istio.io/istio@v0.0.0-20240520182934-d79c90f27776/manifests/charts/gateways/istio-ingress/values.yaml (about)

     1  defaults:
     2    # A-la-carte istio ingress gateway.
     3    # Must be installed in a separate namespace, to minimize access to secrets.
     4    gateways:
     5      istio-ingressgateway:
     6        name: istio-ingressgateway
     7        labels:
     8          app: istio-ingressgateway
     9          istio: ingressgateway
    10        ports:
    11        ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
    12        # Note that AWS ELB will by default perform health checks on the first port
    13        # on this list. Setting this to the health check port will ensure that health
    14        # checks always work. https://github.com/istio/istio/issues/12503
    15        - port: 15021
    16          targetPort: 15021
    17          name: status-port
    18          protocol: TCP
    19        - port: 80
    20          targetPort: 8080
    21          name: http2
    22          protocol: TCP
    23        - port: 443
    24          targetPort: 8443
    25          name: https
    26          protocol: TCP
    27  
    28        # Scalability tuning
    29        # replicaCount: 1
    30        rollingMaxSurge: 100%
    31        rollingMaxUnavailable: 25%
    32        autoscaleEnabled: true
    33        autoscaleMin: 1
    34        autoscaleMax: 5
    35  
    36        cpu:
    37          targetAverageUtilization: 80
    38        memory: {}
    39          # targetAverageUtilization: 80
    40  
    41        resources:
    42          requests:
    43            cpu: 100m
    44            memory: 128Mi
    45          limits:
    46            cpu: 2000m
    47            memory: 1024Mi
    48  
    49        loadBalancerIP: ""
    50        loadBalancerSourceRanges: []
    51        serviceAnnotations: {}
    52  
    53        # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
    54        ipFamilyPolicy: ""
    55        ipFamilies: []
    56  
    57        # To generate an internal load balancer:
    58        # --set serviceAnnotations.cloud.google.com/load-balancer-type=internal
    59        #serviceAnnotations:
    60        #    cloud.google.com/load-balancer-type: "internal"
    61  
    62        podAnnotations: {}
    63        type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be
    64  
    65        ##############
    66        secretVolumes:
    67        - name: ingressgateway-certs
    68          secretName: istio-ingressgateway-certs
    69          mountPath: /etc/istio/ingressgateway-certs
    70        - name: ingressgateway-ca-certs
    71          secretName: istio-ingressgateway-ca-certs
    72          mountPath: /etc/istio/ingressgateway-ca-certs
    73  
    74        customService: false
    75        externalTrafficPolicy: ""
    76  
    77        ingressPorts: []
    78        additionalContainers: []
    79        configVolumes: []
    80  
    81        serviceAccount:
    82          # Annotations to add to the service account
    83          annotations: {}
    84  
    85        ### Advanced options ############
    86        env: {}
    87        nodeSelector: {}
    88        tolerations: []
    89  
    90        # Specify the pod anti-affinity that allows you to constrain which nodes
    91        # your pod is eligible to be scheduled based on labels on pods that are
    92        # already running on the node rather than based on labels on nodes.
    93        # There are currently two types of anti-affinity:
    94        #    "requiredDuringSchedulingIgnoredDuringExecution"
    95        #    "preferredDuringSchedulingIgnoredDuringExecution"
    96        # which denote "hard" vs. "soft" requirements, you can define your values
    97        # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
    98        # correspondingly.
    99        # For example:
   100        # podAntiAffinityLabelSelector:
   101        # - key: security
   102        #   operator: In
   103        #   values: S1,S2
   104        #   topologyKey: "kubernetes.io/hostname"
   105        # This pod anti-affinity rule says that the pod requires not to be scheduled
   106        # onto a node if that node is already running a pod with label having key
   107        # "security" and value "S1".
   108        podAntiAffinityLabelSelector: []
   109        podAntiAffinityTermLabelSelector: []
   110  
   111        # whether to run the gateway in a privileged container
   112        runAsRoot: false
   113  
   114        # The injection template to use for the gateway. If not set, no injection will be performed.
   115        injectionTemplate: ""
   116  
   117    # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
   118    revision: ""
   119  
   120    # For Helm compatibility.
   121    ownerName: ""
   122  
   123    global:
   124      # set the default set of namespaces to which services, service entries, virtual services, destination
   125      # rules should be exported to. Currently only one value can be provided in this list. This value
   126      # should be one of the following two options:
   127      # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
   128      # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
   129      defaultConfigVisibilitySettings: []
   130  
   131      # Default node selector to be applied to all deployments so that all pods can be
   132      # constrained to run a particular nodes. Each component can overwrite these default
   133      # values by adding its node selector block in the relevant section below and setting
   134      # the desired values.
   135      defaultNodeSelector: {}
   136  
   137      # enable pod disruption budget for the control plane, which is used to
   138      # ensure Istio control plane components are gradually upgraded or recovered.
   139      defaultPodDisruptionBudget:
   140        enabled: true
   141  
   142      # A minimal set of requested resources to applied to all deployments so that
   143      # Horizontal Pod Autoscaler will be able to function (if set).
   144      # Each component can overwrite these default values by adding its own resources
   145      # block in the relevant section below and setting the desired resources values.
   146      defaultResources:
   147        requests:
   148          cpu: 10m
   149        #   memory: 128Mi
   150        # limits:
   151        #   cpu: 100m
   152        #   memory: 128Mi
   153  
   154      # Default node tolerations to be applied to all deployments so that all pods can be
   155      # scheduled to a particular nodes with matching taints. Each component can overwrite
   156      # these default values by adding its tolerations block in the relevant section below
   157      # and setting the desired values.
   158      # Configure this field in case that all pods of Istio control plane are expected to
   159      # be scheduled to particular nodes with specified taints.
   160      defaultTolerations: []
   161  
   162      # Default hub for Istio images.
   163      # Releases are published to docker hub under 'istio' project.
   164      # Dev builds from prow are on gcr.io
   165      hub: gcr.io/istio-testing
   166  
   167      # Default tag for Istio images.
   168      tag: latest
   169  
   170      # Variant of the image to use.
   171      # Currently supported are: [debug, distroless]
   172      variant: ""
   173  
   174      # Specify image pull policy if default behavior isn't desired.
   175      # Default behavior: latest images will be Always else IfNotPresent.
   176      imagePullPolicy: ""
   177  
   178      # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
   179      # to use for pulling any images in pods that reference this ServiceAccount.
   180      # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
   181      # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
   182      # Must be set for any cluster configured with private docker registry.
   183      imagePullSecrets: []
   184      # - private-registry-key
   185  
   186      # To output all istio components logs in json format by adding --log_as_json argument to each container argument
   187      logAsJson: false
   188  
   189      # Specify pod scheduling arch(amd64, ppc64le, s390x, arm64) and weight as follows:
   190      #   0 - Never scheduled
   191      #   1 - Least preferred
   192      #   2 - No preference
   193      #   3 - Most preferred
   194      arch: {}
   195  
   196      # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
   197      # The control plane has different scopes depending on component, but can configure default log level across all components
   198      # If empty, default scope and level will be used as configured in code
   199      logging:
   200        level: "default:info"
   201  
   202      # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
   203      # system-node-critical, it is better to configure this in order to make sure your Istio pods
   204      # will not be killed because of low priority class.
   205      # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
   206      # for more detail.
   207      priorityClassName: ""
   208  
   209      proxy:
   210        image: proxyv2
   211  
   212        # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
   213        # cluster domain. Default value is "cluster.local".
   214        clusterDomain: "cluster.local"
   215  
   216        # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
   217        # not set, then the global "logLevel" will be used.
   218        componentLogLevel: "misc:error"
   219  
   220        # If set, newly injected sidecars will have core dumps enabled.
   221        enableCoreDump: false
   222  
   223        # Log level for proxy, applies to gateways and sidecars.
   224        # Expected values are: trace|debug|info|warning|error|critical|off
   225        logLevel: warning
   226  
   227      ##############################################################################################
   228      # The following values are found in other charts. To effectively modify these values, make   #
   229      # make sure they are consistent across your Istio helm charts                                #
   230      ##############################################################################################
   231  
   232      # The customized CA address to retrieve certificates for the pods in the cluster.
   233      # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
   234      caAddress: ""
   235  
   236      # Used to locate istiod.
   237      istioNamespace: istio-system
   238  
   239      # Mesh ID means Mesh Identifier. It should be unique within the scope where
   240      # meshes will interact with each other, but it is not required to be
   241      # globally/universally unique. For example, if any of the following are true,
   242      # then two meshes must have different Mesh IDs:
   243      # - Meshes will have their telemetry aggregated in one place
   244      # - Meshes will be federated together
   245      # - Policy will be written referencing one mesh from the other
   246      #
   247      # If an administrator expects that any of these conditions may become true in
   248      # the future, they should ensure their meshes have different Mesh IDs
   249      # assigned.
   250      #
   251      # Within a multicluster mesh, each cluster must be (manually or auto)
   252      # configured to have the same Mesh ID value. If an existing cluster 'joins' a
   253      # multicluster mesh, it will need to be migrated to the new mesh ID. Details
   254      # of migration TBD, and it may be a disruptive operation to change the Mesh
   255      # ID post-install.
   256      #
   257      # If the mesh admin does not specify a value, Istio will use the value of the
   258      # mesh's Trust Domain. The best practice is to select a proper Trust Domain
   259      # value.
   260      meshID: ""
   261  
   262      # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
   263      mountMtlsCerts: false
   264  
   265      multiCluster:
   266        # Set to true to connect two kubernetes clusters via their respective
   267        # ingressgateway services when pods in each cluster cannot directly
   268        # talk to one another. All clusters should be using Istio mTLS and must
   269        # have a shared root CA for this model to work.
   270        enabled: false
   271        # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
   272        # to properly label proxies
   273        clusterName: ""
   274        # The suffix for global service names
   275        globalDomainSuffix: "global"
   276        # Enable envoy filter to translate `globalDomainSuffix` to cluster local suffix for cross cluster communication
   277        includeEnvoyFilter: true
   278  
   279      # Network defines the network this cluster belong to. This name
   280      # corresponds to the networks in the map of mesh networks.
   281      network: ""
   282  
   283      # Configure the certificate provider for control plane communication.
   284      # Currently, two providers are supported: "kubernetes" and "istiod".
   285      # As some platforms may not have kubernetes signing APIs,
   286      # Istiod is the default
   287      pilotCertProvider: istiod
   288  
   289      sds:
   290        # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
   291        # When a CSR is sent from Citadel Agent to the CA (e.g. Citadel), this aud is to make sure the
   292        # JWT is intended for the CA.
   293        token:
   294          aud: istio-ca
   295  
   296      sts:
   297        # The service port used by Security Token Service (STS) server to handle token exchange requests.
   298        # Setting this port to a non-zero value enables STS server.
   299        servicePort: 0
   300      # whether to use autoscaling/v2 template for HPA settings
   301      # for internal usage only, not to be configured by users.
   302      autoscalingv2API: true
   303  
   304    meshConfig:
   305      enablePrometheusMerge: true
   306  
   307      # The trust domain corresponds to the trust root of a system
   308      # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
   309      trustDomain: "cluster.local"
   310  
   311      defaultConfig:
   312        proxyMetadata: {}
   313        tracing:
   314        #      tlsSettings:
   315        #        mode: DISABLE # DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
   316        #        clientCertificate: # example: /etc/istio/tracer/cert-chain.pem
   317        #        privateKey:        # example: /etc/istio/tracer/key.pem
   318        #        caCertificates:    # example: /etc/istio/tracer/root-cert.pem
   319        #        sni:               # example: tracer.somedomain
   320        #        subjectAltNames: []
   321        # - tracer.somedomain