPolicy: Retain
|
||||
volumeBindingMode: Immediate
|
||||
|
|
@ -0,0 +1 @@
|
|||
admin:$apr1$hrZESu7L$dp3Bc9wcEbfdIVhaP1MHN0
|
||||
|
|
@ -44,7 +44,7 @@ spec:
|
|||
serviceAccountName: prometheus-prometheus-node-exporter
|
||||
containers:
|
||||
- name: node-exporter
|
||||
image: quay.io/prometheus/node-exporter:v1.8.2
|
||||
image: reg.inje-private.com/nnd002/prometheus/node-exporter:v1.8.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --path.procfs=/host/proc
|
||||
|
|
@ -48,7 +48,7 @@ spec:
|
|||
- --port=8080
|
||||
- --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
|
||||
image: reg.inje-private.com/nnd002/kube-state-metrics/kube-state-metrics:v2.13.0
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: "http"
|
||||
|
|
@ -116,7 +116,7 @@ spec:
|
|||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: pushgateway
|
||||
image: "quay.io/prometheus/pushgateway:v1.9.0"
|
||||
image: "reg.inje-private.com/nnd002/prometheus/pushgateway:v1.9.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: metrics
|
||||
|
|
@ -186,7 +186,7 @@ spec:
|
|||
serviceAccountName: prometheus-server
|
||||
containers:
|
||||
- name: prometheus-server-configmap-reload
|
||||
image: "quay.io/prometheus-operator/prometheus-config-reloader:v0.76.0"
|
||||
image: "reg.inje-private.com/nnd002/prometheus-operator/prometheus-config-reloader:v0.76.0"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
args:
|
||||
- --watched-dir=/etc/config
|
||||
|
|
@ -216,7 +216,7 @@ spec:
|
|||
mountPath: /etc/config/alerts
|
||||
readOnly: true
|
||||
- name: prometheus-server
|
||||
image: "quay.io/prometheus/prometheus:v2.54.1"
|
||||
image: "reg.inje-private.com/nnd002/prometheus/prometheus:v2.54.1"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
args:
|
||||
- --storage.tsdb.retention.time=15d
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: vm-nfs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
name: provision
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: vm-nfs
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: vm-nfs
|
||||
spec:
|
||||
serviceAccountName: nfs-pod-provisioner-sa
|
||||
containers:
|
||||
- name: nfs-client-provisioner
|
||||
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
||||
volumeMounts:
|
||||
- name: nfs-provisioner
|
||||
mountPath: persistentvolumes
|
||||
env:
|
||||
- name: PROVISIONER_NAME
|
||||
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
||||
- name: NFS_SERVER
|
||||
value: 172.17.128.249 # 주소변경
|
||||
- name: NFS_PATH
|
||||
value: /nfs/monitoring # nfs 연결 주소
|
||||
volumes:
|
||||
- name: nfs-provisioner
|
||||
nfs:
|
||||
server: 172.17.128.249
|
||||
path: /nfs/monitoring
|
||||
|
|
@ -20,19 +20,19 @@ spec:
|
|||
serviceAccountName: nfs-pod-provisioner-sa
|
||||
containers:
|
||||
- name: nfs-client-provisioner
|
||||
image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
||||
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
||||
volumeMounts:
|
||||
- name: nfs-provisioner
|
||||
mountPath: /persistentvolumes
|
||||
env:
|
||||
- name: PROVISIONER_NAME
|
||||
value: vm-nfs # SC에서 provisioner의 이름으로 사용
|
||||
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
||||
- name: NFS_SERVER
|
||||
value: 192.168.0.211
|
||||
value: 172.17.128.249 # 주소변경
|
||||
- name: NFS_PATH
|
||||
value: /nfs # nfs 연결 주소
|
||||
value: /nfs/monitoring # nfs 연결 주소
|
||||
volumes:
|
||||
- name: nfs-provisioner
|
||||
nfs:
|
||||
server: 192.168.0.211
|
||||
path: /nfs
|
||||
server: 172.17.128.249
|
||||
path: /nfs/monitoring
|
||||
|
|
|
|||
|
|
@ -0,0 +1,202 @@
|
|||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
# Istio
|
||||
|
||||
[](https://bestpractices.coreinfrastructure.org/projects/1395)
|
||||
[](https://goreportcard.com/report/github.com/istio/istio)
|
||||
[](https://godoc.org/istio.io/istio)
|
||||
|
||||
<a href="https://istio.io/">
|
||||
<img src="https://github.com/istio/istio/raw/master/logo/istio-bluelogo-whitebackground-unframed.svg"
|
||||
alt="Istio logo" title="Istio" height="100" width="100" />
|
||||
</a>
|
||||
|
||||
---
|
||||
|
||||
Istio is an open source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio is the path to load balancing, service-to-service authentication, and monitoring – with few or no service code changes.
|
||||
|
||||
- For in-depth information about how to use Istio, visit [istio.io](https://istio.io)
|
||||
- To ask questions and get assistance from our community, visit [Github Discussions](https://github.com/istio/istio/discussions)
|
||||
- To learn how to participate in our overall community, visit [our community page](https://istio.io/about/community)
|
||||
|
||||
In this README:
|
||||
|
||||
- [Introduction](#introduction)
|
||||
- [Repositories](#repositories)
|
||||
- [Issue management](#issue-management)
|
||||
|
||||
In addition, here are some other documents you may wish to read:
|
||||
|
||||
- [Istio Community](https://github.com/istio/community#istio-community) - describes how to get involved and contribute to the Istio project
|
||||
- [Istio Developer's Guide](https://github.com/istio/istio/wiki/Preparing-for-Development) - explains how to set up and use an Istio development environment
|
||||
- [Project Conventions](https://github.com/istio/istio/wiki/Development-Conventions) - describes the conventions we use within the code base
|
||||
- [Creating Fast and Lean Code](https://github.com/istio/istio/wiki/Writing-Fast-and-Lean-Code) - performance-oriented advice and guidelines for the code base
|
||||
|
||||
You'll find many other useful documents on our [Wiki](https://github.com/istio/istio/wiki).
|
||||
|
||||
## Introduction
|
||||
|
||||
[Istio](https://istio.io/latest/docs/concepts/what-is-istio/) is an open platform for providing a uniform way to [integrate
|
||||
microservices](https://istio.io/latest/docs/examples/microservices-istio/), manage [traffic flow](https://istio.io/latest/docs/concepts/traffic-management/) across microservices, enforce policies
|
||||
and aggregate telemetry data. Istio's control plane provides an abstraction
|
||||
layer over the underlying cluster management platform, such as Kubernetes.
|
||||
|
||||
Istio is composed of these components:
|
||||
|
||||
- **Envoy** - Sidecar proxies per microservice to handle ingress/egress traffic
|
||||
between services in the cluster and from a service to external
|
||||
services. The proxies form a _secure microservice mesh_ providing a rich
|
||||
set of functions like discovery, rich layer-7 routing, circuit breakers,
|
||||
policy enforcement and telemetry recording/reporting
|
||||
functions.
|
||||
|
||||
> Note: The service mesh is not an overlay network. It
|
||||
> simplifies and enhances how microservices in an application talk to each
|
||||
> other over the network provided by the underlying platform.
|
||||
|
||||
- **Istiod** - The Istio control plane. It provides service discovery, configuration and certificate management. It consists of the following sub-components:
|
||||
|
||||
- **Pilot** - Responsible for configuring the proxies at runtime.
|
||||
|
||||
- **Citadel** - Responsible for certificate issuance and rotation.
|
||||
|
||||
- **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.
|
||||
|
||||
- **Operator** - The component provides user friendly options to operate the Istio service mesh.
|
||||
|
||||
## Repositories
|
||||
|
||||
The Istio project is divided across a few GitHub repositories:
|
||||
|
||||
- [istio/api](https://github.com/istio/api). This repository defines
|
||||
component-level APIs and common configuration formats for the Istio platform.
|
||||
|
||||
- [istio/community](https://github.com/istio/community). This repository contains
|
||||
information on the Istio community, including the various documents that govern
|
||||
the Istio open source project.
|
||||
|
||||
- [istio/istio](README.md). This is the main code repository. It hosts Istio's
|
||||
core components, install artifacts, and sample programs. It includes:
|
||||
|
||||
- [istioctl](istioctl/). This directory contains code for the
|
||||
[_istioctl_](https://istio.io/latest/docs/reference/commands/istioctl/) command line utility.
|
||||
|
||||
- [operator](operator/). This directory contains code for the
|
||||
[Istio Operator](https://istio.io/latest/docs/setup/install/operator/).
|
||||
|
||||
- [pilot](pilot/). This directory
|
||||
contains platform-specific code to populate the
|
||||
[abstract service model](https://istio.io/docs/concepts/traffic-management/#pilot), dynamically reconfigure the proxies
|
||||
when the application topology changes, as well as translate
|
||||
[routing rules](https://istio.io/latest/docs/reference/config/networking/) into proxy specific configuration.
