istio

1
defaults:
2
  # Standalone istio egress gateway.
3
  # Should be installed in a separate namespace, to minimize access to config
4
  gateways:
5
    istio-egressgateway:
6
      name: istio-egressgateway
7
      ports:
8
      - port: 80
9
        targetPort: 8080
10
        name: http2
11
        protocol: TCP
12
      - port: 443
13
        name: https
14
        targetPort: 8443
15
        protocol: TCP
16

17
      labels:
18
        app: istio-egressgateway
19
        istio: egressgateway
20

21
      # Scalability tuning
22
      # replicaCount: 1
23
      rollingMaxSurge: 100%
24
      rollingMaxUnavailable: 25%
25
      autoscaleEnabled: true
26
      autoscaleMin: 1
27
      autoscaleMax: 5
28
      resources:
29
        requests:
30
          cpu: 100m
31
          memory: 128Mi
32
        limits:
33
          cpu: 2000m
34
          memory: 1024Mi
35
      cpu:
36
        targetAverageUtilization: 80
37
      memory: {}
38
        # targetAverageUtilization: 80
39

40
      serviceAnnotations: {}
41
      podAnnotations: {}
42
      type: ClusterIP # change to NodePort or LoadBalancer if need be
43

44
      # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
45
      ipFamilyPolicy: ""
46
      ipFamilies: []
47

48
      secretVolumes:
49
      - name: egressgateway-certs
50
        secretName: istio-egressgateway-certs
51
        mountPath: /etc/istio/egressgateway-certs
52
      - name: egressgateway-ca-certs
53
        secretName: istio-egressgateway-ca-certs
54
        mountPath: /etc/istio/egressgateway-ca-certs
55

56
      configVolumes: []
57
      additionalContainers: []
58

59
      serviceAccount:
60
        # Annotations to add to the service account
61
        annotations: {}
62

63
      ### Advanced options ############
64
      # TODO: convert to real options, env should not be exposed
65
      env: {}
66
        # Set this to "external" if and only if you want the egress gateway to
67
        # act as a transparent SNI gateway that routes mTLS/TLS traffic to
68
        # external services defined using service entries, where the service
69
        # entry has resolution set to DNS, has one or more endpoints with
70
        # network field set to "external". By default its set to "" so that
71
        # the egress gateway sees the same set of endpoints as the sidecars
72
        # preserving backward compatibility
73
        # ISTIO_META_REQUESTED_NETWORK_VIEW: ""
74

75
      nodeSelector: {}
76
      tolerations: []
77

78
      # Specify the pod anti-affinity that allows you to constrain which nodes
79
      # your pod is eligible to be scheduled based on labels on pods that are
80
      # already running on the node rather than based on labels on nodes.
81
      # There are currently two types of anti-affinity:
82
      #    "requiredDuringSchedulingIgnoredDuringExecution"
83
      #    "preferredDuringSchedulingIgnoredDuringExecution"
84
      # which denote "hard" vs. "soft" requirements, you can define your values
85
      # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
86
      # correspondingly.
87
      # For example:
88
      # podAntiAffinityLabelSelector:
89
      # - key: security
90
      #   operator: In
91
      #   values: S1,S2
92
      #   topologyKey: "kubernetes.io/hostname"
93
      # This pod anti-affinity rule says that the pod requires not to be scheduled
94
      # onto a node if that node is already running a pod with label having key
95
      # "security" and value "S1".
96
      podAntiAffinityLabelSelector: []
97
      podAntiAffinityTermLabelSelector: []
98

99
      # whether to run the gateway in a privileged container
100
      runAsRoot: false
101

102
      # The injection template to use for the gateway. If not set, no injection will be performed.
103
      injectionTemplate: ""
104

105
  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
106
  revision: ""
107

108
  # For Helm compatibility.
109
  ownerName: ""
110

111
  global:
112
    # set the default set of namespaces to which services, service entries, virtual services, destination
113
    # rules should be exported to. Currently only one value can be provided in this list. This value
114
    # should be one of the following two options:
115
    # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
116
    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
117
    defaultConfigVisibilitySettings: []
118

119
    # Default node selector to be applied to all deployments so that all pods can be
120
    # constrained to run a particular nodes. Each component can overwrite these default
121
    # values by adding its node selector block in the relevant section below and setting
122
    # the desired values.
123
    defaultNodeSelector: {}
124

125
    # enable pod disruption budget for the control plane, which is used to
126
    # ensure Istio control plane components are gradually upgraded or recovered.
127
    defaultPodDisruptionBudget:
128
      enabled: true
129

130
    # A minimal set of requested resources to applied to all deployments so that
131
    # Horizontal Pod Autoscaler will be able to function (if set).
132
    # Each component can overwrite these default values by adding its own resources
133
    # block in the relevant section below and setting the desired resources values.
134
    defaultResources:
135
      requests:
136
        cpu: 10m
137
      #   memory: 128Mi
138
      # limits:
139
      #   cpu: 100m
140
      #   memory: 128Mi
141

142
    # Default node tolerations to be applied to all deployments so that all pods can be
143
    # scheduled to a particular nodes with matching taints. Each component can overwrite
144
    # these default values by adding its tolerations block in the relevant section below
145
    # and setting the desired values.
146
    # Configure this field in case that all pods of Istio control plane are expected to
147
    # be scheduled to particular nodes with specified taints.
148
    defaultTolerations: []
149

150
    # Default hub for Istio images.
151
    # Releases are published to docker hub under 'istio' project.
152
    # Dev builds from prow are on gcr.io
153
    hub: gcr.io/istio-testing
154

155
    # Default tag for Istio images.
156
    tag: latest
157

158
    # Specify image pull policy if default behavior isn't desired.
159
    # Default behavior: latest images will be Always else IfNotPresent.
160
    imagePullPolicy: ""
161

162
    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
163
    # to use for pulling any images in pods that reference this ServiceAccount.
164
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
165
    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
166
    # Must be set for any cluster configured with private docker registry.
167
    imagePullSecrets: []
168
    # - private-registry-key
169

170
    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
171
    logAsJson: false
172

173
    # Specify pod scheduling arch(amd64, ppc64le, s390x, arm64) and weight as follows:
174
    #   0 - Never scheduled
175
    #   1 - Least preferred
176
    #   2 - No preference
177
    #   3 - Most preferred
178
    arch: {}
179

180
    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
181
    # The control plane has different scopes depending on component, but can configure default log level across all components
182
    # If empty, default scope and level will be used as configured in code
183
    logging:
184
      level: "default:info"
185

186
    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
187
    # system-node-critical, it is better to configure this in order to make sure your Istio pods
188
    # will not be killed because of low priority class.
189
    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
190
    # for more detail.
191
    priorityClassName: ""
192

193
    proxy:
194
      image: proxyv2
195

196
      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
197
      # cluster domain. Default value is "cluster.local".
198
      clusterDomain: "cluster.local"
199

200
      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
201
      # not set, then the global "logLevel" will be used.
202
      componentLogLevel: "misc:error"
203

204
      # If set, newly injected sidecars will have core dumps enabled.
205
      enableCoreDump: false
206

207
      # Log level for proxy, applies to gateways and sidecars.
208
      # Expected values are: trace|debug|info|warning|error|critical|off
209
      logLevel: warning
210

211
    ##############################################################################################
212
    # The following values are found in other charts. To effectively modify these values, make   #
213
    # make sure they are consistent across your Istio helm charts                                #
214
    ##############################################################################################
215

216
    # The customized CA address to retrieve certificates for the pods in the cluster.
217
    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
218
    caAddress: ""
219

220
    # Used to locate istiod.
221
    istioNamespace: istio-system
222

223
    # Mesh ID means Mesh Identifier. It should be unique within the scope where
224
    # meshes will interact with each other, but it is not required to be
225
    # globally/universally unique. For example, if any of the following are true,
226
    # then two meshes must have different Mesh IDs:
227
    # - Meshes will have their telemetry aggregated in one place
228
    # - Meshes will be federated together
229
    # - Policy will be written referencing one mesh from the other
230
    #
231
    # If an administrator expects that any of these conditions may become true in
232
    # the future, they should ensure their meshes have different Mesh IDs
233
    # assigned.
234
    #
235
    # Within a multicluster mesh, each cluster must be (manually or auto)
236
    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
237
    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
238
    # of migration TBD, and it may be a disruptive operation to change the Mesh
239
    # ID post-install.
240
    #
241
    # If the mesh admin does not specify a value, Istio will use the value of the
242
    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
243
    # value.
244
    meshID: ""
245

246
    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
247
    mountMtlsCerts: false
248

249
    multiCluster:
250
      # Set to true to connect two kubernetes clusters via their respective
251
      # ingressgateway services when pods in each cluster cannot directly
252
      # talk to one another. All clusters should be using Istio mTLS and must
253
      # have a shared root CA for this model to work.
254
      enabled: false
255
      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
256
      # to properly label proxies
257
      clusterName: ""
258

259
    # Network defines the network this cluster belong to. This name
260
    # corresponds to the networks in the map of mesh networks.
261
    network: ""
262

263
    # Configure the certificate provider for control plane communication.
264
    # Currently, two providers are supported: "kubernetes" and "istiod".
265
    # As some platforms may not have kubernetes signing APIs,
266
    # Istiod is the default
267
    pilotCertProvider: istiod
268

269
    sds:
270
      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
271
      # When a CSR is sent from Citadel Agent to the CA (e.g. Citadel), this aud is to make sure the
272
      # JWT is intended for the CA.
273
      token:
274
        aud: istio-ca
275

276
    sts:
277
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
278
      # Setting this port to a non-zero value enables STS server.
279
      servicePort: 0
280

281
    # whether to use autoscaling/v2 template for HPA settings
282
    # for internal usage only, not to be configured by users.
283
    autoscalingv2API: true
284

285
  meshConfig:
286
    enablePrometheusMerge: true
287

288
    # The trust domain corresponds to the trust root of a system
289
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
290
    trustDomain: "cluster.local"
291

292
    defaultConfig:
293
      proxyMetadata: {}
294
      tracing:
295
      #      tlsSettings:
296
      #        mode: DISABLE # DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
297
      #        clientCertificate: # example: /etc/istio/tracer/cert-chain.pem
298
      #        privateKey:        # example: /etc/istio/tracer/key.pem
299
      #        caCertificates:    # example: /etc/istio/tracer/root-cert.pem
300
      #        sni:               # example: tracer.somedomain
301
      #        subjectAltNames: []
302
      # - tracer.somedomain
303