--- title: v1alpha1 layout: protoc-gen-docs generator: protoc-gen-docs number_of_entries: 96 ---

AddonIngressConfig

Configuration for the addon ingress.

Field Type Description Required
enabled BoolValue

Controls whether addon ingress is enabled.

No
hosts string[] No
annotations TypeMapStringInterface No
tls TypeMapStringInterface No

ArchConfig

ArchConfig specifies the pod scheduling target architecture(amd64, ppc64le, s390x) for all the Istio control plane components.

Field Type Description Required
amd64 uint32

Sets pod scheduling weight for amd64 arch

No
ppc64le uint32

Sets pod scheduling weight for ppc64le arch.

No
s390x uint32

Sets pod scheduling weight for s390x arch.

No

CNIConfig

Configuration for CNI.

Field Type Description Required
enabled BoolValue

Controls whether CNI is enabled.

No
hub string No
tag TypeInterface No
image string No
pullPolicy string No
cniBinDir string No
cniConfDir string No
cniConfFileName string No
excludeNamespaces string[] No
pspClusterRole string No
logLevel string No
repair CNIRepairConfig No
chained BoolValue No
podAnnotations TypeMapStringInterface No

CNIRepairConfig

Field Type Description Required
enabled BoolValue

Controls whether repair behavior is enabled.

No
hub string No
tag TypeInterface No
image string No
labelPods bool

Controls whether various repair behaviors are enabled.

No
deletePods bool No
brokenPodLabelKey string No
brokenPodLabelValue string No
initContainerName string No
createEvents string No

CPUTargetUtilizationConfig

Configuration for CPU target utilization for HorizontalPodAutoscaler target.

Field Type Description Required
targetAverageUtilization int32

K8s utilization setting for HorizontalPodAutoscaler target.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No

CertManagerConfig

Configuration for CertManager.

Field Type Description Required
enabled BoolValue

Controls whether CertManager is enabled.

No
hub string

Image hub for the CertManager Deployment.

No
tag TypeInterface

Image tag for the CertManager Deployment.

No
image string

Image name for the CertManager Deployment.

No
email string No
extraArgs string[] No
podDnsPolicy string No
podDnsConfig TypeMapStringInterface No
replicaCount uint32 No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
tolerations TypeSliceOfMapStringInterface No
podAnnotations TypeMapStringInterface No
podLabels TypeMapStringInterface No

CoreDNSConfig

Configuration for Core DNS.

Field Type Description Required
enabled BoolValue

Controls whether CoreDNS is enabled.

No
coreDNSImage string

Image for Core DNS.

No
coreDNSTag string No
coreDNSPluginImage string No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
replicaCount uint32

Number of replicas for Core DNS.

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
tolerations TypeSliceOfMapStringInterface No

DefaultPodDisruptionBudgetConfig

DefaultPodDisruptionBudgetConfig specifies the default pod disruption budget configuration.

See https://kubernetes.io/docs/concepts/workloads/pods/disruptions/

Field Type Description Required
enabled BoolValue

Controls whether a PodDisruptionBudget with a default minAvailable value of 1 is created for each deployment.

No

DefaultResourcesConfig

DefaultResourcesConfig specifies the default k8s resources settings for all Istio control plane components.

Field Type Description Required
requests ResourcesRequestsConfig

k8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No

EgressGatewayConfig

Configuration for an egress gateway.

Field Type Description Required
autoscaleEnabled BoolValue

Controls whether auto scaling with a HorizontalPodAutoscaler is enabled.

No
autoscaleMax uint32

maxReplicas setting for HorizontalPodAutoscaler.

No
autoscaleMin uint32

minReplicas setting for HorizontalPodAutoscaler.

No
connectTimeout string No
drainDuration Duration No
enabled BoolValue

Controls whether an egress gateway is enabled.

No
env TypeMapStringInterface

Environment variables passed to the proxy container.

No
labels GatewayLabelsConfig No
name string No
ports PortsConfig[]

Ports Configuration for the egress gateway service.

No
secretVolumes SecretVolume[]

Config for secret volume mounts.

No
serviceAnnotations TypeMapStringInterface

Annotations to add to the egress gateway service.

No
type string

Service type.

See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

No
zvpn ZeroVPNConfig

Enables cross-cluster access using SNI matching.

No
configVolumes TypeSliceOfMapStringInterface No
additionalContainers TypeSliceOfMapStringInterface No
cpu CPUTargetUtilizationConfig

K8s utilization setting for HorizontalPodAutoscaler target.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

Pod anti-affinity label selector.

Specify the pod anti-affinity that allows you to constrain which nodes your pod is eligible to be scheduled based on labels on pods that are already running on the node rather than based on labels on nodes. There are currently two types of anti-affinity: “requiredDuringSchedulingIgnoredDuringExecution” “preferredDuringSchedulingIgnoredDuringExecution” which denote “hard” vs. “soft” requirements, you can define your values in “podAntiAffinityLabelSelector” and “podAntiAffinityTermLabelSelector” correspondingly. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

Examples: podAntiAffinityLabelSelector: - key: security operator: In values: S1,S2 topologyKey: “kubernetes.io/hostname” This pod anti-affinity rule says that the pod requires not to be scheduled onto a node if that node is already running a pod with label having key “security” and value “S1”.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See PodAntiAffinityLabelSelector.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
tolerations TypeSliceOfMapStringInterface No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No

EnvoyAccessLogConfig

Field Type Description Required
enabled BoolValue No
host string No
port string No
tlsSettings EnvoyAccessLogtlsSettings No
tcpKeepalive TypeMapStringInterface No

EnvoyAccessLogtlsSettings

Field Type Description Required
mode string No
clientCertificate string No
privateKey string No
caCertificates string No
sni string No
subjectAltNames string[] No

EnvoyMetricsConfig

EnvoyMetricsConfig is a set of configuration options for Envoy metrics.

Field Type Description Required
enabled BoolValue

Enables the Envoy Metrics Service.

No
host string

Sets the destination Envoy Metrics Service address in Envoy.

No
port int32

Sets the destination Envoy Metrics Service port in Envoy.

No
tlsSettings TypeMapStringInterface No
tcpKeepalive TypeMapStringInterface No

GalleyConfig

GalleyConfig is a set of Configuration for Galley.

Field Type Description Required
enabled BoolValue

Controls whether Galley is enabled

No
image string

Image name used for Galley.

This can be set either to image name if hub is also set in global.hub, or can be set to the full hub:name string.

Examples: custom-galley, docker.io/someuser:custom-galley

No
mesh map<string, string>

TODO: Galley appears to use the mesh config - need to find which fields are used and need to be configured (https://github.com/istio/istio/issues/15865).

No
enableAnalysis BoolValue

Enable analysis and status update in Galley

No
hub string No
tag TypeInterface No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
replicaCount uint32

Number of replicas in the Galley Deployment.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
tolerations TypeSliceOfMapStringInterface No
enableServiceDiscovery BoolValue No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface No

GatewayLabelsConfig

GatewayLabelsConfig is a set of Configuration for gateway labels.

Field Type Description Required
app string No
istio string No

GatewaysConfig

Configuration for gateways.

Field Type Description Required
istioEgressgateway EgressGatewayConfig

Configuration for an egress gateway.

No
enabled BoolValue

Controls whether any gateways are enabled.

No
istioIngressgateway IngressGatewayConfig

Configuration for an ingress gateway.

No

GlobalConfig

Global Configuration for Istio components.

Field Type Description Required
arch ArchConfig

Specifies pod scheduling arch(amd64, ppc64le, s390x) and weight as follows: 0 - Never scheduled 1 - Least preferred 2 - No preference 3 - Most preferred

No
certificates TypeSliceOfMapStringInterface No
configNamespace string

Specifies the namespace for the configuration and validation component.

No
configRootNamespace string No
configValidation BoolValue

Controls whether the server-side validation is enabled.

No
controlPlaneSecurityEnabled BoolValue

Controls whether the MTLS for communication between the control plane components is enabled.

No
defaultConfigVisibilitySettings string[] No
disablePolicyChecks BoolValue

Controls whether the policy enforcement is enabled.

No
enableHelmTest BoolValue

Controls whether the helm test templates are enabled.

No
enableTracing BoolValue

Controls whether the distributed tracing for the applications is enabled.

See https://opentracing.io/docs/overview/what-is-tracing/

No
hub string

Specifies the docker hub for Istio images.

No
imagePullPolicy string

Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.

More info: https://kubernetes.io/docs/concepts/containers/images#updating-images

No
imagePullSecrets string[] No
istioNamespace string

Specifies the default namespace for the Istio control plane components.

No
localityLbSetting TypeMapStringInterface

Specifies the global locality load balancing settings. Locality-weighted load balancing allows administrators to control the distribution of traffic to endpoints based on the localities of where the traffic originates and where it will terminate. Please set either failover or distribute configuration but not both.

localityLbSetting: distribute: - from: “us-central1/” to: “us-central1/”: 80 “us-central2/*”: 20

localityLbSetting: failover: - from: us-east to: eu-west - from: us-west to: us-east

No
k8sIngress KubernetesIngressConfig

Specifies the Configuration for the legacy kubernetes Ingress.

No
logAsJson BoolValue No
logging GlobalLoggingConfig

Specifies the global logging level settings for the Istio control plane components.

No
meshExpansion MeshExpansionConfig

Specifies the Configuration for Istio mesh expansion to bare metal.

No
meshID string No
meshNetworks TypeMapStringInterface

Configure the mesh networks to be used by the Split Horizon EDS.

The following example defines two networks with different endpoints association methods. For network1 all endpoints that their IP belongs to the provided CIDR range will be mapped to network1. The gateway for this network example is specified by its public IP address and port. The second network, network2, in this example is defined differently with all endpoints retrieved through the specified Multi-Cluster registry being mapped to network2. The gateway is also defined differently with the name of the gateway service on the remote cluster. The public IP for the gateway will be determined from that remote service (only LoadBalancer gateway service type is currently supported, for a NodePort type gateway service, it still need to be configured manually).

meshNetworks: network1: endpoints: - fromCidr: “192.168.0.124” gateways: - address: 1.1.1.1 port: 80 network2: endpoints: - fromRegistry: reg1 gateways: - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local port: 443

No
monitoringPort uint32

Specifies the monitor port number for all Istio control plane components.

No
mtls MTLSConfig

Specifies the MTLS settings for the applications that Istio manages.

No
multiCluster MultiClusterConfig

Specifies the Configuration for Istio mesh across multiple clusters through Istio gateways.

No
network string No
podDNSSearchNamespaces string[]

Custom DNS config for the pod to resolve names of services in other clusters. Use this to add additional search domains, and other settings. see https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config This does not apply to gateway pods as they typically need a different set of DNS settings than the normal application pods (e.g. in multicluster scenarios).

No
omitSidecarInjectorConfigMap BoolValue No
oneNamespace BoolValue

Controls whether to restrict the applications namespace the controller manages; If set it to false, the controller watches all namespaces.

No
operatorManageWebhooks BoolValue No
outboundTrafficPolicy OutboundTrafficPolicyConfig

Controls the default behavior of the sidecar for handling outbound traffic from the application.

No
policyCheckFailOpen BoolValue

Controls whether to allow traffic in cases when the mixer policy service cannot be reached.

No
policyNamespace string

Specifies the namespace for the policy component.

No
prometheusNamespace string No
proxy ProxyConfig

Specifies how proxies are configured within Istio.

No
proxyInit ProxyInitConfig

Specifies the Configuration for proxy_init container which sets the pods’ networking to intercept the inbound/outbound traffic.

No
sds SDSConfig

Specifies the Configuration for the SecretDiscoveryService instead of using K8S secrets to mount the certificates.

No
tag TypeInterface

Specifies the tag for the Istio docker images.

No
telemetryNamespace string

Specifies the namespace for the telemetry component.

No
tracer TracerConfig

Specifies the Configuration for each of the supported tracers.

No
trustDomain string

Specifies the trust domain that corresponds to the root cert of CA.

No
trustDomainAliases string[]

The trust domain aliases represent the aliases of trustDomain.

No
useMCP BoolValue

Controls whether to use of Mesh Configuration Protocol to distribute configuration.

No
istioRemote BoolValue

Settings for remote cluster. Controls whether to use the Istio remote control plane

No
createRemoteSvcEndpoints BoolValue No
remotePilotCreateSvcEndpoint BoolValue

If set, a selector-less service and endpoint for istio-pilot are created with the remotePilotAddress IP, which ensures the istio-pilot. is DNS resolvable in the remote cluster.

No
remotePolicyAddress string

Specifies the Istio control plane’s policy Pod IP address or remote cluster DNS resolvable hostname.

No
remotePilotAddress string

Specifies the Istio control plane’s pilot Pod IP address or remote cluster DNS resolvable hostname.

No
remoteTelemetryAddress string

Specifies the Istio control plane’s telemetry Pod IP address or remote cluster DNS resolvable hostname

No
istiod IstiodConfig

Specifies the configution of istiod

No
pilotCertProvider string

Configure the Pilot certificate provider. Currently, two providers are supported: “kubernetes” and “citadel”.

No
jwtPolicy string

Configure the policy for validating JWT. Currently, two options are supported: “third-party-jwt” and “first-party-jwt”.

No
sts STSConfig

Specifies the configuration for Security Token Service.

No
revision string

Configures the revision this control plane is a part of

No
mountMtlsCerts BoolValue

Controls whether the in-cluster MTLS key and certs are loaded from the secret volume mounts.

No
caAddress string

The address of the CA for CSR.

No
defaultNodeSelector TypeMapStringInterface

Default k8s node selector for all the Istio control plane components

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
defaultPodDisruptionBudget DefaultPodDisruptionBudgetConfig

Specifies the default pod disruption budget configuration.

No
defaultResources DefaultResourcesConfig

Default k8s resources settings for all Istio control plane components.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
defaultTolerations TypeSliceOfMapStringInterface No
priorityClassName string

Specifies the k8s priorityClassName for the istio control plane components.

See https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass

No

GlobalLoggingConfig

GlobalLoggingConfig specifies the global logging level settings for the Istio control plane components.

Field Type Description Required
level string

Comma-separated minimum per-scope logging level of messages to output, in the form of :,: The control plane has different scopes depending on component, but can configure default log level across all components If empty, default scope and level will be used as configured in code

No

IngressGatewayConfig

Configuration for an ingress gateway.

Field Type Description Required
autoscaleEnabled BoolValue

Controls whether auto scaling with a HorizontalPodAutoscaler is enabled.

No
autoscaleMax uint32

maxReplicas setting for HorizontalPodAutoscaler.

No
autoscaleMin uint32

minReplicas setting for HorizontalPodAutoscaler.

No
connectTimeout string No
customService BoolValue No
debug string No
domain string No
drainDuration Duration No
enabled BoolValue

Controls whether an ingress gateway is enabled.

No
env TypeMapStringInterface

Environment variables passed to the proxy container.

No
externalIPs string[] No
k8sIngress BoolValue No
k8sIngressHttps BoolValue No
labels GatewayLabelsConfig No
loadBalancerIP string No
loadBalancerSourceRanges string[] No
meshExpansionPorts PortsConfig[] No
name string No
ports PortsConfig[]

Port Configuration for the ingress gateway.

No
sds IngressGatewaySdsConfig

Secret Discovery Service (SDS) Configuration for ingress gateway.

No
secretVolumes SecretVolume[]

Config for secret volume mounts.

No
serviceAnnotations TypeMapStringInterface

Annotations to add to the egress gateway service.

No
type string

Service type.

See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

No
zvpn IngressGatewayZvpnConfig

Enables cross-cluster access using SNI matching.

No
applicationPorts string

Ports to explicitly check for readiness

No
externalTrafficPolicy string No
ingressPorts TypeSliceOfMapStringInterface No
additionalContainers TypeSliceOfMapStringInterface No
configVolumes TypeSliceOfMapStringInterface No
certificates BoolValue No
tls BoolValue No
telemetryAddonGateways TypeMapStringInterface No
hosts TypeSliceOfMapStringInterface No
telemetryDomainName string No
cpu CPUTargetUtilizationConfig

K8s utilization setting for HorizontalPodAutoscaler target.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
replicaCount uint32

Number of replicas for the ingress gateway Deployment.

No
resources TypeMapStringInterface

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
tolerations TypeSliceOfMapStringInterface No

IngressGatewaySdsConfig

Secret Discovery Service (SDS) Configuration for ingress gateway.

Field Type Description Required
enabled BoolValue

If true, ingress gateway fetches credentials from SDS server to handle TLS connections.

No
image string

SDS server that watches kubernetes secrets and provisions credentials to ingress gateway. This server runs in the same pod as ingress gateway.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No

IngressGatewayZvpnConfig

IngressGatewayZvpnConfig enables cross-cluster access using SNI matching.

Field Type Description Required
enabled BoolValue

Controls whether ZeroVPN is enabled.

No
suffix string No

IstiodConfig

Field Type Description Required
enabled BoolValue

If enabled, all control plane functionality will be handled by a single deployment.

No

KialiConfig

Configuration for Kiali addon.

Field Type Description Required
enabled BoolValue No
createDemoSecret BoolValue No
hub string

Image hub for kiali deployment.

No
tag TypeInterface

Image tag for kiali deployment.

No
prometheusNamespace string No
security KialiSecurityConfig No
dashboard KialiDashboardConfig No
ingress KialiIngressConfig No
contextPath string No
service KialiServiceConfig No
replicaCount uint32

Number of replicas for Kiali.

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

Pod anti-affinity label selector.

Specify the pod anti-affinity that allows you to constrain which nodes your pod is eligible to be scheduled based on labels on pods that are already running on the node rather than based on labels on nodes. There are currently two types of anti-affinity: “requiredDuringSchedulingIgnoredDuringExecution” “preferredDuringSchedulingIgnoredDuringExecution” which denote “hard” vs. “soft” requirements, you can define your values in “podAntiAffinityLabelSelector” and “podAntiAffinityTermLabelSelector” correspondingly. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

Examples: podAntiAffinityLabelSelector: - key: security operator: In values: S1,S2 topologyKey: “kubernetes.io/hostname” This pod anti-affinity rule says that the pod requires not to be scheduled onto a node if that node is already running a pod with label having key “security” and value “S1”.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See PodAntiAffinityLabelSelector.

No
tolerations TypeSliceOfMapStringInterface No
image string No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
prometheusAddr string No

KialiDashboardConfig

Field Type Description Required
secretName string No
usernameKey string No
passphraseKey string No
viewOnlyMode BoolValue No
grafanaURL string No
jaegerURL string No
auth TypeMapStringInterface No
grafanaInClusterURL string No
jaegerInClusterURL string No

KialiIngressConfig

Field Type Description Required
enabled BoolValue No
annotations TypeMapStringInterface No
tls TypeSliceOfMapStringInterface No
hosts string[] No

KialiSecurityConfig

Field Type Description Required
enabled BoolValue No
certFile string No
privateKeyFile string No

KialiServiceConfig

Field Type Description Required
annotations TypeMapStringInterface No
type string

Service type.

See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

No

KubernetesEnvMixerAdapterConfig

Configuration for Kubernetes environment adapter in mixer.

Field Type Description Required
enabled BoolValue

Enables the Kubernetes env adapter in Mixer.

See: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/kubernetesenv/

No

KubernetesIngressConfig

Configuration for the legacy kubernetes Ingress.

Field Type Description Required
enabled BoolValue

Enables gateway for legacy k8s Ingress.

No
enableHttps BoolValue

Enables HTTPS legacy k8s Ingress.

No
gatewayName string

Sets the gateway name for legacy k8s Ingress.

No

LoadSheddingConfig

Configuration for when mixer starts rejecting grpc requests.

Field Type Description Required
latencyThreshold string No
mode mode No

MTLSConfig

MTLS settings for the applications that Istio manages.

Field Type Description Required
enabled BoolValue

Enables MTLS for service to service traffic.

No
auto BoolValue No

MeshExpansionConfig

Configuration for Istio mesh expansion to bare metal.

Field Type Description Required
enabled BoolValue

Exposes Pilot and Citadel mTLS on the ingress gateway.

No
useILB BoolValue

Exposes Pilot and Citadel mTLS and the plain text Pilot ports on an internal gateway.

No

MixerConfig

Configuration for Mixer.

Field Type Description Required
policy MixerPolicyConfig

MixerPolicyConfig is set of configurations for Mixer Policy

No
telemetry MixerTelemetryConfig

MixerTelemetryConfig is set of configurations for Mixer Telemetry

No
adapters MixerTelemetryAdaptersConfig

Configuration for different mixer adapters.

No

MixerPolicyAdaptersConfig

Configuration for Mixer Policy adapters.

Field Type Description Required
kubernetesenv KubernetesEnvMixerAdapterConfig

Configuration for Kubernetes environment adapter in mixer.

No
prometheus PrometheusMixerAdapterConfig

Configuration for Prometheus adapter in mixer.

No
stdio StdioMixerAdapterConfig

Configuration for stdio adapter in mixer, recommended for debug usage only.

No
stackdriver StackdriverMixerAdapterConfig No
useAdapterCRDs BoolValue

Sets the –useAdapterCRDs mixer startup argument.

No

MixerPolicyConfig

Configuration for Mixer Policy.

Field Type Description Required
autoscaleEnabled BoolValue

Controls whether a HorizontalPodAutoscaler is installed for Mixer Policy.

No
autoscaleMax uint32

Maximum number of replicas in the HorizontalPodAutoscaler for Mixer Policy.

No
autoscaleMin uint32

Minimum number of replicas in the HorizontalPodAutoscaler for Mixer Policy.

No
enabled BoolValue

Controls whether Mixer Policy is enabled

No
image string

Image name used for Mixer Policy.

This can be set either to image name if hub is also set, or can be set to the full hub:name string.

Examples: custom-mixer, docker.io/someuser:custom-mixer

No
adapters MixerPolicyAdaptersConfig

Configuration for different mixer adapters.

No
sessionAffinityEnabled BoolValue

Controls whether to enable the sticky session setting when choosing backend pods.

No
env TypeMapStringInterface

Environment variables passed to the Mixer container.

Examples: env: ENVVAR1: value1 ENVVAR2: value2

No
hub string No
tag TypeInterface No
cpu CPUTargetUtilizationConfig

Target CPU utilization used in HorizontalPodAutoscaler.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No
podAnnotations TypeMapStringInterface

K8s annotations to attach to mixer policy deployment

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
replicaCount uint32

Number of replicas in the Mixer Policy Deployment

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
tolerations TypeSliceOfMapStringInterface No

MixerTelemetryAdaptersConfig

Configuration for Mixer Telemetry adapters.

Field Type Description Required
kubernetesenv KubernetesEnvMixerAdapterConfig

Configuration for Kubernetes environment adapter in mixer.

No
prometheus PrometheusMixerAdapterConfig

Configuration for Prometheus adapter in mixer.

No
stdio StdioMixerAdapterConfig

Configuration for stdio adapter in mixer, recommended for debug usage only.

No
stackdriver StackdriverMixerAdapterConfig No
useAdapterCRDs BoolValue

Sets the –useAdapterCRDs mixer startup argument.

No

MixerTelemetryConfig

Configuration for Mixer Telemetry.

Field Type Description Required
autoscaleEnabled BoolValue

Controls whether a HorizontalPodAutoscaler is installed for Mixer Telemetry.

No
autoscaleMax uint32

Maximum number of replicas in the HorizontalPodAutoscaler for Mixer Telemetry.

No
autoscaleMin uint32

Minimum number of replicas in the HorizontalPodAutoscaler for Mixer Telemetry.

No
enabled BoolValue

Controls whether Mixer Telemetry is enabled.

No
env TypeMapStringInterface

Environment variables passed to the Mixer container.

Examples: env: ENVVAR1: value1 ENVVAR2: value2

No
image string

Image name used for Mixer Telemetry.

This can be set either to image name if hub is also set, or can be set to the full hub:name string.

Examples: custom-mixer, docker.io/someuser:custom-mixer

No
loadshedding LoadSheddingConfig

LoadSheddingConfig configs when mixer starts rejecting grpc requests.

No
useMCP BoolValue

Controls whether to use of Mesh Configuration Protocol to distribute configuration.

No
reportBatchMaxTime string No
reportBatchMaxEntries uint32 No
sessionAffinityEnabled BoolValue

Controls whether to enable the sticky session setting when choosing backend pods.

No
hub string No
tag TypeInterface No
cpu CPUTargetUtilizationConfig

Target CPU utilization used in HorizontalPodAutoscaler.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface

K8s annotations to attach to mixer telemetry deployment

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
replicaCount uint32

Number of replicas in the Mixer Telemetry Deployment.

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
tolerations TypeSliceOfMapStringInterface No

MultiClusterConfig

MultiClusterConfig specifies the Configuration for Istio mesh across multiple clusters through the istio gateways.

Field Type Description Required
enabled BoolValue

Enables the connection between two kubernetes clusters via their respective ingressgateway services. Use if the pods in each cluster cannot directly talk to one another.

No
clusterName string No

NodeAgentConfig

Configuration for Node Agent Daemonset.

Field Type Description Required
enabled BoolValue

Controls whether Node Agent is enabled.

No
env TypeMapStringInterface

Environment variables passed to the Node Agent container.

Examples: env: ENVVAR1: value1 ENVVAR2: value2

No
image string

Image name for the Node Agent DaemonSet.

No
hub string No
tag TypeInterface No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
tolerations TypeSliceOfMapStringInterface No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No

OutboundTrafficPolicyConfig

OutboundTrafficPolicyConfig controls the default behavior of the sidecar for handling outbound traffic from the application.

Field Type Description Required
mode Mode No

OutboundTrafficPolicyConfig.Mode

Specifies the sidecar’s default behavior when handling outbound traffic from the application.

Name Description
ALLOW_ANY

Outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntries for the destination port

REGISTRY_ONLY

Restrict outbound traffic to services defined in the service registry as well as those defined through ServiceEntries

PilotConfig

Configuration for Pilot.

Field Type Description Required
enabled BoolValue

Controls whether Pilot is enabled.

No
autoscaleEnabled BoolValue

Controls whether a HorizontalPodAutoscaler is installed for Pilot.

No
autoscaleMin uint32

Minimum number of replicas in the HorizontalPodAutoscaler for Pilot.

No
autoscaleMax uint32

Maximum number of replicas in the HorizontalPodAutoscaler for Pilot.

No
image string

Image name used for Pilot.

This can be set either to image name if hub is also set, or can be set to the full hub:name string.

Examples: custom-pilot, docker.io/someuser:custom-pilot

No
sidecar BoolValue

Controls whether a sidecar proxy is installed in the Pilot pod.

Setting to true installs a proxy in the Pilot pod, used primarily for collecting Pilot telemetry.

No
traceSampling double

Trace sampling fraction.

Used to set the fraction of time that traces are sampled. Higher values are more accurate but add CPU overhead.

Allowed values: 0.0 to 1.0

No
configNamespace string

Namespace that the configuration management feature is installed into, if different from Pilot namespace.

No
keepaliveMaxServerConnectionAge Duration

Maximum duration that a sidecar can be connected to a pilot.

This setting balances out load across pilot instances, but adds some resource overhead.

Examples: 300s, 30m, 1h

No
deploymentLabels TypeMapStringInterface

Labels that are added to Pilot pods.

See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

No
meshNetworks TypeMapStringInterface

Used to override control plane networks.

No
configMap BoolValue

Configuration settings passed to Pilot as a ConfigMap.

This controls whether the mesh config map, generated from values.yaml is generated. If false, pilot wil use default values or user-supplied values, in that order of preference.

No
ingress PilotIngressConfig

Controls legacy k8s ingress. Only one pilot profile should enable ingress support.

No
useMCP BoolValue

Controls whether Pilot is configured through the Mesh Control Protocol (MCP).

If set to true, Pilot requires an MCP server (like Galley) to be installed.

No
env TypeMapStringInterface

Environment variables passed to the Pilot container.

Examples: env: ENVVAR1: value1 ENVVAR2: value2

No
policy PilotPolicyConfig

Controls whether Istio policy is applied to Pilot.

No
appNamespaces TypeSliceOfMapStringInterface No
enableProtocolSniffingForOutbound BoolValue

if protocol sniffing is enabled for outbound

No
enableProtocolSniffingForInbound BoolValue

if protocol sniffing is enabled for inbound

No
configSource PilotConfigSource

ConfigSource describes a source of configuration data for networking rules, and other Istio configuration artifacts. Multiple data sources can be configured for a single control plane.

No
jwksResolverExtraRootCA string No
plugins TypeSliceOfMapStringInterface No
hub string No
tag TypeInterface No
replicaCount uint32

Number of replicas in the Pilot Deployment.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
cpu CPUTargetUtilizationConfig

Target CPU utilization used in HorizontalPodAutoscaler.

See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
tolerations TypeSliceOfMapStringInterface No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No

PilotConfigSource

PilotConfigSource describes information about a configuration store inside a mesh. A single control plane instance can interact with one or more data sources.

Field Type Description Required
subscribedResources string[]

Describes the source of configuration, if nothing is specified default is MCP.

No

PilotIngressConfig

Controls legacy k8s ingress. Only one pilot profile should enable ingress support.

Field Type Description Required
ingressService string

Sets the type ingress service for Pilot.

If empty, node-port is assumed.

Allowed values: node-port, istio-ingressgateway, ingress

No
ingressControllerMode ingressControllerMode No
ingressClass string

If mode is STRICT, this value must be set on “kubernetes.io/ingress.class” annotation to activate.

No

PilotPolicyConfig

Controls whether Istio policy is applied to Pilot.

Field Type Description Required
enabled BoolValue

Controls whether Istio policy is applied to Pilot.

No

PortsConfig

Configuration for a port.

Field Type Description Required
name string

Port name.

No
port int32

Port number.

No
nodePort int32

NodePort number.

No
targetPort int32

Target port number.

No

PrometheusConfig

Configuration for Prometheus.

Field Type Description Required
createPrometheusResource BoolValue No
enabled BoolValue No
hub string No
tag TypeInterface No
retention string No
scrapeInterval Duration No
contextPath string No
ingress AddonIngressConfig No
service PrometheusServiceConfig No
security PrometheusSecurityConfig No
provisionPrometheusCert BoolValue

Configure whether provisions a certificate to Prometheus through Istio Agent. When this option is set as true, a sidecar is deployed along Prometheus to provision a certificate through Istio Agent to Prometheus. The provisioned certificate is shared with Prometheus through mounted files. When this option is set as false, this certificate provisioning mechanism is disabled.

No
replicaCount uint32 No
nodeSelector TypeMapStringInterface

GOSTRUCT: NodeSelector map[string]interface{} json:"nodeSelector,omitempty"

No
tolerations TypeSliceOfMapStringInterface No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
datasources TypeSliceOfMapStringInterface No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
image string No

PrometheusMixerAdapterConfig

Configuration for Prometheus adapter in mixer.

Field Type Description Required
enabled BoolValue

Enables the Prometheus adapter in Mixer.

No
metricsExpiryDuration Duration

Sets the duration after which Prometheus registry purges a metric.

See: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/prometheus/#Params

No

PrometheusSecurityConfig

Configuration for Prometheus adapter security.

Field Type Description Required
enabled BoolValue

Controls whether Prometheus security is enabled.

No

PrometheusServiceConfig

Configuration for Prometheus adapter service.

Field Type Description Required
annotations TypeMapStringInterface No
nodePort PrometheusServiceNodePortConfig No

PrometheusServiceNodePortConfig

Configuration for Prometheus Service NodePort.

Field Type Description Required
enabled BoolValue

Controls whether Prometheus NodePort config is enabled.

No
port uint32 No

ProxyConfig

Configuration for Proxy.

Field Type Description Required
enabled BoolValue No
accessLogFile string

Specifies the path to write the sidecar access log file.

No
accessLogFormat string

Configures how and what fields are displayed in sidecar access log.

No
accessLogEncoding accessLogEncoding No
autoInject string No
clusterDomain string

Domain for the cluster, default: “cluster.local”.

K8s allows this to be customized, see https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/

No
componentLogLevel string

Per Component log level for proxy, applies to gateways and sidecars.

If a component level is not set, then the global “logLevel” will be used. If left empty, “misc:error” is used.

No
concurrency uint32

Controls number of proxy worker threads.

If set to 0 (default), then start worker thread for each CPU thread/core.

No
dnsRefreshRate Duration

Configures the DNS refresh rate for Envoy cluster of type STRICT_DNS.

This must be given it terms of seconds. For example, 300s is valid but 5m is invalid.

No
enableCoreDump BoolValue

Enables core dumps for newly injected sidecars.

If set, newly injected sidecars will have core dumps enabled.

No
envoyMetricsService EnvoyMetricsConfig

Configures Envoy Metrics Service.

No
envoyStatsd EnvoyMetricsConfig

Configures statsd export in Envoy.

No
excludeInboundPorts string

Specifies the Istio ingress ports not to capture.

No
excludeIPRanges string

Lists the excluded IP ranges of Istio egress traffic that the sidecar captures.

No
image string

Image name or path for the proxy, default: “proxyv2”.

If registry or tag are not specified, global.hub and global.tag are used.

Examples: my-proxy (uses global.hub/tag), docker.io/myrepo/my-proxy:v1.0.0

No
includeInboundPorts string

Specifies the Istio ingress ports to capture.

Examples: “”: Redirect no inbound traffic to Envoy. “*”: Redirect all inbound traffic to Envoy. “80,8080”: Redirect only selected ports.

No
includeIPRanges string

Lists the IP ranges of Istio egress traffic that the sidecar captures.

Example: “172.30.0.0/16,172.20.0.0/16” This would only capture egress traffic on those two IP Ranges, all other outbound traffic would # be allowed by the sidecar.”

No
kubevirtInterfaces string

Comma separated list of virtual interfaces whose inbound traffic (from VM) will be treated as outbound. By default, no interfaces are configured.

No
logLevel string

Log level for proxy, applies to gateways and sidecars. If left empty, “warning” is used. Expected values are: trace|debug|info|warning|error|critical|off

No
privileged BoolValue

Enables privileged securityContext for the istio-proxy container.

See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

No
readinessInitialDelaySeconds uint32

Sets the initial delay for readiness probes in seconds.

No
readinessPeriodSeconds uint32

Sets the interval between readiness probes in seconds.

No
readinessFailureThreshold uint32

Sets the number of successive failed probes before indicating readiness failure.

No
statusPort uint32

Default port used for the Pilot agent’s health checks.

No
tracer tracer No
protocolDetectionTimeout string No
envoyAccessLogService EnvoyAccessLogConfig No
excludeOutboundPorts string No
drainDuration Duration No
connectTimeout string No
parentShutdownDuration Duration No
outlierLogPath string No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
enableCoreDumpImage string No

ProxyInitConfig

Configuration for proxy_init container which sets the pods’ networking to intercept the inbound/outbound traffic.

Field Type Description Required
image string

Specifies the image for the proxy_init container.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No

Resources

Mirrors Resources for unmarshaling.

Field Type Description Required
limits map<string, string> No
requests map<string, string> No

ResourcesRequestsConfig

Configuration for K8s resource requests.

Field Type Description Required
cpu string No
memory string No

SDSConfig

Configuration for the SecretDiscoveryService instead of using K8S secrets to mount the certificates.

Field Type Description Required
enabled BoolValue

Controls whether the SecretDiscoveryService is enabled.

No
udsPath string

Specifies the Unix Domain Socket through which Envoy communicates with NodeAgent SDS to get key/cert for mTLS.

No
useNormalJwt BoolValue

Enables SDS use of k8s normal JWT to request for certificates.

No
useTrustworthyJwt BoolValue

Enables SDS use of trustworthy JWT to request for certificates.

No
token TypeMapStringInterface No

STSConfig

Configuration for Security Token Service (STS) server.

See https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16

Field Type Description Required
servicePort uint32 No

SecretVolume

Configuration for secret volume mounts.

See https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets.

Field Type Description Required
mountPath string No
name string No
secretName string No

SecurityConfig

Configuration for Citadel.

Field Type Description Required
enabled BoolValue

Controls whether Citadel is enabled.

No
image string

Image name used for Citadel.

This can be set either to image name if hub is also set, or can be set to the full hub:name string.

Examples: custom-citadel, docker.io/someuser:custom-citadel

No
selfSigned BoolValue

Controls whether self-signed CA is used for citadel to generate the certificate/key pair.

Setting to false if you want to use your own root CA for Citade Deployment.

No
trustDomain string

The trust domain corresponds to the trust root of a system Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain Indicate the domain used in SPIFFE identity URL The default depends on the environment. kubernetes: cluster.local else: default dns domain

No
dnsCerts map<string, string>

The DNS Certs specifies the customized DNS name and corresponding service account.

Example: istio-pilot-service-account.istio-control: istio-pilot.istio-control.svc istio-galley-service-account.istio-config: istio-galley.istio-config.svc

No
createMeshPolicy BoolValue

Controls whether the mesh-wide authentication policy is created or not.

Setting to true creates the mesh-wide authentication policy with name “default”.

No
enableNamespacesByDefault BoolValue No
citadelHealthCheck BoolValue No
env TypeMapStringInterface No
workloadCertTtl string

How long workload certs are valid for

No
replicaCount uint32

Number of replicas in the Citadel Deployment.

No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
tolerations TypeSliceOfMapStringInterface No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface No

ServiceConfig

ServiceConfig is described in istio.io documentation.

Field Type Description Required
annotations TypeMapStringInterface No
externalPort uint32 No
name string No
type string No

SidecarInjectorConfig

SidecarInjectorConfig is described in istio.io documentation.

Field Type Description Required
enabled BoolValue

Controls whether Sidecar Injector is enabled.

No
enableNamespacesByDefault BoolValue

Enables sidecar auto-injection in namespaces by default.

No
image string

Image name used for Sidecar Injector.

This can be set either to image name if hub is also set, or can be set to the full hub:name string.

Examples: custom-sidecarinjector, docker.io/someuser:custom-sidecarinjector

No
hub string No
tag TypeInterface No
neverInjectSelector TypeSliceOfMapStringInterface

Instructs Istio to not inject the sidecar on those pods, based on labels that are present in those pods.

Annotations in the pods have higher precedence than the label selectors. Order of evaluation: Pod Annotations → NeverInjectSelector → AlwaysInjectSelector → Default Policy. See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions

No
alwaysInjectSelector TypeSliceOfMapStringInterface

See NeverInjectSelector.

No
rewriteAppHTTPProbe BoolValue

If true, webhook or istioctl injector will rewrite PodSpec for liveness health check to redirect request to sidecar. This makes liveness check work even when mTLS is enabled.

No
selfSigned BoolValue

Controls whether self-signed CA is used for Sidecar Injector to generate the certificate/key pair.

Setting to false if you want to use your own root CA.

No
injectLabel string No
injectedAnnotations TypeMapStringInterface

injectedAnnotations are additional annotations that will be added to the pod spec after injection This is primarily to support PSP annotations.

No
objectSelector TypeMapStringInterface

Enable objectSelector to filter out pods with no need for sidecar before calling istio-sidecar-injector.

No
lifecycle TypeMapStringInterface No
nodeSelector TypeMapStringInterface

K8s node selector. Each component can overwrite the default values by adding its node selector block in the relevant section and setting the desired values.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
replicaCount uint32

Number of replicas in the Sidecar Injector Deployment.

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
tolerations TypeSliceOfMapStringInterface No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No
rollingMaxSurge TypeIntOrStringForPB

K8s rolling update strategy

No
rollingMaxUnavailable TypeIntOrStringForPB

K8s rolling update strategy

No

StackdriverAuthConfig

Field Type Description Required
appCredentials BoolValue No
apiKey string No
serviceAccountPath string No

StackdriverContextGraph

Field Type Description Required
enabled BoolValue No

StackdriverMixerAdapterConfig

Configuration for stackdriver adapter in mixer.

Field Type Description Required
enabled BoolValue No
auth StackdriverAuthConfig No
tracer StackdriverTracerConfig No
contextGraph StackdriverContextGraph No
logging EnabledConfig No
metrics EnabledConfig No

StackdriverMixerAdapterConfig.EnabledConfig

Field Type Description Required
enabled BoolValue No

StackdriverTracerConfig

Field Type Description Required
enabled BoolValue No
sampleProbability uint32 No

StdioMixerAdapterConfig

Configuration for stdio adapter in mixer, recommended for debug usage only.

Field Type Description Required
enabled BoolValue

Enable stdio adapter to output logs and metrics to local machine.

No
outputAsJson BoolValue

Whether to output a console-friendly or json-friendly format.

No

TelemetryConfig

Controls telemetry configuration

Field Type Description Required
enabled BoolValue

Controls whether telemetry is exported for Pilot.

No
v1 TelemetryV1Config

Use telemetry v1.

No
v2 TelemetryV2Config

Use telemetry v2.

No

TelemetryV1Config

Controls whether pilot will configure telemetry v1.

Field Type Description Required
enabled BoolValue

Controls whether pilot will configure telemetry v1.

No

TelemetryV2Config

Controls whether pilot will configure telemetry v2.

Field Type Description Required
enabled BoolValue

Controls whether pilot will configure telemetry v2.

No
prometheus TelemetryV2PrometheusConfig No
stackdriver TelemetryV2StackDriverConfig No
metadataExchange TelemetryV2MetadataExchangeConfig No

TelemetryV2MetadataExchangeConfig

Field Type Description Required
wasmEnabled BoolValue

Controls whether enabled WebAssembly runtime for metadata exchange filter.

No

TelemetryV2PrometheusConfig

Conrols telemetry v2 prometheus settings.

Field Type Description Required
enabled BoolValue

Controls whether stats envoyfilter would be enabled or not.

No
wasmEnabled BoolValue

Controls whether enabled WebAssembly runtime for stats filter.

No

TelemetryV2StackDriverConfig

Conrols telemetry v2 stackdriver settings.

Field Type Description Required
enabled BoolValue No
logging BoolValue No
monitoring BoolValue No
topology BoolValue No
configOverride TypeMapStringInterface No

TracerConfig

Configuration for each of the supported tracers.

Field Type Description Required
datadog TracerDatadogConfig

Configuration for the datadog tracing service.

No
lightstep TracerLightStepConfig

Configuration for the lightstep tracing service.

No
zipkin TracerZipkinConfig

Configuration for the zipkin tracing service.

No
stackdriver TracerStackdriverConfig

Configuration for the stackdriver tracing service.

No

TracerDatadogConfig

Configuration for the datadog tracing service.

Field Type Description Required
address string

Address in host:port format for reporting trace data to the Datadog agent.

No

TracerLightStepConfig

Configuration for the lightstep tracing service.

Field Type Description Required
address string

Sets the lightstep satellite pool address in host:port format for reporting trace data.

No
accessToken string

Sets the lightstep access token.

No
cacertPath string

Sets path to the file containing the cacert to use when verifying TLS.

No
secure BoolValue

Enables lightstep secure connection.

No

TracerStackdriverConfig

Configuration for the stackdriver tracing service.

Field Type Description Required
debug BoolValue

enables trace output to stdout.

No
maxNumberOfAttributes uint32

The global default max number of attributes per span.

No
maxNumberOfAnnotations uint32

The global default max number of annotation events per span.

No
maxNumberOfMessageEvents uint32

The global default max number of message events per span.

No

TracerZipkinConfig

Configuration for the zipkin tracing service.

Field Type Description Required
address string

Address of zipkin instance in host:port format for reporting trace data.

Example: .:941

No

TracingConfig

Configurations for different tracing system to be installed.

Field Type Description Required
enabled BoolValue

Enables tracing systems installation.

No
ingress TracingIngressConfig

Controls legacy k8s ingress for addon tracing components.

No
jaeger TracingJaegerConfig

Defines Configuration for addon Jaeger tracing.

No
provider string

Configures which tracing system to be installed.

No
service ServiceConfig

Controls K8s service for addon tracing components.

No
zipkin TracingZipkinConfig

Defines Configuration for addon Zipkin tracing.

No
opencensus TracingOpencensusConfig No
contextPath string No
nodeSelector TypeMapStringInterface

K8s node selector.

See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

No
podAntiAffinityLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
podAntiAffinityTermLabelSelector TypeSliceOfMapStringInterface

See EgressGatewayConfig.

No
tolerations TypeSliceOfMapStringInterface No

TracingIngressConfig

Controls legacy k8s ingress for addon tracing components.

Field Type Description Required
enabled BoolValue

Enables k8s ingress for addon tracing components.

No
annotations TypeMapStringInterface No
hosts string[] No
tls TypeMapStringInterface No

TracingJaegerConfig

Configuration for addon Jaeger tracing.

Field Type Description Required
hub string

Image hub for Jaeger tracing deployment.

No
tag TypeInterface

Image tag for Jaeger tracing deployment.

No
image string No
memory TracingJaegerMemoryConfig

Configures Jaeger in-memory storage setting.

No
spanStorageType string No
persist BoolValue No
storageClassName string No
accessMode string No
resources TypeMapStringInterface

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No

TracingJaegerMemoryConfig

Configuration for Jaeger in-memory storage setting.

Field Type Description Required
maxTraces uint32

Set limit of the amount of traces stored in memory for Jaeger

No

TracingOpencensusConfig

Field Type Description Required
hub string

Image hub for Opencensus tracing deployment.

No
tag TypeInterface

Image tag for Opencensus tracing deployment.

No
exporters TracingOpencensusExportersConfig No
resources TypeMapStringInterface

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No

TracingOpencensusExportersConfig

Field Type Description Required
stackdriver TypeMapStringInterface No

TracingZipkinConfig

Configuration for Zipkin.

Field Type Description Required
hub string

Image hub for Zipkin tracing deployment.

No
tag TypeInterface

Image tag for Zipkin tracing deployment.

No
image string No
probeStartupDelay uint32

InitialDelaySeconds of livenessProbe for Zipkin deployment

No
queryPort uint32

Container port for Zipkin deployment

No
javaOptsHeap uint32

Configure java heap opts for Zipkin deployment

No
maxSpans uint32

Configures number of max spans to keep in Zipkin memory storage.

Example: A safe estimate is 1K of memory per span (each span with 2 annotations + 1 binary annotation), plus 100 MB for a safety buffer

No
node TracingZipkinNodeConfig

Configures GC values of JAVA_OPTS for Zipkin deployment

No
resources Resources

K8s resources settings.

See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container

No
podAnnotations TypeMapStringInterface

K8s annotations for pods.

See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

No

TracingZipkinNodeConfig

Configuration for GC values of JAVA_OPTS for Zipkin deployment

Field Type Description Required
cpus uint32

Configures -XX:ConcGCThreads value of JAVA_OPTS for Zipkin deployment

No

TypeIntOrStringForPB

GOTYPE: *IntOrStringForPB

TypeInterface

GOTYPE: interface{}

TypeMapStringInterface

GOTYPE: map[string]interface{}

TypeSliceOfMapStringInterface

GOTYPE: []map[string]interface{}

Values

Field Type Description Required
certmanager CertManagerConfig No
cni CNIConfig No
istiocoredns CoreDNSConfig No
galley GalleyConfig No
gateways GatewaysConfig No
global GlobalConfig No
grafana TypeMapStringInterface No
mixer MixerConfig No
nodeagent NodeAgentConfig No
pilot PilotConfig No
telemetry TelemetryConfig

Controls whether telemetry is exported for Pilot.

No
prometheus PrometheusConfig No
security SecurityConfig No
sidecarInjectorWebhook SidecarInjectorConfig No
tracing TracingConfig No
kiali KialiConfig No
version string

Deprecated.

No
clusterResources BoolValue No
prometheusOperator TypeMapStringInterface

TODO: populate these.

No
istioCni CNIConfig No
kustomize BoolValue No
revision string No

ZeroVPNConfig

ZeroVPNConfig enables cross-cluster access using SNI matching.

Field Type Description Required
enabled BoolValue

Controls whether ZeroVPN is enabled.

No
suffix string No

accessLogEncoding

Configures the access log for sidecar to JSON or TEXT

Name Description
JSON
TEXT

ingressControllerMode

Mode for the ingress controller.

Name Description
DEFAULT

Selects all Ingress resources, with or without Istio annotation.

STRICT

Selects only resources with istio annotation.

OFF

No ingress or sync.

mode

Throttling behavior for mixer.

Name Description
disabled

Removes throttling behavior for mixer.

log_only

Enables an advisory mode for throttling behavior for mixer.

enforce

Turn on throttling behavior for mixer.

tracer

Specifies which tracer to use.

Name Description
zipkin
lightstep
datadog
stackdriver