|
||||
|
||||
- [security](security/). This directory contains [security](https://istio.io/latest/docs/concepts/security/) related code,
|
||||
including Citadel (acting as Certificate Authority), citadel agent, etc.
|
||||
|
||||
- [istio/proxy](https://github.com/istio/proxy). The Istio proxy contains
|
||||
extensions to the [Envoy proxy](https://github.com/envoyproxy/envoy) (in the form of
|
||||
Envoy filters) that support authentication, authorization, and telemetry collection.
|
||||
|
||||
- [istio/ztunnel](https://github.com/istio/ztunnel). The repository contains the Rust implementation of the ztunnel
|
||||
component of Ambient mesh.
|
||||
|
||||
## Issue management
|
||||
|
||||
We use GitHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:
|
||||
|
||||
- **Epic**. An epic represents a feature area for Istio as a whole. Epics are fairly broad in scope and are basically product-level things.
|
||||
Each issue is ultimately part of an epic.
|
||||
|
||||
- **Milestone**. Each issue is assigned a milestone. This is 0.1, 0.2, ..., or 'Nebulous Future'. The milestone indicates when we
|
||||
think the issue should get addressed.
|
||||
|
||||
- **Priority**. Each issue has a priority which is represented by the column in the [Prioritization](https://github.com/orgs/istio/projects/6) project. Priority can be one of
|
||||
P0, P1, P2, or >P2. The priority indicates how important it is to address the issue within the milestone. P0 says that the
|
||||
milestone cannot be considered achieved if the issue isn't resolved.
|
||||
|
||||
---
|
||||
|
||||
<div align="center">
|
||||
<img src="https://raw.githubusercontent.com/cncf/artwork/master/other/cncf/horizontal/color/cncf-color.svg" width="300" alt="Cloud Native Computing Foundation logo"/>
|
||||
<p>Istio is a <a href="https://cncf.io">Cloud Native Computing Foundation</a> project.</p>
|
||||
</div>
|
||||
Binary file not shown.
|
|
@ -0,0 +1,108 @@
|
|||
### download
|
||||
```bash
|
||||
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.23.1 TARGET_ARCH=x86_64 sh -
|
||||
```
|
||||
|
||||
### set istioctl
|
||||
```bash
|
||||
cd ~/istio-1.23.1/bin
|
||||
```
|
||||
```bash
|
||||
chmod +x istioctl
|
||||
```
|
||||
```bash
|
||||
ln istioctl /usr/bin/istioctl
|
||||
```
|
||||
|
||||
### install
|
||||
|
||||
```bash
|
||||
istioctl install --manifests=manifests/
|
||||
```
|
||||
Istioctl은 istio 설치를 위해 manifests/ 디렉토리 내에서 기본적으로 필요한 파일과 폴더들을 참조합니다.
|
||||
|
||||
기본적으로 참조되는 폴더와 파일
|
||||
| 구성요소 | 내용 |
|
||||
| --- | --- |
|
||||
| base | Istio의 기본 리소스 및 CRD 배포, 네임스페이스, 서비스 계정, 클러스터 역할, 클러스터 역할 바인딩 등|
|
||||
| istio-control | Istio의 컨트롤 플레인(예: istiod) 설치에 사용됩니다. |
|
||||
|gateways| Ingress 및 Egress Gateway 설치에 필요하며, 서비스 타입 변경(예: NodePort) 등의 설정을 관리. |
|
||||
| default |
|
||||
|
||||
default/ 폴더는 default 프로필을 사용하는 기본 설치 구성을 포함하고 있습니다. Istio 설치 시 이 폴더의 파일들이 기본적으로 참조되며, 다양한 설치 옵션이 포함된 프로필 파일이 여기에서 사용됩니다.
|
||||
참조 이유: Istio를 설치할 때 default 프로필의 기본 설정을 참조하며, 사용자 정의 구성이 없다면 이 프로필을 따릅니다.
|
||||
istio-operator/
|
||||
|
||||
istio-operator/ 폴더는 IstioOperator 리소스 및 설정을 정의하는 매니페스트가 포함되어 있습니다. 이 파일들은 Istio 설치를 제어하고, 다양한 구성 요소의 활성화/비활성화를 관리하는 데 사용됩니다.
|
||||
참조 이유: IstioOperator 리소스를 통해 Istio 설치의 구체적인 설정과 구성을 관리합니다.
|
||||
istio-cni/ (옵션)
|
||||
|
||||
istio-cni/는 Istio의 CNI(Container Network Interface)를 설정하기 위한 매니페스트 파일을 포함하고 있습니다. Istio CNI는 사이드카 프록시 주입을 지원하며, Kubernetes 네트워크 플러그인과 통합됩니다.
|
||||
참조 이유: CNI 기반 설치를 활성화할 경우 사용됩니다.
|
||||
ztunnel/ (옵션)
|
||||
|
||||
ztunnel/은 Istio의 Zero Trust 기반 네트워크 보안을 지원하는 구성 요소와 관련된 파일이 포함되어 있습니다. 보안 네트워크 통신과 관련된 설정을 정의합니다.
|
||||
참조 이유: Zero Trust 보안 설치를 사용하는 경우 참조됩니다.
|
||||
추가 파일들
|
||||
README.md
|
||||
|
||||
Istio 차트에 대한 간단한 설명이 포함된 파일입니다. Istio의 구성 요소와 설치 방법에 대한 정보를 제공합니다.
|
||||
참조 이유: 설치 중 직접 참조되지는 않지만, 사용자에게 정보를 제공합니다.
|
||||
UPDATING-CHARTS.md
|
||||
|
||||
차트 업데이트와 관련된 정보가 포함된 문서입니다. Istio 차트를 어떻게 업데이트할 수 있는지에 대한 가이드를 제공합니다.
|
||||
참조 이유: 설치 중 직접 참조되지는 않지만, Helm 차트 관리 및 업데이트에 대한 정보를 제공합니다.
|
||||
install-OpenShift.md
|
||||
|
||||
OpenShift에 Istio를 설치할 때 참고할 수 있는 문서입니다. OpenShift에 맞춘 설치 관련 정보가 포함되어 있습니다.
|
||||
참조 이유: OpenShift 설치 시에만 유용하며, 일반적인 Kubernetes 설치에서는 참조되지 않습니다.
|
||||
기본적으로 참조되는 주요 구성 요소
|
||||
CRD: Istio의 모든 설치에서 사용되는 주요 Custom Resource Definitions.
|
||||
istiod: Istio 컨트롤 플레인의 핵심 컴포넌트.
|
||||
Ingress Gateway: Istio Ingress Gateway 설치 파일.
|
||||
IstioOperator: 설치 설정을 조정하는 파일.
|
||||
결론
|
||||
istioctl install --manifests=manifests/ 명령어는 기본적으로 base/, istio-control/, gateways/, default/, istio-operator/ 폴더의 파일들을 참조합니다. 이들 폴더는 Istio의 핵심 구성 요소인 CRD, istiod, 게이트웨이 설정 등을 관리하며, 기본적인 Istio 설치에 필요한 리소스들을 제공합니다.
|
||||
|
||||
|
||||
|
||||
|
||||
나의 말:
|
||||
gateway 폴더와 gateways 폴더의 차이는?
|
||||
ChatGPT의 말:
|
||||
ChatGPT
|
||||
gateway 폴더와 gateways 폴더는 Istio 설치 시 각각 다른 목적을 가진 폴더로, 중요한 차이가 있습니다. 이 두 폴더는 Istio의 게이트웨이(Gateway) 구성과 관련이 있지만, 다루는 범위와 역할이 다릅니다.
|
||||
|
||||
1. gateway/ 폴더
|
||||
목적: Istio의 개별적인 Gateway 구성과 관련된 설정이 포함됩니다. 주로 istio-ingressgateway 또는 istio-egressgateway와 같은 구체적인 게이트웨이 인스턴스를 정의하고, 설치할 때 필요한 매니페스트가 여기에 저장됩니다.
|
||||
내용: Istio에서 Ingress 또는 Egress Gateway를 정의하는 Kubernetes 리소스의 매니페스트가 있을 수 있습니다. 이 폴더는 특정 게이트웨이 인스턴스와 관련된 세부 설정을 포함하는 경우가 많습니다.
|
||||
예시 파일:
|
||||
ingress-gateway.yaml
|
||||
egress-gateway.yaml
|
||||
역할:
|
||||
|
||||
개별 Ingress Gateway와 Egress Gateway를 정의하는 파일을 포함.
|
||||
특정 Gateway 리소스를 Kubernetes 클러스터에 설치할 때 참조됩니다.
|
||||
Ingress Gateway와 Egress Gateway의 서비스 설정(예: NodePort, ClusterIP) 등을 제어할 수 있습니다.
|
||||
2. gateways/ 폴더
|
||||
목적: Istio의 게이트웨이 관련 전반적인 설정이 포함되어 있습니다. 여기에는 Ingress 및 Egress Gateway를 위한 공통적인 설정, 또는 여러 게이트웨이를 관리하는 설정들이 포함됩니다.
