Created
May 21, 2019 02:10
-
-
Save jroper/9d1aa662ea166bdea1f969edd74e34c4 to your computer and use it in GitHub Desktop.
Istio with outbound port exclusions
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: istio-system | |
| labels: | |
| istio-injection: disabled | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: virtualservices.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: VirtualService | |
| listKind: VirtualServiceList | |
| plural: virtualservices | |
| singular: virtualservice | |
| shortNames: | |
| - vs | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.gateways | |
| description: The names of gateways and sidecars that should apply these routes | |
| name: Gateways | |
| type: string | |
| - JSONPath: .spec.hosts | |
| description: The destination hosts to which traffic is being sent | |
| name: Hosts | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: destinationrules.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: DestinationRule | |
| listKind: DestinationRuleList | |
| plural: destinationrules | |
| singular: destinationrule | |
| shortNames: | |
| - dr | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.host | |
| description: The name of a service from the service registry | |
| name: Host | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: serviceentries.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: ServiceEntry | |
| listKind: ServiceEntryList | |
| plural: serviceentries | |
| singular: serviceentry | |
| shortNames: | |
| - se | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.hosts | |
| description: The hosts associated with the ServiceEntry | |
| name: Hosts | |
| type: string | |
| - JSONPath: .spec.location | |
| description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) | |
| name: Location | |
| type: string | |
| - JSONPath: .spec.resolution | |
| description: Service discovery mode for the hosts (NONE, STATIC, or DNS) | |
| name: Resolution | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: gateways.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: Gateway | |
| plural: gateways | |
| singular: gateway | |
| shortNames: | |
| - gw | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: sidecars.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: Sidecar | |
| plural: sidecars | |
| singular: sidecar | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: envoyfilters.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: EnvoyFilter | |
| plural: envoyfilters | |
| singular: envoyfilter | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: clusterrbacconfigs.rbac.istio.io | |
| labels: | |
| app: istio-pilot | |
| istio: rbac | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ClusterRbacConfig | |
| plural: clusterrbacconfigs | |
| singular: clusterrbacconfig | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Cluster | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: policies.authentication.istio.io | |
| labels: | |
| app: istio-citadel | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: authentication.istio.io | |
| names: | |
| kind: Policy | |
| plural: policies | |
| singular: policy | |
| categories: | |
| - istio-io | |
| - authentication-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: meshpolicies.authentication.istio.io | |
| labels: | |
| app: istio-citadel | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: authentication.istio.io | |
| names: | |
| kind: MeshPolicy | |
| listKind: MeshPolicyList | |
| plural: meshpolicies | |
| singular: meshpolicy | |
| categories: | |
| - istio-io | |
| - authentication-istio-io | |
| scope: Cluster | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: httpapispecbindings.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: HTTPAPISpecBinding | |
| plural: httpapispecbindings | |
| singular: httpapispecbinding | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: httpapispecs.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: HTTPAPISpec | |
| plural: httpapispecs | |
| singular: httpapispec | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: quotaspecbindings.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: QuotaSpecBinding | |
| plural: quotaspecbindings | |
| singular: quotaspecbinding | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: quotaspecs.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: QuotaSpec | |
| plural: quotaspecs | |
| singular: quotaspec | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: rules.config.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: core | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: rule | |
| plural: rules | |
| singular: rule | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: attributemanifests.config.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: core | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: attributemanifest | |
| plural: attributemanifests | |
| singular: attributemanifest | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: rbacconfigs.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: RbacConfig | |
| plural: rbacconfigs | |
| singular: rbacconfig | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: serviceroles.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ServiceRole | |
| plural: serviceroles | |
| singular: servicerole | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: servicerolebindings.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ServiceRoleBinding | |
| plural: servicerolebindings | |
| singular: servicerolebinding | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.roleRef.name | |
| description: The name of the ServiceRole object being referenced | |
| name: Reference | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: adapters.config.istio.io | |
| labels: | |
| app: mixer | |
| package: adapter | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: adapter | |
| plural: adapters | |
| singular: adapter | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: instances.config.istio.io | |
| labels: | |
| app: mixer | |
| package: instance | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: instance | |
| plural: instances | |
| singular: instance | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: templates.config.istio.io | |
| labels: | |
| app: mixer | |
| package: template | |
| istio: mixer-template | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: template | |
| plural: templates | |
| singular: template | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: handlers.config.istio.io | |
| labels: | |
| app: mixer | |
| package: handler | |
| istio: mixer-handler | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: handler | |
| plural: handlers | |
| singular: handler | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: sidecars.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: Sidecar | |
| plural: sidecars | |
| singular: sidecar | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: authorizationpolicies.rbac.istio.io | |
| labels: | |
| app: istio-pilot | |
| istio: rbac | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: AuthorizationPolicy | |
| plural: authorizationpolicies | |
| singular: authorizationpolicy | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: clusterissuers.certmanager.k8s.io | |
| labels: | |
| app: certmanager | |
| chart: certmanager | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: certmanager.k8s.io | |
| version: v1alpha1 | |
| names: | |
| kind: ClusterIssuer | |
| plural: clusterissuers | |
| scope: Cluster | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: issuers.certmanager.k8s.io | |
| labels: | |
| app: certmanager | |
| chart: certmanager | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: certmanager.k8s.io | |
| version: v1alpha1 | |
| names: | |
| kind: Issuer | |
| plural: issuers | |
| scope: Namespaced | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: certificates.certmanager.k8s.io | |
| labels: | |
| app: certmanager | |
| chart: certmanager | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| additionalPrinterColumns: | |
| - JSONPath: .status.conditions[?(@.type=="Ready")].status | |
| name: Ready | |
| type: string | |
| - JSONPath: .spec.secretName | |
| name: Secret | |
| type: string | |
| - JSONPath: .spec.issuerRef.name | |
| name: Issuer | |
| type: string | |
| priority: 1 | |
| - JSONPath: .status.conditions[?(@.type=="Ready")].message | |
| name: Status | |
| type: string | |
| priority: 1 | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| group: certmanager.k8s.io | |
| version: v1alpha1 | |
| scope: Namespaced | |
| names: | |
| kind: Certificate | |
| plural: certificates | |
| shortNames: | |
| - cert | |
| - certs | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: orders.certmanager.k8s.io | |
| labels: | |
| app: certmanager | |
| chart: certmanager | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| additionalPrinterColumns: | |
| - JSONPath: .status.state | |
| name: State | |
| type: string | |
| - JSONPath: .spec.issuerRef.name | |
| name: Issuer | |
| type: string | |
| priority: 1 | |
| - JSONPath: .status.reason | |
| name: Reason | |
| type: string | |
| priority: 1 | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| group: certmanager.k8s.io | |
| version: v1alpha1 | |
| names: | |
| kind: Order | |
| plural: orders | |
| scope: Namespaced | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: challenges.certmanager.k8s.io | |
| labels: | |
| app: certmanager | |
| chart: certmanager | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| additionalPrinterColumns: | |
| - JSONPath: .status.state | |
| name: State | |
| type: string | |
| - JSONPath: .spec.dnsName | |
| name: Domain | |
| type: string | |
| - JSONPath: .status.reason | |
| name: Reason | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| group: certmanager.k8s.io | |
| version: v1alpha1 | |
| names: | |
| kind: Challenge | |
| plural: challenges | |
| scope: Namespaced | |
| --- | |
| # Source: istio/charts/galley/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-galley-configuration | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| data: | |
| validatingwebhookconfiguration.yaml: |- | |
| apiVersion: admissionregistration.k8s.io/v1beta1 | |
| kind: ValidatingWebhookConfiguration | |
| metadata: | |
| name: istio-galley | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| webhooks: | |
| - name: pilot.validation.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-galley | |
| namespace: istio-system | |
| path: "/admitpilot" | |
| caBundle: "" | |
| rules: | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - config.istio.io | |
| apiVersions: | |
| - v1alpha2 | |
| resources: | |
| - httpapispecs | |
| - httpapispecbindings | |
| - quotaspecs | |
| - quotaspecbindings | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - rbac.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - "*" | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - authentication.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - "*" | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - networking.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - destinationrules | |
| - envoyfilters | |
| - gateways | |
| - serviceentries | |
| - sidecars | |
| - virtualservices | |
| failurePolicy: Fail | |
| sideEffects: None | |
| - name: mixer.validation.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-galley | |
| namespace: istio-system | |
| path: "/admitmixer" | |
| caBundle: "" | |
| rules: | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - config.istio.io | |
| apiVersions: | |
| - v1alpha2 | |
| resources: | |
| - rules | |
| - attributemanifests | |
| - circonuses | |
| - deniers | |
| - fluentds | |
| - kubernetesenvs | |
| - listcheckers | |
| - memquotas | |
| - noops | |
| - opas | |
| - prometheuses | |
| - rbacs | |
| - solarwindses | |
| - stackdrivers | |
| - cloudwatches | |
| - dogstatsds | |
| - statsds | |
| - stdios | |
| - apikeys | |
| - authorizations | |
| - checknothings | |
| # - kuberneteses | |
| - listentries | |
| - logentries | |
| - metrics | |
| - quotas | |
| - reportnothings | |
| - tracespans | |
| - adapters | |
| - handlers | |
| - instances | |
| - templates | |
| - zipkins | |
| failurePolicy: Fail | |
| sideEffects: None | |
| --- | |
| # Source: istio/charts/prometheus/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| data: | |
| prometheus.yml: |- | |
| global: | |
| scrape_interval: 5s | |
| scrape_configs: | |
| - job_name: 'istio-mesh' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;prometheus | |
| # Scrape config for envoy stats | |
| - job_name: 'envoy-stats' | |
| metrics_path: /stats/prometheus | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_container_port_name] | |
| action: keep | |
| regex: '.*-envoy-prom' | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:15090 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| metric_relabel_configs: | |
| # Exclude some of the envoy metrics that have massive cardinality | |
| # This list may need to be pruned further moving forward, as informed | |
| # by performance and scalability testing. | |
| - source_labels: [ cluster_name ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ tcp_prefix ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ listener_address ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_listener_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tls.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tcp_downstream.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_http_(stats|admin).*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_cluster_(lb|retry|bind|internal|max|original).*' | |
| action: drop | |
| - job_name: 'istio-policy' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-policy;http-monitoring | |
| - job_name: 'istio-telemetry' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;http-monitoring | |
| - job_name: 'pilot' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-pilot;http-monitoring | |
| - job_name: 'galley' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-galley;http-monitoring | |
| - job_name: 'citadel' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-citadel;http-monitoring | |
| # scrape config for API servers | |
| - job_name: 'kubernetes-apiservers' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - default | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: kubernetes;https | |
| # scrape config for nodes (kubelet) | |
| - job_name: 'kubernetes-nodes' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics | |
| # Scrape config for Kubelet cAdvisor. | |
| # | |
| # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics | |
| # (those whose names begin with 'container_') have been removed from the | |
| # Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to | |
| # retrieve those metrics. | |
| # | |
| # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor | |
| # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics" | |
| # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with | |
| # the --cadvisor-port=0 Kubelet flag). | |
| # | |
| # This job is not necessary and should be removed in Kubernetes 1.6 and | |
| # earlier versions, or it will cause the metrics to be scraped twice. | |
| - job_name: 'kubernetes-cadvisor' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor | |
| # scrape config for service endpoints. | |
| - job_name: 'kubernetes-service-endpoints' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme] | |
| action: replace | |
| target_label: __scheme__ | |
| regex: (https?) | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port] | |
| action: replace | |
| target_label: __address__ | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| - action: labelmap | |
| regex: __meta_kubernetes_service_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: kubernetes_namespace | |
| - source_labels: [__meta_kubernetes_service_name] | |
| action: replace | |
| target_label: kubernetes_name | |
| - job_name: 'kubernetes-pods' | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: # If first two labels are present, pod should be scraped by the istio-secure job. | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| # Keep target if there's no sidecar or if prometheus.io/scheme is explicitly set to "http" | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_prometheus_io_scheme] | |
| action: keep | |
| regex: ((;.*)|(.*;http)) | |
| - source_labels: [__meta_kubernetes_pod_annotation_istio_mtls] | |
| action: drop | |
| regex: (true) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| - job_name: 'kubernetes-pods-istio-secure' | |
| scheme: https | |
| tls_config: | |
| ca_file: /etc/istio-certs/root-cert.pem | |
| cert_file: /etc/istio-certs/cert-chain.pem | |
| key_file: /etc/istio-certs/key.pem | |
| insecure_skip_verify: true # prometheus does not support secure naming. | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| # sidecar status annotation is added by sidecar injector and | |
| # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic. | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls] | |
| action: keep | |
| regex: (([^;]+);([^;]*))|(([^;]*);(true)) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scheme] | |
| action: drop | |
| regex: (http) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__] # Only keep address that is host:port | |
| action: keep # otherwise an extra target with ':443' is added for https scheme | |
| regex: ([^:]+):(\d+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| --- | |
| # Source: istio/charts/security/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-security-custom-resources | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| data: | |
| custom-resources.yaml: |- | |
| # Authentication policy to enable permissive mode for all services (that have sidecar) in the mesh. | |
| apiVersion: "authentication.istio.io/v1alpha1" | |
| kind: "MeshPolicy" | |
| metadata: | |
| name: "default" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| peers: | |
| - mtls: | |
| mode: PERMISSIVE | |
| run.sh: |- | |
| #!/bin/sh | |
| set -x | |
| if [ "$#" -ne "1" ]; then | |
| echo "first argument should be path to custom resource yaml" | |
| exit 1 | |
| fi | |
| pathToResourceYAML=${1} | |
| kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null | |
| if [ "$?" -eq 0 ]; then | |
| echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready" | |
| while true; do | |
| kubectl -n istio-system get deployment istio-galley 2>/dev/null | |
| if [ "$?" -eq 0 ]; then | |
| break | |
| fi | |
| sleep 1 | |
| done | |
| kubectl -n istio-system rollout status deployment istio-galley | |
| if [ "$?" -ne 0 ]; then | |
| echo "istio-galley deployment rollout status check failed" | |
| exit 1 | |
| fi | |
| echo "istio-galley deployment ready for configuration validation" | |
| fi | |
| sleep 5 | |
| kubectl apply -f ${pathToResourceYAML} | |
| --- | |
| # Source: istio/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio | |
| namespace: istio-system | |
| labels: | |
| app: istio | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| data: | |
| mesh: |- | |
| # Set the following variable to true to disable policy checks by the Mixer. | |
| # Note that metrics will still be reported to the Mixer. | |
| disablePolicyChecks: false | |
| # Set enableTracing to false to disable request tracing. | |
| enableTracing: true | |
| # Set accessLogFile to empty string to disable access log. | |
| accessLogFile: "/dev/stdout" | |
| # If accessLogEncoding is TEXT, value will be used directly as the log format | |
| # example: "[%START_TIME%] %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\n" | |
| # If AccessLogEncoding is JSON, value will be parsed as map[string]string | |
| # example: '{"start_time": "%START_TIME%", "req_method": "%REQ(:METHOD)%"}' | |
| # Leave empty to use default log format | |
| accessLogFormat: "" | |
| # Set accessLogEncoding to JSON or TEXT to configure sidecar access log | |
| accessLogEncoding: 'TEXT' | |
| mixerCheckServer: istio-policy.istio-system.svc.cluster.local:9091 | |
| mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:9091 | |
| # policyCheckFailOpen allows traffic in cases when the mixer policy service cannot be reached. | |
| # Default is false which means the traffic is denied when the client is unable to connect to Mixer. | |
| policyCheckFailOpen: false | |
| # Let Pilot give ingresses the public IP of the Istio ingressgateway | |
| ingressService: istio-ingressgateway | |
| # Default connect timeout for dynamic clusters generated by Pilot and returned via XDS | |
| connectTimeout: 10s | |
| # DNS refresh rate for Envoy clusters of type STRICT_DNS | |
| dnsRefreshRate: 5s | |
| # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get | |
| # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty. | |
| sdsUdsPath: | |
| # This flag is used by secret discovery service(SDS). | |
| # If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount | |
| # for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which | |
| # will be used to generate key/cert eventually. This isn't supported for non-k8s case. | |
| enableSdsTokenMount: false | |
| # This flag is used by secret discovery service(SDS). | |
| # If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token' | |
| # (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod) | |
| # and pass to sds server, which will be used to request key/cert eventually. | |
| # this flag is ignored if enableSdsTokenMount is set. | |
| # This isn't supported for non-k8s case. | |
| sdsUseK8sSaJwt: false | |
| # The trust domain corresponds to the trust root of a system. | |
| # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain | |
| trustDomain: | |
| # Set the default behavior of the sidecar for handling outbound traffic from the application: | |
| # ALLOW_ANY - outbound traffic to unknown destinations will be allowed, in case there are no | |
| # services or ServiceEntries for the destination port | |
| # REGISTRY_ONLY - restrict outbound traffic to services defined in the service registry as well | |
| # as those defined through ServiceEntries | |
| outboundTrafficPolicy: | |
| mode: REGISTRY_ONLY | |
| localityLbSetting: | |
| {} | |
| # The namespace to treat as the administrative root namespace for istio | |
| # configuration. | |
| rootNamespace: istio-system | |
| configSources: | |
| - address: istio-galley.istio-system.svc:9901 | |
| defaultConfig: | |
| # | |
| # TCP connection timeout between Envoy & the application, and between Envoys. Used for static clusters | |
| # defined in Envoy's configuration file | |
| connectTimeout: 10s | |
| # | |
| ### ADVANCED SETTINGS ############# | |
| # Where should envoy's configuration be stored in the istio-proxy container | |
| configPath: "/etc/istio/proxy" | |
| binaryPath: "/usr/local/bin/envoy" | |
| # The pseudo service name used for Envoy. | |
| serviceCluster: istio-proxy | |
| # These settings that determine how long an old Envoy | |
| # process should be kept alive after an occasional reload. | |
| drainDuration: 45s | |
| parentShutdownDuration: 1m0s | |
| # | |
| # The mode used to redirect inbound connections to Envoy. This setting | |
| # has no effect on outbound traffic: iptables REDIRECT is always used for | |
| # outbound connections. | |
| # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy. | |
| # The "REDIRECT" mode loses source addresses during redirection. | |
| # If "TPROXY", use iptables TPROXY to redirect to Envoy. | |
| # The "TPROXY" mode preserves both the source and destination IP | |
| # addresses and ports, so that they can be used for advanced filtering | |
| # and manipulation. | |
| # The "TPROXY" mode also configures the sidecar to run with the | |
| # CAP_NET_ADMIN capability, which is required to use TPROXY. | |
| #interceptionMode: REDIRECT | |
| # | |
| # Port where Envoy listens (on local host) for admin commands | |
