--- title: v1alpha1 layout: protoc-gen-docs generator: protoc-gen-docs number_of_entries: 94 ---
Configuration for the addon ingress.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether addon ingress is enabled. |
No |
hosts |
string[] |
No | |
annotations |
TypeMapStringInterface |
No | |
tls |
TypeMapStringInterface |
No |
ArchConfig specifies the pod scheduling target architecture(amd64, ppc64le, s390x) for all the Istio control plane components.
| Field | Type | Description | Required |
|---|---|---|---|
amd64 |
uint32 |
Sets pod scheduling weight for amd64 arch |
No |
ppc64le |
uint32 |
Sets pod scheduling weight for ppc64le arch. |
No |
s390x |
uint32 |
Sets pod scheduling weight for s390x arch. |
No |
Configuration for CNI.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether CNI is enabled. |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
image |
string |
No | |
pullPolicy |
string |
No | |
cniBinDir |
string |
No | |
cniConfDir |
string |
No | |
cniConfFileName |
string |
No | |
excludeNamespaces |
string[] |
No | |
pspClusterRole |
string |
No | |
logLevel |
string |
No | |
repair |
CNIRepairConfig |
No | |
chained |
BoolValue |
No | |
podAnnotations |
TypeMapStringInterface |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether repair behavior is enabled. |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
image |
string |
No | |
labelPods |
bool |
Controls whether various repair behaviors are enabled. |
No |
deletePods |
bool |
No | |
brokenPodLabelKey |
string |
No | |
brokenPodLabelValue |
string |
No | |
initContainerName |
string |
No | |
createEvents |
string |
No |
Configuration for CPU target utilization for HorizontalPodAutoscaler target.
| Field | Type | Description | Required |
|---|---|---|---|
targetAverageUtilization |
int32 |
K8s utilization setting for HorizontalPodAutoscaler target. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
Configuration for CertManager.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether CertManager is enabled. |
No |
hub |
string |
Image hub for the CertManager Deployment. |
No |
tag |
TypeInterface |
Image tag for the CertManager Deployment. |
No |
image |
string |
Image name for the CertManager Deployment. |
No |
email |
string |
No | |
extraArgs |
string[] |
No | |
podDnsPolicy |
string |
No | |
podDnsConfig |
TypeMapStringInterface |
No | |
replicaCount |
uint32 |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
tolerations |
TypeSliceOfMapStringInterface |
No | |
podAnnotations |
TypeMapStringInterface |
No | |
podLabels |
TypeMapStringInterface |
No |
Configuration for Core DNS.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether CoreDNS is enabled. |
No |
coreDNSImage |
string |
Image for Core DNS. |
No |
coreDNSTag |
string |
No | |
coreDNSPluginImage |
string |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
replicaCount |
uint32 |
Number of replicas for Core DNS. |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
tolerations |
TypeSliceOfMapStringInterface |
No |
DefaultPodDisruptionBudgetConfig specifies the default pod disruption budget configuration.
See https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether a PodDisruptionBudget with a default minAvailable value of 1 is created for each deployment. |
No |
DefaultResourcesConfig specifies the default k8s resources settings for all Istio control plane components.
| Field | Type | Description | Required |
|---|---|---|---|
requests |
ResourcesRequestsConfig |
k8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
Configuration for an egress gateway.
| Field | Type | Description | Required |
|---|---|---|---|
autoscaleEnabled |
BoolValue |
Controls whether auto scaling with a HorizontalPodAutoscaler is enabled. |
No |
autoscaleMax |
uint32 |
maxReplicas setting for HorizontalPodAutoscaler. |
No |
autoscaleMin |
uint32 |
minReplicas setting for HorizontalPodAutoscaler. |
No |
connectTimeout |
string |
No | |
drainDuration |
Duration |
No | |
enabled |
BoolValue |
Controls whether an egress gateway is enabled. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the proxy container. |
No |
labels |
GatewayLabelsConfig |
No | |
ports |
PortsConfig[] |
Ports Configuration for the egress gateway service. |
No |
secretVolumes |
SecretVolume[] |
Config for secret volume mounts. |
No |
serviceAnnotations |
TypeMapStringInterface |
Annotations to add to the egress gateway service. |
No |
type |
string |
Service type. See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
No |
zvpn |
ZeroVPNConfig |
Enables cross-cluster access using SNI matching. |
No |
configVolumes |
TypeSliceOfMapStringInterface |
No | |
additionalContainers |
TypeSliceOfMapStringInterface |
No | |
cpu |
CPUTargetUtilizationConfig |
K8s utilization setting for HorizontalPodAutoscaler target. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
Pod anti-affinity label selector. Specify the pod anti-affinity that allows you to constrain which nodes your pod is eligible to be scheduled based on labels on pods that are already running on the node rather than based on labels on nodes. There are currently two types of anti-affinity: “requiredDuringSchedulingIgnoredDuringExecution” “preferredDuringSchedulingIgnoredDuringExecution” which denote “hard” vs. “soft” requirements, you can define your values in “podAntiAffinityLabelSelector” and “podAntiAffinityTermLabelSelector” correspondingly. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity Examples: podAntiAffinityLabelSelector: - key: security operator: In values: S1,S2 topologyKey: “kubernetes.io/hostname” This pod anti-affinity rule says that the pod requires not to be scheduled onto a node if that node is already running a pod with label having key “security” and value “S1”. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See PodAntiAffinityLabelSelector. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
host |
string |
No | |
port |
string |
No | |
tlsSettings |
EnvoyAccessLogtlsSettings |
No | |
tcpKeepalive |
TypeMapStringInterface |
No |
| Field | Type | Description | Required |
|---|---|---|---|
mode |
string |
No | |
clientCertificate |
string |
No | |
privateKey |
string |
No | |
caCertificates |
string |
No | |
sni |
string |
No | |
subjectAltNames |
string[] |
No |
EnvoyMetricsConfig is a set of configuration options for Envoy metrics.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables the Envoy Metrics Service. |
No |
host |
string |
Sets the destination Envoy Metrics Service address in Envoy. |
No |
port |
int32 |
Sets the destination Envoy Metrics Service port in Envoy. |
No |
tlsSettings |
TypeMapStringInterface |
No | |
tcpKeepalive |
TypeMapStringInterface |
No |
GalleyConfig is a set of Configuration for Galley.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Galley is enabled |
No |
image |
string |
Image name used for Galley. This can be set either to image name if hub is also set in global.hub, or can be set to the full hub:name string. Examples: custom-galley, docker.io/someuser:custom-galley |
No |
mesh |
map<string, string> |
TODO: Galley appears to use the mesh config - need to find which fields are used and need to be configured (https://github.com/istio/istio/issues/15865). |
No |
enableAnalysis |
BoolValue |
Enable analysis and status update in Galley |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
replicaCount |
uint32 |
Number of replicas in the Galley Deployment. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
enableServiceDiscovery |
BoolValue |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
No |
GatewayLabelsConfig is a set of Configuration for gateway labels.
| Field | Type | Description | Required |
|---|---|---|---|
app |
string |
No | |
istio |
string |
No |
Configuration for gateways.
| Field | Type | Description | Required |
|---|---|---|---|
istioEgressgateway |
EgressGatewayConfig |
Configuration for an egress gateway. |
No |
enabled |
BoolValue |
Controls whether any gateways are enabled. |
No |
istioIngressgateway |
IngressGatewayConfig |
Configuration for an ingress gateway. |
No |
Global Configuration for Istio components.
| Field | Type | Description | Required |
|---|---|---|---|
arch |
ArchConfig |
Specifies pod scheduling arch(amd64, ppc64le, s390x) and weight as follows: 0 - Never scheduled 1 - Least preferred 2 - No preference 3 - Most preferred |
No |
certificates |
TypeSliceOfMapStringInterface |
No | |
configNamespace |
string |
Specifies the namespace for the configuration and validation component. |
No |
configRootNamespace |
string |
No | |
configValidation |
BoolValue |
Controls whether the server-side validation is enabled. |
No |
controlPlaneSecurityEnabled |
BoolValue |
Controls whether the MTLS for communication between the control plane components is enabled. |
No |
defaultConfigVisibilitySettings |
string[] |
No | |
disablePolicyChecks |
BoolValue |
Controls whether the policy enforcement is enabled. |
No |
enableHelmTest |
BoolValue |
Controls whether the helm test templates are enabled. |
No |
enableTracing |
BoolValue |
Controls whether the distributed tracing for the applications is enabled. See https://opentracing.io/docs/overview/what-is-tracing/ |
No |
hub |
string |
Specifies the docker hub for Istio images. |
No |
imagePullPolicy |
string |
Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
No |
imagePullSecrets |
string[] |
No | |
istioNamespace |
string |
Specifies the default namespace for the Istio control plane components. |
No |
localityLbSetting |
TypeMapStringInterface |
Specifies the global locality load balancing settings. Locality-weighted load balancing allows administrators to control the distribution of traffic to endpoints based on the localities of where the traffic originates and where it will terminate. Please set either failover or distribute configuration but not both. localityLbSetting: distribute: - from: “us-central1/” to: “us-central1/”: 80 “us-central2/*”: 20 localityLbSetting: failover: - from: us-east to: eu-west - from: us-west to: us-east |
No |
k8sIngress |
KubernetesIngressConfig |
Specifies the Configuration for the legacy kubernetes Ingress. |
No |
logAsJson |
BoolValue |
No | |
logging |
GlobalLoggingConfig |
Specifies the global logging level settings for the Istio control plane components. |
No |
meshExpansion |
MeshExpansionConfig |
Specifies the Configuration for Istio mesh expansion to bare metal. |
No |
meshID |
string |
No | |
meshNetworks |
TypeMapStringInterface |
Configure the mesh networks to be used by the Split Horizon EDS. The following example defines two networks with different endpoints association methods.
For meshNetworks: network1: endpoints: - fromCidr: “192.168.0.1⁄24” gateways: - address: 1.1.1.1 port: 80 network2: endpoints: - fromRegistry: reg1 gateways: - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local port: 443 |
No |
monitoringPort |
uint32 |
Specifies the monitor port number for all Istio control plane components. |
No |
mtls |
MTLSConfig |
Specifies the MTLS settings for the applications that Istio manages. |
No |
multiCluster |
MultiClusterConfig |
Specifies the Configuration for Istio mesh across multiple clusters through Istio gateways. |
No |
network |
string |
No | |
podDNSSearchNamespaces |
string[] |
Custom DNS config for the pod to resolve names of services in other clusters. Use this to add additional search domains, and other settings. see https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config This does not apply to gateway pods as they typically need a different set of DNS settings than the normal application pods (e.g. in multicluster scenarios). |
No |
omitSidecarInjectorConfigMap |
BoolValue |
No | |
oneNamespace |
BoolValue |
Controls whether to restrict the applications namespace the controller manages; If set it to false, the controller watches all namespaces. |
No |
operatorManageWebhooks |
BoolValue |
No | |
outboundTrafficPolicy |
OutboundTrafficPolicyConfig |
Controls the default behavior of the sidecar for handling outbound traffic from the application. |
No |
policyCheckFailOpen |
BoolValue |
Controls whether to allow traffic in cases when the mixer policy service cannot be reached. |
No |
policyNamespace |
string |
Specifies the namespace for the policy component. |
No |
prometheusNamespace |
string |
No | |
proxy |
ProxyConfig |
Specifies how proxies are configured within Istio. |
No |
proxyInit |
ProxyInitConfig |
Specifies the Configuration for proxy_init container which sets the pods’ networking to intercept the inbound/outbound traffic. |
No |
sds |
SDSConfig |
Specifies the Configuration for the SecretDiscoveryService instead of using K8S secrets to mount the certificates. |
No |
tag |
TypeInterface |
Specifies the tag for the Istio docker images. |
No |
telemetryNamespace |
string |
Specifies the namespace for the telemetry component. |
No |
tracer |
TracerConfig |
Specifies the Configuration for each of the supported tracers. |
No |
trustDomain |
string |
Specifies the trust domain that corresponds to the root cert of CA. |
No |
trustDomainAliases |
string[] |
The trust domain aliases represent the aliases of trustDomain. |
No |
useMCP |
BoolValue |
Controls whether to use of Mesh Configuration Protocol to distribute configuration. |
No |
istioRemote |
BoolValue |
Settings for remote cluster. Controls whether to use the Istio remote control plane |
No |
createRemoteSvcEndpoints |
BoolValue |
No | |
remotePilotCreateSvcEndpoint |
BoolValue |
If set, a selector-less service and endpoint for istio-pilot are created with the remotePilotAddress IP, which ensures the istio-pilot. is DNS resolvable in the remote cluster. |
No |
remotePolicyAddress |
string |
Specifies the Istio control plane’s policy Pod IP address or remote cluster DNS resolvable hostname. |
No |
remotePilotAddress |
string |
Specifies the Istio control plane’s pilot Pod IP address or remote cluster DNS resolvable hostname. |
No |
remoteTelemetryAddress |
string |
Specifies the Istio control plane’s telemetry Pod IP address or remote cluster DNS resolvable hostname |
No |
istiod |
IstiodConfig |
Specifies the configution of istiod |
No |
pilotCertProvider |
string |
Configure the Pilot certificate provider. Currently, two providers are supported: “kubernetes” and “citadel”. |
No |
jwtPolicy |
string |
Configure the policy for validating JWT. Currently, two options are supported: “third-party-jwt” and “first-party-jwt”. |
No |
sts |
STSConfig |
Specifies the configuration for Security Token Service. |
No |
revision |
string |
Configures the revision this control plane is a part of |
No |
mountMtlsCerts |
BoolValue |
Controls whether the in-cluster MTLS key and certs are loaded from the secret volume mounts. |
No |
defaultNodeSelector |
TypeMapStringInterface |
Default k8s node selector for all the Istio control plane components See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
defaultPodDisruptionBudget |
DefaultPodDisruptionBudgetConfig |
Specifies the default pod disruption budget configuration. |
No |
defaultResources |
DefaultResourcesConfig |
Default k8s resources settings for all Istio control plane components. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
defaultTolerations |
TypeSliceOfMapStringInterface |
No | |
priorityClassName |
string |
Specifies the k8s priorityClassName for the istio control plane components. See https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass |
No |
GlobalLoggingConfig specifies the global logging level settings for the Istio control plane components.
