sidk still going and trying things
This commit is contained in:
Oriol
8
Istio/sidecar/01-visibility/README.md
Normal file
8
Istio/sidecar/01-visibility/README.md
Normal file
@ -0,0 +1,8 @@
|
||||
https://github.com/steren/istio.github.io/blob/master/_docs/setup/kubernetes/sidecar-injection.md
|
||||
|
||||
https://istio.io/latest/docs/reference/config/networking/sidecar/
|
||||
|
||||
|
||||
# Continues from
|
||||
|
||||
- 01-hello_world_1_service_1_deployment
|
||||
48
Istio/sidecar/01-visibility/deployment.yaml
Normal file
48
Istio/sidecar/01-visibility/deployment.yaml
Normal file
@ -0,0 +1,48 @@
|
||||
# https://github.com/istio/istio/blob/master/samples/helloworld/helloworld.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: helloworld
|
||||
labels:
|
||||
app: helloworld
|
||||
service: helloworld
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
name: http
|
||||
selector:
|
||||
app: helloworld
|
||||
---
|
||||
#apiVersion: v1
|
||||
#kind: ServiceAccount
|
||||
#metadata:
|
||||
# name: istio-helloworld
|
||||
# labels:
|
||||
# account:
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: helloworld-nginx
|
||||
labels:
|
||||
app: helloworld
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: helloworld
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: helloworld
|
||||
spec:
|
||||
# serviceAccountName: istio-helloworld
|
||||
containers:
|
||||
- name: helloworld
|
||||
image: nginx
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
imagePullPolicy: IfNotPresent #Always
|
||||
ports:
|
||||
- containerPort: 80
|
||||
36
Istio/sidecar/01-visibility/gateway.yaml
Normal file
36
Istio/sidecar/01-visibility/gateway.yaml
Normal file
@ -0,0 +1,36 @@
|
||||
# https://github.com/istio/istio/blob/master/samples/helloworld/helloworld-gateway.yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: helloworld-gateway
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway # use istio default controller
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: helloworld-vs
|
||||
spec:
|
||||
hosts:
|
||||
- "*"
|
||||
gateways:
|
||||
- helloworld-gateway
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
exact: /helloworld
|
||||
route:
|
||||
- destination:
|
||||
host: helloworld
|
||||
port:
|
||||
number: 80
|
||||
rewrite:
|
||||
uri: "/"
|
||||
11
Istio/sidecar/01-visibility/sidecar.yaml
Normal file
11
Istio/sidecar/01-visibility/sidecar.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
apiVersion:
|
||||
networking.istio.io/v1alpha3
|
||||
kind: Sidecar
|
||||
metadata:
|
||||
name: default
|
||||
namespace: foo
|
||||
spec:
|
||||
egress:
|
||||
- hosts:
|
||||
- "./*"
|
||||
- "istio-system/*"
|
||||
235
Istio/sidecar/01-visibility/tmp.yaml
Normal file
235
Istio/sidecar/01-visibility/tmp.yaml
Normal file
@ -0,0 +1,235 @@
|
||||
# https://github.com/istio/istio/blob/master/samples/helloworld/helloworld.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: helloworld
|
||||
labels:
|
||||
app: helloworld
|
||||
service: helloworld
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
name: http
|
||||
selector:
|
||||
app: helloworld
|
||||
---
|
||||
#apiVersion: v1
|
||||
#kind: ServiceAccount
|
||||
#metadata:
|
||||
# name: istio-helloworld
|
||||
# labels:
|
||||
# account:
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: helloworld
|
||||
name: helloworld-nginx
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: helloworld
|
||||
strategy: {}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: helloworld
|
||||
kubectl.kubernetes.io/default-logs-container: helloworld
|
||||
prometheus.io/path: /stats/prometheus
|
||||
prometheus.io/port: "15020"
|
||||
prometheus.io/scrape: "true"
|
||||
sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: helloworld
|
||||
security.istio.io/tlsMode: istio
|
||||
service.istio.io/canonical-name: helloworld
|
||||
service.istio.io/canonical-revision: latest
|
||||
spec:
|
||||
containers:
|
||||
- image: nginx
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: helloworld
|
||||
ports:
|
||||
- containerPort: 80
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
- args:
|
||||
- proxy
|
||||
- sidecar
|
||||
- --domain
|
||||
- $(POD_NAMESPACE).svc.cluster.local
|
||||
- --proxyLogLevel=warning
|
||||
- --proxyComponentLogLevel=misc:error
|
||||
- --log_output_level=default:info
|
||||
- --concurrency
|
||||
- "2"
|
||||
env:
|
||||
- name: JWT_POLICY
|
||||
value: third-party-jwt
|
||||
- name: PILOT_CERT_PROVIDER
|
||||
value: istiod
|
||||
- name: CA_ADDR
|
||||
value: istiod.istio-system.svc:15012
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: SERVICE_ACCOUNT
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.serviceAccountName
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: PROXY_CONFIG
|
||||
value: |
|
||||
{}
|
||||
- name: ISTIO_META_POD_PORTS
|
||||
value: |-
|
||||
[
|
||||
{"containerPort":80}
|
||||
]
|
||||
- name: ISTIO_META_APP_CONTAINERS
|
||||
value: helloworld
|
||||
- name: ISTIO_META_CLUSTER_ID
|
||||
value: Kubernetes
|
||||
- name: ISTIO_META_INTERCEPTION_MODE
|
||||
value: REDIRECT
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: cluster.local
|
||||
- name: TRUST_DOMAIN
|
||||
value: cluster.local
|
||||
image: istio/proxyv2:1.16.1
|
||||
name: istio-proxy
|
||||
ports:
|
||||
- containerPort: 15090
|
||||
name: http-envoy-prom
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 30
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: 15021
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 2
|
||||
timeoutSeconds: 3
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1337
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1337
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/secrets/workload-spiffe-uds
|
||||
name: workload-socket
|
||||
- mountPath: /var/run/secrets/credential-uds
|
||||
name: credential-socket
|
||||
- mountPath: /var/run/secrets/workload-spiffe-credentials
|
||||
name: workload-certs
|
||||
- mountPath: /var/run/secrets/istio
|
||||
name: istiod-ca-cert
|
||||
- mountPath: /var/lib/istio/data
|
||||
name: istio-data
|
||||
- mountPath: /etc/istio/proxy
|
||||
name: istio-envoy
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: istio-token
|
||||
- mountPath: /etc/istio/pod
|
||||
name: istio-podinfo
|
||||
initContainers:
|
||||
- args:
|
||||
- istio-iptables
|
||||
- -p
|
||||
- "15001"
|
||||
- -z
|
||||
- "15006"
|
||||
- -u
|
||||
- "1337"
|
||||
- -m
|
||||
- REDIRECT
|
||||
- -i
|
||||
- '*'
|
||||
- -x
|
||||
- ""
|
||||
- -b
|
||||
- '*'
|
||||
- -d
|
||||
- 15090,15021,15020
|
||||
- --log_output_level=default:info
|
||||
image: istio/proxyv2:1.16.1
|
||||
name: istio-init
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
volumes:
|
||||
- name: workload-socket
|
||||
- name: credential-socket
|
||||
- name: workload-certs
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: istio-envoy
|
||||
- emptyDir: {}
|
||||
name: istio-data
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.labels
|
||||
path: labels
|
||||
- fieldRef:
|
||||
fieldPath: metadata.annotations
|
||||
path: annotations
|
||||
name: istio-podinfo
|
||||
- name: istio-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: istio-ca
|
||||
expirationSeconds: 43200
|
||||
path: istio-token
|
||||
- configMap:
|
||||
name: istio-ca-root-cert
|
||||
name: istiod-ca-cert
|
||||
status: {}
|
||||
---
|
||||
23
Istio/sidecar/README.md
Normal file
23
Istio/sidecar/README.md
Normal file
@ -0,0 +1,23 @@
|
||||
https://istio.io/latest/docs/reference/config/networking/sidecar/
|
||||
|
||||
|
||||
https://istio.io/latest/docs/reference/glossary/#workload
|
||||
|
||||
|
||||
I am not very sure on how or why to use this...
|
||||
|
||||
|
||||
|
||||
```yaml
|
||||
apiVersion:
|
||||
networking.istio.io/v1alpha3
|
||||
kind: Sidecar
|
||||
metadata:
|
||||
name: default
|
||||
namespace: foo
|
||||
spec:
|
||||
egress:
|
||||
- hosts:
|
||||
- "./*"
|
||||
- "istio-system/*"
|
||||
```
|
||||
Reference in New Issue
Block a user