1apiVersion: install.istio.io/v1alpha1
2kind: IstioOperator
3metadata:
4  namespace: istio-system
5spec:
6  hub: gcr.io/istio-testing
7  tag: latest
8
9  # You may override parts of meshconfig by uncommenting the following lines.
10  meshConfig:
11    defaultConfig:
12      proxyMetadata: {}
13    enablePrometheusMerge: false
14    # Opt-out of global http2 upgrades.
15    # Destination rule is used to opt-in.
16    # h2_upgrade_policy: DO_NOT_UPGRADE
17
18  # Traffic management feature
19  components:
20    base:
21      enabled: true
22    pilot:
23      enabled: true
24      k8s:
25        env:
26          - name: POD_NAME
27            valueFrom:
28              fieldRef:
29                apiVersion: v1
30                fieldPath: metadata.name
31          - name: POD_NAMESPACE
32            valueFrom:
33              fieldRef:
34                apiVersion: v1
35                fieldPath: metadata.namespace
36        readinessProbe:
37          httpGet:
38            path: /ready
39            port: 8080
40          initialDelaySeconds: 1
41          periodSeconds: 3
42          timeoutSeconds: 5
43        strategy:
44          rollingUpdate:
45            maxSurge: "100%"
46            maxUnavailable: "25%"
47
48    # Policy feature
49    policy:
50      enabled: false
51      k8s:
52        hpaSpec:
53          maxReplicas: 5
54          minReplicas: 1
55          scaleTargetRef:
56            apiVersion: apps/v1
57            kind: Deployment
58            name: istio-policy
59          metrics:
60            - type: Resource
61              resource:
62                name: cpu
63                targetAverageUtilization: 80
64        env:
65          - name: POD_NAMESPACE
66            valueFrom:
67              fieldRef:
68                apiVersion: v1
69                fieldPath: metadata.namespace
70        strategy:
71          rollingUpdate:
72            maxSurge: "100%"
73            maxUnavailable: "25%"
74
75    # Telemetry feature
76    telemetry:
77      enabled: false
78      k8s:
79        env:
80          - name: POD_NAMESPACE
81            valueFrom:
82              fieldRef:
83                apiVersion: v1
84                fieldPath: metadata.namespace
85          - name: GOMAXPROCS
86            value: "6"
87        hpaSpec:
88          maxReplicas: 5
89          minReplicas: 1
90          scaleTargetRef:
91            apiVersion: apps/v1
92            kind: Deployment
93            name: istio-telemetry
94          metrics:
95            - type: Resource
96              resource:
97                name: cpu
98                targetAverageUtilization: 80
99        replicaCount: 1
100        resources:
101          requests:
102            cpu: 1000m
103            memory: 1G
104          limits:
105            cpu: 4800m
106            memory: 4G
107        strategy:
108          rollingUpdate:
109            maxSurge: "100%"
110            maxUnavailable: "25%"
111
112    # Security feature
113    citadel:
114      enabled: false
115      k8s:
116        strategy:
117          rollingUpdate:
118            maxSurge: "100%"
119            maxUnavailable: "25%"
120
121    # Istio Gateway feature
122    ingressGateways:
123    - name: istio-ingressgateway
124      enabled: true
125      k8s:
126        env:
127          - name: ISTIO_META_ROUTER_MODE
128            value: "sni-dnat"
129        service:
130          ports:
131            - port: 15021
132              targetPort: 15021
133              name: status-port
134            - port: 80
135              targetPort: 8080
136              name: http2
137            - port: 443
138              targetPort: 8443
139              name: https
140            - port: 15443
141              targetPort: 15443
142              name: tls
143        hpaSpec:
144          maxReplicas: 5
145          minReplicas: 1
146          scaleTargetRef:
147            apiVersion: apps/v1
148            kind: Deployment
149            name: istio-ingressgateway
150          metrics:
151            - type: Resource
152              resource:
153                name: cpu
154                targetAverageUtilization: 80
155        resources:
156          requests:
157            cpu: 100m
158            memory: 128Mi
159          limits:
160            cpu: 2000m
161            memory: 1024Mi
162        strategy:
163          rollingUpdate:
164            maxSurge: "100%"
165            maxUnavailable: "25%"
166
167    egressGateways:
168    - name: istio-egressgateway
169      enabled: false
170      k8s:
171        env:
172          - name: ISTIO_META_ROUTER_MODE
173            value: "sni-dnat"
174        service:
175          ports:
176            - port: 80
177              name: http2
178            - port: 443
179              name: https
180            - port: 15443
181              targetPort: 15443
182              name: tls
183        hpaSpec:
184          maxReplicas: 5
185          minReplicas: 1
186          scaleTargetRef:
187            apiVersion: apps/v1
188            kind: Deployment
189            name: istio-egressgateway
190          metrics:
191            - type: Resource
192              resource:
193                name: cpu
194                targetAverageUtilization: 80
195        resources:
196          requests:
197            cpu: 100m
198            memory: 128Mi
199          limits:
200            cpu: 2000m
201            memory: 1024Mi
202        strategy:
203          rollingUpdate:
204            maxSurge: "100%"
205            maxUnavailable: "25%"
206    # Istio CNI feature
207    cni:
208      enabled: false
209
210    # istiod remote configuration wwhen istiod isn't installed on the cluster
211    istiodRemote:
212      enabled: false
213
214  addonComponents:
215    prometheus:
216      enabled: true
217      k8s:
218        replicaCount: 1
219    kiali:
220      enabled: false
221      k8s:
222        replicaCount: 1
223    grafana:
224      enabled: false
225      k8s:
226        replicaCount: 1
227    tracing:
228      enabled: false
229    istiocoredns:
230      enabled: false
231
232  # Global values passed through to helm global.yaml.
233  # Please keep this in sync with manifests/charts/global.yaml
234  values:
235    global:
236      istioNamespace: istio-system
237      istiod:
238        enabled: true
239        enableAnalysis: false
240      logging:
241        level: "default:info"
242      logAsJson: false
243      pilotCertProvider: istiod
244      jwtPolicy: third-party-jwt
245      proxy:
246        image: proxyv2
247        clusterDomain: "cluster.local"
248        resources:
249          requests:
250            cpu: 100m
251            memory: 128Mi
252          limits:
253            cpu: 2000m
254            memory: 1024Mi
255        logLevel: warning
256        componentLogLevel: "misc:error"
257        privileged: false
258        enableCoreDump: false
259        statusPort: 15020
260        readinessInitialDelaySeconds: 1
261        readinessPeriodSeconds: 2
262        readinessFailureThreshold: 30
263        includeIPRanges: "*"
264        excludeIPRanges: ""
265        excludeOutboundPorts: ""
266        excludeInboundPorts: ""
267        autoInject: enabled
268        envoyStatsd:
269          enabled: false
270          host: # example: statsd-svc.istio-system
271          port: # example: 9125
272        tracer: "zipkin"
273      proxy_init:
274        image: proxyv2
275        resources:
276          limits:
277            cpu: 100m
278            memory: 50Mi
279          requests:
280            cpu: 10m
281            memory: 10Mi
282      # Specify image pull policy if default behavior isn't desired.
283      # Default behavior: latest images will be Always else IfNotPresent.
284      imagePullPolicy: ""
285      operatorManageWebhooks: false
286      controlPlaneSecurityEnabled: true
287      tracer:
288        lightstep:
289          address: ""                # example: lightstep-satellite:443
290          accessToken: ""            # example: abcdefg1234567
291        zipkin:
292          address: ""
293        datadog:
294          address: "$(HOST_IP):8126"
295        stackdriver:
296          debug: false
297          maxNumberOfAttributes: 200
298          maxNumberOfAnnotations: 200
299          maxNumberOfMessageEvents: 200
300      imagePullSecrets: []
301      arch:
302        amd64: 2
303        s390x: 2
304        ppc64le: 2
305      oneNamespace: false
306      defaultNodeSelector: {}
307      configValidation: true
308      meshExpansion:
309        enabled: false
310        useILB: false
311      multiCluster:
312        enabled: false
313        clusterName: ""
314      omitSidecarInjectorConfigMap: false
315      network: ""
316      defaultResources:
317        requests:
318          cpu: 10m
319      defaultPodDisruptionBudget:
320        enabled: true
321      priorityClassName: ""
322      useMCP: false
323      trustDomain: "cluster.local"
324      sds:
325        token:
326          aud: istio-ca
327      sts:
328        servicePort: 0
329      meshNetworks: {}
330      enableHelmTest: false
331      mountMtlsCerts: false
332    base:
333      validationURL: ""
334    pilot:
335      autoscaleEnabled: true
336      autoscaleMin: 1
337      autoscaleMax: 5
338      replicaCount: 1
339      image: pilot
340      traceSampling: 1.0
341      configNamespace: istio-config
342      appNamespaces: []
343      env: {}
344      cpu:
345        targetAverageUtilization: 80
346      nodeSelector: {}
347      tolerations: []
348      podAntiAffinityLabelSelector: []
349      podAntiAffinityTermLabelSelector: []
350      keepaliveMaxServerConnectionAge: 30m
351      enableProtocolSniffingForOutbound: true
352      enableProtocolSniffingForInbound: true
353      deploymentLabels:
354      configMap: true
355      policy:
356        enabled: false
357
358    telemetry:
359      enabled: true
360      v1:
361        enabled: false
362      v2:
363        enabled: true
364        metadataExchange: {}
365        prometheus:
366          enabled: true
367        stackdriver:
368          enabled: false
369          logging: false
370          monitoring: false
371          topology: false
372          configOverride: {}
373    mixer:
374      adapters:
375        stdio:
376          enabled: false
377          outputAsJson: false
378        prometheus:
379          enabled: true
380          metricsExpiryDuration: 10m
381        kubernetesenv:
382          enabled: true
383        stackdriver:
384          enabled: false
385          auth:
386            appCredentials: false
387            apiKey: ""
388            serviceAccountPath: ""
389          tracer:
390            enabled: false
391            sampleProbability: 1
392        useAdapterCRDs: false
393
394      telemetry:
395        image: mixer
396        replicaCount: 1
397        autoscaleEnabled: true
398        sessionAffinityEnabled: false
399        loadshedding:
400          mode: enforce
401          latencyThreshold: 100ms
402        env:
403          GOMAXPROCS: "6"
404        nodeSelector: {}
405        tolerations: []
406        podAntiAffinityLabelSelector: []
407        podAntiAffinityTermLabelSelector: []
408
409      policy:
410        autoscaleEnabled: true
411        image: mixer
412        sessionAffinityEnabled: false
413        adapters:
414          kubernetesenv:
415            enabled: true
416          useAdapterCRDs: false
417
418    istiodRemote:
419      injectionURL: ""
420
421    gateways:
422      istio-egressgateway:
423        zvpn: {}
424        env: {}
425        autoscaleEnabled: true
426        type: ClusterIP
427        name: istio-egressgateway
428        secretVolumes:
429          - name: egressgateway-certs
430            secretName: istio-egressgateway-certs
431            mountPath: /etc/istio/egressgateway-certs
432          - name: egressgateway-ca-certs
433            secretName: istio-egressgateway-ca-certs
434            mountPath: /etc/istio/egressgateway-ca-certs
435
436      istio-ingressgateway:
437        autoscaleEnabled: true
438        applicationPorts: ""
439        debug: info
440        domain: ""
441        type: LoadBalancer
442        name: istio-ingressgateway
443        zvpn: {}
444        env: {}
445        meshExpansionPorts:
446          - port: 15011
447            targetPort: 15011
448            name: tcp-pilot-grpc-tls
449          - port: 15012
450            targetPort: 15012
451            name: tcp-istiod
452          - port: 8060
453            targetPort: 8060
454            name: tcp-citadel-grpc-tls
455          - port: 853
456            targetPort: 8853
457            name: tcp-dns-tls
458        secretVolumes:
459          - name: ingressgateway-certs
460            secretName: istio-ingressgateway-certs
461            mountPath: /etc/istio/ingressgateway-certs
462          - name: ingressgateway-ca-certs
463            secretName: istio-ingressgateway-ca-certs
464            mountPath: /etc/istio/ingressgateway-ca-certs
465
466    sidecarInjectorWebhook:
467      enableNamespacesByDefault: false
468      rewriteAppHTTPProbe: true
469      injectLabel: istio-injection
470      objectSelector:
471        enabled: false
472        autoInject: true
473
474    prometheus:
475      hub: docker.io/prom
476      tag: v2.15.1
477      retention: 6h
478      scrapeInterval: 15s
479      contextPath: /prometheus
480
481      security:
482        enabled: true
483      nodeSelector: {}
484      tolerations: []
485      podAntiAffinityLabelSelector: []
486      podAntiAffinityTermLabelSelector: []
487      provisionPrometheusCert: true
488
489    grafana:
490      image:
491        repository: grafana/grafana
492        tag: 6.7.4
493      persist: false
494      storageClassName: ""
495      accessMode: ReadWriteMany
496      security:
497        enabled: false
498        secretName: grafana
499        usernameKey: username
500        passphraseKey: passphrase
501      contextPath: /grafana
502      service:
503        annotations: {}
504        name: http
505        type: ClusterIP
506        externalPort: 3000
507        loadBalancerIP:
508        loadBalancerSourceRanges:
509      datasources:
510        datasources.yaml:
511          apiVersion: 1
512          datasources:
513      dashboardProviders:
514        dashboardproviders.yaml:
515          apiVersion: 1
516          providers:
517            - name: 'istio'
518              orgId: 1
519              folder: 'istio'
520              type: file
521              disableDeletion: false
522              options:
523                path: /var/lib/grafana/dashboards/istio
524      nodeSelector: {}
525      tolerations: []
526      podAntiAffinityLabelSelector: []
527      podAntiAffinityTermLabelSelector: []
528      env: {}
529      envSecrets: {}
530
531    tracing:
532      provider: jaeger
533      nodeSelector: {}
534      podAntiAffinityLabelSelector: []
535      podAntiAffinityTermLabelSelector: []
536      jaeger:
537        hub: docker.io/jaegertracing
538        tag: "1.16"
539        memory:
540          max_traces: 50000
541        spanStorageType: badger
542        persist: false
543        storageClassName: ""
544        accessMode: ReadWriteMany
545      zipkin:
546        hub: docker.io/openzipkin
547        tag: 2.20.0
548        probeStartupDelay: 10
549        queryPort: 9411
550        resources:
551          limits:
552            cpu: 1000m
553            memory: 2048Mi
554          requests:
555            cpu: 150m
556            memory: 900Mi
557        javaOptsHeap: 700
558        maxSpans: 500000
559        node:
560          cpus: 2
561      opencensus:
562        hub: docker.io/omnition
563        tag: 0.1.9
564        resources:
565          limits:
566            cpu: "1"
567            memory: 2Gi
568          requests:
569            cpu: 200m
570            memory: 400Mi
571        exporters:
572          stackdriver:
573            enable_tracing: true
574      service:
575        annotations: {}
576        name: http-query
577        type: ClusterIP
578        externalPort: 9411
579    istiocoredns:
580      coreDNSImage: coredns/coredns
581      coreDNSTag: 1.6.2
582      coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1
583
584    kiali:
585      hub: quay.io/kiali
586      tag: v1.18
587      contextPath: /kiali
588      nodeSelector: {}
589      podAntiAffinityLabelSelector: []
590      podAntiAffinityTermLabelSelector: []
591      dashboard:
592        secretName: kiali
593        usernameKey: username
594        passphraseKey: passphrase
595        viewOnlyMode: false
596        grafanaURL:
597        grafanaInClusterURL: http://grafana:3000
598        jaegerURL:
599        jaegerInClusterURL: http://tracing/jaeger
600        auth:
601          strategy: login
602      prometheusNamespace:
603      createDemoSecret: false
604      security:
605        enabled: false
606        cert_file: /kiali-cert/cert-chain.pem
607        private_key_file: /kiali-cert/key.pem
608      service:
609        annotations: {}
610
611    # TODO: derive from operator API
612    version: ""
613    clusterResources: true
614