install/istio-auth.yaml

   1 apiVersion: v1
   2 kind: Namespace
   3 metadata:
   4   name: istio-system
   5   labels:
   6     istio-injection: disabled
   7 ---
   8 # Source: istio/charts/galley/templates/configmap.yaml
   9 apiVersion: v1
  10 kind: ConfigMap
  11 metadata:
  12   name: istio-galley-configuration
  13   namespace: istio-system
  14   labels:
  15     app: istio-galley
  16     chart: galley-1.0.0
  17     release: RELEASE-NAME
  18     heritage: Tiller
  19     istio: mixer
  20 data:
  21   validatingwebhookconfiguration.yaml: |-
  22     apiVersion: admissionregistration.k8s.io/v1beta1
  23     kind: ValidatingWebhookConfiguration
  24     metadata:
  25       name: istio-galley
  26       namespace: istio-system
  27       labels:
  28         app: istio-galley
  29         chart: galley-1.0.0
  30         release: RELEASE-NAME
  31         heritage: Tiller
  32     webhooks:
  33       - name: pilot.validation.istio.io
  34         clientConfig:
  35           service:
  36             name: istio-galley
  37             namespace: istio-system
  38             path: "/admitpilot"
  39           caBundle: ""
  40         rules:
  41           - operations:
  42             - CREATE
  43             - UPDATE
  44             apiGroups:
  45             - config.istio.io
  46             apiVersions:
  47             - v1alpha2
  48             resources:
  49             - httpapispecs
  50             - httpapispecbindings
  51             - quotaspecs
  52             - quotaspecbindings
  53           - operations:
  54             - CREATE
  55             - UPDATE
  56             apiGroups:
  57             - rbac.istio.io
  58             apiVersions:
  59             - "*"
  60             resources:
  61             - "*"
  62           - operations:
  63             - CREATE
  64             - UPDATE
  65             apiGroups:
  66             - authentication.istio.io
  67             apiVersions:
  68             - "*"
  69             resources:
  70             - "*"
  71           - operations:
  72             - CREATE
  73             - UPDATE
  74             apiGroups:
  75             - networking.istio.io
  76             apiVersions:
  77             - "*"
  78             resources:
  79             - destinationrules
  80             - envoyfilters
  81             - gateways
  82             # disabled per @costinm's request
  83             # - serviceentries
  84             - virtualservices
  85         failurePolicy: Fail
  86       - name: mixer.validation.istio.io
  87         clientConfig:
  88           service:
  89             name: istio-galley
  90             namespace: istio-system
  91             path: "/admitmixer"
  92           caBundle: ""
  93         rules:
  94           - operations:
  95             - CREATE
  96             - UPDATE
  97             apiGroups:
  98             - config.istio.io
  99             apiVersions:
 100             - v1alpha2
 101             resources:
 102             - rules
 103             - attributemanifests
 104             - circonuses
 105             - deniers
 106             - fluentds
 107             - kubernetesenvs
 108             - listcheckers
 109             - memquotas
 110             - noops
 111             - opas
 112             - prometheuses
 113             - rbacs
 114             - servicecontrols
 115             - solarwindses
 116             - stackdrivers
 117             - statsds
 118             - stdios
 119             - apikeys
 120             - authorizations
 121             - checknothings
 122             # - kuberneteses
 123             - listentries
 124             - logentries
 125             - metrics
 126             - quotas
 127             - reportnothings
 128             - servicecontrolreports
 129             - tracespans
 130         failurePolicy: Fail
 131
 132
 133 ---
 134 # Source: istio/charts/grafana/templates/configmap.yaml
 135 apiVersion: v1
 136 kind: ConfigMap
 137 metadata:
 138   name: istio-grafana-custom-resources
 139   namespace: istio-system
 140   labels:
 141     app: istio-grafana
 142     chart: grafana-0.1.0
 143     release: RELEASE-NAME
 144     heritage: Tiller
 145     istio: grafana
 146 data:
 147   custom-resources.yaml: |-
 148     apiVersion: authentication.istio.io/v1alpha1
 149     kind: Policy
 150     metadata:
 151       name: grafana-ports-mtls-disabled
 152       namespace: istio-system
 153     spec:
 154       targets:
 155       - name: grafana
 156         ports:
 157         - number: 3000
 158   run.sh: |-
 159     #!/bin/sh
 160
 161     set -x
 162
 163     if [ "$#" -ne "1" ]; then
 164         echo "first argument should be path to custom resource yaml"
 165         exit 1
 166     fi
 167
 168     pathToResourceYAML=${1}
 169
 170     /kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null
 171     if [ "$?" -eq 0 ]; then
 172         echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready"
 173         while true; do
 174             /kubectl -n istio-system get deployment istio-galley 2>/dev/null
 175             if [ "$?" -eq 0 ]; then
 176                 break
 177             fi
 178             sleep 1
 179         done
 180         /kubectl -n istio-system rollout status deployment istio-galley
 181         if [ "$?" -ne 0 ]; then
 182             echo "istio-galley deployment rollout status check failed"
 183             exit 1
 184         fi
 185         echo "istio-galley deployment ready for configuration validation"
 186     fi
 187     sleep 5
 188     /kubectl apply -f ${pathToResourceYAML}
 189
 190
 191 ---
 192 # Source: istio/charts/mixer/templates/configmap.yaml
 193 apiVersion: v1
 194 kind: ConfigMap
 195 metadata:
 196   name: istio-statsd-prom-bridge
 197   namespace: istio-system
 198   labels:
 199     app: istio-statsd-prom-bridge
 200     chart: mixer-1.0.0
 201     release: RELEASE-NAME
 202     heritage: Tiller
 203     istio: mixer
 204 data:
 205   mapping.conf: |-
 206
 207 ---
 208 # Source: istio/charts/prometheus/templates/configmap.yaml
 209 apiVersion: v1
 210 kind: ConfigMap
 211 metadata:
 212   name: prometheus
 213   namespace: istio-system
 214   labels:
 215     app: prometheus
 216     chart: prometheus-0.1.0
 217     release: RELEASE-NAME
 218     heritage: Tiller
 219 data:
 220   prometheus.yml: |-
 221     global:
 222       scrape_interval: 15s
 223     scrape_configs:
 224
 225     - job_name: 'istio-mesh'
 226       # Override the global default and scrape targets from this job every 5 seconds.
 227       scrape_interval: 5s
 228
 229       kubernetes_sd_configs:
 230       - role: endpoints
 231         namespaces:
 232           names:
 233           - istio-system
 234
 235       relabel_configs:
 236       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 237         action: keep
 238         regex: istio-telemetry;prometheus
 239
 240     - job_name: 'envoy'
 241       # Override the global default and scrape targets from this job every 5 seconds.
 242       scrape_interval: 5s
 243       # metrics_path defaults to '/metrics'
 244       # scheme defaults to 'http'.
 245
 246       kubernetes_sd_configs:
 247       - role: endpoints
 248         namespaces:
 249           names:
 250           - istio-system
 251
 252       relabel_configs:
 253       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 254         action: keep
 255         regex: istio-statsd-prom-bridge;statsd-prom
 256
 257     - job_name: 'istio-policy'
 258       # Override the global default and scrape targets from this job every 5 seconds.
 259       scrape_interval: 5s
 260       # metrics_path defaults to '/metrics'
 261       # scheme defaults to 'http'.
 262
 263       kubernetes_sd_configs:
 264       - role: endpoints
 265         namespaces:
 266           names:
 267           - istio-system
 268
 269
 270       relabel_configs:
 271       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 272         action: keep
 273         regex: istio-policy;http-monitoring
 274
 275     - job_name: 'istio-telemetry'
 276       # Override the global default and scrape targets from this job every 5 seconds.
 277       scrape_interval: 5s
 278       # metrics_path defaults to '/metrics'
 279       # scheme defaults to 'http'.
 280
 281       kubernetes_sd_configs:
 282       - role: endpoints
 283         namespaces:
 284           names:
 285           - istio-system
 286
 287       relabel_configs:
 288       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 289         action: keep
 290         regex: istio-telemetry;http-monitoring
 291
 292     - job_name: 'pilot'
 293       # Override the global default and scrape targets from this job every 5 seconds.
 294       scrape_interval: 5s
 295       # metrics_path defaults to '/metrics'
 296       # scheme defaults to 'http'.
 297
 298       kubernetes_sd_configs:
 299       - role: endpoints
 300         namespaces:
 301           names:
 302           - istio-system
 303
 304       relabel_configs:
 305       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 306         action: keep
 307         regex: istio-pilot;http-monitoring
 308
 309     - job_name: 'galley'
 310       # Override the global default and scrape targets from this job every 5 seconds.
 311       scrape_interval: 5s
 312       # metrics_path defaults to '/metrics'
 313       # scheme defaults to 'http'.
 314
 315       kubernetes_sd_configs:
 316       - role: endpoints
 317         namespaces:
 318           names:
 319           - istio-system
 320
 321       relabel_configs:
 322       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 323         action: keep
 324         regex: istio-galley;http-monitoring
 325
 326     # scrape config for API servers
 327     - job_name: 'kubernetes-apiservers'
 328       kubernetes_sd_configs:
 329       - role: endpoints
 330         namespaces:
 331           names:
 332           - default
 333       scheme: https
 334       tls_config:
 335         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 336       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 337       relabel_configs:
 338       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 339         action: keep
 340         regex: kubernetes;https
 341
 342     # scrape config for nodes (kubelet)
 343     - job_name: 'kubernetes-nodes'
 344       scheme: https
 345       tls_config:
 346         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 347       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 348       kubernetes_sd_configs:
 349       - role: node
 350       relabel_configs:
 351       - action: labelmap
 352         regex: __meta_kubernetes_node_label_(.+)
 353       - target_label: __address__
 354         replacement: kubernetes.default.svc:443
 355       - source_labels: [__meta_kubernetes_node_name]
 356         regex: (.+)
 357         target_label: __metrics_path__
 358         replacement: /api/v1/nodes/${1}/proxy/metrics
 359
 360     # Scrape config for Kubelet cAdvisor.
 361     #
 362     # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
 363     # (those whose names begin with 'container_') have been removed from the
 364     # Kubelet metrics endpoint.  This job scrapes the cAdvisor endpoint to
 365     # retrieve those metrics.
 366     #
 367     # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
 368     # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
 369     # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
 370     # the --cadvisor-port=0 Kubelet flag).
 371     #
 372     # This job is not necessary and should be removed in Kubernetes 1.6 and
 373     # earlier versions, or it will cause the metrics to be scraped twice.
 374     - job_name: 'kubernetes-cadvisor'
 375       scheme: https
 376       tls_config:
 377         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 378       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 379       kubernetes_sd_configs:
 380       - role: node
 381       relabel_configs:
 382       - action: labelmap
 383         regex: __meta_kubernetes_node_label_(.+)
 384       - target_label: __address__
 385         replacement: kubernetes.default.svc:443
 386       - source_labels: [__meta_kubernetes_node_name]
 387         regex: (.+)
 388         target_label: __metrics_path__
 389         replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
 390
 391     # scrape config for service endpoints.
 392     - job_name: 'kubernetes-service-endpoints'
 393       kubernetes_sd_configs:
 394       - role: endpoints
 395       relabel_configs:
 396       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
 397         action: keep
 398         regex: true
 399       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
 400         action: replace
 401         target_label: __scheme__
 402         regex: (https?)
 403       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
 404         action: replace
 405         target_label: __metrics_path__
 406         regex: (.+)
 407       - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
 408         action: replace
 409         target_label: __address__
 410         regex: ([^:]+)(?::\d+)?;(\d+)
 411         replacement: $1:$2
 412       - action: labelmap
 413         regex: __meta_kubernetes_service_label_(.+)
 414       - source_labels: [__meta_kubernetes_namespace]
 415         action: replace
 416         target_label: kubernetes_namespace
 417       - source_labels: [__meta_kubernetes_service_name]
 418         action: replace
 419         target_label: kubernetes_name
 420
 421     # Example scrape config for pods
 422     - job_name: 'kubernetes-pods'
 423       kubernetes_sd_configs:
 424       - role: pod
 425
 426       relabel_configs:
 427       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 428         action: keep
 429         regex: true
 430       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
 431         action: replace
 432         target_label: __metrics_path__
 433         regex: (.+)
 434       - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
 435         action: replace
 436         regex: ([^:]+)(?::\d+)?;(\d+)
 437         replacement: $1:$2
 438         target_label: __address__
 439       - action: labelmap
 440         regex: __meta_kubernetes_pod_label_(.+)
 441       - source_labels: [__meta_kubernetes_namespace]
 442         action: replace
 443         target_label: namespace
 444       - source_labels: [__meta_kubernetes_pod_name]
 445         action: replace
 446         target_label: pod_name
 447
 448 ---
 449 # Source: istio/charts/security/templates/configmap.yaml
 450 apiVersion: v1
 451 kind: ConfigMap
 452 metadata:
 453   name: istio-security-custom-resources
 454   namespace: istio-system
 455   labels:
 456     app: istio-security
 457     chart: security-1.0.0
 458     release: RELEASE-NAME
 459     heritage: Tiller
 460     istio: security
 461 data:
 462   custom-resources.yaml: |-
 463     # These policy and destination rules effectively enable mTLS for all services in the mesh. For now,
 464     # they are added to Istio installation yaml for backward compatible. In future, they should be in
 465     # a separated yaml file so that customer can enable mTLS independent from installation.
 466
 467     # Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
 468     apiVersion: "authentication.istio.io/v1alpha1"
 469     kind: "MeshPolicy"
 470     metadata:
 471       name: "default"
 472       labels:
 473         app: istio-security
 474         chart: security-1.0.0
 475         release: RELEASE-NAME
 476         heritage: Tiller
 477     spec:
 478       peers:
 479       - mtls: {}
 480     ---
 481     # Corresponding destination rule to configure client side to use mutual TLS when talking to
 482     # any service (host) in the mesh.
 483     apiVersion: networking.istio.io/v1alpha3
 484     kind: DestinationRule
 485     metadata:
 486       name: "default"
 487       labels:
 488         app: istio-security
 489         chart: security-1.0.0
 490         release: RELEASE-NAME
 491         heritage: Tiller
 492     spec:
 493       host: "*.local"
 494       trafficPolicy:
 495         tls:
 496           mode: ISTIO_MUTUAL
 497     ---
 498     # Destination rule to dislabe (m)TLS when talking to API server, as API server doesn't have sidecar.
 499     # Customer should add similar destination rules for other services that dont' have sidecar.
 500     apiVersion: networking.istio.io/v1alpha3
 501     kind: DestinationRule
 502     metadata:
 503       name: "api-server"
 504       labels:
 505         app: istio-security
 506         chart: security-1.0.0
 507         release: RELEASE-NAME
 508         heritage: Tiller
 509     spec:
 510       host: "kubernetes.default.svc.cluster.local"
 511       trafficPolicy:
 512         tls:
 513           mode: DISABLE
 514   run.sh: |-
 515     #!/bin/sh
 516
 517     set -x
 518
 519     if [ "$#" -ne "1" ]; then
 520         echo "first argument should be path to custom resource yaml"
 521         exit 1
 522     fi
 523
 524     pathToResourceYAML=${1}
 525
 526     /kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null
 527     if [ "$?" -eq 0 ]; then
 528         echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready"
 529         while true; do
 530             /kubectl -n istio-system get deployment istio-galley 2>/dev/null
 531             if [ "$?" -eq 0 ]; then
 532                 break
 533             fi
 534             sleep 1
 535         done
 536         /kubectl -n istio-system rollout status deployment istio-galley
 537         if [ "$?" -ne 0 ]; then
 538             echo "istio-galley deployment rollout status check failed"
 539             exit 1
 540         fi
 541         echo "istio-galley deployment ready for configuration validation"
 542     fi
 543     sleep 5
 544     /kubectl apply -f ${pathToResourceYAML}
 545
 546
 547 ---
 548 # Source: istio/templates/configmap.yaml
 549
 550 apiVersion: v1
 551 kind: ConfigMap
 552 metadata:
 553   name: istio
 554   namespace: istio-system
 555   labels:
 556     app: istio
 557     chart: istio-1.0.0
 558     release: RELEASE-NAME
 559     heritage: Tiller
 560 data:
 561   mesh: |-
 562     # Set the following variable to true to disable policy checks by the Mixer.
 563     # Note that metrics will still be reported to the Mixer.
 564     disablePolicyChecks: false
 565
 566     # Set enableTracing to false to disable request tracing.
 567     enableTracing: true
 568
 569     # Set accessLogFile to empty string to disable access log.
 570     accessLogFile: "/dev/stdout"
 571     #
 572     # Deprecated: mixer is using EDS
 573     mixerCheckServer: istio-policy.istio-system.svc.cluster.local:15004
 574     mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:15004
 575
 576     # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get
 577     # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty.
 578     sdsUdsPath: ""
 579
 580     # How frequently should Envoy fetch key/cert from NodeAgent.
 581     sdsRefreshDelay: 15s
 582
 583     #
 584     defaultConfig:
 585       #
 586       # TCP connection timeout between Envoy & the application, and between Envoys.
 587       connectTimeout: 10s
 588       #
 589       ### ADVANCED SETTINGS #############
 590       # Where should envoy's configuration be stored in the istio-proxy container
 591       configPath: "/etc/istio/proxy"
 592       binaryPath: "/usr/local/bin/envoy"
 593       # The pseudo service name used for Envoy.
 594       serviceCluster: istio-proxy
 595       # These settings that determine how long an old Envoy
 596       # process should be kept alive after an occasional reload.
 597       drainDuration: 45s
 598       parentShutdownDuration: 1m0s
 599       #
 600       # The mode used to redirect inbound connections to Envoy. This setting
 601       # has no effect on outbound traffic: iptables REDIRECT is always used for
 602       # outbound connections.
 603       # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
 604       # The "REDIRECT" mode loses source addresses during redirection.
 605       # If "TPROXY", use iptables TPROXY to redirect to Envoy.
 606       # The "TPROXY" mode preserves both the source and destination IP
 607       # addresses and ports, so that they can be used for advanced filtering
 608       # and manipulation.
 609       # The "TPROXY" mode also configures the sidecar to run with the
 610       # CAP_NET_ADMIN capability, which is required to use TPROXY.
 611       #interceptionMode: REDIRECT
 612       #
 613       # Port where Envoy listens (on local host) for admin commands
 614       # You can exec into the istio-proxy container in a pod and
 615       # curl the admin port (curl http://localhost:15000/) to obtain
 616       # diagnostic information from Envoy. See
 617       # https://lyft.github.io/envoy/docs/operations/admin.html
 618       # for more details
 619       proxyAdminPort: 15000
 620       #
 621       # Zipkin trace collector
 622       zipkinAddress: zipkin.istio-system:9411
 623       #
 624       # Statsd metrics collector converts statsd metrics into Prometheus metrics.
 625       statsdUdpAddress: istio-statsd-prom-bridge.istio-system:9125
 626       #
 627       # Mutual TLS authentication between sidecars and istio control plane.
 628       controlPlaneAuthPolicy: MUTUAL_TLS
 629       #
 630       # Address where istio Pilot service is running
 631       discoveryAddress: istio-pilot.istio-system:15005
 632
 633 ---
 634 # Source: istio/templates/sidecar-injector-configmap.yaml
 635
 636 apiVersion: v1
 637 kind: ConfigMap
 638 metadata:
 639   name: istio-sidecar-injector
 640   namespace: istio-system
 641   labels:
 642     app: istio
 643     chart: istio-1.0.0
 644     release: RELEASE-NAME
 645     heritage: Tiller
 646     istio: sidecar-injector
 647 data:
 648   config: |-
 649     policy: disabled
 650     template: |-
 651       initContainers:
 652       - name: istio-init
 653         image: "gcr.io/istio-release/proxy_init:1.0.0"
 654         args:
 655         - "-p"
 656         - [[ .MeshConfig.ProxyListenPort ]]
 657         - "-u"
 658         - 1337
 659         - "-m"
 660         - [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 661         - "-i"
 662         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges") -]]
 663         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges"  ]]"
 664         [[ else -]]
 665         - "*"
 666         [[ end -]]
 667         - "-x"
 668         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges") -]]
 669         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges"  ]]"
 670         [[ else -]]
 671         - ""
 672         [[ end -]]
 673         - "-b"
 674         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts") -]]
 675         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts"  ]]"
 676         [[ else -]]
 677         - [[ range .Spec.Containers -]][[ range .Ports -]][[ .ContainerPort -]], [[ end -]][[ end -]][[ end]]
 678         - "-d"
 679         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts") -]]
 680         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts" ]]"
 681         [[ else -]]
 682         - ""
 683         [[ end -]]
 684         imagePullPolicy: IfNotPresent
 685         securityContext:
 686           capabilities:
 687             add:
 688             - NET_ADMIN
 689           privileged: true
 690         restartPolicy: Always
 691
 692       containers:
 693       - name: istio-proxy
 694         image: [[ if (isset .ObjectMeta.Annotations "sidecar.istio.io/proxyImage") -]]
 695         "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyImage" ]]"
 696         [[ else -]]
 697         gcr.io/istio-release/proxy_debug:1.0.0
 698         [[ end -]]
 699         args:
 700         - proxy
 701         - sidecar
 702         - --configPath
 703         - [[ .ProxyConfig.ConfigPath ]]
 704         - --binaryPath
 705         - [[ .ProxyConfig.BinaryPath ]]
 706         - --serviceCluster
 707         [[ if ne "" (index .ObjectMeta.Labels "app") -]]
 708         - [[ index .ObjectMeta.Labels "app" ]]
 709         [[ else -]]
 710         - "istio-proxy"
 711         [[ end -]]
 712         - --drainDuration
 713         - [[ formatDuration .ProxyConfig.DrainDuration ]]
 714         - --parentShutdownDuration
 715         - [[ formatDuration .ProxyConfig.ParentShutdownDuration ]]
 716         - --discoveryAddress
 717         - [[ .ProxyConfig.DiscoveryAddress ]]
 718         - --discoveryRefreshDelay
 719         - [[ formatDuration .ProxyConfig.DiscoveryRefreshDelay ]]
 720         - --zipkinAddress
 721         - [[ .ProxyConfig.ZipkinAddress ]]
 722         - --connectTimeout
 723         - [[ formatDuration .ProxyConfig.ConnectTimeout ]]
 724         - --statsdUdpAddress
 725         - [[ .ProxyConfig.StatsdUdpAddress ]]
 726         - --proxyAdminPort
 727         - [[ .ProxyConfig.ProxyAdminPort ]]
 728         - --controlPlaneAuthPolicy
 729         - [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/controlPlaneAuthPolicy") .ProxyConfig.ControlPlaneAuthPolicy ]]
 730         env:
 731         - name: POD_NAME
 732           valueFrom:
 733             fieldRef:
 734               fieldPath: metadata.name
 735         - name: POD_NAMESPACE
 736           valueFrom:
 737             fieldRef:
 738               fieldPath: metadata.namespace
 739         - name: INSTANCE_IP
 740           valueFrom:
 741             fieldRef:
 742               fieldPath: status.podIP
 743         - name: ISTIO_META_POD_NAME
 744           valueFrom:
 745             fieldRef:
 746               fieldPath: metadata.name
 747         - name: ISTIO_META_INTERCEPTION_MODE
 748           value: [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 749         imagePullPolicy: IfNotPresent
 750         securityContext:
 751           privileged: false
 752           readOnlyRootFilesystem: true
 753           [[ if eq (or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String) "TPROXY" -]]
 754           capabilities:
 755             add:
 756             - NET_ADMIN
 757           runAsGroup: 1337
 758           [[ else -]]
 759           runAsUser: 1337
 760           [[ end -]]
 761         restartPolicy: Always
 762         resources:
 763           [[ if (isset .ObjectMeta.Annotations "sidecar.istio.io/proxyCPU") -]]
 764           requests:
 765             cpu: "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyCPU" ]]"
 766             memory: "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyMemory" ]]"
 767         [[ else -]]
 768           requests:
 769             cpu: 10m
 770
 771         [[ end -]]
 772         volumeMounts:
 773         - mountPath: /etc/istio/proxy
 774           name: istio-envoy
 775         - mountPath: /etc/certs/
 776           name: istio-certs
 777           readOnly: true
 778       volumes:
 779       - emptyDir:
 780           medium: Memory
 781         name: istio-envoy
 782       - name: istio-certs
 783         secret:
 784           optional: true
 785           [[ if eq .Spec.ServiceAccountName "" -]]
 786           secretName: istio.default
 787           [[ else -]]
 788           secretName: [[ printf "istio.%s" .Spec.ServiceAccountName ]]
 789           [[ end -]]
 790
 791 ---
 792 # Source: istio/charts/galley/templates/serviceaccount.yaml
 793 apiVersion: v1
 794 kind: ServiceAccount
 795 metadata:
 796   name: istio-galley-service-account
 797   namespace: istio-system
 798   labels:
 799     app: istio-galley
 800     chart: galley-1.0.0
 801     heritage: Tiller
 802     release: RELEASE-NAME
 803
 804 ---
 805 # Source: istio/charts/gateways/templates/serviceaccount.yaml
 806
 807 apiVersion: v1
 808 kind: ServiceAccount
 809 metadata:
 810   name: istio-egressgateway-service-account
 811   namespace: istio-system
 812   labels:
 813     app: egressgateway
 814     chart: gateways-1.0.0
 815     heritage: Tiller
 816     release: RELEASE-NAME
 817 ---
 818 apiVersion: v1
 819 kind: ServiceAccount
 820 metadata:
 821   name: istio-ingressgateway-service-account
 822   namespace: istio-system
 823   labels:
 824     app: ingressgateway
 825     chart: gateways-1.0.0
 826     heritage: Tiller
 827     release: RELEASE-NAME
 828 ---
 829
 830 ---
 831 # Source: istio/charts/grafana/templates/create-custom-resources-job.yaml
 832 apiVersion: v1
 833 kind: ServiceAccount
 834 metadata:
 835   name: istio-grafana-post-install-account
 836   namespace: istio-system
 837   labels:
 838     app: istio-grafana
 839     chart: grafana-0.1.0
 840     heritage: Tiller
 841     release: RELEASE-NAME
 842 ---
 843 apiVersion: rbac.authorization.k8s.io/v1beta1
 844 kind: ClusterRole
 845 metadata:
 846   name: istio-grafana-post-install-istio-system
 847   labels:
 848     app: istio-grafana
 849     chart: grafana-0.1.0
 850     heritage: Tiller
 851     release: RELEASE-NAME
 852 rules:
 853 - apiGroups: ["authentication.istio.io"] # needed to create default authn policy
 854   resources: ["*"]
 855   verbs: ["*"]
 856 ---
 857 apiVersion: rbac.authorization.k8s.io/v1beta1
 858 kind: ClusterRoleBinding
 859 metadata:
 860   name: istio-grafana-post-install-role-binding-istio-system
 861   labels:
 862     app: istio-grafana
 863     chart: grafana-0.1.0
 864     heritage: Tiller
 865     release: RELEASE-NAME
 866 roleRef:
 867   apiGroup: rbac.authorization.k8s.io
 868   kind: ClusterRole
 869   name: istio-grafana-post-install-istio-system
 870 subjects:
 871   - kind: ServiceAccount
 872     name: istio-grafana-post-install-account
 873     namespace: istio-system
 874 ---
 875 apiVersion: batch/v1
 876 kind: Job
 877 metadata:
 878   name: istio-grafana-post-install
 879   namespace: istio-system
 880   annotations:
 881     "helm.sh/hook": post-install
 882     "helm.sh/hook-delete-policy": hook-succeeded
 883   labels:
 884     app: istio-grafana
 885     chart: grafana-0.1.0
 886     release: RELEASE-NAME
 887     heritage: Tiller
 888 spec:
 889   template:
 890     metadata:
 891       name: istio-grafana-post-install
 892       labels:
 893         app: istio-grafana
 894         release: RELEASE-NAME
 895     spec:
 896       serviceAccountName: istio-grafana-post-install-account
 897       containers:
 898         - name: hyperkube
 899           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
 900           command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ]
 901           volumeMounts:
 902             - mountPath: "/tmp/grafana"
 903               name: tmp-configmap-grafana
 904       volumes:
 905         - name: tmp-configmap-grafana
 906           configMap:
 907             name: istio-grafana-custom-resources
 908       restartPolicy: OnFailure
 909
 910 ---
 911 # Source: istio/charts/mixer/templates/serviceaccount.yaml
 912 apiVersion: v1
 913 kind: ServiceAccount
 914 metadata:
 915   name: istio-mixer-service-account
 916   namespace: istio-system
 917   labels:
 918     app: mixer
 919     chart: mixer-1.0.0
 920     heritage: Tiller
 921     release: RELEASE-NAME
 922
 923 ---
 924 # Source: istio/charts/pilot/templates/serviceaccount.yaml
 925 apiVersion: v1
 926 kind: ServiceAccount
 927 metadata:
 928   name: istio-pilot-service-account
 929   namespace: istio-system
 930   labels:
 931     app: istio-pilot
 932     chart: pilot-1.0.0
 933     heritage: Tiller
 934     release: RELEASE-NAME
 935
 936 ---
 937 # Source: istio/charts/prometheus/templates/serviceaccount.yaml
 938 apiVersion: v1
 939 kind: ServiceAccount
 940 metadata:
 941   name: prometheus
 942   namespace: istio-system
 943
 944 ---
 945 # Source: istio/charts/security/templates/cleanup-secrets.yaml
 946 # The reason for creating a ServiceAccount and ClusterRole specifically for this
 947 # post-delete hooked job is because the citadel ServiceAccount is being deleted
 948 # before this hook is launched. On the other hand, running this hook before the
 949 # deletion of the citadel (e.g. pre-delete) won't delete the secrets because they
 950 # will be re-created immediately by the to-be-deleted citadel.
 951 #
 952 # It's also important that the ServiceAccount, ClusterRole and ClusterRoleBinding
 953 # will be ready before running the hooked Job therefore the hook weights.
 954
 955 apiVersion: v1
 956 kind: ServiceAccount
 957 metadata:
 958   name: istio-cleanup-secrets-service-account
 959   namespace: istio-system
 960   annotations:
 961     "helm.sh/hook": post-delete
 962     "helm.sh/hook-delete-policy": hook-succeeded
 963     "helm.sh/hook-weight": "1"
 964   labels:
 965     app: security
 966     chart: security-1.0.0
 967     heritage: Tiller
 968     release: RELEASE-NAME
 969 ---
 970 apiVersion: rbac.authorization.k8s.io/v1beta1
 971 kind: ClusterRole
 972 metadata:
 973   name: istio-cleanup-secrets-istio-system
 974   annotations:
 975     "helm.sh/hook": post-delete
 976     "helm.sh/hook-delete-policy": hook-succeeded
 977     "helm.sh/hook-weight": "1"
 978   labels:
 979     app: security
 980     chart: security-1.0.0
 981     heritage: Tiller
 982     release: RELEASE-NAME
 983 rules:
 984 - apiGroups: [""]
 985   resources: ["secrets"]
 986   verbs: ["list", "delete"]
 987 ---
 988 apiVersion: rbac.authorization.k8s.io/v1beta1
 989 kind: ClusterRoleBinding
 990 metadata:
 991   name: istio-cleanup-secrets-istio-system
 992   annotations:
 993     "helm.sh/hook": post-delete
 994     "helm.sh/hook-delete-policy": hook-succeeded
 995     "helm.sh/hook-weight": "2"
 996   labels:
 997     app: security
 998     chart: security-1.0.0
 999     heritage: Tiller
1000     release: RELEASE-NAME
1001 roleRef:
1002   apiGroup: rbac.authorization.k8s.io
1003   kind: ClusterRole
1004   name: istio-cleanup-secrets-istio-system
1005 subjects:
1006   - kind: ServiceAccount
1007     name: istio-cleanup-secrets-service-account
1008     namespace: istio-system
1009 ---
1010 apiVersion: batch/v1
1011 kind: Job
1012 metadata:
1013   name: istio-cleanup-secrets
1014   namespace: istio-system
1015   annotations:
1016     "helm.sh/hook": post-delete
1017     "helm.sh/hook-delete-policy": hook-succeeded
1018     "helm.sh/hook-weight": "3"
1019   labels:
1020     app: security
1021     chart: security-1.0.0
1022     release: RELEASE-NAME
1023     heritage: Tiller
1024 spec:
1025   template:
1026     metadata:
1027       name: istio-cleanup-secrets
1028       labels:
1029         app: security
1030         release: RELEASE-NAME
1031     spec:
1032       serviceAccountName: istio-cleanup-secrets-service-account
1033       containers:
1034         - name: hyperkube
1035           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
1036           command:
1037           - /bin/bash
1038           - -c
1039           - >
1040               kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" |  while read -r entry; do
1041                 ns=$(echo $entry | awk '{print $1}');
1042                 name=$(echo $entry | awk '{print $2}');
1043                 kubectl delete secret $name -n $ns;
1044               done
1045       restartPolicy: OnFailure
1046
1047 ---
1048 # Source: istio/charts/security/templates/create-custom-resources-job.yaml
1049
1050 apiVersion: v1
1051 kind: ServiceAccount
1052 metadata:
1053   name: istio-security-post-install-account
1054   namespace: istio-system
1055   labels:
1056     app: istio-security
1057     chart: security-1.0.0
1058     heritage: Tiller
1059     release: RELEASE-NAME
1060 ---
1061 apiVersion: rbac.authorization.k8s.io/v1beta1
1062 kind: ClusterRole
1063 metadata:
1064   name: istio-security-post-install-istio-system
1065   labels:
1066     app: istio-security
1067     chart: security-1.0.0
1068     heritage: Tiller
1069     release: RELEASE-NAME
1070 rules:
1071 - apiGroups: ["authentication.istio.io"] # needed to create default authn policy
1072   resources: ["*"]
1073   verbs: ["*"]
1074 - apiGroups: ["networking.istio.io"] # needed to create security destination rules
1075   resources: ["*"]
1076   verbs: ["*"]
1077 - apiGroups: ["admissionregistration.k8s.io"]
1078   resources: ["validatingwebhookconfigurations"]
1079   verbs: ["get"]
1080 - apiGroups: ["extensions"]
1081   resources: ["deployments", "replicasets"]
1082   verbs: ["get", "list", "watch"]
1083 ---
1084 apiVersion: rbac.authorization.k8s.io/v1beta1
1085 kind: ClusterRoleBinding
1086 metadata:
1087   name: istio-security-post-install-role-binding-istio-system
1088   labels:
1089     app: istio-security
1090     chart: security-1.0.0
1091     heritage: Tiller
1092     release: RELEASE-NAME
1093 roleRef:
1094   apiGroup: rbac.authorization.k8s.io
1095   kind: ClusterRole
1096   name: istio-security-post-install-istio-system
1097 subjects:
1098   - kind: ServiceAccount
1099     name: istio-security-post-install-account
1100     namespace: istio-system
1101 ---
1102
1103 apiVersion: batch/v1
1104 kind: Job
1105 metadata:
1106   name: istio-security-post-install
1107   namespace: istio-system
1108   annotations:
1109     "helm.sh/hook": post-install
1110     "helm.sh/hook-delete-policy": hook-succeeded
1111   labels:
1112     app: istio-security
1113     chart: security-1.0.0
1114     release: RELEASE-NAME
1115     heritage: Tiller
1116 spec:
1117   template:
1118     metadata:
1119       name: istio-security-post-install
1120       labels:
1121         app: istio-security
1122         release: RELEASE-NAME
1123     spec:
1124       serviceAccountName: istio-security-post-install-account
1125       containers:
1126         - name: hyperkube
1127           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
1128           command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ]
1129           volumeMounts:
1130             - mountPath: "/tmp/security"
1131               name: tmp-configmap-security
1132       volumes:
1133         - name: tmp-configmap-security
1134           configMap:
1135             name: istio-security-custom-resources
1136       restartPolicy: OnFailure
1137
1138 ---
1139 # Source: istio/charts/security/templates/serviceaccount.yaml
1140 apiVersion: v1
1141 kind: ServiceAccount
1142 metadata:
1143   name: istio-citadel-service-account
1144   namespace: istio-system
1145   labels:
1146     app: security
1147     chart: security-1.0.0
1148     heritage: Tiller
1149     release: RELEASE-NAME
1150
1151 ---
1152 # Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml
1153 apiVersion: v1
1154 kind: ServiceAccount
1155 metadata:
1156   name: istio-sidecar-injector-service-account
1157   namespace: istio-system
1158   labels:
1159     app: istio-sidecar-injector
1160     chart: sidecarInjectorWebhook-1.0.0
1161     heritage: Tiller
1162     release: RELEASE-NAME
1163
1164 ---
1165 # Source: istio/templates/crds.yaml
1166 #
1167 # these CRDs only make sense when pilot is enabled
1168 #
1169 apiVersion: apiextensions.k8s.io/v1beta1
1170 kind: CustomResourceDefinition
1171 metadata:
1172   name: virtualservices.networking.istio.io
1173   annotations:
1174     "helm.sh/hook": crd-install
1175   labels:
1176     app: istio-pilot
1177 spec:
1178   group: networking.istio.io
1179   names:
1180     kind: VirtualService
1181     listKind: VirtualServiceList
1182     plural: virtualservices
1183     singular: virtualservice
1184     categories:
1185     - istio-io
1186     - networking-istio-io
1187   scope: Namespaced
1188   version: v1alpha3
1189 ---
1190 apiVersion: apiextensions.k8s.io/v1beta1
1191 kind: CustomResourceDefinition
1192 metadata:
1193   name: destinationrules.networking.istio.io
1194   annotations:
1195     "helm.sh/hook": crd-install
1196   labels:
1197     app: istio-pilot
1198 spec:
1199   group: networking.istio.io
1200   names:
1201     kind: DestinationRule
1202     listKind: DestinationRuleList
1203     plural: destinationrules
1204     singular: destinationrule
1205     categories:
1206     - istio-io
1207     - networking-istio-io
1208   scope: Namespaced
1209   version: v1alpha3
1210 ---
1211 apiVersion: apiextensions.k8s.io/v1beta1
1212 kind: CustomResourceDefinition
1213 metadata:
1214   name: serviceentries.networking.istio.io
1215   annotations:
1216     "helm.sh/hook": crd-install
1217   labels:
1218     app: istio-pilot
1219 spec:
1220   group: networking.istio.io
1221   names:
1222     kind: ServiceEntry
1223     listKind: ServiceEntryList
1224     plural: serviceentries
1225     singular: serviceentry
1226     categories:
1227     - istio-io
1228     - networking-istio-io
1229   scope: Namespaced
1230   version: v1alpha3
1231 ---
1232 apiVersion: apiextensions.k8s.io/v1beta1
1233 kind: CustomResourceDefinition
1234 metadata:
1235   name: gateways.networking.istio.io
1236   annotations:
1237     "helm.sh/hook": crd-install
1238     "helm.sh/hook-weight": "-5"
1239   labels:
1240     app: istio-pilot
1241 spec:
1242   group: networking.istio.io
1243   names:
1244     kind: Gateway
1245     plural: gateways
1246     singular: gateway
1247     categories:
1248     - istio-io
1249     - networking-istio-io
1250   scope: Namespaced
1251   version: v1alpha3
1252 ---
1253 apiVersion: apiextensions.k8s.io/v1beta1
1254 kind: CustomResourceDefinition
1255 metadata:
1256   name: envoyfilters.networking.istio.io
1257   annotations:
1258     "helm.sh/hook": crd-install
1259   labels:
1260     app: istio-pilot
1261 spec:
1262   group: networking.istio.io
1263   names:
1264     kind: EnvoyFilter
1265     plural: envoyfilters
1266     singular: envoyfilter
1267     categories:
1268     - istio-io
1269     - networking-istio-io
1270   scope: Namespaced
1271   version: v1alpha3
1272 ---
1273 #
1274
1275 # these CRDs only make sense when security is enabled
1276 #
1277
1278 #
1279 kind: CustomResourceDefinition
1280 apiVersion: apiextensions.k8s.io/v1beta1
1281 metadata:
1282   annotations:
1283     "helm.sh/hook": crd-install
1284   name: httpapispecbindings.config.istio.io
1285 spec:
1286   group: config.istio.io
1287   names:
1288     kind: HTTPAPISpecBinding
1289     plural: httpapispecbindings
1290     singular: httpapispecbinding
1291     categories:
1292     - istio-io
1293     - apim-istio-io
1294   scope: Namespaced
1295   version: v1alpha2
1296 ---
1297 kind: CustomResourceDefinition
1298 apiVersion: apiextensions.k8s.io/v1beta1
1299 metadata:
1300   annotations:
1301     "helm.sh/hook": crd-install
1302   name: httpapispecs.config.istio.io
1303 spec:
1304   group: config.istio.io
1305   names:
1306     kind: HTTPAPISpec
1307     plural: httpapispecs
1308     singular: httpapispec
1309     categories:
1310     - istio-io
1311     - apim-istio-io
1312   scope: Namespaced
1313   version: v1alpha2
1314 ---
1315 kind: CustomResourceDefinition
1316 apiVersion: apiextensions.k8s.io/v1beta1
1317 metadata:
1318   annotations:
1319     "helm.sh/hook": crd-install
1320   name: quotaspecbindings.config.istio.io
1321 spec:
1322   group: config.istio.io
1323   names:
1324     kind: QuotaSpecBinding
1325     plural: quotaspecbindings
1326     singular: quotaspecbinding
1327     categories:
1328     - istio-io
1329     - apim-istio-io
1330   scope: Namespaced
1331   version: v1alpha2
1332 ---
1333 kind: CustomResourceDefinition
1334 apiVersion: apiextensions.k8s.io/v1beta1
1335 metadata:
1336   annotations:
1337     "helm.sh/hook": crd-install
1338   name: quotaspecs.config.istio.io
1339 spec:
1340   group: config.istio.io
1341   names:
1342     kind: QuotaSpec
1343     plural: quotaspecs
1344     singular: quotaspec
1345     categories:
1346     - istio-io
1347     - apim-istio-io
1348   scope: Namespaced
1349   version: v1alpha2
1350 ---
1351
1352 # Mixer CRDs
1353 kind: CustomResourceDefinition
1354 apiVersion: apiextensions.k8s.io/v1beta1
1355 metadata:
1356   name: rules.config.istio.io
1357   annotations:
1358     "helm.sh/hook": crd-install
1359   labels:
1360     app: mixer
1361     package: istio.io.mixer
1362     istio: core
1363 spec:
1364   group: config.istio.io
1365   names:
1366     kind: rule
1367     plural: rules
1368     singular: rule
1369     categories:
1370     - istio-io
1371     - policy-istio-io
1372   scope: Namespaced
1373   version: v1alpha2
1374 ---
1375
1376 kind: CustomResourceDefinition
1377 apiVersion: apiextensions.k8s.io/v1beta1
1378 metadata:
1379   name: attributemanifests.config.istio.io
1380   annotations:
1381     "helm.sh/hook": crd-install
1382   labels:
1383     app: mixer
1384     package: istio.io.mixer
1385     istio: core
1386 spec:
1387   group: config.istio.io
1388   names:
1389     kind: attributemanifest
1390     plural: attributemanifests
1391     singular: attributemanifest
1392     categories:
1393     - istio-io
1394     - policy-istio-io
1395   scope: Namespaced
1396   version: v1alpha2
1397 ---
1398
1399 kind: CustomResourceDefinition
1400 apiVersion: apiextensions.k8s.io/v1beta1
1401 metadata:
1402   name: bypasses.config.istio.io
1403   annotations:
1404     "helm.sh/hook": crd-install
1405   labels:
1406     app: mixer
1407     package: bypass
1408     istio: mixer-adapter
1409 spec:
1410   group: config.istio.io
1411   names:
1412     kind: bypass
1413     plural: bypasses
1414     singular: bypass
1415     categories:
1416     - istio-io
1417     - policy-istio-io
1418   scope: Namespaced
1419   version: v1alpha2
1420 ---
1421
1422 kind: CustomResourceDefinition
1423 apiVersion: apiextensions.k8s.io/v1beta1
1424 metadata:
1425   name: circonuses.config.istio.io
1426   annotations:
1427     "helm.sh/hook": crd-install
1428   labels:
1429     app: mixer
1430     package: circonus
1431     istio: mixer-adapter
1432 spec:
1433   group: config.istio.io
1434   names:
1435     kind: circonus
1436     plural: circonuses
1437     singular: circonus
1438     categories:
1439     - istio-io
1440     - policy-istio-io
1441   scope: Namespaced
1442   version: v1alpha2
1443 ---
1444
1445 kind: CustomResourceDefinition
1446 apiVersion: apiextensions.k8s.io/v1beta1
1447 metadata:
1448   name: deniers.config.istio.io
1449   annotations:
1450     "helm.sh/hook": crd-install
1451   labels:
1452     app: mixer
1453     package: denier
1454     istio: mixer-adapter
1455 spec:
1456   group: config.istio.io
1457   names:
1458     kind: denier
1459     plural: deniers
1460     singular: denier
1461     categories:
1462     - istio-io
1463     - policy-istio-io
1464   scope: Namespaced
1465   version: v1alpha2
1466 ---
1467
1468 kind: CustomResourceDefinition
1469 apiVersion: apiextensions.k8s.io/v1beta1
1470 metadata:
1471   name: fluentds.config.istio.io
1472   annotations:
1473     "helm.sh/hook": crd-install
1474   labels:
1475     app: mixer
1476     package: fluentd
1477     istio: mixer-adapter
1478 spec:
1479   group: config.istio.io
1480   names:
1481     kind: fluentd
1482     plural: fluentds
1483     singular: fluentd
1484     categories:
1485     - istio-io
1486     - policy-istio-io
1487   scope: Namespaced
1488   version: v1alpha2
1489 ---
1490
1491 kind: CustomResourceDefinition
1492 apiVersion: apiextensions.k8s.io/v1beta1
1493 metadata:
1494   name: kubernetesenvs.config.istio.io
1495   annotations:
1496     "helm.sh/hook": crd-install
1497   labels:
1498     app: mixer
1499     package: kubernetesenv
1500     istio: mixer-adapter
1501 spec:
1502   group: config.istio.io
1503   names:
1504     kind: kubernetesenv
1505     plural: kubernetesenvs
1506     singular: kubernetesenv
1507     categories:
1508     - istio-io
1509     - policy-istio-io
1510   scope: Namespaced
1511   version: v1alpha2
1512 ---
1513
1514 kind: CustomResourceDefinition
1515 apiVersion: apiextensions.k8s.io/v1beta1
1516 metadata:
1517   name: listcheckers.config.istio.io
1518   annotations:
1519     "helm.sh/hook": crd-install
1520   labels:
1521     app: mixer
1522     package: listchecker
1523     istio: mixer-adapter
1524 spec:
1525   group: config.istio.io
1526   names:
1527     kind: listchecker
1528     plural: listcheckers
1529     singular: listchecker
1530     categories:
1531     - istio-io
1532     - policy-istio-io
1533   scope: Namespaced
1534   version: v1alpha2
1535 ---
1536
1537 kind: CustomResourceDefinition
1538 apiVersion: apiextensions.k8s.io/v1beta1
1539 metadata:
1540   name: memquotas.config.istio.io
1541   annotations:
1542     "helm.sh/hook": crd-install
1543   labels:
1544     app: mixer
1545     package: memquota
1546     istio: mixer-adapter
1547 spec:
1548   group: config.istio.io
1549   names:
1550     kind: memquota
1551     plural: memquotas
1552     singular: memquota
1553     categories:
1554     - istio-io
1555     - policy-istio-io
1556   scope: Namespaced
1557   version: v1alpha2
1558 ---
1559
1560 kind: CustomResourceDefinition
1561 apiVersion: apiextensions.k8s.io/v1beta1
1562 metadata:
1563   name: noops.config.istio.io
1564   annotations:
1565     "helm.sh/hook": crd-install
1566   labels:
1567     app: mixer
1568     package: noop
1569     istio: mixer-adapter
1570 spec:
1571   group: config.istio.io
1572   names:
1573     kind: noop
1574     plural: noops
1575     singular: noop
1576     categories:
1577     - istio-io
1578     - policy-istio-io
1579   scope: Namespaced
1580   version: v1alpha2
1581 ---
1582
1583 kind: CustomResourceDefinition
1584 apiVersion: apiextensions.k8s.io/v1beta1
1585 metadata:
1586   name: opas.config.istio.io
1587   annotations:
1588     "helm.sh/hook": crd-install
1589   labels:
1590     app: mixer
1591     package: opa
1592     istio: mixer-adapter
1593 spec:
1594   group: config.istio.io
1595   names:
1596     kind: opa
1597     plural: opas
1598     singular: opa
1599     categories:
1600     - istio-io
1601     - policy-istio-io
1602   scope: Namespaced
1603   version: v1alpha2
1604 ---
1605
1606 kind: CustomResourceDefinition
1607 apiVersion: apiextensions.k8s.io/v1beta1
1608 metadata:
1609   name: prometheuses.config.istio.io
1610   annotations:
1611     "helm.sh/hook": crd-install
1612   labels:
1613     app: mixer
1614     package: prometheus
1615     istio: mixer-adapter
1616 spec:
1617   group: config.istio.io
1618   names:
1619     kind: prometheus
1620     plural: prometheuses
1621     singular: prometheus
1622     categories:
1623     - istio-io
1624     - policy-istio-io
1625   scope: Namespaced
1626   version: v1alpha2
1627 ---
1628
1629 kind: CustomResourceDefinition
1630 apiVersion: apiextensions.k8s.io/v1beta1
1631 metadata:
1632   name: rbacs.config.istio.io
1633   annotations:
1634     "helm.sh/hook": crd-install
1635   labels:
1636     app: mixer
1637     package: rbac
1638     istio: mixer-adapter
1639 spec:
1640   group: config.istio.io
1641   names:
1642     kind: rbac
1643     plural: rbacs
1644     singular: rbac
1645     categories:
1646     - istio-io
1647     - policy-istio-io
1648   scope: Namespaced
1649   version: v1alpha2
1650 ---
1651
1652 kind: CustomResourceDefinition
1653 apiVersion: apiextensions.k8s.io/v1beta1
1654 metadata:
1655   name: redisquotas.config.istio.io
1656   annotations:
1657     "helm.sh/hook": crd-install
1658   labels:
1659     package: redisquota
1660     istio: mixer-adapter
1661 spec:
1662   group: config.istio.io
1663   names:
1664     kind: redisquota
1665     plural: redisquotas
1666     singular: redisquota
1667   scope: Namespaced
1668   version: v1alpha2
1669 ---
1670
1671 kind: CustomResourceDefinition
1672 apiVersion: apiextensions.k8s.io/v1beta1
1673 metadata:
1674   name: servicecontrols.config.istio.io
1675   annotations:
1676     "helm.sh/hook": crd-install
1677   labels:
1678     app: mixer
1679     package: servicecontrol
1680     istio: mixer-adapter
1681 spec:
1682   group: config.istio.io
1683   names:
1684     kind: servicecontrol
1685     plural: servicecontrols
1686     singular: servicecontrol
1687     categories:
1688     - istio-io
1689     - policy-istio-io
1690   scope: Namespaced
1691   version: v1alpha2
1692
1693 ---
1694
1695 kind: CustomResourceDefinition
1696 apiVersion: apiextensions.k8s.io/v1beta1
1697 metadata:
1698   name: signalfxs.config.istio.io
1699   annotations:
1700     "helm.sh/hook": crd-install
1701   labels:
1702     app: mixer
1703     package: signalfx
1704     istio: mixer-adapter
1705 spec:
1706   group: config.istio.io
1707   names:
1708     kind: signalfx
1709     plural: signalfxs
1710     singular: signalfx
1711     categories:
1712     - istio-io
1713     - policy-istio-io
1714   scope: Namespaced
1715   version: v1alpha2
1716 ---
1717
1718 kind: CustomResourceDefinition
1719 apiVersion: apiextensions.k8s.io/v1beta1
1720 metadata:
1721   name: solarwindses.config.istio.io
1722   annotations:
1723     "helm.sh/hook": crd-install
1724   labels:
1725     app: mixer
1726     package: solarwinds
1727     istio: mixer-adapter
1728 spec:
1729   group: config.istio.io
1730   names:
1731     kind: solarwinds
1732     plural: solarwindses
1733     singular: solarwinds
1734     categories:
1735     - istio-io
1736     - policy-istio-io
1737   scope: Namespaced
1738   version: v1alpha2
1739 ---
1740
1741 kind: CustomResourceDefinition
1742 apiVersion: apiextensions.k8s.io/v1beta1
1743 metadata:
1744   name: stackdrivers.config.istio.io
1745   annotations:
1746     "helm.sh/hook": crd-install
1747   labels:
1748     app: mixer
1749     package: stackdriver
1750     istio: mixer-adapter
1751 spec:
1752   group: config.istio.io
1753   names:
1754     kind: stackdriver
1755     plural: stackdrivers
1756     singular: stackdriver
1757     categories:
1758     - istio-io
1759     - policy-istio-io
1760   scope: Namespaced
1761   version: v1alpha2
1762 ---
1763
1764 kind: CustomResourceDefinition
1765 apiVersion: apiextensions.k8s.io/v1beta1
1766 metadata:
1767   name: statsds.config.istio.io
1768   annotations:
1769     "helm.sh/hook": crd-install
1770   labels:
1771     app: mixer
1772     package: statsd
1773     istio: mixer-adapter
1774 spec:
1775   group: config.istio.io
1776   names:
1777     kind: statsd
1778     plural: statsds
1779     singular: statsd
1780     categories:
1781     - istio-io
1782     - policy-istio-io
1783   scope: Namespaced
1784   version: v1alpha2
1785 ---
1786
1787 kind: CustomResourceDefinition
1788 apiVersion: apiextensions.k8s.io/v1beta1
1789 metadata:
1790   name: stdios.config.istio.io
1791   annotations:
1792     "helm.sh/hook": crd-install
1793   labels:
1794     app: mixer
1795     package: stdio
1796     istio: mixer-adapter
1797 spec:
1798   group: config.istio.io
1799   names:
1800     kind: stdio
1801     plural: stdios
1802     singular: stdio
1803     categories:
1804     - istio-io
1805     - policy-istio-io
1806   scope: Namespaced
1807   version: v1alpha2
1808 ---
1809
1810 kind: CustomResourceDefinition
1811 apiVersion: apiextensions.k8s.io/v1beta1
1812 metadata:
1813   name: apikeys.config.istio.io
1814   annotations:
1815     "helm.sh/hook": crd-install
1816   labels:
1817     app: mixer
1818     package: apikey
1819     istio: mixer-instance
1820 spec:
1821   group: config.istio.io
1822   names:
1823     kind: apikey
1824     plural: apikeys
1825     singular: apikey
1826     categories:
1827     - istio-io
1828     - policy-istio-io
1829   scope: Namespaced
1830   version: v1alpha2
1831 ---
1832
1833 kind: CustomResourceDefinition
1834 apiVersion: apiextensions.k8s.io/v1beta1
1835 metadata:
1836   name: authorizations.config.istio.io
1837   annotations:
1838     "helm.sh/hook": crd-install
1839   labels:
1840     app: mixer
1841     package: authorization
1842     istio: mixer-instance
1843 spec:
1844   group: config.istio.io
1845   names:
1846     kind: authorization
1847     plural: authorizations
1848     singular: authorization
1849     categories:
1850     - istio-io
1851     - policy-istio-io
1852   scope: Namespaced
1853   version: v1alpha2
1854 ---
1855
1856 kind: CustomResourceDefinition
1857 apiVersion: apiextensions.k8s.io/v1beta1
1858 metadata:
1859   name: checknothings.config.istio.io
1860   annotations:
1861     "helm.sh/hook": crd-install
1862   labels:
1863     app: mixer
1864     package: checknothing
1865     istio: mixer-instance
1866 spec:
1867   group: config.istio.io
1868   names:
1869     kind: checknothing
1870     plural: checknothings
1871     singular: checknothing
1872     categories:
1873     - istio-io
1874     - policy-istio-io
1875   scope: Namespaced
1876   version: v1alpha2
1877 ---
1878
1879 kind: CustomResourceDefinition
1880 apiVersion: apiextensions.k8s.io/v1beta1
1881 metadata:
1882   name: kuberneteses.config.istio.io
1883   annotations:
1884     "helm.sh/hook": crd-install
1885   labels:
1886     app: mixer
1887     package: adapter.template.kubernetes
1888     istio: mixer-instance
1889 spec:
1890   group: config.istio.io
1891   names:
1892     kind: kubernetes
1893     plural: kuberneteses
1894     singular: kubernetes
1895     categories:
1896     - istio-io
1897     - policy-istio-io
1898   scope: Namespaced
1899   version: v1alpha2
1900 ---
1901
1902 kind: CustomResourceDefinition
1903 apiVersion: apiextensions.k8s.io/v1beta1
1904 metadata:
1905   name: listentries.config.istio.io
1906   annotations:
1907     "helm.sh/hook": crd-install
1908   labels:
1909     app: mixer
1910     package: listentry
1911     istio: mixer-instance
1912 spec:
1913   group: config.istio.io
1914   names:
1915     kind: listentry
1916     plural: listentries
1917     singular: listentry
1918     categories:
1919     - istio-io
1920     - policy-istio-io
1921   scope: Namespaced
1922   version: v1alpha2
1923 ---
1924
1925 kind: CustomResourceDefinition
1926 apiVersion: apiextensions.k8s.io/v1beta1
1927 metadata:
1928   name: logentries.config.istio.io
1929   annotations:
1930     "helm.sh/hook": crd-install
1931   labels:
1932     app: mixer
1933     package: logentry
1934     istio: mixer-instance
1935 spec:
1936   group: config.istio.io
1937   names:
1938     kind: logentry
1939     plural: logentries
1940     singular: logentry
1941     categories:
1942     - istio-io
1943     - policy-istio-io
1944   scope: Namespaced
1945   version: v1alpha2
1946 ---
1947
1948 kind: CustomResourceDefinition
1949 apiVersion: apiextensions.k8s.io/v1beta1
1950 metadata:
1951   name: edges.config.istio.io
1952   annotations:
1953     "helm.sh/hook": crd-install
1954   labels:
1955     app: mixer
1956     package: edge
1957     istio: mixer-instance
1958 spec:
1959   group: config.istio.io
1960   names:
1961     kind: edge
1962     plural: edges
1963     singular: edge
1964     categories:
1965     - istio-io
1966     - policy-istio-io
1967   scope: Namespaced
1968   version: v1alpha2
1969 ---
1970
1971 kind: CustomResourceDefinition
1972 apiVersion: apiextensions.k8s.io/v1beta1
1973 metadata:
1974   name: metrics.config.istio.io
1975   annotations:
1976     "helm.sh/hook": crd-install
1977   labels:
1978     app: mixer
1979     package: metric
1980     istio: mixer-instance
1981 spec:
1982   group: config.istio.io
1983   names:
1984     kind: metric
1985     plural: metrics
1986     singular: metric
1987     categories:
1988     - istio-io
1989     - policy-istio-io
1990   scope: Namespaced
1991   version: v1alpha2
1992 ---
1993
1994 kind: CustomResourceDefinition
1995 apiVersion: apiextensions.k8s.io/v1beta1
1996 metadata:
1997   name: quotas.config.istio.io
1998   annotations:
1999     "helm.sh/hook": crd-install
2000   labels:
2001     app: mixer
2002     package: quota
2003     istio: mixer-instance
2004 spec:
2005   group: config.istio.io
2006   names:
2007     kind: quota
2008     plural: quotas
2009     singular: quota
2010     categories:
2011     - istio-io
2012     - policy-istio-io
2013   scope: Namespaced
2014   version: v1alpha2
2015 ---
2016
2017 kind: CustomResourceDefinition
2018 apiVersion: apiextensions.k8s.io/v1beta1
2019 metadata:
2020   name: reportnothings.config.istio.io
2021   annotations:
2022     "helm.sh/hook": crd-install
2023   labels:
2024     app: mixer
2025     package: reportnothing
2026     istio: mixer-instance
2027 spec:
2028   group: config.istio.io
2029   names:
2030     kind: reportnothing
2031     plural: reportnothings
2032     singular: reportnothing
2033     categories:
2034     - istio-io
2035     - policy-istio-io
2036   scope: Namespaced
2037   version: v1alpha2
2038 ---
2039
2040 kind: CustomResourceDefinition
2041 apiVersion: apiextensions.k8s.io/v1beta1
2042 metadata:
2043   name: servicecontrolreports.config.istio.io
2044   annotations:
2045     "helm.sh/hook": crd-install
2046   labels:
2047     app: mixer
2048     package: servicecontrolreport
2049     istio: mixer-instance
2050 spec:
2051   group: config.istio.io
2052   names:
2053     kind: servicecontrolreport
2054     plural: servicecontrolreports
2055     singular: servicecontrolreport
2056     categories:
2057     - istio-io
2058     - policy-istio-io
2059   scope: Namespaced
2060   version: v1alpha2
2061 ---
2062
2063 kind: CustomResourceDefinition
2064 apiVersion: apiextensions.k8s.io/v1beta1
2065 metadata:
2066   name: tracespans.config.istio.io
2067   annotations:
2068     "helm.sh/hook": crd-install
2069   labels:
2070     app: mixer
2071     package: tracespan
2072     istio: mixer-instance
2073 spec:
2074   group: config.istio.io
2075   names:
2076     kind: tracespan
2077     plural: tracespans
2078     singular: tracespan
2079     categories:
2080     - istio-io
2081     - policy-istio-io
2082   scope: Namespaced
2083   version: v1alpha2
2084 ---
2085
2086 kind: CustomResourceDefinition
2087 apiVersion: apiextensions.k8s.io/v1beta1
2088 metadata:
2089   name: rbacconfigs.rbac.istio.io
2090   annotations:
2091     "helm.sh/hook": crd-install
2092   labels:
2093     app: mixer
2094     package: istio.io.mixer
2095     istio: rbac
2096 spec:
2097   group: rbac.istio.io
2098   names:
2099     kind: RbacConfig
2100     plural: rbacconfigs
2101     singular: rbacconfig
2102     categories:
2103     - istio-io
2104     - rbac-istio-io
2105   scope: Namespaced
2106   version: v1alpha1
2107 ---
2108
2109 kind: CustomResourceDefinition
2110 apiVersion: apiextensions.k8s.io/v1beta1
2111 metadata:
2112   name: serviceroles.rbac.istio.io
2113   annotations:
2114     "helm.sh/hook": crd-install
2115   labels:
2116     app: mixer
2117     package: istio.io.mixer
2118     istio: rbac
2119 spec:
2120   group: rbac.istio.io
2121   names:
2122     kind: ServiceRole
2123     plural: serviceroles
2124     singular: servicerole
2125     categories:
2126     - istio-io
2127     - rbac-istio-io
2128   scope: Namespaced
2129   version: v1alpha1
2130 ---
2131
2132 kind: CustomResourceDefinition
2133 apiVersion: apiextensions.k8s.io/v1beta1
2134 metadata:
2135   name: servicerolebindings.rbac.istio.io
2136   annotations:
2137     "helm.sh/hook": crd-install
2138   labels:
2139     app: mixer
2140     package: istio.io.mixer
2141     istio: rbac
2142 spec:
2143   group: rbac.istio.io
2144   names:
2145     kind: ServiceRoleBinding
2146     plural: servicerolebindings
2147     singular: servicerolebinding
2148     categories:
2149     - istio-io
2150     - rbac-istio-io
2151   scope: Namespaced
2152   version: v1alpha1
2153 ---
2154 kind: CustomResourceDefinition
2155 apiVersion: apiextensions.k8s.io/v1beta1
2156 metadata:
2157   name: adapters.config.istio.io
2158   annotations:
2159     "helm.sh/hook": crd-install
2160   labels:
2161     app: mixer
2162     package: adapter
2163     istio: mixer-adapter
2164 spec:
2165   group: config.istio.io
2166   names:
2167     kind: adapter
2168     plural: adapters
2169     singular: adapter
2170     categories:
2171     - istio-io
2172     - policy-istio-io
2173   scope: Namespaced
2174   version: v1alpha2
2175 ---
2176 kind: CustomResourceDefinition
2177 apiVersion: apiextensions.k8s.io/v1beta1
2178 metadata:
2179   name: instances.config.istio.io
2180   annotations:
2181     "helm.sh/hook": crd-install
2182   labels:
2183     app: mixer
2184     package: instance
2185     istio: mixer-instance
2186 spec:
2187   group: config.istio.io
2188   names:
2189     kind: instance
2190     plural: instances
2191     singular: instance
2192     categories:
2193     - istio-io
2194     - policy-istio-io
2195   scope: Namespaced
2196   version: v1alpha2
2197 ---
2198 kind: CustomResourceDefinition
2199 apiVersion: apiextensions.k8s.io/v1beta1
2200 metadata:
2201   name: templates.config.istio.io
2202   annotations:
2203     "helm.sh/hook": crd-install
2204   labels:
2205     app: mixer
2206     package: template
2207     istio: mixer-template
2208 spec:
2209   group: config.istio.io
2210   names:
2211     kind: template
2212     plural: templates
2213     singular: template
2214     categories:
2215     - istio-io
2216     - policy-istio-io
2217   scope: Namespaced
2218   version: v1alpha2
2219 ---
2220 kind: CustomResourceDefinition
2221 apiVersion: apiextensions.k8s.io/v1beta1
2222 metadata:
2223   name: handlers.config.istio.io
2224   annotations:
2225     "helm.sh/hook": crd-install
2226   labels:
2227     app: mixer
2228     package: handler
2229     istio: mixer-handler
2230 spec:
2231   group: config.istio.io
2232   names:
2233     kind: handler
2234     plural: handlers
2235     singular: handler
2236     categories:
2237     - istio-io
2238     - policy-istio-io
2239   scope: Namespaced
2240   version: v1alpha2
2241 ---
2242 #
2243 #
2244 ---
2245 # Source: istio/charts/galley/templates/clusterrole.yaml
2246 apiVersion: rbac.authorization.k8s.io/v1beta1
2247 kind: ClusterRole
2248 metadata:
2249   name: istio-galley-istio-system
2250   labels:
2251     app: istio-galley
2252     chart: galley-1.0.0
2253     heritage: Tiller
2254     release: RELEASE-NAME
2255 rules:
2256 - apiGroups: ["admissionregistration.k8s.io"]
2257   resources: ["validatingwebhookconfigurations"]
2258   verbs: ["*"]
2259 - apiGroups: ["config.istio.io"] # istio mixer CRD watcher
2260   resources: ["*"]
2261   verbs: ["get", "list", "watch"]
2262 - apiGroups: ["*"]
2263   resources: ["deployments"]
2264   resourceNames: ["istio-galley"]
2265   verbs: ["get"]
2266
2267 ---
2268 # Source: istio/charts/gateways/templates/clusterrole.yaml
2269
2270 apiVersion: rbac.authorization.k8s.io/v1beta1
2271 kind: ClusterRole
2272 metadata:
2273   labels:
2274     app: gateways
2275     chart: gateways-1.0.0
2276     heritage: Tiller
2277     release: RELEASE-NAME
2278   name: istio-egressgateway-istio-system
2279 rules:
2280 - apiGroups: ["extensions"]
2281   resources: ["thirdpartyresources", "virtualservices", "destinationrules", "gateways"]
2282   verbs: ["get", "watch", "list", "update"]
2283 ---
2284 apiVersion: rbac.authorization.k8s.io/v1beta1
2285 kind: ClusterRole
2286 metadata:
2287   labels:
2288     app: gateways
2289     chart: gateways-1.0.0
2290     heritage: Tiller
2291     release: RELEASE-NAME
2292   name: istio-ingressgateway-istio-system
2293 rules:
2294 - apiGroups: ["extensions"]
2295   resources: ["thirdpartyresources", "virtualservices", "destinationrules", "gateways"]
2296   verbs: ["get", "watch", "list", "update"]
2297 ---
2298
2299 ---
2300 # Source: istio/charts/mixer/templates/clusterrole.yaml
2301 apiVersion: rbac.authorization.k8s.io/v1beta1
2302 kind: ClusterRole
2303 metadata:
2304   name: istio-mixer-istio-system
2305   labels:
2306     app: mixer
2307     chart: mixer-1.0.0
2308     heritage: Tiller
2309     release: RELEASE-NAME
2310 rules:
2311 - apiGroups: ["config.istio.io"] # istio CRD watcher
2312   resources: ["*"]
2313   verbs: ["create", "get", "list", "watch", "patch"]
2314 - apiGroups: ["rbac.istio.io"] # istio RBAC watcher
2315   resources: ["*"]
2316   verbs: ["get", "list", "watch"]
2317 - apiGroups: ["apiextensions.k8s.io"]
2318   resources: ["customresourcedefinitions"]
2319   verbs: ["get", "list", "watch"]
2320 - apiGroups: [""]
2321   resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets"]
2322   verbs: ["get", "list", "watch"]
2323 - apiGroups: ["extensions"]
2324   resources: ["replicasets"]
2325   verbs: ["get", "list", "watch"]
2326 - apiGroups: ["apps"]
2327   resources: ["replicasets"]
2328   verbs: ["get", "list", "watch"]
2329
2330 ---
2331 # Source: istio/charts/pilot/templates/clusterrole.yaml
2332 apiVersion: rbac.authorization.k8s.io/v1beta1
2333 kind: ClusterRole
2334 metadata:
2335   name: istio-pilot-istio-system
2336   labels:
2337     app: istio-pilot
2338     chart: pilot-1.0.0
2339     heritage: Tiller
2340     release: RELEASE-NAME
2341 rules:
2342 - apiGroups: ["config.istio.io"]
2343   resources: ["*"]
2344   verbs: ["*"]
2345 - apiGroups: ["rbac.istio.io"]
2346   resources: ["*"]
2347   verbs: ["get", "watch", "list"]
2348 - apiGroups: ["networking.istio.io"]
2349   resources: ["*"]
2350   verbs: ["*"]
2351 - apiGroups: ["authentication.istio.io"]
2352   resources: ["*"]
2353   verbs: ["*"]
2354 - apiGroups: ["apiextensions.k8s.io"]
2355   resources: ["customresourcedefinitions"]
2356   verbs: ["*"]
2357 - apiGroups: ["extensions"]
2358   resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses", "ingresses/status"]
2359   verbs: ["*"]
2360 - apiGroups: [""]
2361   resources: ["configmaps"]
2362   verbs: ["create", "get", "list", "watch", "update"]
2363 - apiGroups: [""]
2364   resources: ["endpoints", "pods", "services"]
2365   verbs: ["get", "list", "watch"]
2366 - apiGroups: [""]
2367   resources: ["namespaces", "nodes", "secrets"]
2368   verbs: ["get", "list", "watch"]
2369
2370 ---
2371 # Source: istio/charts/prometheus/templates/clusterrole.yaml
2372 apiVersion: rbac.authorization.k8s.io/v1beta1
2373 kind: ClusterRole
2374 metadata:
2375   name: prometheus-istio-system
2376 rules:
2377 - apiGroups: [""]
2378   resources:
2379   - nodes
2380   - services
2381   - endpoints
2382   - pods
2383   - nodes/proxy
2384   verbs: ["get", "list", "watch"]
2385 - apiGroups: [""]
2386   resources:
2387   - configmaps
2388   verbs: ["get"]
2389 - nonResourceURLs: ["/metrics"]
2390   verbs: ["get"]
2391
2392 ---
2393 # Source: istio/charts/security/templates/clusterrole.yaml
2394 apiVersion: rbac.authorization.k8s.io/v1beta1
2395 kind: ClusterRole
2396 metadata:
2397   name: istio-citadel-istio-system
2398   labels:
2399     app: security
2400     chart: security-1.0.0
2401     heritage: Tiller
2402     release: RELEASE-NAME
2403 rules:
2404 - apiGroups: [""]
2405   resources: ["secrets"]
2406   verbs: ["create", "get", "watch", "list", "update", "delete"]
2407 - apiGroups: [""]
2408   resources: ["serviceaccounts"]
2409   verbs: ["get", "watch", "list"]
2410 - apiGroups: [""]
2411   resources: ["services"]
2412   verbs: ["get", "watch", "list"]
2413
2414 ---
2415 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml
2416 apiVersion: rbac.authorization.k8s.io/v1beta1
2417 kind: ClusterRole
2418 metadata:
2419   name: istio-sidecar-injector-istio-system
2420   labels:
2421     app: istio-sidecar-injector
2422     chart: sidecarInjectorWebhook-1.0.0
2423     heritage: Tiller
2424     release: RELEASE-NAME
2425 rules:
2426 - apiGroups: ["*"]
2427   resources: ["configmaps"]
2428   verbs: ["get", "list", "watch"]
2429 - apiGroups: ["admissionregistration.k8s.io"]
2430   resources: ["mutatingwebhookconfigurations"]
2431   verbs: ["get", "list", "watch", "patch"]
2432
2433 ---
2434 # Source: istio/charts/galley/templates/clusterrolebinding.yaml
2435 apiVersion: rbac.authorization.k8s.io/v1beta1
2436 kind: ClusterRoleBinding
2437 metadata:
2438   name: istio-galley-admin-role-binding-istio-system
2439   labels:
2440     app: istio-galley
2441     chart: galley-1.0.0
2442     heritage: Tiller
2443     release: RELEASE-NAME
2444 roleRef:
2445   apiGroup: rbac.authorization.k8s.io
2446   kind: ClusterRole
2447   name: istio-galley-istio-system
2448 subjects:
2449   - kind: ServiceAccount
2450     name: istio-galley-service-account
2451     namespace: istio-system
2452
2453 ---
2454 # Source: istio/charts/gateways/templates/clusterrolebindings.yaml
2455
2456 apiVersion: rbac.authorization.k8s.io/v1beta1
2457 kind: ClusterRoleBinding
2458 metadata:
2459   name: istio-egressgateway-istio-system
2460 roleRef:
2461   apiGroup: rbac.authorization.k8s.io
2462   kind: ClusterRole
2463   name: istio-egressgateway-istio-system
2464 subjects:
2465   - kind: ServiceAccount
2466     name: istio-egressgateway-service-account
2467     namespace: istio-system
2468 ---
2469 apiVersion: rbac.authorization.k8s.io/v1beta1
2470 kind: ClusterRoleBinding
2471 metadata:
2472   name: istio-ingressgateway-istio-system
2473 roleRef:
2474   apiGroup: rbac.authorization.k8s.io
2475   kind: ClusterRole
2476   name: istio-ingressgateway-istio-system
2477 subjects:
2478   - kind: ServiceAccount
2479     name: istio-ingressgateway-service-account
2480     namespace: istio-system
2481 ---
2482
2483 ---
2484 # Source: istio/charts/mixer/templates/clusterrolebinding.yaml
2485 apiVersion: rbac.authorization.k8s.io/v1beta1
2486 kind: ClusterRoleBinding
2487 metadata:
2488   name: istio-mixer-admin-role-binding-istio-system
2489   labels:
2490     app: mixer
2491     chart: mixer-1.0.0
2492     heritage: Tiller
2493     release: RELEASE-NAME
2494 roleRef:
2495   apiGroup: rbac.authorization.k8s.io
2496   kind: ClusterRole
2497   name: istio-mixer-istio-system
2498 subjects:
2499   - kind: ServiceAccount
2500     name: istio-mixer-service-account
2501     namespace: istio-system
2502
2503 ---
2504 # Source: istio/charts/pilot/templates/clusterrolebinding.yaml
2505 apiVersion: rbac.authorization.k8s.io/v1beta1
2506 kind: ClusterRoleBinding
2507 metadata:
2508   name: istio-pilot-istio-system
2509   labels:
2510     app: istio-pilot
2511     chart: pilot-1.0.0
2512     heritage: Tiller
2513     release: RELEASE-NAME
2514 roleRef:
2515   apiGroup: rbac.authorization.k8s.io
2516   kind: ClusterRole
2517   name: istio-pilot-istio-system
2518 subjects:
2519   - kind: ServiceAccount
2520     name: istio-pilot-service-account
2521     namespace: istio-system
2522
2523 ---
2524 # Source: istio/charts/prometheus/templates/clusterrolebindings.yaml
2525 apiVersion: rbac.authorization.k8s.io/v1beta1
2526 kind: ClusterRoleBinding
2527 metadata:
2528   name: prometheus-istio-system
2529 roleRef:
2530   apiGroup: rbac.authorization.k8s.io
2531   kind: ClusterRole
2532   name: prometheus-istio-system
2533 subjects:
2534 - kind: ServiceAccount
2535   name: prometheus
2536   namespace: istio-system
2537
2538 ---
2539 # Source: istio/charts/security/templates/clusterrolebinding.yaml
2540 apiVersion: rbac.authorization.k8s.io/v1beta1
2541 kind: ClusterRoleBinding
2542 metadata:
2543   name: istio-citadel-istio-system
2544   labels:
2545     app: security
2546     chart: security-1.0.0
2547     heritage: Tiller
2548     release: RELEASE-NAME
2549 roleRef:
2550   apiGroup: rbac.authorization.k8s.io
2551   kind: ClusterRole
2552   name: istio-citadel-istio-system
2553 subjects:
2554   - kind: ServiceAccount
2555     name: istio-citadel-service-account
2556     namespace: istio-system
2557
2558 ---
2559 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml
2560 apiVersion: rbac.authorization.k8s.io/v1beta1
2561 kind: ClusterRoleBinding
2562 metadata:
2563   name: istio-sidecar-injector-admin-role-binding-istio-system
2564   labels:
2565     app: istio-sidecar-injector
2566     chart: sidecarInjectorWebhook-1.0.0
2567     heritage: Tiller
2568     release: RELEASE-NAME
2569 roleRef:
2570   apiGroup: rbac.authorization.k8s.io
2571   kind: ClusterRole
2572   name: istio-sidecar-injector-istio-system
2573 subjects:
2574   - kind: ServiceAccount
2575     name: istio-sidecar-injector-service-account
2576     namespace: istio-system
2577
2578 ---
2579 # Source: istio/charts/galley/templates/service.yaml
2580 apiVersion: v1
2581 kind: Service
2582 metadata:
2583   name: istio-galley
2584   namespace: istio-system
2585   labels:
2586     istio: galley
2587 spec:
2588   ports:
2589   - port: 443
2590     name: https-validation
2591   - port: 9093
2592     name: http-monitoring
2593   selector:
2594     istio: galley
2595
2596 ---
2597 # Source: istio/charts/gateways/templates/service.yaml
2598
2599 apiVersion: v1
2600 kind: Service
2601 metadata:
2602   name: istio-egressgateway
2603   namespace: istio-system
2604   annotations:
2605   labels:
2606     chart: gateways-1.0.0
2607     release: RELEASE-NAME
2608     heritage: Tiller
2609     app: istio-egressgateway
2610     istio: egressgateway
2611 spec:
2612   type: ClusterIP
2613   selector:
2614     app: istio-egressgateway
2615     istio: egressgateway
2616   ports:
2617     -
2618       name: http2
2619       port: 80
2620     -
2621       name: https
2622       port: 443
2623 ---
2624 apiVersion: v1
2625 kind: Service
2626 metadata:
2627   name: istio-ingressgateway
2628   namespace: istio-system
2629   annotations:
2630   labels:
2631     chart: gateways-1.0.0
2632     release: RELEASE-NAME
2633     heritage: Tiller
2634     app: istio-ingressgateway
2635     istio: ingressgateway
2636 spec:
2637   type: LoadBalancer
2638   selector:
2639     app: istio-ingressgateway
2640     istio: ingressgateway
2641   ports:
2642     -
2643       name: http2
2644       nodePort: 31380
2645       port: 80
2646       targetPort: 80
2647     -
2648       name: https
2649       nodePort: 31390
2650       port: 443
2651     -
2652       name: tcp
2653       nodePort: 31400
2654       port: 31400
2655     -
2656       name: tcp-pilot-grpc-tls
2657       port: 15011
2658       targetPort: 15011
2659     -
2660       name: tcp-citadel-grpc-tls
2661       port: 8060
2662       targetPort: 8060
2663     -
2664       name: http2-prometheus
2665       port: 15030
2666       targetPort: 15030
2667     -
2668       name: http2-grafana
2669       port: 15031
2670       targetPort: 15031
2671 ---
2672
2673 ---
2674 # Source: istio/charts/grafana/templates/service.yaml
2675 apiVersion: v1
2676 kind: Service
2677 metadata:
2678   name: grafana
2679   namespace: istio-system
2680   annotations:
2681   labels:
2682     app: grafana
2683     chart: grafana-0.1.0
2684     release: RELEASE-NAME
2685     heritage: Tiller
2686 spec:
2687   type: NodePort
2688   ports:
2689     - port: 3000
2690       targetPort: 3000
2691       protocol: TCP
2692       name: http
2693       nodePort: 30300
2694   selector:
2695     app: grafana
2696
2697 ---
2698 # Source: istio/charts/mixer/templates/service.yaml
2699
2700 apiVersion: v1
2701 kind: Service
2702 metadata:
2703   name: istio-policy
2704   namespace: istio-system
2705   labels:
2706     chart: mixer-1.0.0
2707     release: RELEASE-NAME
2708     istio: mixer
2709 spec:
2710   ports:
2711   - name: grpc-mixer
2712     port: 9091
2713   - name: grpc-mixer-mtls
2714     port: 15004
2715   - name: http-monitoring
2716     port: 9093
2717   selector:
2718     istio: mixer
2719     istio-mixer-type: policy
2720 ---
2721 apiVersion: v1
2722 kind: Service
2723 metadata:
2724   name: istio-telemetry
2725   namespace: istio-system
2726   labels:
2727     chart: mixer-1.0.0
2728     release: RELEASE-NAME
2729     istio: mixer
2730 spec:
2731   ports:
2732   - name: grpc-mixer
2733     port: 9091
2734   - name: grpc-mixer-mtls
2735     port: 15004
2736   - name: http-monitoring
2737     port: 9093
2738   - name: prometheus
2739     port: 42422
2740   selector:
2741     istio: mixer
2742     istio-mixer-type: telemetry
2743 ---
2744
2745 ---
2746 # Source: istio/charts/mixer/templates/statsdtoprom.yaml
2747
2748 ---
2749 apiVersion: v1
2750 kind: Service
2751 metadata:
2752   name: istio-statsd-prom-bridge
2753   namespace: istio-system
2754   labels:
2755     chart: mixer-1.0.0
2756     release: RELEASE-NAME
2757     istio: statsd-prom-bridge
2758 spec:
2759   ports:
2760   - name: statsd-prom
2761     port: 9102
2762   - name: statsd-udp
2763     port: 9125
2764     protocol: UDP
2765   selector:
2766     istio: statsd-prom-bridge
2767
2768 ---
2769
2770 apiVersion: extensions/v1beta1
2771 kind: Deployment
2772 metadata:
2773   name: istio-statsd-prom-bridge
2774   namespace: istio-system
2775   labels:
2776     chart: mixer-1.0.0
2777     release: RELEASE-NAME
2778     istio: mixer
2779 spec:
2780   template:
2781     metadata:
2782       labels:
2783         istio: statsd-prom-bridge
2784       annotations:
2785         sidecar.istio.io/inject: "false"
2786     spec:
2787       serviceAccountName: istio-mixer-service-account
2788       volumes:
2789       - name: config-volume
2790         configMap:
2791           name: istio-statsd-prom-bridge
2792       containers:
2793       - name: statsd-prom-bridge
2794         image: "docker.io/prom/statsd-exporter:v0.6.0"
2795         imagePullPolicy: IfNotPresent
2796         ports:
2797         - containerPort: 9102
2798         - containerPort: 9125
2799           protocol: UDP
2800         args:
2801         - '-statsd.mapping-config=/etc/statsd/mapping.conf'
2802         resources:
2803           requests:
2804             cpu: 10m
2805
2806         volumeMounts:
2807         - name: config-volume
2808           mountPath: /etc/statsd
2809
2810 ---
2811 # Source: istio/charts/pilot/templates/service.yaml
2812 apiVersion: v1
2813 kind: Service
2814 metadata:
2815   name: istio-pilot
2816   namespace: istio-system
2817   labels:
2818     app: istio-pilot
2819     chart: pilot-1.0.0
2820     release: RELEASE-NAME
2821     heritage: Tiller
2822 spec:
2823   ports:
2824   - port: 15010
2825     name: grpc-xds # direct
2826   - port: 15011
2827     name: https-xds # mTLS
2828   - port: 8080
2829     name: http-legacy-discovery # direct
2830   - port: 9093
2831     name: http-monitoring
2832   selector:
2833     istio: pilot
2834
2835 ---
2836 # Source: istio/charts/prometheus/templates/service.yaml
2837 apiVersion: v1
2838 kind: Service
2839 metadata:
2840   name: prometheus
2841   namespace: istio-system
2842   annotations:
2843     prometheus.io/scrape: 'true'
2844   labels:
2845     name: prometheus
2846 spec:
2847   selector:
2848     app: prometheus
2849   ports:
2850   - name: http-prometheus
2851     protocol: TCP
2852     port: 9090
2853
2854 ---
2855 # Source: istio/charts/security/templates/service.yaml
2856 apiVersion: v1
2857 kind: Service
2858 metadata:
2859   # we use the normal name here (e.g. 'prometheus')
2860   # as grafana is configured to use this as a data source
2861   name: istio-citadel
2862   namespace: istio-system
2863   labels:
2864     app: istio-citadel
2865 spec:
2866   ports:
2867     - name: grpc-citadel
2868       port: 8060
2869       targetPort: 8060
2870       protocol: TCP
2871     - name: http-monitoring
2872       port: 9093
2873   selector:
2874     istio: citadel
2875
2876 ---
2877 # Source: istio/charts/servicegraph/templates/service.yaml
2878 apiVersion: v1
2879 kind: Service
2880 metadata:
2881   name: servicegraph
2882   namespace: istio-system
2883   annotations:
2884   labels:
2885     app: servicegraph
2886     chart: servicegraph-0.1.0
2887     release: RELEASE-NAME
2888     heritage: Tiller
2889 spec:
2890   type: NodePort
2891   ports:
2892     - port: 8088
2893       targetPort: 8088
2894       protocol: TCP
2895       name: http
2896       nodePort: 30088
2897   selector:
2898     app: servicegraph
2899
2900 ---
2901 # Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml
2902 apiVersion: v1
2903 kind: Service
2904 metadata:
2905   name: istio-sidecar-injector
2906   namespace: istio-system
2907   labels:
2908     istio: sidecar-injector
2909 spec:
2910   ports:
2911   - port: 443
2912   selector:
2913     istio: sidecar-injector
2914
2915 ---
2916 # Source: istio/charts/galley/templates/deployment.yaml
2917 apiVersion: extensions/v1beta1
2918 kind: Deployment
2919 metadata:
2920   name: istio-galley
2921   namespace: istio-system
2922   labels:
2923     app: galley
2924     chart: galley-1.0.0
2925     release: RELEASE-NAME
2926     heritage: Tiller
2927     istio: galley
2928 spec:
2929   replicas: 1
2930   strategy:
2931     rollingUpdate:
2932       maxSurge: 1
2933       maxUnavailable: 0
2934   template:
2935     metadata:
2936       labels:
2937         istio: galley
2938       annotations:
2939         sidecar.istio.io/inject: "false"
2940         scheduler.alpha.kubernetes.io/critical-pod: ""
2941     spec:
2942       serviceAccountName: istio-galley-service-account
2943       containers:
2944         - name: validator
2945           image: "gcr.io/istio-release/galley:1.0.0"
2946           imagePullPolicy: IfNotPresent
2947           ports:
2948           - containerPort: 443
2949           - containerPort: 9093
2950           command:
2951           - /usr/local/bin/galley
2952           - validator
2953           - --deployment-namespace=istio-system
2954           - --caCertFile=/etc/istio/certs/root-cert.pem
2955           - --tlsCertFile=/etc/istio/certs/cert-chain.pem
2956           - --tlsKeyFile=/etc/istio/certs/key.pem
2957           - --healthCheckInterval=2s
2958           - --healthCheckFile=/health
2959           - --webhook-config-file
2960           - /etc/istio/config/validatingwebhookconfiguration.yaml
2961           volumeMounts:
2962           - name: certs
2963             mountPath: /etc/istio/certs
2964             readOnly: true
2965           - name: config
2966             mountPath: /etc/istio/config
2967             readOnly: true
2968           livenessProbe:
2969             exec:
2970               command:
2971                 - /usr/local/bin/galley
2972                 - probe
2973                 - --probe-path=/health
2974                 - --interval=4s
2975             initialDelaySeconds: 4
2976             periodSeconds: 4
2977           readinessProbe:
2978             exec:
2979               command:
2980                 - /usr/local/bin/galley
2981                 - probe
2982                 - --probe-path=/health
2983                 - --interval=4s
2984             initialDelaySeconds: 4
2985             periodSeconds: 4
2986           resources:
2987             requests:
2988               cpu: 10m
2989
2990       volumes:
2991       - name: certs
2992         secret:
2993           secretName: istio.istio-galley-service-account
2994       - name: config
2995         configMap:
2996           name: istio-galley-configuration
2997       affinity:
2998         nodeAffinity:
2999           requiredDuringSchedulingIgnoredDuringExecution:
3000             nodeSelectorTerms:
3001             - matchExpressions:
3002               - key: beta.kubernetes.io/arch
3003                 operator: In
3004                 values:
3005                 - amd64
3006                 - ppc64le
3007                 - s390x
3008           preferredDuringSchedulingIgnoredDuringExecution:
3009           - weight: 2
3010             preference:
3011               matchExpressions:
3012               - key: beta.kubernetes.io/arch
3013                 operator: In
3014                 values:
3015                 - amd64
3016           - weight: 2
3017             preference:
3018               matchExpressions:
3019               - key: beta.kubernetes.io/arch
3020                 operator: In
3021                 values:
3022                 - ppc64le
3023           - weight: 2
3024             preference:
3025               matchExpressions:
3026               - key: beta.kubernetes.io/arch
3027                 operator: In
3028                 values:
3029                 - s390x
3030
3031 ---
3032 # Source: istio/charts/gateways/templates/deployment.yaml
3033
3034 apiVersion: extensions/v1beta1
3035 kind: Deployment
3036 metadata:
3037   name: istio-egressgateway
3038   namespace: istio-system
3039   labels:
3040     app: egressgateway
3041     chart: gateways-1.0.0
3042     release: RELEASE-NAME
3043     heritage: Tiller
3044     app: istio-egressgateway
3045     istio: egressgateway
3046 spec:
3047   replicas: 1
3048   template:
3049     metadata:
3050       labels:
3051         app: istio-egressgateway
3052         istio: egressgateway
3053       annotations:
3054         sidecar.istio.io/inject: "false"
3055         scheduler.alpha.kubernetes.io/critical-pod: ""
3056     spec:
3057       serviceAccountName: istio-egressgateway-service-account
3058       containers:
3059         - name: egressgateway
3060           image: "gcr.io/istio-release/proxyv2:1.0.0"
3061           imagePullPolicy: IfNotPresent
3062           ports:
3063             - containerPort: 80
3064             - containerPort: 443
3065           args:
3066           - proxy
3067           - router
3068           - -v
3069           - "2"
3070           - --discoveryRefreshDelay
3071           - '1s' #discoveryRefreshDelay
3072           - --drainDuration
3073           - '45s' #drainDuration
3074           - --parentShutdownDuration
3075           - '1m0s' #parentShutdownDuration
3076           - --connectTimeout
3077           - '10s' #connectTimeout
3078           - --serviceCluster
3079           - istio-egressgateway
3080           - --zipkinAddress
3081           - zipkin:9411
3082           - --statsdUdpAddress
3083           - istio-statsd-prom-bridge:9125
3084           - --proxyAdminPort
3085           - "15000"
3086           - --controlPlaneAuthPolicy
3087           - MUTUAL_TLS
3088           - --discoveryAddress
3089           - istio-pilot.istio-system:15005
3090           resources:
3091             requests:
3092               cpu: 10m
3093
3094           env:
3095           - name: POD_NAME
3096             valueFrom:
3097               fieldRef:
3098                 apiVersion: v1
3099                 fieldPath: metadata.name
3100           - name: POD_NAMESPACE
3101             valueFrom:
3102               fieldRef:
3103                 apiVersion: v1
3104                 fieldPath: metadata.namespace
3105           - name: INSTANCE_IP
3106             valueFrom:
3107               fieldRef:
3108                 apiVersion: v1
3109                 fieldPath: status.podIP
3110           - name: ISTIO_META_POD_NAME
3111             valueFrom:
3112               fieldRef:
3113                 fieldPath: metadata.name
3114           volumeMounts:
3115           - name: istio-certs
3116             mountPath: /etc/certs
3117             readOnly: true
3118           - name: egressgateway-certs
3119             mountPath: "/etc/istio/egressgateway-certs"
3120             readOnly: true
3121           - name: egressgateway-ca-certs
3122             mountPath: "/etc/istio/egressgateway-ca-certs"
3123             readOnly: true
3124       volumes:
3125       - name: istio-certs
3126         secret:
3127           secretName: istio.istio-egressgateway-service-account
3128           optional: true
3129       - name: egressgateway-certs
3130         secret:
3131           secretName: "istio-egressgateway-certs"
3132           optional: true
3133       - name: egressgateway-ca-certs
3134         secret:
3135           secretName: "istio-egressgateway-ca-certs"
3136           optional: true
3137       affinity:
3138         nodeAffinity:
3139           requiredDuringSchedulingIgnoredDuringExecution:
3140             nodeSelectorTerms:
3141             - matchExpressions:
3142               - key: beta.kubernetes.io/arch
3143                 operator: In
3144                 values:
3145                 - amd64
3146                 - ppc64le
3147                 - s390x
3148           preferredDuringSchedulingIgnoredDuringExecution:
3149           - weight: 2
3150             preference:
3151               matchExpressions:
3152               - key: beta.kubernetes.io/arch
3153                 operator: In
3154                 values:
3155                 - amd64
3156           - weight: 2
3157             preference:
3158               matchExpressions:
3159               - key: beta.kubernetes.io/arch
3160                 operator: In
3161                 values:
3162                 - ppc64le
3163           - weight: 2
3164             preference:
3165               matchExpressions:
3166               - key: beta.kubernetes.io/arch
3167                 operator: In
3168                 values:
3169                 - s390x
3170 ---
3171 apiVersion: extensions/v1beta1
3172 kind: Deployment
3173 metadata:
3174   name: istio-ingressgateway
3175   namespace: istio-system
3176   labels:
3177     app: ingressgateway
3178     chart: gateways-1.0.0
3179     release: RELEASE-NAME
3180     heritage: Tiller
3181     app: istio-ingressgateway
3182     istio: ingressgateway
3183 spec:
3184   replicas: 1
3185   template:
3186     metadata:
3187       labels:
3188         app: istio-ingressgateway
3189         istio: ingressgateway
3190       annotations:
3191         sidecar.istio.io/inject: "false"
3192         scheduler.alpha.kubernetes.io/critical-pod: ""
3193     spec:
3194       serviceAccountName: istio-ingressgateway-service-account
3195       containers:
3196         - name: ingressgateway
3197           image: "gcr.io/istio-release/proxyv2:1.0.0"
3198           imagePullPolicy: IfNotPresent
3199           ports:
3200             - containerPort: 80
3201             - containerPort: 443
3202             - containerPort: 31400
3203             - containerPort: 15011
3204             - containerPort: 8060
3205             - containerPort: 15030
3206             - containerPort: 15031
3207           args:
3208           - proxy
3209           - router
3210           - -v
3211           - "2"
3212           - --discoveryRefreshDelay
3213           - '1s' #discoveryRefreshDelay
3214           - --drainDuration
3215           - '45s' #drainDuration
3216           - --parentShutdownDuration
3217           - '1m0s' #parentShutdownDuration
3218           - --connectTimeout
3219           - '10s' #connectTimeout
3220           - --serviceCluster
3221           - istio-ingressgateway
3222           - --zipkinAddress
3223           - zipkin:9411
3224           - --statsdUdpAddress
3225           - istio-statsd-prom-bridge:9125
3226           - --proxyAdminPort
3227           - "15000"
3228           - --controlPlaneAuthPolicy
3229           - MUTUAL_TLS
3230           - --discoveryAddress
3231           - istio-pilot.istio-system:15005
3232           resources:
3233             requests:
3234               cpu: 10m
3235
3236           env:
3237           - name: POD_NAME
3238             valueFrom:
3239               fieldRef:
3240                 apiVersion: v1
3241                 fieldPath: metadata.name
3242           - name: POD_NAMESPACE
3243             valueFrom:
3244               fieldRef:
3245                 apiVersion: v1
3246                 fieldPath: metadata.namespace
3247           - name: INSTANCE_IP
3248             valueFrom:
3249               fieldRef:
3250                 apiVersion: v1
3251                 fieldPath: status.podIP
3252           - name: ISTIO_META_POD_NAME
3253             valueFrom:
3254               fieldRef:
3255                 fieldPath: metadata.name
3256           volumeMounts:
3257           - name: istio-certs
3258             mountPath: /etc/certs
3259             readOnly: true
3260           - name: ingressgateway-certs
3261             mountPath: "/etc/istio/ingressgateway-certs"
3262             readOnly: true
3263           - name: ingressgateway-ca-certs
3264             mountPath: "/etc/istio/ingressgateway-ca-certs"
3265             readOnly: true
3266       volumes:
3267       - name: istio-certs
3268         secret:
3269           secretName: istio.istio-ingressgateway-service-account
3270           optional: true
3271       - name: ingressgateway-certs
3272         secret:
3273           secretName: "istio-ingressgateway-certs"
3274           optional: true
3275       - name: ingressgateway-ca-certs
3276         secret:
3277           secretName: "istio-ingressgateway-ca-certs"
3278           optional: true
3279       affinity:
3280         nodeAffinity:
3281           requiredDuringSchedulingIgnoredDuringExecution:
3282             nodeSelectorTerms:
3283             - matchExpressions:
3284               - key: beta.kubernetes.io/arch
3285                 operator: In
3286                 values:
3287                 - amd64
3288                 - ppc64le
3289                 - s390x
3290           preferredDuringSchedulingIgnoredDuringExecution:
3291           - weight: 2
3292             preference:
3293               matchExpressions:
3294               - key: beta.kubernetes.io/arch
3295                 operator: In
3296                 values:
3297                 - amd64
3298           - weight: 2
3299             preference:
3300               matchExpressions:
3301               - key: beta.kubernetes.io/arch
3302                 operator: In
3303                 values:
3304                 - ppc64le
3305           - weight: 2
3306             preference:
3307               matchExpressions:
3308               - key: beta.kubernetes.io/arch
3309                 operator: In
3310                 values:
3311                 - s390x
3312 ---
3313
3314 ---
3315 # Source: istio/charts/grafana/templates/deployment.yaml
3316 apiVersion: extensions/v1beta1
3317 kind: Deployment
3318 metadata:
3319   name: grafana
3320   namespace: istio-system
3321   labels:
3322     app: grafana
3323     chart: grafana-0.1.0
3324     release: RELEASE-NAME
3325     heritage: Tiller
3326 spec:
3327   replicas: 1
3328   template:
3329     metadata:
3330       labels:
3331         app: grafana
3332       annotations:
3333         sidecar.istio.io/inject: "false"
3334         scheduler.alpha.kubernetes.io/critical-pod: ""
3335     spec:
3336       containers:
3337         - name: grafana
3338           image: "gcr.io/istio-release/grafana:1.0.0"
3339           imagePullPolicy: IfNotPresent
3340           ports:
3341             - containerPort: 3000
3342           readinessProbe:
3343             httpGet:
3344               path: /login
3345               port: 3000
3346           env:
3347           - name: GRAFANA_PORT
3348             value: "3000"
3349           - name: GF_AUTH_BASIC_ENABLED
3350             value: "false"
3351           - name: GF_AUTH_ANONYMOUS_ENABLED
3352             value: "true"
3353           - name: GF_AUTH_ANONYMOUS_ORG_ROLE
3354             value: Admin
3355           - name: GF_PATHS_DATA
3356             value: /data/grafana
3357           resources:
3358             requests:
3359               cpu: 10m
3360
3361           volumeMounts:
3362           - name: data
3363             mountPath: /data/grafana
3364       affinity:
3365         nodeAffinity:
3366           requiredDuringSchedulingIgnoredDuringExecution:
3367             nodeSelectorTerms:
3368             - matchExpressions:
3369               - key: beta.kubernetes.io/arch
3370                 operator: In
3371                 values:
3372                 - amd64
3373                 - ppc64le
3374                 - s390x
3375           preferredDuringSchedulingIgnoredDuringExecution:
3376           - weight: 2
3377             preference:
3378               matchExpressions:
3379               - key: beta.kubernetes.io/arch
3380                 operator: In
3381                 values:
3382                 - amd64
3383           - weight: 2
3384             preference:
3385               matchExpressions:
3386               - key: beta.kubernetes.io/arch
3387                 operator: In
3388                 values:
3389                 - ppc64le
3390           - weight: 2
3391             preference:
3392               matchExpressions:
3393               - key: beta.kubernetes.io/arch
3394                 operator: In
3395                 values:
3396                 - s390x
3397       volumes:
3398       - name: data
3399         emptyDir: {}
3400
3401 ---
3402 # Source: istio/charts/mixer/templates/deployment.yaml
3403
3404 apiVersion: extensions/v1beta1
3405 kind: Deployment
3406 metadata:
3407   name: istio-policy
3408   namespace: istio-system
3409   labels:
3410     chart: mixer-1.0.0
3411     release: RELEASE-NAME
3412     istio: mixer
3413 spec:
3414   replicas: 1
3415   template:
3416     metadata:
3417       labels:
3418         app: policy
3419         istio: mixer
3420         istio-mixer-type: policy
3421       annotations:
3422         sidecar.istio.io/inject: "false"
3423         scheduler.alpha.kubernetes.io/critical-pod: ""
3424     spec:
3425       serviceAccountName: istio-mixer-service-account
3426       volumes:
3427       - name: istio-certs
3428         secret:
3429           secretName: istio.istio-mixer-service-account
3430           optional: true
3431       - name: uds-socket
3432         emptyDir: {}
3433       affinity:
3434         nodeAffinity:
3435           requiredDuringSchedulingIgnoredDuringExecution:
3436             nodeSelectorTerms:
3437             - matchExpressions:
3438               - key: beta.kubernetes.io/arch
3439                 operator: In
3440                 values:
3441                 - amd64
3442                 - ppc64le
3443                 - s390x
3444           preferredDuringSchedulingIgnoredDuringExecution:
3445           - weight: 2
3446             preference:
3447               matchExpressions:
3448               - key: beta.kubernetes.io/arch
3449                 operator: In
3450                 values:
3451                 - amd64
3452           - weight: 2
3453             preference:
3454               matchExpressions:
3455               - key: beta.kubernetes.io/arch
3456                 operator: In
3457                 values:
3458                 - ppc64le
3459           - weight: 2
3460             preference:
3461               matchExpressions:
3462               - key: beta.kubernetes.io/arch
3463                 operator: In
3464                 values:
3465                 - s390x
3466       containers:
3467       - name: mixer
3468         image: "gcr.io/istio-release/mixer:1.0.0"
3469         imagePullPolicy: IfNotPresent
3470         ports:
3471         - containerPort: 9093
3472         - containerPort: 42422
3473         args:
3474           - --address
3475           - unix:///sock/mixer.socket
3476           - --configStoreURL=k8s://
3477           - --configDefaultNamespace=istio-system
3478           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
3479         resources:
3480           requests:
3481             cpu: 10m
3482
3483         volumeMounts:
3484         - name: uds-socket
3485           mountPath: /sock
3486         livenessProbe:
3487           httpGet:
3488             path: /version
3489             port: 9093
3490           initialDelaySeconds: 5
3491           periodSeconds: 5
3492       - name: istio-proxy
3493         image: "gcr.io/istio-release/proxyv2:1.0.0"
3494         imagePullPolicy: IfNotPresent
3495         ports:
3496         - containerPort: 9091
3497         - containerPort: 15004
3498         args:
3499         - proxy
3500         - --serviceCluster
3501         - istio-policy
3502         - --templateFile
3503         - /etc/istio/proxy/envoy_policy.yaml.tmpl
3504         - --controlPlaneAuthPolicy
3505         - MUTUAL_TLS
3506         env:
3507         - name: POD_NAME
3508           valueFrom:
3509             fieldRef:
3510               apiVersion: v1
3511               fieldPath: metadata.name
3512         - name: POD_NAMESPACE
3513           valueFrom:
3514             fieldRef:
3515               apiVersion: v1
3516               fieldPath: metadata.namespace
3517         - name: INSTANCE_IP
3518           valueFrom:
3519             fieldRef:
3520               apiVersion: v1
3521               fieldPath: status.podIP
3522         resources:
3523           requests:
3524             cpu: 10m
3525
3526         volumeMounts:
3527         - name: istio-certs
3528           mountPath: /etc/certs
3529           readOnly: true
3530         - name: uds-socket
3531           mountPath: /sock
3532
3533 ---
3534 apiVersion: extensions/v1beta1
3535 kind: Deployment
3536 metadata:
3537   name: istio-telemetry
3538   namespace: istio-system
3539   labels:
3540     chart: mixer-1.0.0
3541     release: RELEASE-NAME
3542     istio: mixer
3543 spec:
3544   replicas: 1
3545   template:
3546     metadata:
3547       labels:
3548         app: telemetry
3549         istio: mixer
3550         istio-mixer-type: telemetry
3551       annotations:
3552         sidecar.istio.io/inject: "false"
3553         scheduler.alpha.kubernetes.io/critical-pod: ""
3554     spec:
3555       serviceAccountName: istio-mixer-service-account
3556       volumes:
3557       - name: istio-certs
3558         secret:
3559           secretName: istio.istio-mixer-service-account
3560           optional: true
3561       - name: uds-socket
3562         emptyDir: {}
3563       containers:
3564       - name: mixer
3565         image: "gcr.io/istio-release/mixer:1.0.0"
3566         imagePullPolicy: IfNotPresent
3567         ports:
3568         - containerPort: 9093
3569         - containerPort: 42422
3570         args:
3571           - --address
3572           - unix:///sock/mixer.socket
3573           - --configStoreURL=k8s://
3574           - --configDefaultNamespace=istio-system
3575           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
3576         resources:
3577           requests:
3578             cpu: 10m
3579
3580         volumeMounts:
3581         - name: uds-socket
3582           mountPath: /sock
3583         livenessProbe:
3584           httpGet:
3585             path: /version
3586             port: 9093
3587           initialDelaySeconds: 5
3588           periodSeconds: 5
3589       - name: istio-proxy
3590         image: "gcr.io/istio-release/proxyv2:1.0.0"
3591         imagePullPolicy: IfNotPresent
3592         ports:
3593         - containerPort: 9091
3594         - containerPort: 15004
3595         args:
3596         - proxy
3597         - --serviceCluster
3598         - istio-telemetry
3599         - --templateFile
3600         - /etc/istio/proxy/envoy_telemetry.yaml.tmpl
3601         - --controlPlaneAuthPolicy
3602         - MUTUAL_TLS
3603         env:
3604         - name: POD_NAME
3605           valueFrom:
3606             fieldRef:
3607               apiVersion: v1
3608               fieldPath: metadata.name
3609         - name: POD_NAMESPACE
3610           valueFrom:
3611             fieldRef:
3612               apiVersion: v1
3613               fieldPath: metadata.namespace
3614         - name: INSTANCE_IP
3615           valueFrom:
3616             fieldRef:
3617               apiVersion: v1
3618               fieldPath: status.podIP
3619         resources:
3620           requests:
3621             cpu: 10m
3622
3623         volumeMounts:
3624         - name: istio-certs
3625           mountPath: /etc/certs
3626           readOnly: true
3627         - name: uds-socket
3628           mountPath: /sock
3629
3630 ---
3631
3632 ---
3633 # Source: istio/charts/pilot/templates/deployment.yaml
3634 apiVersion: extensions/v1beta1
3635 kind: Deployment
3636 metadata:
3637   name: istio-pilot
3638   namespace: istio-system
3639   # TODO: default template doesn't have this, which one is right ?
3640   labels:
3641     app: istio-pilot
3642     chart: pilot-1.0.0
3643     release: RELEASE-NAME
3644     heritage: Tiller
3645     istio: pilot
3646   annotations:
3647     checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9
3648 spec:
3649   replicas: 1
3650   template:
3651     metadata:
3652       labels:
3653         istio: pilot
3654         app: pilot
3655       annotations:
3656         sidecar.istio.io/inject: "false"
3657         scheduler.alpha.kubernetes.io/critical-pod: ""
3658     spec:
3659       serviceAccountName: istio-pilot-service-account
3660       containers:
3661         - name: discovery
3662           image: "gcr.io/istio-release/pilot:1.0.0"
3663           imagePullPolicy: IfNotPresent
3664           args:
3665           - "discovery"
3666           ports:
3667           - containerPort: 8080
3668           - containerPort: 15010
3669           readinessProbe:
3670             httpGet:
3671               path: /debug/endpointz
3672               port: 8080
3673             initialDelaySeconds: 30
3674             periodSeconds: 30
3675             timeoutSeconds: 5
3676           env:
3677           - name: POD_NAME
3678             valueFrom:
3679               fieldRef:
3680                 apiVersion: v1
3681                 fieldPath: metadata.name
3682           - name: POD_NAMESPACE
3683             valueFrom:
3684               fieldRef:
3685                 apiVersion: v1
3686                 fieldPath: metadata.namespace
3687           - name: PILOT_THROTTLE
3688             value: "500"
3689           - name: PILOT_CACHE_SQUASH
3690             value: "5"
3691           - name: PILOT_TRACE_SAMPLING
3692             value: "100"
3693           resources:
3694             requests:
3695               cpu: 500m
3696               memory: 2048Mi
3697
3698           volumeMounts:
3699           - name: config-volume
3700             mountPath: /etc/istio/config
3701           - name: istio-certs
3702             mountPath: /etc/certs
3703             readOnly: true
3704         - name: istio-proxy
3705           image: "gcr.io/istio-release/proxyv2:1.0.0"
3706           imagePullPolicy: IfNotPresent
3707           ports:
3708           - containerPort: 15003
3709           - containerPort: 15005
3710           - containerPort: 15007
3711           - containerPort: 15011
3712           args:
3713           - proxy
3714           - --serviceCluster
3715           - istio-pilot
3716           - --templateFile
3717           - /etc/istio/proxy/envoy_pilot.yaml.tmpl
3718           - --controlPlaneAuthPolicy
3719           - MUTUAL_TLS
3720           env:
3721           - name: POD_NAME
3722             valueFrom:
3723               fieldRef:
3724                 apiVersion: v1
3725                 fieldPath: metadata.name
3726           - name: POD_NAMESPACE
3727             valueFrom:
3728               fieldRef:
3729                 apiVersion: v1
3730                 fieldPath: metadata.namespace
3731           - name: INSTANCE_IP
3732             valueFrom:
3733               fieldRef:
3734                 apiVersion: v1
3735                 fieldPath: status.podIP
3736           resources:
3737             requests:
3738               cpu: 10m
3739
3740           volumeMounts:
3741           - name: istio-certs
3742             mountPath: /etc/certs
3743             readOnly: true
3744       volumes:
3745       - name: config-volume
3746         configMap:
3747           name: istio
3748       - name: istio-certs
3749         secret:
3750           secretName: istio.istio-pilot-service-account
3751       affinity:
3752         nodeAffinity:
3753           requiredDuringSchedulingIgnoredDuringExecution:
3754             nodeSelectorTerms:
3755             - matchExpressions:
3756               - key: beta.kubernetes.io/arch
3757                 operator: In
3758                 values:
3759                 - amd64
3760                 - ppc64le
3761                 - s390x
3762           preferredDuringSchedulingIgnoredDuringExecution:
3763           - weight: 2
3764             preference:
3765               matchExpressions:
3766               - key: beta.kubernetes.io/arch
3767                 operator: In
3768                 values:
3769                 - amd64
3770           - weight: 2
3771             preference:
3772               matchExpressions:
3773               - key: beta.kubernetes.io/arch
3774                 operator: In
3775                 values:
3776                 - ppc64le
3777           - weight: 2
3778             preference:
3779               matchExpressions:
3780               - key: beta.kubernetes.io/arch
3781                 operator: In
3782                 values:
3783                 - s390x
3784
3785 ---
3786 # Source: istio/charts/prometheus/templates/deployment.yaml
3787 # TODO: the original template has service account, roles, etc
3788 apiVersion: extensions/v1beta1
3789 kind: Deployment
3790 metadata:
3791   name: prometheus
3792   namespace: istio-system
3793   labels:
3794     app: prometheus
3795     chart: prometheus-0.1.0
3796     release: RELEASE-NAME
3797     heritage: Tiller
3798 spec:
3799   replicas: 1
3800   selector:
3801     matchLabels:
3802       app: prometheus
3803   template:
3804     metadata:
3805       labels:
3806         app: prometheus
3807       annotations:
3808         sidecar.istio.io/inject: "false"
3809         scheduler.alpha.kubernetes.io/critical-pod: ""
3810     spec:
3811       serviceAccountName: prometheus
3812       containers:
3813         - name: prometheus
3814           image: "docker.io/prom/prometheus:v2.3.1"
3815           imagePullPolicy: IfNotPresent
3816           args:
3817             - '--storage.tsdb.retention=6h'
3818             - '--config.file=/etc/prometheus/prometheus.yml'
3819           ports:
3820             - containerPort: 9090
3821               name: http
3822           livenessProbe:
3823             httpGet:
3824               path: /-/healthy
3825               port: 9090
3826           readinessProbe:
3827             httpGet:
3828               path: /-/ready
3829               port: 9090
3830           resources:
3831             requests:
3832               cpu: 10m
3833
3834           volumeMounts:
3835           - name: config-volume
3836             mountPath: /etc/prometheus
3837       volumes:
3838       - name: config-volume
3839         configMap:
3840           name: prometheus
3841       affinity:
3842         nodeAffinity:
3843           requiredDuringSchedulingIgnoredDuringExecution:
3844             nodeSelectorTerms:
3845             - matchExpressions:
3846               - key: beta.kubernetes.io/arch
3847                 operator: In
3848                 values:
3849                 - amd64
3850                 - ppc64le
3851                 - s390x
3852           preferredDuringSchedulingIgnoredDuringExecution:
3853           - weight: 2
3854             preference:
3855               matchExpressions:
3856               - key: beta.kubernetes.io/arch
3857                 operator: In
3858                 values:
3859                 - amd64
3860           - weight: 2
3861             preference:
3862               matchExpressions:
3863               - key: beta.kubernetes.io/arch
3864                 operator: In
3865                 values:
3866                 - ppc64le
3867           - weight: 2
3868             preference:
3869               matchExpressions:
3870               - key: beta.kubernetes.io/arch
3871                 operator: In
3872                 values:
3873                 - s390x
3874
3875 ---
3876 # Source: istio/charts/security/templates/deployment.yaml
3877 # istio CA watching all namespaces
3878 apiVersion: extensions/v1beta1
3879 kind: Deployment
3880 metadata:
3881   name: istio-citadel
3882   namespace: istio-system
3883   labels:
3884     app: security
3885     chart: security-1.0.0
3886     release: RELEASE-NAME
3887     heritage: Tiller
3888     istio: citadel
3889 spec:
3890   replicas: 1
3891   template:
3892     metadata:
3893       labels:
3894         istio: citadel
3895       annotations:
3896         sidecar.istio.io/inject: "false"
3897         scheduler.alpha.kubernetes.io/critical-pod: ""
3898     spec:
3899       serviceAccountName: istio-citadel-service-account
3900       containers:
3901         - name: citadel
3902           image: "gcr.io/istio-release/citadel:1.0.0"
3903           imagePullPolicy: IfNotPresent
3904           args:
3905             - --append-dns-names=true
3906             - --grpc-port=8060
3907             - --grpc-hostname=citadel
3908             - --citadel-storage-namespace=istio-system
3909             - --self-signed-ca=true
3910           resources:
3911             requests:
3912               cpu: 10m
3913
3914       affinity:
3915         nodeAffinity:
3916           requiredDuringSchedulingIgnoredDuringExecution:
3917             nodeSelectorTerms:
3918             - matchExpressions:
3919               - key: beta.kubernetes.io/arch
3920                 operator: In
3921                 values:
3922                 - amd64
3923                 - ppc64le
3924                 - s390x
3925           preferredDuringSchedulingIgnoredDuringExecution:
3926           - weight: 2
3927             preference:
3928               matchExpressions:
3929               - key: beta.kubernetes.io/arch
3930                 operator: In
3931                 values:
3932                 - amd64
3933           - weight: 2
3934             preference:
3935               matchExpressions:
3936               - key: beta.kubernetes.io/arch
3937                 operator: In
3938                 values:
3939                 - ppc64le
3940           - weight: 2
3941             preference:
3942               matchExpressions:
3943               - key: beta.kubernetes.io/arch
3944                 operator: In
3945                 values:
3946                 - s390x
3947
3948 ---
3949 # Source: istio/charts/servicegraph/templates/deployment.yaml
3950 apiVersion: extensions/v1beta1
3951 kind: Deployment
3952 metadata:
3953   name: servicegraph
3954   namespace: istio-system
3955   labels:
3956     app: servicegraph
3957     chart: servicegraph-0.1.0
3958     release: RELEASE-NAME
3959     heritage: Tiller
3960 spec:
3961   replicas: 1
3962   template:
3963     metadata:
3964       labels:
3965         app: servicegraph
3966       annotations:
3967         sidecar.istio.io/inject: "false"
3968         scheduler.alpha.kubernetes.io/critical-pod: ""
3969     spec:
3970       containers:
3971         - name: servicegraph
3972           image: "gcr.io/istio-release/servicegraph:1.0.0"
3973           imagePullPolicy: IfNotPresent
3974           ports:
3975             - containerPort: 8088
3976           args:
3977           - --prometheusAddr=http://prometheus:9090
3978           livenessProbe:
3979             httpGet:
3980               path: /graph
3981               port: 8088
3982           readinessProbe:
3983             httpGet:
3984               path: /graph
3985               port: 8088
3986           resources:
3987             requests:
3988               cpu: 10m
3989
3990       affinity:
3991         nodeAffinity:
3992           requiredDuringSchedulingIgnoredDuringExecution:
3993             nodeSelectorTerms:
3994             - matchExpressions:
3995               - key: beta.kubernetes.io/arch
3996                 operator: In
3997                 values:
3998                 - amd64
3999                 - ppc64le
4000                 - s390x
4001           preferredDuringSchedulingIgnoredDuringExecution:
4002           - weight: 2
4003             preference:
4004               matchExpressions:
4005               - key: beta.kubernetes.io/arch
4006                 operator: In
4007                 values:
4008                 - amd64
4009           - weight: 2
4010             preference:
4011               matchExpressions:
4012               - key: beta.kubernetes.io/arch
4013                 operator: In
4014                 values:
4015                 - ppc64le
4016           - weight: 2
4017             preference:
4018               matchExpressions:
4019               - key: beta.kubernetes.io/arch
4020                 operator: In
4021                 values:
4022                 - s390x
4023
4024 ---
4025 # Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml
4026 apiVersion: extensions/v1beta1
4027 kind: Deployment
4028 metadata:
4029   name: istio-sidecar-injector
4030   namespace: istio-system
4031   labels:
4032     app: sidecarInjectorWebhook
4033     chart: sidecarInjectorWebhook-1.0.0
4034     release: RELEASE-NAME
4035     heritage: Tiller
4036     istio: sidecar-injector
4037 spec:
4038   replicas: 1
4039   template:
4040     metadata:
4041       labels:
4042         istio: sidecar-injector
4043       annotations:
4044         sidecar.istio.io/inject: "false"
4045         scheduler.alpha.kubernetes.io/critical-pod: ""
4046     spec:
4047       serviceAccountName: istio-sidecar-injector-service-account
4048       containers:
4049         - name: sidecar-injector-webhook
4050           image: "gcr.io/istio-release/sidecar_injector:1.0.0"
4051           imagePullPolicy: IfNotPresent
4052           args:
4053             - --caCertFile=/etc/istio/certs/root-cert.pem
4054             - --tlsCertFile=/etc/istio/certs/cert-chain.pem
4055             - --tlsKeyFile=/etc/istio/certs/key.pem
4056             - --injectConfig=/etc/istio/inject/config
4057             - --meshConfig=/etc/istio/config/mesh
4058             - --healthCheckInterval=2s
4059             - --healthCheckFile=/health
4060           volumeMounts:
4061           - name: config-volume
4062             mountPath: /etc/istio/config
4063             readOnly: true
4064           - name: certs
4065             mountPath: /etc/istio/certs
4066             readOnly: true
4067           - name: inject-config
4068             mountPath: /etc/istio/inject
4069             readOnly: true
4070           livenessProbe:
4071             exec:
4072               command:
4073                 - /usr/local/bin/sidecar-injector
4074                 - probe
4075                 - --probe-path=/health
4076                 - --interval=4s
4077             initialDelaySeconds: 4
4078             periodSeconds: 4
4079           readinessProbe:
4080             exec:
4081               command:
4082                 - /usr/local/bin/sidecar-injector
4083                 - probe
4084                 - --probe-path=/health
4085                 - --interval=4s
4086             initialDelaySeconds: 4
4087             periodSeconds: 4
4088           resources:
4089             requests:
4090               cpu: 10m
4091
4092       volumes:
4093       - name: config-volume
4094         configMap:
4095           name: istio
4096       - name: certs
4097         secret:
4098           secretName: istio.istio-sidecar-injector-service-account
4099       - name: inject-config
4100         configMap:
4101           name: istio-sidecar-injector
4102           items:
4103           - key: config
4104             path: config
4105       affinity:
4106         nodeAffinity:
4107           requiredDuringSchedulingIgnoredDuringExecution:
4108             nodeSelectorTerms:
4109             - matchExpressions:
4110               - key: beta.kubernetes.io/arch
4111                 operator: In
4112                 values:
4113                 - amd64
4114                 - ppc64le
4115                 - s390x
4116           preferredDuringSchedulingIgnoredDuringExecution:
4117           - weight: 2
4118             preference:
4119               matchExpressions:
4120               - key: beta.kubernetes.io/arch
4121                 operator: In
4122                 values:
4123                 - amd64
4124           - weight: 2
4125             preference:
4126               matchExpressions:
4127               - key: beta.kubernetes.io/arch
4128                 operator: In
4129                 values:
4130                 - ppc64le
4131           - weight: 2
4132             preference:
4133               matchExpressions:
4134               - key: beta.kubernetes.io/arch
4135                 operator: In
4136                 values:
4137                 - s390x
4138
4139 ---
4140 # Source: istio/charts/tracing/templates/deployment.yaml
4141 apiVersion: extensions/v1beta1
4142 kind: Deployment
4143 metadata:
4144   name: istio-tracing
4145   namespace: istio-system
4146   labels:
4147     app: istio-tracing
4148     chart: tracing-0.1.0
4149     release: RELEASE-NAME
4150     heritage: Tiller
4151 spec:
4152   replicas: 1
4153   template:
4154     metadata:
4155       labels:
4156         app: jaeger
4157       annotations:
4158         sidecar.istio.io/inject: "false"
4159         scheduler.alpha.kubernetes.io/critical-pod: ""
4160     spec:
4161       containers:
4162         - name: jaeger
4163           image: "docker.io/jaegertracing/all-in-one:1.5"
4164           imagePullPolicy: IfNotPresent
4165           ports:
4166             - containerPort: 9411
4167             - containerPort: 16686
4168             - containerPort: 5775
4169               protocol: UDP
4170             - containerPort: 6831
4171               protocol: UDP
4172             - containerPort: 6832
4173               protocol: UDP
4174           env:
4175           - name: POD_NAMESPACE
4176             valueFrom:
4177               fieldRef:
4178                 apiVersion: v1
4179                 fieldPath: metadata.namespace
4180           - name: COLLECTOR_ZIPKIN_HTTP_PORT
4181             value: "9411"
4182           - name: MEMORY_MAX_TRACES
4183             value: "50000"
4184           livenessProbe:
4185             httpGet:
4186               path: /
4187               port: 16686
4188           readinessProbe:
4189             httpGet:
4190               path: /
4191               port: 16686
4192           resources:
4193             requests:
4194               cpu: 10m
4195
4196       affinity:
4197         nodeAffinity:
4198           requiredDuringSchedulingIgnoredDuringExecution:
4199             nodeSelectorTerms:
4200             - matchExpressions:
4201               - key: beta.kubernetes.io/arch
4202                 operator: In
4203                 values:
4204                 - amd64
4205                 - ppc64le
4206                 - s390x
4207           preferredDuringSchedulingIgnoredDuringExecution:
4208           - weight: 2
4209             preference:
4210               matchExpressions:
4211               - key: beta.kubernetes.io/arch
4212                 operator: In
4213                 values:
4214                 - amd64
4215           - weight: 2
4216             preference:
4217               matchExpressions:
4218               - key: beta.kubernetes.io/arch
4219                 operator: In
4220                 values:
4221                 - ppc64le
4222           - weight: 2
4223             preference:
4224               matchExpressions:
4225               - key: beta.kubernetes.io/arch
4226                 operator: In
4227                 values:
4228                 - s390x
4229
4230 ---
4231 # Source: istio/charts/pilot/templates/gateway.yaml
4232 apiVersion: networking.istio.io/v1alpha3
4233 kind: Gateway
4234 metadata:
4235   name: istio-autogenerated-k8s-ingress
4236   namespace: istio-system
4237 spec:
4238   selector:
4239     istio: ingress
4240   servers:
4241   - port:
4242       number: 80
4243       protocol: HTTP2
4244       name: http
4245     hosts:
4246     - "*"
4247
4248 ---
4249
4250 ---
4251 # Source: istio/charts/gateways/templates/autoscale.yaml
4252
4253 apiVersion: autoscaling/v2beta1
4254 kind: HorizontalPodAutoscaler
4255 metadata:
4256     name: istio-egressgateway
4257     namespace: istio-system
4258 spec:
4259     maxReplicas: 5
4260     minReplicas: 1
4261     scaleTargetRef:
4262       apiVersion: apps/v1beta1
4263       kind: Deployment
4264       name: istio-egressgateway
4265     metrics:
4266       - type: Resource
4267         resource:
4268           name: cpu
4269           targetAverageUtilization: 60
4270 ---
4271 apiVersion: autoscaling/v2beta1
4272 kind: HorizontalPodAutoscaler
4273 metadata:
4274     name: istio-ingressgateway
4275     namespace: istio-system
4276 spec:
4277     maxReplicas: 5
4278     minReplicas: 1
4279     scaleTargetRef:
4280       apiVersion: apps/v1beta1
4281       kind: Deployment
4282       name: istio-ingressgateway
4283     metrics:
4284       - type: Resource
4285         resource:
4286           name: cpu
4287           targetAverageUtilization: 60
4288 ---
4289
4290 ---
4291 # Source: istio/charts/mixer/templates/autoscale.yaml
4292
4293 apiVersion: autoscaling/v2beta1
4294 kind: HorizontalPodAutoscaler
4295 metadata:
4296     name: istio-policy
4297     namespace: istio-system
4298 spec:
4299     maxReplicas: 5
4300     minReplicas: 1
4301     scaleTargetRef:
4302       apiVersion: apps/v1beta1
4303       kind: Deployment
4304       name: istio-policy
4305     metrics:
4306     - type: Resource
4307       resource:
4308         name: cpu
4309         targetAverageUtilization: 80
4310 ---
4311 apiVersion: autoscaling/v2beta1
4312 kind: HorizontalPodAutoscaler
4313 metadata:
4314     name: istio-telemetry
4315     namespace: istio-system
4316 spec:
4317     maxReplicas: 5
4318     minReplicas: 1
4319     scaleTargetRef:
4320       apiVersion: apps/v1beta1
4321       kind: Deployment
4322       name: istio-telemetry
4323     metrics:
4324     - type: Resource
4325       resource:
4326         name: cpu
4327         targetAverageUtilization: 80
4328 ---
4329
4330 ---
4331 # Source: istio/charts/pilot/templates/autoscale.yaml
4332
4333 apiVersion: autoscaling/v2beta1
4334 kind: HorizontalPodAutoscaler
4335 metadata:
4336     name: istio-pilot
4337 spec:
4338     maxReplicas: 1
4339     minReplicas: 1
4340     scaleTargetRef:
4341       apiVersion: apps/v1beta1
4342       kind: Deployment
4343       name: istio-pilot
4344     metrics:
4345       - type: Resource
4346         resource:
4347           name: cpu
4348           targetAverageUtilization: 55
4349 ---
4350
4351 ---
4352 # Source: istio/charts/tracing/templates/service-jaeger.yaml
4353
4354
4355 apiVersion: v1
4356 kind: List
4357 items:
4358 - apiVersion: v1
4359   kind: Service
4360   metadata:
4361     name: jaeger-query
4362     namespace: istio-system
4363     annotations:
4364     labels:
4365       app: jaeger
4366       jaeger-infra: jaeger-service
4367       chart: tracing-0.1.0
4368       release: RELEASE-NAME
4369       heritage: Tiller
4370   spec:
4371     type: NodePort
4372     ports:
4373       - name: query-http
4374         port: 16686
4375         protocol: TCP
4376         targetPort: 16686
4377         nodePort: 30686
4378     selector:
4379       app: jaeger
4380 - apiVersion: v1
4381   kind: Service
4382   metadata:
4383     name: jaeger-collector
4384     namespace: istio-system
4385     labels:
4386       app: jaeger
4387       jaeger-infra: collector-service
4388       chart: tracing-0.1.0
4389       release: RELEASE-NAME
4390       heritage: Tiller
4391   spec:
4392     ports:
4393     - name: jaeger-collector-tchannel
4394       port: 14267
4395       protocol: TCP
4396       targetPort: 14267
4397     - name: jaeger-collector-http
4398       port: 14268
4399       targetPort: 14268
4400       protocol: TCP
4401     selector:
4402       app: jaeger
4403     type: ClusterIP
4404 - apiVersion: v1
4405   kind: Service
4406   metadata:
4407     name: jaeger-agent
4408     namespace: istio-system
4409     labels:
4410       app: jaeger
4411       jaeger-infra: agent-service
4412       chart: tracing-0.1.0
4413       release: RELEASE-NAME
4414       heritage: Tiller
4415   spec:
4416     ports:
4417     - name: agent-zipkin-thrift
4418       port: 5775
4419       protocol: UDP
4420       targetPort: 5775
4421     - name: agent-compact
4422       port: 6831
4423       protocol: UDP
4424       targetPort: 6831
4425     - name: agent-binary
4426       port: 6832
4427       protocol: UDP
4428       targetPort: 6832
4429     clusterIP: None
4430     selector:
4431       app: jaeger
4432
4433
4434
4435 ---
4436 # Source: istio/charts/tracing/templates/service.yaml
4437 apiVersion: v1
4438 kind: List
4439 items:
4440 - apiVersion: v1
4441   kind: Service
4442   metadata:
4443     name: zipkin
4444     namespace: istio-system
4445     labels:
4446       app: jaeger
4447       chart: tracing-0.1.0
4448       release: RELEASE-NAME
4449       heritage: Tiller
4450   spec:
4451     type: ClusterIP
4452     ports:
4453       - port: 9411
4454         targetPort: 9411
4455         protocol: TCP
4456         name: http
4457     selector:
4458       app: jaeger
4459 - apiVersion: v1
4460   kind: Service
4461   metadata:
4462     name: tracing
4463     namespace: istio-system
4464     annotations:
4465     labels:
4466       app: jaeger
4467       chart: tracing-0.1.0
4468       release: RELEASE-NAME
4469       heritage: Tiller
4470   spec:
4471     ports:
4472       - name: http-query
4473         port: 80
4474         protocol: TCP
4475         targetPort: 16686
4476     selector:
4477       app: jaeger
4478
4479 ---
4480 # Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml
4481 apiVersion: admissionregistration.k8s.io/v1beta1
4482 kind: MutatingWebhookConfiguration
4483 metadata:
4484   name: istio-sidecar-injector
4485   namespace: istio-system
4486   labels:
4487     app: istio-sidecar-injector
4488     chart: sidecarInjectorWebhook-1.0.0
4489     release: RELEASE-NAME
4490     heritage: Tiller
4491 webhooks:
4492   - name: sidecar-injector.istio.io
4493     clientConfig:
4494       service:
4495         name: istio-sidecar-injector
4496         namespace: istio-system
4497         path: "/inject"
4498       caBundle: ""
4499     rules:
4500       - operations: [ "CREATE" ]
4501         apiGroups: [""]
4502         apiVersions: ["v1"]
4503         resources: ["pods"]
4504     failurePolicy: Fail
4505     namespaceSelector:
4506       matchLabels:
4507         istio-injection: enabled
4508
4509
4510 ---
4511 # Source: istio/charts/galley/templates/validatingwehookconfiguration.yaml.tpl
4512
4513
4514 ---
4515 # Source: istio/charts/grafana/templates/grafana-ports-mtls.yaml
4516
4517
4518 ---
4519 # Source: istio/charts/grafana/templates/secret.yaml
4520
4521 ---
4522 # Source: istio/charts/pilot/templates/meshexpansion.yaml
4523
4524
4525 ---
4526 # Source: istio/charts/security/templates/enable-mesh-mtls.yaml
4527
4528
4529 ---
4530 # Source: istio/charts/security/templates/meshexpansion.yaml
4531
4532
4533 ---
4534
4535 ---
4536 # Source: istio/charts/servicegraph/templates/ingress.yaml
4537
4538 ---
4539 # Source: istio/charts/telemetry-gateway/templates/gateway.yaml
4540
4541
4542 ---
4543 # Source: istio/charts/tracing/templates/ingress-jaeger.yaml
4544
4545 ---
4546 # Source: istio/charts/tracing/templates/ingress.yaml
4547
4548 ---
4549 # Source: istio/templates/install-custom-resources.sh.tpl
4550
4551
4552 ---
4553 # Source: istio/charts/mixer/templates/config.yaml
4554 apiVersion: "config.istio.io/v1alpha2"
4555 kind: attributemanifest
4556 metadata:
4557   name: istioproxy
4558   namespace: istio-system
4559 spec:
4560   attributes:
4561     origin.ip:
4562       valueType: IP_ADDRESS
4563     origin.uid:
4564       valueType: STRING
4565     origin.user:
4566       valueType: STRING
4567     request.headers:
4568       valueType: STRING_MAP
4569     request.id:
4570       valueType: STRING
4571     request.host:
4572       valueType: STRING
4573     request.method:
4574       valueType: STRING
4575     request.path:
4576       valueType: STRING
4577     request.reason:
4578       valueType: STRING
4579     request.referer:
4580       valueType: STRING
4581     request.scheme:
4582       valueType: STRING
4583     request.total_size:
4584           valueType: INT64
4585     request.size:
4586       valueType: INT64
4587     request.time:
4588       valueType: TIMESTAMP
4589     request.useragent:
4590       valueType: STRING
4591     response.code:
4592       valueType: INT64
4593     response.duration:
4594       valueType: DURATION
4595     response.headers:
4596       valueType: STRING_MAP
4597     response.total_size:
4598           valueType: INT64
4599     response.size:
4600       valueType: INT64
4601     response.time:
4602       valueType: TIMESTAMP
4603     source.uid:
4604       valueType: STRING
4605     source.user: # DEPRECATED
4606       valueType: STRING
4607     source.principal:
4608       valueType: STRING
4609     destination.uid:
4610       valueType: STRING
4611     destination.principal:
4612       valueType: STRING
4613     destination.port:
4614       valueType: INT64
4615     connection.event:
4616       valueType: STRING
4617     connection.id:
4618       valueType: STRING
4619     connection.received.bytes:
4620       valueType: INT64
4621     connection.received.bytes_total:
4622       valueType: INT64
4623     connection.sent.bytes:
4624       valueType: INT64
4625     connection.sent.bytes_total:
4626       valueType: INT64
4627     connection.duration:
4628       valueType: DURATION
4629     connection.mtls:
4630       valueType: BOOL
4631     context.protocol:
4632       valueType: STRING
4633     context.timestamp:
4634       valueType: TIMESTAMP
4635     context.time:
4636       valueType: TIMESTAMP
4637     # Deprecated, kept for compatibility
4638     context.reporter.local:
4639       valueType: BOOL
4640     context.reporter.kind:
4641       valueType: STRING
4642     context.reporter.uid:
4643       valueType: STRING
4644     api.service:
4645       valueType: STRING
4646     api.version:
4647       valueType: STRING
4648     api.operation:
4649       valueType: STRING
4650     api.protocol:
4651       valueType: STRING
4652     request.auth.principal:
4653       valueType: STRING
4654     request.auth.audiences:
4655       valueType: STRING
4656     request.auth.presenter:
4657       valueType: STRING
4658     request.auth.claims:
4659       valueType: STRING_MAP
4660     request.auth.raw_claims:
4661       valueType: STRING
4662     request.api_key:
4663       valueType: STRING
4664
4665 ---
4666 apiVersion: "config.istio.io/v1alpha2"
4667 kind: attributemanifest
4668 metadata:
4669   name: kubernetes
4670   namespace: istio-system
4671 spec:
4672   attributes:
4673     source.ip:
4674       valueType: IP_ADDRESS
4675     source.labels:
4676       valueType: STRING_MAP
4677     source.metadata:
4678       valueType: STRING_MAP
4679     source.name:
4680       valueType: STRING
4681     source.namespace:
4682       valueType: STRING
4683     source.owner:
4684       valueType: STRING
4685     source.service:  # DEPRECATED
4686       valueType: STRING
4687     source.serviceAccount:
4688       valueType: STRING
4689     source.services:
4690       valueType: STRING
4691     source.workload.uid:
4692       valueType: STRING
4693     source.workload.name:
4694       valueType: STRING
4695     source.workload.namespace:
4696       valueType: STRING
4697     destination.ip:
4698       valueType: IP_ADDRESS
4699     destination.labels:
4700       valueType: STRING_MAP
4701     destination.metadata:
4702       valueType: STRING_MAP
4703     destination.owner:
4704       valueType: STRING
4705     destination.name:
4706       valueType: STRING
4707     destination.container.name:
4708       valueType: STRING
4709     destination.namespace:
4710       valueType: STRING
4711     destination.service: # DEPRECATED
4712       valueType: STRING
4713     destination.service.uid:
4714       valueType: STRING
4715     destination.service.name:
4716       valueType: STRING
4717     destination.service.namespace:
4718       valueType: STRING
4719     destination.service.host:
4720       valueType: STRING
4721     destination.serviceAccount:
4722       valueType: STRING
4723     destination.workload.uid:
4724       valueType: STRING
4725     destination.workload.name:
4726       valueType: STRING
4727     destination.workload.namespace:
4728       valueType: STRING
4729 ---
4730 apiVersion: "config.istio.io/v1alpha2"
4731 kind: stdio
4732 metadata:
4733   name: handler
4734   namespace: istio-system
4735 spec:
4736   outputAsJson: true
4737 ---
4738 apiVersion: "config.istio.io/v1alpha2"
4739 kind: logentry
4740 metadata:
4741   name: accesslog
4742   namespace: istio-system
4743 spec:
4744   severity: '"Info"'
4745   timestamp: request.time
4746   variables:
4747     sourceIp: source.ip | ip("0.0.0.0")
4748     sourceApp: source.labels["app"] | ""
4749     sourcePrincipal: source.principal | ""
4750     sourceName: source.name | ""
4751     sourceWorkload: source.workload.name | ""
4752     sourceNamespace: source.namespace | ""
4753     sourceOwner: source.owner | ""
4754     destinationApp: destination.labels["app"] | ""
4755     destinationIp: destination.ip | ip("0.0.0.0")
4756     destinationServiceHost: destination.service.host | ""
4757     destinationWorkload: destination.workload.name | ""
4758     destinationName: destination.name | ""
4759     destinationNamespace: destination.namespace | ""
4760     destinationOwner: destination.owner | ""
4761     destinationPrincipal: destination.principal | ""
4762     apiClaims: request.auth.raw_claims | ""
4763     apiKey: request.api_key | request.headers["x-api-key"] | ""
4764     protocol: request.scheme | context.protocol | "http"
4765     method: request.method | ""
4766     url: request.path | ""
4767     responseCode: response.code | 0
4768     responseSize: response.size | 0
4769     requestSize: request.size | 0
4770     requestId: request.headers["x-request-id"] | ""
4771     clientTraceId: request.headers["x-client-trace-id"] | ""
4772     latency: response.duration | "0ms"
4773     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4774     userAgent: request.useragent | ""
4775     responseTimestamp: response.time
4776     receivedBytes: request.total_size | 0
4777     sentBytes: response.total_size | 0
4778     referer: request.referer | ""
4779     httpAuthority: request.headers[":authority"] | request.host | ""
4780     xForwardedFor: request.headers["x-forwarded-for"] | "0.0.0.0"
4781     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4782   monitored_resource_type: '"global"'
4783 ---
4784 apiVersion: "config.istio.io/v1alpha2"
4785 kind: logentry
4786 metadata:
4787   name: tcpaccesslog
4788   namespace: istio-system
4789 spec:
4790   severity: '"Info"'
4791   timestamp: context.time | timestamp("2017-01-01T00:00:00Z")
4792   variables:
4793     connectionEvent: connection.event | ""
4794     sourceIp: source.ip | ip("0.0.0.0")
4795     sourceApp: source.labels["app"] | ""
4796     sourcePrincipal: source.principal | ""
4797     sourceName: source.name | ""
4798     sourceWorkload: source.workload.name | ""
4799     sourceNamespace: source.namespace | ""
4800     sourceOwner: source.owner | ""
4801     destinationApp: destination.labels["app"] | ""
4802     destinationIp: destination.ip | ip("0.0.0.0")
4803     destinationServiceHost: destination.service.host | ""
4804     destinationWorkload: destination.workload.name | ""
4805     destinationName: destination.name | ""
4806     destinationNamespace: destination.namespace | ""
4807     destinationOwner: destination.owner | ""
4808     destinationPrincipal: destination.principal | ""
4809     protocol: context.protocol | "tcp"
4810     connectionDuration: connection.duration | "0ms"
4811     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4812     receivedBytes: connection.received.bytes | 0
4813     sentBytes: connection.sent.bytes | 0
4814     totalReceivedBytes: connection.received.bytes_total | 0
4815     totalSentBytes: connection.sent.bytes_total | 0
4816     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4817   monitored_resource_type: '"global"'
4818 ---
4819 apiVersion: "config.istio.io/v1alpha2"
4820 kind: rule
4821 metadata:
4822   name: stdio
4823   namespace: istio-system
4824 spec:
4825   match: context.protocol == "http" || context.protocol == "grpc"
4826   actions:
4827   - handler: handler.stdio
4828     instances:
4829     - accesslog.logentry
4830 ---
4831 apiVersion: "config.istio.io/v1alpha2"
4832 kind: rule
4833 metadata:
4834   name: stdiotcp
4835   namespace: istio-system
4836 spec:
4837   match: context.protocol == "tcp"
4838   actions:
4839   - handler: handler.stdio
4840     instances:
4841     - tcpaccesslog.logentry
4842 ---
4843 apiVersion: "config.istio.io/v1alpha2"
4844 kind: metric
4845 metadata:
4846   name: requestcount
4847   namespace: istio-system
4848 spec:
4849   value: "1"
4850   dimensions:
4851     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4852     source_workload: source.workload.name | "unknown"
4853     source_workload_namespace: source.workload.namespace | "unknown"
4854     source_principal: source.principal | "unknown"
4855     source_app: source.labels["app"] | "unknown"
4856     source_version: source.labels["version"] | "unknown"
4857     destination_workload: destination.workload.name | "unknown"
4858     destination_workload_namespace: destination.workload.namespace | "unknown"
4859     destination_principal: destination.principal | "unknown"
4860     destination_app: destination.labels["app"] | "unknown"
4861     destination_version: destination.labels["version"] | "unknown"
4862     destination_service: destination.service.host | "unknown"
4863     destination_service_name: destination.service.name | "unknown"
4864     destination_service_namespace: destination.service.namespace | "unknown"
4865     request_protocol: api.protocol | context.protocol | "unknown"
4866     response_code: response.code | 200
4867     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4868   monitored_resource_type: '"UNSPECIFIED"'
4869 ---
4870 apiVersion: "config.istio.io/v1alpha2"
4871 kind: metric
4872 metadata:
4873   name: requestduration
4874   namespace: istio-system
4875 spec:
4876   value: response.duration | "0ms"
4877   dimensions:
4878     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4879     source_workload: source.workload.name | "unknown"
4880     source_workload_namespace: source.workload.namespace | "unknown"
4881     source_principal: source.principal | "unknown"
4882     source_app: source.labels["app"] | "unknown"
4883     source_version: source.labels["version"] | "unknown"
4884     destination_workload: destination.workload.name | "unknown"
4885     destination_workload_namespace: destination.workload.namespace | "unknown"
4886     destination_principal: destination.principal | "unknown"
4887     destination_app: destination.labels["app"] | "unknown"
4888     destination_version: destination.labels["version"] | "unknown"
4889     destination_service: destination.service.host | "unknown"
4890     destination_service_name: destination.service.name | "unknown"
4891     destination_service_namespace: destination.service.namespace | "unknown"
4892     request_protocol: api.protocol | context.protocol | "unknown"
4893     response_code: response.code | 200
4894     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4895   monitored_resource_type: '"UNSPECIFIED"'
4896 ---
4897 apiVersion: "config.istio.io/v1alpha2"
4898 kind: metric
4899 metadata:
4900   name: requestsize
4901   namespace: istio-system
4902 spec:
4903   value: request.size | 0
4904   dimensions:
4905     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4906     source_workload: source.workload.name | "unknown"
4907     source_workload_namespace: source.workload.namespace | "unknown"
4908     source_principal: source.principal | "unknown"
4909     source_app: source.labels["app"] | "unknown"
4910     source_version: source.labels["version"] | "unknown"
4911     destination_workload: destination.workload.name | "unknown"
4912     destination_workload_namespace: destination.workload.namespace | "unknown"
4913     destination_principal: destination.principal | "unknown"
4914     destination_app: destination.labels["app"] | "unknown"
4915     destination_version: destination.labels["version"] | "unknown"
4916     destination_service: destination.service.host | "unknown"
4917     destination_service_name: destination.service.name | "unknown"
4918     destination_service_namespace: destination.service.namespace | "unknown"
4919     request_protocol: api.protocol | context.protocol | "unknown"
4920     response_code: response.code | 200
4921     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4922   monitored_resource_type: '"UNSPECIFIED"'
4923 ---
4924 apiVersion: "config.istio.io/v1alpha2"
4925 kind: metric
4926 metadata:
4927   name: responsesize
4928   namespace: istio-system
4929 spec:
4930   value: response.size | 0
4931   dimensions:
4932     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4933     source_workload: source.workload.name | "unknown"
4934     source_workload_namespace: source.workload.namespace | "unknown"
4935     source_principal: source.principal | "unknown"
4936     source_app: source.labels["app"] | "unknown"
4937     source_version: source.labels["version"] | "unknown"
4938     destination_workload: destination.workload.name | "unknown"
4939     destination_workload_namespace: destination.workload.namespace | "unknown"
4940     destination_principal: destination.principal | "unknown"
4941     destination_app: destination.labels["app"] | "unknown"
4942     destination_version: destination.labels["version"] | "unknown"
4943     destination_service: destination.service.host | "unknown"
4944     destination_service_name: destination.service.name | "unknown"
4945     destination_service_namespace: destination.service.namespace | "unknown"
4946     request_protocol: api.protocol | context.protocol | "unknown"
4947     response_code: response.code | 200
4948     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4949   monitored_resource_type: '"UNSPECIFIED"'
4950 ---
4951 apiVersion: "config.istio.io/v1alpha2"
4952 kind: metric
4953 metadata:
4954   name: tcpbytesent
4955   namespace: istio-system
4956 spec:
4957   value: connection.sent.bytes | 0
4958   dimensions:
4959     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4960     source_workload: source.workload.name | "unknown"
4961     source_workload_namespace: source.workload.namespace | "unknown"
4962     source_principal: source.principal | "unknown"
4963     source_app: source.labels["app"] | "unknown"
4964     source_version: source.labels["version"] | "unknown"
4965     destination_workload: destination.workload.name | "unknown"
4966     destination_workload_namespace: destination.workload.namespace | "unknown"
4967     destination_principal: destination.principal | "unknown"
4968     destination_app: destination.labels["app"] | "unknown"
4969     destination_version: destination.labels["version"] | "unknown"
4970     destination_service: destination.service.name | "unknown"
4971     destination_service_name: destination.service.name | "unknown"
4972     destination_service_namespace: destination.service.namespace | "unknown"
4973     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4974   monitored_resource_type: '"UNSPECIFIED"'
4975 ---
4976 apiVersion: "config.istio.io/v1alpha2"
4977 kind: metric
4978 metadata:
4979   name: tcpbytereceived
4980   namespace: istio-system
4981 spec:
4982   value: connection.received.bytes | 0
4983   dimensions:
4984     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4985     source_workload: source.workload.name | "unknown"
4986     source_workload_namespace: source.workload.namespace | "unknown"
4987     source_principal: source.principal | "unknown"
4988     source_app: source.labels["app"] | "unknown"
4989     source_version: source.labels["version"] | "unknown"
4990     destination_workload: destination.workload.name | "unknown"
4991     destination_workload_namespace: destination.workload.namespace | "unknown"
4992     destination_principal: destination.principal | "unknown"
4993     destination_app: destination.labels["app"] | "unknown"
4994     destination_version: destination.labels["version"] | "unknown"
4995     destination_service: destination.service.name | "unknown"
4996     destination_service_name: destination.service.name | "unknown"
4997     destination_service_namespace: destination.service.namespace | "unknown"
4998     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4999   monitored_resource_type: '"UNSPECIFIED"'
5000 ---
5001 apiVersion: "config.istio.io/v1alpha2"
5002 kind: prometheus
5003 metadata:
5004   name: handler
5005   namespace: istio-system
5006 spec:
5007   metrics:
5008   - name: requests_total
5009     instance_name: requestcount.metric.istio-system
5010     kind: COUNTER
5011     label_names:
5012     - reporter
5013     - source_app
5014     - source_principal
5015     - source_workload
5016     - source_workload_namespace
5017     - source_version
5018     - destination_app
5019     - destination_principal
5020     - destination_workload
5021     - destination_workload_namespace
5022     - destination_version
5023     - destination_service
5024     - destination_service_name
5025     - destination_service_namespace
5026     - request_protocol
5027     - response_code
5028     - connection_security_policy
5029   - name: request_duration_seconds
5030     instance_name: requestduration.metric.istio-system
5031     kind: DISTRIBUTION
5032     label_names:
5033     - reporter
5034     - source_app
5035     - source_principal
5036     - source_workload
5037     - source_workload_namespace
5038     - source_version
5039     - destination_app
5040     - destination_principal
5041     - destination_workload
5042     - destination_workload_namespace
5043     - destination_version
5044     - destination_service
5045     - destination_service_name
5046     - destination_service_namespace
5047     - request_protocol
5048     - response_code
5049     - connection_security_policy
5050     buckets:
5051       explicit_buckets:
5052         bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
5053   - name: request_bytes
5054     instance_name: requestsize.metric.istio-system
5055     kind: DISTRIBUTION
5056     label_names:
5057     - reporter
5058     - source_app
5059     - source_principal
5060     - source_workload
5061     - source_workload_namespace
5062     - source_version
5063     - destination_app
5064     - destination_principal
5065     - destination_workload
5066     - destination_workload_namespace
5067     - destination_version
5068     - destination_service
5069     - destination_service_name
5070     - destination_service_namespace
5071     - request_protocol
5072     - response_code
5073     - connection_security_policy
5074     buckets:
5075       exponentialBuckets:
5076         numFiniteBuckets: 8
5077         scale: 1
5078         growthFactor: 10
5079   - name: response_bytes
5080     instance_name: responsesize.metric.istio-system
5081     kind: DISTRIBUTION
5082     label_names:
5083     - reporter
5084     - source_app
5085     - source_principal
5086     - source_workload
5087     - source_workload_namespace
5088     - source_version
5089     - destination_app
5090     - destination_principal
5091     - destination_workload
5092     - destination_workload_namespace
5093     - destination_version
5094     - destination_service
5095     - destination_service_name
5096     - destination_service_namespace
5097     - request_protocol
5098     - response_code
5099     - connection_security_policy
5100     buckets:
5101       exponentialBuckets:
5102         numFiniteBuckets: 8
5103         scale: 1
5104         growthFactor: 10
5105   - name: tcp_sent_bytes_total
5106     instance_name: tcpbytesent.metric.istio-system
5107     kind: COUNTER
5108     label_names:
5109     - reporter
5110     - source_app
5111     - source_principal
5112     - source_workload
5113     - source_workload_namespace
5114     - source_version
5115     - destination_app
5116     - destination_principal
5117     - destination_workload
5118     - destination_workload_namespace
5119     - destination_version
5120     - destination_service
5121     - destination_service_name
5122     - destination_service_namespace
5123     - connection_security_policy
5124   - name: tcp_received_bytes_total
5125     instance_name: tcpbytereceived.metric.istio-system
5126     kind: COUNTER
5127     label_names:
5128     - reporter
5129     - source_app
5130     - source_principal
5131     - source_workload
5132     - source_workload_namespace
5133     - source_version
5134     - destination_app
5135     - destination_principal
5136     - destination_workload
5137     - destination_workload_namespace
5138     - destination_version
5139     - destination_service
5140     - destination_service_name
5141     - destination_service_namespace
5142     - connection_security_policy
5143 ---
5144 apiVersion: "config.istio.io/v1alpha2"
5145 kind: rule
5146 metadata:
5147   name: promhttp
5148   namespace: istio-system
5149 spec:
5150   match: context.protocol == "http" || context.protocol == "grpc"
5151   actions:
5152   - handler: handler.prometheus
5153     instances:
5154     - requestcount.metric
5155     - requestduration.metric
5156     - requestsize.metric
5157     - responsesize.metric
5158 ---
5159 apiVersion: "config.istio.io/v1alpha2"
5160 kind: rule
5161 metadata:
5162   name: promtcp
5163   namespace: istio-system
5164 spec:
5165   match: context.protocol == "tcp"
5166   actions:
5167   - handler: handler.prometheus
5168     instances:
5169     - tcpbytesent.metric
5170     - tcpbytereceived.metric
5171 ---
5172
5173 apiVersion: "config.istio.io/v1alpha2"
5174 kind: kubernetesenv
5175 metadata:
5176   name: handler
5177   namespace: istio-system
5178 spec:
5179   # when running from mixer root, use the following config after adding a
5180   # symbolic link to a kubernetes config file via:
5181   #
5182   # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig
5183   #
5184   # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig"
5185
5186 ---
5187 apiVersion: "config.istio.io/v1alpha2"
5188 kind: rule
5189 metadata:
5190   name: kubeattrgenrulerule
5191   namespace: istio-system
5192 spec:
5193   actions:
5194   - handler: handler.kubernetesenv
5195     instances:
5196     - attributes.kubernetes
5197 ---
5198 apiVersion: "config.istio.io/v1alpha2"
5199 kind: rule
5200 metadata:
5201   name: tcpkubeattrgenrulerule
5202   namespace: istio-system
5203 spec:
5204   match: context.protocol == "tcp"
5205   actions:
5206   - handler: handler.kubernetesenv
5207     instances:
5208     - attributes.kubernetes
5209 ---
5210 apiVersion: "config.istio.io/v1alpha2"
5211 kind: kubernetes
5212 metadata:
5213   name: attributes
5214   namespace: istio-system
5215 spec:
5216   # Pass the required attribute data to the adapter
5217   source_uid: source.uid | ""
5218   source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr
5219   destination_uid: destination.uid | ""
5220   destination_port: destination.port | 0
5221   attribute_bindings:
5222     # Fill the new attributes from the adapter produced output.
5223     # $out refers to an instance of OutputTemplate message
5224     source.ip: $out.source_pod_ip | ip("0.0.0.0")
5225     source.uid: $out.source_pod_uid | "unknown"
5226     source.labels: $out.source_labels | emptyStringMap()
5227     source.name: $out.source_pod_name | "unknown"
5228     source.namespace: $out.source_namespace | "default"
5229     source.owner: $out.source_owner | "unknown"
5230     source.serviceAccount: $out.source_service_account_name | "unknown"
5231     source.workload.uid: $out.source_workload_uid | "unknown"
5232     source.workload.name: $out.source_workload_name | "unknown"
5233     source.workload.namespace: $out.source_workload_namespace | "unknown"
5234     destination.ip: $out.destination_pod_ip | ip("0.0.0.0")
5235     destination.uid: $out.destination_pod_uid | "unknown"
5236     destination.labels: $out.destination_labels | emptyStringMap()
5237     destination.name: $out.destination_pod_name | "unknown"
5238     destination.container.name: $out.destination_container_name | "unknown"
5239     destination.namespace: $out.destination_namespace | "default"
5240     destination.owner: $out.destination_owner | "unknown"
5241     destination.serviceAccount: $out.destination_service_account_name | "unknown"
5242     destination.workload.uid: $out.destination_workload_uid | "unknown"
5243     destination.workload.name: $out.destination_workload_name | "unknown"
5244     destination.workload.namespace: $out.destination_workload_namespace | "unknown"
5245
5246 ---
5247 # Configuration needed by Mixer.
5248 # Mixer cluster is delivered via CDS
5249 # Specify mixer cluster settings
5250 apiVersion: networking.istio.io/v1alpha3
5251 kind: DestinationRule
5252 metadata:
5253   name: istio-policy
5254   namespace: istio-system
5255 spec:
5256   host: istio-policy.istio-system.svc.cluster.local
5257   trafficPolicy:
5258     portLevelSettings:
5259     - port:
5260         number: 15004
5261       tls:
5262         mode: ISTIO_MUTUAL
5263     connectionPool:
5264       http:
5265         http2MaxRequests: 10000
5266         maxRequestsPerConnection: 10000
5267 ---
5268 apiVersion: networking.istio.io/v1alpha3
5269 kind: DestinationRule
5270 metadata:
5271   name: istio-telemetry
5272   namespace: istio-system
5273 spec:
5274   host: istio-telemetry.istio-system.svc.cluster.local
5275   trafficPolicy:
5276     portLevelSettings:
5277     - port:
5278         number: 15004
5279       tls:
5280         mode: ISTIO_MUTUAL
5281     connectionPool:
5282       http:
5283         http2MaxRequests: 10000
5284         maxRequestsPerConnection: 10000
5285 ---
5286