|
||||
내용: 여러 게이트웨이와 관련된 설정이나 매니페스트 파일이 들어 있을 수 있으며, 설치할 때 다양한 게이트웨이 구성 요소를 설정하는 데 사용됩니다.
|
||||
예시 파일:
|
||||
ingress.yaml
|
||||
egress.yaml
|
||||
역할:
|
||||
|
||||
Istio에서 게이트웨이와 관련된 전반적인 리소스들을 정의.
|
||||
다양한 게이트웨이 설정 파일을 포함하여 전체 게이트웨이 설치 및 관리에 사용.
|
||||
여러 게이트웨이 인스턴스 간의 공통 설정을 관리하는데 도움을 줍니다.
|
||||
주요 차이점 요약
|
||||
항목 gateway/ 폴더 gateways/ 폴더
|
||||
목적 개별 Gateway 인스턴스(Ingress, Egress 등)를 정의 게이트웨이 관련 전반적인 설정 및 리소스들을 관리
|
||||
내용 특정 Ingress/Egress Gateway의 설정 파일 다양한 게이트웨이와 관련된 매니페스트 및 설정 파일
|
||||
사용 예 istio-ingressgateway 또는 istio-egressgateway 설정 게이트웨이 설치 및 여러 게이트웨이 구성 요소를 관리
|
||||
설정 범위 개별 Gateway 리소스에 대한 세부 설정 게이트웨이 전반에 걸친 공통 설정을 포함
|
||||
결론
|
||||
gateway/ 폴더: 특정 Gateway 인스턴스(예: istio-ingressgateway 또는 istio-egressgateway)의 설정 파일들이 포함되어, 개별 게이트웨이를 정의하고 관리하는 데 사용됩니다.
|
||||
gateways/ 폴더: Istio의 게이트웨이와 관련된 전반적인 설정 파일들을 포함하고 있으며, 여러 게이트웨이 리소스에 공통된 설정을 관리하거나, 다양한 게이트웨이 설치 파일들을 포함할 수 있습니다.
|
||||
따라서, **gateway/**는 개별 게이트웨이에 집중하고, **gateways/**는 게이트웨이 관련 설정을 광범위하게 관리하는 역할을 합니다.
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
architectures:
|
||||
- linux/amd64
|
||||
- linux/arm64
|
||||
dashboards:
|
||||
istio-extension-dashboard: 13277
|
||||
istio-mesh-dashboard: 7639
|
||||
istio-performance-dashboard: 11829
|
||||
istio-service-dashboard: 7636
|
||||
istio-workload-dashboard: 7630
|
||||
pilot-dashboard: 7645
|
||||
ztunnel-dashboard: 0
|
||||
dependencies:
|
||||
api:
|
||||
goversionenabled: true
|
||||
sha: 978ac3b543c0bb4c27bfd1ed3bec42128159118f
|
||||
client-go:
|
||||
goversionenabled: true
|
||||
sha: 42f73330498cb7ec2bb222f83207a7bf05d16d29
|
||||
envoy:
|
||||
sha: 43f5f370dfa3805242e8a48997f99d24c46c68fa
|
||||
istio:
|
||||
sha: 64cfafb98498c62fa35e981b95cb5c7a36678af8
|
||||
proxy:
|
||||
sha: 9da6ab5663bca846996adcb4414dc6bf7bf0d3eb
|
||||
release-builder:
|
||||
sha: f01976c12ca64a1d12437350200fe7c552ac9c72
|
||||
test-infra:
|
||||
sha: 8785582b9a015250a260495ab97fe96930c95bb8
|
||||
tools:
|
||||
sha: 22bc85faf18d262409ec3210405e8e90f8ec5052
|
||||
ztunnel:
|
||||
sha: 245ecc111ba1cbe9bd2923f24be609e656a191ad
|
||||
docker: docker.io/istio
|
||||
dockerOutput: tar
|
||||
skipGenerateBillOfMaterials: false
|
||||
version: 1.23.1
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
# Istio Installer
|
||||
|
||||
Note: If making any changes to the charts or values.yaml in this dir, first read [UPDATING-CHARTS.md](UPDATING-CHARTS.md)
|
||||
|
||||
Istio installer is a modular, 'a-la-carte' installer for Istio. It is based on a
|
||||
fork of the Istio helm templates, refactored to increase modularity and isolation.
|
||||
|
||||
Goals:
|
||||
- Improve upgrade experience: users should be able to gradually roll upgrades, with proper
|
||||
canary deployments for Istio components. It should be possible to deploy a new version while keeping the
|
||||
stable version in place and gradually migrate apps to the new version.
|
||||
|
||||
- More flexibility: the new installer allows multiple 'environments', allowing applications to select
|
||||
a set of control plane settings and components. While the entire mesh respects the same APIs and config,
|
||||
apps may target different 'environments' which contain different instances and variants of Istio.
|
||||
|
||||
- Better security: separate Istio components reside in different namespaces, allowing different teams or
|
||||
roles to manage different parts of Istio. For example, a security team would maintain the
|
||||
root CA and policy, a telemetry team may only have access to Prometheus,
|
||||
and a different team may maintain the control plane components (which are highly security sensitive).
|
||||
|
||||
The install is organized in 'environments' - each environment consists of a set of components
|
||||
in different namespaces that are configured to work together. Regardless of 'environment',
|
||||
workloads can talk with each other and obey the Istio configuration resources, but each environment
|
||||
can use different Istio versions and different configuration defaults.
|
||||
|
||||
`istioctl kube-inject` or the automatic sidecar injector are used to select the environment.
|
||||
In the case of the sidecar injector, the namespace label `istio-env: <NAME_OF_ENV>` is used instead
|
||||
of the conventional `istio-injected: true`. The name of the environment is defined as the namespace
|
||||
where the corresponding control plane components (config, discovery, auto-injection) are running.
|
||||
In the examples below, by default this is the `istio-control` namespace. Pod annotations can also
|
||||
be used to select a different 'environment'.
|
||||
|
||||
## Installing
|
||||
|
||||
The new installer is intended to be modular and very explicit about what is installed. It has
|
||||
far more steps than the Istio installer - but each step is smaller and focused on a specific
|
||||
feature, and can be performed by different people/teams at different times.
|
||||
|
||||
It is strongly recommended that different namespaces are used, with different service accounts.
|
||||
In particular access to the security-critical production components (root CA, policy, control)
|
||||
should be locked down and restricted. The new installer allows multiple instances of
|
||||
policy/control/telemetry - so testing/staging of new settings and versions can be performed
|
||||
by a different role than the prod version.
|
||||
|
||||
The intended users of this repo are users running Istio in production who want to select, tune
|
||||
and understand each binary that gets deployed, and select which combination to use.
|
||||
|
||||
Note: each component can be installed in parallel with an existing Istio 1.0 or 1.1 installation in
|
||||
`istio-system`. The new components will not interfere with existing apps, but can interoperate,
|
||||
and it is possible to gradually move apps from Istio 1.0/1.1 to the new environments and
|
||||
across environments ( for example canary -> prod )
|
||||
|
||||
Note: there are still some cluster roles that may need to be fixed, most likely cluster permissions
|
||||
will need to move to the security component.
|
||||
|
||||
## Everything is Optional
|
||||
|
||||
Each component in the new installer is optional. Users can install the component defined in the new installer,
|
||||
use the equivalent component in `istio-system`, configured with the official installer, or use a different
|
||||
version or implementation.
|
||||
|
||||
For example, you may use your own Prometheus and Grafana installs, or you may use a specialized/custom
|
||||
certificate provisioning tool, or use components that are centrally managed and running in a different cluster.
|
||||
|
||||
This is a work in progress - building on top of the multi-cluster installer.
|
||||
|
||||
As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component
|
||||
in that cluster. Currently, the minimum we require is the security provider (node agent or citadel).
|
||||
|
||||
### Install Istio CRDs
|
||||
|
||||
This is the first step of the installation. Please do not remove or edit any CRD - config currently requires
|
||||
all CRDs to be present. On each upgrade it is recommended to reapply the file, to make sure
|
||||
you get all CRDs. CRDs are separated by release and by component type in the CRD directory.
|
||||
|
||||
Istio has strong integration with certmanager. Some operators may want to keep their current certmanager
|
||||
CRDs in place and not have Istio modify them. In this case, it is necessary to apply CRD files individually.
|
||||
|
||||
```bash
|
||||
kubectl apply -k github.com/istio/installer/base
|
||||
```
|
||||
|
||||
or
|
||||
|
||||
```bash
|
||||
kubectl apply -f base/files
|
||||
```
|
||||
|
||||
### Install Istio-CNI
|
||||
|
||||
This is an optional step - CNI must run in a dedicated namespace, it is a 'singleton' and extremely
|
||||
security sensitive. Access to the CNI namespace must be highly restricted.
