diff --git a/k8s/infrastructure/bases/istio/ingress-gateway.yaml b/k8s/infrastructure/bases/istio/ingress-gateway.yaml index 7ba2939c62..7bb03576d6 100644 --- a/k8s/infrastructure/bases/istio/ingress-gateway.yaml +++ b/k8s/infrastructure/bases/istio/ingress-gateway.yaml @@ -26,8 +26,6 @@ spec: tls: mode: SIMPLE credentialName: ingress-cert - minProtocolVersion: TLSV1_2 # ITPIN 6.1.3 implements TLS 1.2, or subsequent versions - maxProtocolVersion: TLSV1_2 cipherSuites: # ITPIN 6.1.3 uses supported cryptographic algorithms - ECDHE-ECDSA-AES256-GCM-SHA384 - ECDHE-RSA-AES256-GCM-SHA384 diff --git a/k8s/infrastructure/bases/istio/istio-operator.yaml b/k8s/infrastructure/bases/istio/istio-operator.yaml index 0fe81e52d1..af4a4172cb 100644 --- a/k8s/infrastructure/bases/istio/istio-operator.yaml +++ b/k8s/infrastructure/bases/istio/istio-operator.yaml @@ -12,7 +12,7 @@ metadata: spec: # https://istio.io/latest/news/releases/1.9.x/announcing-1.9/#mirroring-of-images-on-gcr-io hub: gcr.io/istio-release - tag: 1.27.3-distroless + tag: 1.30.0-distroless meshConfig: accessLogFile: /dev/stdout enableTracing: true @@ -54,10 +54,15 @@ spec: env: - name: ENABLE_NATIVE_SIDECARS value: "true" + - name: COMPLIANCE_POLICY + value: pqc ingressGateways: - name: istio-ingressgateway enabled: true k8s: + env: + - name: COMPLIANCE_POLICY + value: pqc podDisruptionBudget: minAvailable: 1 selector: diff --git a/k8s/infrastructure/bases/istio/platform/crds.yaml b/k8s/infrastructure/bases/istio/platform/crds.yaml index 30247770b4..8c71f1f0cc 100644 --- a/k8s/infrastructure/bases/istio/platform/crds.yaml +++ b/k8s/infrastructure/bases/istio/platform/crds.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: authorizationpolicies.security.istio.io spec: group: security.istio.io @@ -123,6 +123,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -145,6 +150,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with namespaces @@ -391,7 +401,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: false + storage: true subresources: status: {} - additionalPrinterColumns: @@ -493,6 +503,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -515,6 +530,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with namespaces @@ -761,7 +781,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: true + storage: false subresources: status: {} @@ -775,8 +795,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: destinationrules.networking.istio.io spec: group: networking.istio.io @@ -1001,6 +1021,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -1116,7 +1151,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -1364,6 +1399,23 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -1482,7 +1534,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -1904,6 +1956,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -2016,7 +2083,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -2260,6 +2327,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -2375,7 +2457,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -2940,6 +3022,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -3055,7 +3152,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -3303,6 +3400,23 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -3421,7 +3535,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -3843,6 +3957,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -3955,7 +4084,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -4199,6 +4328,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -4314,7 +4458,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -4879,6 +5023,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -4994,7 +5153,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -5242,6 +5401,23 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -5360,7 +5536,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -5782,6 +5958,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -5894,7 +6085,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -6138,6 +6329,21 @@ spec: httpCookie: description: Hash based on HTTP cookie. properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array name: description: Name of the cookie. type: string @@ -6253,7 +6459,7 @@ spec: description: This parameter controls the speed of traffic increase over the warmup duration. format: double - minimum: 1 + minimum: 0 nullable: true type: number duration: @@ -6620,8 +6826,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: envoyfilters.networking.istio.io spec: group: networking.istio.io @@ -6677,12 +6883,16 @@ spec: - routeConfiguration - required: - cluster + - required: + - waypoint - required: - listener - required: - routeConfiguration - required: - cluster + - required: + - waypoint properties: cluster: description: Match on envoy cluster attributes. @@ -6708,12 +6918,13 @@ spec: description: |- The specific config generation context to match on. - Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY + Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT enum: - ANY - SIDECAR_INBOUND - SIDECAR_OUTBOUND - GATEWAY + - WAYPOINT type: string listener: description: Match on envoy listener attributes. @@ -6843,7 +7054,46 @@ spec: type: object type: object type: object + waypoint: + properties: + filter: + description: The name of a specific filter to apply + the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this filter + to match on. + properties: + name: + description: The filter name to match on. + type: string + type: object + type: object + portNumber: + description: The service port to match on. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + route: + description: Match a specific route. + properties: + name: + description: The Route objects generated by default + are named as default. + type: string + type: object + type: object type: object + x-kubernetes-validations: + - message: only support waypointMatch when context is WAYPOINT + rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? + has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' patch: description: The patch to apply along with the operation. properties: @@ -7029,8 +7279,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: gateways.networking.istio.io spec: group: networking.istio.io @@ -7107,6 +7357,10 @@ spec: description: Set of TLS related options that govern the server's behavior. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -7378,6 +7632,10 @@ spec: description: Set of TLS related options that govern the server's behavior. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -7649,6 +7907,10 @@ spec: description: Set of TLS related options that govern the server's behavior. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -7870,8 +8132,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: peerauthentications.security.istio.io spec: group: security.istio.io @@ -8047,7 +8309,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: false + storage: true subresources: status: {} - additionalPrinterColumns: @@ -8210,7 +8472,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: true + storage: false subresources: status: {} @@ -8224,8 +8486,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: proxyconfigs.networking.istio.io spec: group: networking.istio.io @@ -8378,8 +8640,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: requestauthentications.security.istio.io spec: group: security.istio.io @@ -8496,6 +8758,14 @@ spec: description: This field specifies the header name to output a successfully verified JWT payload to the backend. type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: + minLength: 1 + type: string + maxItems: 64 + type: array timeout: description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, @@ -8673,7 +8943,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: false + storage: true subresources: status: {} - name: v1beta1 @@ -8777,6 +9047,14 @@ spec: description: This field specifies the header name to output a successfully verified JWT payload to the backend. type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: + minLength: 1 + type: string + maxItems: 64 + type: array timeout: description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, @@ -8954,7 +9232,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object served: true - storage: true + storage: false subresources: status: {} @@ -8968,8 +9246,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: serviceentries.networking.istio.io spec: group: networking.istio.io @@ -9155,12 +9433,13 @@ spec: description: |- Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS enum: - NONE - STATIC - DNS - DNS_ROUND_ROBIN + - DYNAMIC_DNS type: string subjectAltNames: description: If specified, the proxy will verify that the server certificate's @@ -9453,12 +9732,13 @@ spec: description: |- Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS enum: - NONE - STATIC - DNS - DNS_ROUND_ROBIN + - DYNAMIC_DNS type: string subjectAltNames: description: If specified, the proxy will verify that the server certificate's @@ -9751,12 +10031,13 @@ spec: description: |- Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS enum: - NONE - STATIC - DNS - DNS_ROUND_ROBIN + - DYNAMIC_DNS type: string subjectAltNames: description: If specified, the proxy will verify that the server certificate's @@ -9890,8 +10171,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: sidecars.networking.istio.io spec: group: networking.istio.io @@ -10220,6 +10501,10 @@ spec: termination on the sidecar for requests originating from outside the mesh. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -10794,6 +11079,10 @@ spec: termination on the sidecar for requests originating from outside the mesh. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -11368,6 +11657,10 @@ spec: termination on the sidecar for requests originating from outside the mesh. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string @@ -11638,8 +11931,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: telemetries.telemetry.istio.io spec: group: telemetry.istio.io @@ -11919,12 +12212,16 @@ spec: - environment - required: - header + - required: + - formatter - required: - literal - required: - environment - required: - header + - required: + - formatter properties: environment: description: Environment adds the value of an environment @@ -11941,6 +12238,18 @@ spec: required: - name type: object + formatter: + description: Formatter adds the value of access logging + substitution formatter. + properties: + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object header: description: RequestHeader adds the value of an header from the request to each span. @@ -11970,6 +12279,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., `traceparent`/`tracestate` + for W3C, `X-B3-*` for Zipkin) are propagated in forwarded + requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -12367,12 +12682,16 @@ spec: - environment - required: - header + - required: + - formatter - required: - literal - required: - environment - required: - header + - required: + - formatter properties: environment: description: Environment adds the value of an environment @@ -12389,6 +12708,18 @@ spec: required: - name type: object + formatter: + description: Formatter adds the value of access logging + substitution formatter. + properties: + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object header: description: RequestHeader adds the value of an header from the request to each span. @@ -12418,6 +12749,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., `traceparent`/`tracestate` + for W3C, `X-B3-*` for Zipkin) are propagated in forwarded + requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -12562,32 +12899,22 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 - name: virtualservices.networking.istio.io + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 + name: trafficextensions.extensions.istio.io spec: - group: networking.istio.io + group: extensions.istio.io names: categories: - istio-io - - networking-istio-io - kind: VirtualService - listKind: VirtualServiceList - plural: virtualservices - shortNames: - - vs - singular: virtualservice + - extensions-istio-io + kind: TrafficExtension + listKind: TrafficExtensionList + plural: trafficextensions + singular: trafficextension scope: Namespaced versions: - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented @@ -12596,251 +12923,624 @@ spec: jsonPath: .metadata.creationTimestamp name: Age type: date - name: v1 + name: v1alpha1 schema: openAPIV3Schema: properties: spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + description: 'Extend the functionality provided by the Istio proxy through + WebAssembly or Lua filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/traffic_extension.html' + oneOf: + - not: + anyOf: + - required: + - wasm + - required: + - lua + - required: + - wasm + - required: + - lua properties: - exportTo: - description: A list of namespaces to which this virtual service is - exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. + lua: + description: Lua filter configuration. + properties: + inlineCode: + description: The inline Lua code to be executed. + maxLength: 65536 + minLength: 1 + type: string + required: + - inlineCode + type: object + match: + description: Specifies the criteria to determine which traffic is + passed to TrafficExtension. items: properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: - type: string - type: array - allowOrigin: - items: - type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are - allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + mode: + description: |- + Criteria for selecting traffic by their direction. - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their destination + port. + items: + properties: + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number + type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `TrafficExtension` is to be injected. + + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + priority: + description: Determines ordering of `TrafficExtensions` in the same + `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + wasm: + description: WebAssembly filter configuration. + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. + + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + pluginConfig: + description: The configuration that will be passed on to the plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy configuration + (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + sha256: + description: SHA256 checksum that will be used to verify Wasm + module or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "file", "oci"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "file", "oci"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. + properties: + env: + description: Specifies environment variables to be injected + to this VM. + items: properties: - bytes: - description: response body as base64 encoded bytes. - format: binary - type: string - string: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 type: string - type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. - properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - properties: - grpcStatus: - description: GRPC status code to use to abort the request. + value: + description: Value for the environment variable. + maxLength: 2048 type: string - http2Error: + valueFrom: + description: |- + Source for the environment variable's value. + + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST type: string - httpStatus: - description: HTTP status code to use to abort the Http - request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with - the error code provided. - properties: - value: - format: double - type: number - type: object - type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded upstream - service, etc. - oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object + required: + - name type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != + "HOST" || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - url + type: object + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) + <= 1' + - message: exactly one of wasm or lua must be set + rule: has(self.wasm) != has(self.lua) + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - headers: + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 + name: virtualservices.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: VirtualService + listKind: VirtualServiceList + plural: virtualservices + shortNames: + - vs + singular: virtualservice + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). properties: - request: - properties: - add: - additionalProperties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - type: object - remove: + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string + type: object + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with + the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay + will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: items: type: string type: array @@ -13785,7 +14485,7 @@ spec: properties: bytes: description: response body as base64 encoded bytes. - format: binary + format: byte type: string string: type: string @@ -14837,7 +15537,7 @@ spec: properties: bytes: description: response body as base64 encoded bytes. - format: binary + format: byte type: string string: type: string @@ -15746,8 +16446,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: wasmplugins.extensions.istio.io spec: group: extensions.istio.io @@ -16109,8 +16809,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: workloadentries.networking.istio.io spec: group: networking.istio.io @@ -16611,12 +17311,14 @@ spec: apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: + annotations: + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 name: workloadgroups.networking.istio.io spec: group: networking.istio.io @@ -17567,8 +18269,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -17587,8 +18289,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: base-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: base-1.0.0 release: istio name: istio-reader-service-account namespace: istio-system @@ -17603,8 +18305,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod namespace: istio-system @@ -17619,8 +18321,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istio-reader-clusterrole-istio-system rules: @@ -17648,6 +18350,7 @@ rules: - replicationcontrollers - namespaces - secrets + - configmaps verbs: - get - list @@ -17734,8 +18437,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod-clusterrole-istio-system rules: @@ -17899,7 +18602,6 @@ rules: - gateway.networking.x-k8s.io resources: - xbackendtrafficpolicies/status - - xlistenersets/status verbs: - update - patch @@ -17915,6 +18617,7 @@ rules: - tcproutes/status - tlsroutes/status - udproutes/status + - listenersets/status verbs: - update - patch @@ -17928,7 +18631,7 @@ rules: - patch - delete - apiGroups: - - inference.networking.x-k8s.io + - inference.networking.k8s.io resources: - inferencepools verbs: @@ -17936,7 +18639,7 @@ rules: - watch - list - apiGroups: - - inference.networking.x-k8s.io + - inference.networking.k8s.io resources: - inferencepools/status verbs: @@ -17979,8 +18682,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod-gateway-controller-istio-system rules: @@ -18055,8 +18758,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istio-reader-clusterrole-istio-system roleRef: @@ -18078,8 +18781,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod-clusterrole-istio-system roleRef: @@ -18101,8 +18804,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod-gateway-controller-istio-system roleRef: @@ -18124,8 +18827,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 istio: istiod istio.io/rev: default release: istio @@ -18186,8 +18889,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -18215,24 +18918,24 @@ data: {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }} requests: {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}} - cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}" + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` | quote }} {{ end }} {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} - memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}" + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` | quote }} {{ end }} {{- end }} {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} limits: {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}} - cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}" + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` | quote }} {{ end }} {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}} - memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}" + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` | quote }} {{ end }} {{- end }} {{- else }} {{- if .Values.global.proxy.resources }} - {{ toYaml .Values.global.proxy.resources | indent 6 }} + {{ toYaml (omitNil .Values.global.proxy.resources) | indent 6 }} {{- end }} {{- end }} {{- end }} @@ -18387,6 +19090,10 @@ data: runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }} runAsNonRoot: true {{- end }} + {{- if .Values.global.proxy.seccompProfile }} + seccompProfile: + {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }} + {{- end }} {{ end -}} {{ end -}} {{ if not $nativeSidecar }} @@ -18479,6 +19186,7 @@ data: valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" - name: PROXY_CONFIG value: | {{ protoToJSON .ProxyConfig }} @@ -18501,10 +19209,12 @@ data: valueFrom: resourceFieldRef: resource: limits.memory + divisor: "1" - name: GOMAXPROCS valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" {{- if .CompliancePolicy }} - name: COMPLIANCE_POLICY value: "{{ .CompliancePolicy }}" @@ -18550,6 +19260,11 @@ data: value: "{{ $value }}" {{- end }} {{- end }} + {{- $otelResAttrs := otelResourceAttributes .MeshConfig .ObjectMeta.Annotations .ObjectMeta.Labels .DeploymentMeta.Namespace .Spec.Containers }} + {{- if $otelResAttrs }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: "{{ $otelResAttrs }}" + {{- end }} {{- range $key, $value := .ProxyConfig.ProxyMetadata }} - name: {{ $key }} value: "{{ $value }}" @@ -18614,6 +19329,10 @@ data: runAsGroup: {{ .ProxyGID | default "1337" }} {{- end }} {{- end }} + {{- if .Values.global.proxy.seccompProfile }} + seccompProfile: + {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }} + {{- end }} resources: {{ template "resources" . }} volumeMounts: @@ -18720,7 +19439,7 @@ data: {{- end }} - name: istio-ca-crl configMap: - name: istio-ca-crl + name: {{ .Values.pilot.crlConfigMapName | default "istio-ca-crl" }} optional: true {{- if .Values.global.mountMtlsCerts }} # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. @@ -18842,6 +19561,7 @@ data: valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" - name: PROXY_CONFIG value: | {{ protoToJSON .ProxyConfig }} @@ -18862,10 +19582,12 @@ data: valueFrom: resourceFieldRef: resource: limits.memory + divisor: "1" - name: GOMAXPROCS valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" {{- if .CompliancePolicy }} - name: COMPLIANCE_POLICY value: "{{ .CompliancePolicy }}" @@ -19098,24 +19820,24 @@ data: {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }} requests: {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}} - cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}" + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` | quote }} {{ end }} {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} - memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}" + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` | quote }} {{ end }} {{- end }} {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} limits: {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}} - cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}" + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` | quote }} {{ end }} {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}} - memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}" + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` | quote }} {{ end }} {{- end }} {{- else }} {{- if .Values.global.proxy.resources }} - {{ toYaml .Values.global.proxy.resources | indent 6 }} + {{ toYaml (omitNil .Values.global.proxy.resources) | indent 6 }} {{- end }} {{- end }} {{- end }} @@ -19399,19 +20121,427 @@ data: secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }} {{ end -}} {{- end }} - {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }} - {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }} - - name: "{{ $index }}" - {{ toYaml $value | indent 4 }} - {{ end }} - {{ end }} - {{- if .Values.global.imagePullSecrets }} - imagePullSecrets: - {{- range .Values.global.imagePullSecrets }} - - name: {{ . }} - {{- end }} + {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }} + {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }} + - name: "{{ $index }}" + {{ toYaml $value | indent 4 }} + {{ end }} + {{ end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + waypoint: | + apiVersion: v1 + kind: ServiceAccount + metadata: + name: {{.ServiceAccount | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + {{- if ge .KubeVersion 128 }} + # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412 + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + {{- end }} + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" .ControllerLabel + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + spec: + selector: + matchLabels: + "{{.GatewayNameLabel}}": "{{.Name}}" + template: + metadata: + annotations: + {{- toJsonMap + (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") + (strdict "istio.io/rev" (.Revision | default "default")) + (strdict + "prometheus.io/path" "/stats/prometheus" + "prometheus.io/port" "15020" + "prometheus.io/scrape" "true" + ) | nindent 8 }} + labels: + {{- toJsonMap + (strdict + "sidecar.istio.io/inject" "false" + "istio.io/dataplane-mode" "none" + "service.istio.io/canonical-name" .DeploymentName + "service.istio.io/canonical-revision" "latest" + ) + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" .ControllerLabel + ) | nindent 8}} + spec: + {{- if .Values.global.waypoint.affinity }} + affinity: + {{- toYaml .Values.global.waypoint.affinity | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.nodeSelector }} + nodeSelector: + {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.tolerations }} + tolerations: + {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }} + {{- end }} + serviceAccountName: {{.ServiceAccount | quote}} + containers: + - name: istio-proxy + ports: + - containerPort: 15020 + name: metrics + protocol: TCP + - containerPort: 15021 + name: status-port + protocol: TCP + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + args: + - proxy + - waypoint + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --serviceCluster + - {{.ServiceAccount}}.$(POD_NAMESPACE) + - --proxyLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}} + - --proxyComponentLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}} + - --log_output_level + - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + {{- if .Values.global.proxy.outlierLogPath }} + - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }} + {{- end}} + env: + - name: ISTIO_META_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: ISTIO_CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + {{- if .ProxyConfig.ProxyMetadata }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- end }} + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" + {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }} + {{- if $network }} + - name: ISTIO_META_NETWORK + value: "{{ $network }}" + {{- if eq .ControllerLabel "istio.io-eastwest-controller" }} + - name: ISTIO_META_REQUESTED_NETWORK_VIEW + value: "{{ $network }}" + {{- end }} + {{- end }} + - name: ISTIO_META_INTERCEPTION_MODE + value: REDIRECT + - name: ISTIO_META_WORKLOAD_NAME + value: {{.DeploymentName}} + - name: ISTIO_META_OWNER + value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}} + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- if .Values.global.waypoint.resources }} + resources: + {{- toYaml (omitNil .Values.global.waypoint.resources) | nindent 10 }} + {{- end }} + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 4 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + privileged: false + {{- if not (eq .Values.global.platform "openshift") }} + runAsGroup: 1337 + runAsUser: 1337 + {{- end }} + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + {{- if .Values.gateways.seccompProfile }} + seccompProfile: + {{- toYaml .Values.gateways.seccompProfile | nindent 12 }} + {{- end }} + volumeMounts: + - mountPath: /var/run/secrets/workload-spiffe-uds + name: workload-socket + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + - mountPath: /var/lib/istio/data + name: istio-data + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /var/run/secrets/tokens + name: istio-token + - mountPath: /etc/istio/pod + name: istio-podinfo + volumes: + - emptyDir: {} + name: workload-socket + - emptyDir: + medium: Memory + name: istio-envoy + - emptyDir: + medium: Memory + name: go-proxy-envoy + - emptyDir: {} + name: istio-data + - emptyDir: {} + name: go-proxy-data + - downwardAPI: + items: + - fieldRef: + fieldPath: metadata.labels + path: labels + - fieldRef: + fieldPath: metadata.annotations + path: annotations + name: istio-podinfo + - name: istio-token + projected: + sources: + - serviceAccountToken: + audience: istio-ca + expirationSeconds: 43200 + path: istio-token + - name: istiod-ca-cert + {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + --- + apiVersion: v1 + kind: Service + metadata: + annotations: + {{ toJsonMap + (strdict "networking.istio.io/traffic-distribution" "PreferClose") + (omit .InfrastructureAnnotations + "kubectl.kubernetes.io/last-applied-configuration" + "gateway.istio.io/name-override" + "gateway.istio.io/service-account" + "gateway.istio.io/controller-version" + ) | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + spec: + ipFamilyPolicy: PreferDualStack + ports: + {{- range $key, $val := .Ports }} + - name: {{ $val.Name | quote }} + port: {{ $val.Port }} + protocol: TCP + appProtocol: {{ $val.AppProtocol }} + {{- end }} + selector: + "{{.GatewayNameLabel}}": "{{.Name}}" + {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }} + loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}} {{- end }} - waypoint: | + type: {{ .ServiceType | quote }} + --- + apiVersion: autoscaling/v2 + kind: HorizontalPodAutoscaler + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{.DeploymentName | quote}} + maxReplicas: 1 + --- + apiVersion: policy/v1 + kind: PodDisruptionBudget + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} + kube-gateway: | apiVersion: v1 kind: ServiceAccount metadata: @@ -19424,11 +20554,12 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} {{- if ge .KubeVersion 128 }} # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412 ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: "{{.Name}}" uid: "{{.UID}}" @@ -19446,17 +20577,18 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name - "gateway.istio.io/managed" .ControllerLabel + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-gateway-controller" ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway - name: "{{.Name}}" + name: {{.Name}} uid: "{{.UID}}" spec: selector: matchLabels: - "{{.GatewayNameLabel}}": "{{.Name}}" + "{{.GatewayNameLabel}}": {{.Name}} template: metadata: annotations: @@ -19472,36 +20604,51 @@ data: {{- toJsonMap (strdict "sidecar.istio.io/inject" "false" - "istio.io/dataplane-mode" "none" "service.istio.io/canonical-name" .DeploymentName "service.istio.io/canonical-revision" "latest" ) .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name - "gateway.istio.io/managed" .ControllerLabel - ) | nindent 8}} + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-gateway-controller" + ) | nindent 8 }} spec: - {{- if .Values.global.waypoint.affinity }} - affinity: - {{- toYaml .Values.global.waypoint.affinity | nindent 8 }} - {{- end }} - {{- if .Values.global.waypoint.topologySpreadConstraints }} - topologySpreadConstraints: - {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }} - {{- end }} - {{- if .Values.global.waypoint.nodeSelector }} - nodeSelector: - {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }} + securityContext: + {{- if .Values.gateways.securityContext }} + {{- toYaml .Values.gateways.securityContext | nindent 8 }} + {{- else }} + sysctls: + - name: net.ipv4.ip_unprivileged_port_start + value: "0" + {{- if .Values.gateways.seccompProfile }} + seccompProfile: + {{- toYaml .Values.gateways.seccompProfile | nindent 10 }} {{- end }} - {{- if .Values.global.waypoint.tolerations }} - tolerations: - {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }} {{- end }} - terminationGracePeriodSeconds: 2 serviceAccountName: {{.ServiceAccount | quote}} containers: - name: istio-proxy + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + {{- if .Values.global.proxy.resources }} + resources: + {{- toYaml (omitNil .Values.global.proxy.resources) | nindent 10 }} + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + securityContext: + capabilities: + drop: + - ALL + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: true + runAsUser: {{ .ProxyUID | default "1337" }} + runAsGroup: {{ .ProxyGID | default "1337" }} + runAsNonRoot: true ports: - containerPort: 15020 name: metrics @@ -19512,40 +20659,28 @@ data: - containerPort: 15090 protocol: TCP name: http-envoy-prom - {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} - image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" - {{- else }} - image: "{{ .ProxyImage }}" - {{- end }} - {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} args: - proxy - - waypoint + - router - --domain - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} - - --serviceCluster - - {{.ServiceAccount}}.$(POD_NAMESPACE) - --proxyLogLevel - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}} - --proxyComponentLogLevel - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}} - --log_output_level - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}} - {{- if .Values.global.logAsJson }} + {{- if .Values.global.sts.servicePort }} + - --stsPort={{ .Values.global.sts.servicePort }} + {{- end }} + {{- if .Values.global.logAsJson }} - --log_as_json - {{- end }} - {{- if .Values.global.proxy.outlierLogPath }} - - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }} - {{- end}} + {{- end }} + {{- if .Values.global.proxy.lifecycle }} + lifecycle: + {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }} + {{- end }} env: - - name: ISTIO_META_SERVICE_ACCOUNT - valueFrom: - fieldRef: - fieldPath: spec.serviceAccountName - - name: ISTIO_META_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - name: PILOT_CERT_PROVIDER value: {{ .Values.global.pilotCertProvider }} - name: CA_ADDR @@ -19578,36 +20713,40 @@ data: valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" - name: PROXY_CONFIG value: | {{ protoToJSON .ProxyConfig }} - {{- if .ProxyConfig.ProxyMetadata }} - {{- range $key, $value := .ProxyConfig.ProxyMetadata }} - - name: {{ $key }} - value: "{{ $value }}" - {{- end }} - {{- end }} + - name: ISTIO_META_POD_PORTS + value: "[]" + - name: ISTIO_META_APP_CONTAINERS + value: "" - name: GOMEMLIMIT valueFrom: resourceFieldRef: resource: limits.memory + divisor: "1" - name: GOMAXPROCS valueFrom: resourceFieldRef: resource: limits.cpu + divisor: "1" - name: ISTIO_META_CLUSTER_ID - value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" - {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }} - {{- if $network }} + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}" + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: ISTIO_META_INTERCEPTION_MODE + value: "{{ .ProxyConfig.InterceptionMode.String }}" + {{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }} - name: ISTIO_META_NETWORK - value: "{{ $network }}" + value: {{.|quote}} {{- end }} - - name: ISTIO_META_INTERCEPTION_MODE - value: REDIRECT - name: ISTIO_META_WORKLOAD_NAME - value: {{.DeploymentName}} + value: {{.DeploymentName|quote}} - name: ISTIO_META_OWNER - value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}} + value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}" {{- if .Values.global.meshID }} - name: ISTIO_META_MESH_ID value: "{{ .Values.global.meshID }}" @@ -19615,13 +20754,17 @@ data: - name: ISTIO_META_MESH_ID value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" {{- end }} - {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} - name: TRUST_DOMAIN value: "{{ . }}" {{- end }} - {{- if .Values.global.waypoint.resources }} - resources: - {{- toYaml .Values.global.waypoint.resources | nindent 10 }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- with (index .InfrastructureLabels "topology.istio.io/network") }} + - name: ISTIO_META_REQUESTED_NETWORK_VIEW + value: {{.|quote}} {{- end }} startupProbe: failureThreshold: 30 @@ -19643,66 +20786,70 @@ data: periodSeconds: 15 successThreshold: 1 timeoutSeconds: 1 - securityContext: - privileged: false - {{- if not (eq .Values.global.platform "openshift") }} - runAsGroup: 1337 - runAsUser: 1337 - {{- end }} - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - {{- if .Values.gateways.seccompProfile }} - seccompProfile: - {{- toYaml .Values.gateways.seccompProfile | nindent 12 }} - {{- end }} volumeMounts: - - mountPath: /var/run/secrets/workload-spiffe-uds - name: workload-socket + - name: workload-socket + mountPath: /var/run/secrets/workload-spiffe-uds + - name: credential-socket + mountPath: /var/run/secrets/credential-uds + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} - mountPath: /var/run/secrets/istio name: istiod-ca-cert + {{- end }} - mountPath: /var/lib/istio/data name: istio-data + # SDS channel between istioagent and Envoy - mountPath: /etc/istio/proxy name: istio-envoy - mountPath: /var/run/secrets/tokens name: istio-token - - mountPath: /etc/istio/pod - name: istio-podinfo + - name: istio-podinfo + mountPath: /etc/istio/pod volumes: - emptyDir: {} name: workload-socket + - emptyDir: {} + name: credential-socket + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + csi: + driver: workloadcertificates.security.cloud.google.com + {{- else}} + - emptyDir: {} + name: workload-certs + {{- end }} + # SDS channel between istioagent and Envoy - emptyDir: medium: Memory name: istio-envoy - - emptyDir: - medium: Memory - name: go-proxy-envoy - - emptyDir: {} - name: istio-data - - emptyDir: {} - name: go-proxy-data - - downwardAPI: + - name: istio-data + emptyDir: {} + - name: istio-podinfo + downwardAPI: items: - - fieldRef: - fieldPath: metadata.labels - path: labels - - fieldRef: - fieldPath: metadata.annotations - path: annotations - name: istio-podinfo + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "annotations" + fieldRef: + fieldPath: metadata.annotations - name: istio-token projected: sources: - serviceAccountToken: - audience: istio-ca - expirationSeconds: 43200 path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} - name: istiod-ca-cert - {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} projected: sources: - clusterTrustBundle: @@ -19712,6 +20859,7 @@ data: configMap: name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} {{- end }} + {{- end }} {{- if .Values.global.imagePullSecrets }} imagePullSecrets: {{- range .Values.global.imagePullSecrets }} @@ -19723,27 +20871,21 @@ data: kind: Service metadata: annotations: - {{ toJsonMap - (strdict "networking.istio.io/traffic-distribution" "PreferClose") - (omit .InfrastructureAnnotations - "kubectl.kubernetes.io/last-applied-configuration" - "gateway.istio.io/name-override" - "gateway.istio.io/service-account" - "gateway.istio.io/controller-version" - ) | nindent 4 }} + {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} labels: {{- toJsonMap .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} name: {{.DeploymentName | quote}} namespace: {{.Namespace | quote}} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway - name: "{{.Name}}" - uid: "{{.UID}}" + name: {{.Name}} + uid: {{.UID}} spec: ipFamilyPolicy: PreferDualStack ports: @@ -19754,7 +20896,7 @@ data: appProtocol: {{ $val.AppProtocol }} {{- end }} selector: - "{{.GatewayNameLabel}}": "{{.Name}}" + "{{.GatewayNameLabel}}": {{.Name}} {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }} loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}} {{- end }} @@ -19772,9 +20914,10 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: "{{.UID}}" @@ -19797,9 +20940,10 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: "{{.UID}}" @@ -19807,7 +20951,7 @@ data: selector: matchLabels: gateway.networking.k8s.io/gateway-name: {{.Name|quote}} - kube-gateway: | + agentgateway: | apiVersion: v1 kind: ServiceAccount metadata: @@ -19820,15 +20964,13 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} - {{- if ge .KubeVersion 128 }} - # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412 ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: "{{.Name}}" uid: "{{.UID}}" - {{- end }} --- apiVersion: apps/v1 kind: Deployment @@ -19842,10 +20984,11 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name - "gateway.istio.io/managed" "istio.io-gateway-controller" + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-agentgateway-controller" ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: "{{.UID}}" @@ -19874,7 +21017,8 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name - "gateway.istio.io/managed" "istio.io-gateway-controller" + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-agentgateway-controller" ) | nindent 8 }} spec: securityContext: @@ -19882,7 +21026,7 @@ data: {{- toYaml .Values.gateways.securityContext | nindent 8 }} {{- else }} sysctls: - - name: net.ipv4.ip_unprivileged_port_start + - name: net.ipv4.ip_unprivileged_port_start # allows binding to 80 and 443 without root value: "0" {{- if .Values.gateways.seccompProfile }} seccompProfile: @@ -19891,15 +21035,15 @@ data: {{- end }} serviceAccountName: {{.ServiceAccount | quote}} containers: - - name: istio-proxy - {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} - image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + - name: agentgateway + {{- if contains "/" (annotation .ObjectMeta `gateway.istio.io/agentgatewayImage` .Values.global.agentgateway.image) }} + image: "{{ annotation .ObjectMeta `gateway.istio.io/agentgatewayImage` .Values.global.agentgateway.image }}" {{- else }} - image: "{{ .ProxyImage }}" + image: "{{ .AgentgatewayImage }}" {{- end }} {{- if .Values.global.proxy.resources }} resources: - {{- toYaml .Values.global.proxy.resources | nindent 10 }} + {{- toYaml (omitNil .Values.global.proxy.resources) | nindent 10 }} {{- end }} {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} securityContext: @@ -19909,8 +21053,8 @@ data: allowPrivilegeEscalation: false privileged: false readOnlyRootFilesystem: true - runAsUser: {{ .ProxyUID | default "1337" }} - runAsGroup: {{ .ProxyGID | default "1337" }} + runAsUser: {{ .ProxyUID | default "10101" }} + runAsGroup: {{ .ProxyGID | default "10101" }} runAsNonRoot: true ports: - containerPort: 15020 @@ -19919,39 +21063,14 @@ data: - containerPort: 15021 name: status-port protocol: TCP - - containerPort: 15090 - protocol: TCP - name: http-envoy-prom args: - - proxy - - router - - --domain - - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} - - --proxyLogLevel - - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}} - - --proxyComponentLogLevel - - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}} - - --log_output_level - - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}} - {{- if .Values.global.sts.servicePort }} - - --stsPort={{ .Values.global.sts.servicePort }} - {{- end }} - {{- if .Values.global.logAsJson }} - - --log_as_json - {{- end }} + - --config + - '{}' {{- if .Values.global.proxy.lifecycle }} lifecycle: {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }} {{- end }} env: - - name: PILOT_CERT_PROVIDER - value: {{ .Values.global.pilotCertProvider }} - - name: CA_ADDR - {{- if .Values.global.caAddress }} - value: {{ .Values.global.caAddress }} - {{- else }} - value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 - {{- end }} - name: POD_NAME valueFrom: fieldRef: @@ -19960,6 +21079,10 @@ data: valueFrom: fieldRef: fieldPath: metadata.namespace + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace - name: INSTANCE_IP valueFrom: fieldRef: @@ -19968,52 +21091,21 @@ data: valueFrom: fieldRef: fieldPath: spec.serviceAccountName - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: ISTIO_CPU_LIMIT - valueFrom: - resourceFieldRef: - resource: limits.cpu - - name: PROXY_CONFIG - value: | - {{ protoToJSON .ProxyConfig }} - - name: ISTIO_META_POD_PORTS - value: "[]" - - name: ISTIO_META_APP_CONTAINERS - value: "" - - name: GOMEMLIMIT - valueFrom: - resourceFieldRef: - resource: limits.memory - - name: GOMAXPROCS + - name: CPU_LIMIT valueFrom: resourceFieldRef: resource: limits.cpu - - name: ISTIO_META_CLUSTER_ID + divisor: "1" + - name: GATEWAY + value: {{.Name|quote}} + - name: RUST_BACKTRACE + value: "1" + - name: CLUSTER_ID value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}" - - name: ISTIO_META_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: ISTIO_META_INTERCEPTION_MODE - value: "{{ .ProxyConfig.InterceptionMode.String }}" {{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }} - - name: ISTIO_META_NETWORK + - name: NETWORK value: {{.|quote}} {{- end }} - - name: ISTIO_META_WORKLOAD_NAME - value: {{.DeploymentName|quote}} - - name: ISTIO_META_OWNER - value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}" - {{- if .Values.global.meshID }} - - name: ISTIO_META_MESH_ID - value: "{{ .Values.global.meshID }}" - {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} - - name: ISTIO_META_MESH_ID - value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" - {{- end }} {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} - name: TRUST_DOMAIN value: "{{ . }}" @@ -20022,9 +21114,13 @@ data: - name: {{ $key }} value: "{{ $value }}" {{- end }} - {{- with (index .InfrastructureLabels "topology.istio.io/network") }} - - name: ISTIO_META_REQUESTED_NETWORK_VIEW - value: {{.|quote}} + - name: XDS_ADDRESS + value: {{ .ProxyConfig.DiscoveryAddress | quote }} + - name: CA_ADDRESS + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 {{- end }} startupProbe: failureThreshold: 30 @@ -20047,59 +21143,26 @@ data: successThreshold: 1 timeoutSeconds: 1 volumeMounts: - - name: workload-socket - mountPath: /var/run/secrets/workload-spiffe-uds - - name: credential-socket - mountPath: /var/run/secrets/credential-uds - {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} - - name: gke-workload-certificate - mountPath: /var/run/secrets/workload-spiffe-credentials - readOnly: true - {{- else }} - - name: workload-certs - mountPath: /var/run/secrets/workload-spiffe-credentials - {{- end }} - {{- if eq .Values.global.pilotCertProvider "istiod" }} + - mountPath: /var/run/secrets/xds + name: istiod-ca-cert + - mountPath: /var/run/secrets/xds-tokens + name: xds-token + - mountPath: /tmp + name: tmp - mountPath: /var/run/secrets/istio name: istiod-ca-cert - {{- end }} - - mountPath: /var/lib/istio/data - name: istio-data - # SDS channel between istioagent and Envoy - - mountPath: /etc/istio/proxy - name: istio-envoy - mountPath: /var/run/secrets/tokens name: istio-token - - name: istio-podinfo - mountPath: /etc/istio/pod volumes: - emptyDir: {} - name: workload-socket - - emptyDir: {} - name: credential-socket - {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} - - name: gke-workload-certificate - csi: - driver: workloadcertificates.security.cloud.google.com - {{- else}} - - emptyDir: {} - name: workload-certs - {{- end }} - # SDS channel between istioagent and Envoy - - emptyDir: - medium: Memory - name: istio-envoy - - name: istio-data - emptyDir: {} - - name: istio-podinfo - downwardAPI: - items: - - path: "labels" - fieldRef: - fieldPath: metadata.labels - - path: "annotations" - fieldRef: - fieldPath: metadata.annotations + name: tmp + - name: xds-token + projected: + sources: + - serviceAccountToken: + path: xds-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} - name: istio-token projected: sources: @@ -20137,11 +21200,12 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} name: {{.DeploymentName | quote}} namespace: {{.Namespace | quote}} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: {{.UID}} @@ -20173,9 +21237,10 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: "{{.UID}}" @@ -20198,9 +21263,10 @@ data: .InfrastructureLabels (strdict "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass ) | nindent 4 }} ownerReferences: - - apiVersion: gateway.networking.k8s.io/v1beta1 + - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway name: {{.Name}} uid: "{{.UID}}" @@ -20248,6 +21314,9 @@ data: }, "nativeNftables": false, "network": "", + "networkPolicy": { + "enabled": false + }, "omitSidecarInjectorConfigMap": false, "operatorManageWebhooks": false, "pilotCertProvider": "istiod", @@ -20279,6 +21348,7 @@ data: "memory": "128Mi" } }, + "seccompProfile": {}, "startupProbe": { "enabled": true, "failureThreshold": 600 @@ -20291,6 +21361,7 @@ data: "image": "proxyv2" }, "remotePilotAddress": "", + "resourceScope": "all", "sds": { "token": { "aud": "istio-ca" @@ -20299,7 +21370,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.27.3-distroless", + "tag": "1.30.0-distroless", "variant": "", "waypoint": { "affinity": {}, @@ -20344,8 +21415,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -20425,6 +21496,9 @@ data: }, "nativeNftables": false, "network": "", + "networkPolicy": { + "enabled": false + }, "omitSidecarInjectorConfigMap": false, "operatorManageWebhooks": false, "pilotCertProvider": "istiod", @@ -20456,6 +21530,7 @@ data: "memory": "128Mi" } }, + "seccompProfile": {}, "startupProbe": { "enabled": true, "failureThreshold": 600 @@ -20468,6 +21543,7 @@ data: "image": "proxyv2" }, "remotePilotAddress": "", + "resourceScope": "all", "sds": { "token": { "aud": "istio-ca" @@ -20476,7 +21552,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.27.3-distroless", + "tag": "1.30.0-distroless", "variant": "", "waypoint": { "affinity": {}, @@ -20600,7 +21676,7 @@ data: "configValidation": true, "hub": "gcr.io/istio-release", "istioNamespace": "istio-system", - "tag": "1.27.3-distroless" + "tag": "1.30.0-distroless" }, "meshConfig": { "accessLogEncoding": "JSON", @@ -20633,8 +21709,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -20652,8 +21728,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -20811,8 +21887,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/dataplane-mode: none @@ -20844,9 +21920,9 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 + app.kubernetes.io/version: 1.0.0 chart: gateways - helm.sh/chart: istio-ingress-1.27.3 + helm.sh/chart: istio-ingress-1.0.0 heritage: Tiller install.operator.istio.io/owning-resource: unknown istio: ingressgateway @@ -20883,6 +21959,8 @@ spec: - --proxyComponentLogLevel=misc:error - --log_output_level=default:info env: + - name: COMPLIANCE_POLICY + value: pqc - name: PILOT_CERT_PROVIDER value: istiod - name: CA_ADDR @@ -20915,6 +21993,7 @@ spec: - name: ISTIO_CPU_LIMIT valueFrom: resourceFieldRef: + divisor: "1" resource: limits.cpu - name: SERVICE_ACCOUNT valueFrom: @@ -20936,7 +22015,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: gcr.io/istio-release/proxyv2:1.27.3-distroless + image: gcr.io/istio-release/proxyv2:1.30.0-distroless name: istio-proxy ports: - containerPort: 8080 @@ -21054,8 +22133,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default @@ -21083,8 +22162,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none @@ -21116,6 +22195,8 @@ spec: env: - name: ENABLE_NATIVE_SIDECARS value: "true" + - name: COMPLIANCE_POLICY + value: pqc - name: REVISION value: default - name: PILOT_CERT_PROVIDER @@ -21145,11 +22226,6 @@ spec: value: "false" - name: CLUSTER_ID value: Kubernetes - - name: GOMEMLIMIT - valueFrom: - resourceFieldRef: - divisor: "1" - resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: @@ -21157,7 +22233,7 @@ spec: resource: limits.cpu - name: PLATFORM value: "" - image: gcr.io/istio-release/pilot:1.27.3-distroless + image: gcr.io/istio-release/pilot:1.30.0-distroless name: discovery ports: - containerPort: 8080 @@ -21244,57 +22320,6 @@ spec: optional: true name: istio-csr-ca-configmap ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - labels: - app: istio-ingressgateway - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: istio-ingressgateway - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 - install.operator.istio.io/owning-resource: unknown - istio: ingressgateway - istio.io/rev: default - operator.istio.io/component: IngressGateways - release: istio - name: istio-ingressgateway - namespace: istio-system -spec: - minAvailable: 1 - selector: - matchLabels: - app: istio-ingressgateway - istio: ingressgateway - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - labels: - app: istiod - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: istiod - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 - install.operator.istio.io/owning-resource: unknown - istio: pilot - istio.io/rev: default - operator.istio.io/component: Pilot - release: istio - name: istiod - namespace: istio-system -spec: - minAvailable: 1 - selector: - matchLabels: - app: istiod - --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -21304,8 +22329,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -21332,8 +22357,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod namespace: istio-system @@ -21380,8 +22405,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -21406,8 +22431,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 release: istio name: istiod namespace: istio-system @@ -21430,8 +22455,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -21464,8 +22489,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -21498,8 +22523,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istio-ingress-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istio-ingress-1.0.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -21531,8 +22556,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.27.3 - helm.sh/chart: istiod-1.27.3 + app.kubernetes.io/version: 1.0.0 + helm.sh/chart: istiod-1.0.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default diff --git a/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml b/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml index 993222c397..0be1e83f9a 100644 --- a/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml +++ b/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml @@ -26,8 +26,6 @@ spec: tls: mode: SIMPLE credentialName: ingress-cert-frompfx - minProtocolVersion: TLSV1_2 - maxProtocolVersion: TLSV1_2 cipherSuites: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 diff --git a/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml b/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml index 993222c397..9ca9899029 100644 --- a/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml +++ b/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml @@ -26,10 +26,4 @@ spec: tls: mode: SIMPLE credentialName: ingress-cert-frompfx - minProtocolVersion: TLSV1_2 - maxProtocolVersion: TLSV1_2 - cipherSuites: - - TLS_AES_128_GCM_SHA256 - - TLS_AES_256_GCM_SHA384 - - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +