Last active
June 6, 2019 00:19
-
-
Save swiftdiaries/04847b5dc194df0e1357441054bd240d to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # PATCH #1: Creating the istio-system namespace. | |
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: istio-system | |
| labels: | |
| istio-injection: disabled | |
| # PATCH #1 ends. | |
| --- | |
| # Source: istio-init/templates/configmap-crd-10.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| namespace: istio-system | |
| name: istio-crd-10 | |
| data: | |
| crd-10.yaml: |- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: virtualservices.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: VirtualService | |
| listKind: VirtualServiceList | |
| plural: virtualservices | |
| singular: virtualservice | |
| shortNames: | |
| - vs | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.gateways | |
| description: The names of gateways and sidecars that should apply these routes | |
| name: Gateways | |
| type: string | |
| - JSONPath: .spec.hosts | |
| description: The destination hosts to which traffic is being sent | |
| name: Hosts | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: destinationrules.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: DestinationRule | |
| listKind: DestinationRuleList | |
| plural: destinationrules | |
| singular: destinationrule | |
| shortNames: | |
| - dr | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.host | |
| description: The name of a service from the service registry | |
| name: Host | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: serviceentries.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: ServiceEntry | |
| listKind: ServiceEntryList | |
| plural: serviceentries | |
| singular: serviceentry | |
| shortNames: | |
| - se | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.hosts | |
| description: The hosts associated with the ServiceEntry | |
| name: Hosts | |
| type: string | |
| - JSONPath: .spec.location | |
| description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) | |
| name: Location | |
| type: string | |
| - JSONPath: .spec.resolution | |
| description: Service discovery mode for the hosts (NONE, STATIC, or DNS) | |
| name: Resolution | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: gateways.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: Gateway | |
| plural: gateways | |
| singular: gateway | |
| shortNames: | |
| - gw | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: envoyfilters.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: EnvoyFilter | |
| plural: envoyfilters | |
| singular: envoyfilter | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: clusterrbacconfigs.rbac.istio.io | |
| labels: | |
| app: istio-pilot | |
| istio: rbac | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ClusterRbacConfig | |
| plural: clusterrbacconfigs | |
| singular: clusterrbacconfig | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Cluster | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: policies.authentication.istio.io | |
| labels: | |
| app: istio-citadel | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: authentication.istio.io | |
| names: | |
| kind: Policy | |
| plural: policies | |
| singular: policy | |
| categories: | |
| - istio-io | |
| - authentication-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: meshpolicies.authentication.istio.io | |
| labels: | |
| app: istio-citadel | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: authentication.istio.io | |
| names: | |
| kind: MeshPolicy | |
| listKind: MeshPolicyList | |
| plural: meshpolicies | |
| singular: meshpolicy | |
| categories: | |
| - istio-io | |
| - authentication-istio-io | |
| scope: Cluster | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: httpapispecbindings.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: HTTPAPISpecBinding | |
| plural: httpapispecbindings | |
| singular: httpapispecbinding | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: httpapispecs.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: HTTPAPISpec | |
| plural: httpapispecs | |
| singular: httpapispec | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: quotaspecbindings.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: QuotaSpecBinding | |
| plural: quotaspecbindings | |
| singular: quotaspecbinding | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: quotaspecs.config.istio.io | |
| labels: | |
| app: istio-mixer | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: QuotaSpec | |
| plural: quotaspecs | |
| singular: quotaspec | |
| categories: | |
| - istio-io | |
| - apim-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: rules.config.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: core | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: rule | |
| plural: rules | |
| singular: rule | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: attributemanifests.config.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: core | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: attributemanifest | |
| plural: attributemanifests | |
| singular: attributemanifest | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: bypasses.config.istio.io | |
| labels: | |
| app: mixer | |
| package: bypass | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: bypass | |
| plural: bypasses | |
| singular: bypass | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: circonuses.config.istio.io | |
| labels: | |
| app: mixer | |
| package: circonus | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: circonus | |
| plural: circonuses | |
| singular: circonus | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: deniers.config.istio.io | |
| labels: | |
| app: mixer | |
| package: denier | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: denier | |
| plural: deniers | |
| singular: denier | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: fluentds.config.istio.io | |
| labels: | |
| app: mixer | |
| package: fluentd | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: fluentd | |
| plural: fluentds | |
| singular: fluentd | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: kubernetesenvs.config.istio.io | |
| labels: | |
| app: mixer | |
| package: kubernetesenv | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: kubernetesenv | |
| plural: kubernetesenvs | |
| singular: kubernetesenv | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: listcheckers.config.istio.io | |
| labels: | |
| app: mixer | |
| package: listchecker | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: listchecker | |
| plural: listcheckers | |
| singular: listchecker | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: memquotas.config.istio.io | |
| labels: | |
| app: mixer | |
| package: memquota | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: memquota | |
| plural: memquotas | |
| singular: memquota | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: noops.config.istio.io | |
| labels: | |
| app: mixer | |
| package: noop | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: noop | |
| plural: noops | |
| singular: noop | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: opas.config.istio.io | |
| labels: | |
| app: mixer | |
| package: opa | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: opa | |
| plural: opas | |
| singular: opa | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: prometheuses.config.istio.io | |
| labels: | |
| app: mixer | |
| package: prometheus | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: prometheus | |
| plural: prometheuses | |
| singular: prometheus | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: rbacs.config.istio.io | |
| labels: | |
| app: mixer | |
| package: rbac | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: rbac | |
| plural: rbacs | |
| singular: rbac | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: redisquotas.config.istio.io | |
| labels: | |
| app: mixer | |
| package: redisquota | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: redisquota | |
| plural: redisquotas | |
| singular: redisquota | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: signalfxs.config.istio.io | |
| labels: | |
| app: mixer | |
| package: signalfx | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: signalfx | |
| plural: signalfxs | |
| singular: signalfx | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: solarwindses.config.istio.io | |
| labels: | |
| app: mixer | |
| package: solarwinds | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: solarwinds | |
| plural: solarwindses | |
| singular: solarwinds | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: stackdrivers.config.istio.io | |
| labels: | |
| app: mixer | |
| package: stackdriver | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: stackdriver | |
| plural: stackdrivers | |
| singular: stackdriver | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: statsds.config.istio.io | |
| labels: | |
| app: mixer | |
| package: statsd | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: statsd | |
| plural: statsds | |
| singular: statsd | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: stdios.config.istio.io | |
| labels: | |
| app: mixer | |
| package: stdio | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: stdio | |
| plural: stdios | |
| singular: stdio | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: apikeys.config.istio.io | |
| labels: | |
| app: mixer | |
| package: apikey | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: apikey | |
| plural: apikeys | |
| singular: apikey | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: authorizations.config.istio.io | |
| labels: | |
| app: mixer | |
| package: authorization | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: authorization | |
| plural: authorizations | |
| singular: authorization | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: checknothings.config.istio.io | |
| labels: | |
| app: mixer | |
| package: checknothing | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: checknothing | |
| plural: checknothings | |
| singular: checknothing | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: kuberneteses.config.istio.io | |
| labels: | |
| app: mixer | |
| package: adapter.template.kubernetes | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: kubernetes | |
| plural: kuberneteses | |
| singular: kubernetes | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: listentries.config.istio.io | |
| labels: | |
| app: mixer | |
| package: listentry | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: listentry | |
| plural: listentries | |
| singular: listentry | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: logentries.config.istio.io | |
| labels: | |
| app: mixer | |
| package: logentry | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: logentry | |
| plural: logentries | |
| singular: logentry | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.severity | |
| description: The importance of the log entry | |
| name: Severity | |
| type: string | |
| - JSONPath: .spec.timestamp | |
| description: The time value for the log entry | |
| name: Timestamp | |
| type: string | |
| - JSONPath: .spec.monitored_resource_type | |
| description: Optional expression to compute the type of the monitored resource this log entry is being recorded on | |
| name: Res Type | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: edges.config.istio.io | |
| labels: | |
| app: mixer | |
| package: edge | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: edge | |
| plural: edges | |
| singular: edge | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: metrics.config.istio.io | |
| labels: | |
| app: mixer | |
| package: metric | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: metric | |
| plural: metrics | |
| singular: metric | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: quotas.config.istio.io | |
| labels: | |
| app: mixer | |
| package: quota | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: quota | |
| plural: quotas | |
| singular: quota | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: reportnothings.config.istio.io | |
| labels: | |
| app: mixer | |
| package: reportnothing | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: reportnothing | |
| plural: reportnothings | |
| singular: reportnothing | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: tracespans.config.istio.io | |
| labels: | |
| app: mixer | |
| package: tracespan | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: tracespan | |
| plural: tracespans | |
| singular: tracespan | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: rbacconfigs.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: RbacConfig | |
| plural: rbacconfigs | |
| singular: rbacconfig | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: serviceroles.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ServiceRole | |
| plural: serviceroles | |
| singular: servicerole | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: servicerolebindings.rbac.istio.io | |
| labels: | |
| app: mixer | |
| package: istio.io.mixer | |
| istio: rbac | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: rbac.istio.io | |
| names: | |
| kind: ServiceRoleBinding | |
| plural: servicerolebindings | |
| singular: servicerolebinding | |
| categories: | |
| - istio-io | |
| - rbac-istio-io | |
| scope: Namespaced | |
| version: v1alpha1 | |
| additionalPrinterColumns: | |
| - JSONPath: .spec.roleRef.name | |
| description: The name of the ServiceRole object being referenced | |
| name: Reference | |
| type: string | |
| - JSONPath: .metadata.creationTimestamp | |
| description: |- | |
| CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. | |
| Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata | |
| name: Age | |
| type: date | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: adapters.config.istio.io | |
| labels: | |
| app: mixer | |
| package: adapter | |
| istio: mixer-adapter | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: adapter | |
| plural: adapters | |
| singular: adapter | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: instances.config.istio.io | |
| labels: | |
| app: mixer | |
| package: instance | |
| istio: mixer-instance | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: instance | |
| plural: instances | |
| singular: instance | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: templates.config.istio.io | |
| labels: | |
| app: mixer | |
| package: template | |
| istio: mixer-template | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: template | |
| plural: templates | |
| singular: template | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: handlers.config.istio.io | |
| labels: | |
| app: mixer | |
| package: handler | |
| istio: mixer-handler | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: handler | |
| plural: handlers | |
| singular: handler | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| --- | |
| # Source: istio-init/templates/configmap-crd-11.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| namespace: istio-system | |
| name: istio-crd-11 | |
| data: | |
| crd-11.yaml: |- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: cloudwatches.config.istio.io | |
| labels: | |
| app: mixer | |
| package: cloudwatch | |
| istio: mixer-adapter | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: cloudwatch | |
| plural: cloudwatches | |
| singular: cloudwatch | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: dogstatsds.config.istio.io | |
| labels: | |
| app: mixer | |
| package: dogstatsd | |
| istio: mixer-adapter | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: dogstatsd | |
| plural: dogstatsds | |
| singular: dogstatsd | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: sidecars.networking.istio.io | |
| labels: | |
| app: istio-pilot | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: networking.istio.io | |
| names: | |
| kind: Sidecar | |
| plural: sidecars | |
| singular: sidecar | |
| categories: | |
| - istio-io | |
| - networking-istio-io | |
| scope: Namespaced | |
| version: v1alpha3 | |
| --- | |
| kind: CustomResourceDefinition | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| metadata: | |
| name: zipkins.config.istio.io | |
| labels: | |
| app: mixer | |
| package: zipkin | |
| istio: mixer-adapter | |
| annotations: | |
| "helm.sh/resource-policy": keep | |
| spec: | |
| group: config.istio.io | |
| names: | |
| kind: zipkin | |
| plural: zipkins | |
| singular: zipkin | |
| categories: | |
| - istio-io | |
| - policy-istio-io | |
| scope: Namespaced | |
| version: v1alpha2 | |
| --- | |
| --- | |
| # Source: istio-init/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-init-service-account | |
| namespace: istio-system | |
| labels: | |
| app: istio-init | |
| istio: init | |
| --- | |
| # Source: istio-init/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-init-istio-system | |
| labels: | |
| app: istio-init | |
| istio: istio-init | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["get", "list", "create", "watch"] | |
| - apiGroups: ["apiextensions.k8s.io"] | |
| resources: ["customresourcedefinitions"] | |
| verbs: ["create", "get", "list", "watch", "patch"] | |
| --- | |
| # Source: istio-init/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-init-admin-role-binding-istio-system | |
| labels: | |
| app: istio-init | |
| istio: init | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-init-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-init-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio-init/templates/job-crd-10.yaml | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| namespace: istio-system | |
| name: istio-init-crd-10 | |
| spec: | |
| template: | |
| metadata: | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-init-service-account | |
| containers: | |
| - name: istio-init-crd-10 | |
| image: "docker.io/istio/kubectl:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| volumeMounts: | |
| - name: crd-10 | |
| mountPath: /etc/istio/crd-10 | |
| readOnly: true | |
| command: ["kubectl", "apply", "-f", "/etc/istio/crd-10/crd-10.yaml"] | |
| volumes: | |
| - name: crd-10 | |
| configMap: | |
| name: istio-crd-10 | |
| restartPolicy: OnFailure | |
| --- | |
| # Source: istio-init/templates/job-crd-11.yaml | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| namespace: istio-system | |
| name: istio-init-crd-11 | |
| spec: | |
| template: | |
| metadata: | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-init-service-account | |
| containers: | |
| - name: istio-init-crd-11 | |
| image: "docker.io/istio/kubectl:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| volumeMounts: | |
| - name: crd-11 | |
| mountPath: /etc/istio/crd-11 | |
| readOnly: true | |
| command: ["kubectl", "apply", "-f", "/etc/istio/crd-11/crd-11.yaml"] | |
| volumes: | |
| - name: crd-11 | |
| configMap: | |
| name: istio-crd-11 | |
| restartPolicy: OnFailure | |
| --- | |
| # Source: istio-init/templates/configmap-crd-certmanager-10.yaml | |
| --- | |
| # Source: istio-init/templates/configmap-crd-certmanager-11.yaml | |
| --- | |
| # Source: istio-init/templates/job-crd-certmanager-10.yaml | |
| --- | |
| # Source: istio-init/templates/job-crd-certmanager-11.yaml | |
| --- | |
| # Source: istio/charts/galley/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: galley | |
| release: istio | |
| istio: galley | |
| --- | |
| # Source: istio/charts/gateways/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: policy | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| version: 1.1.0 | |
| istio: mixer | |
| istio-mixer-type: policy | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: policy | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: policy | |
| --- | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: telemetry | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| version: 1.1.0 | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: telemetry | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/poddisruptionbudget.yaml | |
| apiVersion: policy/v1beta1 | |
| kind: PodDisruptionBudget | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| spec: | |
| minAvailable: 1 | |
| selector: | |
| matchLabels: | |
| app: pilot | |
| release: istio | |
| istio: pilot | |
| --- | |
| # Source: istio/charts/galley/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-galley-configuration | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| data: | |
| validatingwebhookconfiguration.yaml: |- | |
| apiVersion: admissionregistration.k8s.io/v1beta1 | |
| kind: ValidatingWebhookConfiguration | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| webhooks: | |
| - name: pilot.validation.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-galley | |
| namespace: istio-system | |
| path: "/admitpilot" | |
| caBundle: "" | |
| rules: | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - config.istio.io | |
| apiVersions: | |
| - v1alpha2 | |
| resources: | |
| - httpapispecs | |
| - httpapispecbindings | |
| - quotaspecs | |
| - quotaspecbindings | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - rbac.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - "*" | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - authentication.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - "*" | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - networking.istio.io | |
| apiVersions: | |
| - "*" | |
| resources: | |
| - destinationrules | |
| - envoyfilters | |
| - gateways | |
| - serviceentries | |
| - sidecars | |
| - virtualservices | |
| failurePolicy: Fail | |
| - name: mixer.validation.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-galley | |
| namespace: istio-system | |
| path: "/admitmixer" | |
| caBundle: "" | |
| rules: | |
| - operations: | |
| - CREATE | |
| - UPDATE | |
| apiGroups: | |
| - config.istio.io | |
| apiVersions: | |
| - v1alpha2 | |
| resources: | |
| - rules | |
| - attributemanifests | |
| - circonuses | |
| - deniers | |
| - fluentds | |
| - kubernetesenvs | |
| - listcheckers | |
| - memquotas | |
| - noops | |
| - opas | |
| - prometheuses | |
| - rbacs | |
| - solarwindses | |
| - stackdrivers | |
| - cloudwatches | |
| - dogstatsds | |
| - statsds | |
| - stdios | |
| - apikeys | |
| - authorizations | |
| - checknothings | |
| # - kuberneteses | |
| - listentries | |
| - logentries | |
| - metrics | |
| - quotas | |
| - reportnothings | |
| - tracespans | |
| failurePolicy: Fail | |
| --- | |
| # Source: istio/charts/prometheus/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| data: | |
| prometheus.yml: |- | |
| global: | |
| scrape_interval: 15s | |
| scrape_configs: | |
| - job_name: 'istio-mesh' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;prometheus | |
| # Scrape config for envoy stats | |
| - job_name: 'envoy-stats' | |
| metrics_path: /stats/prometheus | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_container_port_name] | |
| action: keep | |
| regex: '.*-envoy-prom' | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:15090 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| metric_relabel_configs: | |
| # Exclude some of the envoy metrics that have massive cardinality | |
| # This list may need to be pruned further moving forward, as informed | |
| # by performance and scalability testing. | |
| - source_labels: [ cluster_name ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ tcp_prefix ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ listener_address ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_listener_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tls.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tcp_downstream.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_http_(stats|admin).*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_cluster_(lb|retry|bind|internal|max|original).*' | |
| action: drop | |
| - job_name: 'istio-policy' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-policy;http-monitoring | |
| - job_name: 'istio-telemetry' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;http-monitoring | |
| - job_name: 'pilot' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-pilot;http-monitoring | |
| - job_name: 'galley' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-galley;http-monitoring | |
| - job_name: 'citadel' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-citadel;http-monitoring | |
| # scrape config for API servers | |
| - job_name: 'kubernetes-apiservers' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - default | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: kubernetes;https | |
| # scrape config for nodes (kubelet) | |
| - job_name: 'kubernetes-nodes' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics | |
| # Scrape config for Kubelet cAdvisor. | |
| # | |
| # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics | |
| # (those whose names begin with 'container_') have been removed from the | |
| # Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to | |
| # retrieve those metrics. | |
| # | |
| # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor | |
| # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics" | |
| # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with | |
| # the --cadvisor-port=0 Kubelet flag). | |
| # | |
| # This job is not necessary and should be removed in Kubernetes 1.6 and | |
| # earlier versions, or it will cause the metrics to be scraped twice. | |
| - job_name: 'kubernetes-cadvisor' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor | |
| # scrape config for service endpoints. | |
| - job_name: 'kubernetes-service-endpoints' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme] | |
| action: replace | |
| target_label: __scheme__ | |
| regex: (https?) | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port] | |
| action: replace | |
| target_label: __address__ | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| - action: labelmap | |
| regex: __meta_kubernetes_service_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: kubernetes_namespace | |
| - source_labels: [__meta_kubernetes_service_name] | |
| action: replace | |
| target_label: kubernetes_name | |
| - job_name: 'kubernetes-pods' | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: # If first two labels are present, pod should be scraped by the istio-secure job. | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| # Keep target if there's no sidecar or if prometheus.io/scheme is explicitly set to "http" | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_prometheus_io_scheme] | |
| action: keep | |
| regex: ((;.*)|(.*;http)) | |
| - source_labels: [__meta_kubernetes_pod_annotation_istio_mtls] | |
| action: drop | |
| regex: (true) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| - job_name: 'kubernetes-pods-istio-secure' | |
| scheme: https | |
| tls_config: | |
| ca_file: /etc/istio-certs/root-cert.pem | |
| cert_file: /etc/istio-certs/cert-chain.pem | |
| key_file: /etc/istio-certs/key.pem | |
| insecure_skip_verify: true # prometheus does not support secure naming. | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| # sidecar status annotation is added by sidecar injector and | |
| # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic. | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls] | |
| action: keep | |
| regex: (([^;]+);([^;]*))|(([^;]*);(true)) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scheme] | |
| action: drop | |
| regex: (http) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__] # Only keep address that is host:port | |
| action: keep # otherwise an extra target with ':443' is added for https scheme | |
| regex: ([^:]+):(\d+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| --- | |
| # Source: istio/charts/security/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-security-custom-resources | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| data: | |
| custom-resources.yaml: |- | |
| # Authentication policy to enable permissive mode for all services (that have sidecar) in the mesh. | |
| apiVersion: "authentication.istio.io/v1alpha1" | |
| kind: "MeshPolicy" | |
| metadata: | |
| name: "default" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| peers: | |
| - mtls: | |
| mode: PERMISSIVE | |
| run.sh: |- | |
| #!/bin/sh | |
| set -x | |
| if [ "$#" -ne "1" ]; then | |
| echo "first argument should be path to custom resource yaml" | |
| exit 1 | |
| fi | |
| pathToResourceYAML=${1} | |
| kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null | |
| if [ "$?" -eq 0 ]; then | |
| echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready" | |
| while true; do | |
| kubectl -n istio-system get deployment istio-galley 2>/dev/null | |
| if [ "$?" -eq 0 ]; then | |
| break | |
| fi | |
| sleep 1 | |
| done | |
| kubectl -n istio-system rollout status deployment istio-galley | |
| if [ "$?" -ne 0 ]; then | |
| echo "istio-galley deployment rollout status check failed" | |
| exit 1 | |
| fi | |
| echo "istio-galley deployment ready for configuration validation" | |
| fi | |
| sleep 5 | |
| kubectl apply -f ${pathToResourceYAML} | |
| --- | |
| # Source: istio/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio | |
| namespace: istio-system | |
| labels: | |
| app: istio | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| data: | |
| mesh: |- | |
| # Set the following variable to true to disable policy checks by the Mixer. | |
| # Note that metrics will still be reported to the Mixer. | |
| disablePolicyChecks: true | |
| # Set enableTracing to false to disable request tracing. | |
| enableTracing: true | |
| # Set accessLogFile to empty string to disable access log. | |
| accessLogFile: "" | |
| # If accessLogEncoding is TEXT, value will be used directly as the log format | |
| # example: "[%START_TIME%] %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\n" | |
| # If AccessLogEncoding is JSON, value will be parsed as map[string]string | |
| # example: '{"start_time": "%START_TIME%", "req_method": "%REQ(:METHOD)%"}' | |
| # Leave empty to use default log format | |
| accessLogFormat: "" | |
| # Set accessLogEncoding to JSON or TEXT to configure sidecar access log | |
| accessLogEncoding: 'TEXT' | |
| mixerCheckServer: istio-policy.istio-system.svc.cluster.local:9091 | |
| mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:9091 | |
| # policyCheckFailOpen allows traffic in cases when the mixer policy service cannot be reached. | |
| # Default is false which means the traffic is denied when the client is unable to connect to Mixer. | |
| policyCheckFailOpen: false | |
| # Let Pilot give ingresses the public IP of the Istio ingressgateway | |
| ingressService: istio-ingressgateway | |
| # Default connect timeout for dynamic clusters generated by Pilot and returned via XDS | |
| connectTimeout: 10s | |
| # DNS refresh rate for Envoy clusters of type STRICT_DNS | |
| dnsRefreshRate: 5s | |
| # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get | |
| # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty. | |
| sdsUdsPath: | |
| # This flag is used by secret discovery service(SDS). | |
| # If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount | |
| # for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which | |
| # will be used to generate key/cert eventually. This isn't supported for non-k8s case. | |
| enableSdsTokenMount: false | |
| # This flag is used by secret discovery service(SDS). | |
| # If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token' | |
| # (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod) | |
| # and pass to sds server, which will be used to request key/cert eventually. | |
| # this flag is ignored if enableSdsTokenMount is set. | |
| # This isn't supported for non-k8s case. | |
| sdsUseK8sSaJwt: false | |
| # The trust domain corresponds to the trust root of a system. | |
| # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain | |
| trustDomain: | |
| # Set the default behavior of the sidecar for handling outbound traffic from the application: | |
| # ALLOW_ANY - outbound traffic to unknown destinations will be allowed, in case there are no | |
| # services or ServiceEntries for the destination port | |
| # REGISTRY_ONLY - restrict outbound traffic to services defined in the service registry as well | |
| # as those defined through ServiceEntries | |
| outboundTrafficPolicy: | |
| mode: ALLOW_ANY | |
| localityLbSetting: | |
| {} | |
| # The namespace to treat as the administrative root namespace for istio | |
| # configuration. | |
| rootNamespace: istio-system | |
| configSources: | |
| - address: istio-galley.istio-system.svc:9901 | |
| defaultConfig: | |
| # | |
| # TCP connection timeout between Envoy & the application, and between Envoys. Used for static clusters | |
| # defined in Envoy's configuration file | |
| connectTimeout: 10s | |
| # | |
| ### ADVANCED SETTINGS ############# | |
| # Where should envoy's configuration be stored in the istio-proxy container | |
| configPath: "/etc/istio/proxy" | |
| binaryPath: "/usr/local/bin/envoy" | |
| # The pseudo service name used for Envoy. | |
| serviceCluster: istio-proxy | |
| # These settings that determine how long an old Envoy | |
| # process should be kept alive after an occasional reload. | |
| drainDuration: 45s | |
| parentShutdownDuration: 1m0s | |
| # | |
| # The mode used to redirect inbound connections to Envoy. This setting | |
| # has no effect on outbound traffic: iptables REDIRECT is always used for | |
| # outbound connections. | |
| # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy. | |
| # The "REDIRECT" mode loses source addresses during redirection. | |
| # If "TPROXY", use iptables TPROXY to redirect to Envoy. | |
| # The "TPROXY" mode preserves both the source and destination IP | |
| # addresses and ports, so that they can be used for advanced filtering | |
| # and manipulation. | |
| # The "TPROXY" mode also configures the sidecar to run with the | |
| # CAP_NET_ADMIN capability, which is required to use TPROXY. | |
| #interceptionMode: REDIRECT | |
| # | |
| # Port where Envoy listens (on local host) for admin commands | |
| # You can exec into the istio-proxy container in a pod and | |
| # curl the admin port (curl http://localhost:15000/) to obtain | |
| # diagnostic information from Envoy. See | |
| # https://lyft.github.io/envoy/docs/operations/admin.html | |
| # for more details | |
| proxyAdminPort: 15000 | |
| # | |
| # Set concurrency to a specific number to control the number of Proxy worker threads. | |
| # If set to 0 (default), then start worker thread for each CPU thread/core. | |
| concurrency: 2 | |
| # | |
| tracing: | |
| zipkin: | |
| # Address of the Zipkin collector | |
| address: zipkin.istio-system:9411 | |
| # | |
| # Mutual TLS authentication between sidecars and istio control plane. | |
| controlPlaneAuthPolicy: NONE | |
| # | |
| # Address where istio Pilot service is running | |
| discoveryAddress: istio-pilot.istio-system:15010 | |
| # Configuration file for the mesh networks to be used by the Split Horizon EDS. | |
| meshNetworks: |- | |
| networks: {} | |
| --- | |
| # Source: istio/templates/sidecar-injector-configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: istio | |
| chart: istio | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| data: | |
| config: |- | |
| policy: enabled | |
| template: |- | |
| rewriteAppHTTPProbe: false | |
| initContainers: | |
| [[ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) "NONE" ]] | |
| - name: istio-init | |
| image: "docker.io/istio/proxy_init:1.1.6" | |
| args: | |
| - "-p" | |
| - [[ .MeshConfig.ProxyListenPort ]] | |
| - "-u" | |
| - 1337 | |
| - "-m" | |
| - [[ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode ]] | |
| - "-i" | |
| - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` "*" ]]" | |
| - "-x" | |
| - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` "" ]]" | |
| - "-b" | |
| - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (includeInboundPorts .Spec.Containers) ]]" | |
| - "-d" | |
| - "[[ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` "" ) ]]" | |
| [[ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -]] | |
| - "-k" | |
| - "[[ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` ]]" | |
| [[ end -]] | |
| imagePullPolicy: IfNotPresent | |
| resources: | |
| requests: | |
| cpu: 10m | |
| memory: 10Mi | |
| limits: | |
| cpu: 100m | |
| memory: 50Mi | |
| securityContext: | |
| runAsUser: 0 | |
| runAsNonRoot: false | |
| capabilities: | |
| add: | |
| - NET_ADMIN | |
| restartPolicy: Always | |
| [[ end -]] | |
| containers: | |
| - name: istio-proxy | |
| image: [[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` "docker.io/istio/proxyv2:1.1.6" ]] | |
| ports: | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - sidecar | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --configPath | |
| - [[ .ProxyConfig.ConfigPath ]] | |
| - --binaryPath | |
| - [[ .ProxyConfig.BinaryPath ]] | |
| - --serviceCluster | |
| [[ if ne "" (index .ObjectMeta.Labels "app") -]] | |
| - [[ index .ObjectMeta.Labels "app" ]].$(POD_NAMESPACE) | |
| [[ else -]] | |
| - [[ valueOrDefault .DeploymentMeta.Name "istio-proxy" ]].[[ valueOrDefault .DeploymentMeta.Namespace "default" ]] | |
| [[ end -]] | |
| - --drainDuration | |
| - [[ formatDuration .ProxyConfig.DrainDuration ]] | |
| - --parentShutdownDuration | |
| - [[ formatDuration .ProxyConfig.ParentShutdownDuration ]] | |
| - --discoveryAddress | |
| - [[ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress ]] | |
| - --zipkinAddress | |
| - [[ .ProxyConfig.GetTracing.GetZipkin.GetAddress ]] | |
| - --connectTimeout | |
| - [[ formatDuration .ProxyConfig.ConnectTimeout ]] | |
| - --proxyAdminPort | |
| - [[ .ProxyConfig.ProxyAdminPort ]] | |
| [[ if gt .ProxyConfig.Concurrency 0 -]] | |
| - --concurrency | |
| - [[ .ProxyConfig.Concurrency ]] | |
| [[ end -]] | |
| - --controlPlaneAuthPolicy | |
| - [[ annotation .ObjectMeta `sidecar.istio.io/controlPlaneAuthPolicy` .ProxyConfig.ControlPlaneAuthPolicy ]] | |
| [[- if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) "0") ]] | |
| - --statusPort | |
| - [[ annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ]] | |
| - --applicationPorts | |
| - "[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/applicationPorts` (applicationPorts .Spec.Containers) ]]" | |
| [[- end ]] | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: status.podIP | |
| - name: ISTIO_META_POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: ISTIO_META_CONFIG_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: ISTIO_META_INTERCEPTION_MODE | |
| value: [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]] | |
| [[ if .ObjectMeta.Annotations ]] | |
| - name: ISTIO_METAJSON_ANNOTATIONS | |
| value: | | |
| [[ toJSON .ObjectMeta.Annotations ]] | |
| [[ end ]] | |
| [[ if .ObjectMeta.Labels ]] | |
| - name: ISTIO_METAJSON_LABELS | |
| value: | | |
| [[ toJSON .ObjectMeta.Labels ]] | |
| [[ end ]] | |
| [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] | |
| - name: ISTIO_BOOTSTRAP_OVERRIDE | |
| value: "/etc/istio/custom-bootstrap/custom_bootstrap.json" | |
| [[- end ]] | |
| imagePullPolicy: IfNotPresent | |
| [[ if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) "0") ]] | |
| readinessProbe: | |
| httpGet: | |
| path: /healthz/ready | |
| port: [[ annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ]] | |
| initialDelaySeconds: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` 1 ]] | |
| periodSeconds: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` 2 ]] | |
| failureThreshold: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` 30 ]] | |
| [[ end -]]securityContext: | |
| readOnlyRootFilesystem: true | |
| [[ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) "TPROXY" -]] | |
| capabilities: | |
| add: | |
| - NET_ADMIN | |
| runAsGroup: 1337 | |
| [[ else -]] | |
| runAsUser: 1337 | |
| [[- end ]] | |
| resources: | |
| [[ if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -]] | |
| requests: | |
| [[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -]] | |
| cpu: "[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` ]]" | |
| [[ end ]] | |
| [[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -]] | |
| memory: "[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` ]]" | |
| [[ end ]] | |
| [[ else -]] | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| [[ end -]] | |
| volumeMounts: | |
| [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] | |
| - mountPath: /etc/istio/custom-bootstrap | |
| name: custom-bootstrap-volume | |
| [[- end ]] | |
| - mountPath: /etc/istio/proxy | |
| name: istio-envoy | |
| - mountPath: /etc/certs/ | |
| name: istio-certs | |
| readOnly: true | |
| [[- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` ]] | |
| [[ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) ]] | |
| - name: "[[ $index ]]" | |
| [[ toYaml $value | indent 4 ]] | |
| [[ end ]] | |
| [[- end ]] | |
| volumes: | |
| [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] | |
| - name: custom-bootstrap-volume | |
| configMap: | |
| name: [[ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` `` ]] | |
| [[- end ]] | |
| - emptyDir: | |
| medium: Memory | |
| name: istio-envoy | |
| - name: istio-certs | |
| secret: | |
| optional: true | |
| [[ if eq .Spec.ServiceAccountName "" -]] | |
| secretName: istio.default | |
| [[ else -]] | |
| secretName: [[ printf "istio.%s" .Spec.ServiceAccountName ]] | |
| [[ end -]] | |
| [[- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` ]] | |
| [[ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) ]] | |
| - name: "[[ $index ]]" | |
| [[ toYaml $value | indent 2 ]] | |
| [[ end ]] | |
| [[ end ]] | |
| --- | |
| # Source: istio/charts/galley/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-galley-service-account | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/gateways/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-ingressgateway-service-account | |
| namespace: istio-system | |
| labels: | |
| app: istio-ingressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-mixer-service-account | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/pilot/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-pilot-service-account | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/prometheus/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/security/templates/cleanup-secrets.yaml | |
| # The reason for creating a ServiceAccount and ClusterRole specifically for this | |
| # post-delete hooked job is because the citadel ServiceAccount is being deleted | |
| # before this hook is launched. On the other hand, running this hook before the | |
| # deletion of the citadel (e.g. pre-delete) won't delete the secrets because they | |
| # will be re-created immediately by the to-be-deleted citadel. | |
| # | |
| # It's also important that the ServiceAccount, ClusterRole and ClusterRoleBinding | |
| # will be ready before running the hooked Job therefore the hook weights. | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-cleanup-secrets-service-account | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "1" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-cleanup-secrets-istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "1" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["list", "delete"] | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-cleanup-secrets-istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "2" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-cleanup-secrets-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-cleanup-secrets-service-account | |
| namespace: istio-system | |
| --- | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| name: istio-cleanup-secrets-1.1.6 | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-delete | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| "helm.sh/hook-weight": "3" | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| template: | |
| metadata: | |
| name: istio-cleanup-secrets | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| serviceAccountName: istio-cleanup-secrets-service-account | |
| containers: | |
| - name: kubectl | |
| image: "docker.io/istio/kubectl:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| command: | |
| - /bin/bash | |
| - -c | |
| - > | |
| kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" | while read -r entry; do | |
| ns=$(echo $entry | awk '{print $1}'); | |
| name=$(echo $entry | awk '{print $2}'); | |
| kubectl delete secret $name -n $ns; | |
| done | |
| restartPolicy: OnFailure | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/create-custom-resources-job.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-security-post-install-account | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-security-post-install-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["authentication.istio.io"] # needed to create default authn policy | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["networking.istio.io"] # needed to create security destination rules | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["validatingwebhookconfigurations"] | |
| verbs: ["get"] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["deployments", "replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-security-post-install-role-binding-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-security-post-install-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-security-post-install-account | |
| namespace: istio-system | |
| --- | |
| apiVersion: batch/v1 | |
| kind: Job | |
| metadata: | |
| name: istio-security-post-install-1.1.6 | |
| namespace: istio-system | |
| annotations: | |
| "helm.sh/hook": post-install | |
| "helm.sh/hook-delete-policy": hook-succeeded | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| template: | |
| metadata: | |
| name: istio-security-post-install | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| serviceAccountName: istio-security-post-install-account | |
| containers: | |
| - name: kubectl | |
| image: "docker.io/istio/kubectl:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ] | |
| volumeMounts: | |
| - mountPath: "/tmp/security" | |
| name: tmp-configmap-security | |
| volumes: | |
| - name: tmp-configmap-security | |
| configMap: | |
| name: istio-security-custom-resources | |
| restartPolicy: OnFailure | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-citadel-service-account | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-sidecar-injector-service-account | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| --- | |
| # Source: istio/templates/serviceaccount.yaml | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: istio-multi | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/galley/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-galley-istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["validatingwebhookconfigurations"] | |
| verbs: ["*"] | |
| - apiGroups: ["config.istio.io"] # istio mixer CRD watcher | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["networking.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["authentication.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["rbac.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions","apps"] | |
| resources: ["deployments"] | |
| resourceNames: ["istio-galley"] | |
| verbs: ["get"] | |
| - apiGroups: [""] | |
| resources: ["pods", "nodes", "services", "endpoints"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions"] | |
| resources: ["ingresses"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions"] | |
| resources: ["deployments/finalizers"] | |
| resourceNames: ["istio-galley"] | |
| verbs: ["update"] | |
| --- | |
| # Source: istio/charts/gateways/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-ingressgateway-istio-system | |
| labels: | |
| app: ingressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["networking.istio.io"] | |
| resources: ["virtualservices", "destinationrules", "gateways"] | |
| verbs: ["get", "watch", "list", "update"] | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-mixer-istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["config.istio.io"] # istio CRD watcher | |
| resources: ["*"] | |
| verbs: ["create", "get", "list", "watch", "patch"] | |
| - apiGroups: ["apiextensions.k8s.io"] | |
| resources: ["customresourcedefinitions"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: [""] | |
| resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets", "replicationcontrollers"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/pilot/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-pilot-istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: ["config.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["rbac.istio.io"] | |
| resources: ["*"] | |
| verbs: ["get", "watch", "list"] | |
| - apiGroups: ["networking.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["authentication.istio.io"] | |
| resources: ["*"] | |
| verbs: ["*"] | |
| - apiGroups: ["apiextensions.k8s.io"] | |
| resources: ["customresourcedefinitions"] | |
| verbs: ["*"] | |
| - apiGroups: ["extensions"] | |
| resources: ["ingresses", "ingresses/status"] | |
| verbs: ["*"] | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["create", "get", "list", "watch", "update"] | |
| - apiGroups: [""] | |
| resources: ["endpoints", "pods", "services", "namespaces", "nodes", "secrets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/prometheus/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: prometheus-istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| - services | |
| - endpoints | |
| - pods | |
| - nodes/proxy | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: [""] | |
| resources: | |
| - configmaps | |
| verbs: ["get"] | |
| - nonResourceURLs: ["/metrics"] | |
| verbs: ["get"] | |
| --- | |
| # Source: istio/charts/security/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-citadel-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["create", "get", "update"] | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["create", "get", "watch", "list", "update", "delete"] | |
| - apiGroups: [""] | |
| resources: ["serviceaccounts", "services"] | |
| verbs: ["get", "watch", "list"] | |
| - apiGroups: ["authentication.k8s.io"] | |
| resources: ["tokenreviews"] | |
| verbs: ["create"] | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: istio-sidecar-injector-istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["configmaps"] | |
| verbs: ["get", "list", "watch"] | |
| - apiGroups: ["admissionregistration.k8s.io"] | |
| resources: ["mutatingwebhookconfigurations"] | |
| verbs: ["get", "list", "watch", "patch"] | |
| --- | |
| # Source: istio/templates/clusterrole.yaml | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| name: istio-reader | |
| rules: | |
| - apiGroups: [''] | |
| resources: ['nodes', 'pods', 'services', 'endpoints', "replicationcontrollers"] | |
| verbs: ['get', 'watch', 'list'] | |
| - apiGroups: ["extensions", "apps"] | |
| resources: ["replicasets"] | |
| verbs: ["get", "list", "watch"] | |
| --- | |
| # Source: istio/charts/galley/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-galley-admin-role-binding-istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-galley-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-galley-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/gateways/templates/clusterrolebindings.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-ingressgateway-istio-system | |
| labels: | |
| app: ingressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-ingressgateway-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-ingressgateway-service-account | |
| namespace: istio-system | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-mixer-admin-role-binding-istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-mixer-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-mixer-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/pilot/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-pilot-istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-pilot-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-pilot-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/prometheus/templates/clusterrolebindings.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: prometheus-istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: prometheus-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: prometheus | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/security/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-citadel-istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-citadel-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-citadel-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-sidecar-injector-admin-role-binding-istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-sidecar-injector-istio-system | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-sidecar-injector-service-account | |
| namespace: istio-system | |
| --- | |
| # Source: istio/templates/clusterrolebinding.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: istio-multi | |
| labels: | |
| chart: istio-1.1.0 | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: istio-reader | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-multi | |
| namespace: istio-system | |
| --- | |
| # Source: istio/charts/gateways/templates/role.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: Role | |
| metadata: | |
| name: istio-ingressgateway-sds | |
| namespace: istio-system | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["secrets"] | |
| verbs: ["get", "watch", "list"] | |
| --- | |
| --- | |
| # Source: istio/charts/gateways/templates/rolebindings.yaml | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: RoleBinding | |
| metadata: | |
| name: istio-ingressgateway-sds | |
| namespace: istio-system | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: Role | |
| name: istio-ingressgateway-sds | |
| subjects: | |
| - kind: ServiceAccount | |
| name: istio-ingressgateway-service-account | |
| --- | |
| --- | |
| # Source: istio/charts/galley/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| ports: | |
| - port: 443 | |
| name: https-validation | |
| - port: 15014 | |
| name: http-monitoring | |
| - port: 9901 | |
| name: grpc-mcp | |
| selector: | |
| istio: galley | |
| --- | |
| # Source: istio/charts/gateways/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| annotations: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| type: LoadBalancer | |
| selector: | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| ports: | |
| - | |
| name: status-port | |
| port: 15020 | |
| targetPort: 15020 | |
| - | |
| name: http2 | |
| nodePort: 31380 | |
| port: 80 | |
| targetPort: 80 | |
| - | |
| name: https | |
| nodePort: 31390 | |
| port: 443 | |
| - | |
| name: tcp | |
| nodePort: 31400 | |
| port: 31400 | |
| - | |
| name: https-kiali | |
| port: 15029 | |
| targetPort: 15029 | |
| - | |
| name: https-prometheus | |
| port: 15030 | |
| targetPort: 15030 | |
| - | |
| name: https-grafana | |
| port: 15031 | |
| targetPort: 15031 | |
| - | |
| name: https-tracing | |
| port: 15032 | |
| targetPort: 15032 | |
| - | |
| name: tls | |
| port: 15443 | |
| targetPort: 15443 | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| annotations: | |
| networking.istio.io/exportTo: "*" | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| ports: | |
| - name: grpc-mixer | |
| port: 9091 | |
| - name: grpc-mixer-mtls | |
| port: 15004 | |
| - name: http-monitoring | |
| port: 15014 | |
| selector: | |
| istio: mixer | |
| istio-mixer-type: policy | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| annotations: | |
| networking.istio.io/exportTo: "*" | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| ports: | |
| - name: grpc-mixer | |
| port: 9091 | |
| - name: grpc-mixer-mtls | |
| port: 15004 | |
| - name: http-monitoring | |
| port: 15014 | |
| - name: prometheus | |
| port: 42422 | |
| selector: | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| spec: | |
| ports: | |
| - port: 15010 | |
| name: grpc-xds # direct | |
| - port: 15011 | |
| name: https-xds # mTLS | |
| - port: 8080 | |
| name: http-legacy-discovery # direct | |
| - port: 15014 | |
| name: http-monitoring | |
| selector: | |
| istio: pilot | |
| --- | |
| # Source: istio/charts/prometheus/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| annotations: | |
| prometheus.io/scrape: 'true' | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| selector: | |
| app: prometheus | |
| ports: | |
| - name: http-prometheus | |
| protocol: TCP | |
| port: 9090 | |
| --- | |
| # Source: istio/charts/security/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| # we use the normal name here (e.g. 'prometheus') | |
| # as grafana is configured to use this as a data source | |
| name: istio-citadel | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| spec: | |
| ports: | |
| - name: grpc-citadel | |
| port: 8060 | |
| targetPort: 8060 | |
| protocol: TCP | |
| - name: http-monitoring | |
| port: 15014 | |
| selector: | |
| istio: citadel | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| spec: | |
| ports: | |
| - port: 443 | |
| selector: | |
| istio: sidecar-injector | |
| --- | |
| # Source: istio/charts/galley/templates/deployment.yaml | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-galley | |
| namespace: istio-system | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| spec: | |
| replicas: 1 | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: galley | |
| chart: galley | |
| heritage: Tiller | |
| release: istio | |
| istio: galley | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-galley-service-account | |
| containers: | |
| - name: galley | |
| image: "docker.io/istio/galley:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 443 | |
| - containerPort: 15014 | |
| - containerPort: 9901 | |
| command: | |
| - /usr/local/bin/galley | |
| - server | |
| - --meshConfigFile=/etc/mesh-config/mesh | |
| - --livenessProbeInterval=1s | |
| - --livenessProbePath=/healthliveness | |
| - --readinessProbePath=/healthready | |
| - --readinessProbeInterval=1s | |
| - --deployment-namespace=istio-system | |
| - --insecure=true | |
| - --validation-webhook-config-file | |
| - /etc/config/validatingwebhookconfiguration.yaml | |
| - --monitoringPort=15014 | |
| - --log_output_level=default:info | |
| volumeMounts: | |
| - name: certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: config | |
| mountPath: /etc/config | |
| readOnly: true | |
| - name: mesh-config | |
| mountPath: /etc/mesh-config | |
| readOnly: true | |
| livenessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/galley | |
| - probe | |
| - --probe-path=/healthliveness | |
| - --interval=10s | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/galley | |
| - probe | |
| - --probe-path=/healthready | |
| - --interval=10s | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumes: | |
| - name: certs | |
| secret: | |
| secretName: istio.istio-galley-service-account | |
| - name: config | |
| configMap: | |
| name: istio-galley-configuration | |
| - name: mesh-config | |
| configMap: | |
| name: istio | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/gateways/templates/deployment.yaml | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| spec: | |
| template: | |
| metadata: | |
| labels: | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| app: istio-ingressgateway | |
| istio: ingressgateway | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-ingressgateway-service-account | |
| containers: | |
| - name: istio-proxy | |
| image: "docker.io/istio/proxyv2:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15020 | |
| - containerPort: 80 | |
| - containerPort: 443 | |
| - containerPort: 31400 | |
| - containerPort: 15029 | |
| - containerPort: 15030 | |
| - containerPort: 15031 | |
| - containerPort: 15032 | |
| - containerPort: 15443 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - router | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --log_output_level=default:info | |
| - --drainDuration | |
| - '45s' #drainDuration | |
| - --parentShutdownDuration | |
| - '1m0s' #parentShutdownDuration | |
| - --connectTimeout | |
| - '10s' #connectTimeout | |
| - --serviceCluster | |
| - istio-ingressgateway | |
| - --zipkinAddress | |
| - zipkin:9411 | |
| - --proxyAdminPort | |
| - "15000" | |
| - --statusPort | |
| - "15020" | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| - --discoveryAddress | |
| - istio-pilot:15010 | |
| readinessProbe: | |
| failureThreshold: 30 | |
| httpGet: | |
| path: /healthz/ready | |
| port: 15020 | |
| scheme: HTTP | |
| initialDelaySeconds: 1 | |
| periodSeconds: 2 | |
| successThreshold: 1 | |
| timeoutSeconds: 1 | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 256Mi | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| - name: HOST_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.hostIP | |
| - name: ISTIO_META_POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: ISTIO_META_CONFIG_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: ISTIO_META_ROUTER_MODE | |
| value: sni-dnat | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: ingressgateway-certs | |
| mountPath: "/etc/istio/ingressgateway-certs" | |
| readOnly: true | |
| - name: ingressgateway-ca-certs | |
| mountPath: "/etc/istio/ingressgateway-ca-certs" | |
| readOnly: true | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-ingressgateway-service-account | |
| optional: true | |
| - name: ingressgateway-certs | |
| secret: | |
| secretName: "istio-ingressgateway-certs" | |
| optional: true | |
| - name: ingressgateway-ca-certs | |
| secret: | |
| secretName: "istio-ingressgateway-ca-certs" | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/deployment.yaml | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: istio-mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: mixer | |
| istio-mixer-type: policy | |
| template: | |
| metadata: | |
| labels: | |
| app: policy | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: policy | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-mixer-service-account | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-mixer-service-account | |
| optional: true | |
| - name: uds-socket | |
| emptyDir: {} | |
| - name: policy-adapter-secret | |
| secret: | |
| secretName: policy-adapter-secret | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| containers: | |
| - name: mixer | |
| image: "docker.io/istio/mixer:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15014 | |
| - containerPort: 42422 | |
| args: | |
| - --monitoringPort=15014 | |
| - --address | |
| - unix:///sock/mixer.socket | |
| - --log_output_level=default:info | |
| - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 | |
| - --configDefaultNamespace=istio-system | |
| - --useAdapterCRDs=true | |
| - --trace_zipkin_url=http://zipkin:9411/api/v1/spans | |
| env: | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: GOMAXPROCS | |
| value: "6" | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| - name: istio-proxy | |
| image: "docker.io/istio/proxyv2:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 9091 | |
| - containerPort: 15004 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-policy | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_policy.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| - name: policy-adapter-secret | |
| mountPath: /var/run/secrets/istio.io/policy/adapter | |
| readOnly: true | |
| --- | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: istio-mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| spec: | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| template: | |
| metadata: | |
| labels: | |
| app: telemetry | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| istio: mixer | |
| istio-mixer-type: telemetry | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-mixer-service-account | |
| volumes: | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-mixer-service-account | |
| optional: true | |
| - name: uds-socket | |
| emptyDir: {} | |
| - name: telemetry-adapter-secret | |
| secret: | |
| secretName: telemetry-adapter-secret | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| containers: | |
| - name: mixer | |
| image: "docker.io/istio/mixer:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15014 | |
| - containerPort: 42422 | |
| args: | |
| - --monitoringPort=15014 | |
| - --address | |
| - unix:///sock/mixer.socket | |
| - --log_output_level=default:info | |
| - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 | |
| - --configDefaultNamespace=istio-system | |
| - --useAdapterCRDs=true | |
| - --trace_zipkin_url=http://zipkin:9411/api/v1/spans | |
| - --averageLatencyThreshold | |
| - 100ms | |
| - --loadsheddingMode | |
| - enforce | |
| env: | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: GOMAXPROCS | |
| value: "6" | |
| resources: | |
| limits: | |
| cpu: 4800m | |
| memory: 4G | |
| requests: | |
| cpu: 1000m | |
| memory: 1G | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: telemetry-adapter-secret | |
| mountPath: /var/run/secrets/istio.io/telemetry/adapter | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| - name: istio-proxy | |
| image: "docker.io/istio/proxyv2:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 9091 | |
| - containerPort: 15004 | |
| - containerPort: 15090 | |
| protocol: TCP | |
| name: http-envoy-prom | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-telemetry | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_telemetry.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: uds-socket | |
| mountPath: /sock | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/deployment.yaml | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| # TODO: default template doesn't have this, which one is right ? | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| annotations: | |
| checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9 | |
| spec: | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| selector: | |
| matchLabels: | |
| istio: pilot | |
| template: | |
| metadata: | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| istio: pilot | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-pilot-service-account | |
| containers: | |
| - name: discovery | |
| image: "docker.io/istio/pilot:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - "discovery" | |
| - --monitoringAddr=:15014 | |
| - --log_output_level=default:info | |
| - --domain | |
| - cluster.local | |
| - --secureGrpcAddr | |
| - "" | |
| - --keepaliveMaxServerConnectionAge | |
| - "30m" | |
| ports: | |
| - containerPort: 8080 | |
| - containerPort: 15010 | |
| readinessProbe: | |
| httpGet: | |
| path: /ready | |
| port: 8080 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 30 | |
| timeoutSeconds: 5 | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: GODEBUG | |
| value: "gctrace=1" | |
| - name: PILOT_PUSH_THROTTLE | |
| value: "100" | |
| - name: PILOT_TRACE_SAMPLING | |
| value: "1" | |
| - name: PILOT_DISABLE_XDS_MARSHALING_TO_ANY | |
| value: "1" | |
| resources: | |
| requests: | |
| cpu: 500m | |
| memory: 2048Mi | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/istio/config | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| - name: istio-proxy | |
| image: "docker.io/istio/proxyv2:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| ports: | |
| - containerPort: 15003 | |
| - containerPort: 15005 | |
| - containerPort: 15007 | |
| - containerPort: 15011 | |
| args: | |
| - proxy | |
| - --domain | |
| - $(POD_NAMESPACE).svc.cluster.local | |
| - --serviceCluster | |
| - istio-pilot | |
| - --templateFile | |
| - /etc/istio/proxy/envoy_pilot.yaml.tmpl | |
| - --controlPlaneAuthPolicy | |
| - NONE | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: metadata.namespace | |
| - name: INSTANCE_IP | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| resources: | |
| limits: | |
| cpu: 2000m | |
| memory: 128Mi | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| volumeMounts: | |
| - name: istio-certs | |
| mountPath: /etc/certs | |
| readOnly: true | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: istio | |
| - name: istio-certs | |
| secret: | |
| secretName: istio.istio-pilot-service-account | |
| optional: true | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/prometheus/templates/deployment.yaml | |
| # TODO: the original template has service account, roles, etc | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: prometheus | |
| template: | |
| metadata: | |
| labels: | |
| app: prometheus | |
| chart: prometheus | |
| heritage: Tiller | |
| release: istio | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: prometheus | |
| containers: | |
| - name: prometheus | |
| image: "docker.io/prom/prometheus:v2.3.1" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - '--storage.tsdb.retention=6h' | |
| - '--config.file=/etc/prometheus/prometheus.yml' | |
| ports: | |
| - containerPort: 9090 | |
| name: http | |
| livenessProbe: | |
| httpGet: | |
| path: /-/healthy | |
| port: 9090 | |
| readinessProbe: | |
| httpGet: | |
| path: /-/ready | |
| port: 9090 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/prometheus | |
| - mountPath: /etc/istio-certs | |
| name: istio-certs | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: prometheus | |
| - name: istio-certs | |
| secret: | |
| defaultMode: 420 | |
| secretName: istio.default | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/security/templates/deployment.yaml | |
| # istio CA watching all namespaces | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-citadel | |
| namespace: istio-system | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| spec: | |
| replicas: 1 | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: security | |
| chart: security | |
| heritage: Tiller | |
| release: istio | |
| istio: citadel | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-citadel-service-account | |
| containers: | |
| - name: citadel | |
| image: "docker.io/istio/citadel:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - --append-dns-names=true | |
| - --grpc-port=8060 | |
| - --grpc-hostname=citadel | |
| - --citadel-storage-namespace=istio-system | |
| - --custom-dns-names=istio-pilot-service-account.istio-system:istio-pilot.istio-system | |
| - --monitoring-port=15014 | |
| - --self-signed-ca=true | |
| livenessProbe: | |
| httpGet: | |
| path: /version | |
| port: 15014 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 5 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml | |
| apiVersion: extensions/v1beta1 | |
| kind: Deployment | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| spec: | |
| replicas: 1 | |
| strategy: | |
| rollingUpdate: | |
| maxSurge: 1 | |
| maxUnavailable: 0 | |
| template: | |
| metadata: | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| istio: sidecar-injector | |
| annotations: | |
| sidecar.istio.io/inject: "false" | |
| spec: | |
| serviceAccountName: istio-sidecar-injector-service-account | |
| containers: | |
| - name: sidecar-injector-webhook | |
| image: "docker.io/istio/sidecar_injector:1.1.6" | |
| imagePullPolicy: IfNotPresent | |
| args: | |
| - --caCertFile=/etc/istio/certs/root-cert.pem | |
| - --tlsCertFile=/etc/istio/certs/cert-chain.pem | |
| - --tlsKeyFile=/etc/istio/certs/key.pem | |
| - --injectConfig=/etc/istio/inject/config | |
| - --meshConfig=/etc/istio/config/mesh | |
| - --healthCheckInterval=2s | |
| - --healthCheckFile=/health | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/istio/config | |
| readOnly: true | |
| - name: certs | |
| mountPath: /etc/istio/certs | |
| readOnly: true | |
| - name: inject-config | |
| mountPath: /etc/istio/inject | |
| readOnly: true | |
| livenessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/sidecar-injector | |
| - probe | |
| - --probe-path=/health | |
| - --interval=4s | |
| initialDelaySeconds: 4 | |
| periodSeconds: 4 | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /usr/local/bin/sidecar-injector | |
| - probe | |
| - --probe-path=/health | |
| - --interval=4s | |
| initialDelaySeconds: 4 | |
| periodSeconds: 4 | |
| resources: | |
| requests: | |
| cpu: 10m | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: istio | |
| - name: certs | |
| secret: | |
| secretName: istio.istio-sidecar-injector-service-account | |
| - name: inject-config | |
| configMap: | |
| name: istio-sidecar-injector | |
| items: | |
| - key: config | |
| path: config | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - ppc64le | |
| - s390x | |
| preferredDuringSchedulingIgnoredDuringExecution: | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - amd64 | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - ppc64le | |
| - weight: 2 | |
| preference: | |
| matchExpressions: | |
| - key: beta.kubernetes.io/arch | |
| operator: In | |
| values: | |
| - s390x | |
| --- | |
| # Source: istio/charts/gateways/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-ingressgateway | |
| namespace: istio-system | |
| labels: | |
| app: ingressgateway | |
| chart: gateways | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1beta1 | |
| kind: Deployment | |
| name: istio-ingressgateway | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/mixer/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1beta1 | |
| kind: Deployment | |
| name: istio-policy | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1beta1 | |
| kind: Deployment | |
| name: istio-telemetry | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/pilot/templates/autoscale.yaml | |
| apiVersion: autoscaling/v2beta1 | |
| kind: HorizontalPodAutoscaler | |
| metadata: | |
| name: istio-pilot | |
| namespace: istio-system | |
| labels: | |
| app: pilot | |
| chart: pilot | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| maxReplicas: 5 | |
| minReplicas: 1 | |
| scaleTargetRef: | |
| apiVersion: apps/v1beta1 | |
| kind: Deployment | |
| name: istio-pilot | |
| metrics: | |
| - type: Resource | |
| resource: | |
| name: cpu | |
| targetAverageUtilization: 80 | |
| --- | |
| --- | |
| # Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml | |
| apiVersion: admissionregistration.k8s.io/v1beta1 | |
| kind: MutatingWebhookConfiguration | |
| metadata: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| labels: | |
| app: sidecarInjectorWebhook | |
| chart: sidecarInjectorWebhook | |
| heritage: Tiller | |
| release: istio | |
| webhooks: | |
| - name: sidecar-injector.istio.io | |
| clientConfig: | |
| service: | |
| name: istio-sidecar-injector | |
| namespace: istio-system | |
| path: "/inject" | |
| caBundle: "" | |
| rules: | |
| - operations: [ "CREATE" ] | |
| apiGroups: [""] | |
| apiVersions: ["v1"] | |
| resources: ["pods"] | |
| failurePolicy: Fail | |
| namespaceSelector: | |
| matchLabels: | |
| istio-injection: enabled | |
| --- | |
| # Source: istio/charts/galley/templates/validatingwebhookconfiguration.yaml.tpl | |
| --- | |
| # Source: istio/charts/gateways/templates/preconfigured.yaml | |
| --- | |
| # Source: istio/charts/pilot/templates/meshexpansion.yaml | |
| --- | |
| # Source: istio/charts/prometheus/templates/ingress.yaml | |
| --- | |
| # Source: istio/charts/prometheus/templates/tests/test-prometheus-connection.yaml | |
| --- | |
| # Source: istio/charts/security/templates/enable-mesh-mtls.yaml | |
| --- | |
| # Source: istio/charts/security/templates/enable-mesh-permissive.yaml | |
| --- | |
| # Source: istio/charts/security/templates/meshexpansion.yaml | |
| --- | |
| # Source: istio/charts/security/templates/tests/test-citadel-connection.yaml | |
| --- | |
| # Source: istio/templates/endpoints.yaml | |
| --- | |
| # Source: istio/templates/install-custom-resources.sh.tpl | |
| --- | |
| # Source: istio/templates/service.yaml | |
| --- | |
| # Source: istio/charts/mixer/templates/config.yaml | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: attributemanifest | |
| metadata: | |
| name: istioproxy | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| attributes: | |
| origin.ip: | |
| valueType: IP_ADDRESS | |
| origin.uid: | |
| valueType: STRING | |
| origin.user: | |
| valueType: STRING | |
| request.headers: | |
| valueType: STRING_MAP | |
| request.id: | |
| valueType: STRING | |
| request.host: | |
| valueType: STRING | |
| request.method: | |
| valueType: STRING | |
| request.path: | |
| valueType: STRING | |
| request.url_path: | |
| valueType: STRING | |
| request.query_params: | |
| valueType: STRING_MAP | |
| request.reason: | |
| valueType: STRING | |
| request.referer: | |
| valueType: STRING | |
| request.scheme: | |
| valueType: STRING | |
| request.total_size: | |
| valueType: INT64 | |
| request.size: | |
| valueType: INT64 | |
| request.time: | |
| valueType: TIMESTAMP | |
| request.useragent: | |
| valueType: STRING | |
| response.code: | |
| valueType: INT64 | |
| response.duration: | |
| valueType: DURATION | |
| response.headers: | |
| valueType: STRING_MAP | |
| response.total_size: | |
| valueType: INT64 | |
| response.size: | |
| valueType: INT64 | |
| response.time: | |
| valueType: TIMESTAMP | |
| response.grpc_status: | |
| valueType: STRING | |
| response.grpc_message: | |
| valueType: STRING | |
| source.uid: | |
| valueType: STRING | |
| source.user: # DEPRECATED | |
| valueType: STRING | |
| source.principal: | |
| valueType: STRING | |
| destination.uid: | |
| valueType: STRING | |
| destination.principal: | |
| valueType: STRING | |
| destination.port: | |
| valueType: INT64 | |
| connection.event: | |
| valueType: STRING | |
| connection.id: | |
| valueType: STRING | |
| connection.received.bytes: | |
| valueType: INT64 | |
| connection.received.bytes_total: | |
| valueType: INT64 | |
| connection.sent.bytes: | |
| valueType: INT64 | |
| connection.sent.bytes_total: | |
| valueType: INT64 | |
| connection.duration: | |
| valueType: DURATION | |
| connection.mtls: | |
| valueType: BOOL | |
| connection.requested_server_name: | |
| valueType: STRING | |
| context.protocol: | |
| valueType: STRING | |
| context.proxy_error_code: | |
| valueType: STRING | |
| context.timestamp: | |
| valueType: TIMESTAMP | |
| context.time: | |
| valueType: TIMESTAMP | |
| # Deprecated, kept for compatibility | |
| context.reporter.local: | |
| valueType: BOOL | |
| context.reporter.kind: | |
| valueType: STRING | |
| context.reporter.uid: | |
| valueType: STRING | |
| api.service: | |
| valueType: STRING | |
| api.version: | |
| valueType: STRING | |
| api.operation: | |
| valueType: STRING | |
| api.protocol: | |
| valueType: STRING | |
| request.auth.principal: | |
| valueType: STRING | |
| request.auth.audiences: | |
| valueType: STRING | |
| request.auth.presenter: | |
| valueType: STRING | |
| request.auth.claims: | |
| valueType: STRING_MAP | |
| request.auth.raw_claims: | |
| valueType: STRING | |
| request.api_key: | |
| valueType: STRING | |
| rbac.permissive.response_code: | |
| valueType: STRING | |
| rbac.permissive.effective_policy_id: | |
| valueType: STRING | |
| check.error_code: | |
| valueType: INT64 | |
| check.error_message: | |
| valueType: STRING | |
| check.cache_hit: | |
| valueType: BOOL | |
| quota.cache_hit: | |
| valueType: BOOL | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: attributemanifest | |
| metadata: | |
| name: kubernetes | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| attributes: | |
| source.ip: | |
| valueType: IP_ADDRESS | |
| source.labels: | |
| valueType: STRING_MAP | |
| source.metadata: | |
| valueType: STRING_MAP | |
| source.name: | |
| valueType: STRING | |
| source.namespace: | |
| valueType: STRING | |
| source.owner: | |
| valueType: STRING | |
| source.serviceAccount: | |
| valueType: STRING | |
| source.services: | |
| valueType: STRING | |
| source.workload.uid: | |
| valueType: STRING | |
| source.workload.name: | |
| valueType: STRING | |
| source.workload.namespace: | |
| valueType: STRING | |
| destination.ip: | |
| valueType: IP_ADDRESS | |
| destination.labels: | |
| valueType: STRING_MAP | |
| destination.metadata: | |
| valueType: STRING_MAP | |
| destination.owner: | |
| valueType: STRING | |
| destination.name: | |
| valueType: STRING | |
| destination.container.name: | |
| valueType: STRING | |
| destination.namespace: | |
| valueType: STRING | |
| destination.service.uid: | |
| valueType: STRING | |
| destination.service.name: | |
| valueType: STRING | |
| destination.service.namespace: | |
| valueType: STRING | |
| destination.service.host: | |
| valueType: STRING | |
| destination.serviceAccount: | |
| valueType: STRING | |
| destination.workload.uid: | |
| valueType: STRING | |
| destination.workload.name: | |
| valueType: STRING | |
| destination.workload.namespace: | |
| valueType: STRING | |
| --- | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: requestcount | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: requestduration | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: response.duration | "0ms" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: requestsize | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: request.size | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: responsesize | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: response.size | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| request_protocol: api.protocol | context.protocol | "unknown" | |
| response_code: response.code | 200 | |
| response_flags: context.proxy_error_code | "-" | |
| permissive_response_code: rbac.permissive.response_code | "none" | |
| permissive_response_policyid: rbac.permissive.effective_policy_id | "none" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: tcpbytesent | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: connection.sent.bytes | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: tcpbytereceived | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: connection.received.bytes | 0 | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.host | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: tcpconnectionsopened | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.name | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: metric | |
| metadata: | |
| name: tcpconnectionsclosed | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| value: "1" | |
| dimensions: | |
| reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") | |
| source_workload: source.workload.name | "unknown" | |
| source_workload_namespace: source.workload.namespace | "unknown" | |
| source_principal: source.principal | "unknown" | |
| source_app: source.labels["app"] | "unknown" | |
| source_version: source.labels["version"] | "unknown" | |
| destination_workload: destination.workload.name | "unknown" | |
| destination_workload_namespace: destination.workload.namespace | "unknown" | |
| destination_principal: destination.principal | "unknown" | |
| destination_app: destination.labels["app"] | "unknown" | |
| destination_version: destination.labels["version"] | "unknown" | |
| destination_service: destination.service.name | "unknown" | |
| destination_service_name: destination.service.name | "unknown" | |
| destination_service_namespace: destination.service.namespace | "unknown" | |
| connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) | |
| response_flags: context.proxy_error_code | "-" | |
| monitored_resource_type: '"UNSPECIFIED"' | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: handler | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledAdapter: prometheus | |
| params: | |
| metricsExpirationPolicy: | |
| metricsExpiryDuration: "10m" | |
| metrics: | |
| - name: requests_total | |
| instance_name: requestcount.metric.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| - name: request_duration_seconds | |
| instance_name: requestduration.metric.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| explicit_buckets: | |
| bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10] | |
| - name: request_bytes | |
| instance_name: requestsize.metric.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| exponentialBuckets: | |
| numFiniteBuckets: 8 | |
| scale: 1 | |
| growthFactor: 10 | |
| - name: response_bytes | |
| instance_name: responsesize.metric.istio-system | |
| kind: DISTRIBUTION | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - request_protocol | |
| - response_code | |
| - response_flags | |
| - permissive_response_code | |
| - permissive_response_policyid | |
| - connection_security_policy | |
| buckets: | |
| exponentialBuckets: | |
| numFiniteBuckets: 8 | |
| scale: 1 | |
| growthFactor: 10 | |
| - name: tcp_sent_bytes_total | |
| instance_name: tcpbytesent.metric.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_received_bytes_total | |
| instance_name: tcpbytereceived.metric.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_connections_opened_total | |
| instance_name: tcpconnectionsopened.metric.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| - name: tcp_connections_closed_total | |
| instance_name: tcpconnectionsclosed.metric.istio-system | |
| kind: COUNTER | |
| label_names: | |
| - reporter | |
| - source_app | |
| - source_principal | |
| - source_workload | |
| - source_workload_namespace | |
| - source_version | |
| - destination_app | |
| - destination_principal | |
| - destination_workload | |
| - destination_workload_namespace | |
| - destination_version | |
| - destination_service | |
| - destination_service_name | |
| - destination_service_namespace | |
| - connection_security_policy | |
| - response_flags | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promhttp | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: (context.protocol == "http" || context.protocol == "grpc") && (match((request.useragent | "-"), "kube-probe*") == false) | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - requestcount.metric | |
| - requestduration.metric | |
| - requestsize.metric | |
| - responsesize.metric | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcp | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpbytesent.metric | |
| - tcpbytereceived.metric | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcpconnectionopen | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" && ((connection.event | "na") == "open") | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpconnectionsopened.metric | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: promtcpconnectionclosed | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" && ((connection.event | "na") == "close") | |
| actions: | |
| - handler: prometheus | |
| instances: | |
| - tcpconnectionsclosed.metric | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: handler | |
| metadata: | |
| name: kubernetesenv | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| compiledAdapter: kubernetesenv | |
| params: | |
| # when running from mixer root, use the following config after adding a | |
| # symbolic link to a kubernetes config file via: | |
| # | |
| # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig | |
| # | |
| # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig" | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: kubeattrgenrulerule | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| actions: | |
| - handler: kubernetesenv | |
| instances: | |
| - attributes.kubernetes | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: rule | |
| metadata: | |
| name: tcpkubeattrgenrulerule | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| match: context.protocol == "tcp" | |
| actions: | |
| - handler: kubernetesenv | |
| instances: | |
| - attributes.kubernetes | |
| --- | |
| apiVersion: "config.istio.io/v1alpha2" | |
| kind: kubernetes | |
| metadata: | |
| name: attributes | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| # Pass the required attribute data to the adapter | |
| source_uid: source.uid | "" | |
| source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr | |
| destination_uid: destination.uid | "" | |
| destination_port: destination.port | 0 | |
| attribute_bindings: | |
| # Fill the new attributes from the adapter produced output. | |
| # $out refers to an instance of OutputTemplate message | |
| source.ip: $out.source_pod_ip | ip("0.0.0.0") | |
| source.uid: $out.source_pod_uid | "unknown" | |
| source.labels: $out.source_labels | emptyStringMap() | |
| source.name: $out.source_pod_name | "unknown" | |
| source.namespace: $out.source_namespace | "default" | |
| source.owner: $out.source_owner | "unknown" | |
| source.serviceAccount: $out.source_service_account_name | "unknown" | |
| source.workload.uid: $out.source_workload_uid | "unknown" | |
| source.workload.name: $out.source_workload_name | "unknown" | |
| source.workload.namespace: $out.source_workload_namespace | "unknown" | |
| destination.ip: $out.destination_pod_ip | ip("0.0.0.0") | |
| destination.uid: $out.destination_pod_uid | "unknown" | |
| destination.labels: $out.destination_labels | emptyStringMap() | |
| destination.name: $out.destination_pod_name | "unknown" | |
| destination.container.name: $out.destination_container_name | "unknown" | |
| destination.namespace: $out.destination_namespace | "default" | |
| destination.owner: $out.destination_owner | "unknown" | |
| destination.serviceAccount: $out.destination_service_account_name | "unknown" | |
| destination.workload.uid: $out.destination_workload_uid | "unknown" | |
| destination.workload.name: $out.destination_workload_name | "unknown" | |
| destination.workload.namespace: $out.destination_workload_namespace | "unknown" | |
| --- | |
| # Configuration needed by Mixer. | |
| # Mixer cluster is delivered via CDS | |
| # Specify mixer cluster settings | |
| apiVersion: networking.istio.io/v1alpha3 | |
| kind: DestinationRule | |
| metadata: | |
| name: istio-policy | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| host: istio-policy.istio-system.svc.cluster.local | |
| trafficPolicy: | |
| connectionPool: | |
| http: | |
| http2MaxRequests: 10000 | |
| maxRequestsPerConnection: 10000 | |
| --- | |
| apiVersion: networking.istio.io/v1alpha3 | |
| kind: DestinationRule | |
| metadata: | |
| name: istio-telemetry | |
| namespace: istio-system | |
| labels: | |
| app: mixer | |
| chart: mixer | |
| heritage: Tiller | |
| release: istio | |
| spec: | |
| host: istio-telemetry.istio-system.svc.cluster.local | |
| trafficPolicy: | |
| connectionPool: | |
| http: | |
| http2MaxRequests: 10000 | |
| maxRequestsPerConnection: 10000 | |
| --- | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment