stable/envoy/values.yaml - master - githubmirror/charts

stable/envoy/values.yaml
342 строки10 KB
Daniel Mittelman
[stable/envoy] Added loadBalancerSourceRanges for Service objects (#23459)
07 авг 2020, 05:18
07 авг 2020, 05:184addcad
replicaCount: 2

podDisruptionBudget: |
  maxUnavailable: 1

## ref: https://pracucci.com/graceful-shutdown-of-kubernetes-pods.html
terminationGracePeriodSeconds: 30

strategy: |
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 1

image:
  repository: envoyproxy/envoy
  tag: v1.11.1
  pullPolicy: IfNotPresent

command:
  - /usr/local/bin/envoy
args:
  - -l
  - $loglevel
  - -c
  - /config/envoy.yaml

## Args template allows you to use Chart template expressions to dynamically generate args
# argsTemplate: |-
#   - -c
#   - /docker-entrypoint.sh envoy --service-node ${POD_NAME} --service-cluster {{ template "envoy.fullname" . }} -l debug -c /config/envoy.yaml

## Client service.
service:
  enabled: true
  ## Service name is user-configurable for maximum service discovery flexibility.
  name: envoy
  type: ClusterIP
  ## Ignored if the type is not LoadBalancer or if the IP is empty string
  loadBalancerIP: ""
  annotations: {}
    ## AWS example for use with LoadBalancer service type.
    # external-dns.alpha.kubernetes.io/hostname: envoy.cluster.local
    # service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
    # service.beta.kubernetes.io/aws-load-balancer-internal: "true"
  ports:
    n0:
      port: 10000
      targetPort: n0
      protocol: TCP
  ## Used to whitelist certain source CIDRs
  # loadBalancerSourceRanges:
  # - 0.0.0.0/0

ports:
  admin:
    containerPort: 9901
    protocol: TCP
  n0:
    containerPort: 10000
    protocol: TCP

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

priorityClassName: ""

nodeSelector: {}

tolerations: []

affinity: {}
  # podAntiAffinity:
  #   preferredDuringSchedulingIgnoredDuringExecution:
  #     - weight: 50
  #       podAffinityTerm:
  #         topologyKey: failure-domain.beta.kubernetes.io/zone
  #         labelSelector:
  #           matchLabels:
  #             release: envoy
  #   requiredDuringSchedulingIgnoredDuringExecution:
  #     - weight: 40
  #       topologyKey: "kubernetes.io/hostname"
  #       labelSelector:
  #         matchLabels:
  #           release: envoy

## ref: https://github.com/envoyproxy/envoy/pull/2896
podAnnotations: {}
  # prometheus.io/scrape: "true"
  # prometheus.io/path: "/stats/prometheus"
  # prometheus.io/port: "9901"

podLabels: {}
  # team: "developers"
  # service: "envoy"

livenessProbe:
  tcpSocket:
    port: admin
  initialDelaySeconds: 30
  # periodSeconds: 10
  # timeoutSeconds: 5
  # failureThreshold: 3
  # successThreshold: 1

readinessProbe:
  tcpSocket:
    port: admin
  initialDelaySeconds: 30
  # periodSeconds: 10
  # timeoutSeconds: 5
  # failureThreshold: 3
  # successThreshold: 1

securityContext: {}

env: {}

## Create secrets out-of-band from Helm like this:
##
## $ kubectl create secret generic envoy --from-file=./some-secret.txt
##
secretMounts: {}
  # secret:
  #   secretName: envoy
  #   mountPath: /secret
  #   defaultMode: 256  # 256 in base10 == 0400 in octal

files:
  envoy.yaml: |-
    ## refs:
    ## - https://www.envoyproxy.io/docs/envoy/latest/start/start#quick-start-to-run-simple-example
    ## - https://raw.githubusercontent.com/envoyproxy/envoy/master/configs/google_com_proxy.v2.yaml
    admin:
      access_log_path: /dev/stdout
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 9901

    static_resources:
      listeners:
      - name: listener_0
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 10000
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              access_log:
              - name: envoy.file_access_log
                config:
                  path: /dev/stdout
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      host_rewrite: www.google.com
                      cluster: service_google
              http_filters:
              - name: envoy.router
      clusters:
      - name: service_google
        connect_timeout: 0.25s
        type: LOGICAL_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        hosts:
          - socket_address:
              address: google.com
              port_value: 443
        tls_context:
          sni: www.google.com

## Uncomment this section to use helm values to dynamically generate enovy.yaml
# templates:
#   envoy.yaml: |-
#     ## refs:
#     ## - https://www.envoyproxy.io/docs/envoy/latest/start/start#quick-start-to-run-simple-example
#     ## - https://raw.githubusercontent.com/envoyproxy/envoy/master/configs/google_com_proxy.v2.yaml
#     admin:
#       access_log_path: /dev/stdout
#       address:
#         socket_address:
#           address: 0.0.0.0
#           port_value: {{ .Values.ports.admin.containerPort }}

#     static_resources:
#       listeners:
#       - name: listener_0
#         address:
#           socket_address:
#             address: 0.0.0.0
#             port_value: {{ .Values.ports.n0.containerPort }}
#         filter_chains:
#         - filters:
#           - name: envoy.http_connection_manager
#             config:
#               access_log:
#               - name: envoy.file_access_log
#                 config:
#                   path: /dev/stdout
#               stat_prefix: ingress_http
#               route_config:
#                 name: local_route
#                 virtual_hosts:
#                 - name: local_service
#                   domains: ["*"]
#                   routes:
#                   - match:
#                       prefix: "/"
#                     route:
#                       host_rewrite: www.google.com
#                       cluster: service_google
#               http_filters:
#               - name: envoy.router
#       clusters:
#       - name: service_google
#         connect_timeout: 0.25s
#         type: LOGICAL_DNS
#         dns_lookup_family: V4_ONLY
#         lb_policy: ROUND_ROBIN
#         hosts:
#           - socket_address:
#               address: google.com
#               port_value: 443
#         tls_context:
#           sni: www.google.com

## Additional volumes to be added to Envoy pods
# volumes:
# - name: xds
#   emptyDir: {}

## Additional volume mounts to be added to Envoy containers(Primary containers of Envoy pods)
# volumeMounts:
# - name: xds
#   mountPath: /srv/runtime

## Init containers
# initContainersTemplate: |-
#   - name: xds-init
#     image: mumoshu/envoy-xds-configmap-loader:canary-6090275
#     command:
#     - envoy-xds-configmap-loader
#     args:
#     - --configmap={{ template "envoy.fullname" . }}-xds
#     - --onetime
#     - --insecure
#     env:
#     - name: POD_NAMESPACE
#       valueFrom:
#         fieldRef:
#           fieldPath: metadata.namespace
#     volumeMounts:
#     - name: xds
#       mountPath: /srv/runtime

## Sidecar containers
# sidecarContainersTemplate: |-
#   - name: xds-update
#     image: mumoshu/envoy-xds-configmap-loader:canary-6090275
#     command:
#     - envoy-xds-configmap-loader
#     args:
#     - --configmap={{ template "envoy.fullname" . }}-xds
#     - --sync-interval=5s
#     - --insecure
#     env:
#     - name: POD_NAMESPACE
#       valueFrom:
#         fieldRef:
#           fieldPath: metadata.namespace
#     volumeMounts:
#     - name: xds
#       mountPath: /srv/runtime

## ServiceMonitor consumed by prometheus-operator
serviceMonitor:
  ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
  enabled: false
  interval: "15s"
  targetLabels: []
  podTargetLabels: []
  ## Namespace in which the service monitor is created
  # namespace: monitoring
  # Added to the ServiceMonitor object so that prometheus-operator is able to discover it
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
  additionalLabels: {}

### Lifecycle Events
lifecycle: {}
#  preStop:
#    exec:
#      command:
#      - sh
#      - -c
#      - "sleep 60"

## PrometheusRule consumed by prometheus-operator
prometheusRule:
  enabled: false
  ## Namespace in which the prometheus rule is created
  # namespace: monitoring
  ## Define individual alerting rules as required
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#rulegroup
  ##      https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
  groups:
    upstream-rules:
      enabled: true
      rules:
        high4xxRate:
          enabled: true
          alert: High4xxRate
          expr: sum(rate(envoy_cluster_upstream_rq_xx{response_code_class="4"}[1m])) / sum(rate(envoy_cluster_upstream_rq_xx[1m])) * 100 > 1
          for: 1m
          labels:
            severity: page
          annotations:
            summary: "4xx response rate above 1%"
            description: "The 4xx error response rate for envoy cluster {{ $labels.envoy_cluster_name }} reported a service replication success rate of {{ $value }}% for more than 1 minute."
  ## Added to the PrometheusRule object so that prometheus-operator is able to discover it
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
  additionalLabels: {}