install/istio.yaml

   1 apiVersion: v1
   2 kind: Namespace
   3 metadata:
   4  name: istio-system
   5 ---
   6 # Source: istio/charts/mixer/templates/configmap.yaml
   7 apiVersion: v1
   8 kind: ConfigMap
   9 metadata:
  10   name: istio-statsd-prom-bridge
  11   namespace: istio-system
  12   labels:
  13     app: istio-statsd-prom-bridge
  14     chart: mixer-0.8.0
  15     release: RELEASE-NAME
  16     heritage: Tiller
  17     istio: mixer
  18 data:
  19   mapping.conf: |-
  20 ---
  21 apiVersion: v1
  22 kind: ConfigMap
  23 metadata:
  24   name: istio-mixer-custom-resources
  25   namespace: istio-system
  26   labels:
  27     app: istio-mixer
  28     chart: mixer-0.8.0
  29     release: RELEASE-NAME
  30     heritage: Tiller
  31     istio: mixer
  32 data:
  33   custom-resources.yaml: |-
  34     apiVersion: "config.istio.io/v1alpha2"
  35     kind: attributemanifest
  36     metadata:
  37       name: istioproxy
  38       namespace: istio-system
  39     spec:
  40       attributes:
  41         origin.ip:
  42           valueType: IP_ADDRESS
  43         origin.uid:
  44           valueType: STRING
  45         origin.user:
  46           valueType: STRING
  47         request.headers:
  48           valueType: STRING_MAP
  49         request.id:
  50           valueType: STRING
  51         request.host:
  52           valueType: STRING
  53         request.method:
  54           valueType: STRING
  55         request.path:
  56           valueType: STRING
  57         request.reason:
  58           valueType: STRING
  59         request.referer:
  60           valueType: STRING
  61         request.scheme:
  62           valueType: STRING
  63         request.total_size:
  64               valueType: INT64
  65         request.size:
  66           valueType: INT64
  67         request.time:
  68           valueType: TIMESTAMP
  69         request.useragent:
  70           valueType: STRING
  71         response.code:
  72           valueType: INT64
  73         response.duration:
  74           valueType: DURATION
  75         response.headers:
  76           valueType: STRING_MAP
  77         response.total_size:
  78               valueType: INT64
  79         response.size:
  80           valueType: INT64
  81         response.time:
  82           valueType: TIMESTAMP
  83         source.uid:
  84           valueType: STRING
  85         source.user:
  86           valueType: STRING
  87         destination.uid:
  88           valueType: STRING
  89         connection.id:
  90           valueType: STRING
  91         connection.received.bytes:
  92           valueType: INT64
  93         connection.received.bytes_total:
  94           valueType: INT64
  95         connection.sent.bytes:
  96           valueType: INT64
  97         connection.sent.bytes_total:
  98           valueType: INT64
  99         connection.duration:
 100           valueType: DURATION
 101         connection.mtls:
 102           valueType: BOOL
 103         context.protocol:
 104           valueType: STRING
 105         context.timestamp:
 106           valueType: TIMESTAMP
 107         context.time:
 108           valueType: TIMESTAMP
 109         api.service:
 110           valueType: STRING
 111         api.version:
 112           valueType: STRING
 113         api.operation:
 114           valueType: STRING
 115         api.protocol:
 116           valueType: STRING
 117         request.auth.principal:
 118           valueType: STRING
 119         request.auth.audiences:
 120           valueType: STRING
 121         request.auth.presenter:
 122           valueType: STRING
 123         request.auth.claims:
 124           valueType: STRING_MAP
 125         request.auth.raw_claims:
 126           valueType: STRING
 127         request.api_key:
 128           valueType: STRING
 129
 130     ---
 131     apiVersion: "config.istio.io/v1alpha2"
 132     kind: attributemanifest
 133     metadata:
 134       name: kubernetes
 135       namespace: istio-system
 136     spec:
 137       attributes:
 138         source.ip:
 139           valueType: IP_ADDRESS
 140         source.labels:
 141           valueType: STRING_MAP
 142         source.name:
 143           valueType: STRING
 144         source.namespace:
 145           valueType: STRING
 146         source.service:
 147           valueType: STRING
 148         source.serviceAccount:
 149           valueType: STRING
 150         destination.ip:
 151           valueType: IP_ADDRESS
 152         destination.labels:
 153           valueType: STRING_MAP
 154         destination.name:
 155           valueType: STRING
 156         destination.namespace:
 157           valueType: STRING
 158         destination.service:
 159           valueType: STRING
 160         destination.serviceAccount:
 161           valueType: STRING
 162     ---
 163     apiVersion: "config.istio.io/v1alpha2"
 164     kind: stdio
 165     metadata:
 166       name: handler
 167       namespace: istio-system
 168     spec:
 169       outputAsJson: true
 170     ---
 171     apiVersion: "config.istio.io/v1alpha2"
 172     kind: logentry
 173     metadata:
 174       name: accesslog
 175       namespace: istio-system
 176     spec:
 177       severity: '"Info"'
 178       timestamp: request.time
 179       variables:
 180         originIp: origin.ip | ip("0.0.0.0")
 181         sourceIp: source.ip | ip("0.0.0.0")
 182         sourceService: source.service | ""
 183         sourceUser: source.user | source.uid | ""
 184         sourceNamespace: source.namespace | ""
 185         destinationIp: destination.ip | ip("0.0.0.0")
 186         destinationService: destination.service | ""
 187         destinationNamespace: destination.namespace | ""
 188         apiName: api.service | ""
 189         apiVersion: api.version | ""
 190         apiClaims: request.headers["sec-istio-auth-userinfo"]| ""
 191         apiKey: request.api_key | request.headers["x-api-key"] | ""
 192         requestOperation: api.operation | ""
 193         protocol: request.scheme | "http"
 194         method: request.method | ""
 195         url: request.path | ""
 196         responseCode: response.code | 0
 197         responseSize: response.size | 0
 198         requestSize: request.size | 0
 199         latency: response.duration | "0ms"
 200         connectionMtls: connection.mtls | false
 201         userAgent: request.useragent | ""
 202         responseTimestamp: response.time
 203         receivedBytes: request.total_size | connection.received.bytes | 0
 204         sentBytes: response.total_size | connection.sent.bytes | 0
 205         referer: request.referer | ""
 206       monitored_resource_type: '"UNSPECIFIED"'
 207     ---
 208     apiVersion: "config.istio.io/v1alpha2"
 209     kind: rule
 210     metadata:
 211       name: stdio
 212       namespace: istio-system
 213     spec:
 214       match: "true" # If omitted match is true.
 215       actions:
 216       - handler: handler.stdio
 217         instances:
 218         - accesslog.logentry
 219     ---
 220     apiVersion: "config.istio.io/v1alpha2"
 221     kind: metric
 222     metadata:
 223       name: requestcount
 224       namespace: istio-system
 225     spec:
 226       value: "1"
 227       dimensions:
 228         source_service: source.service | "unknown"
 229         source_version: source.labels["version"] | "unknown"
 230         destination_service: destination.service | "unknown"
 231         destination_version: destination.labels["version"] | "unknown"
 232         response_code: response.code | 200
 233         connection_mtls: connection.mtls | false
 234       monitored_resource_type: '"UNSPECIFIED"'
 235     ---
 236     apiVersion: "config.istio.io/v1alpha2"
 237     kind: metric
 238     metadata:
 239       name: requestduration
 240       namespace: istio-system
 241     spec:
 242       value: response.duration | "0ms"
 243       dimensions:
 244         source_service: source.service | "unknown"
 245         source_version: source.labels["version"] | "unknown"
 246         destination_service: destination.service | "unknown"
 247         destination_version: destination.labels["version"] | "unknown"
 248         response_code: response.code | 200
 249         connection_mtls: connection.mtls | false
 250       monitored_resource_type: '"UNSPECIFIED"'
 251     ---
 252     apiVersion: "config.istio.io/v1alpha2"
 253     kind: metric
 254     metadata:
 255       name: requestsize
 256       namespace: istio-system
 257     spec:
 258       value: request.size | 0
 259       dimensions:
 260         source_service: source.service | "unknown"
 261         source_version: source.labels["version"] | "unknown"
 262         destination_service: destination.service | "unknown"
 263         destination_version: destination.labels["version"] | "unknown"
 264         response_code: response.code | 200
 265         connection_mtls: connection.mtls | false
 266       monitored_resource_type: '"UNSPECIFIED"'
 267     ---
 268     apiVersion: "config.istio.io/v1alpha2"
 269     kind: metric
 270     metadata:
 271       name: responsesize
 272       namespace: istio-system
 273     spec:
 274       value: response.size | 0
 275       dimensions:
 276         source_service: source.service | "unknown"
 277         source_version: source.labels["version"] | "unknown"
 278         destination_service: destination.service | "unknown"
 279         destination_version: destination.labels["version"] | "unknown"
 280         response_code: response.code | 200
 281         connection_mtls: connection.mtls | false
 282       monitored_resource_type: '"UNSPECIFIED"'
 283     ---
 284     apiVersion: "config.istio.io/v1alpha2"
 285     kind: metric
 286     metadata:
 287       name: tcpbytesent
 288       namespace: istio-system
 289       labels:
 290         istio-protocol: tcp # needed so that mixer will only generate when context.protocol == tcp
 291     spec:
 292       value: connection.sent.bytes | 0
 293       dimensions:
 294         source_service: source.service | "unknown"
 295         source_version: source.labels["version"] | "unknown"
 296         destination_service: destination.service | "unknown"
 297         destination_version: destination.labels["version"] | "unknown"
 298         connection_mtls: connection.mtls | false
 299       monitored_resource_type: '"UNSPECIFIED"'
 300     ---
 301     apiVersion: "config.istio.io/v1alpha2"
 302     kind: metric
 303     metadata:
 304       name: tcpbytereceived
 305       namespace: istio-system
 306       labels:
 307         istio-protocol: tcp # needed so that mixer will only generate when context.protocol == tcp
 308     spec:
 309       value: connection.received.bytes | 0
 310       dimensions:
 311         source_service: source.service | "unknown"
 312         source_version: source.labels["version"] | "unknown"
 313         destination_service: destination.service | "unknown"
 314         destination_version: destination.labels["version"] | "unknown"
 315         connection_mtls: connection.mtls | false
 316       monitored_resource_type: '"UNSPECIFIED"'
 317     ---
 318     apiVersion: "config.istio.io/v1alpha2"
 319     kind: prometheus
 320     metadata:
 321       name: handler
 322       namespace: istio-system
 323     spec:
 324       metrics:
 325       - name: request_count
 326         instance_name: requestcount.metric.istio-system
 327         kind: COUNTER
 328         label_names:
 329         - source_service
 330         - source_version
 331         - destination_service
 332         - destination_version
 333         - response_code
 334         - connection_mtls
 335       - name: request_duration
 336         instance_name: requestduration.metric.istio-system
 337         kind: DISTRIBUTION
 338         label_names:
 339         - source_service
 340         - source_version
 341         - destination_service
 342         - destination_version
 343         - response_code
 344         - connection_mtls
 345         buckets:
 346           explicit_buckets:
 347             bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
 348       - name: request_size
 349         instance_name: requestsize.metric.istio-system
 350         kind: DISTRIBUTION
 351         label_names:
 352         - source_service
 353         - source_version
 354         - destination_service
 355         - destination_version
 356         - response_code
 357         - connection_mtls
 358         buckets:
 359           exponentialBuckets:
 360             numFiniteBuckets: 8
 361             scale: 1
 362             growthFactor: 10
 363       - name: response_size
 364         instance_name: responsesize.metric.istio-system
 365         kind: DISTRIBUTION
 366         label_names:
 367         - source_service
 368         - source_version
 369         - destination_service
 370         - destination_version
 371         - response_code
 372         - connection_mtls
 373         buckets:
 374           exponentialBuckets:
 375             numFiniteBuckets: 8
 376             scale: 1
 377             growthFactor: 10
 378       - name: tcp_bytes_sent
 379         instance_name: tcpbytesent.metric.istio-system
 380         kind: COUNTER
 381         label_names:
 382         - source_service
 383         - source_version
 384         - destination_service
 385         - destination_version
 386         - connection_mtls
 387       - name: tcp_bytes_received
 388         instance_name: tcpbytereceived.metric.istio-system
 389         kind: COUNTER
 390         label_names:
 391         - source_service
 392         - source_version
 393         - destination_service
 394         - destination_version
 395         - connection_mtls
 396     ---
 397     apiVersion: "config.istio.io/v1alpha2"
 398     kind: rule
 399     metadata:
 400       name: promhttp
 401       namespace: istio-system
 402       labels:
 403         istio-protocol: http
 404     spec:
 405       actions:
 406       - handler: handler.prometheus
 407         instances:
 408         - requestcount.metric
 409         - requestduration.metric
 410         - requestsize.metric
 411         - responsesize.metric
 412     ---
 413     apiVersion: "config.istio.io/v1alpha2"
 414     kind: rule
 415     metadata:
 416       name: promtcp
 417       namespace: istio-system
 418       labels:
 419         istio-protocol: tcp # needed so that mixer will only execute when context.protocol == TCP
 420     spec:
 421       actions:
 422       - handler: handler.prometheus
 423         instances:
 424         - tcpbytesent.metric
 425         - tcpbytereceived.metric
 426     ---
 427
 428     apiVersion: "config.istio.io/v1alpha2"
 429     kind: kubernetesenv
 430     metadata:
 431       name: handler
 432       namespace: istio-system
 433     spec:
 434       # when running from mixer root, use the following config after adding a
 435       # symbolic link to a kubernetes config file via:
 436       #
 437       # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig
 438       #
 439       # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig"
 440
 441     ---
 442     apiVersion: "config.istio.io/v1alpha2"
 443     kind: rule
 444     metadata:
 445       name: kubeattrgenrulerule
 446       namespace: istio-system
 447     spec:
 448       actions:
 449       - handler: handler.kubernetesenv
 450         instances:
 451         - attributes.kubernetes
 452     ---
 453     apiVersion: "config.istio.io/v1alpha2"
 454     kind: rule
 455     metadata:
 456       name: tcpkubeattrgenrulerule
 457       namespace: istio-system
 458     spec:
 459       match: context.protocol == "tcp"
 460       actions:
 461       - handler: handler.kubernetesenv
 462         instances:
 463         - attributes.kubernetes
 464     ---
 465     apiVersion: "config.istio.io/v1alpha2"
 466     kind: kubernetes
 467     metadata:
 468       name: attributes
 469       namespace: istio-system
 470     spec:
 471       # Pass the required attribute data to the adapter
 472       source_uid: source.uid | ""
 473       source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr
 474       destination_uid: destination.uid | ""
 475       origin_uid: '""'
 476       origin_ip: ip("0.0.0.0") # default to unspecified ip addr
 477       attribute_bindings:
 478         # Fill the new attributes from the adapter produced output.
 479         # $out refers to an instance of OutputTemplate message
 480         source.ip: $out.source_pod_ip | ip("0.0.0.0")
 481         source.labels: $out.source_labels | emptyStringMap()
 482         source.namespace: $out.source_namespace | "default"
 483         source.service: $out.source_service | "unknown"
 484         source.serviceAccount: $out.source_service_account_name | "unknown"
 485         destination.ip: $out.destination_pod_ip | ip("0.0.0.0")
 486         destination.labels: $out.destination_labels | emptyStringMap()
 487         destination.namespace: $out.destination_namespace | "default"
 488         destination.service: $out.destination_service | "unknown"
 489         destination.serviceAccount: $out.destination_service_account_name | "unknown"
 490     ---
 491     # Configuration needed by Mixer.
 492     # Mixer cluster is delivered via CDS
 493     # Specify mixer cluster settings
 494     apiVersion: networking.istio.io/v1alpha3
 495     kind: DestinationRule
 496     metadata:
 497       name: istio-policy
 498       namespace: istio-system
 499     spec:
 500       host: istio-policy.istio-system.svc.cluster.local
 501       trafficPolicy:
 502         connectionPool:
 503           http:
 504             http2MaxRequests: 10000
 505             maxRequestsPerConnection: 10000
 506     ---
 507     apiVersion: networking.istio.io/v1alpha3
 508     kind: DestinationRule
 509     metadata:
 510       name: istio-telemetry
 511       namespace: istio-system
 512     spec:
 513       host: istio-telemetry.istio-system.svc.cluster.local
 514       trafficPolicy:
 515         connectionPool:
 516           http:
 517             http2MaxRequests: 10000
 518             maxRequestsPerConnection: 10000
 519     ---
 520
 521
 522 ---
 523 # Source: istio/charts/prometheus/templates/configmap.yaml
 524 apiVersion: v1
 525 kind: ConfigMap
 526 metadata:
 527   name: prometheus
 528   namespace: istio-system
 529   labels:
 530     app: prometheus
 531     chart: prometheus-0.1.0
 532     release: RELEASE-NAME
 533     heritage: Tiller
 534 data:
 535   prometheus.yml: |-
 536     global:
 537       scrape_interval: 15s
 538     scrape_configs:
 539
 540     - job_name: 'istio-mesh'
 541       # Override the global default and scrape targets from this job every 5 seconds.
 542       scrape_interval: 5s
 543
 544       kubernetes_sd_configs:
 545       - role: endpoints
 546
 547       relabel_configs:
 548       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 549         action: keep
 550         regex: istio-system;istio-telemetry;prometheus
 551
 552     - job_name: 'envoy'
 553       # Override the global default and scrape targets from this job every 5 seconds.
 554       scrape_interval: 5s
 555       # metrics_path defaults to '/metrics'
 556       # scheme defaults to 'http'.
 557
 558       kubernetes_sd_configs:
 559       - role: endpoints
 560
 561       relabel_configs:
 562       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 563         action: keep
 564         regex: istio-system;istio-statsd-prom-bridge;statsd-prom
 565
 566     - job_name: 'istio-policy'
 567       # Override the global default and scrape targets from this job every 5 seconds.
 568       scrape_interval: 5s
 569       # metrics_path defaults to '/metrics'
 570       # scheme defaults to 'http'.
 571
 572       kubernetes_sd_configs:
 573       - role: endpoints
 574
 575       relabel_configs:
 576       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 577         action: keep
 578         regex: istio-system;istio-policy;http-monitoring
 579
 580     - job_name: 'istio-telemetry'
 581       # Override the global default and scrape targets from this job every 5 seconds.
 582       scrape_interval: 5s
 583       # metrics_path defaults to '/metrics'
 584       # scheme defaults to 'http'.
 585
 586       kubernetes_sd_configs:
 587       - role: endpoints
 588
 589       relabel_configs:
 590       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 591         action: keep
 592         regex: istio-system;istio-telemetry;http-monitoring
 593
 594     - job_name: 'pilot'
 595       # Override the global default and scrape targets from this job every 5 seconds.
 596       scrape_interval: 5s
 597       # metrics_path defaults to '/metrics'
 598       # scheme defaults to 'http'.
 599
 600       kubernetes_sd_configs:
 601       - role: endpoints
 602
 603       relabel_configs:
 604       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 605         action: keep
 606         regex: istio-system;istio-pilot;http-monitoring
 607
 608     # scrape config for API servers
 609     - job_name: 'kubernetes-apiservers'
 610       kubernetes_sd_configs:
 611       - role: endpoints
 612       scheme: https
 613       tls_config:
 614         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 615       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 616       relabel_configs:
 617       - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 618         action: keep
 619         regex: default;kubernetes;https
 620
 621     # scrape config for nodes (kubelet)
 622     - job_name: 'kubernetes-nodes'
 623       scheme: https
 624       tls_config:
 625         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 626       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 627       kubernetes_sd_configs:
 628       - role: node
 629       relabel_configs:
 630       - action: labelmap
 631         regex: __meta_kubernetes_node_label_(.+)
 632       - target_label: __address__
 633         replacement: kubernetes.default.svc:443
 634       - source_labels: [__meta_kubernetes_node_name]
 635         regex: (.+)
 636         target_label: __metrics_path__
 637         replacement: /api/v1/nodes/${1}/proxy/metrics
 638
 639     # Scrape config for Kubelet cAdvisor.
 640     #
 641     # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
 642     # (those whose names begin with 'container_') have been removed from the
 643     # Kubelet metrics endpoint.  This job scrapes the cAdvisor endpoint to
 644     # retrieve those metrics.
 645     #
 646     # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
 647     # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
 648     # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
 649     # the --cadvisor-port=0 Kubelet flag).
 650     #
 651     # This job is not necessary and should be removed in Kubernetes 1.6 and
 652     # earlier versions, or it will cause the metrics to be scraped twice.
 653     - job_name: 'kubernetes-cadvisor'
 654       scheme: https
 655       tls_config:
 656         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 657       bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 658       kubernetes_sd_configs:
 659       - role: node
 660       relabel_configs:
 661       - action: labelmap
 662         regex: __meta_kubernetes_node_label_(.+)
 663       - target_label: __address__
 664         replacement: kubernetes.default.svc:443
 665       - source_labels: [__meta_kubernetes_node_name]
 666         regex: (.+)
 667         target_label: __metrics_path__
 668         replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
 669
 670     # scrape config for service endpoints.
 671     - job_name: 'kubernetes-service-endpoints'
 672       kubernetes_sd_configs:
 673       - role: endpoints
 674       relabel_configs:
 675       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
 676         action: keep
 677         regex: true
 678       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
 679         action: replace
 680         target_label: __scheme__
 681         regex: (https?)
 682       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
 683         action: replace
 684         target_label: __metrics_path__
 685         regex: (.+)
 686       - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
 687         action: replace
 688         target_label: __address__
 689         regex: ([^:]+)(?::\d+)?;(\d+)
 690         replacement: $1:$2
 691       - action: labelmap
 692         regex: __meta_kubernetes_service_label_(.+)
 693       - source_labels: [__meta_kubernetes_namespace]
 694         action: replace
 695         target_label: kubernetes_namespace
 696       - source_labels: [__meta_kubernetes_service_name]
 697         action: replace
 698         target_label: kubernetes_name
 699
 700     # Example scrape config for pods
 701     - job_name: 'kubernetes-pods'
 702       kubernetes_sd_configs:
 703       - role: pod
 704
 705       relabel_configs:
 706       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 707         action: keep
 708         regex: true
 709       - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
 710         action: replace
 711         target_label: __metrics_path__
 712         regex: (.+)
 713       - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
 714         action: replace
 715         regex: ([^:]+)(?::\d+)?;(\d+)
 716         replacement: $1:$2
 717         target_label: __address__
 718       - action: labelmap
 719         regex: __meta_kubernetes_pod_label_(.+)
 720       - source_labels: [__meta_kubernetes_namespace]
 721         action: replace
 722         target_label: namespace
 723       - source_labels: [__meta_kubernetes_pod_name]
 724         action: replace
 725         target_label: pod_name
 726
 727 ---
 728 # Source: istio/templates/configmap.yaml
 729 apiVersion: v1
 730 kind: ConfigMap
 731 metadata:
 732   name: istio
 733   namespace: istio-system
 734   labels:
 735     app: istio
 736     chart: istio-0.8.0
 737     release: RELEASE-NAME
 738     heritage: Tiller
 739 data:
 740   mesh: |-
 741     #
 742     # Edit this list to avoid using mTLS to connect to these services.
 743     # Typically, these are control services (e.g kubernetes API server) that don't have istio sidecar
 744     # to transparently terminate mTLS authentication.
 745     # mtlsExcludedServices: ["kubernetes.default.svc.cluster.local"]
 746
 747     # Set the following variable to true to disable policy checks by the Mixer.
 748     # Note that metrics will still be reported to the Mixer.
 749     disablePolicyChecks: false
 750     # Set enableTracing to false to disable request tracing.
 751     enableTracing: true
 752     #
 753     # To disable the mixer completely (including metrics), comment out
 754     # the following lines
 755     mixerCheckServer: istio-policy.istio-system.svc.cluster.local:15004
 756     mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:15004
 757     # This is the ingress service name, update if you used a different name
 758     ingressService: istio-ingress
 759     #
 760     # Along with discoveryRefreshDelay, this setting determines how
 761     # frequently should Envoy fetch and update its internal configuration
 762     # from istio Pilot. Lower refresh delay results in higher CPU
 763     # utilization and potential performance loss in exchange for faster
 764     # convergence. Tweak this value according to your setup.
 765     rdsRefreshDelay: 10s
 766     #
 767     defaultConfig:
 768       # NOTE: If you change any values in this section, make sure to make
 769       # the same changes in start up args in istio-ingress pods.
 770       # See rdsRefreshDelay for explanation about this setting.
 771       discoveryRefreshDelay: 10s
 772       #
 773       # TCP connection timeout between Envoy & the application, and between Envoys.
 774       connectTimeout: 10s
 775       #
 776       ### ADVANCED SETTINGS #############
 777       # Where should envoy's configuration be stored in the istio-proxy container
 778       configPath: "/etc/istio/proxy"
 779       binaryPath: "/usr/local/bin/envoy"
 780       # The pseudo service name used for Envoy.
 781       serviceCluster: istio-proxy
 782       # These settings that determine how long an old Envoy
 783       # process should be kept alive after an occasional reload.
 784       drainDuration: 45s
 785       parentShutdownDuration: 1m0s
 786       #
 787       # The mode used to redirect inbound connections to Envoy. This setting
 788       # has no effect on outbound traffic: iptables REDIRECT is always used for
 789       # outbound connections.
 790       # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
 791       # The "REDIRECT" mode loses source addresses during redirection.
 792       # If "TPROXY", use iptables TPROXY to redirect to Envoy.
 793       # The "TPROXY" mode preserves both the source and destination IP
 794       # addresses and ports, so that they can be used for advanced filtering
 795       # and manipulation.
 796       # The "TPROXY" mode also configures the sidecar to run with the
 797       # CAP_NET_ADMIN capability, which is required to use TPROXY.
 798       #interceptionMode: REDIRECT
 799       #
 800       # Port where Envoy listens (on local host) for admin commands
 801       # You can exec into the istio-proxy container in a pod and
 802       # curl the admin port (curl http://localhost:15000/) to obtain
 803       # diagnostic information from Envoy. See
 804       # https://lyft.github.io/envoy/docs/operations/admin.html
 805       # for more details
 806       proxyAdminPort: 15000
 807       #
 808       # Zipkin trace collector
 809       zipkinAddress: zipkin.istio-system:9411
 810       #
 811       # Statsd metrics collector converts statsd metrics into Prometheus metrics.
 812       statsdUdpAddress: istio-statsd-prom-bridge.istio-system:9125
 813       #
 814       # Mutual TLS authentication between sidecars and istio control plane.
 815       controlPlaneAuthPolicy: NONE
 816       #
 817       # Address where istio Pilot service is running
 818       discoveryAddress: istio-pilot.istio-system:15007
 819
 820 ---
 821 # Source: istio/templates/sidecar-injector-configmap.yaml
 822 apiVersion: v1
 823 kind: ConfigMap
 824 metadata:
 825   name: istio-sidecar-injector
 826   namespace: istio-system
 827   labels:
 828     app: istio
 829     chart: istio-0.8.0
 830     release: RELEASE-NAME
 831     heritage: Tiller
 832     istio: sidecar-injector
 833 data:
 834   config: |-
 835     policy: disabled
 836     template: |-
 837       initContainers:
 838       - name: istio-init
 839         image: docker.io/istio/proxy_init:0.8.0
 840         args:
 841         - "-p"
 842         - [[ .MeshConfig.ProxyListenPort ]]
 843         - "-u"
 844         - 1337
 845         - "-m"
 846         - [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 847         - "-i"
 848         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges") -]]
 849         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeOutboundIPRanges"  ]]"
 850         [[ else -]]
 851         - "*"
 852         [[ end -]]
 853         - "-x"
 854         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges") -]]
 855         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeOutboundIPRanges"  ]]"
 856         [[ else -]]
 857         - ""
 858         [[ end -]]
 859         - "-b"
 860         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts") -]]
 861         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/includeInboundPorts"  ]]"
 862         [[ else -]]
 863         - [[ range .Spec.Containers -]][[ range .Ports -]][[ .ContainerPort -]], [[ end -]][[ end -]][[ end]]
 864         - "-d"
 865         [[ if (isset .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts") -]]
 866         - "[[ index .ObjectMeta.Annotations "traffic.sidecar.istio.io/excludeInboundPorts" ]]"
 867         [[ else -]]
 868         - ""
 869         [[ end -]]
 870         imagePullPolicy: IfNotPresent
 871         securityContext:
 872           capabilities:
 873             add:
 874             - NET_ADMIN
 875           privileged: true
 876         restartPolicy: Always
 877
 878       containers:
 879       - name: istio-proxy
 880         image: [[ if (isset .ObjectMeta.Annotations "sidecar.istio.io/proxyImage") -]]
 881         "[[ index .ObjectMeta.Annotations "sidecar.istio.io/proxyImage" ]]"
 882         [[ else -]]
 883         docker.io/istio/proxy_debug:0.8.0
 884         [[ end -]]
 885         args:
 886         - proxy
 887         - sidecar
 888         - --configPath
 889         - [[ .ProxyConfig.ConfigPath ]]
 890         - --binaryPath
 891         - [[ .ProxyConfig.BinaryPath ]]
 892         - --serviceCluster
 893         [[ if ne "" (index .ObjectMeta.Labels "app") -]]
 894         - [[ index .ObjectMeta.Labels "app" ]]
 895         [[ else -]]
 896         - "istio-proxy"
 897         [[ end -]]
 898         - --drainDuration
 899         - [[ formatDuration .ProxyConfig.DrainDuration ]]
 900         - --parentShutdownDuration
 901         - [[ formatDuration .ProxyConfig.ParentShutdownDuration ]]
 902         - --discoveryAddress
 903         - [[ .ProxyConfig.DiscoveryAddress ]]
 904         - --discoveryRefreshDelay
 905         - [[ formatDuration .ProxyConfig.DiscoveryRefreshDelay ]]
 906         - --zipkinAddress
 907         - [[ .ProxyConfig.ZipkinAddress ]]
 908         - --connectTimeout
 909         - [[ formatDuration .ProxyConfig.ConnectTimeout ]]
 910         - --statsdUdpAddress
 911         - [[ .ProxyConfig.StatsdUdpAddress ]]
 912         - --proxyAdminPort
 913         - [[ .ProxyConfig.ProxyAdminPort ]]
 914         - --controlPlaneAuthPolicy
 915         - [[ .ProxyConfig.ControlPlaneAuthPolicy ]]
 916         env:
 917         - name: POD_NAME
 918           valueFrom:
 919             fieldRef:
 920               fieldPath: metadata.name
 921         - name: POD_NAMESPACE
 922           valueFrom:
 923             fieldRef:
 924               fieldPath: metadata.namespace
 925         - name: INSTANCE_IP
 926           valueFrom:
 927             fieldRef:
 928               fieldPath: status.podIP
 929         - name: ISTIO_META_POD_NAME
 930           valueFrom:
 931             fieldRef:
 932               fieldPath: metadata.name
 933         - name: ISTIO_META_INTERCEPTION_MODE
 934           value: [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]]
 935         imagePullPolicy: IfNotPresent
 936         securityContext:
 937             privileged: false
 938             readOnlyRootFilesystem: true
 939             [[ if eq (or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String) "TPROXY" -]]
 940             capabilities:
 941               add:
 942               - NET_ADMIN
 943             [[ else -]]
 944             runAsUser: 1337
 945             [[ end -]]
 946         restartPolicy: Always
 947         resources:
 948           requests:
 949             cpu: 100m
 950             memory: 128Mi
 951
 952         volumeMounts:
 953         - mountPath: /etc/istio/proxy
 954           name: istio-envoy
 955         - mountPath: /etc/certs/
 956           name: istio-certs
 957           readOnly: true
 958       volumes:
 959       - emptyDir:
 960           medium: Memory
 961         name: istio-envoy
 962       - name: istio-certs
 963         secret:
 964           optional: true
 965           [[ if eq .Spec.ServiceAccountName "" -]]
 966           secretName: istio.default
 967           [[ else -]]
 968           secretName: [[ printf "istio.%s" .Spec.ServiceAccountName ]]
 969           [[ end -]]
 970
 971
 972 ---
 973 # Source: istio/charts/egressgateway/templates/serviceaccount.yaml
 974 apiVersion: v1
 975 kind: ServiceAccount
 976 metadata:
 977   name: istio-egressgateway-service-account
 978   namespace: istio-system
 979   labels:
 980     app: egressgateway
 981     chart: egressgateway-0.8.0
 982     heritage: Tiller
 983     release: RELEASE-NAME
 984
 985 ---
 986 # Source: istio/charts/ingressgateway/templates/serviceaccount.yaml
 987 apiVersion: v1
 988 kind: ServiceAccount
 989 metadata:
 990   name: istio-ingressgateway-service-account
 991   namespace: istio-system
 992   labels:
 993     app: ingressgateway
 994     chart: ingressgateway-0.8.0
 995     heritage: Tiller
 996     release: RELEASE-NAME
 997
 998 ---
 999 # Source: istio/charts/mixer/templates/create-custom-resources-job.yaml
1000 apiVersion: v1
1001 kind: ServiceAccount
1002 metadata:
1003   name: istio-mixer-post-install-account
1004   namespace: istio-system
1005   labels:
1006     app: mixer
1007     chart: mixer-0.8.0
1008     heritage: Tiller
1009     release: RELEASE-NAME
1010 ---
1011 apiVersion: rbac.authorization.k8s.io/v1beta1
1012 kind: ClusterRole
1013 metadata:
1014   name: istio-mixer-post-install-istio-system
1015   namespace: istio-system
1016   labels:
1017     app: mixer
1018     chart: mixer-0.8.0
1019     heritage: Tiller
1020     release: RELEASE-NAME
1021 rules:
1022 - apiGroups: ["config.istio.io"] # istio CRD watcher
1023   resources: ["*"]
1024   verbs: ["create", "get", "list", "watch", "patch"]
1025 - apiGroups: ["networking.istio.io"] # needed to create mixer destination rules
1026   resources: ["*"]
1027   verbs: ["*"]
1028 - apiGroups: ["apiextensions.k8s.io"]
1029   resources: ["customresourcedefinitions"]
1030   verbs: ["get", "list", "watch"]
1031 - apiGroups: [""]
1032   resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets"]
1033   verbs: ["get", "list", "watch"]
1034 ---
1035 apiVersion: rbac.authorization.k8s.io/v1beta1
1036 kind: ClusterRoleBinding
1037 metadata:
1038   name: istio-mixer-post-install-role-binding-istio-system
1039   labels:
1040     app: mixer
1041     chart: mixer-0.8.0
1042     heritage: Tiller
1043     release: RELEASE-NAME
1044 roleRef:
1045   apiGroup: rbac.authorization.k8s.io
1046   kind: ClusterRole
1047   name: istio-mixer-post-install-istio-system
1048 subjects:
1049   - kind: ServiceAccount
1050     name: istio-mixer-post-install-account
1051     namespace: istio-system
1052 ---
1053
1054 apiVersion: batch/v1
1055 kind: Job
1056 metadata:
1057   name: istio-mixer-post-install
1058   namespace: istio-system
1059   annotations:
1060     "helm.sh/hook": post-install
1061     "helm.sh/hook-delete-policy": before-hook-creation
1062   labels:
1063     app: mixer
1064     chart: mixer-0.8.0
1065     release: RELEASE-NAME
1066     heritage: Tiller
1067 spec:
1068   template:
1069     metadata:
1070       name: istio-mixer-post-install
1071       labels:
1072         app: mixer
1073         release: RELEASE-NAME
1074     spec:
1075       serviceAccountName: istio-mixer-post-install-account
1076       containers:
1077         - name: hyperkube
1078           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
1079           command:
1080             - ./kubectl
1081             - apply
1082             - -f
1083             - /tmp/mixer/custom-resources.yaml
1084           volumeMounts:
1085             - mountPath: "/tmp/mixer"
1086               name: tmp-configmap-mixer
1087       volumes:
1088         - name: tmp-configmap-mixer
1089           configMap:
1090             name: istio-mixer-custom-resources
1091       restartPolicy: Never # CRD might take some time till they are available to consume
1092
1093 ---
1094 # Source: istio/charts/mixer/templates/serviceaccount.yaml
1095
1096 apiVersion: v1
1097 kind: ServiceAccount
1098 metadata:
1099   name: istio-mixer-service-account
1100   namespace: istio-system
1101   labels:
1102     app: mixer
1103     chart: mixer-0.8.0
1104     heritage: Tiller
1105     release: RELEASE-NAME
1106
1107 ---
1108 # Source: istio/charts/pilot/templates/serviceaccount.yaml
1109
1110 apiVersion: v1
1111 kind: ServiceAccount
1112 metadata:
1113   name: istio-pilot-service-account
1114   namespace: istio-system
1115   labels:
1116     app: istio-pilot
1117     chart: pilot-0.8.0
1118     heritage: Tiller
1119     release: RELEASE-NAME
1120
1121 ---
1122 # Source: istio/charts/prometheus/templates/serviceaccount.yaml
1123
1124 apiVersion: v1
1125 kind: ServiceAccount
1126 metadata:
1127   name: prometheus
1128   namespace: istio-system
1129
1130 ---
1131 # Source: istio/charts/security/templates/serviceaccount.yaml
1132
1133 apiVersion: v1
1134 kind: ServiceAccount
1135 metadata:
1136   name: istio-citadel-service-account
1137   namespace: istio-system
1138   labels:
1139     app: security
1140     chart: security-0.8.0
1141     heritage: Tiller
1142     release: RELEASE-NAME
1143 ---
1144 apiVersion: v1
1145 kind: ServiceAccount
1146 metadata:
1147   name: istio-cleanup-old-ca-service-account
1148   namespace: istio-system
1149   labels:
1150     app: security
1151     chart: security-0.8.0
1152     heritage: Tiller
1153     release: RELEASE-NAME
1154
1155 ---
1156 # Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml
1157 apiVersion: v1
1158 kind: ServiceAccount
1159 metadata:
1160   name: istio-sidecar-injector-service-account
1161   namespace: istio-system
1162   labels:
1163     app: istio-sidecar-injector
1164     chart: sidecarInjectorWebhook-0.8.0
1165     heritage: Tiller
1166     release: RELEASE-NAME
1167
1168 ---
1169 # Source: istio/charts/mixer/templates/crds.yaml
1170 # Mixer CRDs
1171 kind: CustomResourceDefinition
1172 apiVersion: apiextensions.k8s.io/v1beta1
1173 metadata:
1174   name: rules.config.istio.io
1175   labels:
1176     app: mixer
1177     package: istio.io.mixer
1178     istio: core
1179 spec:
1180   group: config.istio.io
1181   names:
1182     kind: rule
1183     plural: rules
1184     singular: rule
1185   scope: Namespaced
1186   version: v1alpha2
1187 ---
1188
1189 kind: CustomResourceDefinition
1190 apiVersion: apiextensions.k8s.io/v1beta1
1191 metadata:
1192   name: attributemanifests.config.istio.io
1193   labels:
1194     app: mixer
1195     package: istio.io.mixer
1196     istio: core
1197 spec:
1198   group: config.istio.io
1199   names:
1200     kind: attributemanifest
1201     plural: attributemanifests
1202     singular: attributemanifest
1203   scope: Namespaced
1204   version: v1alpha2
1205 ---
1206
1207 kind: CustomResourceDefinition
1208 apiVersion: apiextensions.k8s.io/v1beta1
1209 metadata:
1210   name: circonuses.config.istio.io
1211   labels:
1212     app: mixer
1213     package: circonus
1214     istio: mixer-adapter
1215 spec:
1216   group: config.istio.io
1217   names:
1218     kind: circonus
1219     plural: circonuses
1220     singular: circonus
1221   scope: Namespaced
1222   version: v1alpha2
1223 ---
1224
1225 kind: CustomResourceDefinition
1226 apiVersion: apiextensions.k8s.io/v1beta1
1227 metadata:
1228   name: deniers.config.istio.io
1229   labels:
1230     app: mixer
1231     package: denier
1232     istio: mixer-adapter
1233 spec:
1234   group: config.istio.io
1235   names:
1236     kind: denier
1237     plural: deniers
1238     singular: denier
1239   scope: Namespaced
1240   version: v1alpha2
1241 ---
1242
1243 kind: CustomResourceDefinition
1244 apiVersion: apiextensions.k8s.io/v1beta1
1245 metadata:
1246   name: fluentds.config.istio.io
1247   labels:
1248     app: mixer
1249     package: fluentd
1250     istio: mixer-adapter
1251 spec:
1252   group: config.istio.io
1253   names:
1254     kind: fluentd
1255     plural: fluentds
1256     singular: fluentd
1257   scope: Namespaced
1258   version: v1alpha2
1259 ---
1260
1261 kind: CustomResourceDefinition
1262 apiVersion: apiextensions.k8s.io/v1beta1
1263 metadata:
1264   name: kubernetesenvs.config.istio.io
1265   labels:
1266     app: mixer
1267     package: kubernetesenv
1268     istio: mixer-adapter
1269 spec:
1270   group: config.istio.io
1271   names:
1272     kind: kubernetesenv
1273     plural: kubernetesenvs
1274     singular: kubernetesenv
1275   scope: Namespaced
1276   version: v1alpha2
1277 ---
1278
1279 kind: CustomResourceDefinition
1280 apiVersion: apiextensions.k8s.io/v1beta1
1281 metadata:
1282   name: listcheckers.config.istio.io
1283   labels:
1284     app: mixer
1285     package: listchecker
1286     istio: mixer-adapter
1287 spec:
1288   group: config.istio.io
1289   names:
1290     kind: listchecker
1291     plural: listcheckers
1292     singular: listchecker
1293   scope: Namespaced
1294   version: v1alpha2
1295 ---
1296
1297 kind: CustomResourceDefinition
1298 apiVersion: apiextensions.k8s.io/v1beta1
1299 metadata:
1300   name: memquotas.config.istio.io
1301   labels:
1302     app: mixer
1303     package: memquota
1304     istio: mixer-adapter
1305 spec:
1306   group: config.istio.io
1307   names:
1308     kind: memquota
1309     plural: memquotas
1310     singular: memquota
1311   scope: Namespaced
1312   version: v1alpha2
1313 ---
1314
1315 kind: CustomResourceDefinition
1316 apiVersion: apiextensions.k8s.io/v1beta1
1317 metadata:
1318   name: noops.config.istio.io
1319   labels:
1320     app: mixer
1321     package: noop
1322     istio: mixer-adapter
1323 spec:
1324   group: config.istio.io
1325   names:
1326     kind: noop
1327     plural: noops
1328     singular: noop
1329   scope: Namespaced
1330   version: v1alpha2
1331 ---
1332
1333 kind: CustomResourceDefinition
1334 apiVersion: apiextensions.k8s.io/v1beta1
1335 metadata:
1336   name: opas.config.istio.io
1337   labels:
1338     app: mixer
1339     package: opa
1340     istio: mixer-adapter
1341 spec:
1342   group: config.istio.io
1343   names:
1344     kind: opa
1345     plural: opas
1346     singular: opa
1347   scope: Namespaced
1348   version: v1alpha2
1349 ---
1350
1351 kind: CustomResourceDefinition
1352 apiVersion: apiextensions.k8s.io/v1beta1
1353 metadata:
1354   name: prometheuses.config.istio.io
1355   labels:
1356     app: mixer
1357     package: prometheus
1358     istio: mixer-adapter
1359 spec:
1360   group: config.istio.io
1361   names:
1362     kind: prometheus
1363     plural: prometheuses
1364     singular: prometheus
1365   scope: Namespaced
1366   version: v1alpha2
1367 ---
1368
1369 kind: CustomResourceDefinition
1370 apiVersion: apiextensions.k8s.io/v1beta1
1371 metadata:
1372   name: rbacs.config.istio.io
1373   labels:
1374     app: mixer
1375     package: rbac
1376     istio: mixer-adapter
1377 spec:
1378   group: config.istio.io
1379   names:
1380     kind: rbac
1381     plural: rbacs
1382     singular: rbac
1383   scope: Namespaced
1384   version: v1alpha2
1385 ---
1386
1387 kind: CustomResourceDefinition
1388 apiVersion: apiextensions.k8s.io/v1beta1
1389 metadata:
1390   name: servicecontrols.config.istio.io
1391   labels:
1392     app: mixer
1393     package: servicecontrol
1394     istio: mixer-adapter
1395 spec:
1396   group: config.istio.io
1397   names:
1398     kind: servicecontrol
1399     plural: servicecontrols
1400     singular: servicecontrol
1401   scope: Namespaced
1402   version: v1alpha2
1403 ---
1404
1405 kind: CustomResourceDefinition
1406 apiVersion: apiextensions.k8s.io/v1beta1
1407 metadata:
1408   name: solarwindses.config.istio.io
1409   labels:
1410     app: mixer
1411     package: solarwinds
1412     istio: mixer-adapter
1413 spec:
1414   group: config.istio.io
1415   names:
1416     kind: solarwinds
1417     plural: solarwindses
1418     singular: solarwinds
1419   scope: Namespaced
1420   version: v1alpha2
1421 ---
1422
1423 kind: CustomResourceDefinition
1424 apiVersion: apiextensions.k8s.io/v1beta1
1425 metadata:
1426   name: stackdrivers.config.istio.io
1427   labels:
1428     app: mixer
1429     package: stackdriver
1430     istio: mixer-adapter
1431 spec:
1432   group: config.istio.io
1433   names:
1434     kind: stackdriver
1435     plural: stackdrivers
1436     singular: stackdriver
1437   scope: Namespaced
1438   version: v1alpha2
1439 ---
1440
1441 kind: CustomResourceDefinition
1442 apiVersion: apiextensions.k8s.io/v1beta1
1443 metadata:
1444   name: statsds.config.istio.io
1445   labels:
1446     app: mixer
1447     package: statsd
1448     istio: mixer-adapter
1449 spec:
1450   group: config.istio.io
1451   names:
1452     kind: statsd
1453     plural: statsds
1454     singular: statsd
1455   scope: Namespaced
1456   version: v1alpha2
1457 ---
1458
1459 kind: CustomResourceDefinition
1460 apiVersion: apiextensions.k8s.io/v1beta1
1461 metadata:
1462   name: stdios.config.istio.io
1463   labels:
1464     app: mixer
1465     package: stdio
1466     istio: mixer-adapter
1467 spec:
1468   group: config.istio.io
1469   names:
1470     kind: stdio
1471     plural: stdios
1472     singular: stdio
1473   scope: Namespaced
1474   version: v1alpha2
1475 ---
1476
1477 kind: CustomResourceDefinition
1478 apiVersion: apiextensions.k8s.io/v1beta1
1479 metadata:
1480   name: apikeys.config.istio.io
1481   labels:
1482     app: mixer
1483     package: apikey
1484     istio: mixer-instance
1485 spec:
1486   group: config.istio.io
1487   names:
1488     kind: apikey
1489     plural: apikeys
1490     singular: apikey
1491   scope: Namespaced
1492   version: v1alpha2
1493 ---
1494
1495 kind: CustomResourceDefinition
1496 apiVersion: apiextensions.k8s.io/v1beta1
1497 metadata:
1498   name: authorizations.config.istio.io
1499   labels:
1500     app: mixer
1501     package: authorization
1502     istio: mixer-instance
1503 spec:
1504   group: config.istio.io
1505   names:
1506     kind: authorization
1507     plural: authorizations
1508     singular: authorization
1509   scope: Namespaced
1510   version: v1alpha2
1511 ---
1512
1513 kind: CustomResourceDefinition
1514 apiVersion: apiextensions.k8s.io/v1beta1
1515 metadata:
1516   name: checknothings.config.istio.io
1517   labels:
1518     app: mixer
1519     package: checknothing
1520     istio: mixer-instance
1521 spec:
1522   group: config.istio.io
1523   names:
1524     kind: checknothing
1525     plural: checknothings
1526     singular: checknothing
1527   scope: Namespaced
1528   version: v1alpha2
1529 ---
1530
1531 kind: CustomResourceDefinition
1532 apiVersion: apiextensions.k8s.io/v1beta1
1533 metadata:
1534   name: kuberneteses.config.istio.io
1535   labels:
1536     app: mixer
1537     package: adapter.template.kubernetes
1538     istio: mixer-instance
1539 spec:
1540   group: config.istio.io
1541   names:
1542     kind: kubernetes
1543     plural: kuberneteses
1544     singular: kubernetes
1545   scope: Namespaced
1546   version: v1alpha2
1547 ---
1548
1549 kind: CustomResourceDefinition
1550 apiVersion: apiextensions.k8s.io/v1beta1
1551 metadata:
1552   name: listentries.config.istio.io
1553   labels:
1554     app: mixer
1555     package: listentry
1556     istio: mixer-instance
1557 spec:
1558   group: config.istio.io
1559   names:
1560     kind: listentry
1561     plural: listentries
1562     singular: listentry
1563   scope: Namespaced
1564   version: v1alpha2
1565 ---
1566
1567 kind: CustomResourceDefinition
1568 apiVersion: apiextensions.k8s.io/v1beta1
1569 metadata:
1570   name: logentries.config.istio.io
1571   labels:
1572     app: mixer
1573     package: logentry
1574     istio: mixer-instance
1575 spec:
1576   group: config.istio.io
1577   names:
1578     kind: logentry
1579     plural: logentries
1580     singular: logentry
1581   scope: Namespaced
1582   version: v1alpha2
1583 ---
1584
1585 kind: CustomResourceDefinition
1586 apiVersion: apiextensions.k8s.io/v1beta1
1587 metadata:
1588   name: metrics.config.istio.io
1589   labels:
1590     app: mixer
1591     package: metric
1592     istio: mixer-instance
1593 spec:
1594   group: config.istio.io
1595   names:
1596     kind: metric
1597     plural: metrics
1598     singular: metric
1599   scope: Namespaced
1600   version: v1alpha2
1601 ---
1602
1603 kind: CustomResourceDefinition
1604 apiVersion: apiextensions.k8s.io/v1beta1
1605 metadata:
1606   name: quotas.config.istio.io
1607   labels:
1608     app: mixer
1609     package: quota
1610     istio: mixer-instance
1611 spec:
1612   group: config.istio.io
1613   names:
1614     kind: quota
1615     plural: quotas
1616     singular: quota
1617   scope: Namespaced
1618   version: v1alpha2
1619 ---
1620
1621 kind: CustomResourceDefinition
1622 apiVersion: apiextensions.k8s.io/v1beta1
1623 metadata:
1624   name: reportnothings.config.istio.io
1625   labels:
1626     app: mixer
1627     package: reportnothing
1628     istio: mixer-instance
1629 spec:
1630   group: config.istio.io
1631   names:
1632     kind: reportnothing
1633     plural: reportnothings
1634     singular: reportnothing
1635   scope: Namespaced
1636   version: v1alpha2
1637 ---
1638
1639 kind: CustomResourceDefinition
1640 apiVersion: apiextensions.k8s.io/v1beta1
1641 metadata:
1642   name: servicecontrolreports.config.istio.io
1643   labels:
1644     app: mixer
1645     package: servicecontrolreport
1646     istio: mixer-instance
1647 spec:
1648   group: config.istio.io
1649   names:
1650     kind: servicecontrolreport
1651     plural: servicecontrolreports
1652     singular: servicecontrolreport
1653   scope: Namespaced
1654   version: v1alpha2
1655 ---
1656
1657 kind: CustomResourceDefinition
1658 apiVersion: apiextensions.k8s.io/v1beta1
1659 metadata:
1660   name: tracespans.config.istio.io
1661   labels:
1662     app: mixer
1663     package: tracespan
1664     istio: mixer-instance
1665 spec:
1666   group: config.istio.io
1667   names:
1668     kind: tracespan
1669     plural: tracespans
1670     singular: tracespan
1671   scope: Namespaced
1672   version: v1alpha2
1673 ---
1674
1675 kind: CustomResourceDefinition
1676 apiVersion: apiextensions.k8s.io/v1beta1
1677 metadata:
1678   name: serviceroles.config.istio.io
1679   labels:
1680     app: mixer
1681     package: istio.io.mixer
1682     istio: rbac
1683 spec:
1684   group: config.istio.io
1685   names:
1686     kind: ServiceRole
1687     plural: serviceroles
1688     singular: servicerole
1689   scope: Namespaced
1690   version: v1alpha2
1691 ---
1692
1693 kind: CustomResourceDefinition
1694 apiVersion: apiextensions.k8s.io/v1beta1
1695 metadata:
1696   name: servicerolebindings.config.istio.io
1697   labels:
1698     app: mixer
1699     package: istio.io.mixer
1700     istio: rbac
1701 spec:
1702   group: config.istio.io
1703   names:
1704     kind: ServiceRoleBinding
1705     plural: servicerolebindings
1706     singular: servicerolebinding
1707   scope: Namespaced
1708   version: v1alpha2
1709
1710 ---
1711 # Source: istio/charts/pilot/templates/crds.yaml
1712 apiVersion: apiextensions.k8s.io/v1beta1
1713 kind: CustomResourceDefinition
1714 metadata:
1715   name: destinationpolicies.config.istio.io
1716   labels:
1717     app: istio-pilot
1718 spec:
1719   group: config.istio.io
1720   names:
1721     kind: DestinationPolicy
1722     listKind: DestinationPolicyList
1723     plural: destinationpolicies
1724     singular: destinationpolicy
1725   scope: Namespaced
1726   version: v1alpha2
1727 ---
1728 apiVersion: apiextensions.k8s.io/v1beta1
1729 kind: CustomResourceDefinition
1730 metadata:
1731   name: egressrules.config.istio.io
1732   labels:
1733     app: istio-pilot
1734 spec:
1735   group: config.istio.io
1736   names:
1737     kind: EgressRule
1738     listKind: EgressRuleList
1739     plural: egressrules
1740     singular: egressrule
1741   scope: Namespaced
1742   version: v1alpha2
1743 ---
1744 apiVersion: apiextensions.k8s.io/v1beta1
1745 kind: CustomResourceDefinition
1746 metadata:
1747   name: routerules.config.istio.io
1748   labels:
1749     app: istio-pilot
1750 spec:
1751   group: config.istio.io
1752   names:
1753     kind: RouteRule
1754     listKind: RouteRuleList
1755     plural: routerules
1756     singular: routerule
1757   scope: Namespaced
1758   version: v1alpha2
1759 ---
1760 apiVersion: apiextensions.k8s.io/v1beta1
1761 kind: CustomResourceDefinition
1762 metadata:
1763   name: virtualservices.networking.istio.io
1764   labels:
1765     app: istio-pilot
1766 spec:
1767   group: networking.istio.io
1768   names:
1769     kind: VirtualService
1770     listKind: VirtualServiceList
1771     plural: virtualservices
1772     singular: virtualservice
1773   scope: Namespaced
1774   version: v1alpha3
1775 ---
1776 apiVersion: apiextensions.k8s.io/v1beta1
1777 kind: CustomResourceDefinition
1778 metadata:
1779   name: destinationrules.networking.istio.io
1780   labels:
1781     app: istio-pilot
1782 spec:
1783   group: networking.istio.io
1784   names:
1785     kind: DestinationRule
1786     listKind: DestinationRuleList
1787     plural: destinationrules
1788     singular: destinationrule
1789   scope: Namespaced
1790   version: v1alpha3
1791 ---
1792 apiVersion: apiextensions.k8s.io/v1beta1
1793 kind: CustomResourceDefinition
1794 metadata:
1795   name: serviceentries.networking.istio.io
1796   labels:
1797     app: istio-pilot
1798 spec:
1799   group: networking.istio.io
1800   names:
1801     kind: ServiceEntry
1802     listKind: ServiceEntryList
1803     plural: serviceentries
1804     singular: serviceentry
1805   scope: Namespaced
1806   version: v1alpha3
1807 ---
1808 apiVersion: apiextensions.k8s.io/v1beta1
1809 kind: CustomResourceDefinition
1810 metadata:
1811   name: gateways.networking.istio.io
1812   labels:
1813     app: istio-pilot
1814 spec:
1815   group: networking.istio.io
1816   names:
1817     kind: Gateway
1818     plural: gateways
1819     singular: gateway
1820   scope: Namespaced
1821   version: v1alpha3
1822 ---
1823 kind: CustomResourceDefinition
1824 apiVersion: apiextensions.k8s.io/v1beta1
1825 metadata:
1826   name: policies.authentication.istio.io
1827 spec:
1828   group: authentication.istio.io
1829   names:
1830     kind: Policy
1831     plural: policies
1832     singular: policy
1833   scope: Namespaced
1834   version: v1alpha1
1835 ---
1836 kind: CustomResourceDefinition
1837 apiVersion: apiextensions.k8s.io/v1beta1
1838 metadata:
1839   name: httpapispecbindings.config.istio.io
1840 spec:
1841   group: config.istio.io
1842   names:
1843     kind: HTTPAPISpecBinding
1844     plural: httpapispecbindings
1845     singular: httpapispecbinding
1846   scope: Namespaced
1847   version: v1alpha2
1848 ---
1849 kind: CustomResourceDefinition
1850 apiVersion: apiextensions.k8s.io/v1beta1
1851 metadata:
1852   name: httpapispecs.config.istio.io
1853 spec:
1854   group: config.istio.io
1855   names:
1856     kind: HTTPAPISpec
1857     plural: httpapispecs
1858     singular: httpapispec
1859   scope: Namespaced
1860   version: v1alpha2
1861 ---
1862 kind: CustomResourceDefinition
1863 apiVersion: apiextensions.k8s.io/v1beta1
1864 metadata:
1865   name: quotaspecbindings.config.istio.io
1866 spec:
1867   group: config.istio.io
1868   names:
1869     kind: QuotaSpecBinding
1870     plural: quotaspecbindings
1871     singular: quotaspecbinding
1872   scope: Namespaced
1873   version: v1alpha2
1874 ---
1875 kind: CustomResourceDefinition
1876 apiVersion: apiextensions.k8s.io/v1beta1
1877 metadata:
1878   name: quotaspecs.config.istio.io
1879 spec:
1880   group: config.istio.io
1881   names:
1882     kind: QuotaSpec
1883     plural: quotaspecs
1884     singular: quotaspec
1885   scope: Namespaced
1886   version: v1alpha2
1887
1888
1889 ---
1890 # Source: istio/charts/mixer/templates/clusterrole.yaml
1891
1892 apiVersion: rbac.authorization.k8s.io/v1beta1
1893 kind: ClusterRole
1894 metadata:
1895   name: istio-mixer-istio-system
1896   namespace: istio-system
1897   labels:
1898     app: mixer
1899     chart: mixer-0.8.0
1900     heritage: Tiller
1901     release: RELEASE-NAME
1902 rules:
1903 - apiGroups: ["config.istio.io"] # istio CRD watcher
1904   resources: ["*"]
1905   verbs: ["create", "get", "list", "watch", "patch"]
1906 - apiGroups: ["apiextensions.k8s.io"]
1907   resources: ["customresourcedefinitions"]
1908   verbs: ["get", "list", "watch"]
1909 - apiGroups: [""]
1910   resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets"]
1911   verbs: ["get", "list", "watch"]
1912
1913 ---
1914 # Source: istio/charts/pilot/templates/clusterrole.yaml
1915
1916 apiVersion: rbac.authorization.k8s.io/v1beta1
1917 kind: ClusterRole
1918 metadata:
1919   name: istio-pilot-istio-system
1920   namespace: istio-system
1921   labels:
1922     app: istio-pilot
1923     chart: pilot-0.8.0
1924     heritage: Tiller
1925     release: RELEASE-NAME
1926 rules:
1927 - apiGroups: ["config.istio.io"]
1928   resources: ["*"]
1929   verbs: ["*"]
1930 - apiGroups: ["networking.istio.io"]
1931   resources: ["*"]
1932   verbs: ["*"]
1933 - apiGroups: ["authentication.istio.io"]
1934   resources: ["*"]
1935   verbs: ["*"]
1936 - apiGroups: ["apiextensions.k8s.io"]
1937   resources: ["customresourcedefinitions"]
1938   verbs: ["*"]
1939 - apiGroups: ["extensions"]
1940   resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses", "ingresses/status"]
1941   verbs: ["*"]
1942 - apiGroups: [""]
1943   resources: ["configmaps"]
1944   verbs: ["create", "get", "list", "watch", "update"]
1945 - apiGroups: [""]
1946   resources: ["endpoints", "pods", "services"]
1947   verbs: ["get", "list", "watch"]
1948 - apiGroups: [""]
1949   resources: ["namespaces", "nodes", "secrets"]
1950   verbs: ["get", "list", "watch"]
1951
1952 ---
1953 # Source: istio/charts/prometheus/templates/clusterrole.yaml
1954
1955 ---
1956 apiVersion: rbac.authorization.k8s.io/v1beta1
1957 kind: ClusterRole
1958 metadata:
1959   name: prometheus-istio-system
1960   namespace: istio-system
1961 rules:
1962 - apiGroups: [""]
1963   resources:
1964   - nodes
1965   - services
1966   - endpoints
1967   - pods
1968   - nodes/proxy
1969   verbs: ["get", "list", "watch"]
1970 - apiGroups: [""]
1971   resources:
1972   - configmaps
1973   verbs: ["get"]
1974 - nonResourceURLs: ["/metrics"]
1975   verbs: ["get"]
1976 ---
1977 apiVersion: rbac.authorization.k8s.io/v1beta1
1978 kind: ClusterRoleBinding
1979 metadata:
1980   name: prometheus-istio-system
1981   namespace: istio-system
1982 roleRef:
1983   apiGroup: rbac.authorization.k8s.io
1984   kind: ClusterRole
1985   name: prometheus-istio-system
1986 subjects:
1987 - kind: ServiceAccount
1988   name: prometheus
1989   namespace: istio-system
1990 ---
1991
1992
1993 ---
1994 # Source: istio/charts/security/templates/clusterrole.yaml
1995
1996 apiVersion: rbac.authorization.k8s.io/v1beta1
1997 kind: ClusterRole
1998 metadata:
1999   name: istio-citadel-istio-system
2000   namespace: istio-system
2001   labels:
2002     app: security
2003     chart: security-0.8.0
2004     heritage: Tiller
2005     release: RELEASE-NAME
2006 rules:
2007 - apiGroups: [""]
2008   resources: ["secrets"]
2009   verbs: ["create", "get", "watch", "list", "update", "delete"]
2010 - apiGroups: [""]
2011   resources: ["serviceaccounts"]
2012   verbs: ["get", "watch", "list"]
2013 - apiGroups: [""]
2014   resources: ["services"]
2015   verbs: ["get", "watch", "list"]
2016 ---
2017 apiVersion: rbac.authorization.k8s.io/v1beta1
2018 kind: Role
2019 metadata:
2020   name: istio-cleanup-old-ca-istio-system
2021   namespace: istio-system
2022   labels:
2023     app: security
2024     chart: security-0.8.0
2025     heritage: Tiller
2026     release: RELEASE-NAME
2027 rules:
2028 - apiGroups: [""]
2029   resources: ["deployments", "serviceaccounts", "services"]
2030   verbs: ["get", "delete"]
2031 - apiGroups: ["extensions"]
2032   resources: ["deployments", "replicasets"]
2033   verbs: ["get", "list", "update", "delete"]
2034
2035 ---
2036 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml
2037
2038 apiVersion: rbac.authorization.k8s.io/v1beta1
2039 kind: ClusterRole
2040 metadata:
2041   name: istio-sidecar-injector-istio-system
2042   labels:
2043     app: istio-sidecar-injector
2044     chart: sidecarInjectorWebhook-0.8.0
2045     heritage: Tiller
2046     release: RELEASE-NAME
2047 rules:
2048 - apiGroups: ["*"]
2049   resources: ["configmaps"]
2050   verbs: ["get", "list", "watch"]
2051 - apiGroups: ["admissionregistration.k8s.io"]
2052   resources: ["mutatingwebhookconfigurations"]
2053   verbs: ["get", "list", "watch", "patch"]
2054
2055 ---
2056 # Source: istio/charts/mixer/templates/clusterrolebinding.yaml
2057
2058 apiVersion: rbac.authorization.k8s.io/v1beta1
2059 kind: ClusterRoleBinding
2060 metadata:
2061   name: istio-mixer-admin-role-binding-istio-system
2062   labels:
2063     app: mixer
2064     chart: mixer-0.8.0
2065     heritage: Tiller
2066     release: RELEASE-NAME
2067 roleRef:
2068   apiGroup: rbac.authorization.k8s.io
2069   kind: ClusterRole
2070   name: istio-mixer-istio-system
2071 subjects:
2072   - kind: ServiceAccount
2073     name: istio-mixer-service-account
2074     namespace: istio-system
2075
2076 ---
2077 # Source: istio/charts/pilot/templates/clusterrolebinding.yaml
2078
2079 apiVersion: rbac.authorization.k8s.io/v1beta1
2080 kind: ClusterRoleBinding
2081 metadata:
2082   name: istio-pilot-istio-system
2083   labels:
2084     app: istio-pilot
2085     chart: pilot-0.8.0
2086     heritage: Tiller
2087     release: RELEASE-NAME
2088 roleRef:
2089   apiGroup: rbac.authorization.k8s.io
2090   kind: ClusterRole
2091   name: istio-pilot-istio-system
2092 subjects:
2093   - kind: ServiceAccount
2094     name: istio-pilot-service-account
2095     namespace: istio-system
2096
2097 ---
2098 # Source: istio/charts/security/templates/clusterrolebinding.yaml
2099
2100 apiVersion: rbac.authorization.k8s.io/v1beta1
2101 kind: ClusterRoleBinding
2102 metadata:
2103   name: istio-citadel-istio-system
2104   labels:
2105     app: security
2106     chart: security-0.8.0
2107     heritage: Tiller
2108     release: RELEASE-NAME
2109 roleRef:
2110   apiGroup: rbac.authorization.k8s.io
2111   kind: ClusterRole
2112   name: istio-citadel-istio-system
2113 subjects:
2114   - kind: ServiceAccount
2115     name: istio-citadel-service-account
2116     namespace: istio-system
2117 ---
2118 apiVersion: rbac.authorization.k8s.io/v1beta1
2119 kind: RoleBinding
2120 metadata:
2121   name: istio-cleanup-old-ca-istio-system
2122   namespace: istio-system
2123   labels:
2124     app: security
2125     chart: security-0.8.0
2126     heritage: Tiller
2127     release: RELEASE-NAME
2128 roleRef:
2129   apiGroup: rbac.authorization.k8s.io
2130   kind: Role
2131   name: istio-cleanup-old-ca-istio-system
2132 subjects:
2133   - kind: ServiceAccount
2134     name: istio-cleanup-old-ca-service-account
2135     namespace: istio-system
2136
2137 ---
2138 # Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml
2139
2140 apiVersion: rbac.authorization.k8s.io/v1beta1
2141 kind: ClusterRoleBinding
2142 metadata:
2143   name: istio-sidecar-injector-admin-role-binding-istio-system
2144   labels:
2145     app: istio-sidecar-injector
2146     chart: sidecarInjectorWebhook-0.8.0
2147     heritage: Tiller
2148     release: RELEASE-NAME
2149 roleRef:
2150   apiGroup: rbac.authorization.k8s.io
2151   kind: ClusterRole
2152   name: istio-sidecar-injector-istio-system
2153 subjects:
2154   - kind: ServiceAccount
2155     name: istio-sidecar-injector-service-account
2156     namespace: istio-system
2157 ---
2158 # Source: istio/charts/egressgateway/templates/service.yaml
2159 apiVersion: v1
2160 kind: Service
2161 metadata:
2162   name: istio-egressgateway
2163   namespace: istio-system
2164   labels:
2165     chart: egressgateway-0.8.0
2166     release: RELEASE-NAME
2167     heritage: Tiller
2168     istio: egressgateway
2169 spec:
2170   type: ClusterIP
2171   selector:
2172     istio: egressgateway
2173   ports:
2174     -
2175       name: http
2176       port: 80
2177     -
2178       name: https
2179       port: 443
2180
2181 ---
2182 # Source: istio/charts/grafana/templates/service.yaml
2183 apiVersion: v1
2184 kind: Service
2185 metadata:
2186   name: grafana
2187   namespace: istio-system
2188   annotations:
2189     auth.istio.io/3000: NONE
2190   labels:
2191     app: grafana
2192     chart: grafana-0.1.0
2193     release: RELEASE-NAME
2194     heritage: Tiller
2195 spec:
2196   type: NodePort
2197   ports:
2198     - port: 3000
2199       targetPort: 3000
2200       protocol: TCP
2201       name: http
2202       nodePort: 30300
2203   selector:
2204     app: grafana
2205
2206 ---
2207 # Source: istio/charts/ingressgateway/templates/service.yaml
2208 apiVersion: v1
2209 kind: Service
2210 metadata:
2211   name: istio-ingressgateway
2212   namespace: istio-system
2213   labels:
2214     chart: ingressgateway-0.8.0
2215     release: RELEASE-NAME
2216     heritage: Tiller
2217     istio: ingressgateway
2218 spec:
2219   type: LoadBalancer
2220   selector:
2221     istio: ingressgateway
2222   ports:
2223     -
2224       name: http
2225       nodePort: 31380
2226       port: 80
2227     -
2228       name: https
2229       nodePort: 31390
2230       port: 443
2231     -
2232       name: tcp
2233       nodePort: 31400
2234       port: 31400
2235
2236 ---
2237 # Source: istio/charts/mixer/templates/service.yaml
2238
2239 apiVersion: v1
2240 kind: Service
2241 metadata:
2242   name: istio-policy
2243   namespace: istio-system
2244   labels:
2245     chart: mixer-0.8.0
2246     release: RELEASE-NAME
2247     istio: mixer
2248 spec:
2249   ports:
2250   - name: grpc-mixer
2251     port: 9091
2252   - name: grpc-mixer-mtls
2253     port: 15004
2254   - name: http-monitoring
2255     port: 9093
2256   selector:
2257     istio: mixer
2258     istio-mixer-type: policy
2259 ---
2260 apiVersion: v1
2261 kind: Service
2262 metadata:
2263   name: istio-telemetry
2264   namespace: istio-system
2265   labels:
2266     chart: mixer-0.8.0
2267     release: RELEASE-NAME
2268     istio: mixer
2269 spec:
2270   ports:
2271   - name: grpc-mixer
2272     port: 9091
2273   - name: grpc-mixer-mtls
2274     port: 15004
2275   - name: http-monitoring
2276     port: 9093
2277   - name: prometheus
2278     port: 42422
2279   selector:
2280     istio: mixer
2281     istio-mixer-type: telemetry
2282 ---
2283
2284 ---
2285 # Source: istio/charts/mixer/templates/statsdtoprom.yaml
2286
2287 ---
2288 apiVersion: v1
2289 kind: Service
2290 metadata:
2291   name: istio-statsd-prom-bridge
2292   namespace: istio-system
2293   labels:
2294     chart: mixer-0.8.0
2295     release: RELEASE-NAME
2296     istio: statsd-prom-bridge
2297 spec:
2298   ports:
2299   - name: statsd-prom
2300     port: 9102
2301   - name: statsd-udp
2302     port: 9125
2303     protocol: UDP
2304   selector:
2305     istio: statsd-prom-bridge
2306
2307 ---
2308
2309 apiVersion: extensions/v1beta1
2310 kind: Deployment
2311 metadata:
2312   name: istio-statsd-prom-bridge
2313   namespace: istio-system
2314   labels:
2315     chart: mixer-0.8.0
2316     release: RELEASE-NAME
2317     istio: mixer
2318 spec:
2319   template:
2320     metadata:
2321       labels:
2322         istio: statsd-prom-bridge
2323       annotations:
2324         sidecar.istio.io/inject: "false"
2325     spec:
2326       serviceAccountName: istio-mixer-service-account
2327       volumes:
2328       - name: config-volume
2329         configMap:
2330           name: istio-statsd-prom-bridge
2331       containers:
2332       - name: statsd-prom-bridge
2333         image: "prom/statsd-exporter:latest"
2334         imagePullPolicy: IfNotPresent
2335         ports:
2336         - containerPort: 9102
2337         - containerPort: 9125
2338           protocol: UDP
2339         args:
2340         - '-statsd.mapping-config=/etc/statsd/mapping.conf'
2341         resources:
2342             {}
2343
2344         volumeMounts:
2345         - name: config-volume
2346           mountPath: /etc/statsd
2347
2348 ---
2349 # Source: istio/charts/pilot/templates/service.yaml
2350 apiVersion: v1
2351 kind: Service
2352 metadata:
2353   name: istio-pilot
2354   namespace: istio-system
2355   labels:
2356     app: istio-pilot
2357     chart: pilot-0.8.0
2358     release: RELEASE-NAME
2359     heritage: Tiller
2360 spec:
2361   ports:
2362   - port: 15003
2363     name: http-old-discovery # mTLS or non-mTLS depending on auth setting
2364   - port: 15005
2365     name: https-discovery # always mTLS
2366   - port: 15007
2367     name: http-discovery # always plain-text
2368   - port: 15010
2369     name: grpc-xds # direct
2370   - port: 15011
2371     name: https-xds # mTLS
2372   - port: 8080
2373     name: http-legacy-discovery # direct
2374   - port: 9093
2375     name: http-monitoring
2376   selector:
2377     istio: pilot
2378
2379 ---
2380 # Source: istio/charts/prometheus/templates/service.yaml
2381 apiVersion: v1
2382 kind: Service
2383 metadata:
2384   name: prometheus
2385   namespace: istio-system
2386   annotations:
2387     prometheus.io/scrape: 'true'
2388   labels:
2389     name: prometheus
2390 spec:
2391   selector:
2392     app: prometheus
2393   ports:
2394   - name: http-prometheus
2395     protocol: TCP
2396     port: 9090
2397
2398 ---
2399 # Source: istio/charts/security/templates/service.yaml
2400 apiVersion: v1
2401 kind: Service
2402 metadata:
2403   # we use the normal name here (e.g. 'prometheus')
2404   # as grafana is configured to use this as a data source
2405   name: istio-citadel
2406   namespace: istio-system
2407   labels:
2408     app: istio-citadel
2409 spec:
2410   ports:
2411     - name: grpc-citadel
2412       port: 8060
2413       targetPort: 8060
2414       protocol: TCP
2415     - name: http-monitoring
2416       port: 9093
2417   selector:
2418     istio: citadel
2419
2420 ---
2421 # Source: istio/charts/servicegraph/templates/service.yaml
2422 apiVersion: v1
2423 kind: Service
2424 metadata:
2425   name: servicegraph
2426   namespace: istio-system
2427   labels:
2428     app: servicegraph
2429     chart: servicegraph-0.1.0
2430     release: RELEASE-NAME
2431     heritage: Tiller
2432 spec:
2433   type: NodePort
2434   ports:
2435     - port: 8088
2436       targetPort: 8088
2437       protocol: TCP
2438       name: http
2439       nodePort: 30088
2440   selector:
2441     app: servicegraph
2442
2443 ---
2444 # Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml
2445 apiVersion: v1
2446 kind: Service
2447 metadata:
2448   name: istio-sidecar-injector
2449   namespace: istio-system
2450   labels:
2451     istio: sidecar-injector
2452 spec:
2453   ports:
2454   - port: 443
2455   selector:
2456     istio: sidecar-injector
2457
2458 ---
2459 # Source: istio/charts/egressgateway/templates/deployment.yaml
2460 apiVersion: extensions/v1beta1
2461 kind: Deployment
2462 metadata:
2463   name: istio-egressgateway
2464   namespace: istio-system
2465   labels:
2466     app: egressgateway
2467     chart: egressgateway-0.8.0
2468     release: RELEASE-NAME
2469     heritage: Tiller
2470     istio: egressgateway
2471 spec:
2472   replicas:
2473   template:
2474     metadata:
2475       labels:
2476         istio: egressgateway
2477       annotations:
2478         sidecar.istio.io/inject: "false"
2479     spec:
2480       serviceAccountName: istio-egressgateway-service-account
2481       containers:
2482         - name: egressgateway
2483           image: "docker.io/istio/proxyv2:0.8.0"
2484           imagePullPolicy: IfNotPresent
2485           ports:
2486             - containerPort: 80
2487             - containerPort: 443
2488           args:
2489           - proxy
2490           - router
2491           - -v
2492           - "2"
2493           - --discoveryRefreshDelay
2494           - '1s' #discoveryRefreshDelay
2495           - --drainDuration
2496           - '45s' #drainDuration
2497           - --parentShutdownDuration
2498           - '1m0s' #parentShutdownDuration
2499           - --connectTimeout
2500           - '10s' #connectTimeout
2501           - --serviceCluster
2502           - istio-egressgateway
2503           - --zipkinAddress
2504           - zipkin:9411
2505           - --statsdUdpAddress
2506           - istio-statsd-prom-bridge:9125
2507           - --proxyAdminPort
2508           - "15000"
2509           - --controlPlaneAuthPolicy
2510           - NONE
2511           - --discoveryAddress
2512           - istio-pilot:8080
2513           resources:
2514             {}
2515
2516           env:
2517           - name: POD_NAME
2518             valueFrom:
2519               fieldRef:
2520                 apiVersion: v1
2521                 fieldPath: metadata.name
2522           - name: POD_NAMESPACE
2523             valueFrom:
2524               fieldRef:
2525                 apiVersion: v1
2526                 fieldPath: metadata.namespace
2527           - name: INSTANCE_IP
2528             valueFrom:
2529               fieldRef:
2530                 fieldPath: status.podIP
2531           - name: ISTIO_META_POD_NAME
2532             valueFrom:
2533               fieldRef:
2534                 fieldPath: metadata.name
2535           volumeMounts:
2536           - name: istio-certs
2537             mountPath: /etc/certs
2538             readOnly: true
2539       volumes:
2540       - name: istio-certs
2541         secret:
2542           secretName: "istio.default"
2543           optional: true
2544       affinity:
2545         nodeAffinity:
2546           requiredDuringSchedulingIgnoredDuringExecution:
2547             nodeSelectorTerms:
2548             - matchExpressions:
2549               - key: beta.kubernetes.io/arch
2550                 operator: In
2551                 values:
2552                 - amd64
2553                 - ppc64le
2554                 - s390x
2555           preferredDuringSchedulingIgnoredDuringExecution:
2556           - weight: 2
2557             preference:
2558               matchExpressions:
2559               - key: beta.kubernetes.io/arch
2560                 operator: In
2561                 values:
2562                 - amd64
2563           - weight: 2
2564             preference:
2565               matchExpressions:
2566               - key: beta.kubernetes.io/arch
2567                 operator: In
2568                 values:
2569                 - ppc64le
2570           - weight: 2
2571             preference:
2572               matchExpressions:
2573               - key: beta.kubernetes.io/arch
2574                 operator: In
2575                 values:
2576                 - s390x
2577
2578 ---
2579 # Source: istio/charts/grafana/templates/deployment.yaml
2580 apiVersion: extensions/v1beta1
2581 kind: Deployment
2582 metadata:
2583   name: grafana
2584   namespace: istio-system
2585   labels:
2586     app: grafana
2587     chart: grafana-0.1.0
2588     release: RELEASE-NAME
2589     heritage: Tiller
2590 spec:
2591   replicas: 1
2592   template:
2593     metadata:
2594       labels:
2595         app: grafana
2596       annotations:
2597         sidecar.istio.io/inject: "false"
2598     spec:
2599       containers:
2600         - name: grafana
2601           image: "docker.io/istio/grafana:0.8.0"
2602           imagePullPolicy: IfNotPresent
2603           ports:
2604             - containerPort: 3000
2605           readinessProbe:
2606             httpGet:
2607               path: /login
2608               port: 3000
2609           env:
2610           - name: GRAFANA_PORT
2611             value: "3000"
2612           - name: GF_AUTH_BASIC_ENABLED
2613             value: "false"
2614           - name: GF_AUTH_ANONYMOUS_ENABLED
2615             value: "true"
2616           - name: GF_AUTH_ANONYMOUS_ORG_ROLE
2617             value: Admin
2618           - name: GF_PATHS_DATA
2619             value: /data/grafana
2620           resources:
2621             {}
2622
2623           volumeMounts:
2624           - name: data
2625             mountPath: /data/grafana
2626       affinity:
2627         nodeAffinity:
2628           requiredDuringSchedulingIgnoredDuringExecution:
2629             nodeSelectorTerms:
2630             - matchExpressions:
2631               - key: beta.kubernetes.io/arch
2632                 operator: In
2633                 values:
2634                 - amd64
2635                 - ppc64le
2636                 - s390x
2637           preferredDuringSchedulingIgnoredDuringExecution:
2638           - weight: 2
2639             preference:
2640               matchExpressions:
2641               - key: beta.kubernetes.io/arch
2642                 operator: In
2643                 values:
2644                 - amd64
2645           - weight: 2
2646             preference:
2647               matchExpressions:
2648               - key: beta.kubernetes.io/arch
2649                 operator: In
2650                 values:
2651                 - ppc64le
2652           - weight: 2
2653             preference:
2654               matchExpressions:
2655               - key: beta.kubernetes.io/arch
2656                 operator: In
2657                 values:
2658                 - s390x
2659       volumes:
2660       - name: data
2661         emptyDir: {}
2662 ---
2663 # Source: istio/charts/ingressgateway/templates/deployment.yaml
2664 apiVersion: extensions/v1beta1
2665 kind: Deployment
2666 metadata:
2667   name: istio-ingressgateway
2668   namespace: istio-system
2669   labels:
2670     app: ingressgateway
2671     chart: ingressgateway-0.8.0
2672     release: RELEASE-NAME
2673     heritage: Tiller
2674     istio: ingressgateway
2675 spec:
2676   replicas:
2677   template:
2678     metadata:
2679       labels:
2680         istio: ingressgateway
2681       annotations:
2682         sidecar.istio.io/inject: "false"
2683     spec:
2684       serviceAccountName: istio-ingressgateway-service-account
2685       containers:
2686         - name: ingressgateway
2687           image: "docker.io/istio/proxyv2:0.8.0"
2688           imagePullPolicy: IfNotPresent
2689           ports:
2690             - containerPort: 80
2691             - containerPort: 443
2692             - containerPort: 31400
2693           args:
2694           - proxy
2695           - router
2696           - -v
2697           - "2"
2698           - --discoveryRefreshDelay
2699           - '1s' #discoveryRefreshDelay
2700           - --drainDuration
2701           - '45s' #drainDuration
2702           - --parentShutdownDuration
2703           - '1m0s' #parentShutdownDuration
2704           - --connectTimeout
2705           - '10s' #connectTimeout
2706           - --serviceCluster
2707           - istio-ingressgateway
2708           - --zipkinAddress
2709           - zipkin:9411
2710           - --statsdUdpAddress
2711           - istio-statsd-prom-bridge:9125
2712           - --proxyAdminPort
2713           - "15000"
2714           - --controlPlaneAuthPolicy
2715           - NONE
2716           - --discoveryAddress
2717           - istio-pilot:8080
2718           resources:
2719             {}
2720
2721           env:
2722           - name: POD_NAME
2723             valueFrom:
2724               fieldRef:
2725                 apiVersion: v1
2726                 fieldPath: metadata.name
2727           - name: POD_NAMESPACE
2728             valueFrom:
2729               fieldRef:
2730                 apiVersion: v1
2731                 fieldPath: metadata.namespace
2732           - name: INSTANCE_IP
2733             valueFrom:
2734               fieldRef:
2735                 apiVersion: v1
2736                 fieldPath: status.podIP
2737           - name: ISTIO_META_POD_NAME
2738             valueFrom:
2739               fieldRef:
2740                 fieldPath: metadata.name
2741           volumeMounts:
2742           - name: istio-certs
2743             mountPath: /etc/certs
2744             readOnly: true
2745           - name: ingressgateway-certs
2746             mountPath: "/etc/istio/ingressgateway-certs"
2747             readOnly: true
2748       volumes:
2749       - name: istio-certs
2750         secret:
2751           secretName: "istio.default"
2752           optional: true
2753       - name: ingressgateway-certs
2754         secret:
2755           secretName: "istio-ingressgateway-certs"
2756           optional: true
2757       affinity:
2758         nodeAffinity:
2759           requiredDuringSchedulingIgnoredDuringExecution:
2760             nodeSelectorTerms:
2761             - matchExpressions:
2762               - key: beta.kubernetes.io/arch
2763                 operator: In
2764                 values:
2765                 - amd64
2766                 - ppc64le
2767                 - s390x
2768           preferredDuringSchedulingIgnoredDuringExecution:
2769           - weight: 2
2770             preference:
2771               matchExpressions:
2772               - key: beta.kubernetes.io/arch
2773                 operator: In
2774                 values:
2775                 - amd64
2776           - weight: 2
2777             preference:
2778               matchExpressions:
2779               - key: beta.kubernetes.io/arch
2780                 operator: In
2781                 values:
2782                 - ppc64le
2783           - weight: 2
2784             preference:
2785               matchExpressions:
2786               - key: beta.kubernetes.io/arch
2787                 operator: In
2788                 values:
2789                 - s390x
2790
2791 ---
2792 # Source: istio/charts/mixer/templates/deployment.yaml
2793
2794 apiVersion: extensions/v1beta1
2795 kind: Deployment
2796 metadata:
2797   name: istio-policy
2798   namespace: istio-system
2799   labels:
2800     chart: mixer-0.8.0
2801     release: RELEASE-NAME
2802     istio: mixer
2803 spec:
2804   replicas: 1
2805   template:
2806     metadata:
2807       labels:
2808         istio: mixer
2809         istio-mixer-type: policy
2810       annotations:
2811         sidecar.istio.io/inject: "false"
2812     spec:
2813       serviceAccountName: istio-mixer-service-account
2814       volumes:
2815       - name: istio-certs
2816         secret:
2817           secretName: istio.istio-mixer-service-account
2818           optional: true
2819       affinity:
2820         nodeAffinity:
2821           requiredDuringSchedulingIgnoredDuringExecution:
2822             nodeSelectorTerms:
2823             - matchExpressions:
2824               - key: beta.kubernetes.io/arch
2825                 operator: In
2826                 values:
2827                 - amd64
2828                 - ppc64le
2829                 - s390x
2830           preferredDuringSchedulingIgnoredDuringExecution:
2831           - weight: 2
2832             preference:
2833               matchExpressions:
2834               - key: beta.kubernetes.io/arch
2835                 operator: In
2836                 values:
2837                 - amd64
2838           - weight: 2
2839             preference:
2840               matchExpressions:
2841               - key: beta.kubernetes.io/arch
2842                 operator: In
2843                 values:
2844                 - ppc64le
2845           - weight: 2
2846             preference:
2847               matchExpressions:
2848               - key: beta.kubernetes.io/arch
2849                 operator: In
2850                 values:
2851                 - s390x
2852       containers:
2853       - name: mixer
2854         image: "docker.io/istio/mixer:0.8.0"
2855         imagePullPolicy: IfNotPresent
2856         ports:
2857         - containerPort: 9092
2858         - containerPort: 9093
2859         - containerPort: 42422
2860         args:
2861           - --address
2862           - tcp://127.0.0.1:9092
2863           - --configStoreURL=k8s://
2864           - --configDefaultNamespace=istio-system
2865           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
2866         resources:
2867             {}
2868
2869       - name: istio-proxy
2870         image: "docker.io/istio/proxyv2:0.8.0"
2871         imagePullPolicy: IfNotPresent
2872         ports:
2873         - containerPort: 9091
2874         - containerPort: 15004
2875         args:
2876         - proxy
2877         - --serviceCluster
2878         - istio-policy
2879         - --templateFile
2880         - /etc/istio/proxy/envoy_policy.yaml.tmpl
2881         - --controlPlaneAuthPolicy
2882         - NONE
2883         env:
2884         - name: POD_NAME
2885           valueFrom:
2886             fieldRef:
2887               apiVersion: v1
2888               fieldPath: metadata.name
2889         - name: POD_NAMESPACE
2890           valueFrom:
2891             fieldRef:
2892               apiVersion: v1
2893               fieldPath: metadata.namespace
2894         - name: INSTANCE_IP
2895           valueFrom:
2896             fieldRef:
2897               apiVersion: v1
2898               fieldPath: status.podIP
2899         resources:
2900             requests:
2901               cpu: 100m
2902               memory: 128Mi
2903
2904         volumeMounts:
2905         - name: istio-certs
2906           mountPath: /etc/certs
2907           readOnly: true
2908
2909 ---
2910 apiVersion: extensions/v1beta1
2911 kind: Deployment
2912 metadata:
2913   name: istio-telemetry
2914   namespace: istio-system
2915   labels:
2916     chart: mixer-0.8.0
2917     release: RELEASE-NAME
2918     istio: mixer
2919 spec:
2920   replicas: 1
2921   template:
2922     metadata:
2923       labels:
2924         istio: mixer
2925         istio-mixer-type: telemetry
2926       annotations:
2927         sidecar.istio.io/inject: "false"
2928     spec:
2929       serviceAccountName: istio-mixer-service-account
2930       volumes:
2931       - name: istio-certs
2932         secret:
2933           secretName: istio.istio-mixer-service-account
2934           optional: true
2935       containers:
2936       - name: mixer
2937         image: "docker.io/istio/mixer:0.8.0"
2938         imagePullPolicy: IfNotPresent
2939         ports:
2940         - containerPort: 9092
2941         - containerPort: 9093
2942         - containerPort: 42422
2943         args:
2944           - --address
2945           - tcp://127.0.0.1:9092
2946           - --configStoreURL=k8s://
2947           - --configDefaultNamespace=istio-system
2948           - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
2949         resources:
2950             {}
2951
2952       - name: istio-proxy
2953         image: "docker.io/istio/proxyv2:0.8.0"
2954         imagePullPolicy: IfNotPresent
2955         ports:
2956         - containerPort: 9091
2957         - containerPort: 15004
2958         args:
2959         - proxy
2960         - --serviceCluster
2961         - istio-telemetry
2962         - --templateFile
2963         - /etc/istio/proxy/envoy_telemetry.yaml.tmpl
2964         - --controlPlaneAuthPolicy
2965         - NONE
2966         env:
2967         - name: POD_NAME
2968           valueFrom:
2969             fieldRef:
2970               apiVersion: v1
2971               fieldPath: metadata.name
2972         - name: POD_NAMESPACE
2973           valueFrom:
2974             fieldRef:
2975               apiVersion: v1
2976               fieldPath: metadata.namespace
2977         - name: INSTANCE_IP
2978           valueFrom:
2979             fieldRef:
2980               apiVersion: v1
2981               fieldPath: status.podIP
2982         resources:
2983             requests:
2984               cpu: 100m
2985               memory: 128Mi
2986
2987         volumeMounts:
2988         - name: istio-certs
2989           mountPath: /etc/certs
2990           readOnly: true
2991
2992 ---
2993
2994 ---
2995 # Source: istio/charts/pilot/templates/deployment.yaml
2996 apiVersion: extensions/v1beta1
2997 kind: Deployment
2998 metadata:
2999   name: istio-pilot
3000   namespace: istio-system
3001   # TODO: default tempate doesn't have this, which one is right ?
3002   labels:
3003     app: istio-pilot
3004     chart: pilot-0.8.0
3005     release: RELEASE-NAME
3006     heritage: Tiller
3007     istio: pilot
3008   annotations:
3009     checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9
3010 spec:
3011   replicas: 1
3012   template:
3013     metadata:
3014       labels:
3015         istio: pilot
3016       annotations:
3017         sidecar.istio.io/inject: "false"
3018     spec:
3019       serviceAccountName: istio-pilot-service-account
3020       containers:
3021         - name: discovery
3022           image: "docker.io/istio/pilot:0.8.0"
3023           imagePullPolicy: IfNotPresent
3024           args:
3025           - "discovery"
3026 # TODO(sdake) remove when secrets are automagically registered
3027           ports:
3028           - containerPort: 8080
3029           - containerPort: 15010
3030           readinessProbe:
3031             httpGet:
3032               path: /v1/registration
3033               port: 8080
3034             initialDelaySeconds: 30
3035             periodSeconds: 30
3036             timeoutSeconds: 5
3037           env:
3038           - name: POD_NAME
3039             valueFrom:
3040               fieldRef:
3041                 apiVersion: v1
3042                 fieldPath: metadata.name
3043           - name: POD_NAMESPACE
3044             valueFrom:
3045               fieldRef:
3046                 apiVersion: v1
3047                 fieldPath: metadata.namespace
3048           - name: PILOT_THROTTLE
3049             value: "500"
3050           - name: PILOT_CACHE_SQUASH
3051             value: "5"
3052           resources:
3053             {}
3054
3055           volumeMounts:
3056           - name: config-volume
3057             mountPath: /etc/istio/config
3058           - name: istio-certs
3059             mountPath: /etc/certs
3060             readOnly: true
3061         - name: istio-proxy
3062           image: "docker.io/istio/proxyv2:0.8.0"
3063           imagePullPolicy: IfNotPresent
3064           ports:
3065           - containerPort: 15003
3066           - containerPort: 15005
3067           - containerPort: 15007
3068           - containerPort: 15011
3069           args:
3070           - proxy
3071           - --serviceCluster
3072           - istio-pilot
3073           - --templateFile
3074           - /etc/istio/proxy/envoy_pilot.yaml.tmpl
3075           - --controlPlaneAuthPolicy
3076           - NONE
3077           env:
3078           - name: POD_NAME
3079             valueFrom:
3080               fieldRef:
3081                 apiVersion: v1
3082                 fieldPath: metadata.name
3083           - name: POD_NAMESPACE
3084             valueFrom:
3085               fieldRef:
3086                 apiVersion: v1
3087                 fieldPath: metadata.namespace
3088           - name: INSTANCE_IP
3089             valueFrom:
3090               fieldRef:
3091                 apiVersion: v1
3092                 fieldPath: status.podIP
3093           resources:
3094             requests:
3095               cpu: 100m
3096               memory: 128Mi
3097
3098           volumeMounts:
3099           - name: istio-certs
3100             mountPath: /etc/certs
3101             readOnly: true
3102       volumes:
3103       - name: config-volume
3104         configMap:
3105           name: istio
3106       - name: istio-certs
3107         secret:
3108           secretName: "istio.istio-pilot-service-account"
3109       affinity:
3110         nodeAffinity:
3111           requiredDuringSchedulingIgnoredDuringExecution:
3112             nodeSelectorTerms:
3113             - matchExpressions:
3114               - key: beta.kubernetes.io/arch
3115                 operator: In
3116                 values:
3117                 - amd64
3118                 - ppc64le
3119                 - s390x
3120           preferredDuringSchedulingIgnoredDuringExecution:
3121           - weight: 2
3122             preference:
3123               matchExpressions:
3124               - key: beta.kubernetes.io/arch
3125                 operator: In
3126                 values:
3127                 - amd64
3128           - weight: 2
3129             preference:
3130               matchExpressions:
3131               - key: beta.kubernetes.io/arch
3132                 operator: In
3133                 values:
3134                 - ppc64le
3135           - weight: 2
3136             preference:
3137               matchExpressions:
3138               - key: beta.kubernetes.io/arch
3139                 operator: In
3140                 values:
3141                 - s390x
3142
3143 ---
3144 # Source: istio/charts/prometheus/templates/deployment.yaml
3145 # TODO: the original template has service account, roles, etc
3146 apiVersion: extensions/v1beta1
3147 kind: Deployment
3148 metadata:
3149   name: prometheus
3150   namespace: istio-system
3151   labels:
3152     app: prometheus
3153     chart: prometheus-0.1.0
3154     release: RELEASE-NAME
3155     heritage: Tiller
3156 spec:
3157   replicas: 1
3158   selector:
3159     matchLabels:
3160       app: prometheus
3161   template:
3162     metadata:
3163       labels:
3164         app: prometheus
3165       annotations:
3166         sidecar.istio.io/inject: "false"
3167     spec:
3168       serviceAccountName: prometheus
3169
3170       containers:
3171         - name: prometheus
3172           image: "docker.io/prom/prometheus:latest"
3173           imagePullPolicy: IfNotPresent
3174           args:
3175             - '--storage.tsdb.retention=6h'
3176             - '--config.file=/etc/prometheus/prometheus.yml'
3177           ports:
3178             - containerPort: 9090
3179               name: http
3180           livenessProbe:
3181             httpGet:
3182               path: /-/healthy
3183               port: 9090
3184           readinessProbe:
3185             httpGet:
3186               path: /-/ready
3187               port: 9090
3188           resources:
3189             {}
3190
3191           volumeMounts:
3192           - name: config-volume
3193             mountPath: /etc/prometheus
3194       volumes:
3195       - name: config-volume
3196         configMap:
3197           name: prometheus
3198       affinity:
3199         nodeAffinity:
3200           requiredDuringSchedulingIgnoredDuringExecution:
3201             nodeSelectorTerms:
3202             - matchExpressions:
3203               - key: beta.kubernetes.io/arch
3204                 operator: In
3205                 values:
3206                 - amd64
3207                 - ppc64le
3208                 - s390x
3209           preferredDuringSchedulingIgnoredDuringExecution:
3210           - weight: 2
3211             preference:
3212               matchExpressions:
3213               - key: beta.kubernetes.io/arch
3214                 operator: In
3215                 values:
3216                 - amd64
3217           - weight: 2
3218             preference:
3219               matchExpressions:
3220               - key: beta.kubernetes.io/arch
3221                 operator: In
3222                 values:
3223                 - ppc64le
3224           - weight: 2
3225             preference:
3226               matchExpressions:
3227               - key: beta.kubernetes.io/arch
3228                 operator: In
3229                 values:
3230                 - s390x
3231
3232 ---
3233 # Source: istio/charts/security/templates/deployment.yaml
3234 # istio CA watching all namespaces
3235 apiVersion: extensions/v1beta1
3236 kind: Deployment
3237 metadata:
3238   name: istio-citadel
3239   namespace: istio-system
3240   labels:
3241     app: security
3242     chart: security-0.8.0
3243     release: RELEASE-NAME
3244     heritage: Tiller
3245     istio: citadel
3246 spec:
3247   replicas: 1
3248   template:
3249     metadata:
3250       labels:
3251         istio: citadel
3252       annotations:
3253         sidecar.istio.io/inject: "false"
3254     spec:
3255       serviceAccountName: istio-citadel-service-account
3256       containers:
3257         - name: citadel
3258           image: "docker.io/istio/citadel:0.8.0"
3259           imagePullPolicy: IfNotPresent
3260           args:
3261             - --append-dns-names=true
3262             - --grpc-port=8060
3263             - --grpc-hostname=citadel
3264             - --self-signed-ca=true
3265             - --citadel-storage-namespace=istio-system
3266           resources:
3267             {}
3268
3269       affinity:
3270         nodeAffinity:
3271           requiredDuringSchedulingIgnoredDuringExecution:
3272             nodeSelectorTerms:
3273             - matchExpressions:
3274               - key: beta.kubernetes.io/arch
3275                 operator: In
3276                 values:
3277                 - amd64
3278                 - ppc64le
3279                 - s390x
3280           preferredDuringSchedulingIgnoredDuringExecution:
3281           - weight: 2
3282             preference:
3283               matchExpressions:
3284               - key: beta.kubernetes.io/arch
3285                 operator: In
3286                 values:
3287                 - amd64
3288           - weight: 2
3289             preference:
3290               matchExpressions:
3291               - key: beta.kubernetes.io/arch
3292                 operator: In
3293                 values:
3294                 - ppc64le
3295           - weight: 2
3296             preference:
3297               matchExpressions:
3298               - key: beta.kubernetes.io/arch
3299                 operator: In
3300                 values:
3301                 - s390x
3302
3303 ---
3304 # Source: istio/charts/servicegraph/templates/deployment.yaml
3305 apiVersion: extensions/v1beta1
3306 kind: Deployment
3307 metadata:
3308   name: servicegraph
3309   namespace: istio-system
3310   labels:
3311     app: servicegraph
3312     chart: servicegraph-0.1.0
3313     release: RELEASE-NAME
3314     heritage: Tiller
3315 spec:
3316   replicas: 1
3317   template:
3318     metadata:
3319       labels:
3320         app: servicegraph
3321       annotations:
3322         sidecar.istio.io/inject: "false"
3323     spec:
3324       containers:
3325         - name: servicegraph
3326           image: "docker.io/istio/servicegraph:0.8.0"
3327           imagePullPolicy: IfNotPresent
3328           ports:
3329             - containerPort: 8088
3330           args:
3331           - --prometheusAddr=http://prometheus:9090
3332           livenessProbe:
3333             httpGet:
3334               path: /graph
3335               port: 8088
3336           readinessProbe:
3337             httpGet:
3338               path: /graph
3339               port: 8088
3340           resources:
3341             {}
3342
3343       affinity:
3344         nodeAffinity:
3345           requiredDuringSchedulingIgnoredDuringExecution:
3346             nodeSelectorTerms:
3347             - matchExpressions:
3348               - key: beta.kubernetes.io/arch
3349                 operator: In
3350                 values:
3351                 - amd64
3352                 - ppc64le
3353                 - s390x
3354           preferredDuringSchedulingIgnoredDuringExecution:
3355           - weight: 2
3356             preference:
3357               matchExpressions:
3358               - key: beta.kubernetes.io/arch
3359                 operator: In
3360                 values:
3361                 - amd64
3362           - weight: 2
3363             preference:
3364               matchExpressions:
3365               - key: beta.kubernetes.io/arch
3366                 operator: In
3367                 values:
3368                 - ppc64le
3369           - weight: 2
3370             preference:
3371               matchExpressions:
3372               - key: beta.kubernetes.io/arch
3373                 operator: In
3374                 values:
3375                 - s390x
3376
3377 ---
3378 # Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml
3379 apiVersion: extensions/v1beta1
3380 kind: Deployment
3381 metadata:
3382   name: istio-sidecar-injector
3383   namespace: istio-system
3384   labels:
3385     app: sidecarInjectorWebhook
3386     chart: sidecarInjectorWebhook-0.8.0
3387     release: RELEASE-NAME
3388     heritage: Tiller
3389     istio: sidecar-injector
3390 spec:
3391   replicas:
3392   template:
3393     metadata:
3394       labels:
3395         istio: sidecar-injector
3396     spec:
3397       serviceAccountName: istio-sidecar-injector-service-account
3398       containers:
3399         - name: sidecar-injector-webhook
3400           image: "docker.io/istio/sidecar_injector:0.8.0"
3401           imagePullPolicy: IfNotPresent
3402           args:
3403             - --caCertFile=/etc/istio/certs/root-cert.pem
3404             - --tlsCertFile=/etc/istio/certs/cert-chain.pem
3405             - --tlsKeyFile=/etc/istio/certs/key.pem
3406             - --injectConfig=/etc/istio/inject/config
3407             - --meshConfig=/etc/istio/config/mesh
3408             - --healthCheckInterval=2s
3409             - --healthCheckFile=/health
3410           volumeMounts:
3411           - name: config-volume
3412             mountPath: /etc/istio/config
3413             readOnly: true
3414           - name: certs
3415             mountPath: /etc/istio/certs
3416             readOnly: true
3417           - name: inject-config
3418             mountPath: /etc/istio/inject
3419             readOnly: true
3420           livenessProbe:
3421             exec:
3422               command:
3423                 - /usr/local/bin/sidecar-injector
3424                 - probe
3425                 - --probe-path=/health
3426                 - --interval=2s
3427             initialDelaySeconds: 4
3428             periodSeconds: 4
3429           readinessProbe:
3430             exec:
3431               command:
3432                 - /usr/local/bin/sidecar-injector
3433                 - probe
3434                 - --probe-path=/health
3435                 - --interval=2s
3436             initialDelaySeconds: 4
3437             periodSeconds: 4
3438       volumes:
3439       - name: config-volume
3440         configMap:
3441           name: istio
3442       - name: certs
3443         secret:
3444           secretName: istio.istio-sidecar-injector-service-account
3445       - name: inject-config
3446         configMap:
3447           name: istio-sidecar-injector
3448           items:
3449           - key: config
3450             path: config
3451       affinity:
3452         nodeAffinity:
3453           requiredDuringSchedulingIgnoredDuringExecution:
3454             nodeSelectorTerms:
3455             - matchExpressions:
3456               - key: beta.kubernetes.io/arch
3457                 operator: In
3458                 values:
3459                 - amd64
3460                 - ppc64le
3461                 - s390x
3462           preferredDuringSchedulingIgnoredDuringExecution:
3463           - weight: 2
3464             preference:
3465               matchExpressions:
3466               - key: beta.kubernetes.io/arch
3467                 operator: In
3468                 values:
3469                 - amd64
3470           - weight: 2
3471             preference:
3472               matchExpressions:
3473               - key: beta.kubernetes.io/arch
3474                 operator: In
3475                 values:
3476                 - ppc64le
3477           - weight: 2
3478             preference:
3479               matchExpressions:
3480               - key: beta.kubernetes.io/arch
3481                 operator: In
3482                 values:
3483                 - s390x
3484
3485 ---
3486 # Source: istio/charts/tracing/templates/deployment.yaml
3487 apiVersion: extensions/v1beta1
3488 kind: Deployment
3489 metadata:
3490   name: istio-tracing
3491   namespace: istio-system
3492   labels:
3493     app: istio-tracing
3494     chart: tracing-0.1.0
3495     release: RELEASE-NAME
3496     heritage: Tiller
3497 spec:
3498   replicas: 1
3499   template:
3500     metadata:
3501       labels:
3502         app: jaeger
3503       annotations:
3504         sidecar.istio.io/inject: "false"
3505     spec:
3506       containers:
3507         - name: jaeger
3508           image: "jaegertracing/all-in-one:1.5"
3509           imagePullPolicy: IfNotPresent
3510           ports:
3511             - containerPort: 9411
3512             - containerPort: 16686
3513             - containerPort: 5775
3514               protocol: UDP
3515             - containerPort: 6831
3516               protocol: UDP
3517             - containerPort: 6832
3518               protocol: UDP
3519           env:
3520           - name: POD_NAMESPACE
3521             valueFrom:
3522               fieldRef:
3523                 apiVersion: v1
3524                 fieldPath: metadata.namespace
3525           - name: COLLECTOR_ZIPKIN_HTTP_PORT
3526             value: "9411"
3527           - name: MEMORY_MAX_TRACES
3528             value: "50000"
3529           livenessProbe:
3530             httpGet:
3531               path: /
3532               port: 16686
3533           readinessProbe:
3534             httpGet:
3535               path: /
3536               port: 16686
3537           resources:
3538             {}
3539
3540       affinity:
3541         nodeAffinity:
3542           requiredDuringSchedulingIgnoredDuringExecution:
3543             nodeSelectorTerms:
3544             - matchExpressions:
3545               - key: beta.kubernetes.io/arch
3546                 operator: In
3547                 values:
3548                 - amd64
3549                 - ppc64le
3550                 - s390x
3551           preferredDuringSchedulingIgnoredDuringExecution:
3552           - weight: 2
3553             preference:
3554               matchExpressions:
3555               - key: beta.kubernetes.io/arch
3556                 operator: In
3557                 values:
3558                 - amd64
3559           - weight: 2
3560             preference:
3561               matchExpressions:
3562               - key: beta.kubernetes.io/arch
3563                 operator: In
3564                 values:
3565                 - ppc64le
3566           - weight: 2
3567             preference:
3568               matchExpressions:
3569               - key: beta.kubernetes.io/arch
3570                 operator: In
3571                 values:
3572                 - s390x
3573
3574 ---
3575 # Source: istio/charts/security/templates/cleanup-old-ca.yaml
3576
3577 apiVersion: batch/v1
3578 kind: Job
3579 metadata:
3580   name: istio-cleanup-old-ca
3581   namespace: istio-system
3582   annotations:
3583     "helm.sh/hook": post-install
3584     "helm.sh/hook-delete-policy": hook-succeeded
3585   labels:
3586     app: security
3587     chart: security-0.8.0
3588     release: RELEASE-NAME
3589     heritage: Tiller
3590 spec:
3591   template:
3592     metadata:
3593       name: istio-cleanup-old-ca
3594       labels:
3595         app: security
3596         release: RELEASE-NAME
3597     spec:
3598       serviceAccountName: istio-cleanup-old-ca-service-account
3599       containers:
3600         - name: hyperkube
3601           image: "quay.io/coreos/hyperkube:v1.7.6_coreos.0"
3602           command:
3603           - /bin/bash
3604           - -c
3605           - >
3606               NS="-n istio-system";
3607               ./kubectl get deploy istio-ca $NS;
3608               if [[ $? = 0 ]]; then ./kubectl delete deploy istio-ca $NS; fi;
3609               ./kubectl get serviceaccount istio-ca-service-account $NS;
3610               if [[ $? = 0 ]]; then ./kubectl delete serviceaccount istio-ca-service-account $NS; fi;
3611               ./kubectl get service istio-ca-ilb $NS;
3612               if [[ $? = 0 ]]; then ./kubectl delete service istio-ca-ilb $NS; fi
3613       restartPolicy: Never
3614 ---
3615 # Source: istio/charts/egressgateway/templates/autoscale.yaml
3616
3617 apiVersion: autoscaling/v2beta1
3618 kind: HorizontalPodAutoscaler
3619 metadata:
3620     name: istio-egressgateway
3621     namespace: istio-system
3622 spec:
3623     maxReplicas: 1
3624     minReplicas: 1
3625     scaleTargetRef:
3626       apiVersion: apps/v1beta1
3627       kind: Deployment
3628       name: istio-egressgateway
3629     metrics:
3630       - type: Resource
3631         resource:
3632           name: cpu
3633           targetAverageUtilization: 80
3634
3635
3636 ---
3637 # Source: istio/charts/ingressgateway/templates/autoscale.yaml
3638
3639 apiVersion: autoscaling/v2beta1
3640 kind: HorizontalPodAutoscaler
3641 metadata:
3642     name: istio-ingressgateway
3643     namespace: istio-system
3644 spec:
3645     maxReplicas: 1
3646     minReplicas: 1
3647     scaleTargetRef:
3648       apiVersion: apps/v1beta1
3649       kind: Deployment
3650       name: istio-ingressgateway
3651     metrics:
3652       - type: Resource
3653         resource:
3654           name: cpu
3655           targetAverageUtilization: 80
3656
3657
3658 ---
3659 # Source: istio/charts/tracing/templates/service.yaml
3660 apiVersion: v1
3661 kind: List
3662 items:
3663 - apiVersion: v1
3664   kind: Service
3665   metadata:
3666     name: zipkin
3667     namespace: istio-system
3668     labels:
3669       app: jaeger
3670       chart: tracing-0.1.0
3671       release: RELEASE-NAME
3672       heritage: Tiller
3673   spec:
3674     type: NodePort
3675     ports:
3676       - port: 9411
3677         targetPort: 9411
3678         protocol: TCP
3679         name: http
3680         nodePort: 30411
3681     selector:
3682       app: jaeger
3683 - apiVersion: v1
3684   kind: Service
3685   metadata:
3686     name: tracing
3687     namespace: istio-system
3688     labels:
3689       app: jaeger
3690       chart: tracing-0.1.0
3691       release: RELEASE-NAME
3692       heritage: Tiller
3693   spec:
3694     ports:
3695       - name: query-http
3696         port: 80
3697         protocol: TCP
3698         targetPort: 16686
3699     selector:
3700       app: jaeger
3701     type: LoadBalancer
3702
3703
3704 ---
3705 # Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml
3706 apiVersion: admissionregistration.k8s.io/v1beta1
3707 kind: MutatingWebhookConfiguration
3708 metadata:
3709   name: istio-sidecar-injector
3710   namespace: istio-system
3711   labels:
3712     app: istio-sidecar-injector
3713     chart: sidecarInjectorWebhook-0.8.0
3714     release: RELEASE-NAME
3715     heritage: Tiller
3716 webhooks:
3717   - name: sidecar-injector.istio.io
3718     clientConfig:
3719       service:
3720         name: istio-sidecar-injector
3721         namespace: istio-system
3722         path: "/inject"
3723       caBundle: ""
3724     rules:
3725       - operations: [ "CREATE" ]
3726         apiGroups: [""]
3727         apiVersions: ["v1"]
3728         resources: ["pods"]
3729     failurePolicy: Fail
3730     namespaceSelector:
3731       matchLabels:
3732         istio-injection: enabled
3733
3734 ---
3735 # Source: istio/charts/grafana/templates/ingress.yaml
3736
3737 ---
3738 # Source: istio/charts/mixer/templates/config.yaml
3739
3740
3741 ---
3742 # Source: istio/charts/prometheus/templates/ingress.yaml
3743
3744 ---
3745 # Source: istio/charts/servicegraph/templates/ingress.yaml
3746
3747 ---
3748 # Source: istio/charts/tracing/templates/ingress.yaml
3749
3750 ---
3751 # Source: istio/charts/tracing/templates/service-jaeger.yaml
3752
3753
3754