istio-vks

istio-vks.yml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: carvel-sa
  namespace: vmware-system-tkg
  annotations:
    argocd.argoproj.io/sync-wave: '-1'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: carvel-sa-cluster-role
  annotations:
    argocd.argoproj.io/sync-wave: '-1'
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: carvel-sa-cluster-rolebinding
  annotations:
    argocd.argoproj.io/sync-wave: '-1'
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: carvel-sa-cluster-role
subjects:
- kind: ServiceAccount
  name: carvel-sa
  namespace: vmware-system-tkg
---
apiVersion: v1
kind: Secret
metadata:
  name: istio-values
  namespace: vmware-system-tkg
stringData:
  values.yml: |
    ---
    istio:
      namespace: "istio-system"
      ambientMode:
        enabled: false
        ztunnel:
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
      istioCNI:
        enabled: true
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
      enableStrictMTLS: true
      gateways:
        egress:
          enabled: true
          namespace: "istio-egress"
          priorityClassName: ""
          replicas: 1
          resources:
            limits:
              cpu: 2000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 128Mi
          autoscaling:
            enabled: true
            minReplicas: 1
            maxReplicas: 5
        ingress:
          enabled: false
          namespace: "istio-ingress"
          priorityClassName: ""
          replicas: 1
          resources:
            limits:
              cpu: 2000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 128Mi
          autoscaling:
            enabled: false
            minReplicas: 1
            maxReplicas: 5
      pilot:
        priorityClassName: ""
        replicas: 1
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
        autoscaling:
          enabled: true
          minReplicas: 1
          maxReplicas: 5
      support:
        priorityClassName: ""
        resources:
          requests:
            cpu: 100m
            memory: 64Mi
          limits:
            cpu: 250m
            memory: 256Mi
      meshConfig:
        connectTimeout: "10s"
        ingressControllerMode: "STRICT"
        accessLogFile: ""
        trustDomain: "cluster.local"
        trustDomainAliases: []
        enablePrometheusMerge: true
        meshID: ""
        meshMTLS:
          minProtocolVersion: "TLSV1_2"
        enableDNSProxy: false
        proxy:
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 2000m
              memory: 1024Mi
        waypoint:
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "2"
              memory: 1Gi
        enableTracing: true
        extensionProviders:
          - name: jaeger
            opentelemetry:
              port: 4317
              service: jaeger-collector.istio-system.svc.cluster.local
          - name: zipkin
            zipkin:
              port: 4317
              service: jaeger-collector.istio-system.svc.cluster.local
        defaultProviders:
          tracing:
            - jaeger

---
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: istio
  namespace: vmware-system-tkg
spec:
  packageRef:
    refName: istio.kubernetes.vmware.com
    versionSelection:
      constraints: 1.27.1+vmware.1-vks.1
      prereleases: {}
  serviceAccountName: carvel-sa
  values:
  - secretRef:
      name: istio-values