mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[New Chart] - Add Istio chart (#1158)
* Add Istio chart * Update servicegraph URL in notes Add ingresses.extensions to RBAC role * Update servicegraph prometheus URL Update RBAC clusterole to include ingresses/status * Update rbac rules to allow secret update Changed almost all services to type ClusterIP for a sane default * Update service types to limit number of LBs * Add RBAC details to Readme Add sample app deployment to Notes * Added installation notes to TL;DR; * Add istioctl requirement to prereqs * rename file update RBAC in readme * Add appVersion to Chart * Update beta rbac roles to sync them with upstream * Make rbac apiVersion configurable and required Pin container image tag to appVersion in Chart.yaml
This commit is contained in:
Lachlan Evenson
committed by
Sean Knox
Sean Knox
parent
e05e625b93
commit
67985a01cb
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
description: Istio Helm chart for Kubernetes
|
||||
name: istio
|
||||
version: 0.1.0
|
||||
appVersion: 0.1.5
|
||||
home: https://istio.io/
|
||||
sources:
|
||||
- https://github.com/istio/istio
|
||||
maintainers:
|
||||
- name: lachie83
|
||||
email: lachlan.evenson@microsoft.com
|
||||
@@ -0,0 +1,112 @@
|
||||
# Istio
|
||||
|
||||
[Istio](https://istio.io/), Istio is an open platform that provides a uniform way to connect, manage, and secure microservices. Istio supports managing traffic flows between microservices, enforcing access policies, and aggregating telemetry data, all without requiring changes to the microservice code.
|
||||
|
||||
## TL;DR;
|
||||
|
||||
> **Note**: Istio manager currently looks for hardcoded configmap of name "istio" in the installed namespace which means that you can only install the chart once per namespace.
|
||||
|
||||
```console
|
||||
$ helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator
|
||||
$ helm install incubator/istio
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a [Istio](https://istio.io/) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.5+
|
||||
- istioctl - See installation steps [here](https://istio.io/docs/tasks/installing-istio.html#installation-steps)
|
||||
|
||||
## RBAC
|
||||
By default the chart will install the associated RBAC roles and rolebindings using beta annotations.
|
||||
|
||||
To determine if your cluster supports this running the following:
|
||||
|
||||
```console
|
||||
$ kubectl api-versions | grep rbac
|
||||
```
|
||||
|
||||
You also need to have the following parameter on the api server. See the following document for how to enable [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)
|
||||
|
||||
```
|
||||
--authorization-mode=RBAC
|
||||
```
|
||||
|
||||
If the output contains "beta" or both "alpha" and "beta" you can proceed with normal installation.
|
||||
|
||||
### Changing RBAC manifest apiVersion
|
||||
|
||||
By default the RBAC resources are generated with the "v1beta1" apiVersion. To use "v1alpha1" do the following:
|
||||
|
||||
```console
|
||||
$ helm install --name my-release incubator/istio --set rbac.apiVersion=v1alpha1
|
||||
```
|
||||
|
||||
|
||||
If it does not. Follow the steps below to disable.
|
||||
|
||||
### Disable RBAC role/rolebinding creation
|
||||
|
||||
To disable the creation of RBAC resources (On clusters without RBAC or if you would like to manage the creation outside the scope of this chart). Do the following:
|
||||
|
||||
```console
|
||||
$ helm install --name my-release incubator/istio --set rbac.install=false
|
||||
```
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator
|
||||
$ helm install --name my-release incubator/istio
|
||||
```
|
||||
|
||||
The command deploys Istio on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following tables lists the configurable parameters of the Istio chart and their default values.
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
Parameter | Description | Default
|
||||
--------- | ----------- | -------
|
||||
| | |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install stable/istio --name my-release \
|
||||
--set auth.enabled=flase
|
||||
```
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install incubator/istio --name my-release -f values.yaml
|
||||
```
|
||||
|
||||
### Addons
|
||||
Istio ships with several preconfigured addons
|
||||
* Grafana
|
||||
* Prometheus
|
||||
* ServiceGraph
|
||||
* Zipkin
|
||||
|
||||
These addons can be selectively installed by setting `addons.<addon-name>.enabled=false` in values.yaml or by using the `--set` command
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
Verify all Pods are running
|
||||
|
||||
kubectl get pods --namespace {{ .Release.Namespace }}
|
||||
{{if .Values.addons.grafana.enabled}}
|
||||
Verifying the Grafana dashboard
|
||||
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ $serviceName }}-grafana" -o jsonpath="{.items[0].metadata.name}")
|
||||
kubectl port-forward $POD_NAME {{ .Values.addons.grafana.service.externalPort }}:{{ .Values.addons.grafana.service.externalPort }}
|
||||
echo http://127.0.0.1:{{ .Values.addons.grafana.service.externalPort }}/dashboard/db/istio-dashboard
|
||||
{{- end }}
|
||||
{{if .Values.addons.servicegraph.enabled}}
|
||||
Verifying the ServiceGraph service
|
||||
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ $serviceName }}-servicegraph" -o jsonpath="{.items[0].metadata.name}")
|
||||
kubectl port-forward $POD_NAME {{ .Values.addons.servicegraph.service.externalPort }}:{{ .Values.addons.servicegraph.service.externalPort }}
|
||||
echo http://127.0.0.1:{{ .Values.addons.servicegraph.service.externalPort }}/dotviz
|
||||
{{- end }}
|
||||
|
||||
Deploy your App!
|
||||
|
||||
kubectl create -f <(istioctl kube-inject -f <your-app-spec>.yaml)
|
||||
|
||||
Or deploy the BookInfo App!
|
||||
|
||||
https://istio.io/docs/samples/bookinfo.html
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,41 @@
|
||||
{{if .Values.addons.grafana.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ $serviceName }}-grafana
|
||||
spec:
|
||||
replicas: {{ .Values.addons.grafana.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.addons.grafana.deployment.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ $serviceName }}-grafana
|
||||
spec:
|
||||
containers:
|
||||
- name: grafana
|
||||
image: "{{ .Values.addons.grafana.deployment.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.addons.grafana.deployment.imagePullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.addons.grafana.service.externalPort }}
|
||||
env:
|
||||
- name: GRAFANA_PORT
|
||||
value: "{{ .Values.addons.grafana.service.externalPort }}"
|
||||
- name: GF_AUTH_BASIC_ENABLED
|
||||
value: "false"
|
||||
- name: GF_AUTH_ANONYMOUS_ENABLED
|
||||
value: "true"
|
||||
- name: GF_AUTH_ANONYMOUS_ORG_ROLE
|
||||
value: Admin
|
||||
- name: GF_PATHS_DATA
|
||||
value: /data/grafana
|
||||
volumeMounts:
|
||||
- mountPath: /data/grafana
|
||||
name: grafana-data
|
||||
volumes:
|
||||
- name: grafana-data
|
||||
emptyDir: {}
|
||||
{{end}}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{if .Values.addons.grafana.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $serviceName }}-grafana
|
||||
spec:
|
||||
type: {{ .Values.addons.grafana.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.addons.grafana.service.externalPort }}
|
||||
protocol: TCP
|
||||
name: grafana
|
||||
selector:
|
||||
app: {{ $serviceName }}-grafana
|
||||
{{end}}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{if .Values.addons.prometheus.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $serviceName }}-prometheus
|
||||
data:
|
||||
prometheus.yml: |-
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
scrape_configs:
|
||||
|
||||
- job_name: 'mixer'
|
||||
# Override the global default and scrape targets from this job every 5 seconds.
|
||||
scrape_interval: 5s
|
||||
# metrics_path defaults to '/metrics'
|
||||
# scheme defaults to 'http'.
|
||||
static_configs:
|
||||
- targets: ['{{ template "fullname" . }}-mixer:{{ .Values.mixer.service.externalPrometheusPort }}']
|
||||
{{end}}
|
||||
@@ -0,0 +1,42 @@
|
||||
{{if .Values.addons.prometheus.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ $serviceName }}-prometheus
|
||||
spec:
|
||||
replicas: {{ .Values.addons.prometheus.deployment.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ $serviceName }}-prometheus
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.addons.prometheus.deployment.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
name: {{ $serviceName }}-prometheus
|
||||
labels:
|
||||
app: {{ $serviceName }}-prometheus
|
||||
spec:
|
||||
containers:
|
||||
- name: prometheus
|
||||
image: "{{ .Values.addons.prometheus.deployment.image }}:{{ .Values.addons.prometheus.deployment.imageTag }}"
|
||||
imagePullPolicy: {{ .Values.addons.prometheus.deployment.imagePullPolicy }}
|
||||
args:
|
||||
- '-storage.local.retention=6h'
|
||||
- '-storage.local.memory-chunks=500000'
|
||||
- '-config.file=/etc/prometheus/prometheus.yml'
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: {{ .Values.addons.prometheus.service.externalPort }}
|
||||
resources:
|
||||
{{ toYaml .Values.addons.prometheus.deployment.resources | indent 10 }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /etc/prometheus
|
||||
volumes:
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ $serviceName }}-prometheus
|
||||
{{end}}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{if .Values.addons.prometheus.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.addons.prometheus.service.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
name: {{ $serviceName }}-prometheus
|
||||
# Grafana datasource config is hardcoded to prometheus:9090
|
||||
# name: {{ $serviceName }}-prometheus
|
||||
name: prometheus
|
||||
spec:
|
||||
selector:
|
||||
app: {{ $serviceName }}-prometheus
|
||||
type: {{ .Values.addons.prometheus.service.type }}
|
||||
ports:
|
||||
- name: prometheus
|
||||
protocol: TCP
|
||||
port: {{ .Values.addons.prometheus.service.externalPort }}
|
||||
{{end}}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{if .Values.addons.servicegraph.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ $serviceName }}-servicegraph
|
||||
spec:
|
||||
replicas: {{ .Values.addons.servicegraph.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.addons.servicegraph.deployment.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ $serviceName }}-servicegraph
|
||||
spec:
|
||||
containers:
|
||||
- name: servicegraph
|
||||
image: "{{ .Values.addons.servicegraph.deployment.image }}:{{ .Values.addons.servicegraph.deployment.imageTag }}"
|
||||
imagePullPolicy: {{ .Values.addons.servicegraph.deployment.imagePullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.addons.servicegraph.service.externalPort }}
|
||||
args:
|
||||
- --prometheusAddr=http://prometheus:{{ .Values.addons.prometheus.service.externalPort }}
|
||||
resources:
|
||||
{{ toYaml .Values.addons.servicegraph.deployment.resources | indent 10 }}
|
||||
{{end}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{if .Values.addons.servicegraph.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $serviceName }}-servicegraph
|
||||
spec:
|
||||
type: {{ .Values.addons.servicegraph.service.type }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.addons.servicegraph.service.externalPort }}
|
||||
selector:
|
||||
app: {{ $serviceName }}-servicegraph
|
||||
{{end}}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{if .Values.addons.zipkin.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ $serviceName }}-zipkin
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.addons.zipkin.deployment.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ $serviceName }}-zipkin
|
||||
spec:
|
||||
containers:
|
||||
- name: zipkin
|
||||
image: "{{ .Values.addons.zipkin.deployment.image }}:{{ .Values.addons.zipkin.deployment.imageTag }}"
|
||||
imagePullPolicy: {{ .Values.addons.zipkin.deployment.imagePullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.addons.zipkin.service.externalPort }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{end}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{if .Values.addons.zipkin.enabled}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $serviceName }}-zipkin
|
||||
spec:
|
||||
type: {{ .Values.addons.zipkin.service.type }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.addons.zipkin.service.externalPort }}
|
||||
selector:
|
||||
app: {{ $serviceName }}-zipkin
|
||||
{{end}}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: v1
|
||||
kind: Deployment
|
||||
apiVersion: extensions/v1beta1
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-ca
|
||||
spec:
|
||||
replicas: {{ .Values.ca.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ca.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-ca
|
||||
spec:
|
||||
serviceAccountName: {{ template "fullname" . }}-ca-service-account
|
||||
containers:
|
||||
- name: istio-ca
|
||||
image: "{{ .Values.ca.deployment.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.ca.deployment.imagePullPolicy }}
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{{ toYaml .Values.ca.deployment.resources | indent 10 }}
|
||||
@@ -0,0 +1,6 @@
|
||||
{{if .Values.auth.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-ca-service-account
|
||||
{{end}}
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: istio
|
||||
data:
|
||||
mesh: |-
|
||||
{{if .Values.auth.enabled }}
|
||||
authPolicy: MUTUAL_TLS
|
||||
{{end}}
|
||||
mixerAddress: {{ template "fullname" . }}-mixer:{{ .Values.mixer.service.externalTcpPort }}
|
||||
discoveryAddress: {{ template "fullname" . }}-manager:{{ .Values.manager.service.externalHttpDiscovery }}
|
||||
ingressService: {{ template "fullname" . }}-ingress
|
||||
zipkinAddress: {{ template "fullname" . }}-zipkin:{{ .Values.addons.zipkin.service.externalPort }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ $serviceName }}-egress
|
||||
spec:
|
||||
replicas: {{ .Values.egress.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.egress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio: {{ $serviceName }}-egress
|
||||
spec:
|
||||
containers:
|
||||
- name: proxy
|
||||
image: "{{ .Values.egress.deployment.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.egress.deployment.imagePullPolicy }}
|
||||
args: ["proxy", "egress", "-v", "2"]
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{{ toYaml .Values.egress.deployment.resources | indent 10 }}
|
||||
{{if .Values.auth.enabled }}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/certs
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: istio-certs
|
||||
secret:
|
||||
secretName: istio.default
|
||||
{{end}}
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-egress
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-egress
|
||||
spec:
|
||||
type: {{ .Values.egress.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.egress.service.externalHttpPort }}
|
||||
selector:
|
||||
istio: {{ template "fullname" . }}-egress
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-ingress
|
||||
spec:
|
||||
replicas: {{ .Values.ingress.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-ingress
|
||||
spec:
|
||||
serviceAccountName: {{ template "fullname" . }}-ingress-service-account
|
||||
containers:
|
||||
- name: istio-ingress
|
||||
image: "{{ .Values.ingress.deployment.image }}:{{ .Chart.AppVersion }}"
|
||||
args: ["proxy", "ingress", "-v", "2"]
|
||||
imagePullPolicy: {{ .Values.ingress.deployment.imagePullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.ingress.service.externalHttpPort }}
|
||||
- containerPort: {{ .Values.ingress.service.externalHttpsPort }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{{ toYaml .Values.ingress.deployment.resources | indent 10 }}
|
||||
{{if .Values.auth.enabled }}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/certs
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: istio-certs
|
||||
secret:
|
||||
secretName: istio.default
|
||||
{{end}}
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-ingress-service-account
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-ingress
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-ingress
|
||||
spec:
|
||||
type: {{ .Values.ingress.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.ingress.service.externalHttpPort }}
|
||||
name: http
|
||||
- port: {{ .Values.ingress.service.externalHttpsPort }}
|
||||
name: https
|
||||
selector:
|
||||
istio: {{ template "fullname" . }}-ingress
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-manager
|
||||
spec:
|
||||
replicas: {{ .Values.manager.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.manager.deployment.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-manager
|
||||
spec:
|
||||
serviceAccountName: {{ template "fullname" . }}-manager-service-account
|
||||
containers:
|
||||
- name: discovery
|
||||
image: "{{ .Values.manager.deployment.discovery.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.manager.deployment.discovery.imagePullPolicy }}
|
||||
args: ["discovery", "-v", "2"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.manager.service.externalHttpDiscovery }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{{ toYaml .Values.manager.deployment.discovery.resources | indent 10 }}
|
||||
- name: apiserver
|
||||
image: "{{ .Values.manager.deployment.apiserver.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.manager.deployment.apiserver.imagePullPolicy }}
|
||||
args: ["apiserver", "-v", "2"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.manager.service.externalHttpApiServer }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{{ toYaml .Values.manager.deployment.apiserver.resources | indent 10 }}
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-manager-service-account
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-manager
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-manager
|
||||
spec:
|
||||
type: {{ .Values.mixer.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.manager.service.externalHttpDiscovery }}
|
||||
name: http-discovery
|
||||
- port: {{ .Values.manager.service.externalHttpApiServer }}
|
||||
name: http-apiserver
|
||||
selector:
|
||||
istio: {{ template "fullname" . }}-manager
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-mixer
|
||||
spec:
|
||||
replicas: {{ .Values.mixer.deployment.replicas }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-mixer
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ template "fullname" . }}-mixer
|
||||
image: "{{ .Values.mixer.deployment.image }}:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.mixer.deployment.imagePullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.mixer.service.externalTcpPort }}
|
||||
- containerPort: {{ .Values.mixer.service.externalConfigApiPort }}
|
||||
- containerPort: {{ .Values.mixer.service.externalPrometheusPort }}
|
||||
args:
|
||||
- --configStoreURL=fs:///etc/opt/mixer/configroot
|
||||
- --logtostderr
|
||||
- -v
|
||||
- "3"
|
||||
resources:
|
||||
{{ toYaml .Values.mixer.deployment.resources | indent 10 }}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-mixer
|
||||
labels:
|
||||
istio: {{ template "fullname" . }}-mixer
|
||||
spec:
|
||||
type: {{ .Values.mixer.service.type }}
|
||||
ports:
|
||||
- name: tcp
|
||||
port: {{ .Values.mixer.service.externalTcpPort }}
|
||||
- name: configapi
|
||||
port: {{ .Values.mixer.service.externalConfigApiPort }}
|
||||
- name: prometheus
|
||||
port: {{ .Values.mixer.service.externalPrometheusPort }}
|
||||
selector:
|
||||
istio: {{ template "fullname" . }}-mixer
|
||||
@@ -0,0 +1,99 @@
|
||||
{{if .Values.rbac.install}}
|
||||
{{- $serviceName := include "fullname" . -}}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-manager
|
||||
rules:
|
||||
- apiGroups: ["istio.io"]
|
||||
resources: ["istioconfigs", "istioconfigs.istio.io"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses", "ingresses/status"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "endpoints", "pods", "services"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-ca
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["create", "get", "watch", "list", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts"]
|
||||
verbs: ["watch", "list"]
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-sidecar
|
||||
rules:
|
||||
- apiGroups: ["istio.io"]
|
||||
resources: ["istioconfigs"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["thirdpartyresources", "ingresses"]
|
||||
verbs: ["get", "watch", "list", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "pods", "endpoints", "services"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-manager-admin-role-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceName }}-manager-service-account
|
||||
namespace: {{.Release.Namespace}}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $serviceName }}-manager
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-ca-role-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceName }}-ca-service-account
|
||||
namespace: {{.Release.Namespace}}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $serviceName }}-ca
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-ingress-admin-role-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceName }}-ingress-service-account
|
||||
namespace: {{.Release.Namespace}}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $serviceName }}-manager
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
|
||||
metadata:
|
||||
name: {{ $serviceName }}-sidecar-role-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
namespace: {{.Release.Namespace}}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $serviceName }}-sidecar
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{end}}
|
||||
@@ -0,0 +1,226 @@
|
||||
## Install Default RBAC roles and bindings
|
||||
rbac:
|
||||
install: true
|
||||
apiVersion: v1beta1
|
||||
|
||||
## Enable Istio auth feature
|
||||
## This deploys a CA in the namespace and enables mTLS between the services
|
||||
auth:
|
||||
enabled: true
|
||||
|
||||
## Mixer configuration
|
||||
mixer:
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalTcpPort: 9091
|
||||
externalConfigApiPort: 9094
|
||||
externalPrometheusPort: 42422
|
||||
|
||||
deployment:
|
||||
image: docker.io/istio/mixer
|
||||
imagePullPolicy: Always
|
||||
replicas: 1
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
## Manager configuration
|
||||
manager:
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalHttpDiscovery: 8080
|
||||
externalHttpApiServer: 8081
|
||||
|
||||
deployment:
|
||||
replicas: 1
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
|
||||
discovery:
|
||||
image: docker.io/istio/manager
|
||||
imagePullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
apiserver:
|
||||
image: docker.io/istio/manager
|
||||
imagePullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
## Ingress configuration
|
||||
ingress:
|
||||
|
||||
service:
|
||||
type: LoadBalancer
|
||||
externalHttpPort: 80
|
||||
externalHttpsPort: 443
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: docker.io/istio/proxy_debug
|
||||
imagePullPolicy: Always
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
## Engress configuration
|
||||
egress:
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalHttpPort: 80
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: docker.io/istio/proxy_debug
|
||||
imagePullPolicy: Always
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
## CA configuration
|
||||
## Only installed if auth.enabled
|
||||
ca:
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
# alpha.istio.io/sidecar: ignore
|
||||
image: docker.io/istio/istio-ca
|
||||
imagePullPolicy: IfNotPresent
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
|
||||
## Addons configuration
|
||||
## Each addon may be disabled
|
||||
addons:
|
||||
|
||||
zipkin:
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 9411
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: docker.io/openzipkin/zipkin
|
||||
imageTag: latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
prometheus:
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 9090
|
||||
annotations:
|
||||
prometheus.io/scrape: 'true'
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: quay.io/coreos/prometheus
|
||||
imageTag: v1.1.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
grafana:
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 3000
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: docker.io/istio/grafana
|
||||
imagePullPolicy: Always
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
servicegraph:
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 8088
|
||||
|
||||
deployment:
|
||||
annotations:
|
||||
alpha.istio.io/sidecar: ignore
|
||||
image: gcr.io/istio-testing/servicegraph
|
||||
imageTag: latest
|
||||
imagePullPolicy: Always
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
Reference in New Issue
Block a user