| Field | Type | Description | Required |
|---|---|---|---|
level |
string |
Comma-separated minimum per-scope logging level of messages to output, in the form of |
No |
Configuration for an ingress gateway.
| Field | Type | Description | Required |
|---|---|---|---|
autoscaleEnabled |
BoolValue |
Controls whether auto scaling with a HorizontalPodAutoscaler is enabled. |
No |
autoscaleMax |
uint32 |
maxReplicas setting for HorizontalPodAutoscaler. |
No |
autoscaleMin |
uint32 |
minReplicas setting for HorizontalPodAutoscaler. |
No |
connectTimeout |
string |
No | |
customService |
BoolValue |
No | |
debug |
string |
No | |
domain |
string |
No | |
drainDuration |
Duration |
No | |
enabled |
BoolValue |
Controls whether an ingress gateway is enabled. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the proxy container. |
No |
externalIPs |
string[] |
No | |
k8sIngress |
BoolValue |
No | |
k8sIngressHttps |
BoolValue |
No | |
labels |
GatewayLabelsConfig |
No | |
loadBalancerIP |
string |
No | |
loadBalancerSourceRanges |
string[] |
No | |
meshExpansionPorts |
PortsConfig[] |
No | |
ports |
PortsConfig[] |
Port Configuration for the ingress gateway. |
No |
sds |
IngressGatewaySdsConfig |
Secret Discovery Service (SDS) Configuration for ingress gateway. |
No |
secretVolumes |
SecretVolume[] |
Config for secret volume mounts. |
No |
serviceAnnotations |
TypeMapStringInterface |
Annotations to add to the egress gateway service. |
No |
type |
string |
Service type. See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
No |
zvpn |
IngressGatewayZvpnConfig |
Enables cross-cluster access using SNI matching. |
No |
applicationPorts |
string |
Ports to explicitly check for readiness |
No |
externalTrafficPolicy |
string |
No | |
ingressPorts |
TypeSliceOfMapStringInterface |
No | |
additionalContainers |
TypeSliceOfMapStringInterface |
No | |
configVolumes |
TypeSliceOfMapStringInterface |
No | |
certificates |
BoolValue |
No | |
tls |
BoolValue |
No | |
telemetryAddonGateways |
TypeMapStringInterface |
No | |
hosts |
TypeSliceOfMapStringInterface |
No | |
telemetryDomainName |
string |
No | |
cpu |
CPUTargetUtilizationConfig |
K8s utilization setting for HorizontalPodAutoscaler target. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
replicaCount |
uint32 |
Number of replicas for the ingress gateway Deployment. |
No |
resources |
TypeMapStringInterface |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
tolerations |
TypeSliceOfMapStringInterface |
No |
Secret Discovery Service (SDS) Configuration for ingress gateway.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
If true, ingress gateway fetches credentials from SDS server to handle TLS connections. |
No |
image |
string |
SDS server that watches kubernetes secrets and provisions credentials to ingress gateway. This server runs in the same pod as ingress gateway. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
IngressGatewayZvpnConfig enables cross-cluster access using SNI matching.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether ZeroVPN is enabled. |
No |
suffix |
string |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
If enabled, all control plane functionality will be handled by a single deployment. |
No |
Configuration for Kiali addon.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
createDemoSecret |
BoolValue |
No | |
hub |
string |
Image hub for kiali deployment. |
No |
tag |
TypeInterface |
Image tag for kiali deployment. |
No |
prometheusNamespace |
string |
No | |
security |
KialiSecurityConfig |
No | |
dashboard |
KialiDashboardConfig |
No | |
ingress |
KialiIngressConfig |
No | |
contextPath |
string |
No | |
replicaCount |
uint32 |
Number of replicas for Kiali. |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
Pod anti-affinity label selector. Specify the pod anti-affinity that allows you to constrain which nodes your pod is eligible to be scheduled based on labels on pods that are already running on the node rather than based on labels on nodes. There are currently two types of anti-affinity: “requiredDuringSchedulingIgnoredDuringExecution” “preferredDuringSchedulingIgnoredDuringExecution” which denote “hard” vs. “soft” requirements, you can define your values in “podAntiAffinityLabelSelector” and “podAntiAffinityTermLabelSelector” correspondingly. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity Examples: podAntiAffinityLabelSelector: - key: security operator: In values: S1,S2 topologyKey: “kubernetes.io/hostname” This pod anti-affinity rule says that the pod requires not to be scheduled onto a node if that node is already running a pod with label having key “security” and value “S1”. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See PodAntiAffinityLabelSelector. |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
image |
string |
No | |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
prometheusAddr |
string |
No |
| Field | Type | Description | Required |
|---|---|---|---|
secretName |
string |
No | |
usernameKey |
string |
No | |
passphraseKey |
string |
No | |
viewOnlyMode |
BoolValue |
No | |
grafanaURL |
string |
No | |
jaegerURL |
string |
No | |
auth |
TypeMapStringInterface |
No | |
grafanaInClusterURL |
string |
No | |
jaegerInClusterURL |
string |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
annotations |
TypeMapStringInterface |
No | |
tls |
TypeSliceOfMapStringInterface |
No | |
hosts |
string[] |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
certFile |
string |
No | |
privateKeyFile |
string |
No |
Configuration for Kubernetes environment adapter in mixer.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables the Kubernetes env adapter in Mixer. See: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/kubernetesenv/ |
No |
Configuration for the legacy kubernetes Ingress.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables gateway for legacy k8s Ingress. |
No |
enableHttps |
BoolValue |
Enables HTTPS legacy k8s Ingress. |
No |
gatewayName |
string |
Sets the gateway name for legacy k8s Ingress. |
No |
Configuration for when mixer starts rejecting grpc requests.
| Field | Type | Description | Required |
|---|---|---|---|
latencyThreshold |
string |
No | |
mode |
mode |
No |
MTLS settings for the applications that Istio manages.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables MTLS for service to service traffic. |
No |
auto |
BoolValue |
No |
Configuration for Istio mesh expansion to bare metal.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Exposes Pilot and Citadel mTLS on the ingress gateway. |
No |
useILB |
BoolValue |
Exposes Pilot and Citadel mTLS and the plain text Pilot ports on an internal gateway. |
No |
Configuration for Mixer.
| Field | Type | Description | Required |
|---|---|---|---|
policy |
MixerPolicyConfig |
MixerPolicyConfig is set of configurations for Mixer Policy |
No |
telemetry |
MixerTelemetryConfig |
MixerTelemetryConfig is set of configurations for Mixer Telemetry |
No |
adapters |
MixerTelemetryAdaptersConfig |
Configuration for different mixer adapters. |
No |
Configuration for Mixer Policy adapters.
| Field | Type | Description | Required |
|---|---|---|---|
kubernetesenv |
KubernetesEnvMixerAdapterConfig |
Configuration for Kubernetes environment adapter in mixer. |
No |
prometheus |
PrometheusMixerAdapterConfig |
Configuration for Prometheus adapter in mixer. |
No |
stdio |
StdioMixerAdapterConfig |
Configuration for stdio adapter in mixer, recommended for debug usage only. |
No |
stackdriver |
StackdriverMixerAdapterConfig |
No | |
useAdapterCRDs |
BoolValue |
Sets the –useAdapterCRDs mixer startup argument. |
No |
Configuration for Mixer Policy.
| Field | Type | Description | Required |
|---|---|---|---|
autoscaleEnabled |
BoolValue |
Controls whether a HorizontalPodAutoscaler is installed for Mixer Policy. |
No |
autoscaleMax |
uint32 |
Maximum number of replicas in the HorizontalPodAutoscaler for Mixer Policy. |
No |
autoscaleMin |
uint32 |
Minimum number of replicas in the HorizontalPodAutoscaler for Mixer Policy. |
No |
enabled |
BoolValue |
Controls whether Mixer Policy is enabled |
No |
image |
string |
Image name used for Mixer Policy. This can be set either to image name if hub is also set, or can be set to the full hub:name string. Examples: custom-mixer, docker.io/someuser:custom-mixer |
No |
adapters |
MixerPolicyAdaptersConfig |
Configuration for different mixer adapters. |
No |
sessionAffinityEnabled |
BoolValue |
Controls whether to enable the sticky session setting when choosing backend pods. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the Mixer container. Examples: env: ENVVAR1: value1 ENVVAR2: value2 |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
cpu |
CPUTargetUtilizationConfig |
Target CPU utilization used in HorizontalPodAutoscaler. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations to attach to mixer policy deployment See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
replicaCount |
uint32 |
Number of replicas in the Mixer Policy Deployment |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
tolerations |
TypeSliceOfMapStringInterface |
No |
Configuration for Mixer Telemetry adapters.
| Field | Type | Description | Required |
|---|---|---|---|
kubernetesenv |
KubernetesEnvMixerAdapterConfig |
Configuration for Kubernetes environment adapter in mixer. |
No |
prometheus |
PrometheusMixerAdapterConfig |
Configuration for Prometheus adapter in mixer. |
No |
stdio |
StdioMixerAdapterConfig |
Configuration for stdio adapter in mixer, recommended for debug usage only. |
No |
stackdriver |
StackdriverMixerAdapterConfig |
No | |
useAdapterCRDs |
BoolValue |
Sets the –useAdapterCRDs mixer startup argument. |
No |
Configuration for Mixer Telemetry.
| Field | Type | Description | Required |
|---|---|---|---|
autoscaleEnabled |
BoolValue |
Controls whether a HorizontalPodAutoscaler is installed for Mixer Telemetry. |
No |
autoscaleMax |
uint32 |
Maximum number of replicas in the HorizontalPodAutoscaler for Mixer Telemetry. |
No |
autoscaleMin |
uint32 |
Minimum number of replicas in the HorizontalPodAutoscaler for Mixer Telemetry. |
No |
enabled |
BoolValue |
Controls whether Mixer Telemetry is enabled. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the Mixer container. Examples: env: ENVVAR1: value1 ENVVAR2: value2 |
No |
image |
string |
Image name used for Mixer Telemetry. This can be set either to image name if hub is also set, or can be set to the full hub:name string. Examples: custom-mixer, docker.io/someuser:custom-mixer |
No |
loadshedding |
LoadSheddingConfig |
LoadSheddingConfig configs when mixer starts rejecting grpc requests. |
No |
useMCP |
BoolValue |
Controls whether to use of Mesh Configuration Protocol to distribute configuration. |
No |
reportBatchMaxTime |
string |
No | |
reportBatchMaxEntries |
uint32 |
No | |
sessionAffinityEnabled |
BoolValue |
Controls whether to enable the sticky session setting when choosing backend pods. |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
cpu |
CPUTargetUtilizationConfig |
Target CPU utilization used in HorizontalPodAutoscaler. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations to attach to mixer telemetry deployment See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
replicaCount |
uint32 |
Number of replicas in the Mixer Telemetry Deployment. |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
tolerations |
TypeSliceOfMapStringInterface |
No |
MultiClusterConfig specifies the Configuration for Istio mesh across multiple clusters through the istio gateways.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables the connection between two kubernetes clusters via their respective ingressgateway services. Use if the pods in each cluster cannot directly talk to one another. |
No |
clusterName |
string |
No |
Configuration for Node Agent Daemonset.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Node Agent is enabled. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the Node Agent container. Examples: env: ENVVAR1: value1 ENVVAR2: value2 |
No |
image |
string |
Image name for the Node Agent DaemonSet. |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
OutboundTrafficPolicyConfig controls the default behavior of the sidecar for handling outbound traffic from the application.
| Field | Type | Description | Required |
|---|---|---|---|
mode |
Mode |
No |
Specifies the sidecar’s default behavior when handling outbound traffic from the application.
| Name | Description |
|---|---|
ALLOW_ANY |
Outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntries for the destination port |
REGISTRY_ONLY |
Restrict outbound traffic to services defined in the service registry as well as those defined through ServiceEntries |
Configuration for Pilot.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Pilot is enabled. |
No |
autoscaleEnabled |
BoolValue |
Controls whether a HorizontalPodAutoscaler is installed for Pilot. |
No |
autoscaleMin |
uint32 |
Minimum number of replicas in the HorizontalPodAutoscaler for Pilot. |
No |
autoscaleMax |
uint32 |
Maximum number of replicas in the HorizontalPodAutoscaler for Pilot. |
No |
image |
string |
Image name used for Pilot. This can be set either to image name if hub is also set, or can be set to the full hub:name string. Examples: custom-pilot, docker.io/someuser:custom-pilot |
No |
sidecar |
BoolValue |
Controls whether a sidecar proxy is installed in the Pilot pod. Setting to true installs a proxy in the Pilot pod, used primarily for collecting Pilot telemetry. |
No |
traceSampling |
double |
Trace sampling fraction. Used to set the fraction of time that traces are sampled. Higher values are more accurate but add CPU overhead. Allowed values: 0.0 to 1.0 |
No |
configNamespace |
string |
Namespace that the configuration management feature is installed into, if different from Pilot namespace. |
No |
keepaliveMaxServerConnectionAge |
Duration |
Maximum duration that a sidecar can be connected to a pilot. This setting balances out load across pilot instances, but adds some resource overhead. Examples: 300s, 30m, 1h |
No |
deploymentLabels |
TypeMapStringInterface |
Labels that are added to Pilot pods. See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
No |
meshNetworks |
TypeMapStringInterface |
Used to override control plane networks. |
No |
configMap |
BoolValue |
Configuration settings passed to Pilot as a ConfigMap. This controls whether the mesh config map, generated from values.yaml is generated. If false, pilot wil use default values or user-supplied values, in that order of preference. |
No |
ingress |
PilotIngressConfig |
Controls legacy k8s ingress. Only one pilot profile should enable ingress support. |
No |
useMCP |
BoolValue |
Controls whether Pilot is configured through the Mesh Control Protocol (MCP). If set to true, Pilot requires an MCP server (like Galley) to be installed. |
No |
env |
TypeMapStringInterface |
Environment variables passed to the Pilot container. Examples: env: ENVVAR1: value1 ENVVAR2: value2 |
No |
policy |
PilotPolicyConfig |
Controls whether Istio policy is applied to Pilot. |
No |
appNamespaces |
TypeSliceOfMapStringInterface |
No | |
enableProtocolSniffingForOutbound |
BoolValue |
if protocol sniffing is enabled for outbound |
No |
enableProtocolSniffingForInbound |
BoolValue |
if protocol sniffing is enabled for inbound |
No |
configSource |
PilotConfigSource |
ConfigSource describes a source of configuration data for networking rules, and other Istio configuration artifacts. Multiple data sources can be configured for a single control plane. |
No |
jwksResolverExtraRootCA |
string |
No | |
plugins |
TypeSliceOfMapStringInterface |
No | |
hub |
string |
No | |
tag |
TypeInterface |
No | |
replicaCount |
uint32 |
Number of replicas in the Pilot Deployment. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
cpu |
CPUTargetUtilizationConfig |
Target CPU utilization used in HorizontalPodAutoscaler. See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
PilotConfigSource describes information about a configuration store inside a mesh. A single control plane instance can interact with one or more data sources.
| Field | Type | Description | Required |
|---|---|---|---|
subscribedResources |
string[] |
Describes the source of configuration, if nothing is specified default is MCP. |
No |
Controls legacy k8s ingress. Only one pilot profile should enable ingress support.
| Field | Type | Description | Required |
|---|---|---|---|
ingressService |
string |
Sets the type ingress service for Pilot. If empty, node-port is assumed. Allowed values: node-port, istio-ingressgateway, ingress |
No |
ingressControllerMode |
ingressControllerMode |
No | |
ingressClass |
string |
If mode is STRICT, this value must be set on “kubernetes.io/ingress.class” annotation to activate. |
No |
Controls whether Istio policy is applied to Pilot.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Istio policy is applied to Pilot. |
No |
Configuration for a port.
| Field | Type | Description | Required |
|---|---|---|---|
name |
string |
Port name. |
No |
port |
int32 |
Port number. |
No |
nodePort |
int32 |
NodePort number. |
No |
targetPort |
int32 |
Target port number. |
No |
Configuration for Prometheus.
| Field | Type | Description | Required |
|---|---|---|---|
createPrometheusResource |
BoolValue |
No | |
enabled |
BoolValue |
No | |
hub |
string |
No | |
tag |
TypeInterface |
No | |
retention |
string |
No | |
scrapeInterval |
Duration |
No | |
contextPath |
string |
No | |
ingress |
AddonIngressConfig |
No | |
service |
PrometheusServiceConfig |
No | |
security |
PrometheusSecurityConfig |
No | |
provisionPrometheusCert |
BoolValue |
Configure whether provisions a certificate to Prometheus through Istio Agent. When this option is set as true, a sidecar is deployed along Prometheus to provision a certificate through Istio Agent to Prometheus. The provisioned certificate is shared with Prometheus through mounted files. When this option is set as false, this certificate provisioning mechanism is disabled. |
No |
replicaCount |
uint32 |
No | |
nodeSelector |
TypeMapStringInterface |
GOSTRUCT: NodeSelector map[string]interface{} |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No | |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
datasources |
TypeSliceOfMapStringInterface |
No | |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
image |
string |
No |
Configuration for Prometheus adapter in mixer.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables the Prometheus adapter in Mixer. |
No |
metricsExpiryDuration |
Duration |
Sets the duration after which Prometheus registry purges a metric. See: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/prometheus/#Params |
No |
Configuration for Prometheus adapter security.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Prometheus security is enabled. |
No |
Configuration for Prometheus adapter service.
| Field | Type | Description | Required |
|---|---|---|---|
annotations |
TypeMapStringInterface |
No | |
nodePort |
PrometheusServiceNodePortConfig |
No |
Configuration for Prometheus Service NodePort.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Prometheus NodePort config is enabled. |
No |
port |
uint32 |
No |
Configuration for Proxy.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
accessLogFile |
string |
Specifies the path to write the sidecar access log file. |
No |
accessLogFormat |
string |
Configures how and what fields are displayed in sidecar access log. |
No |
accessLogEncoding |
accessLogEncoding |
No | |
autoInject |
string |
No | |
clusterDomain |
string |
Domain for the cluster, default: “cluster.local”. K8s allows this to be customized, see https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/ |
No |
componentLogLevel |
string |
Per Component log level for proxy, applies to gateways and sidecars. If a component level is not set, then the global “logLevel” will be used. If left empty, “misc:error” is used. |
No |
concurrency |
uint32 |
Controls number of proxy worker threads. If set to 0 (default), then start worker thread for each CPU thread/core. |
No |
dnsRefreshRate |
Duration |
Configures the DNS refresh rate for Envoy cluster of type STRICT_DNS. This must be given it terms of seconds. For example, 300s is valid but 5m is invalid. |
No |
enableCoreDump |
BoolValue |
Enables core dumps for newly injected sidecars. If set, newly injected sidecars will have core dumps enabled. |
No |
envoyMetricsService |
EnvoyMetricsConfig |
Configures Envoy Metrics Service. |
No |
envoyStatsd |
EnvoyMetricsConfig |
Configures statsd export in Envoy. |
No |
excludeInboundPorts |
string |
Specifies the Istio ingress ports not to capture. |
No |
excludeIPRanges |
string |
Lists the excluded IP ranges of Istio egress traffic that the sidecar captures. |
No |
image |
string |
Image name or path for the proxy, default: “proxyv2”. If registry or tag are not specified, global.hub and global.tag are used. Examples: my-proxy (uses global.hub/tag), docker.io/myrepo/my-proxy:v1.0.0 |
No |
includeInboundPorts |
string |
Specifies the Istio ingress ports to capture. Examples: “”: Redirect no inbound traffic to Envoy. “*”: Redirect all inbound traffic to Envoy. “80,8080”: Redirect only selected ports. |
No |
includeIPRanges |
string |
Lists the IP ranges of Istio egress traffic that the sidecar captures. Example: “172.30.0.0/16,172.20.0.0/16” This would only capture egress traffic on those two IP Ranges, all other outbound traffic would # be allowed by the sidecar.” |
No |
kubevirtInterfaces |
string |
Comma separated list of virtual interfaces whose inbound traffic (from VM) will be treated as outbound. By default, no interfaces are configured. |
No |
logLevel |
string |
Log level for proxy, applies to gateways and sidecars. If left empty, “warning” is used. Expected values are: trace|debug|info|warning|error|critical|off |
No |
privileged |
BoolValue |
Enables privileged securityContext for the istio-proxy container. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
No |
readinessInitialDelaySeconds |
uint32 |
Sets the initial delay for readiness probes in seconds. |
No |
readinessPeriodSeconds |
uint32 |
Sets the interval between readiness probes in seconds. |
No |
readinessFailureThreshold |
uint32 |
Sets the number of successive failed probes before indicating readiness failure. |
No |
statusPort |
uint32 |
Default port used for the Pilot agent’s health checks. |
No |
tracer |
tracer |
No | |
protocolDetectionTimeout |
string |
No | |
envoyAccessLogService |
EnvoyAccessLogConfig |
No | |
excludeOutboundPorts |
string |
No | |
drainDuration |
Duration |
No | |
connectTimeout |
string |
No | |
parentShutdownDuration |
Duration |
No | |
outlierLogPath |
string |
No | |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
enableCoreDumpImage |
string |
No |
Configuration for proxy_init container which sets the pods’ networking to intercept the inbound/outbound traffic.
| Field | Type | Description | Required |
|---|---|---|---|
image |
string |
Specifies the image for the proxy_init container. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
Mirrors Resources for unmarshaling.
| Field | Type | Description | Required |
|---|---|---|---|
limits |
map<string, string> |
No | |
requests |
map<string, string> |
No |
Configuration for K8s resource requests.
| Field | Type | Description | Required |
|---|---|---|---|
cpu |
string |
No | |
memory |
string |
No |
Configuration for the SecretDiscoveryService instead of using K8S secrets to mount the certificates.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether the SecretDiscoveryService is enabled. |
No |
udsPath |
string |
Specifies the Unix Domain Socket through which Envoy communicates with NodeAgent SDS to get key/cert for mTLS. |
No |
useNormalJwt |
BoolValue |
Enables SDS use of k8s normal JWT to request for certificates. |
No |
useTrustworthyJwt |
BoolValue |
Enables SDS use of trustworthy JWT to request for certificates. |
No |
token |
TypeMapStringInterface |
No |
Configuration for Security Token Service (STS) server.
See https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16
| Field | Type | Description | Required |
|---|---|---|---|
servicePort |
uint32 |
No |
Configuration for secret volume mounts.
See https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets.
| Field | Type | Description | Required |
|---|---|---|---|
mountPath |
string |
No | |
name |
string |
No | |
secretName |
string |
No |
Configuration for Citadel.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Citadel is enabled. |
No |
image |
string |
Image name used for Citadel. This can be set either to image name if hub is also set, or can be set to the full hub:name string. Examples: custom-citadel, docker.io/someuser:custom-citadel |
No |
selfSigned |
BoolValue |
Controls whether self-signed CA is used for citadel to generate the certificate/key pair. Setting to false if you want to use your own root CA for Citade Deployment. |
No |
trustDomain |
string |
The trust domain corresponds to the trust root of a system Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain Indicate the domain used in SPIFFE identity URL The default depends on the environment. kubernetes: cluster.local else: default dns domain |
No |
dnsCerts |
map<string, string> |
The DNS Certs specifies the customized DNS name and corresponding service account. Example: istio-pilot-service-account.istio-control: istio-pilot.istio-control.svc istio-galley-service-account.istio-config: istio-galley.istio-config.svc |
No |
createMeshPolicy |
BoolValue |
Controls whether the mesh-wide authentication policy is created or not. Setting to true creates the mesh-wide authentication policy with name “default”. |
No |
enableNamespacesByDefault |
BoolValue |
No | |
citadelHealthCheck |
BoolValue |
No | |
env |
TypeMapStringInterface |
No | |
workloadCertTtl |
string |
How long workload certs are valid for |
No |
replicaCount |
uint32 |
Number of replicas in the Citadel Deployment. |
No |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
No | |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
No |
ServiceConfig is described in istio.io documentation.
| Field | Type | Description | Required |
|---|---|---|---|
annotations |
TypeMapStringInterface |
No | |
externalPort |
uint32 |
No | |
name |
string |
No | |
type |
string |
No |
SidecarInjectorConfig is described in istio.io documentation.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether Sidecar Injector is enabled. |
No |
enableNamespacesByDefault |
BoolValue |
Enables sidecar auto-injection in namespaces by default. |
No |
image |
string |
Image name used for Sidecar Injector. This can be set either to image name if hub is also set, or can be set to the full hub:name string. Examples: custom-sidecarinjector, docker.io/someuser:custom-sidecarinjector |
No |
hub |
string |
No | |
tag |
TypeInterface |
No | |
neverInjectSelector |
TypeSliceOfMapStringInterface |
Instructs Istio to not inject the sidecar on those pods, based on labels that are present in those pods. Annotations in the pods have higher precedence than the label selectors. Order of evaluation: Pod Annotations → NeverInjectSelector → AlwaysInjectSelector → Default Policy. See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions |
No |
alwaysInjectSelector |
TypeSliceOfMapStringInterface |
See NeverInjectSelector. |
No |
rewriteAppHTTPProbe |
BoolValue |
If true, webhook or istioctl injector will rewrite PodSpec for liveness health check to redirect request to sidecar. This makes liveness check work even when mTLS is enabled. |
No |
selfSigned |
BoolValue |
Controls whether self-signed CA is used for Sidecar Injector to generate the certificate/key pair. Setting to false if you want to use your own root CA. |
No |
injectLabel |
string |
No | |
injectedAnnotations |
TypeMapStringInterface |
injectedAnnotations are additional annotations that will be added to the pod spec after injection This is primarily to support PSP annotations. |
No |
objectSelector |
TypeMapStringInterface |
Enable objectSelector to filter out pods with no need for sidecar before calling istio-sidecar-injector. |
No |
lifecycle |
TypeMapStringInterface |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. Each component can overwrite the default values by adding its node selector block in the relevant section and setting the desired values. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
replicaCount |
uint32 |
Number of replicas in the Sidecar Injector Deployment. |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
tolerations |
TypeSliceOfMapStringInterface |
No | |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
rollingMaxSurge |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
rollingMaxUnavailable |
TypeIntOrStringForPB |
K8s rolling update strategy |
No |
| Field | Type | Description | Required |
|---|---|---|---|
appCredentials |
BoolValue |
No | |
apiKey |
string |
No | |
serviceAccountPath |
string |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No |
Configuration for stackdriver adapter in mixer.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
auth |
StackdriverAuthConfig |
No | |
tracer |
StackdriverTracerConfig |
No | |
contextGraph |
StackdriverContextGraph |
No | |
logging |
EnabledConfig |
No | |
metrics |
EnabledConfig |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No |
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
sampleProbability |
uint32 |
No |
Configuration for stdio adapter in mixer, recommended for debug usage only.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enable stdio adapter to output logs and metrics to local machine. |
No |
outputAsJson |
BoolValue |
Whether to output a console-friendly or json-friendly format. |
No |
Controls telemetry configuration
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether telemetry is exported for Pilot. |
No |
v1 |
TelemetryV1Config |
Use telemetry v1. |
No |
v2 |
TelemetryV2Config |
Use telemetry v2. |
No |
Controls whether pilot will configure telemetry v1.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether pilot will configure telemetry v1. |
No |
Controls whether pilot will configure telemetry v2.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether pilot will configure telemetry v2. |
No |
prometheus |
TelemetryV2PrometheusConfig |
No | |
stackdriver |
TelemetryV2StackDriverConfig |
No |
Conrols telemetry v2 prometheus settings.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether stats envoyfilter would be enabled or not. |
No |
Conrols telemetry v2 stackdriver settings.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
No | |
logging |
BoolValue |
No | |
monitoring |
BoolValue |
No | |
topology |
BoolValue |
No | |
configOverride |
TypeMapStringInterface |
No |
Configuration for each of the supported tracers.
| Field | Type | Description | Required |
|---|---|---|---|
datadog |
TracerDatadogConfig |
Configuration for the datadog tracing service. |
No |
lightstep |
TracerLightStepConfig |
Configuration for the lightstep tracing service. |
No |
zipkin |
TracerZipkinConfig |
Configuration for the zipkin tracing service. |
No |
stackdriver |
TracerStackdriverConfig |
Configuration for the stackdriver tracing service. |
No |
Configuration for the datadog tracing service.
| Field | Type | Description | Required |
|---|---|---|---|
address |
string |
Address in host:port format for reporting trace data to the Datadog agent. |
No |
Configuration for the lightstep tracing service.
| Field | Type | Description | Required |
|---|---|---|---|
address |
string |
Sets the lightstep satellite pool address in host:port format for reporting trace data. |
No |
accessToken |
string |
Sets the lightstep access token. |
No |
cacertPath |
string |
Sets path to the file containing the cacert to use when verifying TLS. |
No |
secure |
BoolValue |
Enables lightstep secure connection. |
No |
Configuration for the stackdriver tracing service.
| Field | Type | Description | Required |
|---|---|---|---|
debug |
BoolValue |
enables trace output to stdout. |
No |
maxNumberOfAttributes |
uint32 |
The global default max number of attributes per span. |
No |
maxNumberOfAnnotations |
uint32 |
The global default max number of annotation events per span. |
No |
maxNumberOfMessageEvents |
uint32 |
The global default max number of message events per span. |
No |
Configuration for the zipkin tracing service.
| Field | Type | Description | Required |
|---|---|---|---|
address |
string |
Address of zipkin instance in host:port format for reporting trace data. Example: |
No |
Configurations for different tracing system to be installed.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables tracing systems installation. |
No |
ingress |
TracingIngressConfig |
Controls legacy k8s ingress for addon tracing components. |
No |
jaeger |
TracingJaegerConfig |
Defines Configuration for addon Jaeger tracing. |
No |
provider |
string |
Configures which tracing system to be installed. |
No |
service |
ServiceConfig |
Controls K8s service for addon tracing components. |
No |
zipkin |
TracingZipkinConfig |
Defines Configuration for addon Zipkin tracing. |
No |
opencensus |
TracingOpencensusConfig |
No | |
contextPath |
string |
No | |
nodeSelector |
TypeMapStringInterface |
K8s node selector. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
No |
podAntiAffinityLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
podAntiAffinityTermLabelSelector |
TypeSliceOfMapStringInterface |
See EgressGatewayConfig. |
No |
tolerations |
TypeSliceOfMapStringInterface |
No |
Controls legacy k8s ingress for addon tracing components.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Enables k8s ingress for addon tracing components. |
No |
annotations |
TypeMapStringInterface |
No | |
hosts |
string[] |
No | |
tls |
TypeMapStringInterface |
No |
Configuration for addon Jaeger tracing.
| Field | Type | Description | Required |
|---|---|---|---|
hub |
string |
Image hub for Jaeger tracing deployment. |
No |
tag |
TypeInterface |
Image tag for Jaeger tracing deployment. |
No |
image |
string |
No | |
memory |
TracingJaegerMemoryConfig |
Configures Jaeger in-memory storage setting. |
No |
spanStorageType |
string |
No | |
persist |
BoolValue |
No | |
storageClassName |
string |
No | |
accessMode |
string |
No | |
resources |
TypeMapStringInterface |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
Configuration for Jaeger in-memory storage setting.
| Field | Type | Description | Required |
|---|---|---|---|
maxTraces |
uint32 |
Set limit of the amount of traces stored in memory for Jaeger |
No |
| Field | Type | Description | Required |
|---|---|---|---|
hub |
string |
Image hub for Opencensus tracing deployment. |
No |
tag |
TypeInterface |
Image tag for Opencensus tracing deployment. |
No |
exporters |
TracingOpencensusExportersConfig |
No | |
resources |
TypeMapStringInterface |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
| Field | Type | Description | Required |
|---|---|---|---|
stackdriver |
TypeMapStringInterface |
No |
Configuration for Zipkin.
| Field | Type | Description | Required |
|---|---|---|---|
hub |
string |
Image hub for Zipkin tracing deployment. |
No |
tag |
TypeInterface |
Image tag for Zipkin tracing deployment. |
No |
image |
string |
No | |
probeStartupDelay |
uint32 |
InitialDelaySeconds of livenessProbe for Zipkin deployment |
No |
queryPort |
uint32 |
Container port for Zipkin deployment |
No |
javaOptsHeap |
uint32 |
Configure java heap opts for Zipkin deployment |
No |
maxSpans |
uint32 |
Configures number of max spans to keep in Zipkin memory storage. Example: A safe estimate is 1K of memory per span (each span with 2 annotations + 1 binary annotation), plus 100 MB for a safety buffer |
No |
node |
TracingZipkinNodeConfig |
Configures GC values of JAVA_OPTS for Zipkin deployment |
No |
resources |
Resources |
K8s resources settings. See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container |
No |
podAnnotations |
TypeMapStringInterface |
K8s annotations for pods. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
No |
Configuration for GC values of JAVA_OPTS for Zipkin deployment
| Field | Type | Description | Required |
|---|---|---|---|
cpus |
uint32 |
Configures -XX:ConcGCThreads value of JAVA_OPTS for Zipkin deployment |
No |
GOTYPE: *IntOrStringForPB
GOTYPE: interface{}
GOTYPE: map[string]interface{}
GOTYPE: []map[string]interface{}
| Field | Type | Description | Required |
|---|---|---|---|
certmanager |
CertManagerConfig |
No | |
cni |
CNIConfig |
No | |
istiocoredns |
CoreDNSConfig |
No | |
galley |
GalleyConfig |
No | |
gateways |
GatewaysConfig |
No | |
global |
GlobalConfig |
No | |
grafana |
TypeMapStringInterface |
No | |
mixer |
MixerConfig |
No | |
nodeagent |
NodeAgentConfig |
No | |
pilot |
PilotConfig |
No | |
telemetry |
TelemetryConfig |
Controls whether telemetry is exported for Pilot. |
No |
prometheus |
PrometheusConfig |
No | |
security |
SecurityConfig |
No | |
sidecarInjectorWebhook |
SidecarInjectorConfig |
No | |
tracing |
TracingConfig |
No | |
kiali |
KialiConfig |
No | |
version |
string |
Deprecated. |
No |
clusterResources |
BoolValue |
No | |
prometheusOperator |
TypeMapStringInterface |
TODO: populate these. |
No |
istioCni |
CNIConfig |
No | |
kustomize |
BoolValue |
No | |
revision |
string |
No |
ZeroVPNConfig enables cross-cluster access using SNI matching.
| Field | Type | Description | Required |
|---|---|---|---|
enabled |
BoolValue |
Controls whether ZeroVPN is enabled. |
No |
suffix |
string |
No |
Configures the access log for sidecar to JSON or TEXT
| Name | Description |
|---|---|
JSON |
|
TEXT |
Mode for the ingress controller.
| Name | Description |
|---|---|
DEFAULT |
Selects all Ingress resources, with or without Istio annotation. |
STRICT |
Selects only resources with istio annotation. |
OFF |
No ingress or sync. |
Throttling behavior for mixer.
| Name | Description |
|---|---|
disabled |
Removes throttling behavior for mixer. |
log_only |
Enables an advisory mode for throttling behavior for mixer. |
enforce |
Turn on throttling behavior for mixer. |
Specifies which tracer to use.
| Name | Description |
|---|---|
zipkin |
|
lightstep |
|
datadog |
|
stackdriver |