Skip to content

S
system-charts
Commit 4bd1f8a5 by Guangbo Chen Committed by Craig Jellick
Options

Update istio config and add rancher proxy

* add istio and certmanager CRDs * add rancher system default registry config * add rancher proxy to the Grafana, Prometheus, Kiali and Tracing * remove not used demo values.yaml files and serviceGraph(deprecated)
parent ce770377
Showing with 867 additions and 1204 deletions
charts/rancher-istio/1.1.5-rancher1/.helmignore
......@@ -19,3 +19,4 @@
.project
.idea/
*.tmproj
tests/
charts/rancher-istio/1.1.5-rancher1/Chart.yaml
apiVersion: v1
name: istio
version: 1.1.0
appVersion: 1.1.0
name: rancher-istio
version: 1.1.5-rancher1
appVersion: 1.1.5
tillerVersion: ">=2.7.2-0"
description: Helm chart for all istio components
home: https://istio.io/
keywords:
- istio
- security
......@@ -15,3 +16,5 @@ sources:
- http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
maintainers:
- name: istio
charts/rancher-istio/1.1.5-rancher1/app-readme.md 0 → 100644
# Istio
[Istio](https://istio.io/) is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
## Introduction
This chart bootstraps all istio [components](https://istio.io/docs/concepts/what-is-istio/overview.html) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
## Chart Details
This chart can install multiple istio components as subcharts:
- gateways
- sidecarInjectorWebhook
- galley
- mixer
- pilot
- security(citadel)
- tracing(jaeger)
- kiali
- grafana
- prometheus
To enable or disable each component, change the corresponding `enabled` flag.
Notes: You will need to apply `kubectl label namespace $your-namesapce istio-injection=enabled` to enabled automatic sidecar injection of your desired kubernetes namespaces.
charts/rancher-istio/1.1.5-rancher1/charts/certmanager/templates/deployment.yaml
......@@ -35,7 +35,11 @@ spec:
{{- end }}
containers:
- name: certmanager
image: "{{ .Values.hub }}/cert-manager-controller:{{ .Values.tag }}"
{{- if .Values.global.systemDefaultRegistry }}
image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}"
{{- else }}
image: {{ .Values.image.hub }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}
{{- end }}
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
args:
- --cluster-resource-namespace=$(POD_NAMESPACE)
......@@ -50,7 +54,6 @@ spec:
fieldPath: metadata.namespace
resources:
{{ toYaml .Values.resources | indent 10 }}
{{- if .Values.podDnsPolicy }}
dnsPolicy: {{ .Values.podDnsPolicy }}
{{- end }}
......
charts/rancher-istio/1.1.5-rancher1/charts/certmanager/values.yaml
......@@ -4,8 +4,10 @@
# gateway must be updated by adding 'secretVolumes'. After the gateway
# restart, DestinationRules can be created using the ACME-signed certificates.
enabled: false
hub: quay.io/jetstack
tag: v0.6.2
image:
hub: quay.io
repository: jetstack/cert-manager-controller
tag: v0.6.2
resources: {}
nodeSelector: {}
......
charts/rancher-istio/1.1.5-rancher1/charts/galley/templates/deployment.yaml
......@@ -32,7 +32,7 @@ spec:
{{- end }}
containers:
- name: galley
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
ports:
- containerPort: 443
......
charts/rancher-istio/1.1.5-rancher1/charts/galley/values.yaml
......@@ -3,7 +3,6 @@
#
enabled: true
replicaCount: 1
image: galley
nodeSelector: {}
# Specify the pod anti-affinity that allows you to constrain which nodes
......
charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/_affinity.tpl
......@@ -11,6 +11,10 @@
{{- define "gatewayNodeAffinityRequiredDuringScheduling" }}
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: In
values:
- linux
- key: beta.kubernetes.io/arch
operator: In
values:
......
charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/deployment.yaml
......@@ -43,11 +43,7 @@ spec:
{{- if $.Values.global.proxy.enableCoreDump }}
initContainers:
- name: enable-core-dump
{{- if contains "/" $.Values.global.proxy_init.image }}
image: "{{ $.Values.global.proxy_init.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy_init.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" $ }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
imagePullPolicy: IfNotPresent
command:
- /bin/sh
......@@ -61,11 +57,7 @@ spec:
{{- if $spec.sds }}
{{- if $spec.sds.enabled }}
- name: ingress-sds
{{- if contains "/" $spec.sds.image }}
image: "{{ $spec.sds.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $spec.sds.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" $ }}{{ $.Values.global.nodeAgent.repository }}:{{ $.Values.global.nodeAgent.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
env:
- name: "ENABLE_WORKLOAD_SDS"
......@@ -83,11 +75,7 @@ spec:
{{- end }}
{{- end }}
- name: istio-proxy
{{- if contains "/" $.Values.global.proxy.image }}
image: "{{ $.Values.global.proxy.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" $ }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
ports:
{{- range $key, $val := $spec.ports }}
......
charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/service.yaml
......@@ -45,6 +45,16 @@ spec:
{{ $pkey}}: {{ $pval }}
{{- end }}
{{- end }}
# range addon ports
{{- range $key, $val := $spec.addOnPorts }}
-
{{- range $pkey, $pval := $val }}
{{ $pkey}}: {{ $pval }}
{{- end }}
{{- end }}
# range meshExpansion ports
{{- if $.Values.global.meshExpansion.enabled }}
{{- range $key, $val := $spec.meshExpansionPorts }}
-
......
charts/rancher-istio/1.1.5-rancher1/charts/gateways/values.yaml
......@@ -17,7 +17,6 @@ istio-ingressgateway:
enabled: false
# SDS server that watches kubernetes secrets and provisions credentials to ingress gateway.
# This server runs in the same pod as ingress gateway.
image: node-agent-k8s
labels:
app: istio-ingressgateway
istio: ingressgateway
......@@ -47,9 +46,6 @@ istio-ingressgateway:
# Note that AWS ELB will by default perform health checks on the first port
# on this list. Setting this to the health check port will ensure that health
# checks always work. https://github.com/istio/istio/issues/12503
- port: 15020
targetPort: 15020
name: status-port
- port: 80
targetPort: 80
name: http2
......@@ -57,28 +53,28 @@ istio-ingressgateway:
- port: 443
name: https
nodePort: 31390
# Example of a port to add. Remove if not needed
- port: 31400
name: tcp
nodePort: 31400
### PORTS FOR UI/metrics #####
## Disable if not needed
- port: 15029
targetPort: 15029
name: https-kiali
- port: 15030
targetPort: 15030
name: https-prometheus
- port: 15031
targetPort: 15031
name: https-grafana
- port: 15032
targetPort: 15032
name: https-tracing
# This is the port where sni routing happens
- port: 15443
targetPort: 15443
name: tls
addOnPorts:
# - port: 15029
# targetPort: 15029
# name: https-kiali
# - port: 15030
# targetPort: 15030
# name: https-prometheus
# - port: 15031
# targetPort: 15031
# name: https-grafana
# - port: 15032
# targetPort: 15032
# name: https-tracing
# # This is the port where sni routing happens
# - port: 15443
# targetPort: 15443
# name: tls
# - port: 15020
# targetPort: 15020
# name: status-port
#### MESH EXPANSION PORTS ########
# Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
# to pilot/citadel if global.meshExpansion settings are enabled.
......
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/create-custom-resources-job.yaml
......@@ -73,7 +73,7 @@ spec:
serviceAccountName: istio-grafana-post-install-account
containers:
- name: kubectl
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ]
volumeMounts:
- mountPath: "/tmp/grafana"
......
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/deployment.yaml
......@@ -21,7 +21,6 @@ spec:
sidecar.istio.io/inject: "false"
spec:
securityContext:
runAsUser: 472
fsGroup: 472
{{- if .Values.global.priorityClassName }}
priorityClassName: "{{ .Values.global.priorityClassName }}"
......@@ -34,7 +33,7 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
ports:
- containerPort: 3000
......@@ -94,6 +93,25 @@ spec:
- name: config
mountPath: "/etc/grafana/provisioning/dashboards/dashboardproviders.yaml"
subPath: dashboardproviders.yaml
- name: grafana-proxy
image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
args:
- nginx
- -g
- daemon off;
- -c
- /nginx/nginx.conf
ports:
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- mountPath: /nginx/
name: grafana-nginx
{{- if and .Values.resources .Values.resources.proxy }}
resources:
{{ toYaml .Values.resources.proxy | indent 10 }}
{{- end }}
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
......@@ -101,10 +119,17 @@ spec:
- name: config
configMap:
name: istio-grafana
- name: grafana-nginx
configMap:
name: grafana-nginx
items:
- key: nginx.conf
mode: 438
path: nginx.conf
- name: data
{{- if .Values.persist }}
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:
claimName: istio-grafana-pvc
claimName: {{ .Values.persistence.existingClaim | default ("istio-grafana-pvc") }}
{{- else }}
emptyDir: {}
{{- end }}
......
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/nginx-configmap.yaml 0 → 100644
apiVersion: v1
kind: ConfigMap
metadata:
name: grafana-nginx
labels:
app: grafana-nginx
chart: {{ template "grafana.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
data:
nginx.conf: |-
user nginx;
worker_processes auto;
error_log /dev/stdout warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
log_format main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
proxy_connect_timeout 10;
proxy_read_timeout 180;
proxy_send_timeout 5;
proxy_buffering off;
proxy_cache_path /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
server {
listen 80;
access_log off;
gzip on;
gzip_min_length 1k;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
proxy_set_header Host $host;
location /api/dashboards {
proxy_pass http://localhost:3000;
}
location /api/search {
proxy_pass http://localhost:3000;
sub_filter_types application/json;
sub_filter_once off;
sub_filter '"url":"/d' '"url":"d';
}
location / {
proxy_cache my_zone;
proxy_cache_valid 200 302 1d;
proxy_cache_valid 301 30d;
proxy_cache_valid any 5m;
proxy_cache_bypass $http_cache_control;
add_header X-Proxy-Cache $upstream_cache_status;
add_header Cache-Control "public";
proxy_pass http://localhost:3000/;
sub_filter_types text/html;
sub_filter_once off;
sub_filter '"appSubUrl":""' '"appSubUrl":"."';
sub_filter '"url":"/' '"url":"./';
sub_filter ':"/avatar/' ':"avatar/';
if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
expires 90d;
}
}
}
}
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/pvc.yaml
{{- if .Values.persist }}
{{- if .Values.persistence.enabled }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
......@@ -10,10 +10,10 @@ metadata:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
storageClassName: {{ .Values.storageClassName }}
storageClassName: {{ .Values.persistence.storageClass }}
accessModes:
- {{ .Values.accessMode }}
- {{ .Values.persistence.accessMode }}
resources:
requests:
storage: 5Gi
storage: {{ .Values.persistence.size }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/service.yaml
......@@ -12,21 +12,13 @@ metadata:
chart: {{ template "grafana.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
kubernetes.io/cluster-service: "true"
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.externalPort }}
targetPort: 3000
- name: http-access-grafana
protocol: TCP
name: {{ .Values.service.name }}
targetPort: 80
port: 80
selector:
app: grafana
{{- if .Values.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
{{- end }}
{{if .Values.service.loadBalancerSourceRanges}}
loadBalancerSourceRanges:
{{range $rangeList := .Values.service.loadBalancerSourceRanges}}
- {{ $rangeList }}
{{end}}
{{end}}
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/tests/test-grafana-connection.yaml
......@@ -19,12 +19,11 @@ spec:
{{- end }}
containers:
- name: "{{ template "grafana.fullname" . }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['curl']
args: ['http://grafana:{{ .Values.grafana.service.externalPort }}']
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/grafana/values.yaml
......@@ -3,9 +3,6 @@
#
enabled: false
replicaCount: 1
image:
repository: grafana/grafana
tag: 6.0.2
ingress:
enabled: false
## Used to create an Ingress record.
......@@ -19,9 +16,12 @@ ingress:
# - secretName: grafana-tls
# hosts:
# - grafana.local
persist: false
storageClassName: ""
accessMode: ReadWriteMany
persistence:
enabled: false
storageClass: ""
accessMode: ReadWriteOnce
existingClaim: ""
size: 5Gi
security:
enabled: false
secretName: grafana
......@@ -53,11 +53,7 @@ podAntiAffinityTermLabelSelector: {}
contextPath: /grafana
service:
annotations: {}
name: http
type: ClusterIP
externalPort: 3000
loadBalancerIP:
loadBalancerSourceRanges:
datasources:
datasources.yaml:
......@@ -84,3 +80,5 @@ dashboardProviders:
disableDeletion: false
options:
path: /var/lib/grafana/dashboards/istio
resources: {}
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/charts/istiocoredns/templates/deployment.yaml
......@@ -27,7 +27,7 @@ spec:
{{- end }}
containers:
- name: coredns
image: {{ .Values.coreDNSImage }}
image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: IfNotPresent
args: [ "-conf", "/etc/coredns/Corefile" ]
volumeMounts:
......@@ -61,7 +61,7 @@ spec:
- name: istio-coredns-plugin
command:
- /usr/local/bin/plugin
image: {{ .Values.coreDNSPluginImage }}
image: "{{ template "system_default_registry" . }}{{ .Values.pluginImage.repository }}:{{ .Values.pluginImage.tag }}"
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8053
......
charts/rancher-istio/1.1.5-rancher1/charts/istiocoredns/values.yaml
......@@ -3,11 +3,9 @@
#
enabled: false
replicaCount: 1
coreDNSImage: coredns/coredns:1.1.2
# Source code for the plugin can be found at
# https://github.com/istio-ecosystem/istio-coredns-plugin
# The plugin listens for DNS requests from coredns server at 127.0.0.1:8053
coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1
nodeSelector: {}
# Specify the pod anti-affinity that allows you to constrain which nodes
......
charts/rancher-istio/1.1.5-rancher1/charts/kiali/Chart.yaml
......@@ -2,5 +2,5 @@ apiVersion: v1
description: Kiali is an open source project for service mesh observability, refer to https://www.kiali.io for details.
name: kiali
version: 1.1.0
appVersion: 0.16
appVersion: 0.17
tillerVersion: ">=2.7.2"
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/configmap.yaml
......@@ -17,6 +17,14 @@ data:
istio:
url_service_version: http://istio-pilot:8080/version
jaeger:
service: "jaeger-query"
{{- if .Values.dashboard.jaegerURL }}
url: {{ .Values.dashboard.jaegerURL }}
{{- end }}
grafana:
custom_metrics_url: "http://prometheus.{{ .Release.Namespace }}:9090"
{{- if .Values.dashboard.grafanaURL }}
url: {{ .Values.dashboard.grafanaURL }}
{{- else }}
url: "http://prometheus.{{ .Release.Namespace }}:9090"
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/deployment.yaml
......@@ -23,16 +23,13 @@ spec:
release: {{ .Release.Name }}
annotations:
sidecar.istio.io/inject: "false"
scheduler.alpha.kubernetes.io/critical-pod: ""
prometheus.io/scrape: "true"
prometheus.io/port: "9090"
spec:
serviceAccountName: kiali-service-account
{{- if .Values.global.priorityClassName }}
priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
containers:
- image: "{{ .Values.hub }}/kiali:{{ .Values.tag }}"
- image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
name: kiali
command:
- "/opt/kiali/kiali"
......@@ -45,6 +42,20 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: AUTH_STRATEGY
value: {{ .Values.dashboard.authStrategy }}
- name: SERVER_CREDENTIALS_USERNAME
valueFrom:
secretKeyRef:
name: {{ .Values.dashboard.secretName }}
key: username
optional: true
- name: SERVER_CREDENTIALS_PASSWORD
valueFrom:
secretKeyRef:
name: {{ .Values.dashboard.secretName }}
key: passphrase
optional: true
- name: PROMETHEUS_SERVICE_URL
value: {{ .Values.prometheusAddr }}
{{- if .Values.contextPath }}
......@@ -54,22 +65,42 @@ spec:
volumeMounts:
- name: kiali-configuration
mountPath: "/kiali-configuration"
- name: kiali-secret
mountPath: "/kiali-secret"
resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
- name: kiali-proxy
image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
args:
- nginx
- -g
- daemon off;
- -c
- /nginx/nginx.conf
ports:
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- mountPath: /nginx/
name: kiali-nginx
{{- if and .Values.resources .Values.resources.proxy }}
resources:
{{ toYaml .Values.resources.proxy | indent 10 }}
{{- end }}
volumes:
- name: kiali-configuration
configMap:
name: kiali
- name: kiali-secret
secret:
secretName: {{ .Values.dashboard.secretName }}
optional: true
- name: kiali-nginx
configMap:
name: kiali-nginx
items:
- key: nginx.conf
mode: 438
path: nginx.conf
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/nginx-configmap.yaml 0 → 100644
apiVersion: v1
kind: ConfigMap
metadata:
name: kiali-nginx
namespace: {{ .Release.Namespace }}
labels:
app: kiali-nginx
chart: {{ template "kiali.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
data:
nginx.conf: |-
user nginx;
worker_processes auto;
error_log /dev/stdout warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
log_format main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
proxy_connect_timeout 10;
proxy_read_timeout 180;
proxy_send_timeout 5;
proxy_buffering off;
proxy_cache_path /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
server {
listen 80;
access_log off;
gzip on;
gzip_min_length 1k;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
proxy_set_header Host $host;
location / {
proxy_cache my_zone;
proxy_cache_valid 200 302 1d;
proxy_cache_valid 301 30d;
proxy_cache_valid any 5m;
proxy_cache_bypass $http_cache_control;
add_header X-Proxy-Cache $upstream_cache_status;
add_header Cache-Control "public";
proxy_pass http://localhost:20001/;
sub_filter_types text/html;
sub_filter_once on;
sub_filter </head> '<script>var path = window.location.pathname; var pathName = path.substring(0, path.lastIndexOf("/proxy") + 6); window.WEB_ROOT = window.WEB_ROOT ? pathName + window.WEB_ROOT:pathName</script></head>';
if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
expires 90d;
}
}
}
}
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/demosecret.yaml → charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/secret.yaml
{{- if .Values.createDemoSecret }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .Values.dashboard.secretName }}
name: kiali
namespace: {{ .Release.Namespace }}
labels:
app: {{ template "kiali.name" . }}
......@@ -11,6 +10,5 @@ metadata:
release: {{ .Release.Name }}
type: Opaque
data:
username: YWRtaW4= # admin
passphrase: YWRtaW4= # admin
{{- end }}
username: {{ .Values.dashboard.username | b64enc | quote }}
passphrase: {{ .Values.dashboard.passphrase | b64enc | quote }}
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/service.yaml
......@@ -9,9 +9,30 @@ metadata:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
type: ClusterIP
ports:
- name: http-kiali
protocol: TCP
port: 20001
selector:
app: kiali
---
apiVersion: v1
kind: Service
metadata:
name: kiali-http
namespace: {{ .Release.Namespace }}
labels:
app: {{ template "kiali.name" . }}
chart: {{ template "kiali.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
kubernetes.io/cluster-service: "true"
spec:
type: {{ .Values.service.type }}
ports:
- name: http-access-kiali
protocol: TCP
port: 80
selector:
app: kiali
charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/tests/test-kiali-connection.yaml
......@@ -19,12 +19,11 @@ spec:
{{- end }}
containers:
- name: "{{ template "kiali.fullname" . }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['curl']
args: ['http://kiali:20001']
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/kiali/values.yaml
#
# addon kiali
#
enabled: false # Note that if using the demo or demo-auth yaml when installing via Helm, this default will be `true`.
enabled: false
replicaCount: 1
hub: docker.io/kiali
tag: v0.16
contextPath: /kiali # The root context path to access the Kiali UI.
contextPath: /
nodeSelector: {}
# Specify the pod anti-affinity that allows you to constrain which nodes
......@@ -44,10 +42,20 @@ ingress:
# - kiali.local
dashboard:
secretName: kiali # You must create a secret with this name - one is not provided out-of-box.
grafanaURL: # If you have Grafana installed and it is accessible to client browsers, then set this to its external URL. Kiali will redirect users to this URL when Grafana metrics are to be shown.
jaegerURL: # If you have Jaeger installed and it is accessible to client browsers, then set this property to its external URL. Kiali will redirect users to this URL when Jaeger tracing is to be shown.
# login/anonymous
authStrategy: anonymous
secretName: kiali
username: admin
passphrase: admin
# Override the automatically detected Grafana URL, useful when Grafana service has no ExternalIPs
grafanaURL:
# Override the automatically detected Jaeger URL, useful when Jaeger service has no ExternalIPs
jaegerURL:
prometheusAddr: http://prometheus:9090
# When true, a secret will be created with a default username and password. Useful for demos.
createDemoSecret: false
service:
type: ClusterIP
resources: {}
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/charts/mixer/templates/deployment.yaml
......@@ -20,11 +20,7 @@
{{- include "podAntiAffinity" . | indent 6 }}
containers:
- name: mixer
{{- if contains "/" .Values.image }}
image: "{{ .Values.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.repository }}:{{ $.Values.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
ports:
- containerPort: {{ .Values.global.monitoringPort }}
......@@ -86,11 +82,7 @@
initialDelaySeconds: 5
periodSeconds: 5
- name: istio-proxy
{{- if contains "/" $.Values.global.proxy.image }}
image: "{{ $.Values.global.proxy.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
ports:
- containerPort: 9091
......@@ -168,11 +160,7 @@
{{- include "podAntiAffinity" . | indent 6 }}
containers:
- name: mixer
{{- if contains "/" .Values.image }}
image: "{{ .Values.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.repository }}:{{ $.Values.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
ports:
- containerPort: {{ .Values.global.monitoringPort }}
......@@ -244,11 +232,7 @@
initialDelaySeconds: 5
periodSeconds: 5
- name: istio-proxy
{{- if contains "/" $.Values.global.proxy.image }}
image: "{{ $.Values.global.proxy.image }}"
{{- else }}
image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
ports:
- containerPort: 9091
......
charts/rancher-istio/1.1.5-rancher1/charts/mixer/templates/service.yaml
......@@ -36,4 +36,3 @@ spec:
{{- end }}
{{- end }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/mixer/values.yaml
......@@ -2,7 +2,6 @@
# mixer configuration
#
enabled: true
image: mixer
env:
GODEBUG: gctrace=1
......
charts/rancher-istio/1.1.5-rancher1/charts/nodeagent/templates/daemonset.yaml
......@@ -22,11 +22,7 @@ spec:
serviceAccountName: istio-nodeagent-service-account
containers:
- name: nodeagent
{{- if contains "/" .Values.image }}
image: "{{ .Values.image }}"
{{- else }}
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.global.nodeAgent.repository }}:{{ $.Values.global.nodeAgent.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
volumeMounts:
- mountPath: /var/run/sds
......
charts/rancher-istio/1.1.5-rancher1/charts/pilot/templates/_helpers.tpl
......@@ -30,3 +30,4 @@ Create chart name and version as used by the chart label.
{{- define "pilot.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
charts/rancher-istio/1.1.5-rancher1/charts/pilot/templates/deployment.yaml
......@@ -44,11 +44,7 @@ spec:
{{- end }}
containers:
- name: discovery
{{- if contains "/" .Values.image }}
image: "{{ .Values.image }}"
{{- else }}
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
args:
- "discovery"
......@@ -126,11 +122,7 @@ spec:
readOnly: true
{{- if .Values.sidecar }}
- name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
image: "{{ .Values.global.proxy.image }}"
{{- else }}
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
ports:
- containerPort: 15003
......
charts/rancher-istio/1.1.5-rancher1/charts/pilot/values.yaml
......@@ -7,7 +7,6 @@ autoscaleMin: 1
autoscaleMax: 5
# specify replicaCount when autoscaleEnabled: false
# replicaCount: 1
image: pilot
sidecar: true
traceSampling: 1.0
# Resources for a small pilot install
......
charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/deployment.yaml
......@@ -30,7 +30,7 @@ spec:
{{- end }}
containers:
- name: prometheus
image: "{{ .Values.hub }}/prometheus:{{ .Values.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
args:
- '--storage.tsdb.retention={{ .Values.retention }}'
......@@ -57,6 +57,31 @@ spec:
mountPath: /etc/prometheus
- mountPath: /etc/istio-certs
name: istio-certs
- name: prometheus-nginx
command:
- /bin/sh
- -c
- cp /nginx/run-sh.tmpl /var/run/nginx-start.sh; chmod +x /var/run/nginx-start.sh; /var/run/nginx-start.sh
env:
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
ports:
- containerPort: 80
name: http
protocol: TCP
{{- if and .Values.resources .Values.resources.proxy }}
resources:
{{ toYaml .Values.resources.proxy | indent 6 }}
{{- end }}
securityContext:
runAsNonRoot: false
runAsUser: 0
volumeMounts:
- mountPath: /nginx
name: prometheus-nginx
volumes:
- name: config-volume
configMap:
......@@ -64,10 +89,11 @@ spec:
- name: istio-certs
secret:
defaultMode: 420
{{- if not .Values.security.enabled }}
optional: true
{{- end }}
secretName: istio.default
- name: prometheus-nginx
configMap:
name: {{ template "prometheus.chart" . }}-nginx
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/nginx-configmap.yaml 0 → 100644
apiVersion: v1
kind: ConfigMap
metadata:
name: prometheus-nginx
labels:
app: prometheus-nginx
chart: {{ template "prometheus.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
data:
run-sh.tmpl: |-
#!/bin/sh
set -e
srcpath="/nginx/nginx-conf.tmpl"
dstpath="/var/run/nginx.conf"
if ! [ -f $srcpath ]; then
exit 1
fi
token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
sed "s/REPLACE_PARAM_AUTHORIZATION/Bearer ${token}/g" $srcpath | sed "s/REPLACE_PARAM_IP/${POD_IP}/g" > $dstpath
exec nginx -g "daemon off;" -c /var/run/nginx.conf
nginx-conf.tmpl: |-
user nginx;
worker_processes auto;
error_log /dev/stdout warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
log_format main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
proxy_connect_timeout 10;
proxy_read_timeout 180;
proxy_send_timeout 5;
proxy_buffering off;
proxy_cache_path /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
server {
listen 80;
access_log off;
gzip on;
gzip_min_length 1k;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
proxy_set_header Host $host;
proxy_set_header Authorization "REPLACE_PARAM_AUTHORIZATION";
proxy_pass_header Authorization;
location / {
proxy_cache my_zone;
proxy_cache_valid 200 302 1d;
proxy_cache_valid 301 30d;
proxy_cache_valid any 5m;
proxy_cache_bypass $http_cache_control;
add_header X-Proxy-Cache $upstream_cache_status;
add_header Cache-Control "public";
proxy_pass http://REPLACE_PARAM_IP:9090/;
sub_filter_types text/html;
sub_filter_once off;
sub_filter 'var PATH_PREFIX = "";' 'var PATH_PREFIX = ".";';
if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
expires 90d;
}
}
}
}
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/service.yaml
......@@ -14,32 +14,31 @@ metadata:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
type: ClusterIP
selector:
app: prometheus
ports:
- name: http-prometheus
- name: prometheus
protocol: TCP
port: 9090
{{- if .Values.service.nodePort.enabled }}
# Using separate ingress for nodeport, to avoid conflict with pilot e2e test configs.
---
apiVersion: v1
kind: Service
metadata:
name: prometheus-nodeport
name: prometheus-http
namespace: {{ .Release.Namespace }}
annotations:
labels:
app: prometheus
chart: {{ template "prometheus.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
kubernetes.io/cluster-service: "true"
spec:
type: NodePort
ports:
- port: 9090
nodePort: {{ .Values.service.nodePort.port }}
name: http-prometheus
type: ClusterIP
selector:
app: prometheus
{{- end }}
ports:
- name: access-prometheus
protocol: TCP
port: 80
charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/tests/test-prometheus-connection.yaml
......@@ -19,11 +19,10 @@ spec:
{{- end }}
containers:
- name: "{{ template "prometheus.fullname" . }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
image: {{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['sh', '-c', 'for i in 1 2 3; do curl http://prometheus:9090/-/ready && break || sleep 15; done']
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/prometheus/values.yaml
......@@ -3,8 +3,7 @@
#
enabled: true
replicaCount: 1
hub: docker.io/prom
tag: v2.3.1
retention: 6h
nodeSelector: {}
......@@ -50,9 +49,8 @@ ingress:
service:
annotations: {}
nodePort:
enabled: false
port: 32090
security:
enabled: true
resources: {}
charts/rancher-istio/1.1.5-rancher1/charts/security/templates/cleanup-secrets.yaml
......@@ -95,7 +95,7 @@ spec:
serviceAccountName: istio-cleanup-secrets-service-account
containers:
- name: kubectl
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
imagePullPolicy: IfNotPresent
command:
- /bin/bash
......
charts/rancher-istio/1.1.5-rancher1/charts/security/templates/create-custom-resources-job.yaml
......@@ -77,7 +77,7 @@ spec:
serviceAccountName: istio-security-post-install-account
containers:
- name: kubectl
image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
imagePullPolicy: IfNotPresent
command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ]
volumeMounts:
......
charts/rancher-istio/1.1.5-rancher1/charts/security/templates/deployment.yaml
......@@ -11,7 +11,7 @@ metadata:
release: {{ .Release.Name }}
istio: citadel
spec:
replicas: 1
replicas: {{ .Values.replicaCount }}
strategy:
rollingUpdate:
maxSurge: 1
......@@ -33,7 +33,7 @@ spec:
{{- end }}
containers:
- name: citadel
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
args:
- --append-dns-names=true
......
charts/rancher-istio/1.1.5-rancher1/charts/security/templates/tests/test-citadel-connection.yaml
......@@ -19,11 +19,10 @@ spec:
{{- end }}
containers:
- name: "{{ template "security.fullname" . }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['sh', '-c', 'for i in 1 2 3; do curl http://istio-citadel:8060/-/ready && break || sleep 15; done']
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/security/values.yaml
......@@ -2,7 +2,7 @@
# security configuration
#
enabled: true
image: citadel
replicaCount: 1
selfSigned: true # indicate if self-signed CA is used.
createMeshPolicy: true
nodeSelector: {}
......
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/.helmignore deleted 100644 → 0
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*~
# Various IDEs
.project
.idea/
*.tmproj
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/Chart.yaml deleted 100644 → 0
apiVersion: v1
description: A Helm chart for Kubernetes
name: servicegraph
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/NOTES.txt deleted 100644 → 0
1. Get the application URL by running these commands:
{{- if .Values.ingress.enabled }}
{{- range .Values.ingress.hosts }}
http://{{ . }}
{{- end }}
{{- else if contains "NodePort" .Values.service.type }}
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "servicegraph.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc -w {{ template "servicegraph.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "servicegraph.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
{{- else if contains "ClusterIP" .Values.service.type }}
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "servicegraph.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl port-forward $POD_NAME 8080:8088
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/_helpers.tpl deleted 100644 → 0
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "servicegraph.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "servicegraph.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "servicegraph.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/deployment.yaml deleted 100644 → 0
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: servicegraph
namespace: {{ .Release.Namespace }}
labels:
app: servicegraph
chart: {{ template "servicegraph.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
replicas: {{ .Values.replicaCount }}
template:
metadata:
labels:
app: servicegraph
chart: {{ template "servicegraph.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
annotations:
sidecar.istio.io/inject: "false"
spec:
{{- if .Values.global.priorityClassName }}
priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
- name: {{ . }}
{{- end }}
{{- end }}
containers:
- name: servicegraph
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
ports:
- containerPort: 8088
args:
- --prometheusAddr={{- .Values.prometheusAddr }}
livenessProbe:
httpGet:
path: /graph
port: 8088
readinessProbe:
httpGet:
path: /graph
port: 8088
resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/ingress.yaml deleted 100644 → 0
{{- if .Values.ingress.enabled -}}
{{- $servicePort := .Values.service.externalPort -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: {{ template "servicegraph.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
app: servicegraph
chart: {{ template "servicegraph.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
annotations:
{{- range $key, $value := .Values.ingress.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
spec:
rules:
{{- range $host := .Values.ingress.hosts }}
- host: {{ $host }}
http:
paths:
- path: /
backend:
serviceName: servicegraph
servicePort: {{ $servicePort }}
{{- end -}}
{{- if .Values.ingress.tls }}
tls:
{{ toYaml .Values.ingress.tls | indent 4 }}
{{- end -}}
{{- end -}}
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/service.yaml deleted 100644 → 0
apiVersion: v1
kind: Service
metadata:
name: servicegraph
namespace: {{ .Release.Namespace }}
annotations:
{{- range $key, $val := .Values.service.annotations }}
{{ $key }}: {{ $val | quote }}
{{- end }}
labels:
app: servicegraph
chart: {{ template "servicegraph.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.externalPort }}
targetPort: 8088
protocol: TCP
name: {{ .Values.service.name }}
selector:
app: servicegraph
{{- if .Values.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
{{- end }}
{{if .Values.service.loadBalancerSourceRanges}}
loadBalancerSourceRanges:
{{range $rangeList := .Values.service.loadBalancerSourceRanges}}
- {{ $rangeList }}
{{end}}
{{end}}
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/tests/test-servicegraph-connection.yaml deleted 100644 → 0
{{- if .Values.global.enableHelmTest }}
apiVersion: v1
kind: Pod
metadata:
name: {{ template "servicegraph.fullname" . }}-test
namespace: {{ .Release.Namespace }}
labels:
app: servicegraph-test
chart: {{ template "servicegraph.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
istio: servicegraph
annotations:
sidecar.istio.io/inject: "false"
helm.sh/hook: test-success
spec:
{{- if .Values.global.priorityClassName }}
priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
containers:
- name: "{{ template "servicegraph.fullname" . }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['curl']
args: ['http://servicegraph:{{ .Values.servicegraph.service.externalPort }}']
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/values.yaml deleted 100644 → 0
#
# addon servicegraph configuration
#
enabled: false
replicaCount: 1
image: servicegraph
nodeSelector: {}
# Specify the pod anti-affinity that allows you to constrain which nodes
# your pod is eligible to be scheduled based on labels on pods that are
# already running on the node rather than based on labels on nodes.
# There are currently two types of anti-affinity:
# "requiredDuringSchedulingIgnoredDuringExecution"
# "preferredDuringSchedulingIgnoredDuringExecution"
# which denote “hard” vs. “soft” requirements, you can define your values
# in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
# correspondingly.
# For example:
# podAntiAffinityLabelSelector:
# - key: security
# operator: In
# values: S1,S2
# topologyKey: "kubernetes.io/hostname"
# This pod anti-affinity rule says that the pod requires not to be scheduled
# onto a node if that node is already running a pod with label having key
# “security” and value “S1”.
podAntiAffinityLabelSelector: {}
podAntiAffinityTermLabelSelector: {}
service:
annotations: {}
name: http
type: ClusterIP
externalPort: 8088
loadBalancerIP:
loadBalancerSourceRanges:
ingress:
enabled: false
# Used to create an Ingress record.
hosts:
- servicegraph.local
annotations:
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
tls:
# Secrets must be manually created in the namespace.
# - secretName: servicegraph-tls
# hosts:
# - servicegraph.local
# prometheus address
prometheusAddr: http://prometheus:9090
charts/rancher-istio/1.1.5-rancher1/charts/sidecarInjectorWebhook/templates/deployment.yaml
......@@ -32,7 +32,7 @@ spec:
{{- end }}
containers:
- name: sidecar-injector-webhook
image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
args:
- --caCertFile=/etc/istio/certs/root-cert.pem
......
charts/rancher-istio/1.1.5-rancher1/charts/sidecarInjectorWebhook/values.yaml
......@@ -3,7 +3,6 @@
#
enabled: true
replicaCount: 1
image: sidecar_injector
enableNamespacesByDefault: false
nodeSelector: {}
......
charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/deployment-jaeger.yaml
......@@ -39,7 +39,7 @@ spec:
{{- end }}
containers:
- name: jaeger
image: "{{ .Values.jaeger.hub }}/all-in-one:{{ .Values.jaeger.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.jaeger.repository }}:{{ .Values.jaeger.tag }}"
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
ports:
- containerPort: 9411
......@@ -76,6 +76,33 @@ spec:
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
- name: jaeger-proxy
image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
args:
- nginx
- -g
- daemon off;
- -c
- /nginx/nginx.conf
ports:
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- mountPath: /nginx/
name: tracing-nginx
{{- if and .Values.jaeger.proxy .Values.jaeger.proxy.resources }}
resources:
{{ toYaml .Values.jaeger.proxy.resources | indent 12 }}
{{- end }}
volumes:
- name: tracing-nginx
configMap:
name: tracing-nginx
items:
- key: nginx.conf
mode: 438
path: nginx.conf
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
......
charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/deployment-zipkin.yaml
......@@ -19,7 +19,7 @@ spec:
spec:
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.zipkin.hub }}/zipkin:{{ .Values.zipkin.tag }}"
image: "{{ template "system_default_registry" . }}{{ .Values.zipkin.repository }}:{{ .Values.zipkin.tag }}"
ports:
- containerPort: {{ .Values.zipkin.queryPort }}
livenessProbe:
......@@ -51,6 +51,33 @@ spec:
value: "mem"
- name: ZIPKIN_STORAGE_MEM_MAXSPANS
value: "{{ .Values.zipkin.maxSpans }}"
- name: zipkin-proxy
image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
args:
- nginx
- -g
- daemon off;
- -c
- /nginx/nginx.conf
ports:
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- mountPath: /nginx/
name: tracing-nginx
{{- if and .Values.zipkin.proxy .Values.zipkin.proxy.resources }}
resources:
{{ toYaml .Values.zipkin.proxy.resources | indent 12 }}
{{- end }}
volumes:
- name: tracing-nginx
configMap:
name: tracing-nginx
items:
- key: nginx.conf
mode: 438
path: nginx.conf
affinity:
{{- include "nodeaffinity" . | indent 6 }}
{{- include "podAntiAffinity" . | indent 6 }}
......
charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/nginx-configmap.yaml 0 → 100644
apiVersion: v1
kind: ConfigMap
metadata:
name: tracing-nginx
namespace: {{ .Release.Namespace }}
labels:
app: tracing-nginx
chart: {{ template "tracing.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
data:
nginx.conf: |-
user nginx;
worker_processes auto;
error_log /dev/stdout warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
log_format main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
proxy_connect_timeout 10;
proxy_read_timeout 180;
proxy_send_timeout 5;
proxy_buffering off;
proxy_cache_path /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
server {
listen 80;
access_log off;
gzip on;
gzip_min_length 1k;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
proxy_set_header Host $host;
location / {
proxy_cache my_zone;
proxy_cache_valid 200 302 1d;
proxy_cache_valid 301 30d;
proxy_cache_valid any 5m;
proxy_cache_bypass $http_cache_control;
add_header X-Proxy-Cache $upstream_cache_status;
add_header Cache-Control "public";
{{ if eq .Values.provider "jaeger" }}
proxy_pass http://localhost:16686/;
{{ else }}
proxy_pass http://localhost:9411/;
{{ end}}
if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
expires 90d;
}
}
}
}
charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/service.yaml
......@@ -42,15 +42,13 @@ items:
chart: {{ template "tracing.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
kubernetes.io/cluster-service: "true"
spec:
type: {{ .Values.service.uiType }}
ports:
- name: http-query
- name: http-access-tracing
port: 80
protocol: TCP
{{ if eq .Values.provider "jaeger" }}
targetPort: 16686
{{ else }}
targetPort: 9411
{{ end}}
targetPort: 80
selector:
app: {{ .Values.provider }}
charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/tests/test-tracing-connection.yaml
......@@ -18,7 +18,7 @@ spec:
{{- end }}
containers:
- name: "{{ .Values.provider }}-test"
image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
command: ['curl']
{{- if eq .Values.provider "jaeger" }}
......@@ -29,5 +29,4 @@ spec:
restartPolicy: Never
affinity:
{{- include "nodeaffinity" . | indent 4 }}
{{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
charts/rancher-istio/1.1.5-rancher1/charts/tracing/values.yaml
......@@ -28,14 +28,12 @@ podAntiAffinityLabelSelector: {}
podAntiAffinityTermLabelSelector: {}
jaeger:
hub: docker.io/jaegertracing
tag: 1.9
memory:
max_traces: 50000
proxy:
resources: {}
zipkin:
hub: docker.io/openzipkin
tag: 2
probeStartupDelay: 200
queryPort: 9411
resources:
......@@ -53,11 +51,14 @@ zipkin:
maxSpans: 500000
node:
cpus: 2
proxy:
resources: {}
service:
annotations: {}
name: http
type: ClusterIP
uiType: ClusterIP
externalPort: 9411
ingress:
......
charts/rancher-istio/1.1.5-rancher1/example-values/README.md deleted 100644 → 0
# Example Values
These files provide various example values for different Istio setups.
To use them, [read the docs](https://istio.io/docs/setup/kubernetes/helm-install/) and add the flag `--values example-file.yaml`.
charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-example-sds-vault.yaml deleted 100644 → 0
global:
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
sds:
enabled: true
udsPath: "unix:/var/run/sds/uds_path"
useNormalJwt: true
nodeagent:
enabled: true
image: node-agent-k8s
env:
# https://35.233.249.249:8200 is the IP address and the port number
# of a testing Vault server.
CA_ADDR: "https://35.233.249.249:8200"
CA_PROVIDER: "VaultCA"
VALID_TOKEN: true
# https://35.233.249.249:8200 is the IP address and the port number
# of a testing Vault server.
VAULT_ADDR: "https://35.233.249.249:8200"
VAULT_AUTH_PATH: "auth/kubernetes/login"
VAULT_ROLE: "istio-cert"
VAULT_SIGN_CSR_PATH: "istio_ca/sign/istio-pki-role"
VAULT_TLS_ROOT_CERT: '-----BEGIN CERTIFICATE-----\nMIIC3jCCAcagAwIBAgIRAIcSFH1jneS0XPz5r2QDbigwDQYJKoZIhvcNAQELBQAw\nEDEOMAwGA1UEChMFVmF1bHQwIBcNMTgxMjI2MDkwMDU3WhgPMjExODEyMDIwOTAw\nNTdaMBAxDjAMBgNVBAoTBVZhdWx0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA2q5lfJCLAOTEjX3xV8qMLEX8zUQpd0AjD6zzOMzx51GVM7Plf7CJmaDq\nyloRz3zcrTEltHUrln5fvouvp4TetOlqEU979vvccnFLgXrSpn+Zt/EyjE0rUYY3\n5e2qxy9bP2E7zJSKONIT6zRDd2zUQGH3zUem1ZG0GFY1ZL5qFSOIy+PvuQ4u8HCa\n1CcnHmI613fVDbFbaxuF2G2MIwCZ/Fg6KBd9kgU7uCOvkbR4AtRe0ntwweIjOIas\nFiohPQzVY4obrYZiTV43HT4lGti7ySn2c96UnRSnmHLWyBb7cafd4WZN/t+OmYSd\nooxCVQ2Zqub6NlZ5OySYOz/0BJq6DQIDAQABozEwLzAOBgNVHQ8BAf8EBAMCBaAw\nDAYDVR0TAQH/BAIwADAPBgNVHREECDAGhwQj6fn5MA0GCSqGSIb3DQEBCwUAA4IB\nAQBORvUcW0wgg/Wo1aKFaZQuPPFVLjOZat0QpCJYNDhsSIO4Y0JS+Y1cEIkvXB3S\nQ3D7IfNP0gh1fhtP/d45LQSPqpyJF5vKWAvwa/LSPKpw2+Zys4oDahcH+SEKiQco\nIhkkHNEgC4LEKEaGvY4A8Cw7uWWquUJB16AapSSnkeD2vTcxErfCO59yR7yEWDa6\n8j6QNzmGNj2YXtT86+Mmedhfh65Rrh94mhAPQHBAdCNGCUwZ6zHPQ6Z1rj+x3Wm9\ngqpveVq2olloNbnLNmM3V6F9mqSZACgADmRqf42bixeHczkTfRDKThJcpY5U44vy\nw4Nm32yDWhD6AC68rDkXX68m\n-----END CERTIFICATE-----'
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-gateways.yaml deleted 100644 → 0
# Common settings.
global:
# Omit the istio-sidecar-injector configmap when generate a
# standalone gateway. Gateways may be created in namespaces other
# than `istio-system` and we don't want to re-create the injector
# configmap in those.
omitSidecarInjectorConfigMap: true
# Istio control plane namespace: This specifies where the Istio control
# plane was installed earlier. Modify this if you installed the control
# plane in a different namespace than istio-system.
istioNamespace: istio-system
proxy:
# Sets the destination Statsd in envoy (the value of the "--statsdUdpAddress" proxy argument
# would be <host>:<port>).
# Disabled by default.
# The istio-statsd-prom-bridge is deprecated and should not be used moving forward.
envoyStatsd:
# If enabled is set to true, host and port must also be provided. Istio no longer provides a statsd collector.
enabled: false
host: # example: statsd-svc.istio-system
port: # example: 9125
#
# Gateways Configuration
# By default (if enabled) a pair of Ingress and Egress Gateways will be created for the mesh.
# You can add more gateways in addition to the defaults but make sure those are uniquely named
# and that NodePorts are not conflicting.
# Disable specifc gateway by setting the `enabled` to false.
#
gateways:
enabled: true
custom-gateway:
enabled: true
labels:
app: custom-gateway
replicaCount: 1
autoscaleMin: 1
autoscaleMax: 5
resources: {}
# limits:
# cpu: 100m
# memory: 128Mi
#requests:
# cpu: 1800m
# memory: 256Mi
cpu:
targetAverageUtilization: 80
loadBalancerIP: ""
loadBalancerSourceRanges: {}
externalIPs: []
serviceAnnotations: {}
podAnnotations: {}
type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be
#externalTrafficPolicy: Local #change to Local to preserve source IP or Cluster for default behaviour or leave commented out
ports:
## You can add custom gateway ports
- port: 80
targetPort: 80
name: http2
# nodePort: 31380
- port: 443
name: https
# nodePort: 31390
- port: 31400
name: tcp
# nodePort: 31400
# Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
# to pilot/citadel if global.meshExpansion settings are enabled.
- port: 15011
targetPort: 15011
name: tcp-pilot-grpc-tls
- port: 8060
targetPort: 8060
name: tcp-citadel-grpc-tls
# Addon ports for kiali are enabled in gateway - but will only redirect if
# the gateway configuration for the various components are enabled.
- port: 15029
targetPort: 15029
name: http2-kiali
# Telemetry-related ports are enabled in gateway - but will only redirect if
# the gateway configuration for the various components are enabled.
- port: 15030
targetPort: 15030
name: http2-prometheus
- port: 15031
targetPort: 15031
name: http2-grafana
- port: 15032
targetPort: 15032
name: http2-tracing
secretVolumes:
- name: customgateway-certs
secretName: istio-customgateway-certs
mountPath: /etc/istio/customgateway-certs
- name: customgateway-ca-certs
secretName: istio-customgateway-ca-certs
mountPath: /etc/istio/customgateway-ca-certs
# all other components are disabled except the gateways
security:
enabled: false
sidecarInjectorWebhook:
enabled: false
galley:
enabled: false
mixer:
policy:
enabled: false
telemetry:
enabled: false
pilot:
enabled: false
grafana:
enabled: false
prometheus:
enabled: false
servicegraph:
enabled: false
tracing:
enabled: false
kiali:
enabled: false
certmanager:
enabled: false
charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-googleca.yaml deleted 100644 → 0
global:
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
sds:
enabled: true
udsPath: "unix:/var/run/sds/uds_path"
useTrustworthyJwt: true
trustDomain: ""
nodeagent:
enabled: true
image: node-agent-k8s
env:
CA_PROVIDER: "GoogleCA"
CA_ADDR: "istioca.googleapis.com:443"
Plugins: "GoogleTokenExchange"
charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-multicluster-gateways.yaml deleted 100644 → 0
global:
# Provides dns resolution for global services
podDNSSearchNamespaces:
- global
- "[[ valueOrDefault .DeploymentMeta.Namespace \"default\" ]].global"
multiCluster:
enabled: true
controlPlaneSecurityEnabled: true
# Multicluster with gateways requires a root CA
# Cluster local CAs are bootstrapped with the root CA.
security:
selfSigned: false
# Provides dns resolution for service entries of form
# name.namespace.global
istiocoredns:
enabled: true
gateways:
istio-egressgateway:
enabled: true
env:
# Needed to route traffic via egress gateway if desired.
ISTIO_META_REQUESTED_NETWORK_VIEW: "external"
charts/rancher-istio/1.1.5-rancher1/requirements.yaml
......@@ -23,9 +23,6 @@ dependencies:
- name: prometheus
version: 1.1.0
condition: prometheus.enabled
- name: servicegraph
version: 1.1.0
condition: servicegraph.enabled
- name: tracing
version: 1.1.0
condition: tracing.enabled
......
charts/rancher-istio/1.1.5-rancher1/templates/_affinity.tpl
......@@ -11,6 +11,10 @@
{{- define "nodeAffinityRequiredDuringScheduling" }}
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: In
values:
- linux
- key: beta.kubernetes.io/arch
operator: In
values:
......
charts/rancher-istio/1.1.5-rancher1/templates/_helpers.tpl
......@@ -44,3 +44,12 @@ Configmap checksum.
{{- define "istio.configmap.checksum" -}}
{{- print $.Template.BasePath "/configmap.yaml" | sha256sum -}}
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.global.systemDefaultRegistry -}}
{{- printf "%s/" .Values.global.systemDefaultRegistry -}}
{{- else -}}
{{- "" -}}
{{- end -}}
{{- end -}}
charts/rancher-istio/1.1.5-rancher1/templates/crd-certmanager.yaml 0 → 100644
{{- if and .Values.enableCRDs .Values.certmanager.enabled }}
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: clusterissuers.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
"helm.sh/hook": "crd-install"
spec:
group: certmanager.k8s.io
version: v1alpha1
names:
kind: ClusterIssuer
plural: clusterissuers
scope: Cluster
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: issuers.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
"helm.sh/hook": "crd-install"
spec:
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Issuer
plural: issuers
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: certificates.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
"helm.sh/hook": "crd-install"
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.secretName
name: Secret
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
type: string
priority: 1
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
type: string
priority: 1
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
scope: Namespaced
names:
kind: Certificate
plural: certificates
shortNames:
- cert
- certs
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: orders.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
"helm.sh/hook": "crd-install"
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
type: string
priority: 1
- JSONPath: .status.reason
name: Reason
type: string
priority: 1
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Order
plural: orders
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: challenges.certmanager.k8s.io
labels:
app: certmanager
chart: certmanager
heritage: Tiller
release: istio
annotations:
"helm.sh/resource-policy": keep
"helm.sh/hook": "crd-install"
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.dnsName
name: Domain
type: string
- JSONPath: .status.reason
name: Reason
type: string
- JSONPath: .metadata.creationTimestamp
description: |-
CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
name: Age
type: date
group: certmanager.k8s.io
version: v1alpha1
names:
kind: Challenge
plural: challenges
scope: Namespaced
{{- end }}
charts/rancher-istio/1.1.5-rancher1/templates/sidecar-injector-configmap.yaml
......@@ -20,11 +20,7 @@ data:
{{ "[[ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) \"NONE\" ]]" }}
{{- if not .Values.istio_cni.enabled }}
- name: istio-init
{{- if contains "/" .Values.global.proxy_init.image }}
image: "{{ .Values.global.proxy_init.image }}"
{{- else }}
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
args:
- "-p"
- {{ "[[ .MeshConfig.ProxyListenPort ]]" }}
......@@ -71,11 +67,7 @@ data:
- sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
command:
- /bin/sh
{{- if contains "/" .Values.global.proxy_init.image }}
image: "{{ .Values.global.proxy_init.image }}"
{{- else }}
image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
{{- end }}
image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
imagePullPolicy: IfNotPresent
resources: {}
securityContext:
......@@ -86,11 +78,7 @@ data:
{{- end }}
containers:
- name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.proxy.image }}" {{ " ]]" }}
{{- else }}
image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}" {{ " ]]" }}
{{- end }}
image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}" {{ " ]]" }}
ports:
- containerPort: 15090
protocol: TCP
......@@ -131,9 +119,6 @@ data:
- --datadogAgentAddress
- {{ "[[ .ProxyConfig.GetTracing.GetDatadog.GetAddress ]]" }}
{{- end }}
{{- if $.Values.global.proxy.logLevel }}
- --proxyLogLevel={{ .Values.global.proxy.logLevel }}
{{- end}}
- --connectTimeout
- {{ "[[ formatDuration .ProxyConfig.ConnectTimeout ]]" }}
{{- if .Values.global.proxy.envoyStatsd.enabled }}
......
charts/rancher-istio/1.1.5-rancher1/test-values/README.md deleted 100644 → 0
# Test Values
These files are intended to be used to install Istio for E2E tests.
The rendered files can be generated with `make generate_e2e_yaml`.
These files will all have `values-e2e.yaml` applied to them *first*, so if there are settings there that should not be included in the test the must be overridden.
charts/rancher-istio/1.1.5-rancher1/test-values/values-e2e.yaml deleted 100644 → 0
# This file overrides values for e2e testing.
global:
proxy:
concurrency: 0
resources:
requests:
cpu: 10m
memory: 40Mi
accessLogFile: "/dev/stdout"
enableCoreDump: true
disablePolicyChecks: false
outboundTrafficPolicy:
mode: REGISTRY_ONLY
prometheus:
scrapeInterval: 5s
gateways:
istio-ingressgateway:
autoscaleMax: 1
resources:
requests:
cpu: 10m
memory: 40Mi
limits:
cpu: 100m
memory: 128Mi
istio-egressgateway:
enabled: true
autoscaleMax: 1
resources:
requests:
cpu: 10m
memory: 40Mi
limits:
cpu: 100m
memory: 128Mi
mixer:
policy:
enabled: true
replicaCount: 2
autoscaleEnabled: false
resources:
requests:
cpu: 10m
memory: 100Mi
limits:
cpu: 100m
memory: 100Mi
telemetry:
enabled: true
loadshedding:
mode: disabled
resources:
requests:
cpu: 50m
memory: 100Mi
limits:
cpu: 100m
memory: 100Mi
adapters:
stdio:
enabled: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-auth-mcp.yaml deleted 100644 → 0
# This is used to generate istio-auth.yaml with MCP enabled
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
useMCP: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-auth-multicluster.yaml deleted 100644 → 0
# This is used to generate istio-auth-multicluster.yaml, used for CI/CD.
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
proxy:
accessLogFile: "/dev/stdout"
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
# In a multiple cluster environment, citadel uses the same root certificate in all the clusters
security:
selfSigned: false
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-auth-non-mcp.yaml deleted 100644 → 0
global:
mtls:
enabled: true
controlPlaneSecurityEnabled: true
useMCP: false
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-auth-sds.yaml deleted 100644 → 0
global:
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
sds:
enabled: true
udsPath: "unix:/var/run/sds/uds_path"
useNormalJwt: true
proxy:
enableCoreDump: true
nodeagent:
enabled: true
image: node-agent-k8s
env:
CA_PROVIDER: "Citadel"
CA_ADDR: "istio-citadel:8060"
VALID_TOKEN: true
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-auth.yaml deleted 100644 → 0
# This is used to generate istio-auth.yaml for automated CI/CD test, using v1/alpha1
# or v2/alpha3 with 'gradual migration' (using env variable at inject time).
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-mcp.yaml deleted 100644 → 0
# This is used to generate istio.yaml with MCP enabled
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: false
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
useMCP: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-multicluster.yaml deleted 100644 → 0
# This is used to generate istio-multicluster.yaml, used for CI/CD.
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: false
proxy:
accessLogFile: "/dev/stdout"
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
# In a multiple cluster environment, citadel uses the same root certificate in all the clusters
security:
selfSigned: false
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-one-namespace-auth.yaml deleted 100644 → 0
# This is used to generate istio.yaml used for deprecated CI/CD testing.
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
# Restrict the applications in one namespace the controller manages
oneNamespace: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-one-namespace-trust-domain.yaml deleted 100644 → 0
# This is used to generate istio.yaml used for deprecated CI/CD testing.
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
# Default is 10s second
refreshInterval: 1s
# The trust domain corresponds to the trust root of a system
trustDomain: test.local
# Restrict the applications in one namespace the controller manages
oneNamespace: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio-one-namespace.yaml deleted 100644 → 0
# This is used to generate istio.yaml used for deprecated CI/CD testing.
global:
# controlPlaneMtls enabled. Will result in delays starting the pods while secrets are
# propagated, not recommended for tests.
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: false
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
# Restrict the applications in one namespace the controller manages
oneNamespace: true
charts/rancher-istio/1.1.5-rancher1/test-values/values-istio.yaml deleted 100644 → 0
# This is used to generate istio.yaml for automated CI/CD test, using v1/alpha1
# or v2/alpha3 with 'gradual migration' (using env variable at inject time).
# global:
## imagePullSecrets for all ServiceAccount. Must be set for any clustser configured with private docker registry.
# imagePullSecrets:
# - name: "private-registry-key"
charts/rancher-istio/1.1.5-rancher1/values-istio-demo-auth.yaml deleted 100644 → 0
# This is used to generate istio-auth.yaml for minimal, demo mode with MTLS enabled.
# It is shipped with the release, used for bookinfo or quick installation of istio.
# Includes components used in the demo, defaults to alpha3 rules.
# @include <values-istio-demo-common.yaml>
global:
controlPlaneSecurityEnabled: true
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
charts/rancher-istio/1.1.5-rancher1/values-istio-demo-common.yaml deleted 100644 → 0
# This is used to generate minimal demo mode. It is included from demo and demo-auth values.
# It is shipped with the release, used for bookinfo or quick installation of istio.
# Includes components used in the demo, defaults to alpha3 rules.
# Note: please only put common configuration for the demo profiles here.
global:
proxy:
accessLogFile: "/dev/stdout"
resources:
requests:
cpu: 10m
memory: 40Mi
disablePolicyChecks: false
sidecarInjectorWebhook:
enabled: true
# If true, webhook or istioctl injector will rewrite PodSpec for liveness
# health check to redirect request to sidecar. This makes liveness check work
# even when mTLS is enabled.
rewriteAppHTTPProbe: false
pilot:
traceSampling: 100.0
resources:
requests:
cpu: 10m
memory: 100Mi
limits:
cpu: 100m
memory: 200Mi
mixer:
policy:
enabled: true
resources:
requests:
cpu: 10m
memory: 100Mi
limits:
cpu: 100m
memory: 100Mi
telemetry:
enabled: true
resources:
requests:
cpu: 50m
memory: 100Mi
limits:
cpu: 100m
memory: 100Mi
adapters:
stdio:
enabled: true
grafana:
enabled: true
tracing:
enabled: true
kiali:
enabled: true
createDemoSecret: true
gateways:
istio-ingressgateway:
resources:
requests:
cpu: 10m
memory: 40Mi
limits:
cpu: 100m
memory: 128Mi
istio-egressgateway:
enabled: true
resources:
requests:
cpu: 10m
memory: 40Mi
limits:
cpu: 100m
memory: 128Mi
charts/rancher-istio/1.1.5-rancher1/values-istio-demo.yaml deleted 100644 → 0
# This is used to generate istio.yaml for minimal, demo mode.
# It is shipped with the release, used for bookinfo or quick installation of istio.
# Includes components used in the demo, defaults to alpha3 rules.
# @include <values-istio-demo-common.yaml>
#
global:
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: false
charts/rancher-istio/1.1.5-rancher1/values-istio-minimal.yaml deleted 100644 → 0
#
# Minimal Istio Configuration: https://istio.io/docs/setup/kubernetes/minimal-install/
#
pilot:
enabled: true
sidecar: false
gateways:
enabled: false
security:
enabled: false
sidecarInjectorWebhook:
enabled: false
galley:
enabled: false
mixer:
policy:
enabled: false
telemetry:
enabled: false
prometheus:
enabled: false
# Common settings.
global:
proxy:
# Sets the destination Statsd in envoy (the value of the "--statsdUdpAddress" proxy argument
# would be <host>:<port>).
# Disabled by default.
# The istio-statsd-prom-bridge is deprecated and should not be used moving forward.
envoyStatsd:
# If enabled is set to true, host and port must also be provided. Istio no longer provides a statsd collector.
enabled: false
host: # example: statsd-svc.istio-system
port: # example: 9125
useMCP: false
charts/rancher-istio/1.1.5-rancher1/values-istio-remote.yaml deleted 100644 → 0
gateways:
enabled: false
galley:
enabled: false
mixer:
policy:
enabled: false
telemetry:
enabled: false
pilot:
enabled: false
security:
enabled: true
createMeshPolicy: false
prometheus:
enabled: false
global:
istioRemote: true
defaultPodDisruptionBudget: {}
enableTracing: false
# Sets an identifier for the remote network to be used for Split Horizon EDS. The network will be sent
# to the Pilot when connected by the sidecar and will affect the results returned in EDS requests.
# Based on the network identifier Pilot will return all local endpoints + endpoints of gateways to
# other networks.
#
# Must match the names in the meshNetworks section in the Istio local.
network: ""
charts/rancher-istio/1.1.5-rancher1/values-istio-sds-auth.yaml deleted 100644 → 0
global:
controlPlaneSecurityEnabled: false
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
sds:
enabled: true
udsPath: "unix:/var/run/sds/uds_path"
useNormalJwt: true
nodeagent:
enabled: true
image: node-agent-k8s
env:
CA_PROVIDER: "Citadel"
CA_ADDR: "istio-citadel:8060"
VALID_TOKEN: true
\ No newline at end of file
charts/rancher-istio/1.1.5-rancher1/values.yaml
......@@ -8,6 +8,9 @@
# Check the chart level values file for exhaustive list of configuration options.
#
enableCRDs: true
#
# Gateways Configuration, refer to the charts/gateways/values.yaml
# for detailed configuration
#
......@@ -19,6 +22,8 @@ gateways:
# charts/sidecarInjectorWebhook/values.yaml for detailed configuration
#
sidecarInjectorWebhook:
repository: istio/sidecar_injector
tag: "1.1.5"
enabled: true
#
......@@ -26,6 +31,8 @@ sidecarInjectorWebhook:
# for detailed configuration
#
galley:
repository: istio/galley
tag: 1.1.5
enabled: true
#
......@@ -33,6 +40,8 @@ galley:
#
# @see charts/mixer/values.yaml, it takes precedence
mixer:
repository: istio/mixer
tag: "1.1.5"
enabled: true
policy:
# if policy is enabled the global.disablePolicyChecks has affect.
......@@ -45,12 +54,16 @@ mixer:
#
# @see charts/pilot/values.yaml
pilot:
repository: istio/pilot
tag: "1.1.5"
enabled: true
#
# security configuration
#
security:
repository: istio/citadel
tag: "1.1.5"
enabled: true
#
......@@ -63,31 +76,37 @@ nodeagent:
# addon grafana configuration
#
grafana:
repository: grafana/grafana
tag: 5.4.0
enabled: false
#
# addon prometheus configuration
#
prometheus:
repository: prom/prometheus
tag: v2.3.1
enabled: true
#
# addon servicegraph configuration
#
servicegraph:
enabled: false
#
# addon jaeger tracing configuration
#
tracing:
enabled: false
jaeger:
repository: jaegertracing/all-in-one
tag: 1.9
zipkin:
repository: openzipkin/zipkin
tag: 2
enabled: true
#
# addon kiali tracing configuration
#
kiali:
enabled: false
repository: kiali/kiali
tag: v0.17
enabled: true
#
# Istio CNI plugin enabled
......@@ -101,17 +120,29 @@ istio_cni:
# addon Istio CoreDNS configuration
#
istiocoredns:
image:
repository: coredns/coredns
tag: 1.1.2
pluginImage:
repository: istio/coredns-plugin
tag: 0.2-istio-1.1
enabled: false
certmanager:
enabled: false
# Common settings used among istio subcharts.
global:
systemDefaultRegistry: ""
# Default hub for Istio images.
# Releases are published to docker hub under 'istio' project.
# Daily builds from prow are on gcr.io, and nightly builds from circle on docker.io/istionightly
hub: gcr.io/istio-release
# hub: gcr.io/istio-release
hub: docker.io/istio
# Default tag for Istio images.
tag: release-1.1-latest-daily
# tag: release-1.1-latest-daily
tag: 1.1.5
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
# The control plane has different scopes depending on component, but can configure default log level across all components
......@@ -119,9 +150,17 @@ global:
logging:
level: "default:info"
kubectl:
repository: istio/kubectl
tag: 1.1.5
# monitoring port used by mixer, pilot, galley
monitoringPort: 15014
nginxProxy:
repository: rancher/nginx
tag: 1.15.8-alpine
k8sIngress:
enabled: false
# Gateway used for k8s Ingress resources. By default it is
......@@ -136,7 +175,8 @@ global:
enableHttps: false
proxy:
image: proxyv2
repository: istio/proxyv2
tag: 1.1.5
# cluster domain. Default value is "cluster.local".
clusterDomain: "cluster.local"
......@@ -244,7 +284,8 @@ global:
proxy_init:
# Base name for the proxy_init container, used to configure iptables.
image: proxy_init
repository: istio/proxy_init
tag: "1.1.5"
# imagePullPolicy is applied to istio control plane components.
# local tests require IfNotPresent, to avoid uploading to dockerhub.
......@@ -417,6 +458,9 @@ global:
#defaultConfigVisibilitySettings:
#- '*'
nodeAgent:
repository: istio/node-agent-k8s
tag: "1.1.5"
sds:
# SDS enabled. IF set to true, mTLS certificates for the sidecars will be
# distributed through the SecretDiscoveryService instead of using K8S secrets to mount the certificates.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment