Skip to content

Commit 90ea9e2

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #7378 from borg-land/istio-cert-patch
Tweak istio install
2 parents 2a1a043 + a4c653b commit 90ea9e2

File tree

8 files changed

+126
-143
lines changed

8 files changed

+126
-143
lines changed

‎kubernetes/apps/ingress-nginx.yaml‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎kubernetes/apps/istio.yaml‎

Lines changed: 70 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,79 @@
11
apiVersion: argoproj.io/v1alpha1
2-
kind: Application
2+
kind: ApplicationSet
33
metadata:
44
name: istio-base
5-
annotations:
6-
argocd.argoproj.io/sync-wave: "-3"
75
spec:
8-
destination:
9-
name: gke-utility
10-
namespace: istio-system
11-
project: default
12-
sources:
13-
- chart: base
14-
repoURL: https://istio-release.storage.googleapis.com/charts
15-
targetRevision: 1.23.2
16-
- path: config/crd/experimental
17-
repoURL: https://github.com/kubernetes-sigs/gateway-api
18-
targetRevision: v1.1.0
19-
ignoreDifferences:
20-
- group: admissionregistration.k8s.io
21-
kind: ValidatingWebhookConfiguration
22-
jsonPointers:
23-
- /webhooks/0/failurePolicy
24-
syncPolicy:
25-
automated:
26-
prune: true
27-
selfHeal: true
28-
syncOptions:
29-
- CreateNamespace=true
6+
goTemplate: true
7+
generators:
8+
- clusters:
9+
selector:
10+
matchLabels:
11+
clusterType: 'utility'
12+
template:
13+
metadata:
14+
name: 'istio-base-{{ .name }}'
15+
annotations:
16+
argocd.argoproj.io/sync-wave: "-3"
17+
spec:
18+
destination:
19+
namespace: istio-system
20+
server: "{{ .server }}"
21+
project: default
22+
sources:
23+
- chart: base
24+
repoURL: https://istio-release.storage.googleapis.com/charts
25+
targetRevision: 1.23.2
26+
- path: config/crd/experimental
27+
repoURL: https://github.com/kubernetes-sigs/gateway-api
28+
targetRevision: v1.1.0
29+
syncPolicy:
30+
automated:
31+
prune: true
32+
selfHeal: true
33+
syncOptions:
34+
- CreateNamespace=true
35+
managedNamespaceMetadata:
36+
labels:
37+
topology.istio.io/network: "{{ .metadata.labels.istioNetwork }}"
3038
---
3139
apiVersion: argoproj.io/v1alpha1
32-
kind: Application
40+
kind: ApplicationSet
3341
metadata:
3442
name: istio
3543
spec:
36-
destination:
37-
name: gke-utility
38-
namespace: istio-system
39-
project: default
40-
sources:
41-
- chart: istiod
42-
repoURL: https://istio-release.storage.googleapis.com/charts
43-
targetRevision: 1.23.2
44-
helm:
45-
values: |
46-
global:
47-
hub: gcr.io/istio-release
48-
istiod:
49-
enableAnalysis: true
50-
meshConfig:
51-
accessLogFile: /dev/stdout
52-
enablePrometheusMerge: true
53-
protocolDetectionTimeout: 5s
54-
enableTracing: true
55-
defaultConfig:
56-
tracing:
57-
extensionProviders:
58-
- name: stackdriver
59-
stackdriver:
60-
- name: "oauth2-proxy"
61-
envoyExtAuthzHttp:
62-
service: "oauth2-proxy.oauth2-proxy.svc.cluster.local"
63-
port: "80"
64-
headersToDownstreamOnDeny:
65-
- content-type
66-
- set-cookie
67-
headersToUpstreamOnAllow:
68-
- authorization
69-
- cookie
70-
- path
71-
- x-*
72-
includeHeadersInCheck:
73-
- authorization
74-
- cookie
75-
- user-agent
76-
includeAdditionalHeadersInCheck:
77-
X-Auth-Request-Redirect: https://%REQ(Host)%%REQ(:PATH)%
78-
defaultConfig:
79-
gatewayTopology:
80-
numTrustedProxies: 2
81-
telemetry:
82-
enabled: true
83-
v2:
84-
prometheus:
85-
enabled: true
86-
wasmEnabled: false
87-
- path: kubernetes/gke-utility/istio-system
88-
repoURL: https://github.com/kubernetes/k8s.io
89-
targetRevision: main
90-
ignoreDifferences:
91-
- group: admissionregistration.k8s.io
92-
kind: ValidatingWebhookConfiguration
93-
jsonPointers:
94-
- /webhooks/0/failurePolicy
95-
syncPolicy:
96-
automated:
97-
prune: true
98-
selfHeal: true
44+
goTemplate: true
45+
generators:
46+
- clusters:
47+
selector:
48+
matchLabels:
49+
clusterType: 'utility'
50+
template:
51+
metadata:
52+
name: 'istio-{{ .name }}'
53+
spec:
54+
destination:
55+
namespace: istio-system
56+
server: "{{ .server }}"
57+
project: default
58+
sources:
59+
- chart: istiod
60+
repoURL: https://istio-release.storage.googleapis.com/charts
61+
targetRevision: 1.23.2
62+
helm:
63+
valueFiles:
64+
- $values/kubernetes/{{ .name }}/helm/istio.yaml
65+
- repoURL: 'https://github.com/kubernetes/k8s.io.git'
66+
targetRevision: main
67+
ref: values
68+
- repoURL: https://github.com/kubernetes/k8s.io
69+
targetRevision: main
70+
path: kubernetes/{{ .name }}/istio-system
71+
ignoreDifferences:
72+
- group: admissionregistration.k8s.io
73+
kind: ValidatingWebhookConfiguration
74+
jsonPointers:
75+
- /webhooks/0/failurePolicy
76+
syncPolicy:
77+
automated:
78+
prune: true
79+
selfHeal: true

‎kubernetes/apps/kustomization.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ resources:
44
# - argocd.yaml This has been manually applied to fix sync issues
55
- external-secrets.yaml
66
- cert-manager.yaml
7-
# - ingress-nginx.yaml
87
- prow.yaml
98
- istio.yaml
109
- oauth2-proxy.yaml

‎kubernetes/gke-utility/helm/cert-manager.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
crds:
22
enabled: true
33
extraObjects:
4-
- |
5-
apiVersion: cert-manager.io/v1
4+
- apiVersion: cert-manager.io/v1
65
kind: ClusterIssuer
76
metadata:
87
name: letsencrypt-prod
@@ -13,5 +12,6 @@ extraObjects:
1312
privateKeySecretRef:
1413
name: letsencrypt-prod
1514
solvers:
16-
- cloudDNS:
17-
project: kubernetes-public
15+
- dns01:
16+
cloudDNS:
17+
project: kubernetes-public

‎kubernetes/gke-utility/helm/ingress-nginx.yaml‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎kubernetes/gke-utility/helm/istio.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
global:
2+
hub: gcr.io/istio-release
3+
istiod:
4+
enableAnalysis: true
5+
meshID: mesh
6+
multiCluster:
7+
clusterName: gke-utility
8+
network: prow-vpc
9+
pilot:
10+
env:
11+
PILOT_ENABLE_ALPHA_GATEWAY_API: 'true'
12+
ENABLE_NATIVE_SIDECARS: 'true'
13+
meshConfig:
14+
accessLogFile: /dev/stdout
15+
enablePrometheusMerge: true
16+
protocolDetectionTimeout: 5s
17+
enableTracing: true
18+
defaultConfig:
19+
gatewayTopology:
20+
numTrustedProxies: 2
21+
tracing:
22+
extensionProviders:
23+
- name: stackdriver
24+
stackdriver:
25+
- name: "oauth2-proxy"
26+
envoyExtAuthzHttp:
27+
service: "oauth2-proxy.oauth2-proxy.svc.cluster.local"
28+
port: "80"
29+
headersToDownstreamOnDeny:
30+
- content-type
31+
- set-cookie
32+
headersToUpstreamOnAllow:
33+
- authorization
34+
- cookie
35+
- path
36+
- x-*
37+
includeHeadersInCheck:
38+
- authorization
39+
- cookie
40+
- user-agent
41+
includeAdditionalHeadersInCheck:
42+
X-Auth-Request-Redirect: https://%REQ(Host)%%REQ(:PATH)%
43+
telemetry:
44+
enabled: true
45+
v2:
46+
prometheus:
47+
enabled: true
48+
wasmEnabled: false

‎kubernetes/gke-utility/istio-system/auth-policy.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ spec:
1515
- operation:
1616
hosts:
1717
- argo.k8s.io
18+
- monitoring.prow.k8s.io

‎kubernetes/gke-utility/istio-system/gateway.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ spec:
3232
sectionName: http
3333
hostnames:
3434
- '*.k8s.io'
35+
- '*.prow.k8s.io'
3536
rules:
3637
- filters:
3738
- type: RequestRedirect
@@ -49,5 +50,7 @@ spec:
4950
name: letsencrypt-prod
5051
kind: ClusterIssuer
5152
commonName: '*.k8s.io'
53+
# *.prow.k8s.io doesn't work as GCP CERT MANAGER USES CNAME FOR ACME INSTEAD OF TXT :(((((((
5254
dnsNames:
5355
- '*.k8s.io'
56+
- 'monitoring.prow.k8s.io'

0 commit comments

Comments
 (0)