|
||||
|
||||
**NOTE:** The environment variable `ISTIO_CLUSTER_ISGKE` is assumed to be set to `true` if the cluster
|
||||
is a GKE cluster.
|
||||
|
||||
```bash
|
||||
ISTIO_CNI_ARGS=
|
||||
# TODO: What k8s data can we use for this check for whether GKE?
|
||||
if [[ "${ISTIO_CLUSTER_ISGKE}" == "true" ]]; then
|
||||
ISTIO_CNI_ARGS="--set cni.cniBinDir=/home/kubernetes/bin"
|
||||
fi
|
||||
iop kube-system istio-cni $IBASE/istio-cni/ ${ISTIO_CNI_ARGS}
|
||||
```
|
||||
|
||||
TODO. It is possible to add Istio-CNI later, and gradually migrate.
|
||||
|
||||
### Install Control plane
|
||||
|
||||
This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
|
||||
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.
|
||||
|
||||
```bash
|
||||
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
|
||||
--set global.istioNamespace=istio-system
|
||||
|
||||
# Second istio-discovery, using master version of istio
|
||||
TAG=latest HUB=gcr.io/istio-testing iop istio-master istio-discovery-master $IBASE/istio-control/istio-discovery \
|
||||
--set policy.enable=false \
|
||||
--set global.istioNamespace=istio-master
|
||||
```
|
||||
|
||||
### Gateways
|
||||
|
||||
A cluster may use multiple Gateways, each with a different load balancer IP, domains and certificates.
|
||||
|
||||
Since the domain certificates are stored in the gateway namespace, it is recommended to keep each
|
||||
gateway in a dedicated namespace and restrict access.
|
||||
|
||||
For large-scale gateways it is optionally possible to use a dedicated pilot in the gateway namespace.
|
||||
|
||||
### Additional test templates
|
||||
|
||||
A number of helm test setups are general-purpose and should be installable in any cluster, to confirm
|
||||
Istio works properly and allow testing the specific installation.
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# Updating charts and values.yaml
|
||||
|
||||
## Acceptable Pull Requests
|
||||
|
||||
Helm charts `values.yaml` represent a complex user facing API that tends to grow uncontrollably over time
|
||||
due to design choices in Helm.
|
||||
The underlying Kubernetes resources we configure have 1000s of fields; given enough users and bespoke use cases,
|
||||
eventually someone will want to customize every one of those fields.
|
||||
If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly.
|
||||
|
||||
To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.
|
||||
|
||||
If the change is a dynamic runtime configuration, it probably belongs in the [MeshConfig API](https://github.com/istio/api/blob/master/mesh/v1alpha1/config.proto).
|
||||
This allows configuration without re-installing or restarting deployments.
|
||||
|
||||
If the change is to a Kubernetes field (such as modifying a Deployment attribute), it will likely need to be install-time configuration.
|
||||
However, that doesn't necessarily mean a PR to add a value will be accepted.
|
||||
The `values.yaml` API is intended to maintain a *minimal core set of configuration* that most users will use.
|
||||
For bespoke use cases, [Helm Chart Customization](https://istio.io/latest/docs/setup/additional-setup/customize-installation-helm/#advanced-helm-chart-customization) can be used
|
||||
to allow arbitrary customizations.
|
||||
|
||||
If the change truly is generally purpose, it is generally preferred to have broader APIs. For example, instead of providing
|
||||
direct access to each of the complex fields in [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/), just providing
|
||||
a single `affinity` field that is passed through as-is to the Kubernetes resource.
|
||||
This provides maximum flexibility with minimal API surface overhead.
|
||||
|
||||
## Making changes
|
||||
|
||||
## Step 1. Make changes in charts and values.yaml in `manifests` directory
|
||||
|
||||
Be sure to provide sufficient documentation and example usage in values.yaml.
|
||||
If the chart has a `values.schema.json`, that should be updated as well.
|
||||
|
||||
## Step 2. Update the istioctl/Operator values
|
||||
|
||||
If you are modifying the `gateway` chart, you can stop here.
|
||||
All other charts, however, are exposed by `istioctl` and need to follow the steps below.
|
||||
|
||||
The charts in the `manifests` directory are used in istioctl to generate an installation manifest.
|
||||
|
||||
If `values.yaml` is changed, be sure to update corresponding values changes in [../profiles/default.yaml](../profiles/default.yaml)
|
||||
|
||||
## Step 3. Update istioctl schema
|
||||
|
||||
Istioctl uses a [schema](../../operator/pkg/apis/istio/v1alpha1/values_types.proto) to validate the values. Any changes to
|
||||
the schema must be added here, otherwise istioctl users will see errors.
|
||||
Once the schema file is updated, run:
|
||||
|
||||
```bash
|
||||
$ make operator-proto
|
||||
```
|
||||
|
||||
This will regenerate the Go structs used for schema validation.
|
||||
|
||||
## Step 4. Update the generated manifests
|
||||
|
||||
Tests of istioctl use the auto-generated manifests to ensure that the istioctl binary has the correct version of the charts.
|
||||
To regenerate the manifests, run:
|
||||
|
||||
```bash
|
||||
$ make copy-templates update-golden
|
||||
```
|
||||
|
||||
## Step 5. Create a PR using outputs from Steps 1 to 4
|
||||
|
||||
Your PR should pass all the checks if you followed these steps.
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v2
|
||||
appVersion: 1.23.1
|
||||
description: Helm chart for deploying Istio cluster resources and CRDs
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
name: base
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
version: 1.23.1
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# Istio base Helm Chart
|
||||
|
||||
This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
|
||||
|
||||
## Setup Repo Info
|
||||
|
||||
```console
|
||||
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `istio-base`:
|
||||
|
||||
```console
|
||||
kubectl create namespace istio-system
|
||||
helm install istio-base istio/base -n istio-system
|
||||
```
|
||||
|
||||
### Profiles
|
||||
|
||||
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||
These can be set with `--set profile=<profile>`.
|
||||
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||
|
||||
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||
|
||||
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||
|
||||
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||
When configuring the chart, you should not include this.
|
||||
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
|
||||
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||
variant: distroless
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.21 behavioral changes
|
||||
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||
ENABLE_AUTO_SNI: "false"
|
||||
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
# 1.22 behavioral changes
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||
# * Lower resource utilization.
|
||||
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||
# * More ports enabled on the ingress, which is used in some tasks.
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
extensionProviders:
|
||||
- name: otel
|
||||
envoyOtelAls:
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
port: 4317
|
||||
- name: skywalking
|
||||
skywalking:
|
||||
service: tracing.istio-system.svc.cluster.local
|
||||
port: 11800
|
||||
- name: otel-tracing
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
|
||||
global:
|
||||
proxy:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
traceSampling: 100
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 100Mi
|
||||
|
||||
gateways:
|
||||
istio-egressgateway:
|
||||
autoscaleEnabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
istio-ingressgateway:
|
||||
autoscaleEnabled: false
|
||||
ports:
|
||||
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||
# Note that AWS ELB will by default perform health checks on the first port
|
||||
# on this list. Setting this to the health check port will ensure that health
|
||||
# checks always work. https://github.com/istio/istio/issues/12503
|
||||
- port: 15021
|
||||
targetPort: 15021
|
||||
name: status-port
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
name: http2
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
name: https
|
||||
- port: 31400
|
||||
targetPort: 31400
|
||||
name: tcp
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
platform: openshift
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
variant: distroless
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||
platform: openshift
|
||||
variant: distroless
|
||||
seLinuxOptions:
|
||||
type: spc_t
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||
# CNI must be installed.
|
||||
cni:
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
global:
|
||||
platform: openshift
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
platform: openshift
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The preview profile contains features that are experimental.
|
||||
# This is intended to explore new features coming to Istio.
|
||||
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# Enable Istio agent to handle DNS requests for known hosts
|
||||
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||
ISTIO_META_DNS_CAPTURE: "true"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||
experimental:
|
||||
stableValidationPolicy: true
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
Istio base successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{{- if .Values.base.enableCRDTemplates }}
|
||||
{{ .Files.Get "crds/crd-all.gen.yaml" }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
{{- if not (eq .Values.defaultRevision "") }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istiod-default-validator
|
||||
labels:
|
||||
app: istiod
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.defaultRevision | quote }}
|
||||
webhooks:
|
||||
- name: validation.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
{{- if (eq .Values.defaultRevision "default") }}
|
||||
name: istiod
|
||||
{{- else }}
|
||||
name: istiod-{{ .Values.defaultRevision }}
|
||||
{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
caBundle: "{{ .Values.base.validationCABundle }}"
|
||||
{{- end }}
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
|
||||
{{- if .Values.base.validationCABundle }}
|
||||
# Disable webhook controller in Pilot to stop patching it
|
||||
failurePolicy: Fail
|
||||
{{- else }}
|
||||
# Fail open until the validation webhook is ready. The webhook controller
|
||||
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
||||
# endpoint is ready.
|
||||
failurePolicy: Ignore
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
|
||||
# if the remotePilotAddress is an IP addr
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
{{- if .Values.pilot.enabled }}
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
|
||||
{{- else }}
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||
{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: {{ .Values.global.remotePilotAddress }}
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
- port: 15017
|
||||
name: tcp-webhook
|
||||
protocol: TCP
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# This service account aggregates reader permissions for the revisions in a given cluster
|
||||
# Should be used for remote secret creation.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: istio-reader-service-account
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
labels:
|
||||
app: istio-reader
|
||||
release: {{ .Release.Name }}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{{- if .Values.global.remotePilotAddress }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
{{- if .Values.pilot.enabled }}
|
||||
# when local istiod is enabled, we can't use istiod service name to reach the remote control plane
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
|
||||
{{- else }}
|
||||
# when local istiod isn't enabled, we can use istiod service name to reach the remote control plane
|
||||
name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
|
||||
{{- end }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
targetPort: 15017
|
||||
name: tcp-webhook
|
||||
protocol: TCP
|
||||
{{- if not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress) }}
|
||||
# if the remotePilotAddress is not an IP addr, we use ExternalName
|
||||
type: ExternalName
|
||||
externalName: {{ .Values.global.remotePilotAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- range .Values.global.ipFamilies }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicy
|
||||
metadata:
|
||||
name: "stable-channel-default-policy.istio.io"
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.defaultRevision }}
|
||||
spec:
|
||||
failurePolicy: Fail
|
||||
matchConstraints:
|
||||
resourceRules:
|
||||
- apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions: ["*"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["*"]
|
||||
variables:
|
||||
- name: isEnvoyFilter
|
||||
expression: "object.kind == 'EnvoyFilter'"
|
||||
- name: isWasmPlugin
|
||||
expression: "object.kind == 'WasmPlugin'"
|
||||
- name: isProxyConfig
|
||||
expression: "object.kind == 'ProxyConfig'"
|
||||
- name: isTelemetry
|
||||
expression: "object.kind == 'Telemetry'"
|
||||
validations:
|
||||
- expression: "!variables.isEnvoyFilter"
|
||||
- expression: "!variables.isWasmPlugin"
|
||||
- expression: "!variables.isProxyConfig"
|
||||
- expression: |
|
||||
!(
|
||||
variables.isTelemetry && (
|
||||
(has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
|
||||
(has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
|
||||
(has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
|
||||
)
|
||||
)
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingAdmissionPolicyBinding
|
||||
metadata:
|
||||
name: "stable-channel-default-policy-binding.istio.io"
|
||||
spec:
|
||||
policyName: "stable-channel-default-policy.istio.io"
|
||||
validationActions: [Deny]
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
{{/*
|
||||
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||
The original version of this file is located at /manifests directory.
|
||||
If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
Complex logic ahead...
|
||||
We have three sets of values, in order of precedence (last wins):
|
||||
1. The builtin values.yaml defaults
|
||||
2. The profile the user selects
|
||||
3. Users input (-f or --set)
|
||||
|
||||
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||
|
||||
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||
*/}}
|
||||
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||
{{- $defaults := $.Values.defaults }}
|
||||
{{- $_ := unset $.Values "defaults" }}
|
||||
{{- $profile := dict }}
|
||||
{{- with .Values.profile }}
|
||||
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||
{{- $profile = (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.compatibilityVersion }}
|
||||
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $profile }}
|
||||
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||
{{- end }}
|
||||
# Flatten globals, if defined on a per-chart basis
|
||||
{{- if false }}
|
||||
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||
{{- end }}
|
||||
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||
defaults:
|
||||
global:
|
||||
|
||||
# ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
|
||||
# to use for pulling any images in pods that reference this ServiceAccount.
|
||||
# Must be set for any cluster configured with private docker registry.
|
||||
imagePullSecrets: []
|
||||
|
||||
# Used to locate istiod.
|
||||
istioNamespace: istio-system
|
||||
|
||||
externalIstiod: false
|
||||
remotePilotAddress: ""
|
||||
|
||||
# Platform where Istio is deployed. Possible values are: "openshift", "gcp".
|
||||
# An empty value means it is a vanilla Kubernetes distribution, therefore no special
|
||||
# treatment will be considered.
|
||||
platform: ""
|
||||
|
||||
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
|
||||
# This is intended only for use with external istiod.
|
||||
ipFamilyPolicy: ""
|
||||
ipFamilies: []
|
||||
|
||||
base:
|
||||
# Used for helm2 to add the CRDs to templates.
|
||||
enableCRDTemplates: false
|
||||
|
||||
# Validation webhook configuration url
|
||||
# For example: https://$remotePilotAddress:15017/validate
|
||||
validationURL: ""
|
||||
# Validation webhook caBundle value. Useful when running pilot with a well known cert
|
||||
validationCABundle: ""
|
||||
|
||||
# For istioctl usage to disable istio config crds in base
|
||||
enableIstioConfigCRDs: true
|
||||
|
||||
defaultRevision: "default"
|
||||
experimental:
|
||||
stableValidationPolicy: false
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v2
|
||||
name: istio-default
|
||||
# This version is never actually shipped. istio/release-builder will replace it at build-time
|
||||
# with the appropriate version
|
||||
version: 1.0.0
|
||||
appVersion: 1.0.0
|
||||
description: Helm chart for istio default revision components.
|
||||
keywords:
|
||||
- istio
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
|
||||
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||
variant: distroless
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.21 behavioral changes
|
||||
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||
ENABLE_AUTO_SNI: "false"
|
||||
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
# 1.22 behavioral changes
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||
# * Lower resource utilization.
|
||||
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||
# * More ports enabled on the ingress, which is used in some tasks.
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
extensionProviders:
|
||||
- name: otel
|
||||
envoyOtelAls:
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
port: 4317
|
||||
- name: skywalking
|
||||
skywalking:
|
||||
service: tracing.istio-system.svc.cluster.local
|
||||
port: 11800
|
||||
- name: otel-tracing
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
|
||||
global:
|
||||
proxy:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
traceSampling: 100
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 100Mi
|
||||
|
||||
gateways:
|
||||
istio-egressgateway:
|
||||
autoscaleEnabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
istio-ingressgateway:
|
||||
autoscaleEnabled: false
|
||||
ports:
|
||||
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||
# Note that AWS ELB will by default perform health checks on the first port
|
||||
# on this list. Setting this to the health check port will ensure that health
|
||||
# checks always work. https://github.com/istio/istio/issues/12503
|
||||
- port: 15021
|
||||
targetPort: 15021
|
||||
name: status-port
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
name: http2
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
name: https
|
||||
- port: 31400
|
||||
targetPort: 31400
|
||||
name: tcp
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
platform: openshift
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
variant: distroless
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||
platform: openshift
|
||||
variant: distroless
|
||||
seLinuxOptions:
|
||||
type: spc_t
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||
# CNI must be installed.
|
||||
cni:
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
global:
|
||||
platform: openshift
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
platform: openshift
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The preview profile contains features that are experimental.
|
||||
# This is intended to explore new features coming to Istio.
|
||||
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# Enable Istio agent to handle DNS requests for known hosts
|
||||
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||
ISTIO_META_DNS_CAPTURE: "true"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||
experimental:
|
||||
stableValidationPolicy: true
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
# Adapted from istio-discovery/templates/mutatingwebhook.yaml
|
||||
# Removed paths for legacy and default selectors since a revision tag
|
||||
# is inherently created from a specific revision
|
||||
{{/* Copy just what we need to avoid expensive deepCopy */}}
|
||||
{{- $whv := dict
|
||||
"revision" .Values.revision
|
||||
"injectionURL" .Values.istiodRemote.injectionURL
|
||||
"namespace" .Release.Namespace }}
|
||||
{{- define "core" }}
|
||||
- name: {{.Prefix}}sidecar-injector.istio.io
|
||||
clientConfig:
|
||||
{{- if .injectionURL }}
|
||||
url: {{ .injectionURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
|
||||
namespace: {{ .namespace }}
|
||||
path: "/inject"
|
||||
{{- end }}
|
||||
sideEffects: None
|
||||
rules:
|
||||
- operations: [ "CREATE" ]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Fail
|
||||
admissionReviewVersions: ["v1"]
|
||||
{{- end }}
|
||||
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istio-revision-tag-default
|
||||
labels:
|
||||
istio.io/tag: "default"
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "Pilot"
|
||||
app: sidecar-injector
|
||||
release: {{ .Release.Name }}
|
||||
webhooks:
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "default"
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
- key: istio.io/rev
|
||||
operator: In
|
||||
values:
|
||||
- "default"
|
||||
|
||||
{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: NotIn
|
||||
values:
|
||||
- "false"
|
||||
|
||||
{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
|
||||
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
|
||||
{{- /* Special case 3: no labels at all */}}
|
||||
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: istio-injection
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: "NotIn"
|
||||
values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: sidecar.istio.io/inject
|
||||
operator: DoesNotExist
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istiod-default-validator
|
||||
labels:
|
||||
app: istiod
|
||||
istio: istiod
|
||||
istio.io/rev: {{ .Values.revision | default "default" | quote }}
|
||||
istio.io/tag: "default"
|
||||
# Required to make sure this resource is removed
|
||||
# when purging Istio resources
|
||||
operator.istio.io/component: Pilot
|
||||
webhooks:
|
||||
- name: validation.istio.io
|
||||
clientConfig:
|
||||
{{- if .Values.base.validationURL }}
|
||||
url: {{ .Values.base.validationURL }}
|
||||
{{- else }}
|
||||
service:
|
||||
name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
|
||||
namespace: {{ .Values.global.istioNamespace }}
|
||||
path: "/validate"
|
||||
{{- end }}
|
||||
rules:
|
||||
- operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
apiGroups:
|
||||
- security.istio.io
|
||||
- networking.istio.io
|
||||
- telemetry.istio.io
|
||||
- extensions.istio.io
|
||||
apiVersions:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
failurePolicy: Ignore
|
||||
sideEffects: None
|
||||
admissionReviewVersions: ["v1"]
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: istio.io/rev
|
||||
operator: DoesNotExist
|
||||
---
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
{{/*
|
||||
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||
The original version of this file is located at /manifests directory.
|
||||
If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
Complex logic ahead...
|
||||
We have three sets of values, in order of precedence (last wins):
|
||||
1. The builtin values.yaml defaults
|
||||
2. The profile the user selects
|
||||
3. Users input (-f or --set)
|
||||
|
||||
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||
|
||||
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||
*/}}
|
||||
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||
{{- $defaults := $.Values.defaults }}
|
||||
{{- $_ := unset $.Values "defaults" }}
|
||||
{{- $profile := dict }}
|
||||
{{- with .Values.profile }}
|
||||
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||
{{- $profile = (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.compatibilityVersion }}
|
||||
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $profile }}
|
||||
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||
{{- end }}
|
||||
# Flatten globals, if defined on a per-chart basis
|
||||
{{- if false }}
|
||||
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||
{{- end }}
|
||||
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||
defaults:
|
||||
global:
|
||||
# Used to locate istiod.
|
||||
istioNamespace: "istio-system"
|
||||
|
||||
base:
|
||||
# Validation webhook configuration url
|
||||
# For example: https://$remotePilotAddress:15017/validate
|
||||
validationURL: ""
|
||||
|
||||
istiodRemote:
|
||||
# Sidecar injector mutating webhook configuration url
|
||||
# For example: https://$remotePilotAddress:15017/inject
|
||||
injectionURL: ""
|
||||
|
||||
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
|
||||
revision: ""
|
||||
|
||||
sidecarInjectorWebhook:
|
||||
# This enables injection of sidecar in all namespaces,
|
||||
enableNamespacesByDefault: false
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v2
|
||||
appVersion: 1.23.1
|
||||
description: Helm chart for deploying Istio gateways
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
- gateways
|
||||
name: gateway
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
type: application
|
||||
version: 1.23.1
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
# Istio Gateway Helm Chart
|
||||
|
||||
This chart installs an Istio gateway deployment.
|
||||
|
||||
## Setup Repo Info
|
||||
|
||||
```console
|
||||
helm repo add istio https://istio-release.storage.googleapis.com/charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `istio-ingressgateway`:
|
||||
|
||||
```console
|
||||
helm install istio-ingressgateway istio/gateway
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `istio-ingressgateway` deployment:
|
||||
|
||||
```console
|
||||
helm delete istio-ingressgateway
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To view support configuration options and documentation, run:
|
||||
|
||||
```console
|
||||
helm show values istio/gateway
|
||||
```
|
||||
|
||||
### Profiles
|
||||
|
||||
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
|
||||
These can be set with `--set profile=<profile>`.
|
||||
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
|
||||
|
||||
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
|
||||
|
||||
Explicitly set values have highest priority, then profile settings, then chart defaults.
|
||||
|
||||
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
|
||||
When configuring the chart, you should not include this.
|
||||
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
|
||||
|
||||
### OpenShift
|
||||
|
||||
When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
|
||||
|
||||
```console
|
||||
helm install istio-ingressgateway istio/gateway --set profile=openshift
|
||||
```
|
||||
|
||||
### `image: auto` Information
|
||||
|
||||
The image used by the chart, `auto`, may be unintuitive.
|
||||
This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
|
||||
This allows the same configurations and lifecycle to apply to gateways as sidecars.
|
||||
|
||||
Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
|
||||
See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
|
||||
|
||||
### Examples
|
||||
|
||||
#### Egress Gateway
|
||||
|
||||
Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
|
||||
|
||||
```yaml
|
||||
service:
|
||||
# Egress gateways do not need an external LoadBalancer IP
|
||||
type: ClusterIP
|
||||
```
|
||||
|
||||
#### Multi-network/VM Gateway
|
||||
|
||||
Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
|
||||
|
||||
```yaml
|
||||
networkGateway: network-1
|
||||
```
|
||||
|
||||
### Migrating from other installation methods
|
||||
|
||||
Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
|
||||
following the guidance below.
|
||||
If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
|
||||
|
||||
WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
|
||||
|
||||
#### Legacy Gateway Helm charts
|
||||
|
||||
Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
|
||||
These are replaced by this chart.
|
||||
While not required, it is recommended all new users use this chart, and existing users migrate when possible.
|
||||
|
||||
This chart has the following benefits and differences:
|
||||
* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
|
||||
* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
|
||||
* Published to official Istio Helm repository.
|
||||
* Single chart for all gateways (Ingress, Egress, East West).
|
||||
|
||||
#### General concerns
|
||||
|
||||
For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
|
||||
|
||||
If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
|
||||
|
||||
```yaml
|
||||
app: istio-gateway
|
||||
istio: gateway # the release name with leading istio- prefix stripped
|
||||
```
|
||||
|
||||
If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
|
||||
`foo=bar,istio=ingressgateway`:
|
||||
|
||||
```yaml
|
||||
name: my-custom-gateway # Override the name to match existing resources
|
||||
labels:
|
||||
app: "" # Unset default app selector label
|
||||
istio: ingressgateway # override default istio selector label
|
||||
foo: bar # Add the existing custom selector label
|
||||
```
|
||||
|
||||
#### Migrating an existing Helm release
|
||||
|
||||
An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
|
||||
installation was done like:
|
||||
|
||||
```console
|
||||
helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
|
||||
```
|
||||
|
||||
It could be upgraded with
|
||||
|
||||
```console
|
||||
helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
|
||||
```
|
||||
|
||||
Note the name and labels are overridden to match the names of the existing installation.
|
||||
|
||||
Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
|
||||
If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
|
||||
or customize the ports to match the old defaults.
|
||||
See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
|
||||
|
||||
#### Other migrations
|
||||
|
||||
If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
|
||||
|
||||
The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
|
||||
|
||||
```console
|
||||
KINDS=(service deployment)
|
||||
RELEASE=istio-ingressgateway
|
||||
NAMESPACE=istio-system
|
||||
for KIND in "${KINDS[@]}"; do
|
||||
kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
|
||||
kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
|
||||
kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
|
||||
done
|
||||
```
|
||||
|
||||
You may ignore errors about resources not being found.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
|
||||
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||
variant: distroless
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.21 behavioral changes
|
||||
ENABLE_EXTERNAL_NAME_ALIAS: "false"
|
||||
PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
|
||||
VERIFY_CERTIFICATE_AT_CLIENT: "false"
|
||||
ENABLE_AUTO_SNI: "false"
|
||||
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
|
||||
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
|
||||
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
# 1.22 behavioral changes
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_DELTA_XDS: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
tracing:
|
||||
zipkin:
|
||||
address: zipkin.istio-system:9411
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
pilot:
|
||||
env:
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# 1.22 behavioral changes
|
||||
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
|
||||
# 1.23 behavioral changes
|
||||
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The demo profile enables a variety of things to try out Istio in non-production environments.
|
||||
# * Lower resource utilization.
|
||||
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
|
||||
# * More ports enabled on the ingress, which is used in some tasks.
|
||||
meshConfig:
|
||||
accessLogFile: /dev/stdout
|
||||
extensionProviders:
|
||||
- name: otel
|
||||
envoyOtelAls:
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
port: 4317
|
||||
- name: skywalking
|
||||
skywalking:
|
||||
service: tracing.istio-system.svc.cluster.local
|
||||
port: 11800
|
||||
- name: otel-tracing
|
||||
opentelemetry:
|
||||
port: 4317
|
||||
service: opentelemetry-collector.observability.svc.cluster.local
|
||||
|
||||
global:
|
||||
proxy:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
||||
pilot:
|
||||
autoscaleEnabled: false
|
||||
traceSampling: 100
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 100Mi
|
||||
|
||||
gateways:
|
||||
istio-egressgateway:
|
||||
autoscaleEnabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
istio-ingressgateway:
|
||||
autoscaleEnabled: false
|
||||
ports:
|
||||
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
|
||||
# Note that AWS ELB will by default perform health checks on the first port
|
||||
# on this list. Setting this to the health check port will ensure that health
|
||||
# checks always work. https://github.com/istio/istio/issues/12503
|
||||
- port: 15021
|
||||
targetPort: 15021
|
||||
name: status-port
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
name: http2
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
name: https
|
||||
- port: 31400
|
||||
targetPort: 31400
|
||||
name: tcp
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 40Mi
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
platform: openshift
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
variant: distroless
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
# Allow sidecars/ingress to send/receive HBONE. This is required for interop.
|
||||
PILOT_ENABLE_SENDING_HBONE: "true"
|
||||
PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
|
||||
platform: openshift
|
||||
variant: distroless
|
||||
seLinuxOptions:
|
||||
type: spc_t
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
|
||||
# CNI must be installed.
|
||||
cni:
|
||||
cniBinDir: /var/lib/cni/bin
|
||||
cniConfDir: /etc/cni/multus/net.d
|
||||
chained: false
|
||||
cniConfFileName: "istio-cni.conf"
|
||||
logLevel: info
|
||||
provider: "multus"
|
||||
global:
|
||||
platform: openshift
|
||||
pilot:
|
||||
cni:
|
||||
enabled: true
|
||||
provider: "multus"
|
||||
platform: openshift
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The preview profile contains features that are experimental.
|
||||
# This is intended to explore new features coming to Istio.
|
||||
# Stability, security, and performance are not guaranteed - use at your own risk.
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
# Enable Istio agent to handle DNS requests for known hosts
|
||||
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
|
||||
ISTIO_META_DNS_CAPTURE: "true"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The stable profile deploys admission control to ensure that only stable resources and fields are used
|
||||
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
|
||||
experimental:
|
||||
stableValidationPolicy: true
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
"{{ include "gateway.name" . }}" successfully installed!
|
||||
|
||||
To learn more about the release, try:
|
||||
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
|
||||
Next steps:
|
||||
* Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
|
||||
* Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{{- define "gateway.name" -}}
|
||||
{{- if eq .Release.Name "RELEASE-NAME" -}}
|
||||
{{- .Values.name | default "istio-ingressgateway" -}}
|
||||
{{- else -}}
|
||||
{{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the helm.sh/chart label.
|
||||
*/}}
|
||||
{{- define "gateway.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "gateway.labels" -}}
|
||||
helm.sh/chart: {{ include "gateway.chart" . }}
|
||||
{{ include "gateway.selectorLabels" . }}
|
||||
app.kubernetes.io/name: {{ include "gateway.name" . }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- range $key, $val := .Values.labels }}
|
||||
{{- if and (ne $key "app") (ne $key "istio") }}
|
||||
{{ $key | quote }}: {{ $val | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "gateway.selectorLabels" -}}
|
||||
app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
|
||||
istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Keep sidecar injection labels together
|
||||
https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
|
||||
*/}}
|
||||
{{- define "gateway.sidecarInjectionLabels" -}}
|
||||
sidecar.istio.io/inject: "true"
|
||||
{{- with .Values.revision }}
|
||||
istio.io/rev: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "gateway.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- .Values.serviceAccount.name | default (include "gateway.name" .) }}
|
||||
{{- else }}
|
||||
{{- .Values.serviceAccount.name | default "default" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
apiVersion: apps/v1
|
||||
kind: {{ .Values.kind | default "Deployment" }}
|
||||
metadata:
|
||||
name: {{ include "gateway.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4}}
|
||||
annotations:
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
{{- with .Values.replicaCount }}
|
||||
replicas: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gateway.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
|
||||
{{- include "gateway.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/name: {{ include "gateway.name" . }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- range $key, $val := .Values.labels }}
|
||||
{{- if and (ne $key "app") (ne $key "istio") }}
|
||||
{{ $key | quote }}: {{ $val | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "gateway.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- if .Values.securityContext }}
|
||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||
{{- else }}
|
||||
# Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
volumes:
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: istio-proxy
|
||||
# "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
|
||||
image: auto
|
||||
{{- with .Values.imagePullPolicy }}
|
||||
imagePullPolicy: {{ . }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- if .Values.containerSecurityContext }}
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
{{- else }}
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
{{- if not (eq .Values.platform "openshift") }}
|
||||
runAsUser: 1337
|
||||
runAsGroup: 1337
|
||||
{{- end }}
|
||||
runAsNonRoot: true
|
||||
{{- end }}
|
||||
env:
|
||||
{{- with .Values.networkGateway }}
|
||||
- name: ISTIO_META_REQUESTED_NETWORK_VIEW
|
||||
value: "{{.}}"
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $val | quote }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
protocol: TCP
|
||||
name: http-envoy-prom
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "gateway.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: {{ .Values.kind | default "Deployment" }}
|
||||
name: {{ include "gateway.name" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
type: Utilization
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
type: Utilization
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.autoscaleBehavior }}
|
||||
behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{{- if .Values.podDisruptionBudget }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "gateway.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4}}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gateway.selectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.podDisruptionBudget }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
|
||||
{{- if .Values.rbac.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "gateway.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4}}
|
||||
annotations:
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "gateway.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4}}
|
||||
annotations:
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "gateway.serviceAccountName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "gateway.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{{- if not (eq .Values.service.type "None") }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "gateway.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4 }}
|
||||
{{- with .Values.networkGateway }}
|
||||
topology.istio.io/network: "{{.}}"
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
|
||||
spec:
|
||||
{{- with .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
{{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
|
||||
allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- range .Values.service.ipFamilies }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: "{{ . }}"
|
||||
{{- end }}
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
{{- if .Values.networkGateway }}
|
||||
- name: status-port
|
||||
port: 15021
|
||||
targetPort: 15021
|
||||
- name: tls
|
||||
port: 15443
|
||||
targetPort: 15443
|
||||
- name: tls-istiod
|
||||
port: 15012
|
||||
targetPort: 15012
|
||||
- name: tls-webhook
|
||||
port: 15017
|
||||
targetPort: 15017
|
||||
{{- else }}
|
||||
{{ .Values.service.ports | toYaml | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.externalIPs }}
|
||||
externalIPs: {{- range .Values.service.externalIPs }}
|
||||
- {{.}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "gateway.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "gateway.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gateway.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
{{/*
|
||||
WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
|
||||
The original version of this file is located at /manifests directory.
|
||||
If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
Complex logic ahead...
|
||||
We have three sets of values, in order of precedence (last wins):
|
||||
1. The builtin values.yaml defaults
|
||||
2. The profile the user selects
|
||||
3. Users input (-f or --set)
|
||||
|
||||
Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
|
||||
|
||||
However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
|
||||
We can then merge the profile onto the defaults, then the user settings onto that.
|
||||
Finally, we can set all of that under .Values so the chart behaves without awareness.
|
||||
*/}}
|
||||
{{- $globals := $.Values.global | default dict | deepCopy }}
|
||||
{{- $defaults := $.Values.defaults }}
|
||||
{{- $_ := unset $.Values "defaults" }}
|
||||
{{- $profile := dict }}
|
||||
{{- with .Values.profile }}
|
||||
{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
|
||||
{{- $profile = (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown profile" $.Values.profile) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.compatibilityVersion }}
|
||||
{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
|
||||
{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
|
||||
{{- else }}
|
||||
{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $profile }}
|
||||
{{- $a := mustMergeOverwrite $defaults $profile }}
|
||||
{{- end }}
|
||||
# Flatten globals, if defined on a per-chart basis
|
||||
{{- if false }}
|
||||
{{- $a := mustMergeOverwrite $defaults $globals }}
|
||||
{{- end }}
|
||||
{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
|
||||
|
|
@ -0,0 +1,301 @@
|
|||
{
|
||||
"$schema": "http://json-schema.org/schema#",
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"$defs": {
|
||||
"values": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"global": {
|
||||
"type": "object"
|
||||
},
|
||||
"affinity": {
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"type": [
|
||||
"object",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"containerSecurityContext": {
|
||||
"type": [
|
||||
"object",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Deployment",
|
||||
"DaemonSet"
|
||||
]
|
||||
},
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": [
|
||||
"string",
|
||||
"integer"
|
||||
]
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"autoscaling": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"maxReplicas": {
|
||||
"type": "integer"
|
||||
},
|
||||
"minReplicas": {
|
||||
"type": "integer"
|
||||
},
|
||||
"targetCPUUtilizationPercentage": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"env": {
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"type": "object"
|
||||
},
|
||||
"podAnnotations": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"inject.istio.io/templates": {
|
||||
"type": "string"
|
||||
},
|
||||
"prometheus.io/path": {
|
||||
"type": "string"
|
||||
},
|
||||
"prometheus.io/port": {
|
||||
"type": "string"
|
||||
},
|
||||
"prometheus.io/scrape": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"replicaCount": {
|
||||
"type": [
|
||||
"integer",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"resources": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": ["string", "null"]
|
||||
},
|
||||
"memory": {
|
||||
"type": ["string", "null"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"requests": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": ["string", "null"]
|
||||
},
|
||||
"memory": {
|
||||
"type": ["string", "null"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"revision": {
|
||||
"type": "string"
|
||||
},
|
||||
"compatibilityVersion": {
|
||||
"type": "string"
|
||||
},
|
||||
"runAsRoot": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"unprivilegedPort": {
|
||||
"type": [
|
||||
"string",
|
||||
"boolean"
|
||||
],
|
||||
"enum": [
|
||||
true,
|
||||
false,
|
||||
"auto"
|
||||
]
|
||||
},
|
||||
"service": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"externalTrafficPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"loadBalancerIP": {
|
||||
"type": "string"
|
||||
},
|
||||
"loadBalancerSourceRanges": {
|
||||
"type": "array"
|
||||
},
|
||||
"ipFamilies": {
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"IPv4",
|
||||
"IPv6"
|
||||
]
|
||||
}
|
||||
},
|
||||
"ipFamilyPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"SingleStack",
|
||||
"PreferDualStack",
|
||||
"RequireDualStack"
|
||||
]
|
||||
},
|
||||
"ports": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "string"
|
||||
},
|
||||
"targetPort": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"rbac": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array"
|
||||
},
|
||||
"topologySpreadConstraints": {
|
||||
"type": "array"
|
||||
},
|
||||
"networkGateway": {
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"Always",
|
||||
"IfNotPresent",
|
||||
"Never"
|
||||
]
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"podDisruptionBudget": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"minAvailable": {
|
||||
"type": [
|
||||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"maxUnavailable": {
|
||||
"type": [
|
||||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"IfHealthyBudget",
|
||||
"AlwaysAllow"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"terminationGracePeriodSeconds": {
|
||||
"type": "number"
|
||||
},
|
||||
"volumes": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"volumeMounts": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"priorityClassName": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"defaults": {
|
||||
"$ref": "#/$defs/values"
|
||||
},
|
||||
"$ref": "#/$defs/values"
|
||||
}
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
# "defaults" is a workaround for Helm limitations. Users should NOT set ".defaults" explicitly, but rather directly set the fields internally.
|
||||
# For instance, instead of `--set defaults.foo=bar`, just set `--set foo=bar`.
|
||||
defaults:
|
||||
# Name allows overriding the release name. Generally this should not be set
|
||||
name: ""
|
||||
# revision declares which revision this gateway is a part of
|
||||
revision: ""
|
||||
|
||||
# Controls the spec.replicas setting for the Gateway deployment if set.
|
||||
# Otherwise defaults to Kubernetes Deployment default (1).
|
||||
replicaCount:
|
||||
|
||||
kind: Deployment
|
||||
|
||||
rbac:
|
||||
# If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
|
||||
# when using http://gateway-api.org/.
|
||||
enabled: true
|
||||
|
||||
serviceAccount:
|
||||
# If set, a service account will be created. Otherwise, the default is used
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set, the release name is used
|
||||
name: ""
|
||||
|
||||
podAnnotations:
|
||||
prometheus.io/port: "15020"
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "/stats/prometheus"
|
||||
inject.istio.io/templates: "gateway"
|
||||
sidecar.istio.io/inject: "true"
|
||||
|
||||
# Define the security context for the pod.
|
||||
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
|
||||
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
|
||||
securityContext: {}
|
||||
containerSecurityContext: {}
|
||||
|
||||
service:
|
||||
# Type of service. Set to "None" to disable the service entirely
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: status-port
|
||||
port: 15021
|
||||
protocol: TCP
|
||||
targetPort: 15021
|
||||
- name: http2
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 80
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 443
|
||||
annotations: {}
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
externalTrafficPolicy: ""
|
||||
externalIPs: []
|
||||
ipFamilyPolicy: ""
|
||||
ipFamilies: []
|
||||
## Whether to automatically allocate NodePorts (only for LoadBalancers).
|
||||
# allocateLoadBalancerNodePorts: false
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1024Mi
|
||||
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 1
|
||||
maxReplicas: 5
|
||||
targetCPUUtilizationPercentage: 80
|
||||
targetMemoryUtilizationPercentage: {}
|
||||
autoscaleBehavior: {}
|
||||
|
||||
# Pod environment variables
|
||||
env: {}
|
||||
|
||||
# Labels to apply to all resources
|
||||
labels: {}
|
||||
|
||||
# Annotations to apply to all resources
|
||||
annotations: {}
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
# If specified, the gateway will act as a network gateway for the given network.
|
||||
networkGateway: ""
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent
|
||||
imagePullPolicy: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
# This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
|
||||
#
|
||||
# By default, the `podDisruptionBudget` is disabled (set to `{}`),
|
||||
# which means that no PodDisruptionBudget resource will be created.
|
||||
#
|
||||
# To enable the PodDisruptionBudget, configure it by specifying the
|
||||
# `minAvailable` or `maxUnavailable`. For example, to set the
|
||||
# minimum number of available replicas to 1, you can update this value as follows:
|
||||
#
|
||||
# podDisruptionBudget:
|
||||
# minAvailable: 1
|
||||
#
|
||||
# Or, to allow a maximum of 1 unavailable replica, you can set:
|
||||
#
|
||||
# podDisruptionBudget:
|
||||
# maxUnavailable: 1
|
||||
#
|
||||
# You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
|
||||
# For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
|
||||
#
|
||||
# podDisruptionBudget:
|
||||
# minAvailable: 1
|
||||
# unhealthyPodEvictionPolicy: AlwaysAllow
|
||||
#
|
||||
# To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
|
||||
#
|
||||
# podDisruptionBudget: {}
|
||||
#
|
||||
podDisruptionBudget: {}
|
||||
|
||||
terminationGracePeriodSeconds: 30
|
||||
|
||||
# A list of `Volumes` added into the Gateway Pods. See
|
||||
# https://kubernetes.io/docs/concepts/storage/volumes/.
|
||||
volumes: []
|
||||
|
||||
# A list of `VolumeMounts` added into the Gateway Pods. See
|
||||
# https://kubernetes.io/docs/concepts/storage/volumes/.
|
||||
volumeMounts: []
|
||||
|
||||
# Configure this to a higher priority class in order to make sure your Istio gateway pods
|
||||
# will not be killed because of low priority class.
|
||||
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
# for more detail.
|
||||
priorityClassName: ""
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v2
|
||||
appVersion: 1.23.1
|
||||
description: Helm chart for deploying Istio gateways
|
||||
icon: https://istio.io/latest/favicons/android-192x192.png
|
||||
keywords:
|
||||
- istio
|
||||
- egressgateway
|
||||
- gateways
|
||||
name: istio-egress
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
version: 1.23.1
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
|
||||
Changes:
|
||||
- separate namespace allows:
|
||||
-- easier reconfig of just the gateway
|
||||
-- TLS secrets and domain name management is isolated, for better security
|
||||
-- simplified configuration
|
||||
-- multiple versions of the ingress can be used, to minize upgrade risks
|
||||
|
||||
- the new chart uses the default namespace service account, and doesn't require
|
||||
additional RBAC permissions.
|
||||
|
||||
- simplified label structure. Label change is not supported on upgrade.
|
||||
|
||||
- for 'internal load balancer' you should deploy a separate gateway, in a different
|
||||
namespace.
|
||||
|
||||
All ingress gateway have a "app:ingressgateway" label, used to identify it as an
|
||||
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.
|
||||
|
||||
The Gateways use "istio: ingressgateway$SUFFIX" selectors.
|
||||
|
||||
|
||||
# Multiple gateway versions
|
||||
|
||||
|
||||
|
||||
# Using different pilot versions
|
||||
|
||||
|
||||
|
||||
# Migration from istio-system
|
||||
|
||||
Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
|
||||
with the Service and bound to the namespace, it is recommended to:
|
||||
|
||||
1. Install the new gateway in a new namespace.
|
||||
2. Copy any TLS certificate to the new namespace, and configure the domains.
|
||||
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
|
||||
4. Modify the DNS server to add the A record of the new namespace
|
||||
5. Check traffic
|
||||
6. Delete the A record corresponding to the gateway in istio-system
|
||||
7. Upgrade istio-system, disabling the ingressgateway
|
||||
8. Delete the domain TLS certs from istio-system.
|
||||
|
||||
If using certmanager, all Certificate and associated configs must be moved as well.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
|
||||
# The original version of this file is located at /manifests/helm-profiles directory.
|
||||
# If you want to make a change in this file, edit the original one and run "make gen".
|
||||
|
||||
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
proxyMetadata:
|
||||
ISTIO_META_ENABLE_HBONE: "true"
|
||||
global:
|
||||
variant: distroless
|
||||
pilot:
|
||||
env:
|
||||
PILOT_ENABLE_AMBIENT: "true"
|
||||
cni:
|
||||
ambient:
|
||||
enabled: true
|
||||
|
||||
# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
|
||||
variant: distroless
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue