install/istio.yaml

   1 apiVersion: v1
   2 kind: Namespace
   3 metadata:
   4   name: istio-system
   5   labels:
   6     istio-injection: disabled
   7 ---
   8 # Source: istio/charts/galley/templates/configmap.yaml
   9 apiVersion: v1
  10 kind: ConfigMap
  11 metadata:
  12   name: istio-galley-configuration
  13   namespace: istio-system
  14   labels:
  15     app: istio-galley
  16     chart: galley-1.0.0
  17     release: RELEASE-NAME
  18     heritage: Tiller
  19     istio: mixer
  20 data:
  21   validatingwebhookconfiguration.yaml: |-
  22     apiVersion: admissionregistration.k8s.io/v1beta1
  23     kind: ValidatingWebhookConfiguration
  24     metadata:
  25       name: istio-galley
  26       namespace: istio-system
  27       labels:
  28         app: istio-galley
  29         chart: galley-1.0.0
  30         release: RELEASE-NAME
  31         heritage: Tiller
  32     webhooks:
  33       - name: pilot.validation.istio.io
  34         clientConfig:
  35           service:
  36             name: istio-galley
  37             namespace: istio-system
  38             path: "/admitpilot"
  39           caBundle: ""
  40         rules:
  41           - operations:
  42             - CREATE
  43             - UPDATE
  44             apiGroups:
  45             - config.istio.io
  46             apiVersions:
  47             - v1alpha2
  48             resources:
  49             - httpapispecs
  50             - httpapispecbindings
  51             - quotaspecs
  52             - quotaspecbindings
  53           - operations:
  54             - CREATE
  55             - UPDATE
  56             apiGroups:
  57             - rbac.istio.io
  58             apiVersions:
  59             - "*"
  60             resources:
  61             - "*"
  62           - operations:
  63             - CREATE
  64             - UPDATE
  65             apiGroups:
  66             - authentication.istio.io
  67             apiVersions:
  68             - "*"
  69             resources:
  70             - "*"
  71           - operations:
  72             - CREATE
  73             - UPDATE
  74             apiGroups:
  75             - networking.istio.io
  76             apiVersions:
  77             - "*"
  78             resources:
  79             - destinationrules
  80             - envoyfilters
  81             - gateways
  82             # disabled per @costinm's request
  83             # - serviceentries
  84             - virtualservices
  85         failurePolicy: Fail
  86       - name: mixer.validation.istio.io
  87         clientConfig:
  88           service:
  89             name: istio-galley
  90             namespace: istio-system
  91             path: "/admitmixer"
  92           caBundle: ""
  93         rules:
  94           - operations:
  95             - CREATE
  96             - UPDATE
  97             apiGroups:
  98             - config.istio.io
  99             apiVersions:
 100             - v1alpha2
 101             resources:
 102             - rules
 103             - attributemanifests
 104             - circonuses
 105             - deniers
 106             - fluentds
 107             - kubernetesenvs
 108             - listcheckers
 109             - memquotas
 110             - noops
 111             - opas
 112             - prometheuses
 113             - rbacs
 114             - servicecontrols
 115             - solarwindses
 116             - stackdrivers
 117             - statsds
 118             - stdios
 119             - apikeys
 120             - authorizations
 121             - checknothings
 122             # - kuberneteses
 123             - listentries
 124             - logentries
 125             - metrics
 126             - quotas
 127             - reportnothings
 128             - servicecontrolreports
 129             - tracespans
 130         failurePolicy: Fail
 131
 132
 133 ---
 134 # Source: istio/charts/grafana/templates/configmap.yaml
 135 apiVersion: v1
 136 kind: ConfigMap
 137 metadata:
 138   name: istio-grafana-custom-resources
 139   namespace: istio-system
 140   labels:
 141     app: istio-grafana
 142     chart: grafana-0.1.0
 143     release: RELEASE-NAME
 144     heritage: Tiller
 145     istio: grafana
 146 data:
 147   custom-resources.yaml: |-
 148     apiVersion: authentication.istio.io/v1alpha1
 149     kind: Policy
 150     metadata:
 151       name: grafana-ports-mtls-disabled
 152       namespace: istio-system
 153     spec:
 154       targets:
 155       - name: grafana
 156         ports:
 157         - number: 3000
 158   run.sh: |-
 159     #!/bin/sh
 160
 161     set -x
 162
 163     if [ "$#" -ne "1" ]; then
 164         echo "first argument should be path to custom resource yaml"
 165         exit 1
 166     fi
 167
 168     pathToResourceYAML=${1}
 169
 170     /kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null
 171     if [ "$?" -eq 0 ]; then
 172         echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready"
 173         while true; do
 174             /kubectl -n istio-system get deployment istio-galley 2>/dev/null
 175             if [ "$?" -eq 0 ]; then
 176                 break
 177             fi
 178             sleep 1
 179         done
 180         /kubectl -n istio-system rollout status deployment istio-galley
 181         if [ "$?" -ne 0 ]; then
 182             echo "istio-galley deployment rollout status check failed"
 183             exit 1
 184         fi
 185         echo "istio-galley deployment ready for configuration validation"
 186     fi
 187     sleep 5
 188     /kubectl apply -f ${pathToResourceYAML}
 189
 190
 191 ---
 192 # Source: istio/charts/mixer/templates/configmap.yaml
 193 apiVersion: v1
 194 kind: ConfigMap
 195 metadata:
 196   name: istio-statsd-prom-bridge
 197   namespace: istio-system
 198   labels:
 199     app: istio-statsd-prom-bridge
 200     chart: mixer-1.0.0
 201     release: RELEASE-NAME
 202     heritage: Tiller
 203     istio: mixer
 204 data:
 205   mapping.conf: |-
 206
 207 ---
 208 # Source: istio/charts/prometheus/templates/configmap.yaml
 209 apiVersion: v1
 210 kind: ConfigMap
 211 metadata:
 212   name: prometheus
 213   namespace: istio-system
 214   labels:
 215     app: prometheus
 216     chart: prometheus-0.1.0
 217     release: RELEASE-NAME
 218     heritage: Tiller
 219 data:
 220   prometheus.yml: |-
 221     global:
 222       scrape_interval: 15s
 223     scrape_configs:
 224
 225     - job_name: 'istio-mesh'
 226       # Override the global default and scrape targets from this job every 5 seconds.
 227       scrape_interval: 5s
 228
 229       kubernetes_sd_configs:
 230       - role: endpoints
 231         namespaces:
 232           names:
 233           - istio-system
 234
 235       relabel_configs:
 236       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 237         action: keep
 238         regex: istio-telemetry;prometheus
 239
 240     - job_name: 'envoy'
 241       # Override the global default and scrape targets from this job every 5 seconds.
 242       scrape_interval: 5s
 243       # metrics_path defaults to '/metrics'
 244       # scheme defaults to 'http'.
 245
 246       kubernetes_sd_configs:
 247       - role: endpoints
 248         namespaces:
 249           names:
 250           - istio-system
 251
 252       relabel_configs:
 253       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 254         action: keep
 255         regex: istio-statsd-prom-bridge;statsd-prom
 256
 257     - job_name: 'istio-policy'
 258       # Override the global default and scrape targets from this job every 5 seconds.
 259       scrape_interval: 5s
 260       # metrics_path defaults to '/metrics'
 261       # scheme defaults to 'http'.
 262
 263       kubernetes_sd_configs:
 264       - role: endpoints
 265         namespaces:
 266           names:
 267           - istio-system
 268
 269
 270       relabel_configs:
 271       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 272         action: keep
 273         regex: istio-policy;http-monitoring
 274
 275     - job_name: 'istio-telemetry'
 276       # Override the global default and scrape targets from this job every 5 seconds.
 277       scrape_interval: 5s
 278       # metrics_path defaults to '/metrics'
 279       # scheme defaults to 'http'.
 280
 281       kubernetes_sd_configs:
 282       - role: endpoints
 283         namespaces:
 284           names:
 285           - istio-system
 286
 287       relabel_configs:
 288       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 289         action: keep
 290         regex: istio-telemetry;http-monitoring
 291
 292     - job_name: 'pilot'
 293       # Override the global default and scrape targets from this job every 5 seconds.
 294       scrape_interval: 5s
 295       # metrics_path defaults to '/metrics'
 296       # scheme defaults to 'http'.
 297
 298       kubernetes_sd_configs:
 299       - role: endpoints
 300         namespaces:
 301           names:
 302           - istio-system
 303
 304       relabel_configs:
 305       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 306         action: keep
 307         regex: istio-pilot;http-monitoring
 308
 309     - job_name: 'galley'
 310       # Override the global default and scrape targets from this job every 5 seconds.
 311       scrape_interval: 5s
 312       # metrics_path defaults to '/metrics'
 313       # scheme defaults to 'http'.
 314
 315       kubernetes_sd_configs:
 316       - role: endpoints
 317         namespaces:
 318           names:
 319           - istio-system
 320
 321       relabel_configs:
 322       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 323         action: keep
 324         regex: istio-galley;http-monitoring
 325
 326     # scrape config for API servers
 327     - job_name: 'kubernetes-apiservers'
 328       kubernetes_sd_configs:
 329       - role: endpoints
 330         namespaces:
 331           names:
 332           - default
 333       scheme: https
 334       tls_config:
 335         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 336       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 337       relabel_configs:
 338       - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 339         action: keep
 340         regex: kubernetes;https
 341
 342     # scrape config for nodes (kubelet)
 343     - job_name: 'kubernetes-nodes'
 344       scheme: https
 345       tls_config:
 346         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 347       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 348       kubernetes_sd_configs:
 349       - role: node
 350       relabel_configs:
 351       - action: labelmap
 352         regex: __meta_kubernetes_node_label_(.+)
 353       - target_label: __address__
 354         replacement: kubernetes.default.svc:443
 355       - source_labels: [__meta_kubernetes_node_name]
 356         regex: (.+)
 357         target_label: __metrics_path__
 358         replacement: /api/v1/nodes/${1}/proxy/metrics
 359
 360     # Scrape config for Kubelet cAdvisor.
 361     #
 362     # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
 363     # (those whose names begin with 'container_') have been removed from the
 364     # Kubelet metrics endpoint.  This job scrapes the cAdvisor endpoint to
 365     # retrieve those metrics.
 366     #
 367     # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
 368     # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
 369     # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
 370     # the --cadvisor-port=0 Kubelet flag).
 371     #
 372     # This job is not necessary and should be removed in Kubernetes 1.6 and
 373     # earlier versions, or it will cause the metrics to be scraped twice.
 374     - job_name: 'kubernetes-cadvisor'
 375       scheme: https
 376       tls_config:
 377         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 378       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 379       kubernetes_sd_configs:
 380       - role: node
 381       relabel_configs:
 382       - action: labelmap
 383         regex: __meta_kubernetes_node_label_(.+)
 384       - target_label: __address__
 385         replacement: kubernetes.default.svc:443
 386       - source_labels: [__meta_kubernetes_node_name]
 387         regex: (.+)
 388         target_label: __metrics_path__
 389         replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
 390
 391     # scrape config for service endpoints.
 392     - job_name: 'kubernetes-service-endpoints'
 393       kubernetes_sd_configs:
 394       - role: endpoints
 395       relabel_configs:
 396       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
 397         action: keep
 398         regex: true
 399       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
 400         action: replace
 401         target_label: __scheme__
 402         regex: (https?)
 403       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
 404         action: replace
 405         target_label: __metrics_path__
 406         regex: (.+)
 407       - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
 408         action: replace
 409         target_label: __address__
 410         regex: ([^:]+)(?::\d+)?;(\d+)
 411         replacement: $1:$2
 412       - action: labelmap
 413         regex: __meta_kubernetes_service_label_(.+)
 414       - source_labels: [__meta_kubernetes_namespace]
 415         action: replace
 416         target_label: kubernetes_namespace
 417       - source_labels: [__meta_kubernetes_service_name]
 418         action: replace
 419         target_label: kubernetes_name
 420
 421     # Example scrape config for pods
 422     - job_name: 'kubernetes-pods'
 423       kubernetes_sd_configs:
 424       - role: pod
 425
 426       relabel_configs:
 427       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 428         action: keep
 429         regex: true
 430       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
 431         action: replace
 432         target_label: __metrics_path__
 433         regex: (.+)
 434       - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
 435         action: replace
 436         regex: ([^:]+)(?::\d+)?;(\d+)
 437         replacement: $1:$2
 438         target_label: __address__
 439       - action: labelmap
 440         regex: __meta_kubernetes_pod_label_(.+)
 441       - source_labels: [__meta_kubernetes_namespace]
 442         action: replace
 443         target_label: namespace
 444       - source_labels: [__meta_kubernetes_pod_name]
 445         action: replace
 446         target_label: pod_name
 447
 448 ---
 449 # Source: istio/charts/security/templates/configmap.yaml
 450 apiVersion: v1
 451 kind: ConfigMap
 452 metadata:
 453   name: istio-security-custom-resources
 454   namespace: istio-system
 455   labels:
 456     app: istio-security
 457     chart: security-1.0.0
 458     release: RELEASE-NAME
 459     heritage: Tiller
 460     istio: security
 461 data:
 462   custom-resources.yaml: |-
 463   run.sh: |-
 464     #!/bin/sh
 465
 466     set -x
 467
 468     if [ "$#" -ne "1" ]; then
 469         echo "first argument should be path to custom resource yaml"
 470         exit 1
 471     fi
 472
 473     pathToResourceYAML=${1}
 474
 475     /kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null
 476     if [ "$?" -eq 0 ]; then
 477         echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready"
 478         while true; do
 479             /kubectl -n istio-system get deployment istio-galley 2>/dev/null
 480             if [ "$?" -eq 0 ]; then
 481                 break
 482             fi
 483             sleep 1
 484         done
 485         /kubectl -n istio-system rollout status deployment istio-galley
 486         if [ "$?" -ne 0 ]; then
 487             echo "istio-galley deployment rollout status check failed"
 488             exit 1
 489         fi
 490         echo "istio-galley deployment ready for configuration validation"
 491     fi
 492     sleep 5
 493     /kubectl apply -f ${pathToResourceYAML}
 494
 495
 496 ---
 497 # Source: istio/templates/configmap.yaml
 498
 499 apiVersion: v1
 500 kind: ConfigMap
 501 metadata:
 502   name: istio
 503   namespace: istio-system
 504   labels:
 505     app: istio
 506     chart: istio-1.0.0
 507     release: RELEASE-NAME
 508     heritage: Tiller
 509 data:
 510   mesh: |-
 511     # Set the following variable to true to disable policy checks by the Mixer.
 512     # Note that metrics will still be reported to the Mixer.
 513     disablePolicyChecks: false
 514
 515     # Set enableTracing to false to disable request tracing.
 516     enableTracing: true
 517
 518     # Set accessLogFile to empty string to disable access log.
 519     accessLogFile: "/dev/stdout"
 520     #
 521     # Deprecated: mixer is using EDS
 522     mixerCheckServer: istio-policy.istio-system.svc.cluster.local:9091
 523     mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:9091
 524
 525     # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get
 526     # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty.
 527     sdsUdsPath: ""
 528
 529     # How frequently should Envoy fetch key/cert from NodeAgent.
 530     sdsRefreshDelay: 15s
 531
 532     #
 533     defaultConfig:
 534       #
 535       # TCP connection timeout between Envoy & the application, and between Envoys.
 536       connectTimeout: 10s
 537       #
 538       ### ADVANCED SETTINGS #############
 539       # Where should envoy's configuration be stored in the istio-proxy container
 540       configPath: "/etc/istio/proxy"
 541       binaryPath: "/usr/local/bin/envoy"
 542       # The pseudo service name used for Envoy.
 543       serviceCluster: istio-proxy
 544       # These settings that determine how long an old Envoy
 545       # process should be kept alive after an occasional reload.
 546       drainDuration: 45s
 547       parentShutdownDuration: 1m0s
 548       #
 549       # The mode used to redirect inbound connections to Envoy. This setting
 550       # has no effect on outbound traffic: iptables REDIRECT is always used for
 551       # outbound connections.
 552       # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
 553       # The "REDIRECT" mode loses source addresses during redirection.
 554       # If "TPROXY", use iptables TPROXY to redirect to Envoy.
 555       # The "TPROXY" mode preserves both the source and destination IP
 556       # addresses and ports, so that they can be used for advanced filtering
 557       # and manipulation.
 558       # The "TPROXY" mode also configures the sidecar to run with the
 559       # CAP_NET_ADMIN capability, which is required to use TPROXY.
 560       #interceptionMode: REDIRECT
 561       #
 562       # Port where Envoy listens (on local host) for admin commands
 563       # You can exec into the istio-proxy container in a pod and
 564       # curl the admin port (curl http://localhost:15000/) to obtain
 565       # diagnostic information from Envoy. See
 566       # https://lyft.github.io/envoy/docs/operations/admin.html
 567       # for more details
 568       proxyAdminPort: 15000
 569       #
 570       # Zipkin trace collector
 571       zipkinAddress: zipkin.istio-system:9411
 572       #
 573       # Statsd metrics collector converts statsd metrics into Prometheus metrics.
 574       statsdUdpAddress: istio-statsd-prom-bridge.istio-system:9125
 575       #
 576       # Mutual TLS authentication between sidecars and istio control plane.
 577       controlPlaneAuthPolicy: NONE
 578       #
 579       # Address where istio Pilot service is running
 580       discoveryAddress: istio-pilot.istio-system:15007
 581
 582 ---
 583 # Source: istio/templates/sidecar-injector-configmap.yaml
 584
 585 apiVersion: v1
 586 kind: ConfigMap
 587 metadata:
 588   name: istio-sidecar-injector
 589   namespace: istio-system
 590   labels:
 591     app: istio
 592     chart: istio-1.0.0
 593     release: RELEASE-NAME
 594     heritage: Tiller
 595     istio: sidecar-injector
 596 data:
 597   config: |-
 598     policy: disabled
 599     template: |-
 600       initContainers:
 601       - name: istio-init
 602         image: "gcr.io/istio-release/proxy_init:1.0.0"
 603         args:
 604         - "-p"
 605         - [[ .MeshConfig.ProxyListenPort ]]
 606         - "-u"
 607         - 1337
 608         - "-m"
 609         - [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 610         - "-i"
 611         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges") -]]
 612         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges"  ]]"
 613         [[ else -]]
 614         - "*"
 615         [[ end -]]
 616         - "-x"
 617         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges") -]]
 618         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges"  ]]"
 619         [[ else -]]
 620         - ""
 621         [[ end -]]
 622         - "-b"
 623         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts") -]]
 624         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts"  ]]"
 625         [[ else -]]
 626         - [[ range .Spec.Containers -]][[ range .Ports -]][[ .ContainerPort -]], [[ end -]][[ end -]][[ end]]
 627         - "-d"
 628         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts") -]]
 629         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts" ]]"
 630         [[ else -]]
 631         - ""
 632         [[ end -]]
 633         imagePullPolicy: IfNotPresent
 634         securityContext:
 635           capabilities:
 636             add:
 637             - NET_ADMIN
 638           privileged: true
 639         restartPolicy: Always
 640
 641       containers:
 642       - name: istio-proxy
 643         image: [[ if (isset .ObjectMeta.Annotations "sidecar.istio.io/proxyImage") -]]
 644         "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyImage" ]]"
 645         [[ else -]]
 646         gcr.io/istio-release/proxy_debug:1.0.0
 647         [[ end -]]
 648         args:
 649         - proxy
 650         - sidecar
 651         - --configPath
 652         - [[ .ProxyConfig.ConfigPath ]]
 653         - --binaryPath
 654         - [[ .ProxyConfig.BinaryPath ]]
 655         - --serviceCluster
 656         [[ if ne "" (index .ObjectMeta.Labels "app") -]]
 657         - [[ index .ObjectMeta.Labels "app" ]]
 658         [[ else -]]
 659         - "istio-proxy"
 660         [[ end -]]
 661         - --drainDuration
 662         - [[ formatDuration .ProxyConfig.DrainDuration ]]
 663         - --parentShutdownDuration
 664         - [[ formatDuration .ProxyConfig.ParentShutdownDuration ]]
 665         - --discoveryAddress
 666         - [[ .ProxyConfig.DiscoveryAddress ]]
 667         - --discoveryRefreshDelay
 668         - [[ formatDuration .ProxyConfig.DiscoveryRefreshDelay ]]
 669         - --zipkinAddress
 670         - [[ .ProxyConfig.ZipkinAddress ]]
 671         - --connectTimeout
 672         - [[ formatDuration .ProxyConfig.ConnectTimeout ]]
 673         - --statsdUdpAddress
 674         - [[ .ProxyConfig.StatsdUdpAddress ]]
 675         - --proxyAdminPort
 676         - [[ .ProxyConfig.ProxyAdminPort ]]
 677         - --controlPlaneAuthPolicy
 678         - [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/controlPlaneAuthPolicy") .ProxyConfig.ControlPlaneAuthPolicy ]]
 679         env:
 680         - name: POD_NAME
 681           valueFrom:
 682             fieldRef:
 683               fieldPath: metadata.name
 684         - name: POD_NAMESPACE
 685           valueFrom:
 686             fieldRef:
 687               fieldPath: metadata.namespace
 688         - name: INSTANCE_IP
 689           valueFrom:
 690             fieldRef:
 691               fieldPath: status.podIP
 692         - name: ISTIO_META_POD_NAME
 693           valueFrom:
 694             fieldRef:
 695               fieldPath: metadata.name
 696         - name: ISTIO_META_INTERCEPTION_MODE
 697           value: [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 698         imagePullPolicy: IfNotPresent
 699         securityContext:
 700           privileged: false
 701           readOnlyRootFilesystem: true
 702           [[ if eq (or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String) "TPROXY" -]]
 703           capabilities:
 704             add:
 705             - NET_ADMIN
 706           runAsGroup: 1337
 707           [[ else -]]
 708           runAsUser: 1337
 709           [[ end -]]
 710         restartPolicy: Always
 711         resources:
 712           [[ if (isset .ObjectMeta.Annotations "sidecar.istio.io/proxyCPU") -]]
 713           requests:
 714             cpu: "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyCPU" ]]"
 715             memory: "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyMemory" ]]"
 716         [[ else -]]
 717           requests:
 718             cpu: 10m
 719
 720         [[ end -]]
 721         volumeMounts:
 722         - mountPath: /etc/istio/proxy
 723           name: istio-envoy
 724         - mountPath: /etc/certs/
 725           name: istio-certs
 726           readOnly: true
 727       volumes:
 728       - emptyDir:
 729           medium: Memory
 730         name: istio-envoy
 731       - name: istio-certs
 732         secret:
 733           optional: true
 734           [[ if eq .Spec.ServiceAccountName "" -]]
 735           secretName: istio.default
 736           [[ else -]]
 737           secretName: [[ printf "istio.%s" .Spec.ServiceAccountName ]]
 738           [[ end -]]
 739
 740 ---
 741 # Source: istio/charts/galley/templates/serviceaccount.yaml
 742 apiVersion: v1
 743 kind: ServiceAccount
 744 metadata:
 745   name: istio-galley-service-account
 746   namespace: istio-system
 747   labels:
 748     app: istio-galley
 749     chart: galley-1.0.0
 750     heritage: Tiller
 751     release: RELEASE-NAME
 752
 753 ---
 754 # Source: istio/charts/gateways/templates/serviceaccount.yaml
 755
 756 apiVersion: v1
 757 kind: ServiceAccount
 758 metadata:
 759   name: istio-egressgateway-service-account
 760   namespace: istio-system
 761   labels:
 762     app: egressgateway
 763     chart: gateways-1.0.0
 764     heritage: Tiller
 765     release: RELEASE-NAME
 766 ---
 767 apiVersion: v1
 768 kind: ServiceAccount
 769 metadata:
 770   name: istio-ingressgateway-service-account
 771   namespace: istio-system
 772   labels:
 773     app: ingressgateway
 774     chart: gateways-1.0.0
 775     heritage: Tiller
 776     release: RELEASE-NAME
 777 ---
 778
 779 ---
 780 # Source: istio/charts/grafana/templates/create-custom-resources-job.yaml
 781 apiVersion: v1
 782 kind: ServiceAccount
 783 metadata:
 784   name: istio-grafana-post-install-account
 785   namespace: istio-system
 786   labels:
 787     app: istio-grafana
 788     chart: grafana-0.1.0
 789     heritage: Tiller
 790     release: RELEASE-NAME
 791 ---
 792 apiVersion: rbac.authorization.k8s.io/v1beta1
 793 kind: ClusterRole
 794 metadata:
 795   name: istio-grafana-post-install-istio-system
 796   labels:
 797     app: istio-grafana
 798     chart: grafana-0.1.0
 799     heritage: Tiller
 800     release: RELEASE-NAME
 801 rules:
 802 - apiGroups: ["authentication.istio.io"] # needed to create default authn policy
 803   resources: ["*"]
 804   verbs: ["*"]
 805 ---
 806 apiVersion: rbac.authorization.k8s.io/v1beta1
 807 kind: ClusterRoleBinding
 808 metadata:
 809   name: istio-grafana-post-install-role-binding-istio-system
 810   labels:
 811     app: istio-grafana
 812     chart: grafana-0.1.0
 813     heritage: Tiller
 814     release: RELEASE-NAME
 815 roleRef:
 816   apiGroup: rbac.authorization.k8s.io
 817   kind: ClusterRole
 818   name: istio-grafana-post-install-istio-system
 819 subjects:
 820   - kind: ServiceAccount
 821     name: istio-grafana-post-install-account
 822     namespace: istio-system
 823 ---
 824 apiVersion: batch/v1
 825 kind: Job
 826 metadata:
 827   name: istio-grafana-post-install
 828   namespace: istio-system
 829   annotations:
 830     "helm.sh/hook": post-install
 831     "helm.sh/hook-delete-policy": hook-succeeded
 832   labels:
 833     app: istio-grafana
 834     chart: grafana-0.1.0
 835     release: RELEASE-NAME
 836     heritage: Tiller
 837 spec:
 838   template:
 839     metadata:
 840       name: istio-grafana-post-install
 841       labels:
 842         app: istio-grafana
 843         release: RELEASE-NAME
 844     spec:
 845       serviceAccountName: istio-grafana-post-install-account
 846       containers:
 847         - name: hyperkube
 848           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
 849           command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ]
 850           volumeMounts:
 851             - mountPath: "/tmp/grafana"
 852               name: tmp-configmap-grafana
 853       volumes:
 854         - name: tmp-configmap-grafana
 855           configMap:
 856             name: istio-grafana-custom-resources
 857       restartPolicy: OnFailure
 858
 859 ---
 860 # Source: istio/charts/mixer/templates/serviceaccount.yaml
 861 apiVersion: v1
 862 kind: ServiceAccount
 863 metadata:
 864   name: istio-mixer-service-account
 865   namespace: istio-system
 866   labels:
 867     app: mixer
 868     chart: mixer-1.0.0
 869     heritage: Tiller
 870     release: RELEASE-NAME
 871
 872 ---
 873 # Source: istio/charts/pilot/templates/serviceaccount.yaml
 874 apiVersion: v1
 875 kind: ServiceAccount
 876 metadata:
 877   name: istio-pilot-service-account
 878   namespace: istio-system
 879   labels:
 880     app: istio-pilot
 881     chart: pilot-1.0.0
 882     heritage: Tiller
 883     release: RELEASE-NAME
 884
 885 ---
 886 # Source: istio/charts/prometheus/templates/serviceaccount.yaml
 887 apiVersion: v1
 888 kind: ServiceAccount
 889 metadata:
 890   name: prometheus
 891   namespace: istio-system
 892
 893 ---
 894 # Source: istio/charts/security/templates/cleanup-secrets.yaml
 895 # The reason for creating a ServiceAccount and ClusterRole specifically for this
 896 # post-delete hooked job is because the citadel ServiceAccount is being deleted
 897 # before this hook is launched. On the other hand, running this hook before the
 898 # deletion of the citadel (e.g. pre-delete) won't delete the secrets because they
 899 # will be re-created immediately by the to-be-deleted citadel.
 900 #
 901 # It's also important that the ServiceAccount, ClusterRole and ClusterRoleBinding
 902 # will be ready before running the hooked Job therefore the hook weights.
 903
 904 apiVersion: v1
 905 kind: ServiceAccount
 906 metadata:
 907   name: istio-cleanup-secrets-service-account
 908   namespace: istio-system
 909   annotations:
 910     "helm.sh/hook": post-delete
 911     "helm.sh/hook-delete-policy": hook-succeeded
 912     "helm.sh/hook-weight": "1"
 913   labels:
 914     app: security
 915     chart: security-1.0.0
 916     heritage: Tiller
 917     release: RELEASE-NAME
 918 ---
 919 apiVersion: rbac.authorization.k8s.io/v1beta1
 920 kind: ClusterRole
 921 metadata:
 922   name: istio-cleanup-secrets-istio-system
 923   annotations:
 924     "helm.sh/hook": post-delete
 925     "helm.sh/hook-delete-policy": hook-succeeded
 926     "helm.sh/hook-weight": "1"
 927   labels:
 928     app: security
 929     chart: security-1.0.0
 930     heritage: Tiller
 931     release: RELEASE-NAME
 932 rules:
 933 - apiGroups: [""]
 934   resources: ["secrets"]
 935   verbs: ["list", "delete"]
 936 ---
 937 apiVersion: rbac.authorization.k8s.io/v1beta1
 938 kind: ClusterRoleBinding
 939 metadata:
 940   name: istio-cleanup-secrets-istio-system
 941   annotations:
 942     "helm.sh/hook": post-delete
 943     "helm.sh/hook-delete-policy": hook-succeeded
 944     "helm.sh/hook-weight": "2"
 945   labels:
 946     app: security
 947     chart: security-1.0.0
 948     heritage: Tiller
 949     release: RELEASE-NAME
 950 roleRef:
 951   apiGroup: rbac.authorization.k8s.io
 952   kind: ClusterRole
 953   name: istio-cleanup-secrets-istio-system
 954 subjects:
 955   - kind: ServiceAccount
 956     name: istio-cleanup-secrets-service-account
 957     namespace: istio-system
 958 ---
 959 apiVersion: batch/v1
 960 kind: Job
 961 metadata:
 962   name: istio-cleanup-secrets
 963   namespace: istio-system
 964   annotations:
 965     "helm.sh/hook": post-delete
 966     "helm.sh/hook-delete-policy": hook-succeeded
 967     "helm.sh/hook-weight": "3"
 968   labels:
 969     app: security
 970     chart: security-1.0.0
 971     release: RELEASE-NAME
 972     heritage: Tiller
 973 spec:
 974   template:
 975     metadata:
 976       name: istio-cleanup-secrets
 977       labels:
 978         app: security
 979         release: RELEASE-NAME
 980     spec:
 981       serviceAccountName: istio-cleanup-secrets-service-account
 982       containers:
 983         - name: hyperkube
 984           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
 985           command:
 986           - /bin/bash
 987           - -c
 988           - >
 989               kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" |  while read -r entry; do
 990                 ns=$(echo $entry | awk '{print $1}');
 991                 name=$(echo $entry | awk '{print $2}');
 992                 kubectl delete secret $name -n $ns;
 993               done
 994       restartPolicy: OnFailure
 995
 996 ---
 997 # Source: istio/charts/security/templates/serviceaccount.yaml
 998 apiVersion: v1
 999 kind: ServiceAccount
1000 metadata:
1001   name: istio-citadel-service-account
1002   namespace: istio-system
1003   labels:
1004     app: security
1005     chart: security-1.0.0
1006     heritage: Tiller
1007     release: RELEASE-NAME
1008
1009 ---
1010 # Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml
1011 apiVersion: v1
1012 kind: ServiceAccount
1013 metadata:
1014   name: istio-sidecar-injector-service-account
1015   namespace: istio-system
1016   labels:
1017     app: istio-sidecar-injector
1018     chart: sidecarInjectorWebhook-1.0.0
1019     heritage: Tiller
1020     release: RELEASE-NAME
1021
1022 ---
1023 # Source: istio/templates/crds.yaml
1024 #
1025 # these CRDs only make sense when pilot is enabled
1026 #
1027 apiVersion: apiextensions.k8s.io/v1beta1
1028 kind: CustomResourceDefinition
1029 metadata:
1030   name: virtualservices.networking.istio.io
1031   annotations:
1032     "helm.sh/hook": crd-install
1033   labels:
1034     app: istio-pilot
1035 spec:
1036   group: networking.istio.io
1037   names:
1038     kind: VirtualService
1039     listKind: VirtualServiceList
1040     plural: virtualservices
1041     singular: virtualservice
1042     categories:
1043     - istio-io
1044     - networking-istio-io
1045   scope: Namespaced
1046   version: v1alpha3
1047 ---
1048 apiVersion: apiextensions.k8s.io/v1beta1
1049 kind: CustomResourceDefinition
1050 metadata:
1051   name: destinationrules.networking.istio.io
1052   annotations:
1053     "helm.sh/hook": crd-install
1054   labels:
1055     app: istio-pilot
1056 spec:
1057   group: networking.istio.io
1058   names:
1059     kind: DestinationRule
1060     listKind: DestinationRuleList
1061     plural: destinationrules
1062     singular: destinationrule
1063     categories:
1064     - istio-io
1065     - networking-istio-io
1066   scope: Namespaced
1067   version: v1alpha3
1068 ---
1069 apiVersion: apiextensions.k8s.io/v1beta1
1070 kind: CustomResourceDefinition
1071 metadata:
1072   name: serviceentries.networking.istio.io
1073   annotations:
1074     "helm.sh/hook": crd-install
1075   labels:
1076     app: istio-pilot
1077 spec:
1078   group: networking.istio.io
1079   names:
1080     kind: ServiceEntry
1081     listKind: ServiceEntryList
1082     plural: serviceentries
1083     singular: serviceentry
1084     categories:
1085     - istio-io
1086     - networking-istio-io
1087   scope: Namespaced
1088   version: v1alpha3
1089 ---
1090 apiVersion: apiextensions.k8s.io/v1beta1
1091 kind: CustomResourceDefinition
1092 metadata:
1093   name: gateways.networking.istio.io
1094   annotations:
1095     "helm.sh/hook": crd-install
1096     "helm.sh/hook-weight": "-5"
1097   labels:
1098     app: istio-pilot
1099 spec:
1100   group: networking.istio.io
1101   names:
1102     kind: Gateway
1103     plural: gateways
1104     singular: gateway
1105     categories:
1106     - istio-io
1107     - networking-istio-io
1108   scope: Namespaced
1109   version: v1alpha3
1110 ---
1111 apiVersion: apiextensions.k8s.io/v1beta1
1112 kind: CustomResourceDefinition
1113 metadata:
1114   name: envoyfilters.networking.istio.io
1115   annotations:
1116     "helm.sh/hook": crd-install
1117   labels:
1118     app: istio-pilot
1119 spec:
1120   group: networking.istio.io
1121   names:
1122     kind: EnvoyFilter
1123     plural: envoyfilters
1124     singular: envoyfilter
1125     categories:
1126     - istio-io
1127     - networking-istio-io
1128   scope: Namespaced
1129   version: v1alpha3
1130 ---
1131 #
1132
1133 # these CRDs only make sense when security is enabled
1134 #
1135
1136 #
1137 kind: CustomResourceDefinition
1138 apiVersion: apiextensions.k8s.io/v1beta1
1139 metadata:
1140   annotations:
1141     "helm.sh/hook": crd-install
1142   name: httpapispecbindings.config.istio.io
1143 spec:
1144   group: config.istio.io
1145   names:
1146     kind: HTTPAPISpecBinding
1147     plural: httpapispecbindings
1148     singular: httpapispecbinding
1149     categories:
1150     - istio-io
1151     - apim-istio-io
1152   scope: Namespaced
1153   version: v1alpha2
1154 ---
1155 kind: CustomResourceDefinition
1156 apiVersion: apiextensions.k8s.io/v1beta1
1157 metadata:
1158   annotations:
1159     "helm.sh/hook": crd-install
1160   name: httpapispecs.config.istio.io
1161 spec:
1162   group: config.istio.io
1163   names:
1164     kind: HTTPAPISpec
1165     plural: httpapispecs
1166     singular: httpapispec
1167     categories:
1168     - istio-io
1169     - apim-istio-io
1170   scope: Namespaced
1171   version: v1alpha2
1172 ---
1173 kind: CustomResourceDefinition
1174 apiVersion: apiextensions.k8s.io/v1beta1
1175 metadata:
1176   annotations:
1177     "helm.sh/hook": crd-install
1178   name: quotaspecbindings.config.istio.io
1179 spec:
1180   group: config.istio.io
1181   names:
1182     kind: QuotaSpecBinding
1183     plural: quotaspecbindings
1184     singular: quotaspecbinding
1185     categories:
1186     - istio-io
1187     - apim-istio-io
1188   scope: Namespaced
1189   version: v1alpha2
1190 ---
1191 kind: CustomResourceDefinition
1192 apiVersion: apiextensions.k8s.io/v1beta1
1193 metadata:
1194   annotations:
1195     "helm.sh/hook": crd-install
1196   name: quotaspecs.config.istio.io
1197 spec:
1198   group: config.istio.io
1199   names:
1200     kind: QuotaSpec
1201     plural: quotaspecs
1202     singular: quotaspec
1203     categories:
1204     - istio-io
1205     - apim-istio-io
1206   scope: Namespaced
1207   version: v1alpha2
1208 ---
1209
1210 # Mixer CRDs
1211 kind: CustomResourceDefinition
1212 apiVersion: apiextensions.k8s.io/v1beta1
1213 metadata:
1214   name: rules.config.istio.io
1215   annotations:
1216     "helm.sh/hook": crd-install
1217   labels:
1218     app: mixer
1219     package: istio.io.mixer
1220     istio: core
1221 spec:
1222   group: config.istio.io
1223   names:
1224     kind: rule
1225     plural: rules
1226     singular: rule
1227     categories:
1228     - istio-io
1229     - policy-istio-io
1230   scope: Namespaced
1231   version: v1alpha2
1232 ---
1233
1234 kind: CustomResourceDefinition
1235 apiVersion: apiextensions.k8s.io/v1beta1
1236 metadata:
1237   name: attributemanifests.config.istio.io
1238   annotations:
1239     "helm.sh/hook": crd-install
1240   labels:
1241     app: mixer
1242     package: istio.io.mixer
1243     istio: core
1244 spec:
1245   group: config.istio.io
1246   names:
1247     kind: attributemanifest
1248     plural: attributemanifests
1249     singular: attributemanifest
1250     categories:
1251     - istio-io
1252     - policy-istio-io
1253   scope: Namespaced
1254   version: v1alpha2
1255 ---
1256
1257 kind: CustomResourceDefinition
1258 apiVersion: apiextensions.k8s.io/v1beta1
1259 metadata:
1260   name: bypasses.config.istio.io
1261   annotations:
1262     "helm.sh/hook": crd-install
1263   labels:
1264     app: mixer
1265     package: bypass
1266     istio: mixer-adapter
1267 spec:
1268   group: config.istio.io
1269   names:
1270     kind: bypass
1271     plural: bypasses
1272     singular: bypass
1273     categories:
1274     - istio-io
1275     - policy-istio-io
1276   scope: Namespaced
1277   version: v1alpha2
1278 ---
1279
1280 kind: CustomResourceDefinition
1281 apiVersion: apiextensions.k8s.io/v1beta1
1282 metadata:
1283   name: circonuses.config.istio.io
1284   annotations:
1285     "helm.sh/hook": crd-install
1286   labels:
1287     app: mixer
1288     package: circonus
1289     istio: mixer-adapter
1290 spec:
1291   group: config.istio.io
1292   names:
1293     kind: circonus
1294     plural: circonuses
1295     singular: circonus
1296     categories:
1297     - istio-io
1298     - policy-istio-io
1299   scope: Namespaced
1300   version: v1alpha2
1301 ---
1302
1303 kind: CustomResourceDefinition
1304 apiVersion: apiextensions.k8s.io/v1beta1
1305 metadata:
1306   name: deniers.config.istio.io
1307   annotations:
1308     "helm.sh/hook": crd-install
1309   labels:
1310     app: mixer
1311     package: denier
1312     istio: mixer-adapter
1313 spec:
1314   group: config.istio.io
1315   names:
1316     kind: denier
1317     plural: deniers
1318     singular: denier
1319     categories:
1320     - istio-io
1321     - policy-istio-io
1322   scope: Namespaced
1323   version: v1alpha2
1324 ---
1325
1326 kind: CustomResourceDefinition
1327 apiVersion: apiextensions.k8s.io/v1beta1
1328 metadata:
1329   name: fluentds.config.istio.io
1330   annotations:
1331     "helm.sh/hook": crd-install
1332   labels:
1333     app: mixer
1334     package: fluentd
1335     istio: mixer-adapter
1336 spec:
1337   group: config.istio.io
1338   names:
1339     kind: fluentd
1340     plural: fluentds
1341     singular: fluentd
1342     categories:
1343     - istio-io
1344     - policy-istio-io
1345   scope: Namespaced
1346   version: v1alpha2
1347 ---
1348
1349 kind: CustomResourceDefinition
1350 apiVersion: apiextensions.k8s.io/v1beta1
1351 metadata:
1352   name: kubernetesenvs.config.istio.io
1353   annotations:
1354     "helm.sh/hook": crd-install
1355   labels:
1356     app: mixer
1357     package: kubernetesenv
1358     istio: mixer-adapter
1359 spec:
1360   group: config.istio.io
1361   names:
1362     kind: kubernetesenv
1363     plural: kubernetesenvs
1364     singular: kubernetesenv
1365     categories:
1366     - istio-io
1367     - policy-istio-io
1368   scope: Namespaced
1369   version: v1alpha2
1370 ---
1371
1372 kind: CustomResourceDefinition
1373 apiVersion: apiextensions.k8s.io/v1beta1
1374 metadata:
1375   name: listcheckers.config.istio.io
1376   annotations:
1377     "helm.sh/hook": crd-install
1378   labels:
1379     app: mixer
1380     package: listchecker
1381     istio: mixer-adapter
1382 spec:
1383   group: config.istio.io
1384   names:
1385     kind: listchecker
1386     plural: listcheckers
1387     singular: listchecker
1388     categories:
1389     - istio-io
1390     - policy-istio-io
1391   scope: Namespaced
1392   version: v1alpha2
1393 ---
1394
1395 kind: CustomResourceDefinition
1396 apiVersion: apiextensions.k8s.io/v1beta1
1397 metadata:
1398   name: memquotas.config.istio.io
1399   annotations:
1400     "helm.sh/hook": crd-install
1401   labels:
1402     app: mixer
1403     package: memquota
1404     istio: mixer-adapter
1405 spec:
1406   group: config.istio.io
1407   names:
1408     kind: memquota
1409     plural: memquotas
1410     singular: memquota
1411     categories:
1412     - istio-io
1413     - policy-istio-io
1414   scope: Namespaced
1415   version: v1alpha2
1416 ---
1417
1418 kind: CustomResourceDefinition
1419 apiVersion: apiextensions.k8s.io/v1beta1
1420 metadata:
1421   name: noops.config.istio.io
1422   annotations:
1423     "helm.sh/hook": crd-install
1424   labels:
1425     app: mixer
1426     package: noop
1427     istio: mixer-adapter
1428 spec:
1429   group: config.istio.io
1430   names:
1431     kind: noop
1432     plural: noops
1433     singular: noop
1434     categories:
1435     - istio-io
1436     - policy-istio-io
1437   scope: Namespaced
1438   version: v1alpha2
1439 ---
1440
1441 kind: CustomResourceDefinition
1442 apiVersion: apiextensions.k8s.io/v1beta1
1443 metadata:
1444   name: opas.config.istio.io
1445   annotations:
1446     "helm.sh/hook": crd-install
1447   labels:
1448     app: mixer
1449     package: opa
1450     istio: mixer-adapter
1451 spec:
1452   group: config.istio.io
1453   names:
1454     kind: opa
1455     plural: opas
1456     singular: opa
1457     categories:
1458     - istio-io
1459     - policy-istio-io
1460   scope: Namespaced
1461   version: v1alpha2
1462 ---
1463
1464 kind: CustomResourceDefinition
1465 apiVersion: apiextensions.k8s.io/v1beta1
1466 metadata:
1467   name: prometheuses.config.istio.io
1468   annotations:
1469     "helm.sh/hook": crd-install
1470   labels:
1471     app: mixer
1472     package: prometheus
1473     istio: mixer-adapter
1474 spec:
1475   group: config.istio.io
1476   names:
1477     kind: prometheus
1478     plural: prometheuses
1479     singular: prometheus
1480     categories:
1481     - istio-io
1482     - policy-istio-io
1483   scope: Namespaced
1484   version: v1alpha2
1485 ---
1486
1487 kind: CustomResourceDefinition
1488 apiVersion: apiextensions.k8s.io/v1beta1
1489 metadata:
1490   name: rbacs.config.istio.io
1491   annotations:
1492     "helm.sh/hook": crd-install
1493   labels:
1494     app: mixer
1495     package: rbac
1496     istio: mixer-adapter
1497 spec:
1498   group: config.istio.io
1499   names:
1500     kind: rbac
1501     plural: rbacs
1502     singular: rbac
1503     categories:
1504     - istio-io
1505     - policy-istio-io
1506   scope: Namespaced
1507   version: v1alpha2
1508 ---
1509
1510 kind: CustomResourceDefinition
1511 apiVersion: apiextensions.k8s.io/v1beta1
1512 metadata:
1513   name: redisquotas.config.istio.io
1514   annotations:
1515     "helm.sh/hook": crd-install
1516   labels:
1517     package: redisquota
1518     istio: mixer-adapter
1519 spec:
1520   group: config.istio.io
1521   names:
1522     kind: redisquota
1523     plural: redisquotas
1524     singular: redisquota
1525   scope: Namespaced
1526   version: v1alpha2
1527 ---
1528
1529 kind: CustomResourceDefinition
1530 apiVersion: apiextensions.k8s.io/v1beta1
1531 metadata:
1532   name: servicecontrols.config.istio.io
1533   annotations:
1534     "helm.sh/hook": crd-install
1535   labels:
1536     app: mixer
1537     package: servicecontrol
1538     istio: mixer-adapter
1539 spec:
1540   group: config.istio.io
1541   names:
1542     kind: servicecontrol
1543     plural: servicecontrols
1544     singular: servicecontrol
1545     categories:
1546     - istio-io
1547     - policy-istio-io
1548   scope: Namespaced
1549   version: v1alpha2
1550
1551 ---
1552
1553 kind: CustomResourceDefinition
1554 apiVersion: apiextensions.k8s.io/v1beta1
1555 metadata:
1556   name: signalfxs.config.istio.io
1557   annotations:
1558     "helm.sh/hook": crd-install
1559   labels:
1560     app: mixer
1561     package: signalfx
1562     istio: mixer-adapter
1563 spec:
1564   group: config.istio.io
1565   names:
1566     kind: signalfx
1567     plural: signalfxs
1568     singular: signalfx
1569     categories:
1570     - istio-io
1571     - policy-istio-io
1572   scope: Namespaced
1573   version: v1alpha2
1574 ---
1575
1576 kind: CustomResourceDefinition
1577 apiVersion: apiextensions.k8s.io/v1beta1
1578 metadata:
1579   name: solarwindses.config.istio.io
1580   annotations:
1581     "helm.sh/hook": crd-install
1582   labels:
1583     app: mixer
1584     package: solarwinds
1585     istio: mixer-adapter
1586 spec:
1587   group: config.istio.io
1588   names:
1589     kind: solarwinds
1590     plural: solarwindses
1591     singular: solarwinds
1592     categories:
1593     - istio-io
1594     - policy-istio-io
1595   scope: Namespaced
1596   version: v1alpha2
1597 ---
1598
1599 kind: CustomResourceDefinition
1600 apiVersion: apiextensions.k8s.io/v1beta1
1601 metadata:
1602   name: stackdrivers.config.istio.io
1603   annotations:
1604     "helm.sh/hook": crd-install
1605   labels:
1606     app: mixer
1607     package: stackdriver
1608     istio: mixer-adapter
1609 spec:
1610   group: config.istio.io
1611   names:
1612     kind: stackdriver
1613     plural: stackdrivers
1614     singular: stackdriver
1615     categories:
1616     - istio-io
1617     - policy-istio-io
1618   scope: Namespaced
1619   version: v1alpha2
1620 ---
1621
1622 kind: CustomResourceDefinition
1623 apiVersion: apiextensions.k8s.io/v1beta1
1624 metadata:
1625   name: statsds.config.istio.io
1626   annotations:
1627     "helm.sh/hook": crd-install
1628   labels:
1629     app: mixer
1630     package: statsd
1631     istio: mixer-adapter
1632 spec:
1633   group: config.istio.io
1634   names:
1635     kind: statsd
1636     plural: statsds
1637     singular: statsd
1638     categories:
1639     - istio-io
1640     - policy-istio-io
1641   scope: Namespaced
1642   version: v1alpha2
1643 ---
1644
1645 kind: CustomResourceDefinition
1646 apiVersion: apiextensions.k8s.io/v1beta1
1647 metadata:
1648   name: stdios.config.istio.io
1649   annotations:
1650     "helm.sh/hook": crd-install
1651   labels:
1652     app: mixer
1653     package: stdio
1654     istio: mixer-adapter
1655 spec:
1656   group: config.istio.io
1657   names:
1658     kind: stdio
1659     plural: stdios
1660     singular: stdio
1661     categories:
1662     - istio-io
1663     - policy-istio-io
1664   scope: Namespaced
1665   version: v1alpha2
1666 ---
1667
1668 kind: CustomResourceDefinition
1669 apiVersion: apiextensions.k8s.io/v1beta1
1670 metadata:
1671   name: apikeys.config.istio.io
1672   annotations:
1673     "helm.sh/hook": crd-install
1674   labels:
1675     app: mixer
1676     package: apikey
1677     istio: mixer-instance
1678 spec:
1679   group: config.istio.io
1680   names:
1681     kind: apikey
1682     plural: apikeys
1683     singular: apikey
1684     categories:
1685     - istio-io
1686     - policy-istio-io
1687   scope: Namespaced
1688   version: v1alpha2
1689 ---
1690
1691 kind: CustomResourceDefinition
1692 apiVersion: apiextensions.k8s.io/v1beta1
1693 metadata:
1694   name: authorizations.config.istio.io
1695   annotations:
1696     "helm.sh/hook": crd-install
1697   labels:
1698     app: mixer
1699     package: authorization
1700     istio: mixer-instance
1701 spec:
1702   group: config.istio.io
1703   names:
1704     kind: authorization
1705     plural: authorizations
1706     singular: authorization
1707     categories:
1708     - istio-io
1709     - policy-istio-io
1710   scope: Namespaced
1711   version: v1alpha2
1712 ---
1713
1714 kind: CustomResourceDefinition
1715 apiVersion: apiextensions.k8s.io/v1beta1
1716 metadata:
1717   name: checknothings.config.istio.io
1718   annotations:
1719     "helm.sh/hook": crd-install
1720   labels:
1721     app: mixer
1722     package: checknothing
1723     istio: mixer-instance
1724 spec:
1725   group: config.istio.io
1726   names:
1727     kind: checknothing
1728     plural: checknothings
1729     singular: checknothing
1730     categories:
1731     - istio-io
1732     - policy-istio-io
1733   scope: Namespaced
1734   version: v1alpha2
1735 ---
1736
1737 kind: CustomResourceDefinition
1738 apiVersion: apiextensions.k8s.io/v1beta1
1739 metadata:
1740   name: kuberneteses.config.istio.io
1741   annotations:
1742     "helm.sh/hook": crd-install
1743   labels:
1744     app: mixer
1745     package: adapter.template.kubernetes
1746     istio: mixer-instance
1747 spec:
1748   group: config.istio.io
1749   names:
1750     kind: kubernetes
1751     plural: kuberneteses
1752     singular: kubernetes
1753     categories:
1754     - istio-io
1755     - policy-istio-io
1756   scope: Namespaced
1757   version: v1alpha2
1758 ---
1759
1760 kind: CustomResourceDefinition
1761 apiVersion: apiextensions.k8s.io/v1beta1
1762 metadata:
1763   name: listentries.config.istio.io
1764   annotations:
1765     "helm.sh/hook": crd-install
1766   labels:
1767     app: mixer
1768     package: listentry
1769     istio: mixer-instance
1770 spec:
1771   group: config.istio.io
1772   names:
1773     kind: listentry
1774     plural: listentries
1775     singular: listentry
1776     categories:
1777     - istio-io
1778     - policy-istio-io
1779   scope: Namespaced
1780   version: v1alpha2
1781 ---
1782
1783 kind: CustomResourceDefinition
1784 apiVersion: apiextensions.k8s.io/v1beta1
1785 metadata:
1786   name: logentries.config.istio.io
1787   annotations:
1788     "helm.sh/hook": crd-install
1789   labels:
1790     app: mixer
1791     package: logentry
1792     istio: mixer-instance
1793 spec:
1794   group: config.istio.io
1795   names:
1796     kind: logentry
1797     plural: logentries
1798     singular: logentry
1799     categories:
1800     - istio-io
1801     - policy-istio-io
1802   scope: Namespaced
1803   version: v1alpha2
1804 ---
1805
1806 kind: CustomResourceDefinition
1807 apiVersion: apiextensions.k8s.io/v1beta1
1808 metadata:
1809   name: edges.config.istio.io
1810   annotations:
1811     "helm.sh/hook": crd-install
1812   labels:
1813     app: mixer
1814     package: edge
1815     istio: mixer-instance
1816 spec:
1817   group: config.istio.io
1818   names:
1819     kind: edge
1820     plural: edges
1821     singular: edge
1822     categories:
1823     - istio-io
1824     - policy-istio-io
1825   scope: Namespaced
1826   version: v1alpha2
1827 ---
1828
1829 kind: CustomResourceDefinition
1830 apiVersion: apiextensions.k8s.io/v1beta1
1831 metadata:
1832   name: metrics.config.istio.io
1833   annotations:
1834     "helm.sh/hook": crd-install
1835   labels:
1836     app: mixer
1837     package: metric
1838     istio: mixer-instance
1839 spec:
1840   group: config.istio.io
1841   names:
1842     kind: metric
1843     plural: metrics
1844     singular: metric
1845     categories:
1846     - istio-io
1847     - policy-istio-io
1848   scope: Namespaced
1849   version: v1alpha2
1850 ---
1851
1852 kind: CustomResourceDefinition
1853 apiVersion: apiextensions.k8s.io/v1beta1
1854 metadata:
1855   name: quotas.config.istio.io
1856   annotations:
1857     "helm.sh/hook": crd-install
1858   labels:
1859     app: mixer
1860     package: quota
1861     istio: mixer-instance
1862 spec:
1863   group: config.istio.io
1864   names:
1865     kind: quota
1866     plural: quotas
1867     singular: quota
1868     categories:
1869     - istio-io
1870     - policy-istio-io
1871   scope: Namespaced
1872   version: v1alpha2
1873 ---
1874
1875 kind: CustomResourceDefinition
1876 apiVersion: apiextensions.k8s.io/v1beta1
1877 metadata:
1878   name: reportnothings.config.istio.io
1879   annotations:
1880     "helm.sh/hook": crd-install
1881   labels:
1882     app: mixer
1883     package: reportnothing
1884     istio: mixer-instance
1885 spec:
1886   group: config.istio.io
1887   names:
1888     kind: reportnothing
1889     plural: reportnothings
1890     singular: reportnothing
1891     categories:
1892     - istio-io
1893     - policy-istio-io
1894   scope: Namespaced
1895   version: v1alpha2
1896 ---
1897
1898 kind: CustomResourceDefinition
1899 apiVersion: apiextensions.k8s.io/v1beta1
1900 metadata:
1901   name: servicecontrolreports.config.istio.io
1902   annotations:
1903     "helm.sh/hook": crd-install
1904   labels:
1905     app: mixer
1906     package: servicecontrolreport
1907     istio: mixer-instance
1908 spec:
1909   group: config.istio.io
1910   names:
1911     kind: servicecontrolreport
1912     plural: servicecontrolreports
1913     singular: servicecontrolreport
1914     categories:
1915     - istio-io
1916     - policy-istio-io
1917   scope: Namespaced
1918   version: v1alpha2
1919 ---
1920
1921 kind: CustomResourceDefinition
1922 apiVersion: apiextensions.k8s.io/v1beta1
1923 metadata:
1924   name: tracespans.config.istio.io
1925   annotations:
1926     "helm.sh/hook": crd-install
1927   labels:
1928     app: mixer
1929     package: tracespan
1930     istio: mixer-instance
1931 spec:
1932   group: config.istio.io
1933   names:
1934     kind: tracespan
1935     plural: tracespans
1936     singular: tracespan
1937     categories:
1938     - istio-io
1939     - policy-istio-io
1940   scope: Namespaced
1941   version: v1alpha2
1942 ---
1943
1944 kind: CustomResourceDefinition
1945 apiVersion: apiextensions.k8s.io/v1beta1
1946 metadata:
1947   name: rbacconfigs.rbac.istio.io
1948   annotations:
1949     "helm.sh/hook": crd-install
1950   labels:
1951     app: mixer
1952     package: istio.io.mixer
1953     istio: rbac
1954 spec:
1955   group: rbac.istio.io
1956   names:
1957     kind: RbacConfig
1958     plural: rbacconfigs
1959     singular: rbacconfig
1960     categories:
1961     - istio-io
1962     - rbac-istio-io
1963   scope: Namespaced
1964   version: v1alpha1
1965 ---
1966
1967 kind: CustomResourceDefinition
1968 apiVersion: apiextensions.k8s.io/v1beta1
1969 metadata:
1970   name: serviceroles.rbac.istio.io
1971   annotations:
1972     "helm.sh/hook": crd-install
1973   labels:
1974     app: mixer
1975     package: istio.io.mixer
1976     istio: rbac
1977 spec:
1978   group: rbac.istio.io
1979   names:
1980     kind: ServiceRole
1981     plural: serviceroles
1982     singular: servicerole
1983     categories:
1984     - istio-io
1985     - rbac-istio-io
1986   scope: Namespaced
1987   version: v1alpha1
1988 ---
1989
1990 kind: CustomResourceDefinition
1991 apiVersion: apiextensions.k8s.io/v1beta1
1992 metadata:
1993   name: servicerolebindings.rbac.istio.io
1994   annotations:
1995     "helm.sh/hook": crd-install
1996   labels:
1997     app: mixer
1998     package: istio.io.mixer
1999     istio: rbac
2000 spec:
2001   group: rbac.istio.io
2002   names:
2003     kind: ServiceRoleBinding
2004     plural: servicerolebindings
2005     singular: servicerolebinding
2006     categories:
2007     - istio-io
2008     - rbac-istio-io
2009   scope: Namespaced
2010   version: v1alpha1
2011 ---
2012 kind: CustomResourceDefinition
2013 apiVersion: apiextensions.k8s.io/v1beta1
2014 metadata:
2015   name: adapters.config.istio.io
2016   annotations:
2017     "helm.sh/hook": crd-install
2018   labels:
2019     app: mixer
2020     package: adapter
2021     istio: mixer-adapter
2022 spec:
2023   group: config.istio.io
2024   names:
2025     kind: adapter
2026     plural: adapters
2027     singular: adapter
2028     categories:
2029     - istio-io
2030     - policy-istio-io
2031   scope: Namespaced
2032   version: v1alpha2
2033 ---
2034 kind: CustomResourceDefinition
2035 apiVersion: apiextensions.k8s.io/v1beta1
2036 metadata:
2037   name: instances.config.istio.io
2038   annotations:
2039     "helm.sh/hook": crd-install
2040   labels:
2041     app: mixer
2042     package: instance
2043     istio: mixer-instance
2044 spec:
2045   group: config.istio.io
2046   names:
2047     kind: instance
2048     plural: instances
2049     singular: instance
2050     categories:
2051     - istio-io
2052     - policy-istio-io
2053   scope: Namespaced
2054   version: v1alpha2
2055 ---
2056 kind: CustomResourceDefinition
2057 apiVersion: apiextensions.k8s.io/v1beta1
2058 metadata:
2059   name: templates.config.istio.io
2060   annotations:
2061     "helm.sh/hook": crd-install
2062   labels:
2063     app: mixer
2064     package: template
2065     istio: mixer-template
2066 spec:
2067   group: config.istio.io
2068   names:
2069     kind: template
2070     plural: templates
2071     singular: template
2072     categories:
2073     - istio-io
2074     - policy-istio-io
2075   scope: Namespaced
2076   version: v1alpha2
2077 ---
2078 kind: CustomResourceDefinition
2079 apiVersion: apiextensions.k8s.io/v1beta1
2080 metadata:
2081   name: handlers.config.istio.io
2082   annotations:
2083     "helm.sh/hook": crd-install
2084   labels:
2085     app: mixer
2086     package: handler
2087     istio: mixer-handler
2088 spec:
2089   group: config.istio.io
2090   names:
2091     kind: handler
2092     plural: handlers
2093     singular: handler
2094     categories:
2095     - istio-io
2096     - policy-istio-io
2097   scope: Namespaced
2098   version: v1alpha2
2099 ---
2100 #
2101 #
2102 ---
2103 # Source: istio/charts/galley/templates/clusterrole.yaml
2104 apiVersion: rbac.authorization.k8s.io/v1beta1
2105 kind: ClusterRole
2106 metadata:
2107   name: istio-galley-istio-system
2108   labels:
2109     app: istio-galley
2110     chart: galley-1.0.0
2111     heritage: Tiller
2112     release: RELEASE-NAME
2113 rules:
2114 - apiGroups: ["admissionregistration.k8s.io"]
2115   resources: ["validatingwebhookconfigurations"]
2116   verbs: ["*"]
2117 - apiGroups: ["config.istio.io"] # istio mixer CRD watcher
2118   resources: ["*"]
2119   verbs: ["get", "list", "watch"]
2120 - apiGroups: ["*"]
2121   resources: ["deployments"]
2122   resourceNames: ["istio-galley"]
2123   verbs: ["get"]
2124
2125 ---
2126 # Source: istio/charts/gateways/templates/clusterrole.yaml
2127
2128 apiVersion: rbac.authorization.k8s.io/v1beta1
2129 kind: ClusterRole
2130 metadata:
2131   labels:
2132     app: gateways
2133     chart: gateways-1.0.0
2134     heritage: Tiller
2135     release: RELEASE-NAME
2136   name: istio-egressgateway-istio-system
2137 rules:
2138 - apiGroups: ["extensions"]
2139   resources: ["thirdpartyresources", "virtualservices", "destinationrules", "gateways"]
2140   verbs: ["get", "watch", "list", "update"]
2141 ---
2142 apiVersion: rbac.authorization.k8s.io/v1beta1
2143 kind: ClusterRole
2144 metadata:
2145   labels:
2146     app: gateways
2147     chart: gateways-1.0.0
2148     heritage: Tiller
2149     release: RELEASE-NAME
2150   name: istio-ingressgateway-istio-system
2151 rules:
2152 - apiGroups: ["extensions"]
2153   resources: ["thirdpartyresources", "virtualservices", "destinationrules", "gateways"]
2154   verbs: ["get", "watch", "list", "update"]
2155 ---
2156
2157 ---
2158 # Source: istio/charts/mixer/templates/clusterrole.yaml
2159 apiVersion: rbac.authorization.k8s.io/v1beta1
2160 kind: ClusterRole
2161 metadata:
2162   name: istio-mixer-istio-system
2163   labels:
2164     app: mixer
2165     chart: mixer-1.0.0
2166     heritage: Tiller
2167     release: RELEASE-NAME
2168 rules:
2169 - apiGroups: ["config.istio.io"] # istio CRD watcher
2170   resources: ["*"]
2171   verbs: ["create", "get", "list", "watch", "patch"]
2172 - apiGroups: ["rbac.istio.io"] # istio RBAC watcher
2173   resources: ["*"]
2174   verbs: ["get", "list", "watch"]
2175 - apiGroups: ["apiextensions.k8s.io"]
2176   resources: ["customresourcedefinitions"]
2177   verbs: ["get", "list", "watch"]
2178 - apiGroups: [""]
2179   resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets"]
2180   verbs: ["get", "list", "watch"]
2181 - apiGroups: ["extensions"]
2182   resources: ["replicasets"]
2183   verbs: ["get", "list", "watch"]
2184 - apiGroups: ["apps"]
2185   resources: ["replicasets"]
2186   verbs: ["get", "list", "watch"]
2187
2188 ---
2189 # Source: istio/charts/pilot/templates/clusterrole.yaml
2190 apiVersion: rbac.authorization.k8s.io/v1beta1
2191 kind: ClusterRole
2192 metadata:
2193   name: istio-pilot-istio-system
2194   labels:
2195     app: istio-pilot
2196     chart: pilot-1.0.0
2197     heritage: Tiller
2198     release: RELEASE-NAME
2199 rules:
2200 - apiGroups: ["config.istio.io"]
2201   resources: ["*"]
2202   verbs: ["*"]
2203 - apiGroups: ["rbac.istio.io"]
2204   resources: ["*"]
2205   verbs: ["get", "watch", "list"]
2206 - apiGroups: ["networking.istio.io"]
2207   resources: ["*"]
2208   verbs: ["*"]
2209 - apiGroups: ["authentication.istio.io"]
2210   resources: ["*"]
2211   verbs: ["*"]
2212 - apiGroups: ["apiextensions.k8s.io"]
2213   resources: ["customresourcedefinitions"]
2214   verbs: ["*"]
2215 - apiGroups: ["extensions"]
2216   resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses", "ingresses/status"]
2217   verbs: ["*"]
2218 - apiGroups: [""]
2219   resources: ["configmaps"]
2220   verbs: ["create", "get", "list", "watch", "update"]
2221 - apiGroups: [""]
2222   resources: ["endpoints", "pods", "services"]
2223   verbs: ["get", "list", "watch"]
2224 - apiGroups: [""]
2225   resources: ["namespaces", "nodes", "secrets"]
2226   verbs: ["get", "list", "watch"]
2227
2228 ---
2229 # Source: istio/charts/prometheus/templates/clusterrole.yaml
2230 apiVersion: rbac.authorization.k8s.io/v1beta1
2231 kind: ClusterRole
2232 metadata:
2233   name: prometheus-istio-system
2234 rules:
2235 - apiGroups: [""]
2236   resources:
2237   - nodes
2238   - services
2239   - endpoints
2240   - pods
2241   - nodes/proxy
2242   verbs: ["get", "list", "watch"]
2243 - apiGroups: [""]
2244   resources:
2245   - configmaps
2246   verbs: ["get"]
2247 - nonResourceURLs: ["/metrics"]
2248   verbs: ["get"]
2249
2250 ---
2251 # Source: istio/charts/security/templates/clusterrole.yaml
2252 apiVersion: rbac.authorization.k8s.io/v1beta1
2253 kind: ClusterRole
2254 metadata:
2255   name: istio-citadel-istio-system
2256   labels:
2257     app: security
2258     chart: security-1.0.0
2259     heritage: Tiller
2260     release: RELEASE-NAME
2261 rules:
2262 - apiGroups: [""]
2263   resources: ["secrets"]
2264   verbs: ["create", "get", "watch", "list", "update", "delete"]
2265 - apiGroups: [""]
2266   resources: ["serviceaccounts"]
2267   verbs: ["get", "watch", "list"]
2268 - apiGroups: [""]
2269   resources: ["services"]
2270   verbs: ["get", "watch", "list"]
2271
2272 ---
2273 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml
2274 apiVersion: rbac.authorization.k8s.io/v1beta1
2275 kind: ClusterRole
2276 metadata:
2277   name: istio-sidecar-injector-istio-system
2278   labels:
2279     app: istio-sidecar-injector
2280     chart: sidecarInjectorWebhook-1.0.0
2281     heritage: Tiller
2282     release: RELEASE-NAME
2283 rules:
2284 - apiGroups: ["*"]
2285   resources: ["configmaps"]
2286   verbs: ["get", "list", "watch"]
2287 - apiGroups: ["admissionregistration.k8s.io"]
2288   resources: ["mutatingwebhookconfigurations"]
2289   verbs: ["get", "list", "watch", "patch"]
2290
2291 ---
2292 # Source: istio/charts/galley/templates/clusterrolebinding.yaml
2293 apiVersion: rbac.authorization.k8s.io/v1beta1
2294 kind: ClusterRoleBinding
2295 metadata:
2296   name: istio-galley-admin-role-binding-istio-system
2297   labels:
2298     app: istio-galley
2299     chart: galley-1.0.0
2300     heritage: Tiller
2301     release: RELEASE-NAME
2302 roleRef:
2303   apiGroup: rbac.authorization.k8s.io
2304   kind: ClusterRole
2305   name: istio-galley-istio-system
2306 subjects:
2307   - kind: ServiceAccount
2308     name: istio-galley-service-account
2309     namespace: istio-system
2310
2311 ---
2312 # Source: istio/charts/gateways/templates/clusterrolebindings.yaml
2313
2314 apiVersion: rbac.authorization.k8s.io/v1beta1
2315 kind: ClusterRoleBinding
2316 metadata:
2317   name: istio-egressgateway-istio-system
2318 roleRef:
2319   apiGroup: rbac.authorization.k8s.io
2320   kind: ClusterRole
2321   name: istio-egressgateway-istio-system
2322 subjects:
2323   - kind: ServiceAccount
2324     name: istio-egressgateway-service-account
2325     namespace: istio-system
2326 ---
2327 apiVersion: rbac.authorization.k8s.io/v1beta1
2328 kind: ClusterRoleBinding
2329 metadata:
2330   name: istio-ingressgateway-istio-system
2331 roleRef:
2332   apiGroup: rbac.authorization.k8s.io
2333   kind: ClusterRole
2334   name: istio-ingressgateway-istio-system
2335 subjects:
2336   - kind: ServiceAccount
2337     name: istio-ingressgateway-service-account
2338     namespace: istio-system
2339 ---
2340
2341 ---
2342 # Source: istio/charts/mixer/templates/clusterrolebinding.yaml
2343 apiVersion: rbac.authorization.k8s.io/v1beta1
2344 kind: ClusterRoleBinding
2345 metadata:
2346   name: istio-mixer-admin-role-binding-istio-system
2347   labels:
2348     app: mixer
2349     chart: mixer-1.0.0
2350     heritage: Tiller
2351     release: RELEASE-NAME
2352 roleRef:
2353   apiGroup: rbac.authorization.k8s.io
2354   kind: ClusterRole
2355   name: istio-mixer-istio-system
2356 subjects:
2357   - kind: ServiceAccount
2358     name: istio-mixer-service-account
2359     namespace: istio-system
2360
2361 ---
2362 # Source: istio/charts/pilot/templates/clusterrolebinding.yaml
2363 apiVersion: rbac.authorization.k8s.io/v1beta1
2364 kind: ClusterRoleBinding
2365 metadata:
2366   name: istio-pilot-istio-system
2367   labels:
2368     app: istio-pilot
2369     chart: pilot-1.0.0
2370     heritage: Tiller
2371     release: RELEASE-NAME
2372 roleRef:
2373   apiGroup: rbac.authorization.k8s.io
2374   kind: ClusterRole
2375   name: istio-pilot-istio-system
2376 subjects:
2377   - kind: ServiceAccount
2378     name: istio-pilot-service-account
2379     namespace: istio-system
2380
2381 ---
2382 # Source: istio/charts/prometheus/templates/clusterrolebindings.yaml
2383 apiVersion: rbac.authorization.k8s.io/v1beta1
2384 kind: ClusterRoleBinding
2385 metadata:
2386   name: prometheus-istio-system
2387 roleRef:
2388   apiGroup: rbac.authorization.k8s.io
2389   kind: ClusterRole
2390   name: prometheus-istio-system
2391 subjects:
2392 - kind: ServiceAccount
2393   name: prometheus
2394   namespace: istio-system
2395
2396 ---
2397 # Source: istio/charts/security/templates/clusterrolebinding.yaml
2398 apiVersion: rbac.authorization.k8s.io/v1beta1
2399 kind: ClusterRoleBinding
2400 metadata:
2401   name: istio-citadel-istio-system
2402   labels:
2403     app: security
2404     chart: security-1.0.0
2405     heritage: Tiller
2406     release: RELEASE-NAME
2407 roleRef:
2408   apiGroup: rbac.authorization.k8s.io
2409   kind: ClusterRole
2410   name: istio-citadel-istio-system
2411 subjects:
2412   - kind: ServiceAccount
2413     name: istio-citadel-service-account
2414     namespace: istio-system
2415
2416 ---
2417 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml
2418 apiVersion: rbac.authorization.k8s.io/v1beta1
2419 kind: ClusterRoleBinding
2420 metadata:
2421   name: istio-sidecar-injector-admin-role-binding-istio-system
2422   labels:
2423     app: istio-sidecar-injector
2424     chart: sidecarInjectorWebhook-1.0.0
2425     heritage: Tiller
2426     release: RELEASE-NAME
2427 roleRef:
2428   apiGroup: rbac.authorization.k8s.io
2429   kind: ClusterRole
2430   name: istio-sidecar-injector-istio-system
2431 subjects:
2432   - kind: ServiceAccount
2433     name: istio-sidecar-injector-service-account
2434     namespace: istio-system
2435
2436 ---
2437 # Source: istio/charts/galley/templates/service.yaml
2438 apiVersion: v1
2439 kind: Service
2440 metadata:
2441   name: istio-galley
2442   namespace: istio-system
2443   labels:
2444     istio: galley
2445 spec:
2446   ports:
2447   - port: 443
2448     name: https-validation
2449   - port: 9093
2450     name: http-monitoring
2451   selector:
2452     istio: galley
2453
2454 ---
2455 # Source: istio/charts/gateways/templates/service.yaml
2456
2457 apiVersion: v1
2458 kind: Service
2459 metadata:
2460   name: istio-egressgateway
2461   namespace: istio-system
2462   annotations:
2463   labels:
2464     chart: gateways-1.0.0
2465     release: RELEASE-NAME
2466     heritage: Tiller
2467     app: istio-egressgateway
2468     istio: egressgateway
2469 spec:
2470   type: ClusterIP
2471   selector:
2472     app: istio-egressgateway
2473     istio: egressgateway
2474   ports:
2475     -
2476       name: http2
2477       port: 80
2478     -
2479       name: https
2480       port: 443
2481 ---
2482 apiVersion: v1
2483 kind: Service
2484 metadata:
2485   name: istio-ingressgateway
2486   namespace: istio-system
2487   annotations:
2488   labels:
2489     chart: gateways-1.0.0
2490     release: RELEASE-NAME
2491     heritage: Tiller
2492     app: istio-ingressgateway
2493     istio: ingressgateway
2494 spec:
2495   type: LoadBalancer
2496   selector:
2497     app: istio-ingressgateway
2498     istio: ingressgateway
2499   ports:
2500     -
2501       name: http2
2502       nodePort: 31380
2503       port: 80
2504       targetPort: 80
2505     -
2506       name: https
2507       nodePort: 31390
2508       port: 443
2509     -
2510       name: tcp
2511       nodePort: 31400
2512       port: 31400
2513     -
2514       name: tcp-pilot-grpc-tls
2515       port: 15011
2516       targetPort: 15011
2517     -
2518       name: tcp-citadel-grpc-tls
2519       port: 8060
2520       targetPort: 8060
2521     -
2522       name: http2-prometheus
2523       port: 15030
2524       targetPort: 15030
2525     -
2526       name: http2-grafana
2527       port: 15031
2528       targetPort: 15031
2529 ---
2530
2531 ---
2532 # Source: istio/charts/grafana/templates/service.yaml
2533 apiVersion: v1
2534 kind: Service
2535 metadata:
2536   name: grafana
2537   namespace: istio-system
2538   annotations:
2539   labels:
2540     app: grafana
2541     chart: grafana-0.1.0
2542     release: RELEASE-NAME
2543     heritage: Tiller
2544 spec:
2545   type: NodePort
2546   ports:
2547     - port: 3000
2548       targetPort: 3000
2549       protocol: TCP
2550       name: http
2551       nodePort: 30300
2552   selector:
2553     app: grafana
2554
2555 ---
2556 # Source: istio/charts/mixer/templates/service.yaml
2557
2558 apiVersion: v1
2559 kind: Service
2560 metadata:
2561   name: istio-policy
2562   namespace: istio-system
2563   labels:
2564     chart: mixer-1.0.0
2565     release: RELEASE-NAME
2566     istio: mixer
2567 spec:
2568   ports:
2569   - name: grpc-mixer
2570     port: 9091
2571   - name: grpc-mixer-mtls
2572     port: 15004
2573   - name: http-monitoring
2574     port: 9093
2575   selector:
2576     istio: mixer
2577     istio-mixer-type: policy
2578 ---
2579 apiVersion: v1
2580 kind: Service
2581 metadata:
2582   name: istio-telemetry
2583   namespace: istio-system
2584   labels:
2585     chart: mixer-1.0.0
2586     release: RELEASE-NAME
2587     istio: mixer
2588 spec:
2589   ports:
2590   - name: grpc-mixer
2591     port: 9091
2592   - name: grpc-mixer-mtls
2593     port: 15004
2594   - name: http-monitoring
2595     port: 9093
2596   - name: prometheus
2597     port: 42422
2598   selector:
2599     istio: mixer
2600     istio-mixer-type: telemetry
2601 ---
2602
2603 ---
2604 # Source: istio/charts/mixer/templates/statsdtoprom.yaml
2605
2606 ---
2607 apiVersion: v1
2608 kind: Service
2609 metadata:
2610   name: istio-statsd-prom-bridge
2611   namespace: istio-system
2612   labels:
2613     chart: mixer-1.0.0
2614     release: RELEASE-NAME
2615     istio: statsd-prom-bridge
2616 spec:
2617   ports:
2618   - name: statsd-prom
2619     port: 9102
2620   - name: statsd-udp
2621     port: 9125
2622     protocol: UDP
2623   selector:
2624     istio: statsd-prom-bridge
2625
2626 ---
2627
2628 apiVersion: extensions/v1beta1
2629 kind: Deployment
2630 metadata:
2631   name: istio-statsd-prom-bridge
2632   namespace: istio-system
2633   labels:
2634     chart: mixer-1.0.0
2635     release: RELEASE-NAME
2636     istio: mixer
2637 spec:
2638   template:
2639     metadata:
2640       labels:
2641         istio: statsd-prom-bridge
2642       annotations:
2643         sidecar.istio.io/inject: "false"
2644     spec:
2645       serviceAccountName: istio-mixer-service-account
2646       volumes:
2647       - name: config-volume
2648         configMap:
2649           name: istio-statsd-prom-bridge
2650       containers:
2651       - name: statsd-prom-bridge
2652         image: "docker.io/prom/statsd-exporter:v0.6.0"
2653         imagePullPolicy: IfNotPresent
2654         ports:
2655         - containerPort: 9102
2656         - containerPort: 9125
2657           protocol: UDP
2658         args:
2659         - '-statsd.mapping-config=/etc/statsd/mapping.conf'
2660         resources:
2661           requests:
2662             cpu: 10m
2663
2664         volumeMounts:
2665         - name: config-volume
2666           mountPath: /etc/statsd
2667
2668 ---
2669 # Source: istio/charts/pilot/templates/service.yaml
2670 apiVersion: v1
2671 kind: Service
2672 metadata:
2673   name: istio-pilot
2674   namespace: istio-system
2675   labels:
2676     app: istio-pilot
2677     chart: pilot-1.0.0
2678     release: RELEASE-NAME
2679     heritage: Tiller
2680 spec:
2681   ports:
2682   - port: 15010
2683     name: grpc-xds # direct
2684   - port: 15011
2685     name: https-xds # mTLS
2686   - port: 8080
2687     name: http-legacy-discovery # direct
2688   - port: 9093
2689     name: http-monitoring
2690   selector:
2691     istio: pilot
2692
2693 ---
2694 # Source: istio/charts/prometheus/templates/service.yaml
2695 apiVersion: v1
2696 kind: Service
2697 metadata:
2698   name: prometheus
2699   namespace: istio-system
2700   annotations:
2701     prometheus.io/scrape: 'true'
2702   labels:
2703     name: prometheus
2704 spec:
2705   selector:
2706     app: prometheus
2707   ports:
2708   - name: http-prometheus
2709     protocol: TCP
2710     port: 9090
2711
2712 ---
2713 # Source: istio/charts/security/templates/service.yaml
2714 apiVersion: v1
2715 kind: Service
2716 metadata:
2717   # we use the normal name here (e.g. 'prometheus')
2718   # as grafana is configured to use this as a data source
2719   name: istio-citadel
2720   namespace: istio-system
2721   labels:
2722     app: istio-citadel
2723 spec:
2724   ports:
2725     - name: grpc-citadel
2726       port: 8060
2727       targetPort: 8060
2728       protocol: TCP
2729     - name: http-monitoring
2730       port: 9093
2731   selector:
2732     istio: citadel
2733
2734 ---
2735 # Source: istio/charts/servicegraph/templates/service.yaml
2736 apiVersion: v1
2737 kind: Service
2738 metadata:
2739   name: servicegraph
2740   namespace: istio-system
2741   annotations:
2742   labels:
2743     app: servicegraph
2744     chart: servicegraph-0.1.0
2745     release: RELEASE-NAME
2746     heritage: Tiller
2747 spec:
2748   type: NodePort
2749   ports:
2750     - port: 8088
2751       targetPort: 8088
2752       protocol: TCP
2753       name: http
2754       nodePort: 30088
2755   selector:
2756     app: servicegraph
2757
2758 ---
2759 # Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml
2760 apiVersion: v1
2761 kind: Service
2762 metadata:
2763   name: istio-sidecar-injector
2764   namespace: istio-system
2765   labels:
2766     istio: sidecar-injector
2767 spec:
2768   ports:
2769   - port: 443
2770   selector:
2771     istio: sidecar-injector
2772
2773 ---
2774 # Source: istio/charts/galley/templates/deployment.yaml
2775 apiVersion: extensions/v1beta1
2776 kind: Deployment
2777 metadata:
2778   name: istio-galley
2779   namespace: istio-system
2780   labels:
2781     app: galley
2782     chart: galley-1.0.0
2783     release: RELEASE-NAME
2784     heritage: Tiller
2785     istio: galley
2786 spec:
2787   replicas: 1
2788   strategy:
2789     rollingUpdate:
2790       maxSurge: 1
2791       maxUnavailable: 0
2792   template:
2793     metadata:
2794       labels:
2795         istio: galley
2796       annotations:
2797         sidecar.istio.io/inject: "false"
2798         scheduler.alpha.kubernetes.io/critical-pod: ""
2799     spec:
2800       serviceAccountName: istio-galley-service-account
2801       containers:
2802         - name: validator
2803           image: "gcr.io/istio-release/galley:1.0.0"
2804           imagePullPolicy: IfNotPresent
2805           ports:
2806           - containerPort: 443
2807           - containerPort: 9093
2808           command:
2809           - /usr/local/bin/galley
2810           - validator
2811           - --deployment-namespace=istio-system
2812           - --caCertFile=/etc/istio/certs/root-cert.pem
2813           - --tlsCertFile=/etc/istio/certs/cert-chain.pem
2814           - --tlsKeyFile=/etc/istio/certs/key.pem
2815           - --healthCheckInterval=2s
2816           - --healthCheckFile=/health
2817           - --webhook-config-file
2818           - /etc/istio/config/validatingwebhookconfiguration.yaml
2819           volumeMounts:
2820           - name: certs
2821             mountPath: /etc/istio/certs
2822             readOnly: true
2823           - name: config
2824             mountPath: /etc/istio/config
2825             readOnly: true
2826           livenessProbe:
2827             exec:
2828               command:
2829                 - /usr/local/bin/galley
2830                 - probe
2831                 - --probe-path=/health
2832                 - --interval=4s
2833             initialDelaySeconds: 4
2834             periodSeconds: 4
2835           readinessProbe:
2836             exec:
2837               command:
2838                 - /usr/local/bin/galley
2839                 - probe
2840                 - --probe-path=/health
2841                 - --interval=4s
2842             initialDelaySeconds: 4
2843             periodSeconds: 4
2844           resources:
2845             requests:
2846               cpu: 10m
2847
2848       volumes:
2849       - name: certs
2850         secret:
2851           secretName: istio.istio-galley-service-account
2852       - name: config
2853         configMap:
2854           name: istio-galley-configuration
2855       affinity:
2856         nodeAffinity:
2857           requiredDuringSchedulingIgnoredDuringExecution:
2858             nodeSelectorTerms:
2859             - matchExpressions:
2860               - key: beta.kubernetes.io/arch
2861                 operator: In
2862                 values:
2863                 - amd64
2864                 - ppc64le
2865                 - s390x
2866           preferredDuringSchedulingIgnoredDuringExecution:
2867           - weight: 2
2868             preference:
2869               matchExpressions:
2870               - key: beta.kubernetes.io/arch
2871                 operator: In
2872                 values:
2873                 - amd64
2874           - weight: 2
2875             preference:
2876               matchExpressions:
2877               - key: beta.kubernetes.io/arch
2878                 operator: In
2879                 values:
2880                 - ppc64le
2881           - weight: 2
2882             preference:
2883               matchExpressions:
2884               - key: beta.kubernetes.io/arch
2885                 operator: In
2886                 values:
2887                 - s390x
2888
2889 ---
2890 # Source: istio/charts/gateways/templates/deployment.yaml
2891
2892 apiVersion: extensions/v1beta1
2893 kind: Deployment
2894 metadata:
2895   name: istio-egressgateway
2896   namespace: istio-system
2897   labels:
2898     app: egressgateway
2899     chart: gateways-1.0.0
2900     release: RELEASE-NAME
2901     heritage: Tiller
2902     app: istio-egressgateway
2903     istio: egressgateway
2904 spec:
2905   replicas: 1
2906   template:
2907     metadata:
2908       labels:
2909         app: istio-egressgateway
2910         istio: egressgateway
2911       annotations:
2912         sidecar.istio.io/inject: "false"
2913         scheduler.alpha.kubernetes.io/critical-pod: ""
2914     spec:
2915       serviceAccountName: istio-egressgateway-service-account
2916       containers:
2917         - name: egressgateway
2918           image: "gcr.io/istio-release/proxyv2:1.0.0"
2919           imagePullPolicy: IfNotPresent
2920           ports:
2921             - containerPort: 80
2922             - containerPort: 443
2923           args:
2924           - proxy
2925           - router
2926           - -v
2927           - "2"
2928           - --discoveryRefreshDelay
2929           - '1s' #discoveryRefreshDelay
2930           - --drainDuration
2931           - '45s' #drainDuration
2932           - --parentShutdownDuration
2933           - '1m0s' #parentShutdownDuration
2934           - --connectTimeout
2935           - '10s' #connectTimeout
2936           - --serviceCluster
2937           - istio-egressgateway
2938           - --zipkinAddress
2939           - zipkin:9411
2940           - --statsdUdpAddress
2941           - istio-statsd-prom-bridge:9125
2942           - --proxyAdminPort
2943           - "15000"
2944           - --controlPlaneAuthPolicy
2945           - NONE
2946           - --discoveryAddress
2947           - istio-pilot.istio-system:8080
2948           resources:
2949             requests:
2950               cpu: 10m
2951
2952           env:
2953           - name: POD_NAME
2954             valueFrom:
2955               fieldRef:
2956                 apiVersion: v1
2957                 fieldPath: metadata.name
2958           - name: POD_NAMESPACE
2959             valueFrom:
2960               fieldRef:
2961                 apiVersion: v1
2962                 fieldPath: metadata.namespace
2963           - name: INSTANCE_IP
2964             valueFrom:
2965               fieldRef:
2966                 apiVersion: v1
2967                 fieldPath: status.podIP
2968           - name: ISTIO_META_POD_NAME
2969             valueFrom:
2970               fieldRef:
2971                 fieldPath: metadata.name
2972           volumeMounts:
2973           - name: istio-certs
2974             mountPath: /etc/certs
2975             readOnly: true
2976           - name: egressgateway-certs
2977             mountPath: "/etc/istio/egressgateway-certs"
2978             readOnly: true
2979           - name: egressgateway-ca-certs
2980             mountPath: "/etc/istio/egressgateway-ca-certs"
2981             readOnly: true
2982       volumes:
2983       - name: istio-certs
2984         secret:
2985           secretName: istio.istio-egressgateway-service-account
2986           optional: true
2987       - name: egressgateway-certs
2988         secret:
2989           secretName: "istio-egressgateway-certs"
2990           optional: true
2991       - name: egressgateway-ca-certs
2992         secret:
2993           secretName: "istio-egressgateway-ca-certs"
2994           optional: true
2995       affinity:
2996         nodeAffinity:
2997           requiredDuringSchedulingIgnoredDuringExecution:
2998             nodeSelectorTerms:
2999             - matchExpressions:
3000               - key: beta.kubernetes.io/arch
3001                 operator: In
3002                 values:
3003                 - amd64
3004                 - ppc64le
3005                 - s390x
3006           preferredDuringSchedulingIgnoredDuringExecution:
3007           - weight: 2
3008             preference:
3009               matchExpressions:
3010               - key: beta.kubernetes.io/arch
3011                 operator: In
3012                 values:
3013                 - amd64
3014           - weight: 2
3015             preference:
3016               matchExpressions:
3017               - key: beta.kubernetes.io/arch
3018                 operator: In
3019                 values:
3020                 - ppc64le
3021           - weight: 2
3022             preference:
3023               matchExpressions:
3024               - key: beta.kubernetes.io/arch
3025                 operator: In
3026                 values:
3027                 - s390x
3028 ---
3029 apiVersion: extensions/v1beta1
3030 kind: Deployment
3031 metadata:
3032   name: istio-ingressgateway
3033   namespace: istio-system
3034   labels:
3035     app: ingressgateway
3036     chart: gateways-1.0.0
3037     release: RELEASE-NAME
3038     heritage: Tiller
3039     app: istio-ingressgateway
3040     istio: ingressgateway
3041 spec:
3042   replicas: 1
3043   template:
3044     metadata:
3045       labels:
3046         app: istio-ingressgateway
3047         istio: ingressgateway
3048       annotations:
3049         sidecar.istio.io/inject: "false"
3050         scheduler.alpha.kubernetes.io/critical-pod: ""
3051     spec:
3052       serviceAccountName: istio-ingressgateway-service-account
3053       containers:
3054         - name: ingressgateway
3055           image: "gcr.io/istio-release/proxyv2:1.0.0"
3056           imagePullPolicy: IfNotPresent
3057           ports:
3058             - containerPort: 80
3059             - containerPort: 443
3060             - containerPort: 31400
3061             - containerPort: 15011
3062             - containerPort: 8060
3063             - containerPort: 15030
3064             - containerPort: 15031
3065           args:
3066           - proxy
3067           - router
3068           - -v
3069           - "2"
3070           - --discoveryRefreshDelay
3071           - '1s' #discoveryRefreshDelay
3072           - --drainDuration
3073           - '45s' #drainDuration
3074           - --parentShutdownDuration
3075           - '1m0s' #parentShutdownDuration
3076           - --connectTimeout
3077           - '10s' #connectTimeout
3078           - --serviceCluster
3079           - istio-ingressgateway
3080           - --zipkinAddress
3081           - zipkin:9411
3082           - --statsdUdpAddress
3083           - istio-statsd-prom-bridge:9125
3084           - --proxyAdminPort
3085           - "15000"
3086           - --controlPlaneAuthPolicy
3087           - NONE
3088           - --discoveryAddress
3089           - istio-pilot.istio-system:8080
3090           resources:
3091             requests:
3092               cpu: 10m
3093
3094           env:
3095           - name: POD_NAME
3096             valueFrom:
3097               fieldRef:
3098                 apiVersion: v1
3099                 fieldPath: metadata.name
3100           - name: POD_NAMESPACE
3101             valueFrom:
3102               fieldRef:
3103                 apiVersion: v1
3104                 fieldPath: metadata.namespace
3105           - name: INSTANCE_IP
3106             valueFrom:
3107               fieldRef:
3108                 apiVersion: v1
3109                 fieldPath: status.podIP
3110           - name: ISTIO_META_POD_NAME
3111             valueFrom:
3112               fieldRef:
3113                 fieldPath: metadata.name
3114           volumeMounts:
3115           - name: istio-certs
3116             mountPath: /etc/certs
3117             readOnly: true
3118           - name: ingressgateway-certs
3119             mountPath: "/etc/istio/ingressgateway-certs"
3120             readOnly: true
3121           - name: ingressgateway-ca-certs
3122             mountPath: "/etc/istio/ingressgateway-ca-certs"
3123             readOnly: true
3124       volumes:
3125       - name: istio-certs
3126         secret:
3127           secretName: istio.istio-ingressgateway-service-account
3128           optional: true
3129       - name: ingressgateway-certs
3130         secret:
3131           secretName: "istio-ingressgateway-certs"
3132           optional: true
3133       - name: ingressgateway-ca-certs
3134         secret:
3135           secretName: "istio-ingressgateway-ca-certs"
3136           optional: true
3137       affinity:
3138         nodeAffinity:
3139           requiredDuringSchedulingIgnoredDuringExecution:
3140             nodeSelectorTerms:
3141             - matchExpressions:
3142               - key: beta.kubernetes.io/arch
3143                 operator: In
3144                 values:
3145                 - amd64
3146                 - ppc64le
3147                 - s390x
3148           preferredDuringSchedulingIgnoredDuringExecution:
3149           - weight: 2
3150             preference:
3151               matchExpressions:
3152               - key: beta.kubernetes.io/arch
3153                 operator: In
3154                 values:
3155                 - amd64
3156           - weight: 2
3157             preference:
3158               matchExpressions:
3159               - key: beta.kubernetes.io/arch
3160                 operator: In
3161                 values:
3162                 - ppc64le
3163           - weight: 2
3164             preference:
3165               matchExpressions:
3166               - key: beta.kubernetes.io/arch
3167                 operator: In
3168                 values:
3169                 - s390x
3170 ---
3171
3172 ---
3173 # Source: istio/charts/grafana/templates/deployment.yaml
3174 apiVersion: extensions/v1beta1
3175 kind: Deployment
3176 metadata:
3177   name: grafana
3178   namespace: istio-system
3179   labels:
3180     app: grafana
3181     chart: grafana-0.1.0
3182     release: RELEASE-NAME
3183     heritage: Tiller
3184 spec:
3185   replicas: 1
3186   template:
3187     metadata:
3188       labels:
3189         app: grafana
3190       annotations:
3191         sidecar.istio.io/inject: "false"
3192         scheduler.alpha.kubernetes.io/critical-pod: ""
3193     spec:
3194       containers:
3195         - name: grafana
3196           image: "gcr.io/istio-release/grafana:1.0.0"
3197           imagePullPolicy: IfNotPresent
3198           ports:
3199             - containerPort: 3000
3200           readinessProbe:
3201             httpGet:
3202               path: /login
3203               port: 3000
3204           env:
3205           - name: GRAFANA_PORT
3206             value: "3000"
3207           - name: GF_AUTH_BASIC_ENABLED
3208             value: "false"
3209           - name: GF_AUTH_ANONYMOUS_ENABLED
3210             value: "true"
3211           - name: GF_AUTH_ANONYMOUS_ORG_ROLE
3212             value: Admin
3213           - name: GF_PATHS_DATA
3214             value: /data/grafana
3215           resources:
3216             requests:
3217               cpu: 10m
3218
3219           volumeMounts:
3220           - name: data
3221             mountPath: /data/grafana
3222       affinity:
3223         nodeAffinity:
3224           requiredDuringSchedulingIgnoredDuringExecution:
3225             nodeSelectorTerms:
3226             - matchExpressions:
3227               - key: beta.kubernetes.io/arch
3228                 operator: In
3229                 values:
3230                 - amd64
3231                 - ppc64le
3232                 - s390x
3233           preferredDuringSchedulingIgnoredDuringExecution:
3234           - weight: 2
3235             preference:
3236               matchExpressions:
3237               - key: beta.kubernetes.io/arch
3238                 operator: In
3239                 values:
3240                 - amd64
3241           - weight: 2
3242             preference:
3243               matchExpressions:
3244               - key: beta.kubernetes.io/arch
3245                 operator: In
3246                 values:
3247                 - ppc64le
3248           - weight: 2
3249             preference:
3250               matchExpressions:
3251               - key: beta.kubernetes.io/arch
3252                 operator: In
3253                 values:
3254                 - s390x
3255       volumes:
3256       - name: data
3257         emptyDir: {}
3258
3259 ---
3260 # Source: istio/charts/mixer/templates/deployment.yaml
3261
3262 apiVersion: extensions/v1beta1
3263 kind: Deployment
3264 metadata:
3265   name: istio-policy
3266   namespace: istio-system
3267   labels:
3268     chart: mixer-1.0.0
3269     release: RELEASE-NAME
3270     istio: mixer
3271 spec:
3272   replicas: 1
3273   template:
3274     metadata:
3275       labels:
3276         app: policy
3277         istio: mixer
3278         istio-mixer-type: policy
3279       annotations:
3280         sidecar.istio.io/inject: "false"
3281         scheduler.alpha.kubernetes.io/critical-pod: ""
3282     spec:
3283       serviceAccountName: istio-mixer-service-account
3284       volumes:
3285       - name: istio-certs
3286         secret:
3287           secretName: istio.istio-mixer-service-account
3288           optional: true
3289       - name: uds-socket
3290         emptyDir: {}
3291       affinity:
3292         nodeAffinity:
3293           requiredDuringSchedulingIgnoredDuringExecution:
3294             nodeSelectorTerms:
3295             - matchExpressions:
3296               - key: beta.kubernetes.io/arch
3297                 operator: In
3298                 values:
3299                 - amd64
3300                 - ppc64le
3301                 - s390x
3302           preferredDuringSchedulingIgnoredDuringExecution:
3303           - weight: 2
3304             preference:
3305               matchExpressions:
3306               - key: beta.kubernetes.io/arch
3307                 operator: In
3308                 values:
3309                 - amd64
3310           - weight: 2
3311             preference:
3312               matchExpressions:
3313               - key: beta.kubernetes.io/arch
3314                 operator: In
3315                 values:
3316                 - ppc64le
3317           - weight: 2
3318             preference:
3319               matchExpressions:
3320               - key: beta.kubernetes.io/arch
3321                 operator: In
3322                 values:
3323                 - s390x
3324       containers:
3325       - name: mixer
3326         image: "gcr.io/istio-release/mixer:1.0.0"
3327         imagePullPolicy: IfNotPresent
3328         ports:
3329         - containerPort: 9093
3330         - containerPort: 42422
3331         args:
3332           - --address
3333           - unix:///sock/mixer.socket
3334           - --configStoreURL=k8s://
3335           - --configDefaultNamespace=istio-system
3336           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
3337         resources:
3338           requests:
3339             cpu: 10m
3340
3341         volumeMounts:
3342         - name: uds-socket
3343           mountPath: /sock
3344         livenessProbe:
3345           httpGet:
3346             path: /version
3347             port: 9093
3348           initialDelaySeconds: 5
3349           periodSeconds: 5
3350       - name: istio-proxy
3351         image: "gcr.io/istio-release/proxyv2:1.0.0"
3352         imagePullPolicy: IfNotPresent
3353         ports:
3354         - containerPort: 9091
3355         - containerPort: 15004
3356         args:
3357         - proxy
3358         - --serviceCluster
3359         - istio-policy
3360         - --templateFile
3361         - /etc/istio/proxy/envoy_policy.yaml.tmpl
3362         - --controlPlaneAuthPolicy
3363         - NONE
3364         env:
3365         - name: POD_NAME
3366           valueFrom:
3367             fieldRef:
3368               apiVersion: v1
3369               fieldPath: metadata.name
3370         - name: POD_NAMESPACE
3371           valueFrom:
3372             fieldRef:
3373               apiVersion: v1
3374               fieldPath: metadata.namespace
3375         - name: INSTANCE_IP
3376           valueFrom:
3377             fieldRef:
3378               apiVersion: v1
3379               fieldPath: status.podIP
3380         resources:
3381           requests:
3382             cpu: 10m
3383
3384         volumeMounts:
3385         - name: istio-certs
3386           mountPath: /etc/certs
3387           readOnly: true
3388         - name: uds-socket
3389           mountPath: /sock
3390
3391 ---
3392 apiVersion: extensions/v1beta1
3393 kind: Deployment
3394 metadata:
3395   name: istio-telemetry
3396   namespace: istio-system
3397   labels:
3398     chart: mixer-1.0.0
3399     release: RELEASE-NAME
3400     istio: mixer
3401 spec:
3402   replicas: 1
3403   template:
3404     metadata:
3405       labels:
3406         app: telemetry
3407         istio: mixer
3408         istio-mixer-type: telemetry
3409       annotations:
3410         sidecar.istio.io/inject: "false"
3411         scheduler.alpha.kubernetes.io/critical-pod: ""
3412     spec:
3413       serviceAccountName: istio-mixer-service-account
3414       volumes:
3415       - name: istio-certs
3416         secret:
3417           secretName: istio.istio-mixer-service-account
3418           optional: true
3419       - name: uds-socket
3420         emptyDir: {}
3421       containers:
3422       - name: mixer
3423         image: "gcr.io/istio-release/mixer:1.0.0"
3424         imagePullPolicy: IfNotPresent
3425         ports:
3426         - containerPort: 9093
3427         - containerPort: 42422
3428         args:
3429           - --address
3430           - unix:///sock/mixer.socket
3431           - --configStoreURL=k8s://
3432           - --configDefaultNamespace=istio-system
3433           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
3434         resources:
3435           requests:
3436             cpu: 10m
3437
3438         volumeMounts:
3439         - name: uds-socket
3440           mountPath: /sock
3441         livenessProbe:
3442           httpGet:
3443             path: /version
3444             port: 9093
3445           initialDelaySeconds: 5
3446           periodSeconds: 5
3447       - name: istio-proxy
3448         image: "gcr.io/istio-release/proxyv2:1.0.0"
3449         imagePullPolicy: IfNotPresent
3450         ports:
3451         - containerPort: 9091
3452         - containerPort: 15004
3453         args:
3454         - proxy
3455         - --serviceCluster
3456         - istio-telemetry
3457         - --templateFile
3458         - /etc/istio/proxy/envoy_telemetry.yaml.tmpl
3459         - --controlPlaneAuthPolicy
3460         - NONE
3461         env:
3462         - name: POD_NAME
3463           valueFrom:
3464             fieldRef:
3465               apiVersion: v1
3466               fieldPath: metadata.name
3467         - name: POD_NAMESPACE
3468           valueFrom:
3469             fieldRef:
3470               apiVersion: v1
3471               fieldPath: metadata.namespace
3472         - name: INSTANCE_IP
3473           valueFrom:
3474             fieldRef:
3475               apiVersion: v1
3476               fieldPath: status.podIP
3477         resources:
3478           requests:
3479             cpu: 10m
3480
3481         volumeMounts:
3482         - name: istio-certs
3483           mountPath: /etc/certs
3484           readOnly: true
3485         - name: uds-socket
3486           mountPath: /sock
3487
3488 ---
3489
3490 ---
3491 # Source: istio/charts/pilot/templates/deployment.yaml
3492 apiVersion: extensions/v1beta1
3493 kind: Deployment
3494 metadata:
3495   name: istio-pilot
3496   namespace: istio-system
3497   # TODO: default template doesn't have this, which one is right ?
3498   labels:
3499     app: istio-pilot
3500     chart: pilot-1.0.0
3501     release: RELEASE-NAME
3502     heritage: Tiller
3503     istio: pilot
3504   annotations:
3505     checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9
3506 spec:
3507   replicas: 1
3508   template:
3509     metadata:
3510       labels:
3511         istio: pilot
3512         app: pilot
3513       annotations:
3514         sidecar.istio.io/inject: "false"
3515         scheduler.alpha.kubernetes.io/critical-pod: ""
3516     spec:
3517       serviceAccountName: istio-pilot-service-account
3518       containers:
3519         - name: discovery
3520           image: "gcr.io/istio-release/pilot:1.0.0"
3521           imagePullPolicy: IfNotPresent
3522           args:
3523           - "discovery"
3524           ports:
3525           - containerPort: 8080
3526           - containerPort: 15010
3527           readinessProbe:
3528             httpGet:
3529               path: /debug/endpointz
3530               port: 8080
3531             initialDelaySeconds: 30
3532             periodSeconds: 30
3533             timeoutSeconds: 5
3534           env:
3535           - name: POD_NAME
3536             valueFrom:
3537               fieldRef:
3538                 apiVersion: v1
3539                 fieldPath: metadata.name
3540           - name: POD_NAMESPACE
3541             valueFrom:
3542               fieldRef:
3543                 apiVersion: v1
3544                 fieldPath: metadata.namespace
3545           - name: PILOT_THROTTLE
3546             value: "500"
3547           - name: PILOT_CACHE_SQUASH
3548             value: "5"
3549           - name: PILOT_TRACE_SAMPLING
3550             value: "100"
3551           resources:
3552             requests:
3553               cpu: 500m
3554               memory: 2048Mi
3555
3556           volumeMounts:
3557           - name: config-volume
3558             mountPath: /etc/istio/config
3559           - name: istio-certs
3560             mountPath: /etc/certs
3561             readOnly: true
3562         - name: istio-proxy
3563           image: "gcr.io/istio-release/proxyv2:1.0.0"
3564           imagePullPolicy: IfNotPresent
3565           ports:
3566           - containerPort: 15003
3567           - containerPort: 15005
3568           - containerPort: 15007
3569           - containerPort: 15011
3570           args:
3571           - proxy
3572           - --serviceCluster
3573           - istio-pilot
3574           - --templateFile
3575           - /etc/istio/proxy/envoy_pilot.yaml.tmpl
3576           - --controlPlaneAuthPolicy
3577           - NONE
3578           env:
3579           - name: POD_NAME
3580             valueFrom:
3581               fieldRef:
3582                 apiVersion: v1
3583                 fieldPath: metadata.name
3584           - name: POD_NAMESPACE
3585             valueFrom:
3586               fieldRef:
3587                 apiVersion: v1
3588                 fieldPath: metadata.namespace
3589           - name: INSTANCE_IP
3590             valueFrom:
3591               fieldRef:
3592                 apiVersion: v1
3593                 fieldPath: status.podIP
3594           resources:
3595             requests:
3596               cpu: 10m
3597
3598           volumeMounts:
3599           - name: istio-certs
3600             mountPath: /etc/certs
3601             readOnly: true
3602       volumes:
3603       - name: config-volume
3604         configMap:
3605           name: istio
3606       - name: istio-certs
3607         secret:
3608           secretName: istio.istio-pilot-service-account
3609       affinity:
3610         nodeAffinity:
3611           requiredDuringSchedulingIgnoredDuringExecution:
3612             nodeSelectorTerms:
3613             - matchExpressions:
3614               - key: beta.kubernetes.io/arch
3615                 operator: In
3616                 values:
3617                 - amd64
3618                 - ppc64le
3619                 - s390x
3620           preferredDuringSchedulingIgnoredDuringExecution:
3621           - weight: 2
3622             preference:
3623               matchExpressions:
3624               - key: beta.kubernetes.io/arch
3625                 operator: In
3626                 values:
3627                 - amd64
3628           - weight: 2
3629             preference:
3630               matchExpressions:
3631               - key: beta.kubernetes.io/arch
3632                 operator: In
3633                 values:
3634                 - ppc64le
3635           - weight: 2
3636             preference:
3637               matchExpressions:
3638               - key: beta.kubernetes.io/arch
3639                 operator: In
3640                 values:
3641                 - s390x
3642
3643 ---
3644 # Source: istio/charts/prometheus/templates/deployment.yaml
3645 # TODO: the original template has service account, roles, etc
3646 apiVersion: extensions/v1beta1
3647 kind: Deployment
3648 metadata:
3649   name: prometheus
3650   namespace: istio-system
3651   labels:
3652     app: prometheus
3653     chart: prometheus-0.1.0
3654     release: RELEASE-NAME
3655     heritage: Tiller
3656 spec:
3657   replicas: 1
3658   selector:
3659     matchLabels:
3660       app: prometheus
3661   template:
3662     metadata:
3663       labels:
3664         app: prometheus
3665       annotations:
3666         sidecar.istio.io/inject: "false"
3667         scheduler.alpha.kubernetes.io/critical-pod: ""
3668     spec:
3669       serviceAccountName: prometheus
3670       containers:
3671         - name: prometheus
3672           image: "docker.io/prom/prometheus:v2.3.1"
3673           imagePullPolicy: IfNotPresent
3674           args:
3675             - '--storage.tsdb.retention=6h'
3676             - '--config.file=/etc/prometheus/prometheus.yml'
3677           ports:
3678             - containerPort: 9090
3679               name: http
3680           livenessProbe:
3681             httpGet:
3682               path: /-/healthy
3683               port: 9090
3684           readinessProbe:
3685             httpGet:
3686               path: /-/ready
3687               port: 9090
3688           resources:
3689             requests:
3690               cpu: 10m
3691
3692           volumeMounts:
3693           - name: config-volume
3694             mountPath: /etc/prometheus
3695       volumes:
3696       - name: config-volume
3697         configMap:
3698           name: prometheus
3699       affinity:
3700         nodeAffinity:
3701           requiredDuringSchedulingIgnoredDuringExecution:
3702             nodeSelectorTerms:
3703             - matchExpressions:
3704               - key: beta.kubernetes.io/arch
3705                 operator: In
3706                 values:
3707                 - amd64
3708                 - ppc64le
3709                 - s390x
3710           preferredDuringSchedulingIgnoredDuringExecution:
3711           - weight: 2
3712             preference:
3713               matchExpressions:
3714               - key: beta.kubernetes.io/arch
3715                 operator: In
3716                 values:
3717                 - amd64
3718           - weight: 2
3719             preference:
3720               matchExpressions:
3721               - key: beta.kubernetes.io/arch
3722                 operator: In
3723                 values:
3724                 - ppc64le
3725           - weight: 2
3726             preference:
3727               matchExpressions:
3728               - key: beta.kubernetes.io/arch
3729                 operator: In
3730                 values:
3731                 - s390x
3732
3733 ---
3734 # Source: istio/charts/security/templates/deployment.yaml
3735 # istio CA watching all namespaces
3736 apiVersion: extensions/v1beta1
3737 kind: Deployment
3738 metadata:
3739   name: istio-citadel
3740   namespace: istio-system
3741   labels:
3742     app: security
3743     chart: security-1.0.0
3744     release: RELEASE-NAME
3745     heritage: Tiller
3746     istio: citadel
3747 spec:
3748   replicas: 1
3749   template:
3750     metadata:
3751       labels:
3752         istio: citadel
3753       annotations:
3754         sidecar.istio.io/inject: "false"
3755         scheduler.alpha.kubernetes.io/critical-pod: ""
3756     spec:
3757       serviceAccountName: istio-citadel-service-account
3758       containers:
3759         - name: citadel
3760           image: "gcr.io/istio-release/citadel:1.0.0"
3761           imagePullPolicy: IfNotPresent
3762           args:
3763             - --append-dns-names=true
3764             - --grpc-port=8060
3765             - --grpc-hostname=citadel
3766             - --citadel-storage-namespace=istio-system
3767             - --self-signed-ca=true
3768           resources:
3769             requests:
3770               cpu: 10m
3771
3772       affinity:
3773         nodeAffinity:
3774           requiredDuringSchedulingIgnoredDuringExecution:
3775             nodeSelectorTerms:
3776             - matchExpressions:
3777               - key: beta.kubernetes.io/arch
3778                 operator: In
3779                 values:
3780                 - amd64
3781                 - ppc64le
3782                 - s390x
3783           preferredDuringSchedulingIgnoredDuringExecution:
3784           - weight: 2
3785             preference:
3786               matchExpressions:
3787               - key: beta.kubernetes.io/arch
3788                 operator: In
3789                 values:
3790                 - amd64
3791           - weight: 2
3792             preference:
3793               matchExpressions:
3794               - key: beta.kubernetes.io/arch
3795                 operator: In
3796                 values:
3797                 - ppc64le
3798           - weight: 2
3799             preference:
3800               matchExpressions:
3801               - key: beta.kubernetes.io/arch
3802                 operator: In
3803                 values:
3804                 - s390x
3805
3806 ---
3807 # Source: istio/charts/servicegraph/templates/deployment.yaml
3808 apiVersion: extensions/v1beta1
3809 kind: Deployment
3810 metadata:
3811   name: servicegraph
3812   namespace: istio-system
3813   labels:
3814     app: servicegraph
3815     chart: servicegraph-0.1.0
3816     release: RELEASE-NAME
3817     heritage: Tiller
3818 spec:
3819   replicas: 1
3820   template:
3821     metadata:
3822       labels:
3823         app: servicegraph
3824       annotations:
3825         sidecar.istio.io/inject: "false"
3826         scheduler.alpha.kubernetes.io/critical-pod: ""
3827     spec:
3828       containers:
3829         - name: servicegraph
3830           image: "gcr.io/istio-release/servicegraph:1.0.0"
3831           imagePullPolicy: IfNotPresent
3832           ports:
3833             - containerPort: 8088
3834           args:
3835           - --prometheusAddr=http://prometheus:9090
3836           livenessProbe:
3837             httpGet:
3838               path: /graph
3839               port: 8088
3840           readinessProbe:
3841             httpGet:
3842               path: /graph
3843               port: 8088
3844           resources:
3845             requests:
3846               cpu: 10m
3847
3848       affinity:
3849         nodeAffinity:
3850           requiredDuringSchedulingIgnoredDuringExecution:
3851             nodeSelectorTerms:
3852             - matchExpressions:
3853               - key: beta.kubernetes.io/arch
3854                 operator: In
3855                 values:
3856                 - amd64
3857                 - ppc64le
3858                 - s390x
3859           preferredDuringSchedulingIgnoredDuringExecution:
3860           - weight: 2
3861             preference:
3862               matchExpressions:
3863               - key: beta.kubernetes.io/arch
3864                 operator: In
3865                 values:
3866                 - amd64
3867           - weight: 2
3868             preference:
3869               matchExpressions:
3870               - key: beta.kubernetes.io/arch
3871                 operator: In
3872                 values:
3873                 - ppc64le
3874           - weight: 2
3875             preference:
3876               matchExpressions:
3877               - key: beta.kubernetes.io/arch
3878                 operator: In
3879                 values:
3880                 - s390x
3881
3882 ---
3883 # Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml
3884 apiVersion: extensions/v1beta1
3885 kind: Deployment
3886 metadata:
3887   name: istio-sidecar-injector
3888   namespace: istio-system
3889   labels:
3890     app: sidecarInjectorWebhook
3891     chart: sidecarInjectorWebhook-1.0.0
3892     release: RELEASE-NAME
3893     heritage: Tiller
3894     istio: sidecar-injector
3895 spec:
3896   replicas: 1
3897   template:
3898     metadata:
3899       labels:
3900         istio: sidecar-injector
3901       annotations:
3902         sidecar.istio.io/inject: "false"
3903         scheduler.alpha.kubernetes.io/critical-pod: ""
3904     spec:
3905       serviceAccountName: istio-sidecar-injector-service-account
3906       containers:
3907         - name: sidecar-injector-webhook
3908           image: "gcr.io/istio-release/sidecar_injector:1.0.0"
3909           imagePullPolicy: IfNotPresent
3910           args:
3911             - --caCertFile=/etc/istio/certs/root-cert.pem
3912             - --tlsCertFile=/etc/istio/certs/cert-chain.pem
3913             - --tlsKeyFile=/etc/istio/certs/key.pem
3914             - --injectConfig=/etc/istio/inject/config
3915             - --meshConfig=/etc/istio/config/mesh
3916             - --healthCheckInterval=2s
3917             - --healthCheckFile=/health
3918           volumeMounts:
3919           - name: config-volume
3920             mountPath: /etc/istio/config
3921             readOnly: true
3922           - name: certs
3923             mountPath: /etc/istio/certs
3924             readOnly: true
3925           - name: inject-config
3926             mountPath: /etc/istio/inject
3927             readOnly: true
3928           livenessProbe:
3929             exec:
3930               command:
3931                 - /usr/local/bin/sidecar-injector
3932                 - probe
3933                 - --probe-path=/health
3934                 - --interval=4s
3935             initialDelaySeconds: 4
3936             periodSeconds: 4
3937           readinessProbe:
3938             exec:
3939               command:
3940                 - /usr/local/bin/sidecar-injector
3941                 - probe
3942                 - --probe-path=/health
3943                 - --interval=4s
3944             initialDelaySeconds: 4
3945             periodSeconds: 4
3946           resources:
3947             requests:
3948               cpu: 10m
3949
3950       volumes:
3951       - name: config-volume
3952         configMap:
3953           name: istio
3954       - name: certs
3955         secret:
3956           secretName: istio.istio-sidecar-injector-service-account
3957       - name: inject-config
3958         configMap:
3959           name: istio-sidecar-injector
3960           items:
3961           - key: config
3962             path: config
3963       affinity:
3964         nodeAffinity:
3965           requiredDuringSchedulingIgnoredDuringExecution:
3966             nodeSelectorTerms:
3967             - matchExpressions:
3968               - key: beta.kubernetes.io/arch
3969                 operator: In
3970                 values:
3971                 - amd64
3972                 - ppc64le
3973                 - s390x
3974           preferredDuringSchedulingIgnoredDuringExecution:
3975           - weight: 2
3976             preference:
3977               matchExpressions:
3978               - key: beta.kubernetes.io/arch
3979                 operator: In
3980                 values:
3981                 - amd64
3982           - weight: 2
3983             preference:
3984               matchExpressions:
3985               - key: beta.kubernetes.io/arch
3986                 operator: In
3987                 values:
3988                 - ppc64le
3989           - weight: 2
3990             preference:
3991               matchExpressions:
3992               - key: beta.kubernetes.io/arch
3993                 operator: In
3994                 values:
3995                 - s390x
3996
3997 ---
3998 # Source: istio/charts/tracing/templates/deployment.yaml
3999 apiVersion: extensions/v1beta1
4000 kind: Deployment
4001 metadata:
4002   name: istio-tracing
4003   namespace: istio-system
4004   labels:
4005     app: istio-tracing
4006     chart: tracing-0.1.0
4007     release: RELEASE-NAME
4008     heritage: Tiller
4009 spec:
4010   replicas: 1
4011   template:
4012     metadata:
4013       labels:
4014         app: jaeger
4015       annotations:
4016         sidecar.istio.io/inject: "false"
4017         scheduler.alpha.kubernetes.io/critical-pod: ""
4018     spec:
4019       containers:
4020         - name: jaeger
4021           image: "docker.io/jaegertracing/all-in-one:1.5"
4022           imagePullPolicy: IfNotPresent
4023           ports:
4024             - containerPort: 9411
4025             - containerPort: 16686
4026             - containerPort: 5775
4027               protocol: UDP
4028             - containerPort: 6831
4029               protocol: UDP
4030             - containerPort: 6832
4031               protocol: UDP
4032           env:
4033           - name: POD_NAMESPACE
4034             valueFrom:
4035               fieldRef:
4036                 apiVersion: v1
4037                 fieldPath: metadata.namespace
4038           - name: COLLECTOR_ZIPKIN_HTTP_PORT
4039             value: "9411"
4040           - name: MEMORY_MAX_TRACES
4041             value: "50000"
4042           livenessProbe:
4043             httpGet:
4044               path: /
4045               port: 16686
4046           readinessProbe:
4047             httpGet:
4048               path: /
4049               port: 16686
4050           resources:
4051             requests:
4052               cpu: 10m
4053
4054       affinity:
4055         nodeAffinity:
4056           requiredDuringSchedulingIgnoredDuringExecution:
4057             nodeSelectorTerms:
4058             - matchExpressions:
4059               - key: beta.kubernetes.io/arch
4060                 operator: In
4061                 values:
4062                 - amd64
4063                 - ppc64le
4064                 - s390x
4065           preferredDuringSchedulingIgnoredDuringExecution:
4066           - weight: 2
4067             preference:
4068               matchExpressions:
4069               - key: beta.kubernetes.io/arch
4070                 operator: In
4071                 values:
4072                 - amd64
4073           - weight: 2
4074             preference:
4075               matchExpressions:
4076               - key: beta.kubernetes.io/arch
4077                 operator: In
4078                 values:
4079                 - ppc64le
4080           - weight: 2
4081             preference:
4082               matchExpressions:
4083               - key: beta.kubernetes.io/arch
4084                 operator: In
4085                 values:
4086                 - s390x
4087
4088 ---
4089 # Source: istio/charts/pilot/templates/gateway.yaml
4090 apiVersion: networking.istio.io/v1alpha3
4091 kind: Gateway
4092 metadata:
4093   name: istio-autogenerated-k8s-ingress
4094   namespace: istio-system
4095 spec:
4096   selector:
4097     istio: ingress
4098   servers:
4099   - port:
4100       number: 80
4101       protocol: HTTP2
4102       name: http
4103     hosts:
4104     - "*"
4105
4106 ---
4107
4108 ---
4109 # Source: istio/charts/gateways/templates/autoscale.yaml
4110
4111 apiVersion: autoscaling/v2beta1
4112 kind: HorizontalPodAutoscaler
4113 metadata:
4114     name: istio-egressgateway
4115     namespace: istio-system
4116 spec:
4117     maxReplicas: 5
4118     minReplicas: 1
4119     scaleTargetRef:
4120       apiVersion: apps/v1beta1
4121       kind: Deployment
4122       name: istio-egressgateway
4123     metrics:
4124       - type: Resource
4125         resource:
4126           name: cpu
4127           targetAverageUtilization: 60
4128 ---
4129 apiVersion: autoscaling/v2beta1
4130 kind: HorizontalPodAutoscaler
4131 metadata:
4132     name: istio-ingressgateway
4133     namespace: istio-system
4134 spec:
4135     maxReplicas: 5
4136     minReplicas: 1
4137     scaleTargetRef:
4138       apiVersion: apps/v1beta1
4139       kind: Deployment
4140       name: istio-ingressgateway
4141     metrics:
4142       - type: Resource
4143         resource:
4144           name: cpu
4145           targetAverageUtilization: 60
4146 ---
4147
4148 ---
4149 # Source: istio/charts/mixer/templates/autoscale.yaml
4150
4151 apiVersion: autoscaling/v2beta1
4152 kind: HorizontalPodAutoscaler
4153 metadata:
4154     name: istio-policy
4155     namespace: istio-system
4156 spec:
4157     maxReplicas: 5
4158     minReplicas: 1
4159     scaleTargetRef:
4160       apiVersion: apps/v1beta1
4161       kind: Deployment
4162       name: istio-policy
4163     metrics:
4164     - type: Resource
4165       resource:
4166         name: cpu
4167         targetAverageUtilization: 80
4168 ---
4169 apiVersion: autoscaling/v2beta1
4170 kind: HorizontalPodAutoscaler
4171 metadata:
4172     name: istio-telemetry
4173     namespace: istio-system
4174 spec:
4175     maxReplicas: 5
4176     minReplicas: 1
4177     scaleTargetRef:
4178       apiVersion: apps/v1beta1
4179       kind: Deployment
4180       name: istio-telemetry
4181     metrics:
4182     - type: Resource
4183       resource:
4184         name: cpu
4185         targetAverageUtilization: 80
4186 ---
4187
4188 ---
4189 # Source: istio/charts/pilot/templates/autoscale.yaml
4190
4191 apiVersion: autoscaling/v2beta1
4192 kind: HorizontalPodAutoscaler
4193 metadata:
4194     name: istio-pilot
4195 spec:
4196     maxReplicas: 1
4197     minReplicas: 1
4198     scaleTargetRef:
4199       apiVersion: apps/v1beta1
4200       kind: Deployment
4201       name: istio-pilot
4202     metrics:
4203       - type: Resource
4204         resource:
4205           name: cpu
4206           targetAverageUtilization: 55
4207 ---
4208
4209 ---
4210 # Source: istio/charts/tracing/templates/service-jaeger.yaml
4211
4212
4213 apiVersion: v1
4214 kind: List
4215 items:
4216 - apiVersion: v1
4217   kind: Service
4218   metadata:
4219     name: jaeger-query
4220     namespace: istio-system
4221     annotations:
4222     labels:
4223       app: jaeger
4224       jaeger-infra: jaeger-service
4225       chart: tracing-0.1.0
4226       release: RELEASE-NAME
4227       heritage: Tiller
4228   spec:
4229     type: NodePort
4230     ports:
4231       - name: query-http
4232         port: 16686
4233         protocol: TCP
4234         targetPort: 16686
4235         nodePort: 30686
4236     selector:
4237       app: jaeger
4238 - apiVersion: v1
4239   kind: Service
4240   metadata:
4241     name: jaeger-collector
4242     namespace: istio-system
4243     labels:
4244       app: jaeger
4245       jaeger-infra: collector-service
4246       chart: tracing-0.1.0
4247       release: RELEASE-NAME
4248       heritage: Tiller
4249   spec:
4250     ports:
4251     - name: jaeger-collector-tchannel
4252       port: 14267
4253       protocol: TCP
4254       targetPort: 14267
4255     - name: jaeger-collector-http
4256       port: 14268
4257       targetPort: 14268
4258       protocol: TCP
4259     selector:
4260       app: jaeger
4261     type: ClusterIP
4262 - apiVersion: v1
4263   kind: Service
4264   metadata:
4265     name: jaeger-agent
4266     namespace: istio-system
4267     labels:
4268       app: jaeger
4269       jaeger-infra: agent-service
4270       chart: tracing-0.1.0
4271       release: RELEASE-NAME
4272       heritage: Tiller
4273   spec:
4274     ports:
4275     - name: agent-zipkin-thrift
4276       port: 5775
4277       protocol: UDP
4278       targetPort: 5775
4279     - name: agent-compact
4280       port: 6831
4281       protocol: UDP
4282       targetPort: 6831
4283     - name: agent-binary
4284       port: 6832
4285       protocol: UDP
4286       targetPort: 6832
4287     clusterIP: None
4288     selector:
4289       app: jaeger
4290
4291
4292
4293 ---
4294 # Source: istio/charts/tracing/templates/service.yaml
4295 apiVersion: v1
4296 kind: List
4297 items:
4298 - apiVersion: v1
4299   kind: Service
4300   metadata:
4301     name: zipkin
4302     namespace: istio-system
4303     labels:
4304       app: jaeger
4305       chart: tracing-0.1.0
4306       release: RELEASE-NAME
4307       heritage: Tiller
4308   spec:
4309     type: NodePort
4310     ports:
4311       - port: 9411
4312         targetPort: 9411
4313         protocol: TCP
4314         name: http
4315         nodePort: 30411
4316     selector:
4317       app: jaeger
4318 - apiVersion: v1
4319   kind: Service
4320   metadata:
4321     name: tracing
4322     namespace: istio-system
4323     annotations:
4324     labels:
4325       app: jaeger
4326       chart: tracing-0.1.0
4327       release: RELEASE-NAME
4328       heritage: Tiller
4329   spec:
4330     ports:
4331       - name: http-query
4332         port: 80
4333         protocol: TCP
4334         targetPort: 16686
4335     selector:
4336       app: jaeger
4337
4338 ---
4339 # Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml
4340 apiVersion: admissionregistration.k8s.io/v1beta1
4341 kind: MutatingWebhookConfiguration
4342 metadata:
4343   name: istio-sidecar-injector
4344   namespace: istio-system
4345   labels:
4346     app: istio-sidecar-injector
4347     chart: sidecarInjectorWebhook-1.0.0
4348     release: RELEASE-NAME
4349     heritage: Tiller
4350 webhooks:
4351   - name: sidecar-injector.istio.io
4352     clientConfig:
4353       service:
4354         name: istio-sidecar-injector
4355         namespace: istio-system
4356         path: "/inject"
4357       caBundle: ""
4358     rules:
4359       - operations: [ "CREATE" ]
4360         apiGroups: [""]
4361         apiVersions: ["v1"]
4362         resources: ["pods"]
4363     failurePolicy: Fail
4364     namespaceSelector:
4365       matchLabels:
4366         istio-injection: enabled
4367
4368
4369 ---
4370 # Source: istio/charts/galley/templates/validatingwehookconfiguration.yaml.tpl
4371
4372
4373 ---
4374 # Source: istio/charts/grafana/templates/grafana-ports-mtls.yaml
4375
4376
4377 ---
4378 # Source: istio/charts/grafana/templates/secret.yaml
4379
4380 ---
4381 # Source: istio/charts/pilot/templates/meshexpansion.yaml
4382
4383
4384 ---
4385 # Source: istio/charts/security/templates/create-custom-resources-job.yaml
4386
4387
4388 ---
4389 # Source: istio/charts/security/templates/enable-mesh-mtls.yaml
4390
4391
4392 ---
4393 # Source: istio/charts/security/templates/meshexpansion.yaml
4394
4395
4396 ---
4397
4398 ---
4399 # Source: istio/charts/servicegraph/templates/ingress.yaml
4400
4401 ---
4402 # Source: istio/charts/telemetry-gateway/templates/gateway.yaml
4403
4404
4405 ---
4406 # Source: istio/charts/tracing/templates/ingress-jaeger.yaml
4407
4408 ---
4409 # Source: istio/charts/tracing/templates/ingress.yaml
4410
4411 ---
4412 # Source: istio/templates/install-custom-resources.sh.tpl
4413
4414
4415 ---
4416 # Source: istio/charts/mixer/templates/config.yaml
4417 apiVersion: "config.istio.io/v1alpha2"
4418 kind: attributemanifest
4419 metadata:
4420   name: istioproxy
4421   namespace: istio-system
4422 spec:
4423   attributes:
4424     origin.ip:
4425       valueType: IP_ADDRESS
4426     origin.uid:
4427       valueType: STRING
4428     origin.user:
4429       valueType: STRING
4430     request.headers:
4431       valueType: STRING_MAP
4432     request.id:
4433       valueType: STRING
4434     request.host:
4435       valueType: STRING
4436     request.method:
4437       valueType: STRING
4438     request.path:
4439       valueType: STRING
4440     request.reason:
4441       valueType: STRING
4442     request.referer:
4443       valueType: STRING
4444     request.scheme:
4445       valueType: STRING
4446     request.total_size:
4447           valueType: INT64
4448     request.size:
4449       valueType: INT64
4450     request.time:
4451       valueType: TIMESTAMP
4452     request.useragent:
4453       valueType: STRING
4454     response.code:
4455       valueType: INT64
4456     response.duration:
4457       valueType: DURATION
4458     response.headers:
4459       valueType: STRING_MAP
4460     response.total_size:
4461           valueType: INT64
4462     response.size:
4463       valueType: INT64
4464     response.time:
4465       valueType: TIMESTAMP
4466     source.uid:
4467       valueType: STRING
4468     source.user: # DEPRECATED
4469       valueType: STRING
4470     source.principal:
4471       valueType: STRING
4472     destination.uid:
4473       valueType: STRING
4474     destination.principal:
4475       valueType: STRING
4476     destination.port:
4477       valueType: INT64
4478     connection.event:
4479       valueType: STRING
4480     connection.id:
4481       valueType: STRING
4482     connection.received.bytes:
4483       valueType: INT64
4484     connection.received.bytes_total:
4485       valueType: INT64
4486     connection.sent.bytes:
4487       valueType: INT64
4488     connection.sent.bytes_total:
4489       valueType: INT64
4490     connection.duration:
4491       valueType: DURATION
4492     connection.mtls:
4493       valueType: BOOL
4494     context.protocol:
4495       valueType: STRING
4496     context.timestamp:
4497       valueType: TIMESTAMP
4498     context.time:
4499       valueType: TIMESTAMP
4500     # Deprecated, kept for compatibility
4501     context.reporter.local:
4502       valueType: BOOL
4503     context.reporter.kind:
4504       valueType: STRING
4505     context.reporter.uid:
4506       valueType: STRING
4507     api.service:
4508       valueType: STRING
4509     api.version:
4510       valueType: STRING
4511     api.operation:
4512       valueType: STRING
4513     api.protocol:
4514       valueType: STRING
4515     request.auth.principal:
4516       valueType: STRING
4517     request.auth.audiences:
4518       valueType: STRING
4519     request.auth.presenter:
4520       valueType: STRING
4521     request.auth.claims:
4522       valueType: STRING_MAP
4523     request.auth.raw_claims:
4524       valueType: STRING
4525     request.api_key:
4526       valueType: STRING
4527
4528 ---
4529 apiVersion: "config.istio.io/v1alpha2"
4530 kind: attributemanifest
4531 metadata:
4532   name: kubernetes
4533   namespace: istio-system
4534 spec:
4535   attributes:
4536     source.ip:
4537       valueType: IP_ADDRESS
4538     source.labels:
4539       valueType: STRING_MAP
4540     source.metadata:
4541       valueType: STRING_MAP
4542     source.name:
4543       valueType: STRING
4544     source.namespace:
4545       valueType: STRING
4546     source.owner:
4547       valueType: STRING
4548     source.service:  # DEPRECATED
4549       valueType: STRING
4550     source.serviceAccount:
4551       valueType: STRING
4552     source.services:
4553       valueType: STRING
4554     source.workload.uid:
4555       valueType: STRING
4556     source.workload.name:
4557       valueType: STRING
4558     source.workload.namespace:
4559       valueType: STRING
4560     destination.ip:
4561       valueType: IP_ADDRESS
4562     destination.labels:
4563       valueType: STRING_MAP
4564     destination.metadata:
4565       valueType: STRING_MAP
4566     destination.owner:
4567       valueType: STRING
4568     destination.name:
4569       valueType: STRING
4570     destination.container.name:
4571       valueType: STRING
4572     destination.namespace:
4573       valueType: STRING
4574     destination.service: # DEPRECATED
4575       valueType: STRING
4576     destination.service.uid:
4577       valueType: STRING
4578     destination.service.name:
4579       valueType: STRING
4580     destination.service.namespace:
4581       valueType: STRING
4582     destination.service.host:
4583       valueType: STRING
4584     destination.serviceAccount:
4585       valueType: STRING
4586     destination.workload.uid:
4587       valueType: STRING
4588     destination.workload.name:
4589       valueType: STRING
4590     destination.workload.namespace:
4591       valueType: STRING
4592 ---
4593 apiVersion: "config.istio.io/v1alpha2"
4594 kind: stdio
4595 metadata:
4596   name: handler
4597   namespace: istio-system
4598 spec:
4599   outputAsJson: true
4600 ---
4601 apiVersion: "config.istio.io/v1alpha2"
4602 kind: logentry
4603 metadata:
4604   name: accesslog
4605   namespace: istio-system
4606 spec:
4607   severity: '"Info"'
4608   timestamp: request.time
4609   variables:
4610     sourceIp: source.ip | ip("0.0.0.0")
4611     sourceApp: source.labels["app"] | ""
4612     sourcePrincipal: source.principal | ""
4613     sourceName: source.name | ""
4614     sourceWorkload: source.workload.name | ""
4615     sourceNamespace: source.namespace | ""
4616     sourceOwner: source.owner | ""
4617     destinationApp: destination.labels["app"] | ""
4618     destinationIp: destination.ip | ip("0.0.0.0")
4619     destinationServiceHost: destination.service.host | ""
4620     destinationWorkload: destination.workload.name | ""
4621     destinationName: destination.name | ""
4622     destinationNamespace: destination.namespace | ""
4623     destinationOwner: destination.owner | ""
4624     destinationPrincipal: destination.principal | ""
4625     apiClaims: request.auth.raw_claims | ""
4626     apiKey: request.api_key | request.headers["x-api-key"] | ""
4627     protocol: request.scheme | context.protocol | "http"
4628     method: request.method | ""
4629     url: request.path | ""
4630     responseCode: response.code | 0
4631     responseSize: response.size | 0
4632     requestSize: request.size | 0
4633     requestId: request.headers["x-request-id"] | ""
4634     clientTraceId: request.headers["x-client-trace-id"] | ""
4635     latency: response.duration | "0ms"
4636     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4637     userAgent: request.useragent | ""
4638     responseTimestamp: response.time
4639     receivedBytes: request.total_size | 0
4640     sentBytes: response.total_size | 0
4641     referer: request.referer | ""
4642     httpAuthority: request.headers[":authority"] | request.host | ""
4643     xForwardedFor: request.headers["x-forwarded-for"] | "0.0.0.0"
4644     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4645   monitored_resource_type: '"global"'
4646 ---
4647 apiVersion: "config.istio.io/v1alpha2"
4648 kind: logentry
4649 metadata:
4650   name: tcpaccesslog
4651   namespace: istio-system
4652 spec:
4653   severity: '"Info"'
4654   timestamp: context.time | timestamp("2017-01-01T00:00:00Z")
4655   variables:
4656     connectionEvent: connection.event | ""
4657     sourceIp: source.ip | ip("0.0.0.0")
4658     sourceApp: source.labels["app"] | ""
4659     sourcePrincipal: source.principal | ""
4660     sourceName: source.name | ""
4661     sourceWorkload: source.workload.name | ""
4662     sourceNamespace: source.namespace | ""
4663     sourceOwner: source.owner | ""
4664     destinationApp: destination.labels["app"] | ""
4665     destinationIp: destination.ip | ip("0.0.0.0")
4666     destinationServiceHost: destination.service.host | ""
4667     destinationWorkload: destination.workload.name | ""
4668     destinationName: destination.name | ""
4669     destinationNamespace: destination.namespace | ""
4670     destinationOwner: destination.owner | ""
4671     destinationPrincipal: destination.principal | ""
4672     protocol: context.protocol | "tcp"
4673     connectionDuration: connection.duration | "0ms"
4674     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4675     receivedBytes: connection.received.bytes | 0
4676     sentBytes: connection.sent.bytes | 0
4677     totalReceivedBytes: connection.received.bytes_total | 0
4678     totalSentBytes: connection.sent.bytes_total | 0
4679     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4680   monitored_resource_type: '"global"'
4681 ---
4682 apiVersion: "config.istio.io/v1alpha2"
4683 kind: rule
4684 metadata:
4685   name: stdio
4686   namespace: istio-system
4687 spec:
4688   match: context.protocol == "http" || context.protocol == "grpc"
4689   actions:
4690   - handler: handler.stdio
4691     instances:
4692     - accesslog.logentry
4693 ---
4694 apiVersion: "config.istio.io/v1alpha2"
4695 kind: rule
4696 metadata:
4697   name: stdiotcp
4698   namespace: istio-system
4699 spec:
4700   match: context.protocol == "tcp"
4701   actions:
4702   - handler: handler.stdio
4703     instances:
4704     - tcpaccesslog.logentry
4705 ---
4706 apiVersion: "config.istio.io/v1alpha2"
4707 kind: metric
4708 metadata:
4709   name: requestcount
4710   namespace: istio-system
4711 spec:
4712   value: "1"
4713   dimensions:
4714     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4715     source_workload: source.workload.name | "unknown"
4716     source_workload_namespace: source.workload.namespace | "unknown"
4717     source_principal: source.principal | "unknown"
4718     source_app: source.labels["app"] | "unknown"
4719     source_version: source.labels["version"] | "unknown"
4720     destination_workload: destination.workload.name | "unknown"
4721     destination_workload_namespace: destination.workload.namespace | "unknown"
4722     destination_principal: destination.principal | "unknown"
4723     destination_app: destination.labels["app"] | "unknown"
4724     destination_version: destination.labels["version"] | "unknown"
4725     destination_service: destination.service.host | "unknown"
4726     destination_service_name: destination.service.name | "unknown"
4727     destination_service_namespace: destination.service.namespace | "unknown"
4728     request_protocol: api.protocol | context.protocol | "unknown"
4729     response_code: response.code | 200
4730     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4731   monitored_resource_type: '"UNSPECIFIED"'
4732 ---
4733 apiVersion: "config.istio.io/v1alpha2"
4734 kind: metric
4735 metadata:
4736   name: requestduration
4737   namespace: istio-system
4738 spec:
4739   value: response.duration | "0ms"
4740   dimensions:
4741     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4742     source_workload: source.workload.name | "unknown"
4743     source_workload_namespace: source.workload.namespace | "unknown"
4744     source_principal: source.principal | "unknown"
4745     source_app: source.labels["app"] | "unknown"
4746     source_version: source.labels["version"] | "unknown"
4747     destination_workload: destination.workload.name | "unknown"
4748     destination_workload_namespace: destination.workload.namespace | "unknown"
4749     destination_principal: destination.principal | "unknown"
4750     destination_app: destination.labels["app"] | "unknown"
4751     destination_version: destination.labels["version"] | "unknown"
4752     destination_service: destination.service.host | "unknown"
4753     destination_service_name: destination.service.name | "unknown"
4754     destination_service_namespace: destination.service.namespace | "unknown"
4755     request_protocol: api.protocol | context.protocol | "unknown"
4756     response_code: response.code | 200
4757     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4758   monitored_resource_type: '"UNSPECIFIED"'
4759 ---
4760 apiVersion: "config.istio.io/v1alpha2"
4761 kind: metric
4762 metadata:
4763   name: requestsize
4764   namespace: istio-system
4765 spec:
4766   value: request.size | 0
4767   dimensions:
4768     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4769     source_workload: source.workload.name | "unknown"
4770     source_workload_namespace: source.workload.namespace | "unknown"
4771     source_principal: source.principal | "unknown"
4772     source_app: source.labels["app"] | "unknown"
4773     source_version: source.labels["version"] | "unknown"
4774     destination_workload: destination.workload.name | "unknown"
4775     destination_workload_namespace: destination.workload.namespace | "unknown"
4776     destination_principal: destination.principal | "unknown"
4777     destination_app: destination.labels["app"] | "unknown"
4778     destination_version: destination.labels["version"] | "unknown"
4779     destination_service: destination.service.host | "unknown"
4780     destination_service_name: destination.service.name | "unknown"
4781     destination_service_namespace: destination.service.namespace | "unknown"
4782     request_protocol: api.protocol | context.protocol | "unknown"
4783     response_code: response.code | 200
4784     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4785   monitored_resource_type: '"UNSPECIFIED"'
4786 ---
4787 apiVersion: "config.istio.io/v1alpha2"
4788 kind: metric
4789 metadata:
4790   name: responsesize
4791   namespace: istio-system
4792 spec:
4793   value: response.size | 0
4794   dimensions:
4795     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4796     source_workload: source.workload.name | "unknown"
4797     source_workload_namespace: source.workload.namespace | "unknown"
4798     source_principal: source.principal | "unknown"
4799     source_app: source.labels["app"] | "unknown"
4800     source_version: source.labels["version"] | "unknown"
4801     destination_workload: destination.workload.name | "unknown"
4802     destination_workload_namespace: destination.workload.namespace | "unknown"
4803     destination_principal: destination.principal | "unknown"
4804     destination_app: destination.labels["app"] | "unknown"
4805     destination_version: destination.labels["version"] | "unknown"
4806     destination_service: destination.service.host | "unknown"
4807     destination_service_name: destination.service.name | "unknown"
4808     destination_service_namespace: destination.service.namespace | "unknown"
4809     request_protocol: api.protocol | context.protocol | "unknown"
4810     response_code: response.code | 200
4811     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4812   monitored_resource_type: '"UNSPECIFIED"'
4813 ---
4814 apiVersion: "config.istio.io/v1alpha2"
4815 kind: metric
4816 metadata:
4817   name: tcpbytesent
4818   namespace: istio-system
4819 spec:
4820   value: connection.sent.bytes | 0
4821   dimensions:
4822     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4823     source_workload: source.workload.name | "unknown"
4824     source_workload_namespace: source.workload.namespace | "unknown"
4825     source_principal: source.principal | "unknown"
4826     source_app: source.labels["app"] | "unknown"
4827     source_version: source.labels["version"] | "unknown"
4828     destination_workload: destination.workload.name | "unknown"
4829     destination_workload_namespace: destination.workload.namespace | "unknown"
4830     destination_principal: destination.principal | "unknown"
4831     destination_app: destination.labels["app"] | "unknown"
4832     destination_version: destination.labels["version"] | "unknown"
4833     destination_service: destination.service.name | "unknown"
4834     destination_service_name: destination.service.name | "unknown"
4835     destination_service_namespace: destination.service.namespace | "unknown"
4836     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4837   monitored_resource_type: '"UNSPECIFIED"'
4838 ---
4839 apiVersion: "config.istio.io/v1alpha2"
4840 kind: metric
4841 metadata:
4842   name: tcpbytereceived
4843   namespace: istio-system
4844 spec:
4845   value: connection.received.bytes | 0
4846   dimensions:
4847     reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
4848     source_workload: source.workload.name | "unknown"
4849     source_workload_namespace: source.workload.namespace | "unknown"
4850     source_principal: source.principal | "unknown"
4851     source_app: source.labels["app"] | "unknown"
4852     source_version: source.labels["version"] | "unknown"
4853     destination_workload: destination.workload.name | "unknown"
4854     destination_workload_namespace: destination.workload.namespace | "unknown"
4855     destination_principal: destination.principal | "unknown"
4856     destination_app: destination.labels["app"] | "unknown"
4857     destination_version: destination.labels["version"] | "unknown"
4858     destination_service: destination.service.name | "unknown"
4859     destination_service_name: destination.service.name | "unknown"
4860     destination_service_namespace: destination.service.namespace | "unknown"
4861     connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
4862   monitored_resource_type: '"UNSPECIFIED"'
4863 ---
4864 apiVersion: "config.istio.io/v1alpha2"
4865 kind: prometheus
4866 metadata:
4867   name: handler
4868   namespace: istio-system
4869 spec:
4870   metrics:
4871   - name: requests_total
4872     instance_name: requestcount.metric.istio-system
4873     kind: COUNTER
4874     label_names:
4875     - reporter
4876     - source_app
4877     - source_principal
4878     - source_workload
4879     - source_workload_namespace
4880     - source_version
4881     - destination_app
4882     - destination_principal
4883     - destination_workload
4884     - destination_workload_namespace
4885     - destination_version
4886     - destination_service
4887     - destination_service_name
4888     - destination_service_namespace
4889     - request_protocol
4890     - response_code
4891     - connection_security_policy
4892   - name: request_duration_seconds
4893     instance_name: requestduration.metric.istio-system
4894     kind: DISTRIBUTION
4895     label_names:
4896     - reporter
4897     - source_app
4898     - source_principal
4899     - source_workload
4900     - source_workload_namespace
4901     - source_version
4902     - destination_app
4903     - destination_principal
4904     - destination_workload
4905     - destination_workload_namespace
4906     - destination_version
4907     - destination_service
4908     - destination_service_name
4909     - destination_service_namespace
4910     - request_protocol
4911     - response_code
4912     - connection_security_policy
4913     buckets:
4914       explicit_buckets:
4915         bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
4916   - name: request_bytes
4917     instance_name: requestsize.metric.istio-system
4918     kind: DISTRIBUTION
4919     label_names:
4920     - reporter
4921     - source_app
4922     - source_principal
4923     - source_workload
4924     - source_workload_namespace
4925     - source_version
4926     - destination_app
4927     - destination_principal
4928     - destination_workload
4929     - destination_workload_namespace
4930     - destination_version
4931     - destination_service
4932     - destination_service_name
4933     - destination_service_namespace
4934     - request_protocol
4935     - response_code
4936     - connection_security_policy
4937     buckets:
4938       exponentialBuckets:
4939         numFiniteBuckets: 8
4940         scale: 1
4941         growthFactor: 10
4942   - name: response_bytes
4943     instance_name: responsesize.metric.istio-system
4944     kind: DISTRIBUTION
4945     label_names:
4946     - reporter
4947     - source_app
4948     - source_principal
4949     - source_workload
4950     - source_workload_namespace
4951     - source_version
4952     - destination_app
4953     - destination_principal
4954     - destination_workload
4955     - destination_workload_namespace
4956     - destination_version
4957     - destination_service
4958     - destination_service_name
4959     - destination_service_namespace
4960     - request_protocol
4961     - response_code
4962     - connection_security_policy
4963     buckets:
4964       exponentialBuckets:
4965         numFiniteBuckets: 8
4966         scale: 1
4967         growthFactor: 10
4968   - name: tcp_sent_bytes_total
4969     instance_name: tcpbytesent.metric.istio-system
4970     kind: COUNTER
4971     label_names:
4972     - reporter
4973     - source_app
4974     - source_principal
4975     - source_workload
4976     - source_workload_namespace
4977     - source_version
4978     - destination_app
4979     - destination_principal
4980     - destination_workload
4981     - destination_workload_namespace
4982     - destination_version
4983     - destination_service
4984     - destination_service_name
4985     - destination_service_namespace
4986     - connection_security_policy
4987   - name: tcp_received_bytes_total
4988     instance_name: tcpbytereceived.metric.istio-system
4989     kind: COUNTER
4990     label_names:
4991     - reporter
4992     - source_app
4993     - source_principal
4994     - source_workload
4995     - source_workload_namespace
4996     - source_version
4997     - destination_app
4998     - destination_principal
4999     - destination_workload
5000     - destination_workload_namespace
5001     - destination_version
5002     - destination_service
5003     - destination_service_name
5004     - destination_service_namespace
5005     - connection_security_policy
5006 ---
5007 apiVersion: "config.istio.io/v1alpha2"
5008 kind: rule
5009 metadata:
5010   name: promhttp
5011   namespace: istio-system
5012 spec:
5013   match: context.protocol == "http" || context.protocol == "grpc"
5014   actions:
5015   - handler: handler.prometheus
5016     instances:
5017     - requestcount.metric
5018     - requestduration.metric
5019     - requestsize.metric
5020     - responsesize.metric
5021 ---
5022 apiVersion: "config.istio.io/v1alpha2"
5023 kind: rule
5024 metadata:
5025   name: promtcp
5026   namespace: istio-system
5027 spec:
5028   match: context.protocol == "tcp"
5029   actions:
5030   - handler: handler.prometheus
5031     instances:
5032     - tcpbytesent.metric
5033     - tcpbytereceived.metric
5034 ---
5035
5036 apiVersion: "config.istio.io/v1alpha2"
5037 kind: kubernetesenv
5038 metadata:
5039   name: handler
5040   namespace: istio-system
5041 spec:
5042   # when running from mixer root, use the following config after adding a
5043   # symbolic link to a kubernetes config file via:
5044   #
5045   # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig
5046   #
5047   # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig"
5048
5049 ---
5050 apiVersion: "config.istio.io/v1alpha2"
5051 kind: rule
5052 metadata:
5053   name: kubeattrgenrulerule
5054   namespace: istio-system
5055 spec:
5056   actions:
5057   - handler: handler.kubernetesenv
5058     instances:
5059     - attributes.kubernetes
5060 ---
5061 apiVersion: "config.istio.io/v1alpha2"
5062 kind: rule
5063 metadata:
5064   name: tcpkubeattrgenrulerule
5065   namespace: istio-system
5066 spec:
5067   match: context.protocol == "tcp"
5068   actions:
5069   - handler: handler.kubernetesenv
5070     instances:
5071     - attributes.kubernetes
5072 ---
5073 apiVersion: "config.istio.io/v1alpha2"
5074 kind: kubernetes
5075 metadata:
5076   name: attributes
5077   namespace: istio-system
5078 spec:
5079   # Pass the required attribute data to the adapter
5080   source_uid: source.uid | ""
5081   source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr
5082   destination_uid: destination.uid | ""
5083   destination_port: destination.port | 0
5084   attribute_bindings:
5085     # Fill the new attributes from the adapter produced output.
5086     # $out refers to an instance of OutputTemplate message
5087     source.ip: $out.source_pod_ip | ip("0.0.0.0")
5088     source.uid: $out.source_pod_uid | "unknown"
5089     source.labels: $out.source_labels | emptyStringMap()
5090     source.name: $out.source_pod_name | "unknown"
5091     source.namespace: $out.source_namespace | "default"
5092     source.owner: $out.source_owner | "unknown"
5093     source.serviceAccount: $out.source_service_account_name | "unknown"
5094     source.workload.uid: $out.source_workload_uid | "unknown"
5095     source.workload.name: $out.source_workload_name | "unknown"
5096     source.workload.namespace: $out.source_workload_namespace | "unknown"
5097     destination.ip: $out.destination_pod_ip | ip("0.0.0.0")
5098     destination.uid: $out.destination_pod_uid | "unknown"
5099     destination.labels: $out.destination_labels | emptyStringMap()
5100     destination.name: $out.destination_pod_name | "unknown"
5101     destination.container.name: $out.destination_container_name | "unknown"
5102     destination.namespace: $out.destination_namespace | "default"
5103     destination.owner: $out.destination_owner | "unknown"
5104     destination.serviceAccount: $out.destination_service_account_name | "unknown"
5105     destination.workload.uid: $out.destination_workload_uid | "unknown"
5106     destination.workload.name: $out.destination_workload_name | "unknown"
5107     destination.workload.namespace: $out.destination_workload_namespace | "unknown"
5108
5109 ---
5110 # Configuration needed by Mixer.
5111 # Mixer cluster is delivered via CDS
5112 # Specify mixer cluster settings
5113 apiVersion: networking.istio.io/v1alpha3
5114 kind: DestinationRule
5115 metadata:
5116   name: istio-policy
5117   namespace: istio-system
5118 spec:
5119   host: istio-policy.istio-system.svc.cluster.local
5120   trafficPolicy:
5121     connectionPool:
5122       http:
5123         http2MaxRequests: 10000
5124         maxRequestsPerConnection: 10000
5125 ---
5126 apiVersion: networking.istio.io/v1alpha3
5127 kind: DestinationRule
5128 metadata:
5129   name: istio-telemetry
5130   namespace: istio-system
5131 spec:
5132   host: istio-telemetry.istio-system.svc.cluster.local
5133   trafficPolicy:
5134     connectionPool:
5135       http:
5136         http2MaxRequests: 10000
5137         maxRequestsPerConnection: 10000
5138 ---
5139