proxyListenPort |
int32 |
Port on which Envoy should listen for incoming connections from
other services. Default port is 15001.
|
No
|
proxyHttpPort |
int32 |
Port on which Envoy should listen for HTTP PROXY requests if set.
|
No
|
connectTimeout |
Duration |
Connection timeout used by Envoy. (MUST BE >=1ms)
Default timeout is 10s.
|
No
|
protocolDetectionTimeout |
Duration |
Automatic protocol detection uses a set of heuristics to
determine whether the connection is using TLS or not (on the
server side), as well as the application protocol being used
(e.g., http vs tcp). These heuristics rely on the client sending
the first bits of data. For server first protocols like MySQL,
MongoDB, etc. Envoy will timeout on the protocol detection after
the specified period, defaulting to non mTLS plain TCP
traffic. Set this field to tweak the period that Envoy will wait
for the client to send the first bits of data. (MUST BE >=1ms or
0s to disable). Default detection timeout is 5s.
|
No
|
tcpKeepalive |
TcpKeepalive |
If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
|
No
|
ingressClass |
string |
Class of ingress resources to be processed by Istio ingress
controller. This corresponds to the value of
kubernetes.io/ingress.class annotation.
|
No
|
ingressService |
string |
Name of the Kubernetes service used for the istio ingress controller.
If no ingress controller is specified, the default value istio-ingressgateway is used.
|
No
|
ingressControllerMode |
IngressControllerMode |
Defines whether to use Istio ingress controller for annotated or all ingress resources.
Default mode is STRICT .
|
No
|
ingressSelector |
string |
Defines which gateway deployment to use as the Ingress controller. This field corresponds to
the Gateway.selector field, and will be set as istio: INGRESS_SELECTOR .
By default, ingressgateway is used, which will select the default IngressGateway as it has the
istio: ingressgateway labels.
It is recommended that this is the same value as ingress_service.
|
No
|
enableTracing |
bool |
Flag to control generation of trace spans and request IDs.
Requires a trace span collector defined in the proxy configuration.
|
No
|
accessLogFile |
string |
File address for the proxy access log (e.g. /dev/stdout).
Empty value disables access logging.
|
No
|
accessLogFormat |
string |
Format for the proxy access log
Empty value results in proxy’s default access log format
|
No
|
accessLogEncoding |
AccessLogEncoding |
Encoding for the proxy access log (TEXT or JSON ).
Default value is TEXT .
|
No
|
enableEnvoyAccessLogService |
bool |
This flag enables Envoy’s gRPC Access Log Service.
See Access Log Service
for details about Envoy’s gRPC Access Log Service API.
Default value is false .
|
No
|
disableEnvoyListenerLog |
bool |
This flag disables Envoy Listener logs.
See Listener Access Log
Istio Enables Envoy’s listener access logs on “NoRoute” response flag.
Default value is false .
|
No
|
defaultConfig |
ProxyConfig |
Default proxy config used by gateway and sidecars.
In case of Kubernetes, the proxy config is applied once during the injection process,
and remain constant for the duration of the pod. The rest of the mesh config can be changed
at runtime and config gets distributed dynamically.
On Kubernetes, this can be overridden on individual pods with the proxy.istio.io/config annotation.
|
No
|
outboundTrafficPolicy |
OutboundTrafficPolicy |
Set the default behavior of the sidecar for handling outbound
traffic from the application. If your application uses one or
more external services that are not known apriori, setting the
policy to ALLOW_ANY will cause the sidecars to route any unknown
traffic originating from the application to its requested
destination. Users are strongly encouraged to use ServiceEntries
to explicitly declare any external dependencies, instead of using
ALLOW_ANY , so that traffic to these services can be
monitored. Can be overridden at a Sidecar level by setting the
OutboundTrafficPolicy in the Sidecar
API.
Default mode is ALLOW_ANY which means outbound traffic to unknown destinations will be allowed.
|
No
|
configSources |
ConfigSource[] |
ConfigSource describes a source of configuration data for networking
rules, and other Istio configuration artifacts. Multiple data sources
can be configured for a single control plane.
|
No
|
enableAutoMtls |
BoolValue |
This flag is used to enable mutual TLS automatically for service to service communication
within the mesh, default true.
If set to true, and a given service does not have a corresponding DestinationRule configured,
or its DestinationRule does not have ClientTLSSettings specified, Istio configures client side
TLS configuration appropriately. More specifically,
If the upstream authentication policy is in STRICT mode, use Istio provisioned certificate
for mutual TLS to connect to upstream.
If upstream service is in plain text mode, use plain text.
If the upstream authentication policy is in PERMISSIVE mode, Istio configures clients to use
mutual TLS when server sides are capable of accepting mutual TLS traffic.
If service DestinationRule exists and has ClientTLSSettings specified, that is always used instead.
|
No
|
trustDomain |
string |
The trust domain corresponds to the trust root of a system.
Refer to SPIFFE-ID
|
No
|
trustDomainAliases |
string[] |
The trust domain aliases represent the aliases of trust_domain .
For example, if we have
trustDomain: td1
trustDomainAliases: ["td2", "td3"]
Any service with the identity td1/ns/foo/sa/a-service-account , td2/ns/foo/sa/a-service-account ,
or td3/ns/foo/sa/a-service-account will be treated the same in the Istio mesh.
|
No
|
caCertificates |
CertificateData[] |
The extra root certificates for workload-to-workload communication.
The plugin certificates (the ‘cacerts’ secret) or self-signed certificates (the ‘istio-ca-secret’ secret)
are automatically added by Istiod.
The CA certificate that signs the workload certificates is automatically added by Istio Agent.
|
No
|
defaultServiceExportTo |
string[] |
The default value for the ServiceEntry.export_to field and services
imported through container registry integrations, e.g. this applies to
Kubernetes Service resources. The value is a list of namespace names and
reserved namespace aliases. The allowed namespace aliases are:
* - All Namespaces
. - Current Namespace
~ - No Namespace
If not set the system will use “*” as the default value which implies that
services are exported to all namespaces.
All namespaces is a reasonable default for implementations that don’t
need to restrict access or visibility of services across namespace
boundaries. If that requirement is present it is generally good practice to
make the default Current namespace so that services are only visible
within their own namespaces by default. Operators can then expand the
visibility of services to other namespaces as needed. Use of No Namespace
is expected to be rare but can have utility for deployments where
dependency management needs to be precise even within the scope of a single
namespace.
For further discussion see the reference documentation for ServiceEntry ,
Sidecar , and Gateway .
|
No
|
defaultVirtualServiceExportTo |
string[] |
The default value for the VirtualService.export_to field. Has the same
syntax as default_service_export_to .
If not set the system will use “*” as the default value which implies that
virtual services are exported to all namespaces
|
No
|
defaultDestinationRuleExportTo |
string[] |
The default value for the DestinationRule.export_to field. Has the same
syntax as default_service_export_to .
If not set the system will use “*” as the default value which implies that
destination rules are exported to all namespaces
|
No
|
rootNamespace |
string |
The namespace to treat as the administrative root namespace for
Istio configuration. When processing a leaf namespace Istio will search for
declarations in that namespace first and if none are found it will
search in the root namespace. Any matching declaration found in the root
namespace is processed as if it were declared in the leaf namespace.
The precise semantics of this processing are documented on each resource
type.
|
No
|
localityLbSetting |
LocalityLoadBalancerSetting |
Locality based load balancing distribution or failover settings.
|
No
|
dnsRefreshRate |
Duration |
Configures DNS refresh rate for Envoy clusters of type STRICT_DNS
Default refresh rate is 5s .
|
No
|
h2UpgradePolicy |
H2UpgradePolicy |
Specify if http1.1 connections should be upgraded to http2 by default.
if sidecar is installed on all pods in the mesh, then this should be set to UPGRADE .
If one or more services or namespaces do not have sidecar(s), then this should be set to DO_NOT_UPGRADE .
It can be enabled by destination using the destinationRule.trafficPolicy.connectionPool.http.h2UpgradePolicy override.
|
No
|
inboundClusterStatName |
string |
Name to be used while emitting statistics for inbound clusters. The same pattern is used while computing stat prefix for
network filters like TCP and Redis.
By default, Istio emits statistics with the pattern inbound|<port>|<port-name>|<service-FQDN> .
For example inbound|7443|grpc-reviews|reviews.prod.svc.cluster.local . This can be used to override that pattern.
A Pattern can be composed of various pre-defined variables. The following variables are supported.
%SERVICE% - Will be substituted with name of the service.
%SERVICE_FQDN% - Will be substituted with FQDN of the service.
%SERVICE_PORT% - Will be substituted with port of the service.
%SERVICE_PORT_NAME% - Will be substituted with port name of the service.
Following are some examples of supported patterns for reviews:
%SERVICE_FQDN%_%SERVICE_PORT% will use reviews.prod.svc.cluster.local_7443 as the stats name.
%SERVICE% will use reviews.prod as the stats name.
|
No
|
outboundClusterStatName |
string |
Name to be used while emitting statistics for outbound clusters. The same pattern is used while computing stat prefix for
network filters like TCP and Redis.
By default, Istio emits statistics with the pattern outbound|<port>|<subsetname>|<service-FQDN> .
For example outbound|8080|v2|reviews.prod.svc.cluster.local . This can be used to override that pattern.
A Pattern can be composed of various pre-defined variables. The following variables are supported.
%SERVICE% - Will be substituted with name of the service.
%SERVICE_FQDN% - Will be substituted with FQDN of the service.
%SERVICE_PORT% - Will be substituted with port of the service.
%SERVICE_PORT_NAME% - Will be substituted with port name of the service.
%SUBSET_NAME% - Will be substituted with subset.
Following are some examples of supported patterns for reviews:
%SERVICE_FQDN%_%SERVICE_PORT% will use reviews.prod.svc.cluster.local_7443 as the stats name.
%SERVICE% will use reviews.prod as the stats name.
|
No
|
certificates |
Certificate[] |
Configure the provision of certificates.
|
No
|
thriftConfig |
ThriftConfig |
Set configuration for Thrift protocol
|
No
|
enablePrometheusMerge |
BoolValue |
If enabled, Istio agent will merge metrics exposed by the application with metrics from Envoy
and Istio agent. The sidecar injection will replace prometheus.io annotations present on the pod
and redirect them towards Istio agent, which will then merge metrics of from the application with Istio metrics.
This relies on the annotations prometheus.io/scrape , prometheus.io/port , and
prometheus.io/path annotations.
If you are running a separately managed Envoy with an Istio sidecar, this may cause issues, as the metrics will collide.
In this case, it is recommended to disable aggregation on that deployment with the
prometheus.istio.io/merge-metrics: "false" annotation.
If not specified, this will be enabled by default.
|
No
|
verifyCertificateAtClient |
BoolValue |
VerifyCertificateAtClient sets the mesh global default for peer certificate validation
at the client-side proxy when SIMPLE TLS or MUTUAL TLS (non ISTIO_MUTUAL ) origination
modes are used. This setting can be overridden at the host level via DestinationRule API.
By default, VerifyCertificateAtClient is true .
CaCertificates : If set, proxy verifies CA signature based on given CaCertificates. If unset,
and VerifyCertificateAtClient is true, proxy uses default System CA bundle. If unset and
VerifyCertificateAtClient is false, proxy will not verify the CA.
SubjectAltNames : If set, proxy verifies subject alt names are present in the SAN. If unset,
and VerifyCertificateAtClient is true, proxy uses host in destination rule to verify the SANs.
If unset, and VerifyCertificateAtClient is false, proxy does not verify SANs.
For SAN, client-side proxy will exact match host in DestinationRule as well as one level
wildcard if the specified host in DestinationRule doesn’t contain a wildcard.
For example, if the host in DestinationRule is x.y.com , client-side proxy will
match either x.y.com or *.y.com for the SAN in the presented server certificate.
For wildcard host name in DestinationRule, client-side proxy will do a suffix match. For example,
if host is *.x.y.com , client-side proxy will verify the presented server certificate SAN matches
`.x.y.com suffix.
|
No
|
extensionProviders |
ExtensionProvider[] |
Defines a list of extension providers that extend Istio’s functionality. For example, the AuthorizationPolicy
can be used with an extension provider to delegate the authorization decision to a custom authorization system.
|
No
|