apiVersion: v1
kind: ConfigMap
metadata:
  name: istio
  labels:
    app: {{ template "istio.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  mesh: |-
  {{- if .Values.global.mtls.enabed }}
    # Mutual TLS between proxies
    authPolicy: MUTUAL_TLS
    mtlsExcludedServices: ["kubernetes.default.svc.cluster.local"]
  {{- end }}
    #
    # Edit this list to avoid using mTLS to connect to these services.
    # Typically, these are control services (e.g kubernetes API server) that don't have istio sidecar
    # to transparently terminate mTLS authentication.
    # mtlsExcludedServices: ["kubernetes.default.svc.cluster.local"]

    # Set the following variable to true to disable policy checks by the Mixer.
    # Note that metrics will still be reported to the Mixer.
    disablePolicyChecks: false
    # Set enableTracing to false to disable request tracing.
    enableTracing: true
    #
    # To disable the mixer completely (including metrics), comment out
    # the following lines
    mixerCheckServer: istio-mixer.{{ .Release.Namespace }}:15004
    mixerReportServer: istio-mixer.{{ .Release.Namespace }}:15004
    # This is the ingress service name, update if you used a different name
    ingressService: istio-ingress
    #
    # Along with discoveryRefreshDelay, this setting determines how
    # frequently should Envoy fetch and update its internal configuration
    # from istio Pilot. Lower refresh delay results in higher CPU
    # utilization and potential performance loss in exchange for faster
    # convergence. Tweak this value according to your setup.
    rdsRefreshDelay: {{ .Values.global.refreshInterval }}
    #
    defaultConfig:
      # NOTE: If you change any values in this section, make sure to make
      # the same changes in start up args in istio-ingress pods.
      # See rdsRefreshDelay for explanation about this setting.
      discoveryRefreshDelay: {{ .Values.global.refreshInterval }}
      #
      # TCP connection timeout between Envoy & the application, and between Envoys.
      connectTimeout: 10s
      #
      ### ADVANCED SETTINGS #############
      # Where should envoy's configuration be stored in the istio-proxy container
      configPath: "/etc/istio/proxy"
      binaryPath: "/usr/local/bin/envoy"
      # The pseudo service name used for Envoy.
      serviceCluster: istio-proxy
      # These settings that determine how long an old Envoy
      # process should be kept alive after an occasional reload.
      drainDuration: 45s
      parentShutdownDuration: 1m0s
      #
      # Port where Envoy listens (on local host) for admin commands
      # You can exec into the istio-proxy container in a pod and
      # curl the admin port (curl http://localhost:15000/) to obtain
      # diagnostic information from Envoy. See
      # https://lyft.github.io/envoy/docs/operations/admin.html
      # for more details
      proxyAdminPort: 15000
      #
      # Zipkin trace collector
      zipkinAddress: istio-zipkin.{{ .Release.Namespace }}:9411
      #
      # Statsd metrics collector. istio mixer exposes a UDP endpoint
      # to collect and convert statsd metrics into Prometheus metrics.
      statsdUdpAddress: istio-mixer.{{ .Release.Namespace }}:9125
    {{- if .Values.global.controlPlaneSecurityEnabled }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: MUTUAL_TLS
      #
      # Address where istio Pilot service is running
      discoveryAddress: istio-pilot.{{ .Release.Namespace }}:15005
    {{- else }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: NONE
      #
      # Address where istio Pilot service is running
      # Port 15007 is captured by envoy, but is not yet tuned (max connections, etc)
      discoveryAddress: istio-pilot.{{ .Release.Namespace }}:8080
    {{- end }}