| # You can exec into the istio-proxy container in a pod and | |
| # curl the admin port (curl http://localhost:15000/) to obtain | |
| # diagnostic information from Envoy. See | |
| # https://lyft.github.io/envoy/docs/operations/admin.html | |
| # for more details | |
| proxyAdminPort: 15000 | |
| # | |
| # Set concurrency to a specific number to control the number of Proxy worker threads. | |
| # If set to 0 (default), then start worker thread for each CPU thread/core. | |
| concurrency: 0 | |
| # | |
| tracing: | |
| zipkin: | |
| # Address of the Zipkin collector | |
| address: zipkin.istio-system:9411 | |
| # | |
| # Mutual TLS authentication between sidecars and istio control plane. | |
| controlPlaneAuthPolicy: NONE | |
| # | |
| # Address where istio Pilot service is running | |
| discoveryAddress: istio-pilot.istio-system:15010 | |
| # Configuration file for the mesh networks to be used by the Split Horizon EDS. | |
| meshNetworks: |- | |
| networks: {} | |
| --- | |
| # Source: istio/templates/sidecar-injector-configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: istio | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| data: | |
| values: |- | |
| {"certmanager":{"enabled":false},"galley":{"enabled":true,"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"image":"galley","nodeSelector":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"replicaCount":1},"gateways":{"enabled":true,"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"istio-egressgateway":{"autoscaleEnabled":true,"autoscaleMax":1,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":true,"env":{"ISTIO_META_ROUTER_MODE":"sni-dnat"},"labels":{"app":"istio-egressgateway","istio":"egressgateway"},"nodeSelector":{},"podAnnotations":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"ports":[{"name":"http2","port":80},{"name":"https","port":443},{"name":"tls","port":15443,"targetPort":15443}],"resources":{"limits":{"cpu":"100m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"secretVolumes":[{"mountPath":"/etc/istio/egressgateway-certs","name":"egressgateway-certs","secretName":"istio-egressgateway-certs"},{"mountPath":"/etc/istio/egressgateway-ca-certs","name":"egressgateway-ca-certs","secretName":"istio-egressgateway-ca-certs"}],"serviceAnnotations":{},"type":"ClusterIP"},"istio-ilbgateway":{"autoscaleEnabled":true,"autoscaleMax":5,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":false,"labels":{"app":"istio-ilbgateway","istio":"ilbgateway"},"loadBalancerIP":"","nodeSelector":{},"podAnnotations":{},"ports":[{"name":"grpc-pilot-mtls","port":15011},{"name":"grpc-pilot","port":15010},{"name":"tcp-citadel-grpc-tls","port":8060,"targetPort":8060},{"name":"tcp-dns","port":5353}],"resources":{"requests":{"cpu":"800m","memory":"512Mi"}},"secretVolumes":[{"mountPath":"/etc/istio/ilbgateway-certs","name":"ilbgateway-certs","secretName":"istio-ilbgateway-certs"},{"mountPath":"/etc/istio/ilbgateway-ca-certs","name":"ilbgateway-ca-certs","secretName":"istio-ilbgateway-ca-certs"}],"serviceAnnotations":{"cloud.google.com/load-balancer-type":"internal"},"type":"LoadBalancer"},"istio-ingressgateway":{"autoscaleEnabled":true,"autoscaleMax":1,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":true,"env":{"ISTIO_META_ROUTER_MODE":"sni-dnat"},"externalIPs":[],"labels":{"app":"istio-ingressgateway","istio":"ingressgateway"},"loadBalancerIP":"","loadBalancerSourceRanges":[],"meshExpansionPorts":[{"name":"tcp-pilot-grpc-tls","port":15011,"targetPort":15011},{"name":"tcp-mixer-grpc-tls","port":15004,"targetPort":15004},{"name":"tcp-citadel-grpc-tls","port":8060,"targetPort":8060},{"name":"tcp-dns-tls","port":853,"targetPort":853}],"nodeSelector":{},"podAnnotations":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"ports":[{"name":"status-port","port":15020,"targetPort":15020},{"name":"http2","nodePort":31380,"port":80,"targetPort":80},{"name":"https","nodePort":31390,"port":443},{"name":"tcp","nodePort":31400,"port":31400},{"name":"https-kiali","port":15029,"targetPort":15029},{"name":"https-prometheus","port":15030,"targetPort":15030},{"name":"https-grafana","port":15031,"targetPort":15031},{"name":"https-tracing","port":15032,"targetPort":15032},{"name":"tls","port":15443,"targetPort":15443}],"resources":{"limits":{"cpu":"100m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"sds":{"enabled":false,"image":"node-agent-k8s"},"secretVolumes":[{"mountPath":"/etc/istio/ingressgateway-certs","name":"ingressgateway-certs","secretName":"istio-ingressgateway-certs"},{"mountPath":"/etc/istio/ingressgateway-ca-certs","name":"ingressgateway-ca-certs","secretName":"istio-ingressgateway-ca-certs"}],"serviceAnnotations":{},"type":"LoadBalancer"}},"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"grafana":{"enabled":false},"istio_cni":{"enabled":false},"istiocoredns":{"enabled":false},"kiali":{"enabled":false},"mixer":{"adapters":{"kubernetesenv":{"enabled":true},"prometheus":{"enabled":true,"metricsExpiryDuration":"10m"},"stdio":{"enabled":true,"outputAsJson":true},"useAdapterCRDs":false},"env":{"GODEBUG":"gctrace=1","GOMAXPROCS":"6"},"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"image":"mixer","kiali":{"enabled":true},"nodeSelector":{},"podAnnotations":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"policy":{"autoscaleEnabled":false,"autoscaleMax":5,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":true,"replicaCount":2,"resources":{"limits":{"cpu":"100m","memory":"100Mi"},"requests":{"cpu":"10m","memory":"100Mi"}}},"telemetry":{"autoscaleEnabled":true,"autoscaleMax":5,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":true,"loadshedding":{"latencyThreshold":"100ms","mode":"disabled"},"replicaCount":1,"resources":{"limits":{"cpu":"100m","memory":"100Mi"},"requests":{"cpu":"50m","memory":"100Mi"}},"sessionAffinityEnabled":false}},"nodeagent":{"enabled":false},"pilot":{"autoscaleEnabled":true,"autoscaleMax":5,"autoscaleMin":1,"cpu":{"targetAverageUtilization":80},"enabled":true,"env":{"GODEBUG":"gctrace=1","PILOT_PUSH_THROTTLE":100},"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"image":"pilot","keepaliveMaxServerConnectionAge":"30m","nodeSelector":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"resources":{"requests":{"cpu":"500m","memory":"2048Mi"}},"sidecar":true,"traceSampling":1},"prometheus":{"contextPath":"/prometheus","enabled":true,"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"hub":"docker.io/prom","ingress":{"annotations":null,"enabled":false,"hosts":["prometheus.local"],"tls":null},"nodeSelector":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"replicaCount":1,"retention":"6h","scrapeInterval":"5s","security":{"enabled":true},"service":{"annotations":{},"nodePort":{"enabled":false,"port":32090}},"tag":"v2.8.0"},"security":{"createMeshPolicy":true,"enabled":true,"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"image":"citadel","nodeSelector":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"selfSigned":true},"sidecarInjectorWebhook":{"enableNamespacesByDefault":false,"enabled":true,"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"configValidation":true,"controlPlaneSecurityEnabled":false,"defaultNodeSelector":{},"defaultPodDisruptionBudget":{"enabled":true},"defaultResources":{"requests":{"cpu":"10m"}},"disablePolicyChecks":false,"enableHelmTest":false,"enableTracing":true,"hub":"docker.io/jamesroper","imagePullPolicy":"IfNotPresent","imagePullSecrets":null,"k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{},"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"monitoringPort":15014,"mtls":{"enabled":false},"multiCluster":{"enabled":false},"oneNamespace":false,"outboundTrafficPolicy":{"mode":"REGISTRY_ONLY"},"policyCheckFailOpen":false,"priorityClassName":"","proxy":{"accessLogEncoding":"TEXT","accessLogFile":"/dev/stdout","accessLogFormat":"","autoInject":"enabled","clusterDomain":"cluster.local","componentLogLevel":"","concurrency":0,"dnsRefreshRate":"5s","enableCoreDump":false,"envoyMetricsService":{"enabled":false,"host":null,"port":null},"envoyStatsd":{"enabled":false,"host":null,"port":null},"excludeIPRanges":"","excludeInboundPorts":"","excludeOutboundPorts":"","image":"proxyv2","includeIPRanges":"*","includeInboundPorts":"*","kubevirtInterfaces":"","logLevel":"","privileged":false,"readinessFailureThreshold":30,"readinessInitialDelaySeconds":1,"readinessPeriodSeconds":2,"resources":{"limits":{"cpu":"2000m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"40Mi"}},"statusPort":15020,"tracer":"zipkin"},"proxy_init":{"image":"proxy_init"},"sds":{"enabled":false,"udsPath":"","useNormalJwt":false,"useTrustworthyJwt":false},"tag":"1.2-alpha-3a243984-outbound-port-exclusions","tracer":{"datadog":{"address":"$(HOST_IP):8126"},"lightstep":{"accessToken":"","address":"","cacertPath":"","secure":true},"zipkin":{"address":""}},"trustDomain":"","useMCP":true},"image":"sidecar_injector","nodeSelector":{},"podAntiAffinityLabelSelector":[],"podAntiAffinityTermLabelSelector":[],"replicaCount":1,"rewriteAppHTTPProbe":false},"tracing":{"enabled":false}} | |
| config: |- | |
| policy: enabled | |
| template: |- | |
| rewriteAppHTTPProbe: {{ valueOrDefault .Values.sidecarInjectorWebhook.rewriteAppHTTPProbe false }} | |
| {{- if or (not .Values.istio_cni.enabled) .Values.global.proxy.enableCoreDump }} | |
| initContainers: | |
| {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }} | |
| {{- if not .Values.istio_cni.enabled }} | |
| - name: istio-init | |
| {{- if contains "/" .Values.global.proxy_init.image }} | |
| image: "{{ .Values.global.proxy_init.image }}" | |
| {{- else }} | |
| image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}" | |
| {{- end }} | |
| args: | |
| - "-p" | |
| - "{{ .MeshConfig.ProxyListenPort }}" | |
| - "-u" | |
| - 1337 | |
| - "-m" | |
| - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}" | |
| - "-i" | |
| - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}" | |
| - "-x" | |
| - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}" | |
| - "-b" | |
| - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (includeInboundPorts .Spec.Containers) }}" | |
| - "-d" | |
| - "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}" | |
| {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") -}} | |
| - "-o" | |
| - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}" | |
| {{ end -}} | |
| {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}} | |
| - "-k" | |
| - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}" | |
| {{ end -}} | |
| imagePullPolicy: "{{ .Values.global.imagePullPolicy }}" | |
| resources: | |
| requests: | |
| cpu: 10m | |
| memory: 10Mi | |
| limits: | |
| cpu: 100m | |
| memory: 50Mi | |
| securityContext: | |
| runAsUser: 0 | |
| runAsNonRoot: false | |
| capabilities: | |
| add: | |
| - NET_ADMIN | |
| {{- if .Values.global.proxy.privileged }} | |
| privileged: true | |
| {{- end }} | |
| restartPolicy: Always | |
| env: | |
| {{- if contains "*" (annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` "") }} | |
| - name: INBOUND_CAPTURE_PORT | |
| value: 15006 | |
| {{- end }} | |
| {{- end }} | |
| {{ end -}} | |
| {{- if eq .Values.global.proxy.enableCoreDump true }} | |
| - name: enable-core-dump | |
| args: | |
| - -c | |
| - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited | |
| command: | |
| - /bin/sh | |
| {{- if contains "/" .Values.global.proxy_init.image }} | |
| image: "{{ .Values.global.proxy_init.image }}" | |
| {{- else }} | |
| image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}" | |
| {{- end }} | |
| imagePullPolicy: IfNotPresent | |
| resources: {} | |
| securityContext: | |
| runAsUser: 0 | |
| runAsNonRoot: false | |
| privileged: true | |
| {{ end }} | |
| {{- end }} | |
| containers: | |
| - name: istio-proxy | |
| {{- if contains "/" .Values.global.proxy.image }} | |
| image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" | |
| {{- else }} | |
| image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}" | |
| {{- end }} | |
| ports: | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - sidecar | |
| - --domain | |
| - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} | |
| - --configPath | |
| - "{{ .ProxyConfig.ConfigPath }}" | |
| - --binaryPath | |
| - "{{ .ProxyConfig.BinaryPath }}" | |
| - --serviceCluster | |
| {{ if ne "" (index .ObjectMeta.Labels "app") -}} | |
| - "{{ index .ObjectMeta.Labels `app` }}.$(POD_NAMESPACE)" | |
| {{ else -}} | |
| - "{{ valueOrDefault .DeploymentMeta.Name `istio-proxy` }}.{{ valueOrDefault .DeploymentMeta.Namespace `default` }}" | |
| {{ end -}} | |
| - --drainDuration | |
| - "{{ formatDuration .ProxyConfig.DrainDuration }}" | |
| - --parentShutdownDuration | |
| - "{{ formatDuration .ProxyConfig.ParentShutdownDuration }}" | |
| - --discoveryAddress | |
| - "{{ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress }}" | |
| {{- if eq .Values.global.proxy.tracer "lightstep" }} | |
| - --lightstepAddress | |
| - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAddress }}" | |
| - --lightstepAccessToken | |
| - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAccessToken }}" | |
| - --lightstepSecure={{ .ProxyConfig.GetTracing.GetLightstep.GetSecure }} | |
| - --lightstepCacertPath | |
| - "{{ .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }}" | |
| {{- else if eq .Values.global.proxy.tracer "zipkin" }} | |
| - --zipkinAddress | |
| - "{{ .ProxyConfig.GetTracing.GetZipkin.GetAddress }}" | |
| {{- else if eq .Values.global.proxy.tracer "datadog" }} | |
| - --datadogAgentAddress | |
| - "{{ .ProxyConfig.GetTracing.GetDatadog.GetAddress }}" | |
| {{- end }} | |
| {{- if .Values.global.proxy.logLevel }} | |
| - --proxyLogLevel={{ .Values.global.proxy.logLevel }} | |
| {{- end}} | |
| {{- if .Values.global.proxy.componentLogLevel }} | |
| - --proxyComponentLogLevel={{ .Values.global.proxy.componentLogLevel }} | |
| {{- end}} | |
| - --dnsRefreshRate | |
| - {{ .Values.global.proxy.dnsRefreshRate }} | |
| - --connectTimeout | |
| - "{{ formatDuration .ProxyConfig.ConnectTimeout }}" | |
| {{- if .Values.global.proxy.envoyStatsd.enabled }} | |
| - --statsdUdpAddress | |
| - "{{ .ProxyConfig.StatsdUdpAddress }}" | |
| {{- end }} | |
| {{- if .Values.global.proxy.envoyMetricsService.enabled }} | |
| - --envoyMetricsServiceAddress | |
| - "{{ .ProxyConfig.EnvoyMetricsServiceAddress }}" | |
| {{- end }} | |
| - --proxyAdminPort | |
| - "{{ .ProxyConfig.ProxyAdminPort }}" | |
| {{ if gt .ProxyConfig.Concurrency 0 -}} | |
| - --concurrency | |
| - "{{ .ProxyConfig.Concurrency }}" | |
| {{ end -}} | |
| - --controlPlaneAuthPolicy | |
| - "{{ annotation .ObjectMeta `sidecar.istio.io/controlPlaneAuthPolicy` .ProxyConfig.ControlPlaneAuthPolicy }}" | |
| {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }} | |
| - --statusPort | |
| - "{{ annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort }}" | |
| - --applicationPorts | |
| - "{{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/applicationPorts` (applicationPorts .Spec.Containers) }}" | |
| {{- end }} | |
| {{- if .Values.global.trustDomain }} | |
| - --trust-domain={{ .Values.global.trustDomain }} | |
| {{- end }} | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: status.podIP | |
| {{ if eq .Values.global.proxy.tracer "datadog" }} | |
| - name: HOST_IP | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: status.hostIP | |
| {{ end }} | |
| - name: ISTIO_META_POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: ISTIO_META_CONFIG_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: ISTIO_META_INTERCEPTION_MODE | |
| value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}" | |
| - name: ISTIO_META_INCLUDE_INBOUND_PORTS | |
| value: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (applicationPorts .Spec.Containers) }}" | |
| {{- if .Values.global.network }} | |
| - name: ISTIO_META_NETWORK | |
| value: "{{ .Values.global.network }}" | |
| {{- end }} | |
| {{ if .ObjectMeta.Annotations }} | |
| - name: ISTIO_METAJSON_ANNOTATIONS | |
| value: | | |
| {{ toJSON .ObjectMeta.Annotations }} | |
| {{ end }} | |
| {{ if .ObjectMeta.Labels }} | |
| - name: ISTIO_METAJSON_LABELS | |
| value: | | |
| {{ toJSON .ObjectMeta.Labels }} | |
| {{ end }} | |
| {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} | |
| - name: ISTIO_BOOTSTRAP_OVERRIDE | |
| value: "/etc/istio/custom-bootstrap/custom_bootstrap.json" | |
| {{- end }} | |
| {{- if .Values.global.sds.customTokenDirectory }} | |
| - name: ISTIO_META_SDS_TOKEN_PATH | |
| value: "{{ .Values.global.sds.customTokenDirectory -}}/sdstoken" | |
| {{- end }} | |
| imagePullPolicy: {{ .Values.global.imagePullPolicy }} | |
| {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }} | |
| readinessProbe: | |
| httpGet: | |
| path: /healthz/ready | |
| port: {{ annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort }} | |
| initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }} | |
| periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }} | |
| failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }} | |
| {{ end -}} | |
| securityContext: | |
| {{- if .Values.global.proxy.privileged }} | |
| privileged: true | |
| {{- end }} | |
| {{- if ne .Values.global.proxy.enableCoreDump true }} | |
| readOnlyRootFilesystem: true | |
| {{- end }} | |
| {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}} | |
| capabilities: | |
| add: | |
| - NET_ADMIN | |
| runAsGroup: 1337 | |
| {{ else -}} | |
| {{ if and .Values.global.sds.enabled .Values.global.sds.useTrustworthyJwt }} | |
| runAsGroup: 1337 | |
| {{- end }} | |
| runAsUser: 1337 | |
| {{- end }} | |
| resources: | |
| {{ if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} | |
| requests: | |
| {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}} | |
| cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}" | |
| {{ end}} | |
| {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} | |
| memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}" | |
| {{ end }} | |
| {{ else -}} | |
| {{- if .Values.global.proxy.resources }} | |
| {{ toYaml .Values.global.proxy.resources | indent 4 }} | |
| {{- end }} | |
| {{ end -}} | |
| volumeMounts: | |
| {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} | |
| - mountPath: /etc/istio/custom-bootstrap | |
| name: custom-bootstrap-volume | |
| {{- end }} | |
| - mountPath: /etc/istio/proxy | |
| name: istio-envoy | |
| {{- if .Values.global.sds.enabled }} | |
| - mountPath: /var/run/sds/uds_path | |
| name: sds-uds-path | |
| readOnly: true | |
| {{- if .Values.global.sds.useTrustworthyJwt }} | |
| - mountPath: /var/run/secrets/tokens | |
| name: istio-token | |
| {{- end }} | |
| {{- if .Values.global.sds.customTokenDirectory }} | |
| - mountPath: "{{ .Values.global.sds.customTokenDirectory -}}" | |
| name: custom-sds-token | |
| readOnly: true | |
| {{- end }} | |
| {{- else }} | |
| - mountPath: /etc/certs/ | |
| name: istio-certs | |
| readOnly: true | |
| {{- end }} | |
| {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }} | |
| - mountPath: {{ directory .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }} | |
| name: lightstep-certs | |
| readOnly: true | |
| {{- end }} | |
| {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }} | |
| {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }} | |
| - name: "{{ $index }}" | |
| {{ toYaml $value | indent 4 }} | |
| {{ end }} | |
| {{- end }} | |
| volumes: | |
| {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} | |
| - name: custom-bootstrap-volume | |
| configMap: | |
| name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }} | |
| {{- end }} | |
| - emptyDir: | |
| medium: Memory | |
| name: istio-envoy | |
| {{- if .Values.global.sds.enabled }} | |
| - name: sds-uds-path | |
| hostPath: | |
| path: /var/run/sds/uds_path | |
| type: Socket | |
| {{- if .Values.global.sds.customTokenDirectory }} | |
| - name: custom-sds-token | |
| secret: | |
| secretName: sdstokensecret | |
| {{- end }} | |
| {{- if .Values.global.sds.useTrustworthyJwt }} | |
| - name: istio-token | |
| projected: | |
| sources: | |
| - serviceAccountToken: | |
| path: istio-token | |
| expirationSeconds: 43200 | |
| audience: {{ .Values.global.trustDomain }} | |
| {{- end }} | |
| {{- else }} | |
| - name: istio-certs | |
| secret: | |
| optional: true | |
| {{ if eq .Spec.ServiceAccountName "" }} | |
| secretName: istio.default | |
| {{ else -}} | |
| secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }} | |
| {{ end -}} | |
| {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }} | |
| {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }} | |
| - name: "{{ $index }}" | |
| {{ toYaml $value | indent 2 }} | |
| {{ end }} | |
| {{ end }} | |
| {{- end }} | |
| {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }} | |
| - name: lightstep-certs | |
| secret: | |
| optional: true | |
| secretName: lightstep.cacert | |
| {{- end }} | |
| {{- if .Values.global.podDNSSearchNamespaces }} | |
| dnsConfig: | |
| searches: | |
| {{- range .Values.global.podDNSSearchNamespaces }} | |
| - {{ render . }} | |
| {{- end }} | |
| {{- end }} | |
| --- | |
| # Source: istio/charts/galley/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-galley-service-account | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/gateways/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-egressgateway-service-account | |
| namespace: istio-system | |
| labels: | |
| app: istio-egressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-ingressgateway-service-account | |
| namespace: istio-system | |
| labels: | |
| app: istio-ingressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-mixer-service-account | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/pilot/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-pilot-service-account | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/prometheus/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/security/templates/cleanup-secrets.yaml | |
| # The reason for creating a ServiceAccount and ClusterRole specifically for this | |
| # post-delete hooked job is because the citadel ServiceAccount is being deleted | |
| # before this hook is launched. On the other hand, running this hook before the | |
| # deletion of the citadel (e.g. pre-delete) won't delete the secrets because they | |
| # will be re-created immediately by the to-be-deleted citadel. | |
| # | |
| # It's also important that the ServiceAccount, ClusterRole and ClusterRoleBinding | |
| # will be ready before running the hooked Job therefore the hook weights. | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-cleanup-secrets-service-account | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "1" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-cleanup-secrets-istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "1" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["list", "delete"] | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-cleanup-secrets-istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "2" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-cleanup-secrets-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-cleanup-secrets-service-account | |
| namespace: istio-system | |
| --- | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| name: istio-cleanup-secrets-1.2-alpha-3a243984-outbound-port | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "3" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| template: | |
| metadata: | |
| name: istio-cleanup-secrets | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| serviceAccountName: istio-cleanup-secrets-service-account | |
| containers: | |
| - name: kubectl | |
| image: "docker.io/jamesroper/kubectl:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| command: | |
| - /bin/bash | |
| - -c | |
| - > | |
| kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" | while read -r entry; do | |
| ns=$(echo $entry | awk '{print $1}'); | |
| name=$(echo $entry | awk '{print $2}'); | |
| kubectl delete secret $name -n $ns; | |
| done | |
| restartPolicy: OnFailure | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/create-custom-resources-job.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-security-post-install-account | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-security-post-install-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["authentication.istio.io"] # needed to create default authn policy | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["networking.istio.io"] # needed to create security destination rules | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["validatingwebhookconfigurations"] | |
| verbs: ["get"] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["deployments", "replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-security-post-install-role-binding-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-security-post-install-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-security-post-install-account | |
| namespace: istio-system | |
| --- | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| name: istio-security-post-install-1.2-alpha-3a243984-outbound-port | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-install | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| template: | |
| metadata: | |
| name: istio-security-post-install | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| serviceAccountName: istio-security-post-install-account | |
| containers: | |
| - name: kubectl | |
| image: "docker.io/jamesroper/kubectl:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ] | |
| volumeMounts: | |
| - mountPath: "/tmp/security" | |
| name: tmp-configmap-security | |
| volumes: | |
| - name: tmp-configmap-security | |
| configMap: | |
| name: istio-security-custom-resources | |
| restartPolicy: OnFailure | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-citadel-service-account | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-sidecar-injector-service-account | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| --- | |
| # Source: istio/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-multi | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/galley/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-galley-istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["validatingwebhookconfigurations"] | |
| verbs: ["*"] | |
| - apiGroups: ["config.istio.io"] # istio mixer CRD watcher | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["networking.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["authentication.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["rbac.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions","apps"] | |
| resources: ["deployments"] | |
| resourceNames: ["istio-galley"] | |
| verbs: ["get"] | |
| - apiGroups: [""] | |
| resources: ["pods", "nodes", "services", "endpoints"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions"] | |
| resources: ["ingresses"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions"] | |
| resources: ["deployments/finalizers"] | |
| resourceNames: ["istio-galley"] | |
| verbs: ["update"] | |
| --- | |
| # Source: istio/charts/mixer/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-mixer-istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["config.istio.io"] # istio CRD watcher | |
| resources: ["*"] | |
| verbs: ["create", "get", "list", "watch", "patch"] | |
| - apiGroups: ["apiextensions.k8s.io"] | |
| resources: ["customresourcedefinitions"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: [""] | |
| resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets", "replicationcontrollers"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/pilot/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-pilot-istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["config.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["rbac.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "watch", "list"] | |
| - apiGroups: ["networking.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["authentication.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["apiextensions.k8s.io"] | |
| resources: ["customresourcedefinitions"] | |
| verbs: ["*"] | |
| - apiGroups: ["extensions"] | |
| resources: ["ingresses", "ingresses/status"] | |
| verbs: ["*"] | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["create", "get", "list", "watch", "update"] | |
| - apiGroups: [""] | |
| resources: ["endpoints", "pods", "services", "namespaces", "nodes", "secrets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/prometheus/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: prometheus-istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| - services | |
| - endpoints | |
| - pods | |
| - nodes/proxy | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: [""] | |
| resources: | |
| - configmaps | |
| verbs: ["get"] | |
| - nonResourceURLs: ["/metrics"] | |
| verbs: ["get"] | |
| --- | |
| # Source: istio/charts/security/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-citadel-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["create", "get", "update"] | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["create", "get", "watch", "list", "update", "delete"] | |
| - apiGroups: [""] | |
| resources: ["serviceaccounts", "services"] | |
| verbs: ["get", "watch", "list"] | |
| - apiGroups: ["authentication.k8s.io"] | |
| resources: ["tokenreviews"] | |
| verbs: ["create"] | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-sidecar-injector-istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["mutatingwebhookconfigurations"] | |
| verbs: ["get", "list", "watch", "patch"] | |
| --- | |
| # Source: istio/templates/clusterrole.yaml | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| name: istio-reader | |
| rules: | |
| - apiGroups: [''] | |
| resources: ['nodes', 'pods', 'services', 'endpoints', "replicationcontrollers"] | |
| verbs: ['get', 'watch', 'list'] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/galley/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-galley-admin-role-binding-istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-galley-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-galley-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/mixer/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-mixer-admin-role-binding-istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-mixer-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-mixer-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/pilot/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-pilot-istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-pilot-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-pilot-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/prometheus/templates/clusterrolebindings.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: prometheus-istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: prometheus-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: prometheus | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/security/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-citadel-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-citadel-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-citadel-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-sidecar-injector-admin-role-binding-istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-sidecar-injector-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-sidecar-injector-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-multi | |
| labels: | |
| chart: istio-1.1.0 | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-reader | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-multi | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/gateways/templates/role.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: Role | |
| metadata: | |
| name: istio-ingressgateway-sds | |
| namespace: istio-system | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["get", "watch", "list"] | |
| --- | |
| --- | |
| # Source: istio/charts/gateways/templates/rolebindings.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: RoleBinding | |
| metadata: | |
| name: istio-ingressgateway-sds | |
| namespace: istio-system | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: Role | |
| name: istio-ingressgateway-sds | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-ingressgateway-service-account | |
| --- | |
| --- | |
| # Source: istio/charts/galley/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| ports: | |
| - port: 443 | |
| name: https-validation | |
| - port: 15014 | |
| name: http-monitoring | |
| - port: 9901 | |
| name: grpc-mcp | |
| selector: | |
| istio: galley | |
| --- | |
| # Source: istio/charts/gateways/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-egressgateway | |
| namespace: istio-system | |
| annotations: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| spec: | |
| type: ClusterIP | |
| selector: | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| ports: | |
| - | |
| name: http2 | |
| port: 80 | |
| - | |
| name: https | |
| port: 443 | |
| - | |
| name: tls | |
| port: 15443 | |
| targetPort: 15443 | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| annotations: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| type: LoadBalancer | |
| selector: | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| ports: | |
| - | |
| name: status-port | |
| port: 15020 | |
| targetPort: 15020 | |
| - | |
| name: http2 | |
| nodePort: 31380 | |
| port: 80 | |
| targetPort: 80 | |
| - | |
| name: https | |
| nodePort: 31390 | |
| port: 443 | |
| - | |
| name: tcp | |
| nodePort: 31400 | |
| port: 31400 | |
| - | |
| name: https-kiali | |
| port: 15029 | |
| targetPort: 15029 | |
| - | |
| name: https-prometheus | |
| port: 15030 | |
| targetPort: 15030 | |
| - | |
| name: https-grafana | |
| port: 15031 | |
| targetPort: 15031 | |
| - | |
| name: https-tracing | |
| port: 15032 | |
| targetPort: 15032 | |
| - | |
| name: tls | |
| port: 15443 | |
| targetPort: 15443 | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| annotations: | |
| networking.istio.io/exportTo: "*" | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| ports: | |
| - name: grpc-mixer | |
| port: 9091 | |
| - name: grpc-mixer-mtls | |
| port: 15004 | |
| - name: http-monitoring | |
| port: 15014 | |
| selector: | |
| istio: mixer | |
| istio-mixer-type: policy | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| annotations: | |
| networking.istio.io/exportTo: "*" | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| ports: | |
| - name: grpc-mixer | |
| port: 9091 | |
| - name: grpc-mixer-mtls | |
| port: 15004 | |
| - name: http-monitoring | |
| port: 15014 | |
| - name: prometheus | |
| port: 42422 | |
| selector: | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| spec: | |
| ports: | |
| - port: 15010 | |
| name: grpc-xds # direct | |
| - port: 15011 | |
| name: https-xds # mTLS | |
| - port: 8080 | |
| name: http-legacy-discovery # direct | |
| - port: 15014 | |
| name: http-monitoring | |
| selector: | |
| istio: pilot | |
| --- | |
| # Source: istio/charts/prometheus/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| annotations: | |
| prometheus.io/scrape: 'true' | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| selector: | |
| app: prometheus | |
| ports: | |
| - name: http-prometheus | |
| protocol: TCP | |
| port: 9090 | |
| --- | |
| # Source: istio/charts/security/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| # we use the normal name here (e.g. 'prometheus') | |
| # as grafana is configured to use this as a data source | |
| name: istio-citadel | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| spec: | |
| ports: | |
| - name: grpc-citadel | |
| port: 8060 | |
| targetPort: 8060 | |
| protocol: TCP | |
| - name: http-monitoring | |
| port: 15014 | |
| selector: | |
| istio: citadel | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| spec: | |
| ports: | |
| - port: 443 | |
| selector: | |
| istio: sidecar-injector | |
| --- | |
| # Source: istio/charts/galley/templates/deployment.yaml | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| istio: galley | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-galley-service-account | |
| containers: | |
| - name: galley | |
| image: "docker.io/jamesroper/galley:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 443 | |
| - containerPort: 15014 | |
| - containerPort: 9901 | |
| command: | |
| - /usr/local/bin/galley | |
| - server | |
| - --meshConfigFile=/etc/mesh-config/mesh | |
| - --livenessProbeInterval=1s | |
| - --livenessProbePath=/healthliveness | |
| - --readinessProbePath=/healthready | |
| - --readinessProbeInterval=1s | |
| - --deployment-namespace=istio-system | |
| - --insecure=true | |
| - --validation-webhook-config-file | |
| - /etc/config/validatingwebhookconfiguration.yaml | |
| - --monitoringPort=15014 | |
| - --log_output_level=default:info | |
| volumeMounts: | |
| - name: certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: config | |
| mountPath: /etc/config | |
| readOnly: true | |
| - name: mesh-config | |
| mountPath: /etc/mesh-config | |
| readOnly: true | |
| livenessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/galley | |
| - probe | |
| - --probe-path=/healthliveness | |
| - --interval=10s | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/galley | |
| - probe | |
| - --probe-path=/healthready | |
| - --interval=10s | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumes: | |
| - name: certs | |
| secret: | |
| secretName: istio.istio-galley-service-account | |
| - name: config | |
| configMap: | |
| name: istio-galley-configuration | |
| - name: mesh-config | |
| configMap: | |
| name: istio | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/gateways/templates/deployment.yaml | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-egressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| template: | |
| metadata: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-egressgateway-service-account | |
| containers: | |
| - name: istio-proxy | |
| image: "docker.io/jamesroper/proxyv2:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 80 | |
| - containerPort: 443 | |
| - containerPort: 15443 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - router | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --log_output_level=default:info | |
| - --drainDuration | |
| - '45s' #drainDuration | |
| - --parentShutdownDuration | |
| - '1m0s' #parentShutdownDuration | |
| - --connectTimeout | |
| - '10s' #connectTimeout | |
| - --serviceCluster | |
| - istio-egressgateway | |
| - --zipkinAddress | |
| - zipkin:9411 | |
| - --proxyAdminPort | |
| - "15000" | |
| - --statusPort | |
| - "15020" | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| - --discoveryAddress | |
| - istio-pilot:15010 | |
| readinessProbe: | |
| failureThreshold: 30 | |
| httpGet: | |
| path: /healthz/ready | |
| port: 15020 | |
| scheme: HTTP | |
| initialDelaySeconds: 1 | |
| periodSeconds: 2 | |
| successThreshold: 1 | |
| timeoutSeconds: 1 | |
| resources: | |
| limits: | |
| cpu: 100m | |
| memory: 128Mi | |
| requests: | |
| cpu: 10m | |
| memory: 40Mi | |
| env: | |
| - name: NODE_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: spec.nodeName | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| - name: HOST_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.hostIP | |
| - name: ISTIO_META_POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: ISTIO_META_CONFIG_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: ISTIO_META_ROUTER_MODE | |
| value: sni-dnat | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: egressgateway-certs | |
| mountPath: "/etc/istio/egressgateway-certs" | |
| readOnly: true | |
| - name: egressgateway-ca-certs | |
| mountPath: "/etc/istio/egressgateway-ca-certs" | |
| readOnly: true | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-egressgateway-service-account | |
| optional: true | |
| - name: egressgateway-certs | |
| secret: | |
| secretName: "istio-egressgateway-certs" | |
| optional: true | |
| - name: egressgateway-ca-certs | |
| secret: | |
| secretName: "istio-egressgateway-ca-certs" | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| template: | |
| metadata: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-ingressgateway-service-account | |
| containers: | |
| - name: istio-proxy | |
| image: "docker.io/jamesroper/proxyv2:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15020 | |
| - containerPort: 80 | |
| - containerPort: 443 | |
| - containerPort: 31400 | |
| - containerPort: 15029 | |
| - containerPort: 15030 | |
| - containerPort: 15031 | |
| - containerPort: 15032 | |
| - containerPort: 15443 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - router | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --log_output_level=default:info | |
| - --drainDuration | |
| - '45s' #drainDuration | |
| - --parentShutdownDuration | |
| - '1m0s' #parentShutdownDuration | |
| - --connectTimeout | |
| - '10s' #connectTimeout | |
| - --serviceCluster | |
| - istio-ingressgateway | |
| - --zipkinAddress | |
| - zipkin:9411 | |
| - --proxyAdminPort | |
| - "15000" | |
| - --statusPort | |
| - "15020" | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| - --discoveryAddress | |
| - istio-pilot:15010 | |
| readinessProbe: | |
| failureThreshold: 30 | |
| httpGet: | |
| path: /healthz/ready | |
| port: 15020 | |
| scheme: HTTP | |
| initialDelaySeconds: 1 | |
| periodSeconds: 2 | |
| successThreshold: 1 | |
| timeoutSeconds: 1 | |
| resources: | |
| limits: | |
| cpu: 100m | |
| memory: 128Mi | |
| requests: | |
| cpu: 10m | |
| memory: 40Mi | |
| env: | |
| - name: NODE_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: spec.nodeName | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| - name: HOST_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.hostIP | |
| - name: ISTIO_META_POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: ISTIO_META_CONFIG_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: ISTIO_META_ROUTER_MODE | |
| value: sni-dnat | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: ingressgateway-certs | |
| mountPath: "/etc/istio/ingressgateway-certs" | |
| readOnly: true | |
| - name: ingressgateway-ca-certs | |
| mountPath: "/etc/istio/ingressgateway-ca-certs" | |
| readOnly: true | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-ingressgateway-service-account | |
| optional: true | |
| - name: ingressgateway-certs | |
| secret: | |
| secretName: "istio-ingressgateway-certs" | |
| optional: true | |
| - name: ingressgateway-ca-certs | |
| secret: | |
| secretName: "istio-ingressgateway-ca-certs" | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/deployment.yaml | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: istio-mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| replicas: 2 | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: mixer | |
| istio-mixer-type: policy | |
| template: | |
| metadata: | |
| labels: | |
| app: policy | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: policy | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-mixer-service-account | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-mixer-service-account | |
| optional: true | |
| - name: uds-socket | |
| emptyDir: {} | |
| - name: policy-adapter-secret | |
| secret: | |
| secretName: policy-adapter-secret | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| containers: | |
| - name: mixer | |
| image: "docker.io/jamesroper/mixer:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15014 | |
| - containerPort: 42422 | |
| args: | |
| - --monitoringPort=15014 | |
| - --address | |
| - unix:///sock/mixer.socket | |
| - --log_output_level=default:info | |
| - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 | |
| - --configDefaultNamespace=istio-system | |
| - --useAdapterCRDs=false | |
| - --useTemplateCRDs=false | |
| - --trace_zipkin_url=http://zipkin.istio-system:9411/api/v1/spans | |
| env: | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: GOMAXPROCS | |
| value: "6" | |
| resources: | |
| limits: | |
| cpu: 100m | |
| memory: 100Mi | |
| requests: | |
| cpu: 10m | |
| memory: 100Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| - name: istio-proxy | |
| image: "docker.io/jamesroper/proxyv2:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 9091 | |
| - containerPort: 15004 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-policy | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_policy.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 10m | |
| memory: 40Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| - name: policy-adapter-secret | |
| mountPath: /var/run/secrets/istio.io/policy/adapter | |
| readOnly: true | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: istio-mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| template: | |
| metadata: | |
| labels: | |
| app: telemetry | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-mixer-service-account | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-mixer-service-account | |
| optional: true | |
| - name: uds-socket | |
| emptyDir: {} | |
| - name: telemetry-adapter-secret | |
| secret: | |
| secretName: telemetry-adapter-secret | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| containers: | |
| - name: mixer | |
| image: "docker.io/jamesroper/mixer:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15014 | |
| - containerPort: 42422 | |
| args: | |
| - --monitoringPort=15014 | |
| - --address | |
| - unix:///sock/mixer.socket | |
| - --log_output_level=default:info | |
| - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 | |
| - --configDefaultNamespace=istio-system | |
| - --useAdapterCRDs=false | |
| - --trace_zipkin_url=http://zipkin.istio-system:9411/api/v1/spans | |
| - --averageLatencyThreshold | |
| - 100ms | |
| - --loadsheddingMode | |
| - disabled | |
| env: | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: GOMAXPROCS | |
| value: "6" | |
| resources: | |
| limits: | |
| cpu: 100m | |
| memory: 100Mi | |
| requests: | |
| cpu: 50m | |
| memory: 100Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: telemetry-adapter-secret | |
| mountPath: /var/run/secrets/istio.io/telemetry/adapter | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| - name: istio-proxy | |
| image: "docker.io/jamesroper/proxyv2:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 9091 | |
| - containerPort: 15004 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-telemetry | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_telemetry.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 10m | |
| memory: 40Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/deployment.yaml | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| # TODO: default template doesn't have this, which one is right ? | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| annotations: | |
| checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9 | |
| spec: | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: pilot | |
| template: | |
| metadata: | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-pilot-service-account | |
| containers: | |
| - name: discovery | |
| image: "docker.io/jamesroper/pilot:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - "discovery" | |
| - --monitoringAddr=:15014 | |
| - --log_output_level=default:info | |
| - --domain | |
| - cluster.local | |
| - --secureGrpcAddr | |
| - "" | |
| - --keepaliveMaxServerConnectionAge | |
| - "30m" | |
| ports: | |
| - containerPort: 8080 | |
| - containerPort: 15010 | |
| readinessProbe: | |
| httpGet: | |
| path: /ready | |
| port: 8080 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 30 | |
| timeoutSeconds: 5 | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: PILOT_PUSH_THROTTLE | |
| value: "100" | |
| - name: PILOT_TRACE_SAMPLING | |
| value: "1" | |
| - name: PILOT_DISABLE_XDS_MARSHALING_TO_ANY | |
| value: "1" | |
| resources: | |
| requests: | |
| cpu: 500m | |
| memory: 2048Mi | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/istio/config | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: istio-proxy | |
| image: "docker.io/jamesroper/proxyv2:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15003 | |
| - containerPort: 15005 | |
| - containerPort: 15007 | |
| - containerPort: 15011 | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-pilot | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_pilot.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 10m | |
| memory: 40Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: istio | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-pilot-service-account | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/prometheus/templates/deployment.yaml | |
| # TODO: the original template has service account, roles, etc | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: prometheus | |
| template: | |
| metadata: | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: prometheus | |
| containers: | |
| - name: prometheus | |
| image: "docker.io/prom/prometheus:v2.8.0" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - '--storage.tsdb.retention=6h' | |
| - '--config.file=/etc/prometheus/prometheus.yml' | |
| ports: | |
| - containerPort: 9090 | |
| name: http | |
| livenessProbe: | |
| httpGet: | |
| path: /-/healthy | |
| port: 9090 | |
| readinessProbe: | |
| httpGet: | |
| path: /-/ready | |
| port: 9090 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/prometheus | |
| - mountPath: /etc/istio-certs | |
| name: istio-certs | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: prometheus | |
| - name: istio-certs | |
| secret: | |
| defaultMode: 420 | |
| secretName: istio.default | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/deployment.yaml | |
| # istio CA watching all namespaces | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-citadel | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| istio: citadel | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-citadel-service-account | |
| containers: | |
| - name: citadel | |
| image: "docker.io/jamesroper/citadel:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - --append-dns-names=true | |
| - --grpc-port=8060 | |
| - --citadel-storage-namespace=istio-system | |
| - --custom-dns-names=istio-pilot-service-account.istio-system:istio-pilot.istio-system | |
| - --monitoring-port=15014 | |
| - --self-signed-ca=true | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| istio: sidecar-injector | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-sidecar-injector-service-account | |
| containers: | |
| - name: sidecar-injector-webhook | |
| image: "docker.io/jamesroper/sidecar_injector:1.2-alpha-3a243984-outbound-port-exclusions" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - --caCertFile=/etc/istio/certs/root-cert.pem | |
| - --tlsCertFile=/etc/istio/certs/cert-chain.pem | |
| - --tlsKeyFile=/etc/istio/certs/key.pem | |
| - --injectConfig=/etc/istio/inject/config | |
| - --meshConfig=/etc/istio/config/mesh | |
| - --healthCheckInterval=2s | |
| - --healthCheckFile=/health | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/istio/config | |
| readOnly: true | |
| - name: certs | |
| mountPath: /etc/istio/certs | |
| readOnly: true | |
| - name: inject-config | |
| mountPath: /etc/istio/inject | |
| readOnly: true | |
| livenessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/sidecar-injector | |
| - probe | |
| - --probe-path=/health | |
| - --interval=4s | |
| initialDelaySeconds: 4 | |
| periodSeconds: 4 | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/sidecar-injector | |
| - probe | |
| - --probe-path=/health | |
| - --interval=4s | |
| initialDelaySeconds: 4 | |
| periodSeconds: 4 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: istio | |
| - name: certs | |
| secret: | |
| secretName: istio.istio-sidecar-injector-service-account | |
| - name: inject-config | |
| configMap: | |
| name: istio-sidecar-injector | |
| items: | |
| - key: config | |
| path: config | |
| - key: values | |
| path: values | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/gateways/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-egressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| spec: | |
| maxReplicas: 1 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| name: istio-egressgateway | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| maxReplicas: 1 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| name: istio-ingressgateway | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| name: istio-telemetry | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| name: istio-pilot | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml | |
| apiVersion: admissionregistration.k8s.io/v1beta1 | |
| kind: MutatingWebhookConfiguration | |
| metadata: | |
| name: istio-sidecar-injector | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| webhooks: | |
| - name: sidecar-injector.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| path: "/inject" | |
| caBundle: "" | |
| rules: | |
| - operations: [ "CREATE" ] | |
| apiGroups: [""] | |
| apiVersions: ["v1"] | |
| resources: ["pods"] | |
| failurePolicy: Fail | |
| namespaceSelector: | |
| matchLabels: | |
| istio-injection: enabled | |
| --- | |
| # Source: istio/charts/galley/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: galley | |
| release: istio | |
| istio: galley | |
| --- | |
| # Source: istio/charts/gateways/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-egressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| release: istio | |
| app: istio-egressgateway | |
| istio: egressgateway | |
| --- | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: policy | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| version: 1.1.0 | |
| istio: mixer | |
| istio-mixer-type: policy | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: policy | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: policy | |
| --- | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: telemetry | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| version: 1.1.0 | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: telemetry | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: pilot | |
| release: istio | |
| istio: pilot | |
| --- | |
| # Source: istio/charts/galley/templates/validatingwebhookconfiguration.yaml.tpl | |
| --- | |
| # Source: istio/charts/gateways/templates/preconfigured.yaml | |
| --- | |
| # Source: istio/charts/pilot/templates/meshexpansion.yaml | |
| --- | |
| # Source: istio/charts/prometheus/templates/ingress.yaml | |
| --- | |
| # Source: istio/charts/prometheus/templates/tests/test-prometheus-connection.yaml | |
| --- | |
| # Source: istio/charts/security/templates/enable-mesh-mtls.yaml | |
| --- | |
| # Source: istio/charts/security/templates/enable-mesh-permissive.yaml | |
| --- | |
| # Source: istio/charts/security/templates/meshexpansion.yaml | |
| --- | |
| # Source: istio/charts/security/templates/tests/test-citadel-connection.yaml | |
| --- | |
| # Source: istio/templates/endpoints.yaml | |
| --- | |
| # Source: istio/templates/install-custom-resources.sh.tpl | |
| --- | |
| # Source: istio/templates/service.yaml | |
| --- | |
| # Source: istio/charts/mixer/templates/config.yaml | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: attributemanifest | |
| metadata: | |
| name: istioproxy | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| attributes: | |
| origin.ip: | |
| valueType: IP_ADDRESS | |
| origin.uid: | |
| valueType: STRING | |
| origin.user: | |
| valueType: STRING | |
| request.headers: | |
| valueType: STRING_MAP | |
| request.id: | |
| valueType: STRING | |
| request.host: | |
| valueType: STRING | |
| request.method: | |
| valueType: STRING | |
| request.path: | |
| valueType: STRING | |
| request.url_path: | |
| valueType: STRING | |
| request.query_params: | |
| valueType: STRING_MAP | |
| request.reason: | |
| valueType: STRING | |
| request.referer: | |
| valueType: STRING | |
| request.scheme: | |
| valueType: STRING | |
| request.total_size: | |
| valueType: INT64 | |
| request.size: | |
| valueType: INT64 | |
| request.time: | |
| valueType: TIMESTAMP | |
| request.useragent: | |
| valueType: STRING | |
| response.code: | |
| valueType: INT64 | |
| response.duration: | |
| valueType: DURATION | |
| response.headers: | |
| valueType: STRING_MAP | |
| response.total_size: | |
| valueType: INT64 | |
| response.size: | |
| valueType: INT64 | |
| response.time: | |
| valueType: TIMESTAMP | |
| response.grpc_status: | |
| valueType: STRING | |
| response.grpc_message: | |
| valueType: STRING | |
| source.uid: | |
| valueType: STRING | |
| source.user: # DEPRECATED | |
| valueType: STRING | |
| source.principal: | |
| valueType: STRING | |
| destination.uid: | |
| valueType: STRING | |
| destination.principal: | |
| valueType: STRING | |
| destination.port: | |
| valueType: INT64 | |
| connection.event: | |
| valueType: STRING | |
| connection.id: | |
| valueType: STRING | |
| connection.received.bytes: | |
| valueType: INT64 | |
| connection.received.bytes_total: | |
| valueType: INT64 | |
| connection.sent.bytes: | |
| valueType: INT64 | |
| connection.sent.bytes_total: | |
| valueType: INT64 | |
| connection.duration: | |
| valueType: DURATION | |
| connection.mtls: | |
| valueType: BOOL | |
| connection.requested_server_name: | |
| valueType: STRING | |
| context.protocol: | |
| valueType: STRING | |
| context.proxy_error_code: | |
| valueType: STRING | |
| context.timestamp: | |
| valueType: TIMESTAMP | |
| context.time: | |
| valueType: TIMESTAMP | |
| # Deprecated, kept for compatibility | |
| context.reporter.local: | |
| valueType: BOOL | |
| context.reporter.kind: | |
| valueType: STRING | |
| context.reporter.uid: | |
| valueType: STRING | |
| api.service: | |
| valueType: STRING | |
| api.version: | |
| valueType: STRING | |
| api.operation: | |
| valueType: STRING | |
| api.protocol: | |
| valueType: STRING | |
| request.auth.principal: | |
| valueType: STRING | |
| request.auth.audiences: | |
| valueType: STRING | |
| request.auth.presenter: | |
| valueType: STRING | |
| request.auth.claims: | |
| valueType: STRING_MAP | |
| request.auth.raw_claims: | |
| valueType: STRING | |
| request.api_key: | |
| valueType: STRING | |
| rbac.permissive.response_code: | |
| valueType: STRING | |
| rbac.permissive.effective_policy_id: | |
| valueType: STRING | |
| check.error_code: | |
| valueType: INT64 | |
| check.error_message: | |
| valueType: STRING | |
| check.cache_hit: | |
| valueType: BOOL | |
| quota.cache_hit: | |
| valueType: BOOL | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: attributemanifest | |
| metadata: | |
| name: kubernetes | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| attributes: | |
| source.ip: | |
| valueType: IP_ADDRESS | |
| source.labels: | |
| valueType: STRING_MAP | |
| source.metadata: | |
| valueType: STRING_MAP | |
| source.name: | |
| valueType: STRING | |
| source.namespace: | |
| valueType: STRING | |
| source.owner: | |
| valueType: STRING | |
| source.serviceAccount: | |
| valueType: STRING | |
| source.services: | |
| valueType: STRING | |
| source.workload.uid: | |
| valueType: STRING | |
| source.workload.name: | |
| valueType: STRING | |
| source.workload.namespace: | |
| valueType: STRING | |
| destination.ip: | |
| valueType: IP_ADDRESS | |
| destination.labels: | |
| valueType: STRING_MAP | |
| destination.metadata: | |
| valueType: STRING_MAP | |
| destination.owner: | |
| valueType: STRING | |
| destination.name: | |
| valueType: STRING | |
| destination.container.name: | |
| valueType: STRING | |
| destination.namespace: | |
| valueType: STRING | |
| destination.service.uid: | |
| valueType: STRING | |
| destination.service.name: | |
| valueType: STRING | |
| destination.service.namespace: | |
| valueType: STRING | |
| destination.service.host: | |
| valueType: STRING | |
| destination.serviceAccount: | |
| valueType: STRING | |
| destination.workload.uid: | |
| valueType: STRING | |
| destination.workload.name: | |
| valueType: STRING | |
| destination.workload.namespace: | |
| valueType: STRING | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: handler | |
| metadata: | |
| name: stdio | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledAdapter: stdio | |
| params: | |
| outputAsJson: true | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: accesslog | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: logentry | |
| params: | |
| severity: '"Info"' | |
| timestamp: request.time | |
| variables: | |
| sourceIp: source.ip | ip("0.0.0.0") | |
| sourceApp: source.labels["app"] | "" | |
| sourcePrincipal: source.principal | "" | |
| sourceName: source.name | "" | |
| sourceWorkload: source.workload.name | "" | |
| sourceNamespace: source.namespace | "" | |
| sourceOwner: source.owner | "" | |
| destinationApp: destination.labels["app"] | "" | |
| destinationIp: destination.ip | ip("0.0.0.0") | |
| destinationServiceHost: destination.service.host | "" | |
| destinationWorkload: destination.workload.name | "" | |
| destinationName: destination.name | "" | |
| destinationNamespace: destination.namespace | "" | |
| destinationOwner: destination.owner | "" | |
| destinationPrincipal: destination.principal | "" | |
| apiClaims: request.auth.raw_claims | "" | |
| apiKey: request.api_key | request.headers["x-api-key"] | "" | |
| protocol: request.scheme | context.protocol | "http" | |
| method: request.method | "" | |
| url: request.path | "" | |
| responseCode: response.code | 0 | |
| responseFlags: context.proxy_error_code | "" | |
| responseSize: response.size | 0 | |
| permissiveResponseCode: rbac.permissive.response_code | "none" | |
| permissiveResponsePolicyID: rbac.permissive.effective_policy_id | "none" | |
| requestSize: request.size | 0 | |
| requestId: request.headers["x-request-id"] | "" | |
| clientTraceId: request.headers["x-client-trace-id"] | "" | |
| latency: response.duration | "0ms" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| requestedServerName: connection.requested_server_name | "" | |
| userAgent: request.useragent | "" | |
| responseTimestamp: response.time | |
| receivedBytes: request.total_size | 0 | |
| sentBytes: response.total_size | 0 | |
| referer: request.referer | "" | |
| httpAuthority: request.headers[":authority"] | request.host | "" | |
| xForwardedFor: request.headers["x-forwarded-for"] | "0.0.0.0" | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| grpcStatus: response.grpc_status | "" | |
| grpcMessage: response.grpc_message | "" | |
| monitored_resource_type: '"global"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: tcpaccesslog | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: logentry | |
| params: | |
| severity: '"Info"' | |
| timestamp: context.time | timestamp("2017-01-01T00:00:00Z") | |
| variables: | |
| connectionEvent: connection.event | "" | |
| sourceIp: source.ip | ip("0.0.0.0") | |
| sourceApp: source.labels["app"] | "" | |
| sourcePrincipal: source.principal | "" | |
| sourceName: source.name | "" | |
| sourceWorkload: source.workload.name | "" | |
| sourceNamespace: source.namespace | "" | |
| sourceOwner: source.owner | "" | |
| destinationApp: destination.labels["app"] | "" | |
| destinationIp: destination.ip | ip("0.0.0.0") | |
| destinationServiceHost: destination.service.host | "" | |
| destinationWorkload: destination.workload.name | "" | |
| destinationName: destination.name | "" | |
| destinationNamespace: destination.namespace | "" | |
| destinationOwner: destination.owner | "" | |
| destinationPrincipal: destination.principal | "" | |
| protocol: context.protocol | "tcp" | |
| connectionDuration: connection.duration | "0ms" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| requestedServerName: connection.requested_server_name | "" | |
| receivedBytes: connection.received.bytes | 0 | |
| sentBytes: connection.sent.bytes | 0 | |
| totalReceivedBytes: connection.received.bytes_total | 0 | |
| totalSentBytes: connection.sent.bytes_total | 0 | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| responseFlags: context.proxy_error_code | "" | |
| monitored_resource_type: '"global"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: stdio | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "http" || context.protocol == "grpc" | |
| actions: | |
| - handler: stdio | |
| instances: | |
| - accesslog | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: stdiotcp | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" | |
| actions: | |
| - handler: stdio | |
| instances: | |
| - tcpaccesslog | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: requestcount | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: requestduration | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: response.duration | "0ms" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: requestsize | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: request.size | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: responsesize | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: response.size | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: tcpbytesent | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: connection.sent.bytes | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: tcpbytereceived | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: connection.received.bytes | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: tcpconnectionsopened | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.name | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: tcpconnectionsclosed | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: metric | |
| params: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.name | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: handler | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledAdapter: prometheus | |
| params: | |
| metricsExpirationPolicy: | |
| metricsExpiryDuration: "10m" | |
| metrics: | |
| - name: requests_total | |
| instance_name: requestcount.instance.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| - name: request_duration_seconds | |
| instance_name: requestduration.instance.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| explicit_buckets: | |
| bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10] | |
| - name: request_bytes | |
| instance_name: requestsize.instance.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| exponentialBuckets: | |
| numFiniteBuckets: 8 | |
| scale: 1 | |
| growthFactor: 10 | |
| - name: response_bytes | |
| instance_name: responsesize.instance.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| exponentialBuckets: | |
| numFiniteBuckets: 8 | |
| scale: 1 | |
| growthFactor: 10 | |
| - name: tcp_sent_bytes_total | |
| instance_name: tcpbytesent.instance.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_received_bytes_total | |
| instance_name: tcpbytereceived.instance.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_connections_opened_total | |
| instance_name: tcpconnectionsopened.instance.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_connections_closed_total | |
| instance_name: tcpconnectionsclosed.instance.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promhttp | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: (context.protocol == "http" || context.protocol == "grpc") && (match((request.useragent | "-"), "kube-probe*") == false) && (match((request.useragent | "-"), "Prometheus*") == false) | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - requestcount | |
| - requestduration | |
| - requestsize | |
| - responsesize | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcp | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpbytesent | |
| - tcpbytereceived | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcpconnectionopen | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" && ((connection.event | "na") == "open") | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpconnectionsopened | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcpconnectionclosed | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" && ((connection.event | "na") == "close") | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpconnectionsclosed | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: handler | |
| metadata: | |
| name: kubernetesenv | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledAdapter: kubernetesenv | |
| params: | |
| # when running from mixer root, use the following config after adding a | |
| # symbolic link to a kubernetes config file via: | |
| # | |
| # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig | |
| # | |
| # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig" | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: kubeattrgenrulerule | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| actions: | |
| - handler: kubernetesenv | |
| instances: | |
| - attributes | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: tcpkubeattrgenrulerule | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" | |
| actions: | |
| - handler: kubernetesenv | |
| instances: | |
| - attributes | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: instance | |
| metadata: | |
| name: attributes | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledTemplate: kubernetes | |
| params: | |
| # Pass the required attribute data to the adapter | |
| source_uid: source.uid | "" | |
| source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr | |
| destination_uid: destination.uid | "" | |
| destination_port: destination.port | 0 | |
| attributeBindings: | |
| # Fill the new attributes from the adapter produced output. | |
| # $out refers to an instance of OutputTemplate message | |
| source.ip: $out.source_pod_ip | ip("0.0.0.0") | |
| source.uid: $out.source_pod_uid | "unknown" | |
| source.labels: $out.source_labels | emptyStringMap() | |
| source.name: $out.source_pod_name | "unknown" | |
| source.namespace: $out.source_namespace | "default" | |
| source.owner: $out.source_owner | "unknown" | |
| source.serviceAccount: $out.source_service_account_name | "unknown" | |
| source.workload.uid: $out.source_workload_uid | "unknown" | |
| source.workload.name: $out.source_workload_name | "unknown" | |
| source.workload.namespace: $out.source_workload_namespace | "unknown" | |
| destination.ip: $out.destination_pod_ip | ip("0.0.0.0") | |
| destination.uid: $out.destination_pod_uid | "unknown" | |
| destination.labels: $out.destination_labels | emptyStringMap() | |
| destination.name: $out.destination_pod_name | "unknown" | |
| destination.container.name: $out.destination_container_name | "unknown" | |
| destination.namespace: $out.destination_namespace | "default" | |
| destination.owner: $out.destination_owner | "unknown" | |
| destination.serviceAccount: $out.destination_service_account_name | "unknown" | |
| destination.workload.uid: $out.destination_workload_uid | "unknown" | |
| destination.workload.name: $out.destination_workload_name | "unknown" | |
| destination.workload.namespace: $out.destination_workload_namespace | "unknown" | |
| --- | |
| # Configuration needed by Mixer. | |
| # Mixer cluster is delivered via CDS | |
| # Specify mixer cluster settings | |
| apiVersion: networking.istio.io/v1alpha3 | |
| kind: DestinationRule | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| host: istio-policy.istio-system.svc.cluster.local | |
| trafficPolicy: | |
| connectionPool: | |
| http: | |
| http2MaxRequests: 10000 | |
| maxRequestsPerConnection: 10000 | |
| --- | |
| apiVersion: networking.istio.io/v1alpha3 | |
| kind: DestinationRule | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| host: istio-telemetry.istio-system.svc.cluster.local | |
| trafficPolicy: | |
| connectionPool: | |
| http: | |
| http2MaxRequests: 10000 | |
| maxRequestsPerConnection: 10000 | |
| --- | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment