vnfs/DAaaS/deploy/00-init/istio-operator/templates/operator-istio-1.2-crd.yaml

   1 {{ if eq .Values.istioVersion 1.2 }}
   2 apiVersion: apiextensions.k8s.io/v1beta1
   3 kind: CustomResourceDefinition
   4 metadata:
   5   name: istios.istio.banzaicloud.io
   6   labels:
   7     controller-tools.k8s.io: "1.0"
   8     app.kubernetes.io/name: {{ include "istio-operator.name" . }}
   9     helm.sh/chart: {{ include "istio-operator.chart" . }}
  10     app.kubernetes.io/instance: {{ .Release.Name }}
  11     app.kubernetes.io/managed-by: {{ .Release.Service }}
  12     app.kubernetes.io/version: {{ .Chart.AppVersion }}
  13     app.kubernetes.io/component: operator
  14 spec:
  15   additionalPrinterColumns:
  16   - JSONPath: .status.Status
  17     description: Status of the resource
  18     name: Status
  19     type: string
  20   - JSONPath: .status.ErrorMessage
  21     description: Error message
  22     name: Error
  23     type: string
  24   - JSONPath: .status.GatewayAddress
  25     description: Ingress gateways of the resource
  26     name: Gateways
  27     type: string
  28   - JSONPath: .metadata.creationTimestamp
  29     name: Age
  30     type: date
  31   group: istio.banzaicloud.io
  32   names:
  33     kind: Istio
  34     plural: istios
  35   scope: Namespaced
  36   subresources:
  37     status: {}
  38   validation:
  39     openAPIV3Schema:
  40       properties:
  41         apiVersion:
  42           description: 'APIVersion defines the versioned schema of this representation
  43             of an object. Servers should convert recognized schemas to the latest
  44             internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
  45           type: string
  46         kind:
  47           description: 'Kind is a string value representing the REST resource this
  48             object represents. Servers may infer this from the endpoint the client
  49             submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
  50           type: string
  51         metadata:
  52           type: object
  53         spec:
  54           properties:
  55             autoInjectionNamespaces:
  56               description: List of namespaces to label with sidecar auto injection
  57                 enabled
  58               items:
  59                 type: string
  60               type: array
  61             citadel:
  62               description: Citadel configuration options
  63               properties:
  64                 affinity:
  65                   type: object
  66                 caSecretName:
  67                   type: string
  68                 enabled:
  69                   type: boolean
  70                 healthCheck:
  71                   description: Enable health checking on the Citadel CSR signing API.
  72                     https://istio.io/docs/tasks/security/health-check/
  73                   type: boolean
  74                 image:
  75                   type: string
  76                 maxWorkloadCertTTL:
  77                   description: Citadel uses a flag max-workload-cert-ttl to control
  78                     the maximum lifetime for Istio certificates issued to workloads.
  79                     The default value is 90 days. If workload-cert-ttl on Citadel
  80                     or node agent is greater than max-workload-cert-ttl, Citadel will
  81                     fail issuing the certificate.
  82                   type: string
  83                 nodeSelector:
  84                   type: object
  85                 resources:
  86                   type: object
  87                 tolerations:
  88                   items:
  89                     type: object
  90                   type: array
  91                 workloadCertTTL:
  92                   description: For the workloads running in Kubernetes, the lifetime
  93                     of their Istio certificates is controlled by the workload-cert-ttl
  94                     flag on Citadel. The default value is 90 days. This value should
  95                     be no greater than max-workload-cert-ttl of Citadel.
  96                   type: string
  97               type: object
  98             controlPlaneSecurityEnabled:
  99               description: ControlPlaneSecurityEnabled control plane services are
 100                 communicating through mTLS
 101               type: boolean
 102             defaultConfigVisibility:
 103               description: Set the default set of namespaces to which services, service
 104                 entries, virtual services, destination rules should be exported to
 105               type: string
 106             defaultPodDisruptionBudget:
 107               description: Enable pod disruption budget for the control plane, which
 108                 is used to ensure Istio control plane components are gradually upgraded
 109                 or recovered
 110               properties:
 111                 enabled:
 112                   type: boolean
 113               type: object
 114             defaultResources:
 115               description: DefaultResources are applied for all Istio components by
 116                 default, can be overridden for each component
 117               type: object
 118             excludeIPRanges:
 119               description: ExcludeIPRanges the range where not to capture egress traffic
 120               type: string
 121             galley:
 122               description: Galley configuration options
 123               properties:
 124                 affinity:
 125                   type: object
 126                 enabled:
 127                   type: boolean
 128                 image:
 129                   type: string
 130                 nodeSelector:
 131                   type: object
 132                 replicaCount:
 133                   format: int32
 134                   type: integer
 135                 resources:
 136                   type: object
 137                 tolerations:
 138                   items:
 139                     type: object
 140                   type: array
 141               type: object
 142             gateways:
 143               description: Gateways configuration options
 144               properties:
 145                 egress:
 146                   properties:
 147                     affinity:
 148                       type: object
 149                     applicationPorts:
 150                       type: string
 151                     enabled:
 152                       type: boolean
 153                     loadBalancerIP:
 154                       type: string
 155                     maxReplicas:
 156                       format: int32
 157                       type: integer
 158                     minReplicas:
 159                       format: int32
 160                       type: integer
 161                     nodeSelector:
 162                       type: object
 163                     ports:
 164                       items:
 165                         type: object
 166                       type: array
 167                     replicaCount:
 168                       format: int32
 169                       type: integer
 170                     requestedNetworkView:
 171                       type: string
 172                     resources:
 173                       type: object
 174                     sds:
 175                       properties:
 176                         enabled:
 177                           type: boolean
 178                         image:
 179                           type: string
 180                         resources:
 181                           type: object
 182                       type: object
 183                     serviceAnnotations:
 184                       type: object
 185                     serviceLabels:
 186                       type: object
 187                     serviceType:
 188                       enum:
 189                       - ClusterIP
 190                       - NodePort
 191                       - LoadBalancer
 192                       type: string
 193                     tolerations:
 194                       items:
 195                         type: object
 196                       type: array
 197                   type: object
 198                 enabled:
 199                   type: boolean
 200                 ingress:
 201                   properties:
 202                     affinity:
 203                       type: object
 204                     applicationPorts:
 205                       type: string
 206                     enabled:
 207                       type: boolean
 208                     loadBalancerIP:
 209                       type: string
 210                     maxReplicas:
 211                       format: int32
 212                       type: integer
 213                     minReplicas:
 214                       format: int32
 215                       type: integer
 216                     nodeSelector:
 217                       type: object
 218                     ports:
 219                       items:
 220                         type: object
 221                       type: array
 222                     replicaCount:
 223                       format: int32
 224                       type: integer
 225                     requestedNetworkView:
 226                       type: string
 227                     resources:
 228                       type: object
 229                     sds:
 230                       properties:
 231                         enabled:
 232                           type: boolean
 233                         image:
 234                           type: string
 235                         resources:
 236                           type: object
 237                       type: object
 238                     serviceAnnotations:
 239                       type: object
 240                     serviceLabels:
 241                       type: object
 242                     serviceType:
 243                       enum:
 244                       - ClusterIP
 245                       - NodePort
 246                       - LoadBalancer
 247                       type: string
 248                     tolerations:
 249                       items:
 250                         type: object
 251                       type: array
 252                   type: object
 253               type: object
 254             imagePullPolicy:
 255               description: ImagePullPolicy describes a policy for if/when to pull
 256                 a container image
 257               enum:
 258               - Always
 259               - Never
 260               - IfNotPresent
 261               type: string
 262             includeIPRanges:
 263               description: IncludeIPRanges the range where to capture egress traffic
 264               type: string
 265             istioCoreDNS:
 266               description: Istio CoreDNS provides DNS resolution for services in multi
 267                 mesh setups
 268               properties:
 269                 affinity:
 270                   type: object
 271                 enabled:
 272                   type: boolean
 273                 image:
 274                   type: string
 275                 nodeSelector:
 276                   type: object
 277                 pluginImage:
 278                   type: string
 279                 replicaCount:
 280                   format: int32
 281                   type: integer
 282                 resources:
 283                   type: object
 284                 tolerations:
 285                   items:
 286                     type: object
 287                   type: array
 288               type: object
 289             localityLB:
 290               description: Locality based load balancing distribution or failover
 291                 settings.
 292               properties:
 293                 distribute:
 294                   description: 'Optional: only one of distribute or failover can be
 295                     set. Explicitly specify loadbalancing weight across different
 296                     zones and geographical locations. Refer to [Locality weighted
 297                     load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight)
 298                     If empty, the locality weight is set according to the endpoints
 299                     number within it.'
 300                   items:
 301                     properties:
 302                       from:
 303                         description: Originating locality, '/' separated, e.g. 'region/zone'.
 304                         type: string
 305                       to:
 306                         description: Map of upstream localities to traffic distribution
 307                           weights. The sum of all weights should be == 100. Any locality
 308                           not assigned a weight will receive no traffic.
 309                         type: object
 310                     type: object
 311                   type: array
 312                 enabled:
 313                   description: If set to true, locality based load balancing will
 314                     be enabled
 315                   type: boolean
 316                 failover:
 317                   description: 'Optional: only failover or distribute can be set.
 318                     Explicitly specify the region traffic will land on when endpoints
 319                     in local region becomes unhealthy. Should be used together with
 320                     OutlierDetection to detect unhealthy endpoints. Note: if no OutlierDetection
 321                     specified, this will not take effect.'
 322                   items:
 323                     properties:
 324                       from:
 325                         description: Originating region.
 326                         type: string
 327                       to:
 328                         description: Destination region the traffic will fail over
 329                           to when endpoints in the 'from' region becomes unhealthy.
 330                         type: string
 331                     type: object
 332                   type: array
 333               type: object
 334             meshExpansion:
 335               description: If set to true, the pilot and citadel mtls will be exposed
 336                 on the ingress gateway also the remote istios will be connected through
 337                 gateways
 338               type: boolean
 339             mixer:
 340               description: Mixer configuration options
 341               properties:
 342                 affinity:
 343                   type: object
 344                 enabled:
 345                   type: boolean
 346                 image:
 347                   type: string
 348                 maxReplicas:
 349                   format: int32
 350                   type: integer
 351                 minReplicas:
 352                   format: int32
 353                   type: integer
 354                 multiClusterSupport:
 355                   description: Turn it on if you use mixer that supports multi cluster
 356                     telemetry
 357                   type: boolean
 358                 nodeSelector:
 359                   type: object
 360                 replicaCount:
 361                   format: int32
 362                   type: integer
 363                 resources:
 364                   type: object
 365                 tolerations:
 366                   items:
 367                     type: object
 368                   type: array
 369               type: object
 370             mtls:
 371               description: MTLS enables or disables global mTLS
 372               type: boolean
 373             multiMesh:
 374               description: Set to true to connect two or more meshes via their respective
 375                 ingressgateway services when workloads in each cluster cannot directly
 376                 talk to one another. All meshes should be using Istio mTLS and must
 377                 have a shared root CA for this model to work.
 378               type: boolean
 379             nodeAgent:
 380               description: NodeAgent configuration options
 381               properties:
 382                 affinity:
 383                   type: object
 384                 enabled:
 385                   type: boolean
 386                 image:
 387                   type: string
 388                 nodeSelector:
 389                   type: object
 390                 resources:
 391                   type: object
 392                 tolerations:
 393                   items:
 394                     type: object
 395                   type: array
 396               type: object
 397             outboundTrafficPolicy:
 398               description: Set the default behavior of the sidecar for handling outbound
 399                 traffic from the application (ALLOW_ANY or REGISTRY_ONLY)
 400               properties:
 401                 mode:
 402                   enum:
 403                   - ALLOW_ANY
 404                   - REGISTRY_ONLY
 405                   type: string
 406               type: object
 407             pilot:
 408               description: Pilot configuration options
 409               properties:
 410                 affinity:
 411                   type: object
 412                 enabled:
 413                   type: boolean
 414                 image:
 415                   type: string
 416                 maxReplicas:
 417                   format: int32
 418                   type: integer
 419                 minReplicas:
 420                   format: int32
 421                   type: integer
 422                 nodeSelector:
 423                   type: object
 424                 replicaCount:
 425                   format: int32
 426                   type: integer
 427                 resources:
 428                   type: object
 429                 sidecar:
 430                   type: boolean
 431                 tolerations:
 432                   items:
 433                     type: object
 434                   type: array
 435                 traceSampling:
 436                   format: float
 437                   type: number
 438               type: object
 439             proxy:
 440               description: Proxy configuration options
 441               properties:
 442                 componentLogLevel:
 443                   description: Per Component log level for proxy, applies to gateways
 444                     and sidecars. If a component level is not set, then the "LogLevel"
 445                     will be used. If left empty, "misc:error" is used.
 446                   type: string
 447                 dnsRefreshRate:
 448                   description: Configure the DNS refresh rate for Envoy cluster of
 449                     type STRICT_DNS This must be given it terms of seconds. For example,
 450                     300s is valid but 5m is invalid.
 451                   pattern: ^[0-9]{1,5}s$
 452                   type: string
 453                 enableCoreDump:
 454                   description: If set, newly injected sidecars will have core dumps
 455                     enabled.
 456                   type: boolean
 457                 image:
 458                   type: string
 459                 logLevel:
 460                   description: 'Log level for proxy, applies to gateways and sidecars.
 461                     If left empty, "warning" is used. Expected values are: trace|debug|info|warning|error|critical|off'
 462                   enum:
 463                     - trace
 464                     - debug
 465                     - info
 466                     - warning
 467                     - error
 468                     - critical
 469                     - "off"
 470                   type: string
 471                 privileged:
 472                   description: If set to true, istio-proxy container will have privileged
 473                     securityContext
 474                   type: boolean
 475                 resources:
 476                   type: object
 477               type: object
 478             proxyInit:
 479               description: Proxy Init configuration options
 480               properties:
 481                 image:
 482                   type: string
 483               type: object
 484             sds:
 485               description: If SDS is configured, mTLS certificates for the sidecars
 486                 will be distributed through the SecretDiscoveryService instead of
 487                 using K8S secrets to mount the certificates
 488               properties:
 489                 customTokenDirectory:
 490                   type: string
 491                 enabled:
 492                   description: If set to true, mTLS certificates for the sidecars
 493                     will be distributed through the SecretDiscoveryService instead
 494                     of using K8S secrets to mount the certificates.
 495                   type: boolean
 496                 udsPath:
 497                   description: Unix Domain Socket through which envoy communicates
 498                     with NodeAgent SDS to get key/cert for mTLS. Use secret-mount
 499                     files instead of SDS if set to empty.
 500                   type: string
 501                 useNormalJwt:
 502                   description: If set to true, envoy will fetch normal k8s service
 503                     account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token'
 504                     (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod)
 505                     and pass to sds server, which will be used to request key/cert
 506                     eventually this flag is ignored if UseTrustworthyJwt is set
 507                   type: boolean
 508                 useTrustworthyJwt:
 509                   description: 'If set to true, Istio will inject volumes mount for
 510                     k8s service account JWT, so that K8s API server mounts k8s service
 511                     account JWT to envoy container, which will be used to generate
 512                     key/cert eventually. (prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected)'
 513                   type: boolean
 514               type: object
 515             sidecarInjector:
 516               description: SidecarInjector configuration options
 517               properties:
 518                 affinity:
 519                   type: object
 520                 alwaysInjectSelector:
 521                   description: 'AlwaysInjectSelector: Forces the injection on pods
 522                     whose labels match this selector. It''s an array of label selectors,
 523                     that will be OR''ed, meaning we will iterate over it and stop
 524                     at the first match'
 525                   items:
 526                     type: object
 527                   type: array
 528                 autoInjectionPolicyEnabled:
 529                   description: This controls the 'policy' in the sidecar injector
 530                   type: boolean
 531                 enableNamespacesByDefault:
 532                   description: This controls whether the webhook looks for namespaces
 533                     for injection enabled or disabled
 534                   type: boolean
 535                 enabled:
 536                   type: boolean
 537                 image:
 538                   type: string
 539                 init:
 540                   properties:
 541                     resources:
 542                       type: object
 543                   type: object
 544                 initCNIConfiguration:
 545                   properties:
 546                     affinity:
 547                       type: object
 548                     binDir:
 549                       description: Must be the same as the environment’s --cni-bin-dir
 550                         setting (kubelet parameter)
 551                       type: string
 552                     confDir:
 553                       description: Must be the same as the environment’s --cni-conf-dir
 554                         setting (kubelet parameter)
 555                       type: string
 556                     enabled:
 557                       description: If true, the privileged initContainer istio-init
 558                         is not needed to perform the traffic redirect settings for
 559                         the istio-proxy
 560                       type: boolean
 561                     excludeNamespaces:
 562                       description: List of namespaces to exclude from Istio pod check
 563                       items:
 564                         type: string
 565                       type: array
 566                     image:
 567                       type: string
 568                     logLevel:
 569                       description: Logging level for CNI binary
 570                       type: string
 571                   type: object
 572                 neverInjectSelector:
 573                   description: 'NeverInjectSelector: Refuses the injection on pods
 574                     whose labels match this selector. It''s an array of label selectors,
 575                     that will be OR''ed, meaning we will iterate over it and stop
 576                     at the first match Takes precedence over AlwaysInjectSelector.'
 577                   items:
 578                     type: object
 579                   type: array
 580                 nodeSelector:
 581                   type: object
 582                 replicaCount:
 583                   format: int32
 584                   type: integer
 585                 resources:
 586                   type: object
 587                 rewriteAppHTTPProbe:
 588                   description: If true, sidecar injector will rewrite PodSpec for
 589                     liveness health check to redirect request to sidecar. This makes
 590                     liveness check work even when mTLS is enabled.
 591                   type: boolean
 592                 tolerations:
 593                   items:
 594                     type: object
 595                   type: array
 596               type: object
 597             tracing:
 598               description: Configuration for each of the supported tracers
 599               properties:
 600                 datadog:
 601                   properties:
 602                     address:
 603                       description: Host:Port for submitting traces to the Datadog
 604                         agent.
 605                       pattern: ^[^\:]+:[0-9]{1,5}$
 606                       type: string
 607                   type: object
 608                 enabled:
 609                   type: boolean
 610                 lightstep:
 611                   properties:
 612                     accessToken:
 613                       description: required for sending data to the pool
 614                       type: string
 615                     address:
 616                       description: the <host>:<port> of the satellite pool
 617                       pattern: ^[^\:]+:[0-9]{1,5}$
 618                       type: string
 619                     cacertPath:
 620                       description: the path to the file containing the cacert to use
 621                         when verifying TLS. If secure is true, this is required. If
 622                         a value is specified then a secret called "lightstep.cacert"
 623                         must be created in the destination namespace with the key
 624                         matching the base of the provided cacertPath and the value
 625                         being the cacert itself.
 626                       type: string
 627                     secure:
 628                       description: specifies whether data should be sent with TLS
 629                       type: boolean
 630                   type: object
 631                 tracer:
 632                   enum:
 633                   - zipkin
 634                   - lightstep
 635                   - datadog
 636                   type: string
 637                 zipkin:
 638                   properties:
 639                     address:
 640                       description: Host:Port for reporting trace data in zipkin format.
 641                         If not specified, will default to zipkin service (port 9411)
 642                         in the same namespace as the other istio components.
 643                       pattern: ^[^\:]+:[0-9]{1,5}$
 644                       type: string
 645                   type: object
 646               type: object
 647             useMCP:
 648               description: Use the Mesh Control Protocol (MCP) for configuring Mixer
 649                 and Pilot. Requires galley.
 650               type: boolean
 651             version:
 652               description: Contains the intended Istio version
 653               pattern: ^1.2
 654               type: string
 655             watchAdapterCRDs:
 656               description: Whether or not to establish watches for adapter-specific
 657                 CRDs
 658               type: boolean
 659             watchOneNamespace:
 660               description: Whether to restrict the applications namespace the controller
 661                 manages
 662               type: boolean
 663           required:
 664           - version
 665           - mtls
 666           type: object
 667         status:
 668           type: object
 669   version: v1beta1
 670 status:
 671   acceptedNames:
 672     kind: ""
 673     plural: ""
 674   conditions: []
 675   storedVersions: []
 676 {{- end }}