1apiVersion: install.istio.io/v1alpha1 2kind: IstioOperator 3metadata: 4 namespace: istio-system 5spec: 6 hub: gcr.io/istio-testing 7 tag: latest 8 9 # You may override parts of meshconfig by uncommenting the following lines. 10 meshConfig: 11 defaultConfig: 12 proxyMetadata: {} 13 enablePrometheusMerge: false 14 # Opt-out of global http2 upgrades. 15 # Destination rule is used to opt-in. 16 # h2_upgrade_policy: DO_NOT_UPGRADE 17 18 # Traffic management feature 19 components: 20 base: 21 enabled: true 22 pilot: 23 enabled: true 24 k8s: 25 env: 26 - name: POD_NAME 27 valueFrom: 28 fieldRef: 29 apiVersion: v1 30 fieldPath: metadata.name 31 - name: POD_NAMESPACE 32 valueFrom: 33 fieldRef: 34 apiVersion: v1 35 fieldPath: metadata.namespace 36 readinessProbe: 37 httpGet: 38 path: /ready 39 port: 8080 40 initialDelaySeconds: 1 41 periodSeconds: 3 42 timeoutSeconds: 5 43 strategy: 44 rollingUpdate: 45 maxSurge: "100%" 46 maxUnavailable: "25%" 47 48 # Policy feature 49 policy: 50 enabled: false 51 k8s: 52 hpaSpec: 53 maxReplicas: 5 54 minReplicas: 1 55 scaleTargetRef: 56 apiVersion: apps/v1 57 kind: Deployment 58 name: istio-policy 59 metrics: 60 - type: Resource 61 resource: 62 name: cpu 63 targetAverageUtilization: 80 64 env: 65 - name: POD_NAMESPACE 66 valueFrom: 67 fieldRef: 68 apiVersion: v1 69 fieldPath: metadata.namespace 70 strategy: 71 rollingUpdate: 72 maxSurge: "100%" 73 maxUnavailable: "25%" 74 75 # Telemetry feature 76 telemetry: 77 enabled: false 78 k8s: 79 env: 80 - name: POD_NAMESPACE 81 valueFrom: 82 fieldRef: 83 apiVersion: v1 84 fieldPath: metadata.namespace 85 - name: GOMAXPROCS 86 value: "6" 87 hpaSpec: 88 maxReplicas: 5 89 minReplicas: 1 90 scaleTargetRef: 91 apiVersion: apps/v1 92 kind: Deployment 93 name: istio-telemetry 94 metrics: 95 - type: Resource 96 resource: 97 name: cpu 98 targetAverageUtilization: 80 99 replicaCount: 1 100 resources: 101 requests: 102 cpu: 1000m 103 memory: 1G 104 limits: 105 cpu: 4800m 106 memory: 4G 107 strategy: 108 rollingUpdate: 109 maxSurge: "100%" 110 maxUnavailable: "25%" 111 112 # Security feature 113 citadel: 114 enabled: false 115 k8s: 116 strategy: 117 rollingUpdate: 118 maxSurge: "100%" 119 maxUnavailable: "25%" 120 121 # Istio Gateway feature 122 ingressGateways: 123 - name: istio-ingressgateway 124 enabled: true 125 k8s: 126 env: 127 - name: ISTIO_META_ROUTER_MODE 128 value: "sni-dnat" 129 service: 130 ports: 131 - port: 15021 132 targetPort: 15021 133 name: status-port 134 - port: 80 135 targetPort: 8080 136 name: http2 137 - port: 443 138 targetPort: 8443 139 name: https 140 - port: 15443 141 targetPort: 15443 142 name: tls 143 hpaSpec: 144 maxReplicas: 5 145 minReplicas: 1 146 scaleTargetRef: 147 apiVersion: apps/v1 148 kind: Deployment 149 name: istio-ingressgateway 150 metrics: 151 - type: Resource 152 resource: 153 name: cpu 154 targetAverageUtilization: 80 155 resources: 156 requests: 157 cpu: 100m 158 memory: 128Mi 159 limits: 160 cpu: 2000m 161 memory: 1024Mi 162 strategy: 163 rollingUpdate: 164 maxSurge: "100%" 165 maxUnavailable: "25%" 166 167 egressGateways: 168 - name: istio-egressgateway 169 enabled: false 170 k8s: 171 env: 172 - name: ISTIO_META_ROUTER_MODE 173 value: "sni-dnat" 174 service: 175 ports: 176 - port: 80 177 name: http2 178 - port: 443 179 name: https 180 - port: 15443 181 targetPort: 15443 182 name: tls 183 hpaSpec: 184 maxReplicas: 5 185 minReplicas: 1 186 scaleTargetRef: 187 apiVersion: apps/v1 188 kind: Deployment 189 name: istio-egressgateway 190 metrics: 191 - type: Resource 192 resource: 193 name: cpu 194 targetAverageUtilization: 80 195 resources: 196 requests: 197 cpu: 100m 198 memory: 128Mi 199 limits: 200 cpu: 2000m 201 memory: 1024Mi 202 strategy: 203 rollingUpdate: 204 maxSurge: "100%" 205 maxUnavailable: "25%" 206 # Istio CNI feature 207 cni: 208 enabled: false 209 210 # istiod remote configuration wwhen istiod isn't installed on the cluster 211 istiodRemote: 212 enabled: false 213 214 addonComponents: 215 prometheus: 216 enabled: true 217 k8s: 218 replicaCount: 1 219 kiali: 220 enabled: false 221 k8s: 222 replicaCount: 1 223 grafana: 224 enabled: false 225 k8s: 226 replicaCount: 1 227 tracing: 228 enabled: false 229 istiocoredns: 230 enabled: false 231 232 # Global values passed through to helm global.yaml. 233 # Please keep this in sync with manifests/charts/global.yaml 234 values: 235 global: 236 istioNamespace: istio-system 237 istiod: 238 enabled: true 239 enableAnalysis: false 240 logging: 241 level: "default:info" 242 logAsJson: false 243 pilotCertProvider: istiod 244 jwtPolicy: third-party-jwt 245 proxy: 246 image: proxyv2 247 clusterDomain: "cluster.local" 248 resources: 249 requests: 250 cpu: 100m 251 memory: 128Mi 252 limits: 253 cpu: 2000m 254 memory: 1024Mi 255 logLevel: warning 256 componentLogLevel: "misc:error" 257 privileged: false 258 enableCoreDump: false 259 statusPort: 15020 260 readinessInitialDelaySeconds: 1 261 readinessPeriodSeconds: 2 262 readinessFailureThreshold: 30 263 includeIPRanges: "*" 264 excludeIPRanges: "" 265 excludeOutboundPorts: "" 266 excludeInboundPorts: "" 267 autoInject: enabled 268 envoyStatsd: 269 enabled: false 270 host: # example: statsd-svc.istio-system 271 port: # example: 9125 272 tracer: "zipkin" 273 proxy_init: 274 image: proxyv2 275 resources: 276 limits: 277 cpu: 100m 278 memory: 50Mi 279 requests: 280 cpu: 10m 281 memory: 10Mi 282 # Specify image pull policy if default behavior isn't desired. 283 # Default behavior: latest images will be Always else IfNotPresent. 284 imagePullPolicy: "" 285 operatorManageWebhooks: false 286 controlPlaneSecurityEnabled: true 287 tracer: 288 lightstep: 289 address: "" # example: lightstep-satellite:443 290 accessToken: "" # example: abcdefg1234567 291 zipkin: 292 address: "" 293 datadog: 294 address: "$(HOST_IP):8126" 295 stackdriver: 296 debug: false 297 maxNumberOfAttributes: 200 298 maxNumberOfAnnotations: 200 299 maxNumberOfMessageEvents: 200 300 imagePullSecrets: [] 301 arch: 302 amd64: 2 303 s390x: 2 304 ppc64le: 2 305 oneNamespace: false 306 defaultNodeSelector: {} 307 configValidation: true 308 meshExpansion: 309 enabled: false 310 useILB: false 311 multiCluster: 312 enabled: false 313 clusterName: "" 314 omitSidecarInjectorConfigMap: false 315 network: "" 316 defaultResources: 317 requests: 318 cpu: 10m 319 defaultPodDisruptionBudget: 320 enabled: true 321 priorityClassName: "" 322 useMCP: false 323 trustDomain: "cluster.local" 324 sds: 325 token: 326 aud: istio-ca 327 sts: 328 servicePort: 0 329 meshNetworks: {} 330 enableHelmTest: false 331 mountMtlsCerts: false 332 base: 333 validationURL: "" 334 pilot: 335 autoscaleEnabled: true 336 autoscaleMin: 1 337 autoscaleMax: 5 338 replicaCount: 1 339 image: pilot 340 traceSampling: 1.0 341 configNamespace: istio-config 342 appNamespaces: [] 343 env: {} 344 cpu: 345 targetAverageUtilization: 80 346 nodeSelector: {} 347 tolerations: [] 348 podAntiAffinityLabelSelector: [] 349 podAntiAffinityTermLabelSelector: [] 350 keepaliveMaxServerConnectionAge: 30m 351 enableProtocolSniffingForOutbound: true 352 enableProtocolSniffingForInbound: true 353 deploymentLabels: 354 configMap: true 355 policy: 356 enabled: false 357 358 telemetry: 359 enabled: true 360 v1: 361 enabled: false 362 v2: 363 enabled: true 364 metadataExchange: {} 365 prometheus: 366 enabled: true 367 stackdriver: 368 enabled: false 369 logging: false 370 monitoring: false 371 topology: false 372 configOverride: {} 373 mixer: 374 adapters: 375 stdio: 376 enabled: false 377 outputAsJson: false 378 prometheus: 379 enabled: true 380 metricsExpiryDuration: 10m 381 kubernetesenv: 382 enabled: true 383 stackdriver: 384 enabled: false 385 auth: 386 appCredentials: false 387 apiKey: "" 388 serviceAccountPath: "" 389 tracer: 390 enabled: false 391 sampleProbability: 1 392 useAdapterCRDs: false 393 394 telemetry: 395 image: mixer 396 replicaCount: 1 397 autoscaleEnabled: true 398 sessionAffinityEnabled: false 399 loadshedding: 400 mode: enforce 401 latencyThreshold: 100ms 402 env: 403 GOMAXPROCS: "6" 404 nodeSelector: {} 405 tolerations: [] 406 podAntiAffinityLabelSelector: [] 407 podAntiAffinityTermLabelSelector: [] 408 409 policy: 410 autoscaleEnabled: true 411 image: mixer 412 sessionAffinityEnabled: false 413 adapters: 414 kubernetesenv: 415 enabled: true 416 useAdapterCRDs: false 417 418 istiodRemote: 419 injectionURL: "" 420 421 gateways: 422 istio-egressgateway: 423 zvpn: {} 424 env: {} 425 autoscaleEnabled: true 426 type: ClusterIP 427 name: istio-egressgateway 428 secretVolumes: 429 - name: egressgateway-certs 430 secretName: istio-egressgateway-certs 431 mountPath: /etc/istio/egressgateway-certs 432 - name: egressgateway-ca-certs 433 secretName: istio-egressgateway-ca-certs 434 mountPath: /etc/istio/egressgateway-ca-certs 435 436 istio-ingressgateway: 437 autoscaleEnabled: true 438 applicationPorts: "" 439 debug: info 440 domain: "" 441 type: LoadBalancer 442 name: istio-ingressgateway 443 zvpn: {} 444 env: {} 445 meshExpansionPorts: 446 - port: 15011 447 targetPort: 15011 448 name: tcp-pilot-grpc-tls 449 - port: 15012 450 targetPort: 15012 451 name: tcp-istiod 452 - port: 8060 453 targetPort: 8060 454 name: tcp-citadel-grpc-tls 455 - port: 853 456 targetPort: 8853 457 name: tcp-dns-tls 458 secretVolumes: 459 - name: ingressgateway-certs 460 secretName: istio-ingressgateway-certs 461 mountPath: /etc/istio/ingressgateway-certs 462 - name: ingressgateway-ca-certs 463 secretName: istio-ingressgateway-ca-certs 464 mountPath: /etc/istio/ingressgateway-ca-certs 465 466 sidecarInjectorWebhook: 467 enableNamespacesByDefault: false 468 rewriteAppHTTPProbe: true 469 injectLabel: istio-injection 470 objectSelector: 471 enabled: false 472 autoInject: true 473 474 prometheus: 475 hub: docker.io/prom 476 tag: v2.15.1 477 retention: 6h 478 scrapeInterval: 15s 479 contextPath: /prometheus 480 481 security: 482 enabled: true 483 nodeSelector: {} 484 tolerations: [] 485 podAntiAffinityLabelSelector: [] 486 podAntiAffinityTermLabelSelector: [] 487 provisionPrometheusCert: true 488 489 grafana: 490 image: 491 repository: grafana/grafana 492 tag: 6.7.4 493 persist: false 494 storageClassName: "" 495 accessMode: ReadWriteMany 496 security: 497 enabled: false 498 secretName: grafana 499 usernameKey: username 500 passphraseKey: passphrase 501 contextPath: /grafana 502 service: 503 annotations: {} 504 name: http 505 type: ClusterIP 506 externalPort: 3000 507 loadBalancerIP: 508 loadBalancerSourceRanges: 509 datasources: 510 datasources.yaml: 511 apiVersion: 1 512 datasources: 513 dashboardProviders: 514 dashboardproviders.yaml: 515 apiVersion: 1 516 providers: 517 - name: 'istio' 518 orgId: 1 519 folder: 'istio' 520 type: file 521 disableDeletion: false 522 options: 523 path: /var/lib/grafana/dashboards/istio 524 nodeSelector: {} 525 tolerations: [] 526 podAntiAffinityLabelSelector: [] 527 podAntiAffinityTermLabelSelector: [] 528 env: {} 529 envSecrets: {} 530 531 tracing: 532 provider: jaeger 533 nodeSelector: {} 534 podAntiAffinityLabelSelector: [] 535 podAntiAffinityTermLabelSelector: [] 536 jaeger: 537 hub: docker.io/jaegertracing 538 tag: "1.16" 539 memory: 540 max_traces: 50000 541 spanStorageType: badger 542 persist: false 543 storageClassName: "" 544 accessMode: ReadWriteMany 545 zipkin: 546 hub: docker.io/openzipkin 547 tag: 2.20.0 548 probeStartupDelay: 10 549 queryPort: 9411 550 resources: 551 limits: 552 cpu: 1000m 553 memory: 2048Mi 554 requests: 555 cpu: 150m 556 memory: 900Mi 557 javaOptsHeap: 700 558 maxSpans: 500000 559 node: 560 cpus: 2 561 opencensus: 562 hub: docker.io/omnition 563 tag: 0.1.9 564 resources: 565 limits: 566 cpu: "1" 567 memory: 2Gi 568 requests: 569 cpu: 200m 570 memory: 400Mi 571 exporters: 572 stackdriver: 573 enable_tracing: true 574 service: 575 annotations: {} 576 name: http-query 577 type: ClusterIP 578 externalPort: 9411 579 istiocoredns: 580 coreDNSImage: coredns/coredns 581 coreDNSTag: 1.6.2 582 coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1 583 584 kiali: 585 hub: quay.io/kiali 586 tag: v1.18 587 contextPath: /kiali 588 nodeSelector: {} 589 podAntiAffinityLabelSelector: [] 590 podAntiAffinityTermLabelSelector: [] 591 dashboard: 592 secretName: kiali 593 usernameKey: username 594 passphraseKey: passphrase 595 viewOnlyMode: false 596 grafanaURL: 597 grafanaInClusterURL: http://grafana:3000 598 jaegerURL: 599 jaegerInClusterURL: http://tracing/jaeger 600 auth: 601 strategy: login 602 prometheusNamespace: 603 createDemoSecret: false 604 security: 605 enabled: false 606 cert_file: /kiali-cert/cert-chain.pem 607 private_key_file: /kiali-cert/key.pem 608 service: 609 annotations: {} 610 611 # TODO: derive from operator API 612 version: "" 613 clusterResources: true 614