From 49b82d89338ab06864b93f32fdcaa4031502d3ce Mon Sep 17 00:00:00 2001
From: Greg M <26463-kipten@users.noreply.gitlab.example.com>
Date: Mon, 3 Mar 2025 21:39:13 +0000
Subject: [PATCH] Operatorless Istio with CORE packages only SKIP UPGRADE DEBUG
---
chart/ingress-certs.yaml | 93 ++++++++++++++++++-
chart/templates/_helpers.tpl | 41 ++++++++
chart/templates/argocd/namespace.yaml | 4 +-
chart/templates/argocd/values.yaml | 6 +-
.../templates/authservice/gitrepository.yaml | 2 +-
chart/templates/authservice/helmrelease.yaml | 6 +-
.../authservice/imagepullsecret.yaml | 2 +-
chart/templates/authservice/namespace.yaml | 4 +-
chart/templates/authservice/values.yaml | 8 +-
chart/templates/grafana/helmrelease.yaml | 6 +-
chart/templates/grafana/namespace.yaml | 3 +-
chart/templates/grafana/values.yaml | 10 +-
.../templates/istio-core/git-credentials.yaml | 7 ++
chart/templates/istio-core/gitrepository.yaml | 24 +++++
chart/templates/istio-core/helmrelease.yaml | 69 ++++++++++++++
.../templates/istio-core/imagepullsecret.yaml | 16 ++++
chart/templates/istio-core/namespace.yaml | 25 +++++
chart/templates/istio-core/values.yaml | 34 +++++++
.../git-credentials.yaml | 7 ++
.../gitrepository.yaml | 24 +++++
.../helmrelease.yaml | 71 ++++++++++++++
.../imagepullsecret.yaml | 14 +++
.../istio-gateway-passthrough/values.yaml | 46 +++++++++
.../istio-gateway-public/git-credentials.yaml | 7 ++
.../istio-gateway-public/gitrepository.yaml | 24 +++++
.../istio-gateway-public/helmrelease.yaml | 75 +++++++++++++++
.../istio-gateway-public/imagepullsecret.yaml | 14 +++
.../istio-gateway-public/secret-tls.yaml | 20 ++++
.../istio-gateway-public/values.yaml | 47 ++++++++++
chart/templates/jaeger/helmrelease.yaml | 6 +-
chart/templates/jaeger/namespace.yaml | 2 +-
chart/templates/jaeger/values.yaml | 22 +++--
chart/templates/keycloak/helmrelease.yaml | 6 +-
chart/templates/keycloak/namespace.yaml | 2 +-
chart/templates/keycloak/values.yaml | 8 +-
chart/templates/kiali/helmrelease.yaml | 6 +-
chart/templates/kiali/namespace.yaml | 2 +-
chart/templates/kiali/values.yaml | 37 +++++++-
chart/templates/kyverno-policies/values.yaml | 37 ++++++--
chart/templates/kyverno-reporter/values.yaml | 2 +
chart/templates/loki/helmrelease.yaml | 4 +
chart/templates/loki/namespace.yaml | 2 +-
chart/templates/loki/values.yaml | 14 ++-
chart/templates/metrics-server/namespace.yaml | 2 +-
.../templates/minio-operator/helmrelease.yaml | 4 +
chart/templates/minio-operator/namespace.yaml | 2 +-
chart/templates/minio-operator/values.yaml | 8 +-
chart/templates/minio/namespace.yaml | 2 +-
chart/templates/minio/values.yaml | 8 +-
chart/templates/monitoring/helmrelease.yaml | 6 +-
chart/templates/monitoring/namespace.yaml | 2 +-
chart/templates/monitoring/values.yaml | 22 +++--
chart/templates/neuvector/helmrelease.yaml | 6 +-
chart/templates/neuvector/namespace.yaml | 2 +-
chart/templates/neuvector/values.yaml | 16 +++-
chart/templates/promtail/helmrelease.yaml | 4 +
chart/templates/promtail/namespace.yaml | 2 +-
chart/templates/promtail/values.yaml | 6 +-
chart/templates/sonarqube/values.yaml | 2 +
chart/templates/tempo/helmrelease.yaml | 6 +-
chart/templates/tempo/namespace.yaml | 2 +-
chart/templates/tempo/values.yaml | 16 +++-
chart/values.schema.json | 56 +++++++++++
chart/values.yaml | 83 ++++++++++++++++-
docs/assets/scripts/developer/k3d-dev.sh | 4 +-
tests/package-mapping.yaml | 12 +++
tests/test-values.yaml | 4 +-
67 files changed, 1040 insertions(+), 96 deletions(-)
create mode 100644 chart/templates/istio-core/git-credentials.yaml
create mode 100644 chart/templates/istio-core/gitrepository.yaml
create mode 100644 chart/templates/istio-core/helmrelease.yaml
create mode 100644 chart/templates/istio-core/imagepullsecret.yaml
create mode 100644 chart/templates/istio-core/namespace.yaml
create mode 100644 chart/templates/istio-core/values.yaml
create mode 100644 chart/templates/istio-gateway-passthrough/git-credentials.yaml
create mode 100644 chart/templates/istio-gateway-passthrough/gitrepository.yaml
create mode 100644 chart/templates/istio-gateway-passthrough/helmrelease.yaml
create mode 100644 chart/templates/istio-gateway-passthrough/imagepullsecret.yaml
create mode 100644 chart/templates/istio-gateway-passthrough/values.yaml
create mode 100644 chart/templates/istio-gateway-public/git-credentials.yaml
create mode 100644 chart/templates/istio-gateway-public/gitrepository.yaml
create mode 100644 chart/templates/istio-gateway-public/helmrelease.yaml
create mode 100644 chart/templates/istio-gateway-public/imagepullsecret.yaml
create mode 100644 chart/templates/istio-gateway-public/secret-tls.yaml
create mode 100644 chart/templates/istio-gateway-public/values.yaml
diff --git a/chart/ingress-certs.yaml b/chart/ingress-certs.yaml
index 96a8375f52..8cf53db684 100644
--- a/chart/ingress-certs.yaml
+++ b/chart/ingress-certs.yaml
@@ -1,3 +1,94 @@
+istioGatewayPublic:
+ tls:
+ key: |
+ -----BEGIN PRIVATE KEY-----
+ MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDCkz9rWBxaiDui
+ uw8vF49lTKtShFTu3tAkWiyp3IwzSH3F/HeSZ8pMTl7reCiRbhXHSmqiCyVVFkg7
+ eG6gA1fJNhJI26zoTSaN+seV1N4qgQIa4vkVgUEumPo6L+X93n7X7rH1GwVilYFo
+ 5MpYZkGoTLp8JtZRsUAXmooRa2URUoX11Wx4aegPR55gKkhXKnTl5a7cln93zOZb
+ 6QKG/UOmSIJe5C5JKQYhpQlv5DWi7Zf6ZqJABT27Lu8U/DY4qCv4pVphxdcZZqGl
+ 8GbBRmZ3pEHKS9KzlffHRE4xl/xy1cSdG60jlpBL8f8PO+bGEnqCMr8LXJqoU1Lp
+ Samg9AuJAgMBAAECggEAG8CLzaA6HxGKS/oZPtLB8aVfVDwqrw1Zq62u7CVYW+It
+ ikUputiR6pNNB5HSW3fTpGKxVd54Gyw77juNr8X6Sekr73dhsJp8csi/mdfMPky7
+ Q6F2/IG8jcxk+FKnn6+R8POLL1YEzRxc4lyrnbMsDziuapHRhMJezV8N7VEfj7ox
+ HbZDv00sLdwlIpnG6llJysq+S48s86l8CYBzpTk33XNOwWahrwZBGmpRBwdj2niP
+ 8UVZMD2GPSX+RevWEM5l3TkU6YbaFgOFthXmP3KcQjUHFkPRZq8iEcJnFixcaOGK
+ ySm3SbRr2kdHzuIpWTm4Yro9/9Jj3y5bfg3uo29jhwKBgQDydCIIeglxVaZgx06x
+ o7LdZpRQvVp3/Es6KTppqDeYwrFAZNTiP6aH4ZXpnyL7jrMn2iqSvBJ9/WnadKyc
+ gvgxBPBj+b84a7mVN/5AILzmcSxqHgEju0Ql+NuAuY1YHINtqgfNM9u68/JYw9s9
+ OeK81rja99CID1JNSmKM30zGxwKBgQDNckx/rhuSgiKI55WIQ7//yOtgRvzOWArH
+ vGlb2N+8zyfJd+D0tZyB39ZIvGGROm95rMNW/jmyEgiF8TkMLvjFMB/EpCWT58LG
+ I0WvkPizCd62tGoiBdIJ3tQi8RDwTVcLrzZsv7b039kkHpnFg0io93i4g/zOUear
+ wK/MiycLLwKBgQDFL8iCJmbJo0RGz7Jj7WRKhuQ3allK3ol8Sw2z4tkcx7OLULaH
+ MAdL2h+nuwKjn2J8FgasAoPzrgfKYTwFqssaaw7r8LIhvBNalgiVtUqNDRx3TeHV
+ YrfBPk2fusmHEOGfbjscHIIn4cGHifskJ5ENzoDXrdcO4Y8pR0cxlWcG/wKBgCRY
+ ViQ4XvRaRVXG8nM62RqdJtbPeCXg+XdAY7s18M7sLvO7W3avMlLfkH8ppHEWz2XN
+ JHmdXAOeoRdhB2CaZrQrwVL+Xw99br2yu79FfFngIyBbZnNCaFgKrajI0OBSLlYI
+ 1y4B9JH5j+aN61I/2Xja3uZ1oyG054P3AKLE81FNAoGAHVV7TcyVwi8OJo/1YGHq
+ ybWK0UvWTKJ4YgpMO3Asn3MzwadoxY5E6p0RpqQSDCV+txAPX1QqHNRuCcKmPHSF
+ 6E7oWeFD09vcOcaPQSTw7NfGUktoMLDzjfiHHGLGKH3PeB7qgPIfnHvOa4iJjyQp
+ gBaI0ROebBfbZ5pUyr/NEx4=
+ -----END PRIVATE KEY-----
+ cert: |
+ -----BEGIN CERTIFICATE-----
+ MIIE9DCCA9ygAwIBAgISBLhHLRR5idjuJooPRuDdhyFaMA0GCSqGSIb3DQEBCwUA
+ MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
+ EwNSMTEwHhcNMjUwMjEyMTcxNzU4WhcNMjUwNTEzMTcxNzU3WjAcMRowGAYDVQQD
+ DBEqLmRldi5iaWdiYW5nLm1pbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ ggEBAMKTP2tYHFqIO6K7Dy8Xj2VMq1KEVO7e0CRaLKncjDNIfcX8d5JnykxOXut4
+ KJFuFcdKaqILJVUWSDt4bqADV8k2EkjbrOhNJo36x5XU3iqBAhri+RWBQS6Y+jov
+ 5f3eftfusfUbBWKVgWjkylhmQahMunwm1lGxQBeaihFrZRFShfXVbHhp6A9HnmAq
+ SFcqdOXlrtyWf3fM5lvpAob9Q6ZIgl7kLkkpBiGlCW/kNaLtl/pmokAFPbsu7xT8
+ NjioK/ilWmHF1xlmoaXwZsFGZnekQcpL0rOV98dETjGX/HLVxJ0brSOWkEvx/w87
+ 5sYSeoIyvwtcmqhTUulJqaD0C4kCAwEAAaOCAhcwggITMA4GA1UdDwEB/wQEAwIF
+ oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
+ BgNVHQ4EFgQUbbIRs2GOo9GYzktU5Url5c9dSzIwHwYDVR0jBBgwFoAUxc9GpOr0
+ w8B6bJXELbBeki8m47kwVwYIKwYBBQUHAQEESzBJMCIGCCsGAQUFBzABhhZodHRw
+ Oi8vcjExLm8ubGVuY3Iub3JnMCMGCCsGAQUFBzAChhdodHRwOi8vcjExLmkubGVu
+ Y3Iub3JnLzAcBgNVHREEFTATghEqLmRldi5iaWdiYW5nLm1pbDATBgNVHSAEDDAK
+ MAgGBmeBDAECATCCAQYGCisGAQQB1nkCBAIEgfcEgfQA8gB3AHMgIg8IFor588Sm
+ iwqyappKAO71d4WKCE0FANSlQkRZAAABlPtgcQIAAAQDAEgwRgIhAKLzkKto2f2R
+ l3TrYZ+fLvW9qXRSVN8x3ilaKdcS+dEKAiEAg408cpgsAv88HOx9lLI9jJmLXm/7
+ hUhT22LkL1JaVgMAdwCi4wrkRe+9rZt+OO1HZ3dT14JbhJTXK14bLMS5UKRH5wAA
+ AZT7YHjfAAAEAwBIMEYCIQDWMGhLWcUeAP8YZSMvwD7eiJ2IWlpbvtBIEswIYPg7
+ BAIhAL8JoxIMP6GTmvGGd8Fmx6kUC/fTx5odro0Z1eag731hMA0GCSqGSIb3DQEB
+ CwUAA4IBAQAH2I9lef1qGbjAwa92YU95l8G+DvQZ1nEJVADqcXZ/EGW0r4St5t7j
+ y0wFEweo8PZmQG81wemsGWKPGwtL/+ow29RjSmHL+Wg3cY+WrtYuAwFwJguIBDoU
+ 8nU7x29lHZy2E0i5fPL0lfHATvjNdhaycrg50Oc2/osOusTSzR5GPtIqFnQt0hKj
+ EvotDUCxlFD+tmgEdYDfAhD+PM2r/qXI5U/1mmXqmQF2YwzXsxZzS/PqhGnD2Day
+ jSTELbgAtsPMW8yh0Js20deOZ3aT6Wj1s8OpzgoIMb4Ztw9sLD9IcgdzVvgaBYQf
+ nJNGNWiG+v+1Lp2rEnEbN3R/f34JteTG
+ -----END CERTIFICATE-----
+ -----BEGIN CERTIFICATE-----
+ MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
+ TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+ cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+ WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+ RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+ CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
+ DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
+ AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
+ 6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
+ SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
+ Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
+ hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
+ /wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
+ ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
+ hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
+ A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
+ AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
+ v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
+ 01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
+ e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
+ UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
+ aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
+ WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
+ PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
+ pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
+ 6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
+ uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
+ -----END CERTIFICATE-----
+
istio:
gateways:
public:
@@ -271,4 +362,4 @@ addons:
pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
- -----END CERTIFICATE-----
+ -----END CERTIFICATE-----
\ No newline at end of file
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
index d2dc916a4e..d20fefb088 100644
--- a/chart/templates/_helpers.tpl
+++ b/chart/templates/_helpers.tpl
@@ -438,4 +438,45 @@ data:
{{- end -}}
{{- end -}}
+{{- /* Returns namespace of istio gateways */ -}}
+{{- define "istioGatewayNamespace" -}}
+{{- if .Values.istio.enabled -}}
+ {{- print "istio-system" -}}
+{{- else -}}
+ {{- print "istio-gateway" -}}
+{{- end -}}
+{{- end -}}
+
+{{- /* Returns name of istio public gateway */ -}}
+{{- define "istioPublicGateway" -}}
+{{- if .Values.istio.enabled -}}
+ {{- print "public" -}}
+{{- else -}}
+ {{- print "public-ingressgateway" -}}
+{{- end -}}
+{{- end -}}
+{{- /* Returns name of istio passthrough gateway */ -}}
+{{- define "istioPassthroughGateway" -}}
+{{- if .Values.istio.enabled -}}
+ {{- print "passthrough" -}}
+{{- else -}}
+ {{- print "passthrough-ingressgateway" -}}
+{{- end -}}
+{{- end -}}
+
+{{- /* Returns true if either istio or istioCore is enabled */ -}}
+{{- define "istioEnabled" -}}
+{{ or .Values.istio.enabled .Values.istioCore.enabled }}
+{{- end -}}
+
+{{- /* Returns name of istio Namespace Selector*/ -}}
+{{- define "istioNamespaceSelector" -}}
+{{- if .Values.istioCore.enabled -}}
+ingress: istio-gateway
+egress: istio-core
+{{- else -}}
+ingress: istio-controlplane
+egress: istio-controlplane
+{{- end -}}
+{{- end -}}
\ No newline at end of file
diff --git a/chart/templates/argocd/namespace.yaml b/chart/templates/argocd/namespace.yaml
index 3897cb98af..8ee74e2897 100644
--- a/chart/templates/argocd/namespace.yaml
+++ b/chart/templates/argocd/namespace.yaml
@@ -6,6 +6,6 @@ metadata:
app.kubernetes.io/name: argocd
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.argocd) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.argocd) "enabled")) }}
name: argocd
-{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/argocd/values.yaml b/chart/templates/argocd/values.yaml
index d36a93c9ad..7a4939525c 100644
--- a/chart/templates/argocd/values.yaml
+++ b/chart/templates/argocd/values.yaml
@@ -142,7 +142,7 @@ repoServer:
{{- end }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.addons.argocd.values)
@@ -151,13 +151,15 @@ istio:
injection: {{ dig "istio" "injection" "enabled" .Values.addons.argocd }}
argocd:
gateways:
- - istio-system/{{ default "public" .Values.addons.argocd.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.addons.argocd.ingress.gateway }}
monitoring:
enabled: {{ .Values.monitoring.enabled }}
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
ingressLabels:
{{- $gateway := default "public" .Values.addons.argocd.ingress.gateway }}
diff --git a/chart/templates/authservice/gitrepository.yaml b/chart/templates/authservice/gitrepository.yaml
index c6665ace28..24ed66eb80 100644
--- a/chart/templates/authservice/gitrepository.yaml
+++ b/chart/templates/authservice/gitrepository.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.istio.enabled (eq .Values.addons.authservice.sourceType "git") (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
+{{- if and (include "istioEnabled" .) (eq .Values.addons.authservice.sourceType "git") (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
{{- $gitCredsDict := dict
"name" "authservice"
"packageGitScope" .Values.addons.authservice.git
diff --git a/chart/templates/authservice/helmrelease.yaml b/chart/templates/authservice/helmrelease.yaml
index 2032be1475..da10540585 100644
--- a/chart/templates/authservice/helmrelease.yaml
+++ b/chart/templates/authservice/helmrelease.yaml
@@ -1,5 +1,5 @@
{{- $fluxSettingsAuthservice := merge .Values.addons.authservice.flux .Values.flux -}}
-{{- if and .Values.istio.enabled (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
+{{- if and (include "istioEnabled" .) (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
@@ -65,4 +65,8 @@ spec:
- name: monitoring
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- end }}
diff --git a/chart/templates/authservice/imagepullsecret.yaml b/chart/templates/authservice/imagepullsecret.yaml
index c26e456c30..e8f7d29ae0 100644
--- a/chart/templates/authservice/imagepullsecret.yaml
+++ b/chart/templates/authservice/imagepullsecret.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.istio.enabled (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
+{{- if and (include "istioEnabled" .) (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
{{- if ( include "imagePullSecret" . ) }}
apiVersion: v1
kind: Secret
diff --git a/chart/templates/authservice/namespace.yaml b/chart/templates/authservice/namespace.yaml
index 4a29c465de..20e545621d 100644
--- a/chart/templates/authservice/namespace.yaml
+++ b/chart/templates/authservice/namespace.yaml
@@ -1,10 +1,10 @@
-{{- if and .Values.istio.enabled (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
+{{- if and (include "istioEnabled" .) (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled)) }}
apiVersion: v1
kind: Namespace
metadata:
name: authservice
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.authservice) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.authservice) "enabled")) }}
app.kubernetes.io/name: authservice
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
diff --git a/chart/templates/authservice/values.yaml b/chart/templates/authservice/values.yaml
index 6b0a2a6d15..c90fd913b8 100644
--- a/chart/templates/authservice/values.yaml
+++ b/chart/templates/authservice/values.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.istio.enabled (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled) (and .Values.addons.thanos.enabled .Values.addons.thanos.sso.enabled) (and .Values.addons.holocron.enabled .Values.addons.holocron.sso.enabled)) }}
+{{- if and (include "istioEnabled" .) (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled) (and .Values.addons.thanos.enabled .Values.addons.thanos.sso.enabled) (and .Values.addons.holocron.enabled .Values.addons.holocron.sso.enabled)) }}
{{- include "values-secret" (dict "root" $ "package" .Values.addons.authservice "name" "authservice" "defaults" (include "bigbang.defaults.authservice" .)) }}
{{- end }}
@@ -16,7 +16,7 @@
}}
istio:
- enabled: {{ .Values.istio.enabled | default false }}
+ enabled: {{ (include "istioEnabled" .) | default false }}
hardened:
enabled: {{ $authServiceHardened }}
clusterWideHardenedEnabled: {{ dig "hardened" "enabled" false .Values.istio.values }}
@@ -37,6 +37,8 @@ monitoring:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled | default false }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
{{- $gateway := default "public" .Values.addons.haproxy.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
@@ -63,7 +65,7 @@ redis-bb:
selector:
app.kubernetes.io/name: redis-bb
app.kubernetes.io/instance: authservice-authservice
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.addons.authservice.values) "STRICT") }}
+ {{- if and (include "istioEnabled" .) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.addons.authservice.values) "STRICT") }}
scheme: https
tlsConfig:
caFile: /etc/prom-certs/root-cert.pem
diff --git a/chart/templates/grafana/helmrelease.yaml b/chart/templates/grafana/helmrelease.yaml
index 99d7af8803..fa83c22e1a 100644
--- a/chart/templates/grafana/helmrelease.yaml
+++ b/chart/templates/grafana/helmrelease.yaml
@@ -58,12 +58,16 @@ spec:
valuesKey: "overlays"
# TODO: DRY this up
- {{- if or .Values.gatekeeper.enabled .Values.istio.enabled .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
+ {{- if or .Values.gatekeeper.enabled (include "istioEnabled" .) .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
dependsOn:
{{- if .Values.istio.enabled }}
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.gatekeeper.enabled }}
- name: gatekeeper
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/grafana/namespace.yaml b/chart/templates/grafana/namespace.yaml
index 2b60cf2695..b9209894fa 100644
--- a/chart/templates/grafana/namespace.yaml
+++ b/chart/templates/grafana/namespace.yaml
@@ -7,6 +7,5 @@ metadata:
app.kubernetes.io/name: monitoring
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.grafana) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.grafana) "enabled")) }}
{{- end }}
-
diff --git a/chart/templates/grafana/values.yaml b/chart/templates/grafana/values.yaml
index cc7ab59208..0f093e32aa 100644
--- a/chart/templates/grafana/values.yaml
+++ b/chart/templates/grafana/values.yaml
@@ -8,7 +8,7 @@
hostname: {{ $domainName }}
domain: {{ $domainName }}
-{{- $istioInjection := (and (eq (dig "istio" "injection" "enabled" .Values.grafana) "enabled") .Values.istio.enabled) }}
+{{- $istioInjection := (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.grafana) "enabled")) }}
{{- $gitlabRedis := (and (ne .Values.addons.gitlab.redis.password "" ) (or .Values.addons.gitlab.enabled .Values.addons.gitlabRunner.enabled)) }}
{{- $authserviceRedisEnabled := (and (dig "values" "redis" "enabled" false .Values.addons.authservice) .Values.addons.authservice.enabled) }}
{{- $redisDatasource := (or $gitlabRedis .Values.addons.argocd.enabled $authserviceRedisEnabled) }}
@@ -18,6 +18,8 @@ flux:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
ingressLabels:
{{- $gateway := default "public" .Values.grafana.ingress.gateway }}
@@ -34,7 +36,7 @@ gitlabRunner:
istio:
{{- $grafanaInjection := dig "istio" "injection" "enabled" .Values.grafana }}
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.monitoring.values)
@@ -48,7 +50,7 @@ istio:
grafana:
enabled: true
gateways:
- - istio-system/{{ default "public" .Values.grafana.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.grafana.ingress.gateway }}
injection: {{ dig "istio" "injection" "enabled" .Values.grafana }}
anchore:
@@ -237,7 +239,7 @@ datasources:
{{- end }}
grafana.ini:
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
server:
root_url: https://grafana.{{ $domainName }}/
{{- end }}
diff --git a/chart/templates/istio-core/git-credentials.yaml b/chart/templates/istio-core/git-credentials.yaml
new file mode 100644
index 0000000000..0e5dad2418
--- /dev/null
+++ b/chart/templates/istio-core/git-credentials.yaml
@@ -0,0 +1,7 @@
+{{- $gitCredsSecretDict := dict
+ "name" "istioCore"
+ "targetScope" .Values.istioCore
+ "releaseName" .Release.Name
+ "releaseNamespace" .Release.Namespace
+}}
+{{- include "gitCredsSecret" $gitCredsSecretDict | nindent 0 -}}
diff --git a/chart/templates/istio-core/gitrepository.yaml b/chart/templates/istio-core/gitrepository.yaml
new file mode 100644
index 0000000000..fa167bda8c
--- /dev/null
+++ b/chart/templates/istio-core/gitrepository.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq .Values.istioCore.sourceType "git") (not .Values.offline) .Values.istioCore.enabled }}
+{{- $gitCredsDict := dict
+ "name" "istioCore"
+ "packageGitScope" .Values.istioCore.git
+ "rootScope" .
+ "releaseName" .Release.Name
+}}
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+ name: istio-core
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-core
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+spec:
+ interval: {{ .Values.flux.interval }}
+ url: {{ .Values.istioCore.git.repo }}
+ ref:
+ {{- include "validRef" .Values.istioCore.git | nindent 4 }}
+ {{ include "gitIgnore" . }}
+ {{- include "gitCredsExtended" $gitCredsDict | nindent 2 }}
+{{- end }}
diff --git a/chart/templates/istio-core/helmrelease.yaml b/chart/templates/istio-core/helmrelease.yaml
new file mode 100644
index 0000000000..c1d0cef674
--- /dev/null
+++ b/chart/templates/istio-core/helmrelease.yaml
@@ -0,0 +1,69 @@
+{{- $fluxSettingsIstioCore := merge .Values.istioCore.flux .Values.flux -}}
+{{- if and .Values.istioCore.enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: istio-core
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-core
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+ annotations:
+ checksum/bigbang-values: {{ include (print $.Template.BasePath "/istio-core/values.yaml") . | sha256sum }}
+spec:
+ targetNamespace: istio-system
+ chart:
+ spec:
+ {{- if eq .Values.istioCore.sourceType "git" }}
+ chart: {{ .Values.istioCore.git.path }}
+ sourceRef:
+ kind: GitRepository
+ name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- else }}
+ chart: {{ .Values.istioCore.helmRepo.chartName }}
+ version: {{ .Values.istioCore.helmRepo.tag }}
+ sourceRef:
+ kind: HelmRepository
+ name: {{ .Values.istioCore.helmRepo.repoName }}
+ namespace: {{ .Release.Namespace }}
+ {{- $repoType := include "getRepoType" (dict "repoName" .Values.istioCore.helmRepo.repoName "allRepos" $.Values.helmRepositories) -}}
+ {{- if (and .Values.istioCore.helmRepo.cosignVerify (eq $repoType "oci")) }} # Needs to be an OCI repo
+ verify:
+ provider: cosign
+ secretRef:
+ name: {{ printf "%s-cosign-pub" .Values.istioCore.helmRepo.repoName }}
+ {{- end }}
+ {{- end }}
+ interval: 5m
+
+ {{- toYaml $fluxSettingsIstioCore | nindent 2 }}
+
+ {{- if .Values.istioCore.postRenderers }}
+ postRenderers:
+ {{ toYaml .Values.istioCore.postRenderers | nindent 4 }}
+ {{- end }}
+ valuesFrom:
+ - name: {{ .Release.Name }}-istio-core-values
+ kind: Secret
+ valuesKey: "common"
+ - name: {{ .Release.Name }}-istio-core-values
+ kind: Secret
+ valuesKey: "defaults"
+ - name: {{ .Release.Name }}-istio-core-values
+ kind: Secret
+ valuesKey: "overlays"
+
+ {{- if or .Values.gatekeeper.enabled .Values.kyvernoPolicies.enabled }}
+ dependsOn:
+ {{- if .Values.gatekeeper.enabled }}
+ - name: gatekeeper
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- if .Values.kyvernoPolicies.enabled }}
+ - name: kyverno-policies
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- end }}
+{{- end }}
diff --git a/chart/templates/istio-core/imagepullsecret.yaml b/chart/templates/istio-core/imagepullsecret.yaml
new file mode 100644
index 0000000000..25d5e217d0
--- /dev/null
+++ b/chart/templates/istio-core/imagepullsecret.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.istioCore.enabled }}
+{{- if ( include "imagePullSecret" . ) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: private-registry
+ namespace: istio-system
+ labels:
+ app.kubernetes.io/name: istio-core
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+type: kubernetes.io/dockerconfigjson
+data:
+ .dockerconfigjson: {{ template "imagePullSecret" . }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/istio-core/namespace.yaml b/chart/templates/istio-core/namespace.yaml
new file mode 100644
index 0000000000..c50daddde2
--- /dev/null
+++ b/chart/templates/istio-core/namespace.yaml
@@ -0,0 +1,25 @@
+{{- if .Values.istioCore.enabled }}
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: istio-system
+ labels:
+ istio-base-managed: Reconcile
+ istio-injection: disabled
+ app.kubernetes.io/name: istio-core
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+{{- if or .Values.istioGatewayPublic.enabled .Values.istioGatewayPassthrough.enabled }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: istio-gateway
+ labels:
+ istio-gateway-managed: Reconcile
+ istio-injection: enabled
+ app.kubernetes.io/name: istio-gateway
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+{{- end }}
+{{- end }}
diff --git a/chart/templates/istio-core/values.yaml b/chart/templates/istio-core/values.yaml
new file mode 100644
index 0000000000..918d8ed392
--- /dev/null
+++ b/chart/templates/istio-core/values.yaml
@@ -0,0 +1,34 @@
+{{- $pkg := "istioCore" }}
+
+{{- /* Create secret */ -}}
+{{- if (get .Values $pkg).enabled }}
+{{- include "values-secret" (dict "root" $ "package" (get .Values $pkg) "name" ($pkg | kebabcase) "defaults" (include (printf "bigbang.defaults.%s" $pkg | kebabcase) .)) }}
+{{- end }}
+
+{{- define "bigbang.defaults.istio-core" -}}
+createNamespace: true
+
+enterprise: {{ .Values.istioCore.enterprise }}
+imagePullPolicy: {{ .Values.imagePullPolicy }}
+
+imagePullSecrets:
+ - private-registry
+
+istiod:
+ networkPolicies:
+ enabled: {{ .Values.networkPolicies.enabled }}
+ controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+
+ monitoring:
+ enabled: {{ .Values.monitoring.enabled }}
+
+{{- if .Values.addons.authservice.enabled }}
+ meshConfig:
+ extensionProviders:
+ - name: "authservice"
+ envoyExtAuthzGrpc:
+ service: "authservice.authservice.svc.cluster.local"
+ port: "10003"
+{{- end }}
+
+{{- end }}
diff --git a/chart/templates/istio-gateway-passthrough/git-credentials.yaml b/chart/templates/istio-gateway-passthrough/git-credentials.yaml
new file mode 100644
index 0000000000..f9ca9c7e51
--- /dev/null
+++ b/chart/templates/istio-gateway-passthrough/git-credentials.yaml
@@ -0,0 +1,7 @@
+{{- $gitCredsSecretDict := dict
+ "name" "istioGatewayPassthrough"
+ "targetScope" .Values.istioGatewayPassthrough
+ "releaseName" .Release.Name
+ "releaseNamespace" .Release.Namespace
+}}
+{{- include "gitCredsSecret" $gitCredsSecretDict | nindent 0 -}}
diff --git a/chart/templates/istio-gateway-passthrough/gitrepository.yaml b/chart/templates/istio-gateway-passthrough/gitrepository.yaml
new file mode 100644
index 0000000000..adea7847cd
--- /dev/null
+++ b/chart/templates/istio-gateway-passthrough/gitrepository.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq .Values.istioGatewayPassthrough.sourceType "git") (not .Values.offline) .Values.istioGatewayPassthrough.enabled }}
+{{- $gitCredsDict := dict
+ "name" "istioGatewayPassthrough"
+ "packageGitScope" .Values.istioGatewayPassthrough.git
+ "rootScope" .
+ "releaseName" .Release.Name
+}}
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+ name: istio-gateway-passthrough
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-gateway-passthrough
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+spec:
+ interval: {{ .Values.flux.interval }}
+ url: {{ .Values.istioGatewayPassthrough.git.repo }}
+ ref:
+ {{- include "validRef" .Values.istioGatewayPassthrough.git | nindent 4 }}
+ {{ include "gitIgnore" . }}
+ {{- include "gitCredsExtended" $gitCredsDict | nindent 2 }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-passthrough/helmrelease.yaml b/chart/templates/istio-gateway-passthrough/helmrelease.yaml
new file mode 100644
index 0000000000..4aa9620c39
--- /dev/null
+++ b/chart/templates/istio-gateway-passthrough/helmrelease.yaml
@@ -0,0 +1,71 @@
+{{- $fluxSettingsIstioGatewayPassthrough := merge .Values.istioGatewayPassthrough.flux .Values.flux -}}
+{{- if and .Values.istioCore.enabled .Values.istioGatewayPassthrough.enabled }}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: passthrough-ingressgateway
+ namespace: {{ $.Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-gateway
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" $ | nindent 4}}
+ annotations:
+ checksum/bigbang-values: {{ include (print $.Template.BasePath "/istio-gateway-passthrough/values.yaml") $ | sha256sum }}
+spec:
+ releaseName: passthrough-ingressgateway
+ targetNamespace: istio-gateway
+ chart:
+ spec:
+ {{- if eq $.Values.istioGatewayPassthrough.sourceType "git" }}
+ chart: {{ $.Values.istioGatewayPassthrough.git.path }}
+ sourceRef:
+ kind: GitRepository
+ name: istio-gateway-passthrough
+ namespace: {{ $.Release.Namespace }}
+ {{- else }}
+ chart: {{ $.Values.istioGatewayPassthrough.helmRepo.chartName }}
+ version: {{ $.Values.istioGatewayPassthrough.helmRepo.tag }}
+ sourceRef:
+ kind: HelmRepository
+ name: {{ $.Values.istioGatewayPassthrough.helmRepo.repoName }}
+ namespace: {{ $.Release.Namespace }}
+ {{- $repoType := include "getRepoType" (dict "repoName" $.Values.istioGatewayPassthrough.helmRepo.repoName "allRepos" $.Values.helmRepositories) -}}
+ {{- if (and $.Values.istioGatewayPassthrough.helmRepo.cosignVerify (eq $repoType "oci")) }} # Needs to be an OCI repo
+ verify:
+ provider: cosign
+ secretRef:
+ name: {{ printf "%s-cosign-pub" $.Values.istioGatewayPassthrough.helmRepo.repoName }}
+ {{- end }}
+ {{- end }}
+ interval: 5m
+
+ {{- toYaml $fluxSettingsIstioGatewayPassthrough | nindent 2 }}
+
+ {{- if $.Values.istioGatewayPassthrough.postRenderers }}
+ postRenderers:
+ {{ toYaml $.Values.istioGatewayPassthrough.postRenderers | nindent 4 }}
+ {{- end }}
+ valuesFrom:
+ - name: {{ $.Release.Name }}-istio-gateway-passthrough-values
+ kind: Secret
+ valuesKey: "common"
+ - name: {{ $.Release.Name }}-istio-gateway-passthrough-values
+ kind: Secret
+ valuesKey: "defaults"
+ - name: {{ $.Release.Name }}-istio-gateway-passthrough-values
+ kind: Secret
+ valuesKey: "overlays"
+
+ dependsOn:
+ - name: istio-core
+ namespace: {{ $.Release.Namespace }}
+ {{- if $.Values.gatekeeper.enabled }}
+ - name: gatekeeper
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
+ {{- if $.Values.kyvernoPolicies.enabled }}
+ - name: kyverno-policies
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-passthrough/imagepullsecret.yaml b/chart/templates/istio-gateway-passthrough/imagepullsecret.yaml
new file mode 100644
index 0000000000..7469e7a3bf
--- /dev/null
+++ b/chart/templates/istio-gateway-passthrough/imagepullsecret.yaml
@@ -0,0 +1,14 @@
+{{- if and .Values.istioGatewayPassthrough.enabled ( include "imagePullSecret" . ) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: private-registry-passthrough
+ namespace: istio-gateway
+ labels:
+ app.kubernetes.io/name: istio-gateway-passthrough
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+type: kubernetes.io/dockerconfigjson
+data:
+ .dockerconfigjson: {{ template "imagePullSecret" . }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-passthrough/values.yaml b/chart/templates/istio-gateway-passthrough/values.yaml
new file mode 100644
index 0000000000..bf05d16a68
--- /dev/null
+++ b/chart/templates/istio-gateway-passthrough/values.yaml
@@ -0,0 +1,46 @@
+{{- $pkg := "istioGatewayPassthrough" }}
+
+{{- /* Create secret */ -}}
+{{- if (get .Values $pkg).enabled }}
+{{- include "values-secret" (dict "root" $ "package" (get .Values $pkg) "name" ($pkg | kebabcase) "defaults" (include (printf "bigbang.defaults.%s" $pkg | kebabcase) .)) }}
+{{- end }}
+
+{{- define "bigbang.defaults.istio-gateway-passthrough" -}}
+createNamespace: true
+
+imagePullPolicy: {{ .Values.imagePullPolicy }}
+
+imagePullSecrets:
+ - name: private-registry-passthrough
+
+networkPolicies:
+ enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
+ controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+
+labels:
+ istio: ingressgateway
+
+monitoring:
+ enabled: {{ .Values.monitoring.enabled }}
+
+gateway:
+ servers:
+ - hosts:
+ - '*.{{ .Values.domain }}'
+ port:
+ name: http
+ number: 8080
+ protocol: HTTP
+ tls:
+ httpsRedirect: true
+ - hosts:
+ - '*.{{ .Values.domain }}'
+ port:
+ name: https
+ number: 8443
+ protocol: HTTPS
+ tls:
+ mode: PASSTHROUGH
+{{- end -}}
\ No newline at end of file
diff --git a/chart/templates/istio-gateway-public/git-credentials.yaml b/chart/templates/istio-gateway-public/git-credentials.yaml
new file mode 100644
index 0000000000..5a85066f08
--- /dev/null
+++ b/chart/templates/istio-gateway-public/git-credentials.yaml
@@ -0,0 +1,7 @@
+{{- $gitCredsSecretDict := dict
+ "name" "istioGatewayPublic"
+ "targetScope" .Values.istioGatewayPublic
+ "releaseName" .Release.Name
+ "releaseNamespace" .Release.Namespace
+}}
+{{- include "gitCredsSecret" $gitCredsSecretDict | nindent 0 -}}
diff --git a/chart/templates/istio-gateway-public/gitrepository.yaml b/chart/templates/istio-gateway-public/gitrepository.yaml
new file mode 100644
index 0000000000..19149609e8
--- /dev/null
+++ b/chart/templates/istio-gateway-public/gitrepository.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq .Values.istioGatewayPublic.sourceType "git") (not .Values.offline) .Values.istioGatewayPublic.enabled }}
+{{- $gitCredsDict := dict
+ "name" "istioGatewayPublic"
+ "packageGitScope" .Values.istioGatewayPublic.git
+ "rootScope" .
+ "releaseName" .Release.Name
+}}
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+ name: istio-gateway-public
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-gateway-public
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+spec:
+ interval: {{ .Values.flux.interval }}
+ url: {{ .Values.istioGatewayPublic.git.repo }}
+ ref:
+ {{- include "validRef" .Values.istioGatewayPublic.git | nindent 4 }}
+ {{ include "gitIgnore" . }}
+ {{- include "gitCredsExtended" $gitCredsDict | nindent 2 }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-public/helmrelease.yaml b/chart/templates/istio-gateway-public/helmrelease.yaml
new file mode 100644
index 0000000000..59f88adba5
--- /dev/null
+++ b/chart/templates/istio-gateway-public/helmrelease.yaml
@@ -0,0 +1,75 @@
+{{- $fluxSettingsIstioGatewayPublic := merge .Values.istioGatewayPublic.flux .Values.flux -}}
+{{- if and .Values.istioCore.enabled .Values.istioGatewayPublic.enabled }}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: public-ingressgateway
+ namespace: {{ $.Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: istio-gateway
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" $ | nindent 4}}
+ annotations:
+ checksum/bigbang-values: {{ include (print $.Template.BasePath "/istio-gateway-public/values.yaml") $ | sha256sum }}
+spec:
+ releaseName: public-ingressgateway
+ targetNamespace: istio-gateway
+ chart:
+ spec:
+ {{- if eq $.Values.istioGatewayPublic.sourceType "git" }}
+ chart: {{ $.Values.istioGatewayPublic.git.path }}
+ sourceRef:
+ kind: GitRepository
+ name: istio-gateway-public
+ namespace: {{ $.Release.Namespace }}
+ {{- else }}
+ chart: {{ $.Values.istioGatewayPublic.helmRepo.chartName }}
+ version: {{ $.Values.istioGatewayPublic.helmRepo.tag }}
+ sourceRef:
+ kind: HelmRepository
+ name: {{ $.Values.istioGatewayPublic.helmRepo.repoName }}
+ namespace: {{ $.Release.Namespace }}
+ {{- $repoType := include "getRepoType" (dict "repoName" $.Values.istioGatewayPublic.helmRepo.repoName "allRepos" $.Values.helmRepositories) -}}
+ {{- if (and $.Values.istioGatewayPublic.helmRepo.cosignVerify (eq $repoType "oci")) }} # Needs to be an OCI repo
+ verify:
+ provider: cosign
+ secretRef:
+ name: {{ printf "%s-cosign-pub" $.Values.istioGatewayPublic.helmRepo.repoName }}
+ {{- end }}
+ {{- end }}
+ interval: 5m
+
+ {{- toYaml $fluxSettingsIstioGatewayPublic | nindent 2 }}
+
+ {{- if $.Values.istioGatewayPublic.postRenderers }}
+ postRenderers:
+ {{ toYaml $.Values.istioGatewayPublic.postRenderers | nindent 4 }}
+ {{- end }}
+ valuesFrom:
+ - name: {{ $.Release.Name }}-istio-gateway-public-values
+ kind: Secret
+ valuesKey: "common"
+ - name: {{ $.Release.Name }}-istio-gateway-public-values
+ kind: Secret
+ valuesKey: "defaults"
+ - name: {{ $.Release.Name }}-istio-gateway-public-values
+ kind: Secret
+ valuesKey: "overlays"
+
+ dependsOn:
+ - name: istio-core
+ namespace: {{ $.Release.Namespace }}
+ {{- if $.Values.gatekeeper.enabled }}
+ - name: gatekeeper
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
+ {{- if $.Values.kyvernoPolicies.enabled }}
+ - name: kyverno-policies
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
+ {{- if $.Values.istioGatewayPassthrough.enabled }}
+ - name: passthrough-ingressgateway
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-public/imagepullsecret.yaml b/chart/templates/istio-gateway-public/imagepullsecret.yaml
new file mode 100644
index 0000000000..014bcf8409
--- /dev/null
+++ b/chart/templates/istio-gateway-public/imagepullsecret.yaml
@@ -0,0 +1,14 @@
+{{- if and .Values.istioGatewayPublic.enabled ( include "imagePullSecret" . ) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: private-registry-public
+ namespace: istio-gateway
+ labels:
+ app.kubernetes.io/name: istio-gateway-public
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+type: kubernetes.io/dockerconfigjson
+data:
+ .dockerconfigjson: {{ template "imagePullSecret" . }}
+{{- end }}
diff --git a/chart/templates/istio-gateway-public/secret-tls.yaml b/chart/templates/istio-gateway-public/secret-tls.yaml
new file mode 100644
index 0000000000..39b1958997
--- /dev/null
+++ b/chart/templates/istio-gateway-public/secret-tls.yaml
@@ -0,0 +1,20 @@
+{{- if and .Values.istioCore.enabled .Values.istioGatewayPublic.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: public-cert
+ namespace: istio-gateway
+ labels:
+ app.kubernetes.io/name: istio-gateway
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" $ | nindent 4}}
+type: kubernetes.io/tls
+data:
+ tls.crt: {{ .Values.istioGatewayPublic.tls.cert | b64enc }}
+ tls.key: {{ .Values.istioGatewayPublic.tls.key | b64enc }}
+ {{- if .Values.istioGatewayPublic.tls.ca }}
+ ca.crt: {{ .Values.istioGatewayPublic.tls.ca | b64enc }}
+ {{- end }}
+---
+{{- end }}
diff --git a/chart/templates/istio-gateway-public/values.yaml b/chart/templates/istio-gateway-public/values.yaml
new file mode 100644
index 0000000000..2faeb806fe
--- /dev/null
+++ b/chart/templates/istio-gateway-public/values.yaml
@@ -0,0 +1,47 @@
+{{- $pkg := "istioGatewayPublic" }}
+
+{{- /* Create secret */ -}}
+{{- if (get .Values $pkg).enabled }}
+{{- include "values-secret" (dict "root" $ "package" (get .Values $pkg) "name" ($pkg | kebabcase) "defaults" (include (printf "bigbang.defaults.%s" $pkg | kebabcase) .)) }}
+{{- end }}
+
+{{- define "bigbang.defaults.istio-gateway-public" -}}
+createNamespace: true
+
+imagePullPolicy: {{ .Values.imagePullPolicy }}
+
+imagePullSecrets:
+ - name: private-registry-public
+
+networkPolicies:
+ enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
+ controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+
+labels:
+ istio: ingressgateway
+
+monitoring:
+ enabled: {{ .Values.monitoring.enabled }}
+
+gateway:
+ servers:
+ - hosts:
+ - '*.{{ .Values.domain }}'
+ port:
+ name: http
+ number: 8080
+ protocol: HTTP
+ tls:
+ httpsRedirect: true
+ - hosts:
+ - '*.{{ .Values.domain }}'
+ port:
+ name: https
+ number: 8443
+ protocol: HTTPS
+ tls:
+ credentialName: public-cert
+ mode: SIMPLE
+{{- end -}}
\ No newline at end of file
diff --git a/chart/templates/jaeger/helmrelease.yaml b/chart/templates/jaeger/helmrelease.yaml
index cf9ba28658..91357a891c 100644
--- a/chart/templates/jaeger/helmrelease.yaml
+++ b/chart/templates/jaeger/helmrelease.yaml
@@ -57,11 +57,15 @@ spec:
kind: Secret
valuesKey: "overlays"
- {{ if or .Values.istio.enabled .Values.monitoring.enabled .Values.jaeger.sso.enabled .Values.elasticsearchKibana.enabled }}
+ {{ if or (include "istioEnabled" .) .Values.monitoring.enabled .Values.jaeger.sso.enabled .Values.elasticsearchKibana.enabled }}
dependsOn:
{{- if .Values.istio.enabled }}
- name: istio
namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
{{- end }}
{{- if .Values.monitoring.enabled }}
- name: monitoring
diff --git a/chart/templates/jaeger/namespace.yaml b/chart/templates/jaeger/namespace.yaml
index dabc0e00f2..a5c6f33831 100644
--- a/chart/templates/jaeger/namespace.yaml
+++ b/chart/templates/jaeger/namespace.yaml
@@ -4,7 +4,7 @@ kind: Namespace
metadata:
name: jaeger
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.jaeger) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.jaeger) "enabled")) }}
app.kubernetes.io/name: jaeger
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
diff --git a/chart/templates/jaeger/values.yaml b/chart/templates/jaeger/values.yaml
index e748950a00..ee48c7de15 100644
--- a/chart/templates/jaeger/values.yaml
+++ b/chart/templates/jaeger/values.yaml
@@ -15,18 +15,18 @@ hostname: {{ $domainName }}
domain: {{ $domainName }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.jaeger.values)
(dig "hardened" "enabled" false .Values.istio.values)
}}
jaeger:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
gateways:
- - istio-system/{{ default "public" .Values.jaeger.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.jaeger.ingress.gateway }}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
annotations:
{{ include "istioAnnotation" . }}
{{- end }}
@@ -34,7 +34,7 @@ annotations:
monitoring:
enabled: {{ .Values.monitoring.enabled }}
# conditional passes only for default istio: enabled, mTLS: SCRICT
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.jaeger.values) "STRICT") }}
+ {{- if and (include "istioEnabled" . ) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.jaeger.values) "STRICT") }}
serviceMonitor:
scheme: https
tlsConfig:
@@ -51,10 +51,10 @@ sso:
enabled: {{ .Values.jaeger.sso.enabled }}
-{{- if or .Values.jaeger.sso.enabled .Values.istio.enabled .Values.kiali.enabled }}
+{{- if or .Values.jaeger.sso.enabled (include "istioEnabled" .) .Values.kiali.enabled }}
jaeger:
spec:
- {{- if or .Values.jaeger.sso.enabled .Values.istio.enabled }}
+ {{- if or .Values.jaeger.sso.enabled (include "istioEnabled" .) }}
{{- $jaegerAuthserviceKey := (dig "selector" "key" "protect" .Values.addons.authservice.values) }}
{{- $jaegerAuthserviceValue := (dig "selector" "value" "keycloak" .Values.addons.authservice.values) }}
allInOne:
@@ -62,7 +62,7 @@ jaeger:
labels:
{{ $jaegerAuthserviceKey }}: {{ $jaegerAuthserviceValue }}
{{- end }}
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
annotations:
{{ include "istioAnnotation" . }}
{{- end }}
@@ -71,12 +71,12 @@ jaeger:
labels:
{{ $jaegerAuthserviceKey }}: {{ $jaegerAuthserviceValue }}
{{- end }}
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
annotations:
{{ include "istioAnnotation" . }}
{{- end }}
{{- end }}
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
agent:
annotations:
{{ include "istioAnnotation" . }}
@@ -92,6 +92,8 @@ openshift:
enabled: {{ .Values.openshift }}
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
ingressLabels:
{{- $gateway := default "public" .Values.jaeger.ingress.gateway }}
diff --git a/chart/templates/keycloak/helmrelease.yaml b/chart/templates/keycloak/helmrelease.yaml
index 1390da94ec..14b6034012 100644
--- a/chart/templates/keycloak/helmrelease.yaml
+++ b/chart/templates/keycloak/helmrelease.yaml
@@ -59,7 +59,7 @@ spec:
kind: Secret
valuesKey: "overlays"
- {{- if or .Values.gatekeeper.enabled .Values.istio.enabled .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
+ {{- if or .Values.gatekeeper.enabled (include "istioEnabled" .) .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
dependsOn:
{{- if .Values.gatekeeper.enabled }}
- name: gatekeeper
@@ -69,6 +69,10 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.kyvernoPolicies.enabled }}
- name: kyverno-policies
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/keycloak/namespace.yaml b/chart/templates/keycloak/namespace.yaml
index 0a37a9e353..065544a6cc 100644
--- a/chart/templates/keycloak/namespace.yaml
+++ b/chart/templates/keycloak/namespace.yaml
@@ -5,7 +5,7 @@ kind: Namespace
metadata:
name: {{ $name }}
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.keycloak) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.keycloak) "enabled")) }}
app.kubernetes.io/name: {{ $name }}
app.kubernetes.io/component: "security-tools"
{{- include "commonLabels" . | nindent 4 }}
diff --git a/chart/templates/keycloak/values.yaml b/chart/templates/keycloak/values.yaml
index 7f6de7f0b0..eaac46fb50 100644
--- a/chart/templates/keycloak/values.yaml
+++ b/chart/templates/keycloak/values.yaml
@@ -18,10 +18,10 @@ domain: {{ $domainName }}
openshift: {{ .Values.openshift }}
-{{- $istioInjection := (and (eq (dig "istio" "injection" "enabled" .Values.addons.keycloak) "enabled") .Values.istio.enabled) }}
+{{- $istioInjection := (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.keycloak) "enabled")) }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.addons.keycloak.values)
@@ -31,7 +31,7 @@ istio:
keycloak:
enabled: true
gateways:
- - istio-system/{{ default "public" .Values.addons.keycloak.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPassthroughGateway" . ) .Values.addons.keycloak.ingress.gateway }}
{{- if $istioInjection }}
podAnnotations:
@@ -41,6 +41,8 @@ podAnnotations:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
{{- $gateway := default "passthrough" .Values.addons.keycloak.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
diff --git a/chart/templates/kiali/helmrelease.yaml b/chart/templates/kiali/helmrelease.yaml
index 800b1a5f74..0b720284fb 100644
--- a/chart/templates/kiali/helmrelease.yaml
+++ b/chart/templates/kiali/helmrelease.yaml
@@ -55,11 +55,15 @@ spec:
kind: Secret
valuesKey: "overlays"
- {{ if or .Values.istio.enabled .Values.monitoring.enabled }}
+ {{ if or (include "istioEnabled" . ) .Values.monitoring.enabled }}
dependsOn:
{{- if .Values.istio.enabled }}
- name: istio
namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
{{- end }}
{{- if .Values.monitoring.enabled }}
- name: monitoring
diff --git a/chart/templates/kiali/namespace.yaml b/chart/templates/kiali/namespace.yaml
index 56ef0e8f10..e94074d054 100644
--- a/chart/templates/kiali/namespace.yaml
+++ b/chart/templates/kiali/namespace.yaml
@@ -4,7 +4,7 @@ kind: Namespace
metadata:
name: kiali
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.kiali) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.kiali) "enabled")) }}
app.kubernetes.io/name: kiali
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
diff --git a/chart/templates/kiali/values.yaml b/chart/templates/kiali/values.yaml
index a42a8cebea..dbd9de02bc 100644
--- a/chart/templates/kiali/values.yaml
+++ b/chart/templates/kiali/values.yaml
@@ -16,7 +16,7 @@ image:
pullPolicy: {{ .Values.imagePullPolicy }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.kiali.values)
@@ -26,9 +26,9 @@ istio:
enabled: {{ .Values.monitoring.enabled }}
kiali:
gateways:
- - istio-system/{{ default "public" .Values.kiali.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.kiali.ingress.gateway }}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
podAnnotations:
{{ include "istioAnnotation" . }}
{{- end }}
@@ -43,9 +43,12 @@ elasticsearch:
enabled: {{ .Values.elasticsearchKibana.enabled }}
cr:
spec:
+ {{- if .Values.istioCore.enabled }}
+ istio_namespace: istio-system
+ {{- end}}
deployment:
image_pull_policy: {{ .Values.imagePullPolicy }}
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
pod_annotations:
{{ include "istioAnnotation" . }}
{{- end }}
@@ -97,6 +100,7 @@ cr:
- app_label: istiod
is_core: true
is_proxy: false
+ {{- if .Values.istio.enabled }}
{{- range $name, $values := .Values.istio.ingressGateways }}
{{ if ne $values.enabled false }}
- app_label: {{ $name }}
@@ -111,6 +115,23 @@ cr:
is_proxy: true
{{- end }}
{{- end }}
+ {{- end }}
+ {{- if .Values.istioGatewayPublic.enabled }}
+ - app_label: public-ingressgateway
+ is_core: true
+ is_proxy: true
+ namespace: istio-gateway
+ {{- end }}
+ {{- if .Values.istioGatewayPassthrough.enabled }}
+ - app_label: passthrough-ingressgateway
+ is_core: true
+ is_proxy: true
+ namespace: istio-gateway
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ ingress_gateway_namespace: istio-gateway
+ egress_gateway_namespace: istio-gateway
+ {{- end }}
api:
namespaces:
# bigbang watches all!
@@ -118,8 +139,16 @@ cr:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
+ {{- if .Values.istio.enabled }}
{{- $gateway := default "public" .Values.kiali.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
{{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ app: public-ingressgateway
+ istio: ingressgateway
+ {{- end }}
{{- end -}}
diff --git a/chart/templates/kyverno-policies/values.yaml b/chart/templates/kyverno-policies/values.yaml
index 730aa4be62..edb9c7f3c0 100644
--- a/chart/templates/kyverno-policies/values.yaml
+++ b/chart/templates/kyverno-policies/values.yaml
@@ -55,7 +55,7 @@ policies:
# Istio services (istio ingress) can create type: NodePort services
disallow-nodeport-services:
validationFailureAction: Enforce
- {{- if $nodePortIngressGateways }}
+ {{- if or $nodePortIngressGateways .Values.istioCore.enabled }}
exclude:
any:
- resources:
@@ -67,6 +67,20 @@ policies:
{{- end }}
namespaces:
- "istio-system"
+ {{- if .Values.istioCore.enabled }}
+ - resources:
+ kinds:
+ - Service
+ names:
+ {{- if .Values.istioGatewayPassthrough.enabled }}
+ - "istio-gateway-passthrough-ingressgateway"
+ {{- end }}
+ {{- if .Values.istioGatewayPublic }}
+ - "public-ingressgateway"
+ {{- end }}
+ namespaces:
+ - "istio-gateway"
+ {{- end }}
{{- end }}
disallow-image-tags:
@@ -74,13 +88,14 @@ policies:
validationFailureAction: Enforce
disallow-istio-injection-bypass:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
exclude:
any:
# Istio does not inject itself
- resources:
namespaces:
- istio-system
+ - istio-gateway
disallow-namespaces:
enabled: true
@@ -268,7 +283,7 @@ policies:
- app.kubernetes.io/version
require-istio-on-namespaces:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
exclude:
any:
- resources:
@@ -285,6 +300,7 @@ policies:
# Istio does not inject itself
- istio-operator
- istio-system
+ - istio-gateway
add-default-securitycontext:
validationFailureAction: Enforce
@@ -380,7 +396,7 @@ policies:
require-non-root-group:
validationFailureAction: Enforce
- {{ if .Values.istio.enabled }}
+ {{ if include "istioEnabled" . }}
parameters:
excludeContainers:
- istio-init
@@ -398,6 +414,13 @@ policies:
- resources:
namespaces:
- kube-system
+ {{ if .Values.istioCore.enabled }}
+ - resources:
+ namespaces:
+ - istio-system
+ names:
+ - istiod*
+ {{- end }}
{{- if $deployNodeAgent }}
# Velero. The node agent backup tool requires root group access to see the host's runtime pod directory which is
# mounted inside velero/node agent pods.
@@ -462,7 +485,7 @@ policies:
require-non-root-user:
validationFailureAction: Enforce
- {{ if .Values.istio.enabled }}
+ {{ if include "istioEnabled" . }}
parameters:
excludeContainers:
- istio-init
@@ -586,7 +609,7 @@ policies:
allow:
# Defaults from https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
- NET_BIND_SERVICE
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
# Istio requires NET_ADMIN and NET_RAW for sidecar init: https://istio.io/latest/docs/ops/deployment/requirements/#pod-requirements
# It uses these permissions to setup iptables for network routing
# Cannot create exclusion since sidecar is injected in most containers, so allow the capabilities globally
@@ -1128,7 +1151,7 @@ policies:
- gitlab-runner-*
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
{{- end }}
diff --git a/chart/templates/kyverno-reporter/values.yaml b/chart/templates/kyverno-reporter/values.yaml
index 0e01f9ae0d..f415f7c9cc 100644
--- a/chart/templates/kyverno-reporter/values.yaml
+++ b/chart/templates/kyverno-reporter/values.yaml
@@ -67,6 +67,8 @@ openshift: {{ .Values.openshift }}
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
{{- end -}}
diff --git a/chart/templates/loki/helmrelease.yaml b/chart/templates/loki/helmrelease.yaml
index 4e58d99a9e..6bef4d220a 100644
--- a/chart/templates/loki/helmrelease.yaml
+++ b/chart/templates/loki/helmrelease.yaml
@@ -78,6 +78,10 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.kyvernoPolicies.enabled }}
- name: kyverno-policies
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/loki/namespace.yaml b/chart/templates/loki/namespace.yaml
index bd0e5687fe..ce2a721278 100644
--- a/chart/templates/loki/namespace.yaml
+++ b/chart/templates/loki/namespace.yaml
@@ -7,5 +7,5 @@ metadata:
app.kubernetes.io/name: logging
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.loki) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.loki) "enabled")) }}
{{- end }}
diff --git a/chart/templates/loki/values.yaml b/chart/templates/loki/values.yaml
index f0b67d1110..c2c38ce8a3 100644
--- a/chart/templates/loki/values.yaml
+++ b/chart/templates/loki/values.yaml
@@ -13,8 +13,8 @@ clusterName: ""
openshift: {{ .Values.openshift }}
istio:
- enabled: {{ .Values.istio.enabled }}
- {{- if or
+ enabled: {{ include "istioEnabled" . }}
+ {{- if or
(dig "hardened" "enabled" false .Values.istio.values)
(dig "istio" "hardened" "enabled" false .Values.monitoring.values)
(dig "istio" "hardened" "enabled" false .Values.addons.authservice.values)
@@ -34,6 +34,10 @@ istio:
minioOperator:
enabled: {{ .Values.addons.minioOperator.enabled }}
{{- end }}
+ loki:
+ enabled: true
+ gateways:
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) }}
imagePullSecrets:
- name: private-registry
@@ -44,13 +48,15 @@ image:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
monitoring:
enabled: {{ .Values.monitoring.enabled }}
serviceMonitor:
enabled: {{ .Values.monitoring.enabled }}
# conditional passes only for default istio: enabled, mTLS: SCRICT
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.loki.values) "STRICT") }}
+ {{- if and (include "istioEnabled" . ) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.loki.values) "STRICT") }}
scheme: https
tlsConfig:
caFile: /etc/prom-certs/root-cert.pem
@@ -102,7 +108,7 @@ loki:
filesystem:
directory: /var/loki/chunks
{{- end }}
- {{- if .Values.istio.enabled }}
+ {{- if include "istioEnabled" . }}
podAnnotations:
{{ include "istioAnnotation" . }}
{{- end }}
diff --git a/chart/templates/metrics-server/namespace.yaml b/chart/templates/metrics-server/namespace.yaml
index ac5f129826..db44ee2f9e 100644
--- a/chart/templates/metrics-server/namespace.yaml
+++ b/chart/templates/metrics-server/namespace.yaml
@@ -9,6 +9,6 @@ metadata:
app.kubernetes.io/name: metrics-server
app.kubernetes.io/component: "cluster-utilities"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.metricsServer) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.metricsServer) "enabled")) }}
name: metrics-server
{{- end }}
diff --git a/chart/templates/minio-operator/helmrelease.yaml b/chart/templates/minio-operator/helmrelease.yaml
index 65d539cdff..ee2d0ea685 100644
--- a/chart/templates/minio-operator/helmrelease.yaml
+++ b/chart/templates/minio-operator/helmrelease.yaml
@@ -69,6 +69,10 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.kyvernoPolicies.enabled }}
- name: kyverno-policies
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/minio-operator/namespace.yaml b/chart/templates/minio-operator/namespace.yaml
index e18fda7f8c..42f9a5b84a 100644
--- a/chart/templates/minio-operator/namespace.yaml
+++ b/chart/templates/minio-operator/namespace.yaml
@@ -4,7 +4,7 @@ kind: Namespace
metadata:
name: minio-operator
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.minioOperator) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.minioOperator) "enabled")) }}
app.kubernetes.io/name: minioOperator
app.kubernetes.io/component: "application-utilities"
{{- include "commonLabels" . | nindent 4}}
diff --git a/chart/templates/minio-operator/values.yaml b/chart/templates/minio-operator/values.yaml
index a3166366fe..482aca0f1b 100644
--- a/chart/templates/minio-operator/values.yaml
+++ b/chart/templates/minio-operator/values.yaml
@@ -38,13 +38,15 @@ operator:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
{{- $gateway := default "public" .Values.addons.minio.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
{{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.addons.minioOperator.values)
@@ -53,9 +55,9 @@ istio:
}}
console:
gateways:
- - istio-system/{{ default "public" .Values.addons.minio.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.addons.minio.ingress.gateway }}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
annotations:
{{ include "istioAnnotation" . }}
{{- end }}
diff --git a/chart/templates/minio/namespace.yaml b/chart/templates/minio/namespace.yaml
index 5133e83cc2..c8fe4c9417 100644
--- a/chart/templates/minio/namespace.yaml
+++ b/chart/templates/minio/namespace.yaml
@@ -4,7 +4,7 @@ kind: Namespace
metadata:
name: minio
labels:
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.addons.minio) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.addons.minio) "enabled")) }}
app.kubernetes.io/name: minio
app.kubernetes.io/component: "application-utilities"
{{- include "commonLabels" . | nindent 4}}
diff --git a/chart/templates/minio/values.yaml b/chart/templates/minio/values.yaml
index e62638202d..5b0d1c53ea 100644
--- a/chart/templates/minio/values.yaml
+++ b/chart/templates/minio/values.yaml
@@ -9,13 +9,13 @@ hostname: {{ $domainName }}
domain: {{ $domainName }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
console:
gateways:
- - istio-system/{{ default "public" .Values.addons.minio.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.addons.minio.ingress.gateway }}
api:
gateways:
- - istio-system/{{ default "public" .Values.addons.minio.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.addons.minio.ingress.gateway }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.addons.minioOperator.values)
@@ -23,7 +23,7 @@ istio:
(dig "hardened" "enabled" false .Values.istio.values)
}}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
annotations:
{{ include "istioAnnotation" . }}
{{- end }}
diff --git a/chart/templates/monitoring/helmrelease.yaml b/chart/templates/monitoring/helmrelease.yaml
index d526e0f195..023d1186b9 100644
--- a/chart/templates/monitoring/helmrelease.yaml
+++ b/chart/templates/monitoring/helmrelease.yaml
@@ -56,12 +56,16 @@ spec:
valuesKey: "overlays"
# TODO: DRY this up
- {{- if or .Values.gatekeeper.enabled .Values.istio.enabled .Values.kyvernoPolicies.enabled .Values.addons.vault.enabled }}
+ {{- if or .Values.gatekeeper.enabled (include "istioEnabled" .) .Values.kyvernoPolicies.enabled .Values.addons.vault.enabled }}
dependsOn:
{{- if .Values.istio.enabled }}
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.gatekeeper.enabled }}
- name: gatekeeper
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/monitoring/namespace.yaml b/chart/templates/monitoring/namespace.yaml
index 89b930f4ed..818b8e84e0 100644
--- a/chart/templates/monitoring/namespace.yaml
+++ b/chart/templates/monitoring/namespace.yaml
@@ -7,5 +7,5 @@ metadata:
app.kubernetes.io/name: monitoring
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.monitoring) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.monitoring) "enabled")) }}
{{- end }}
diff --git a/chart/templates/monitoring/values.yaml b/chart/templates/monitoring/values.yaml
index 886110eeee..be54fc9c6a 100644
--- a/chart/templates/monitoring/values.yaml
+++ b/chart/templates/monitoring/values.yaml
@@ -8,7 +8,7 @@
hostname: {{ $domainName }}
domain: {{ $domainName }}
-{{- $istioInjection := (and (eq (dig "istio" "injection" "enabled" .Values.monitoring) "enabled") .Values.istio.enabled) }}
+{{- $istioInjection := (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.monitoring) "enabled")) }}
{{- $gitlabRedis := (and (ne .Values.addons.gitlab.redis.password "" ) (or .Values.addons.gitlab.enabled .Values.addons.gitlabRunner.enabled)) }}
{{- $authserviceRedisEnabled := (and (dig "values" "redis" "enabled" false .Values.addons.authservice) .Values.addons.authservice.enabled) }}
{{- $redisDatasource := (or $gitlabRedis .Values.addons.argocd.enabled $authserviceRedisEnabled) }}
@@ -21,11 +21,19 @@ flux:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
ingressLabels:
+ {{- if .Values.istio.enabled }}
{{- $gateway := default "public" .Values.monitoring.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
{{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ app: public-ingressgateway
+ istio: ingressgateway
+ {{- end }}
openshift: {{ .Values.openshift }}
@@ -37,7 +45,7 @@ gitlabRunner:
istio:
{{- $monitoringInjection := dig "istio" "injection" "enabled" .Values.monitoring }}
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.monitoring.values)
@@ -76,7 +84,7 @@ istio:
namespace: authservice
{{- end }}
gateways:
- - istio-system/{{ default "public" .Values.monitoring.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.monitoring.ingress.gateway }}
alertmanager:
enabled: true
{{- if and .Values.monitoring.sso.enabled (eq $monitoringInjection "disabled") }}
@@ -85,7 +93,7 @@ istio:
namespace: authservice
{{- end }}
gateways:
- - istio-system/{{ default "public" .Values.monitoring.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.monitoring.ingress.gateway }}
injection: {{ dig "istio" "injection" "enabled" .Values.monitoring }}
alertmanager:
@@ -112,7 +120,7 @@ alertmanager:
{{ include "istioAnnotation" . }}
{{- end }}
{{- end }}
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
+ {{- if and (include "istioEnabled" .) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
serviceMonitor:
scheme: https
tlsConfig:
@@ -143,7 +151,7 @@ prometheus:
thanosServiceMonitor:
enabled: true
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
+ {{- if and (include "istioEnabled" .) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
serviceMonitor:
scheme: https
tlsConfig:
@@ -154,7 +162,7 @@ prometheus:
{{- end }}
{{- end }}
prometheusSpec:
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
+ {{- if and (include "istioEnabled" .) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.monitoring.values) "STRICT") }}
alertingEndpoints:
- name: monitoring-monitoring-kube-alertmanager
namespace: monitoring
diff --git a/chart/templates/neuvector/helmrelease.yaml b/chart/templates/neuvector/helmrelease.yaml
index a667f095d6..e5faf64217 100644
--- a/chart/templates/neuvector/helmrelease.yaml
+++ b/chart/templates/neuvector/helmrelease.yaml
@@ -55,7 +55,7 @@ spec:
kind: Secret
valuesKey: "overlays"
- {{- if or .Values.gatekeeper.enabled .Values.istio.enabled .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
+ {{- if or .Values.gatekeeper.enabled (include "istioEnabled" .) .Values.kyvernoPolicies.enabled .Values.monitoring.enabled }}
dependsOn:
{{- if .Values.gatekeeper.enabled }}
- name: gatekeeper
@@ -65,6 +65,10 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.kyvernoPolicies.enabled }}
- name: kyverno-policies
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/neuvector/namespace.yaml b/chart/templates/neuvector/namespace.yaml
index a231b71f7c..2a5da6412c 100644
--- a/chart/templates/neuvector/namespace.yaml
+++ b/chart/templates/neuvector/namespace.yaml
@@ -7,5 +7,5 @@ metadata:
app.kubernetes.io/name: neuvector
app.kubernetes.io/component: "sandbox"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.neuvector) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.neuvector) "enabled")) }}
{{- end }}
\ No newline at end of file
diff --git a/chart/templates/neuvector/values.yaml b/chart/templates/neuvector/values.yaml
index 832672c5a4..00f975a538 100644
--- a/chart/templates/neuvector/values.yaml
+++ b/chart/templates/neuvector/values.yaml
@@ -7,10 +7,10 @@ domain: {{ default .Values.domain .Values.hostname }}
openshift: {{ .Values.openshift }}
-{{ $istioInjection := (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.neuvector) "enabled")) }}
+{{ $istioInjection := (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.neuvector) "enabled")) }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.neuvector.values)
@@ -18,7 +18,7 @@ istio:
}}
neuvector:
gateways:
- - istio-system/{{ default "public" .Values.neuvector.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.monitoring.ingress.gateway }}
injection: {{ ternary "enabled" "disabled" $istioInjection }}
monitoring:
@@ -113,7 +113,7 @@ cve:
{{- end }}
{{- end }}
-{{- if or .Values.istio.enabled $.Values.kiali.enabled }}
+{{- if or (include "istioEnabled" .) $.Values.kiali.enabled }}
manager:
{{- if $istioInjection }}
podAnnotations:
@@ -124,10 +124,18 @@ manager:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
+ {{- if .Values.istio.enabled }}
{{- $gateway := default "public" .Values.neuvector.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
{{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ app: public-ingressgateway
+ istio: ingressgateway
+ {{- end }}
{{- end }}
{{- /* Create secret */ -}}
diff --git a/chart/templates/promtail/helmrelease.yaml b/chart/templates/promtail/helmrelease.yaml
index 921a3acf30..40c0518b5b 100644
--- a/chart/templates/promtail/helmrelease.yaml
+++ b/chart/templates/promtail/helmrelease.yaml
@@ -70,6 +70,10 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- if .Values.kyvernoPolicies.enabled }}
- name: kyverno-policies
namespace: {{ .Release.Namespace }}
diff --git a/chart/templates/promtail/namespace.yaml b/chart/templates/promtail/namespace.yaml
index a65c30ac6d..93c357ba4c 100644
--- a/chart/templates/promtail/namespace.yaml
+++ b/chart/templates/promtail/namespace.yaml
@@ -7,5 +7,5 @@ metadata:
app.kubernetes.io/name: promtail
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.promtail) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.promtail) "enabled")) }}
{{- end }}
diff --git a/chart/templates/promtail/values.yaml b/chart/templates/promtail/values.yaml
index 30632d2a7d..2b9f132330 100644
--- a/chart/templates/promtail/values.yaml
+++ b/chart/templates/promtail/values.yaml
@@ -12,7 +12,7 @@ image:
openshift: {{ .Values.openshift }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.promtail.values)
@@ -25,7 +25,7 @@ loki:
serviceMonitor:
enabled: {{ .Values.monitoring.enabled }}
# conditional passes only for default istio: enabled, mTLS: SCRICT
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.promtail.values) "STRICT") }}
+ {{- if and (include "istioEnabled" . ) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.promtail.values) "STRICT") }}
scheme: https
tlsConfig:
caFile: /etc/prom-certs/root-cert.pem
@@ -41,7 +41,7 @@ networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
podAnnotations:
{{ include "istioAnnotation" . }}
{{- end }}
diff --git a/chart/templates/sonarqube/values.yaml b/chart/templates/sonarqube/values.yaml
index 7b1da3aa41..93454f4376 100644
--- a/chart/templates/sonarqube/values.yaml
+++ b/chart/templates/sonarqube/values.yaml
@@ -30,6 +30,8 @@ monitoring:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
ingressLabels:
{{- $gateway := default "public" .Values.addons.sonarqube.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
diff --git a/chart/templates/tempo/helmrelease.yaml b/chart/templates/tempo/helmrelease.yaml
index e7ca5d5143..2b4b68255d 100644
--- a/chart/templates/tempo/helmrelease.yaml
+++ b/chart/templates/tempo/helmrelease.yaml
@@ -56,7 +56,7 @@ spec:
- name: {{ .Release.Name }}-tempo-values
kind: Secret
valuesKey: "overlays"
- {{- if or .Values.monitoring.enabled .Values.istio.enabled .Values.tempo.sso.enabled }}
+ {{- if or .Values.monitoring.enabled .Values.tempo.sso.enabled (include "istioEnabled" .) }}
dependsOn:
{{- if .Values.monitoring.enabled }}
- name: monitoring
@@ -70,5 +70,9 @@ spec:
- name: istio
namespace: {{ .Release.Namespace }}
{{- end }}
+ {{- if .Values.istioCore.enabled }}
+ - name: istio-core
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
{{- end }}
{{- end }}
diff --git a/chart/templates/tempo/namespace.yaml b/chart/templates/tempo/namespace.yaml
index 8ce52cc3a3..1419d53a4e 100644
--- a/chart/templates/tempo/namespace.yaml
+++ b/chart/templates/tempo/namespace.yaml
@@ -7,5 +7,5 @@ metadata:
app.kubernetes.io/name: tempo
app.kubernetes.io/component: "core"
{{- include "commonLabels" . | nindent 4}}
- istio-injection: {{ ternary "enabled" "disabled" (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.tempo) "enabled")) }}
+ istio-injection: {{ ternary "enabled" "disabled" (and (include "istioEnabled" .) (eq (dig "istio" "injection" "enabled" .Values.tempo) "enabled")) }}
{{- end }}
diff --git a/chart/templates/tempo/values.yaml b/chart/templates/tempo/values.yaml
index b7aeaa2733..b71fa16f18 100644
--- a/chart/templates/tempo/values.yaml
+++ b/chart/templates/tempo/values.yaml
@@ -4,7 +4,7 @@
{{- define "bigbang.defaults.tempo" -}}
-{{- if .Values.istio.enabled }}
+{{- if include "istioEnabled" . }}
podAnnotations:
{{ include "istioAnnotation" . }}
{{- end }}
@@ -51,14 +51,22 @@ serviceAccount:
networkPolicies:
enabled: {{ .Values.networkPolicies.enabled }}
+ istioNamespaceSelector:
+ {{ include "istioNamespaceSelector" . | nindent 4 }}
controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
ingressLabels:
+ {{- if .Values.istio.enabled }}
{{- $gateway := default "public" .Values.tempo.ingress.gateway }}
{{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
{{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
+ {{- end }}
+ {{- if .Values.istioCore.enabled }}
+ app: public-ingressgateway
+ istio: ingressgateway
+ {{- end }}
istio:
- enabled: {{ .Values.istio.enabled }}
+ enabled: {{ include "istioEnabled" . }}
hardened:
enabled: {{ or
(dig "istio" "hardened" "enabled" false .Values.tempo.values)
@@ -71,7 +79,7 @@ istio:
- "tempo.{{ .Values.domain }}"
{{- end }}
gateways:
- - istio-system/{{ default "public" .Values.tempo.ingress.gateway }}
+ - {{ include "istioGatewayNamespace" . }}/{{ default (include "istioPublicGateway" . ) .Values.tempo.ingress.gateway }}
monitoring:
enabled: {{ .Values.monitoring.enabled }}
@@ -81,7 +89,7 @@ serviceMonitor:
# conditional passes only if all conditionals are true:
# - istio: enabled
# - mTLS: SCRICT
- {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.tempo.values) "STRICT") }}
+ {{- if and (include "istioEnabled" .) (eq (dig "istio" "mtls" "mode" "STRICT" .Values.tempo.values) "STRICT") }}
scheme: https
tlsConfig:
caFile: /etc/prom-certs/root-cert.pem
diff --git a/chart/values.schema.json b/chart/values.schema.json
index 3733ee0e04..78665a8e66 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -14,6 +14,9 @@
"flux",
"networkPolicies",
"imagePullPolicy",
+ "istioCore",
+ "istioGatewayPublic",
+ "istioGatewayPassthrough",
"istio",
"istioOperator",
"jaeger",
@@ -237,6 +240,59 @@
"IfNotPresent"
]
},
+ "istioCore": {
+ "properties": {
+ "enabled": true,
+ "sourceType": true,
+ "git": true,
+ "helmRepo": true,
+ "flux": true,
+ "values": true,
+ "postRenderers": true
+ },
+ "allOf": [
+ {
+ "$ref": "#/$defs/basePackage"
+ }
+ ],
+ "additionalProperties": true
+ },
+ "istioGatewayPublic": {
+ "properties": {
+ "enabled": true,
+ "sourceType": true,
+ "git": true,
+ "helmRepo": true,
+ "flux": true,
+ "values": true,
+ "postRenderers": true,
+ "tls": true
+ },
+ "allOf": [
+ {
+ "$ref": "#/$defs/basePackage"
+ }
+ ],
+ "additionalProperties": true
+ },
+ "istioGatewayPassthrough": {
+ "properties": {
+ "enabled": true,
+ "sourceType": true,
+ "git": true,
+ "helmRepo": true,
+ "flux": true,
+ "values": true,
+ "postRenderers": true,
+ "tls": true
+ },
+ "allOf": [
+ {
+ "$ref": "#/$defs/basePackage"
+ }
+ ],
+ "additionalProperties": true
+ },
"istio": {
"properties": {
"enabled": true,
diff --git a/chart/values.yaml b/chart/values.yaml
index 9b27725db2..0fa5ef4e1a 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -160,6 +160,87 @@ imagePullPolicy: IfNotPresent
# ----------------------------------------------------------------------------------------------------------------------
# Istio
#
+
+istioCore:
+ status: "alpha"
+ # -- Toggle deployment of Istio (helm deployment of istio-base and istiod)
+ enabled: false
+ # -- Choose source type of "git" or "helmRepo"
+ sourceType: "git"
+ git:
+ repo: https://repo1.dso.mil/big-bang/apps/sandbox/istio-core.git
+ path: "./chart"
+ branch: "main"
+ #tag:
+ helmRepo:
+ repoName: "registry1"
+ chartName: "istio-core"
+ #tag:
+ # -- Values to passthrough to the istiod chart
+ values:
+ # k8s 1.29+ native sidecars ~ https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates
+ # prevent jobs from hanging ~ https://istio.io/latest/blog/2023/native-sidecars/#sidecar-woes
+ istiod:
+ pilot:
+ env:
+ ENABLE_NATIVE_SIDECARS: 'true'
+ # # enable Tetrate FIPS compliant Istio images
+ # defaults:
+ # global:
+ # enterprise: true
+ # -- Flux reconciliation overrides specifically for the Istio Gateway Package
+ flux: {}
+ # -- Post Renderers. See docs/postrenders.md
+ postRenderers: []
+
+istioGatewayPublic:
+ status: "alpha"
+ # -- Toggle deployment of the Istio public ingress gateway
+ enabled: false
+ # -- Choose source type of "git" or "helmRepo"
+ sourceType: "git"
+ git:
+ repo: https://repo1.dso.mil/big-bang/apps/sandbox/istio-gateway.git
+ path: "./chart"
+ branch: "main"
+ #tag:
+ helmRepo:
+ repoName: "registry1"
+ chartName: "istio-gateway"
+ #tag:
+ # -- set the tls key/cert
+ # tls:
+ # key: ""
+ # cert: ""
+ # -- Values to passthrough to the istio-gateway chart
+ values: {}
+ # -- Flux reconciliation overrides specifically for the Istio Gateway Package
+ flux: {}
+ # -- Post Renderers. See docs/postrenders.md
+ postRenderers: []
+
+istioGatewayPassthrough:
+ status: "alpha"
+ # -- Toggle deployment of the Istio passthrough ingress gateway
+ enabled: false
+ # -- Choose source type of "git" or "helmRepo"
+ sourceType: "git"
+ git:
+ repo: https://repo1.dso.mil/big-bang/apps/sandbox/istio-gateway.git
+ path: "./chart"
+ branch: "main"
+ #tag:
+ helmRepo:
+ repoName: "registry1"
+ chartName: "istio-gateway"
+ #tag:
+ # -- Values to passthrough to the istio-gateway chart
+ values: {}
+ # -- Flux reconciliation overrides specifically for the Istio Gateway Package
+ flux: {}
+ # -- Post Renderers. See docs/postrenders.md
+ postRenderers: []
+
istio:
# -- Toggle deployment of Istio.
enabled: true
@@ -1810,7 +1891,7 @@ addons:
# -- Redirect the package ingress to a specific Istio Gateway (listed in `istio.gateways`). The default is "public".
ingress:
# the istio gateway for keycloak must have tls.mode: PASSTHROUGH
- gateway: "passthrough"
+ gateway: ""
# -- Certificate/Key pair to use as the certificate for exposing Keycloak
# Setting the ingress cert here will automatically create the volume and volumemounts in the Keycloak Package chart
key: ""
diff --git a/docs/assets/scripts/developer/k3d-dev.sh b/docs/assets/scripts/developer/k3d-dev.sh
index 6cb606d521..5c75ce99cd 100755
--- a/docs/assets/scripts/developer/k3d-dev.sh
+++ b/docs/assets/scripts/developer/k3d-dev.sh
@@ -1199,7 +1199,7 @@ function fix_etc_hosts {
sudo sed -i '/dev.bigbang.mil/d' /etc/hosts
sudo bash -c "echo '## begin dev.bigbang.mil section (METAL_LB)' >> /etc/hosts"
sudo bash -c "echo 172.20.1.240 keycloak.dev.bigbang.mil vault.dev.bigbang.mil >> /etc/hosts"
- sudo bash -c "echo 172.20.1.241 anchore-api.dev.bigbang.mil anchore.dev.bigbang.mil argocd.dev.bigbang.mil gitlab.dev.bigbang.mil registry.dev.bigbang.mil tracing.dev.bigbang.mil kiali.dev.bigbang.mil kibana.dev.bigbang.mil chat.dev.bigbang.mil minio.dev.bigbang.mil minio-api.dev.bigbang.mil alertmanager.dev.bigbang.mil grafana.dev.bigbang.mil prometheus.dev.bigbang.mil nexus.dev.bigbang.mil sonarqube.dev.bigbang.mil tempo.dev.bigbang.mil twistlock.dev.bigbang.mil >> /etc/hosts"
+ sudo bash -c "echo 172.20.1.241 anchore-api.dev.bigbang.mil anchore.dev.bigbang.mil argocd.dev.bigbang.mil gitlab.dev.bigbang.mil registry.dev.bigbang.mil tracing.dev.bigbang.mil kiali.dev.bigbang.mil kibana.dev.bigbang.mil chat.dev.bigbang.mil minio.dev.bigbang.mil minio-api.dev.bigbang.mil alertmanager.dev.bigbang.mil grafana.dev.bigbang.mil prometheus.dev.bigbang.mil neuvector.dev.bigbang.mil nexus.dev.bigbang.mil sonarqube.dev.bigbang.mil tempo.dev.bigbang.mil twistlock.dev.bigbang.mil >> /etc/hosts"
sudo bash -c "echo '## end dev.bigbang.mil section' >> /etc/hosts"
# run kubectl to add keycloak and vault's hostname/IP to the configmap for coredns, restart coredns
kubectl get configmap -n kube-system coredns -o yaml | sed '/^ 172.20.0.1 host.k3d.internal$/a\ \ \ \ 172.20.1.240 keycloak.dev.bigbang.mil vault.dev.bigbang.mil' | kubectl apply -f -
@@ -1212,7 +1212,7 @@ ENDSSH
sudo sed -i '/dev.bigbang.mil/d' /etc/hosts
sudo bash -c "echo '## begin dev.bigbang.mil section (ATTACH_SECONDARY_IP)' >> /etc/hosts"
sudo bash -c "echo $(getPrivateIP2) keycloak.dev.bigbang.mil vault.dev.bigbang.mil >> /etc/hosts"
- sudo bash -c "echo $PrivateIP anchore-api.dev.bigbang.mil anchore.dev.bigbang.mil argocd.dev.bigbang.mil gitlab.dev.bigbang.mil registry.dev.bigbang.mil tracing.dev.bigbang.mil kiali.dev.bigbang.mil kibana.dev.bigbang.mil chat.dev.bigbang.mil minio.dev.bigbang.mil minio-api.dev.bigbang.mil alertmanager.dev.bigbang.mil grafana.dev.bigbang.mil prometheus.dev.bigbang.mil nexus.dev.bigbang.mil sonarqube.dev.bigbang.mil tempo.dev.bigbang.mil twistlock.dev.bigbang.mil >> /etc/hosts"
+ sudo bash -c "echo $PrivateIP anchore-api.dev.bigbang.mil anchore.dev.bigbang.mil argocd.dev.bigbang.mil gitlab.dev.bigbang.mil registry.dev.bigbang.mil tracing.dev.bigbang.mil kiali.dev.bigbang.mil kibana.dev.bigbang.mil chat.dev.bigbang.mil minio.dev.bigbang.mil minio-api.dev.bigbang.mil alertmanager.dev.bigbang.mil grafana.dev.bigbang.mil prometheus.dev.bigbang.mil neuvector.dev.bigbang.mil nexus.dev.bigbang.mil sonarqube.dev.bigbang.mil tempo.dev.bigbang.mil twistlock.dev.bigbang.mil >> /etc/hosts"
sudo bash -c "echo '## end dev.bigbang.mil section' >> /etc/hosts"
# run kubectl to add keycloak and vault's hostname/IP to the configmap for coredns, restart coredns
kubectl get configmap -n kube-system coredns -o yaml | sed '/^ .* host.k3d.internal$/a\ \ \ \ $(getPrivateIP2) keycloak.dev.bigbang.mil vault.dev.bigbang.mil' | kubectl apply -f -
diff --git a/tests/package-mapping.yaml b/tests/package-mapping.yaml
index b98854f260..a6b01fee8d 100644
--- a/tests/package-mapping.yaml
+++ b/tests/package-mapping.yaml
@@ -12,6 +12,18 @@ istioOperator:
repoName: "istio-operator"
hrName: "istio-operator"
filePath: "istio-operator"
+istioCore:
+ repoName: "istio-core"
+ hrName: "istio-core"
+ filePath: "istio-core"
+istioGatewayPublic:
+ repoName: "istio-gateway"
+ hrName: "public-ingressgateway"
+ filePath: "istio-gateway-public"
+istioGatewayPassthrough:
+ repoName: "istio-gateway"
+ hrName: "passthrough-ingressgateway"
+ filePath: "istio-gateway-passthrough"
clusterAuditor:
repoName: "cluster-auditor"
hrName: "cluster-auditor"
diff --git a/tests/test-values.yaml b/tests/test-values.yaml
index a168dda9bd..a3968b8b54 100644
--- a/tests/test-values.yaml
+++ b/tests/test-values.yaml
@@ -55,7 +55,6 @@ flux:
networkPolicies:
enabled: true
#controlPlaneCidr: 172.16.0.0/12
-
istio:
enabled: true
ingressGateways:
@@ -79,7 +78,6 @@ istio:
dashboard:
auth:
strategy: "anonymous"
-
jaeger:
enabled: false
sso:
@@ -2213,7 +2211,7 @@ addons:
keycloak:
enabled: false
ingress:
- gateway: "passthrough"
+ gateway: ""
key: "" # Gets added via chart/ingress-certs.yaml
cert: "" # Gets added via chart/ingress-certs.yaml
values:
--
GitLab