Commit 0030defa by Guangbo Chen Committed by Craig Jellick

Base copy istio-init v1.2 to rancher-istio

parent 69124313
apiVersion: v1
name: istio-init
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2-0"
description: Helm chart to initialize Istio CRDs
keywords:
- istio
- crd
sources:
- http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
# Istio
[Istio](https://istio.io/) is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
## Introduction
This chart bootstraps Istio's [CRDs](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions)
which are an internal implementation detail of Istio. CRDs define data structures for storing runtime configuration
specified by a human operator.
This chart must be run to completion prior to running other Istio charts, or other Istio charts will fail to initialize.
## Prerequisites
- Kubernetes 1.9 or newer cluster with RBAC (Role-Based Access Control) enabled is required
- Helm 2.7.2 or newer or alternately the ability to modify RBAC rules is also required
## Resources Required
The chart deploys pods that consume minimal resources.
## Installing the Chart
1. If a service account has not already been installed for Tiller, install one:
```
$ kubectl apply -f install/kubernetes/helm/helm-service-account.yaml
```
1. If Tiller has not already been installed in your cluster, Install Tiller on your cluster with the service account:
```
$ helm init --service-account tiller
```
1. Install the Istio initializer chart:
```
$ helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
```
> Although you can install the `istio-init` chart to any namespace, it is recommended to install `istio-init` in the same namespace(`istio-system`) as other Istio charts.
## Configuration
The Helm chart ships with reasonable defaults. There may be circumstances in which defaults require overrides.
To override Helm values, use `--set key=value` argument during the `helm install` command. Multiple `--set` operations may be used in the same Helm operation.
Helm charts expose configuration options which are currently in alpha. The currently exposed options are explained in the following table:
| Parameter | Description | Values | Default |
| --- | --- | --- | --- |
| `global.hub` | Specifies the HUB for most images used by Istio | registry/namespace | `docker.io/istio` |
| `global.tag` | Specifies the TAG for most images used by Istio | valid image tag | `0.8.latest` |
| `global.imagePullPolicy` | Specifies the image pull policy | valid image pull policy | `IfNotPresent` |
## Uninstalling the Chart
> Uninstalling this chart does not delete Istio's registered CRDs. Istio by design expects
> CRDs to leak into the Kubernetes environment. As CRDs contain all runtime configuration
> data in CustomResources the Istio designers feel it is better to explicitly delete this
> configuration rather then unexpectedly lose it.
To uninstall/delete the `istio-init` release but continue to track the release:
```
$ helm delete istio-init
```
To uninstall/delete the `istio-init` release completely and make its name free for later use:
```
$ helm delete istio-init --purge
```
> Warning: Deleting CRDs will delete any configuration that you have made to Istio.
To delete all CRDs, run the following command
```
$ for i in istio-init/files/*crd*yaml; do kubectl delete -f $i; done
```
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: sidecars.networking.istio.io
labels:
app: istio-pilot
chart: istio
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
group: networking.istio.io
names:
kind: Sidecar
plural: sidecars
singular: sidecar
categories:
- istio-io
- networking-istio-io
scope: Namespaced
version: v1alpha3
---
kind: CustomResourceDefinition
apiVersion: apiextensions.k8s.io/v1beta1
metadata:
name: authorizationpolicies.rbac.istio.io
labels:
app: istio-pilot
istio: rbac
heritage: Tiller
release: istio
spec:
group: rbac.istio.io
names:
kind: AuthorizationPolicy
plural: authorizationpolicies
singular: authorizationpolicy
categories:
- istio-io
- rbac-istio-io
scope: Namespaced
version: v1alpha1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: clusterissuers.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
group: certmanager.k8s.io
version: v1alpha1
names:
kind: ClusterIssuer
plural: clusterissuers
scope: Cluster
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: issuers.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Issuer
plural: issuers
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: certificates.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.secretName
name: Secret
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
type: string
priority: 1
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
priority: 1
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
scope: Namespaced
names:
kind: Certificate
plural: certificates
shortNames:
- cert
- certs
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: orders.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
type: string
priority: 1
- JSONPath: .status.reason
name: Reason
type: string
priority: 1
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Order
plural: orders
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: challenges.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.dnsName
name: Domain
type: string
- JSONPath: .status.reason
name: Reason
type: string
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Challenge
plural: challenges
scope: Namespaced
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: istio-init-{{ .Release.Namespace }}
labels:
app: istio-init
istio: init
rules:
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["create", "get", "list", "watch", "patch"]
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: istio-init-admin-role-binding-{{ .Release.Namespace }}
labels:
app: istio-init
istio: init
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: istio-init-{{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: istio-init-service-account
namespace: {{ .Release.Namespace }}
apiVersion: v1
kind: ConfigMap
metadata:
namespace: {{ .Release.Namespace }}
name: istio-crd-10
data:
crd-10.yaml: |-
{{.Files.Get "files/crd-10.yaml" | printf "%s" | indent 4}}
apiVersion: v1
kind: ConfigMap
metadata:
namespace: {{ .Release.Namespace }}
name: istio-crd-11
data:
crd-11.yaml: |-
{{.Files.Get "files/crd-11.yaml" | printf "%s" | indent 4}}
apiVersion: v1
kind: ConfigMap
metadata:
namespace: {{ .Release.Namespace }}
name: istio-crd-12
data:
crd-12.yaml: |-
{{.Files.Get "files/crd-12.yaml" | printf "%s" | indent 4}}
{{- if .Values.certmanager.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
namespace: {{ .Release.Namespace }}
name: istio-crd-certmanager-10
data:
crd-certmanager-10.yaml: |-
{{.Files.Get "files/crd-certmanager-10.yaml" | printf "%s" | indent 4}}
{{- end }}
{{- if .Values.certmanager.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
namespace: {{ .Release.Namespace }}
name: istio-crd-certmanager-11
data:
crd-certmanager-11.yaml: |-
{{.Files.Get "files/crd-certmanager-11.yaml" | printf "%s" | indent 4}}
{{- end }}
apiVersion: batch/v1
kind: Job
metadata:
namespace: {{ .Release.Namespace }}
name: istio-init-crd-10
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
spec:
serviceAccountName: istio-init-service-account
containers:
- name: istio-init-crd-10
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- name: crd-10
mountPath: /etc/istio/crd-10
readOnly: true
command: ["kubectl", "apply", "-f", "/etc/istio/crd-10/crd-10.yaml"]
volumes:
- name: crd-10
configMap:
name: istio-crd-10
restartPolicy: OnFailure
apiVersion: batch/v1
kind: Job
metadata:
namespace: {{ .Release.Namespace }}
name: istio-init-crd-11
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
spec:
serviceAccountName: istio-init-service-account
containers:
- name: istio-init-crd-11
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- name: crd-11
mountPath: /etc/istio/crd-11
readOnly: true
command: ["kubectl", "apply", "-f", "/etc/istio/crd-11/crd-11.yaml"]
volumes:
- name: crd-11
configMap:
name: istio-crd-11
restartPolicy: OnFailure
apiVersion: batch/v1
kind: Job
metadata:
namespace: {{ .Release.Namespace }}
name: istio-init-crd-12
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
spec:
serviceAccountName: istio-init-service-account
containers:
- name: istio-init-crd-12
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- name: crd-12
mountPath: /etc/istio/crd-12
readOnly: true
command: ["kubectl", "apply", "-f", "/etc/istio/crd-12/crd-12.yaml"]
volumes:
- name: crd-12
configMap:
name: istio-crd-12
restartPolicy: OnFailure
{{- if .Values.certmanager.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
namespace: {{ .Release.Namespace }}
name: istio-init-crd-certmanager-10
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
spec:
serviceAccountName: istio-init-service-account
containers:
- name: istio-init-crd-certmanager-10
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- name: crd-certmanager-10
mountPath: /etc/istio/crd-certmanager-10
readOnly: true
command: ["kubectl", "apply", "-f", "/etc/istio/crd-certmanager-10/crd-certmanager-10.yaml"]
volumes:
- name: crd-certmanager-10
configMap:
name: istio-crd-certmanager-10
restartPolicy: OnFailure
{{- end }}
{{- if .Values.certmanager.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
namespace: {{ .Release.Namespace }}
name: istio-init-crd-certmanager-11
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
spec:
serviceAccountName: istio-init-service-account
containers:
- name: istio-init-crd-certmanager-11
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- name: crd-certmanager-11
mountPath: /etc/istio/crd-certmanager-11
readOnly: true
command: ["kubectl", "apply", "-f", "/etc/istio/crd-certmanager-11/crd-certmanager-11.yaml"]
volumes:
- name: crd-certmanager-11
configMap:
name: istio-crd-certmanager-11
restartPolicy: OnFailure
{{- end }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: istio-init-service-account
namespace: {{ .Release.Namespace }}
labels:
app: istio-init
istio: init
global:
# Default hub for Istio images.
# Releases are published to docker hub under 'istio' project.
# Daily builds from prow are on gcr.io, and nightly builds from circle on docker.io/istionightly
hub: gcr.io/istio-release
# Default tag for Istio images.
tag: release-1.2-latest-daily
# imagePullPolicy is applied to istio control plane components.
# local tests require IfNotPresent, to avoid uploading to dockerhub.
# TODO: Switch to Always as default, and override in the local tests.
imagePullPolicy: IfNotPresent
certmanager:
enabled: false
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment