The module has 15 alerts.
The module is not enabled by default in any bundles.
The module is configured using the ModuleConfig custom resource named istio
(learn more about setting up Deckhouse…).
Example of the ModuleConfig/istio
resource for configuring the module:
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
name: istio
spec:
version: 2
enabled: true
settings: # <-- Module parameters from the "Parameters" section below.
Parameters
Schema version: 2
- array of strings
Additional versions of Istio control plane to install. You can use specific namespace labels (
istio.io/rev=
) to switch between installed revisions.Default:
[]
- object
Common options both for federation and multicluster.
This feature is available in enterprise edition only.
- object
ingressgateway settings.
This feature is available in enterprise edition only.
- string
The method for exposing ingressgateway.
LoadBalancer
— is a recommended method if you have a cloud-based cluster and it supports Load Balancing.NodePort
— for installations that do not have the LB.
Default:
"LoadBalancer"
This feature is available in enterprise edition only.
Allowed values:
LoadBalancer
,NodePort
Example:
inlet: LoadBalancer
- object
Special settings for NodePort inlet.
This feature is available in enterprise edition only.
Examples:
nodePort: {}
nodePort: port: 30001
- object
Additional service annotations. They can be used, e.g., for configuring a local LB in the Yandex Cloud (using the
yandex.cpi.flant.com/listener-subnet-id
annotation).This feature is available in enterprise edition only.
Example:
serviceAnnotations: yandex.cpi.flant.com/listener-subnet-id: xyz-123
- array of objects
ingressgateway DaemonSet tolerations.
The same as
spec.tolerations
for the Kubernetes pod.This feature is available in enterprise edition only.
Example:
tolerations: - operator: Exists
- object
Options related to authentication or authorization in the application.
Example:
auth: externalAuthentication: authURL: https://dex.d8.svc.cluster.local/dex/auth authSignInURL: https://example.com/dex/sign_in allowedUserGroups: - admins
- array of strings
An array of user groups that can access module’s public web interfaces.
This parameter is used if the
user-authn
module is enabled or theexternalAuthentication
parameter is set.Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.
- object
Parameters to enable external authentication based on the NGINX Ingress external-auth mechanism that uses the Nginx auth_request module.
External authentication is enabled automatically if the user-authn module is enabled.
- object
Explicitly specified root certificate. It signs individual service certificates to use in mutual TLS connections.
- object
Optional
nodeSelector
for istiod. The same as thespec.nodeSelector
pod parameter in Kubernetes.If the parameter is omitted or
false
, it will be determined automatically. - object
Replication management settings and scaling of istiod.
Examples:
replicasManagement: mode: Standard
replicasManagement: mode: Static static: replicas: 3
replicasManagement: mode: HPA hpa: minReplicas: 2 maxReplicas: 5 metrics: - type: CPU targetAverageUtilization: 80
- array of objects
Required value
The HPA will use these metrics to decide whether to increase or decrease the number of replicates.
- string
Replicas management mode:
Standard
— replicas management and scaling mode according to the global fault tolerance mode (the highAvailability parameter);Static
— the mode, where the number of replicas is specified explicitly (the static.replicas parameter);HPA
— the mode, where the number of replicas is calculated automatically using HPA based on CPU usage. You can configure this mode by modifying parameters in the hpa parameter section.
Default:
"Standard"
Allowed values:
Standard
,Static
,HPA
- object
Options for replicas management for the
Static
mode.
- object
Settings for CPU and memory requests and limits by istiod pods.
Examples:
resourcesManagement: mode: VPA vpa: mode: Auto cpu: min: 50m max: 2 limitRatio: 1.5 memory: min: 256Mi max: 2Gi limitRatio: 1.5
resourcesManagement: mode: Static static: requests: cpu: 55m memory: 256Mi limits: cpu: '2' memory: 2Gi
- string
Resource management mode:
Default:
"VPA"
Allowed values:
VPA
,Static
- object
Resource management options for the
Static
mode.
- array of objects
Optional
tolerations
for istiod. The same asspec.tolerations
for the Kubernetes pod.If the parameter is omitted or
false
, it will be determined automatically.
- string
Managing the redirection mode of application traffic to be forwarded under Istio control in the Pod’s network namespace.
CNIPlugin
— in this mode, the configuration is performed by a CNI plugin when creating a Pod on a node. This mode does not require additional permissions for Pods and is recommended. This mode has limitations when using application init-containers that perform network communication with other services.InitContainer
— classic mode, each application Pod is automatically injected with a special init-container that configures the network environment of the Pod. In order to perform this configuration, the init-container is given additional permissions, which may not meet the security requirements of individual installations.
Default:
"InitContainer"
Allowed values:
CNIPlugin
,InitContainer
Examples:
trafficRedirectionSetupMode: CNIPlugin
trafficRedirectionSetupMode: InitContainer
- object
Parameters for federating with other clusters.
This feature is available in enterprise edition only.
- boolean
Designate this cluster as a federation member (see Enabling federation).
Default:
false
Example:
enabled: true
- boolean
Manually enable the high availability mode.
By default, Deckhouse automatically decides whether to enable the HA mode. Click here to learn more about the HA mode for modules.
Example:
highAvailability: true
- object
What certificate type to use with module’s public web interfaces.
This parameter completely overrides the
global.modules.https
settings.Examples:
https: mode: CustomCertificate customCertificate: secretName: foobar
https: mode: CertManager certManager: clusterIssuerName: letsencrypt
- string
The name of the secret in the
d8-system
namespace to use with Kiali/metadata-exporter (including SPIFFE endpoint)/api-proxy.This secret must have the kubernetes.io/tls format.
Default:
"false"
- string
The HTTPS usage mode:
CertManager
— Kiali/metadata-exporter (including SPIFFE endpoint)/api-proxy will use HTTPS and get a certificate from the clusterissuer defined in thecertManager.clusterIssuerName
parameter.CustomCertificate
— Kiali/metadata-exporter (including SPIFFE endpoint)/api-proxy will use HTTPS using the certificate from thed8-system
namespace.OnlyInURI
— Kiali/metadata-exporter (including SPIFFE endpoint)/api-proxy will work over HTTP (thinking that there is an external HTTPS load balancer in front that terminates HTTPS traffic). All the links in theuser-authn
will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.
Caution! Unlike other modules, Istio doesn’t support non-secured HTTP (
mode: Disabled
).Default:
"CertManager"
Allowed values:
CertManager
,CustomCertificate
,OnlyInURI
- object
Multicluster parameters.
This feature is available in enterprise edition only.
- boolean
Designate this cluster as a multicluster member (see Enabling multicluster).
Default:
false
Example:
enabled: true
- object
Optional
nodeSelector
for istio-operator, metadata-exporter and Kiali. The same as thespec.nodeSelector
pod parameter in Kubernetes.If the parameter is omitted or
false
, it will be determined automatically. - string
How to handle requests directed to external services which aren’t registered in service mesh.
AllowAny
— allow.RegistryOnly
— deny. In this case to work with external services you need to register them with ServiceEntry custom resource or to organize egressgateway.
Default:
"AllowAny"
Allowed values:
AllowAny
,RegistryOnly
Example:
outboundTrafficPolicyMode: AllowAny
- boolean
With this feature, the sidecar-injector injects the sidecar at the first place of Pod’s container list and adds a postStart hook to be sure if the Envoy proxy is initialized before the application. So the Envoy is able to handle requests without application network errors.
This global flag can be overriden per Pod by an annotation —
proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
.Default:
false
Example:
holdApplicationUntilProxyStarts: true
- string
Timeout for connections without application activity established between the client’s istio-sidecar and the service. When the timeout expires, the connection between the sidecar and the service is closed, but the connection between the application and the sidecar is not closed. If set to
0s
, the timeout is disabled.This global flag can be overriden per Pod by an annotation:
proxy.istio.io/config: |- proxyMetadata: ISTIO_META_IDLE_TIMEOUT: "12h"
Warning! Disabling this timeout (setting the value to
0s
) is very likely to result in leaky connections due to TCP FIN packet loss, etc. Warning! After changing this setting, a restart of the client pods is required.Default:
"1h"
Pattern:
^[0-9]+(s|m|h)$
Example:
idleTimeout: 24h
- array of strings
The range of inbound ports whose traffic is guaranteed not to flow through Istio.
You can redefine this parameter for single Pod using the
traffic.sidecar.istio.io/excludeInboundPorts
annotation.Default:
[]
Example:
excludeInboundPorts: - '8080' - '8443'
- array of strings
Traffic to these IP ranges is guaranteed not to flow through Istio.
You can redefine this parameter for single Pod using the
traffic.sidecar.istio.io/excludeOutboundIPRanges
annotation.Default:
[]
Example:
excludeOutboundIPRanges: - 10.1.1.0/24
- array of strings
The range of outbound ports whose traffic is guaranteed not to flow through Istio.
You can redefine this parameter for single Pod using the
traffic.sidecar.istio.io/excludeOutboundPorts
annotation.Default:
[]
Example:
excludeOutboundPorts: - '8080' - '8443'
- array of strings
Traffic to these IP ranges is forcibly routed through Istio.
You can redefine this parameter for single Pod using the
traffic.sidecar.istio.io/includeOutboundIPRanges
annotation.Default:
["0.0.0.0/0"]
Example:
includeOutboundIPRanges: - 10.1.1.0/24
- object
Manages Istio sidecar container resources.
Caution! The setting only applies to new Pods with
istio-proxy
.Example:
resourcesManagement: static: requests: cpu: 100m memory: 128Mi limits: cpu: 2000m memory: 1Gi
- string
Resource management mode:
Static
— allows you to specify requests/limits. The parameters of this mode are defined in the static parameter section;
Default:
"Static"
Allowed values:
Static
- array of objects
Optional
tolerations
for istio-operator, metadata-exporter and Kiali. The same asspec.tolerations
for the Kubernetes pod.If the parameter is omitted or
false
, it will be determined automatically. - object
Zipkin protocol parameters used by Istio for sending traces. Jaeger supports this protocol.
If tracing is enabled, this settings section is mandatory.
- object
Span displaying settings for Kiali.
When not configured, Kiali won’t show any tracing dashboards.
Examples:
kiali: {}
kiali: jaegerURLForUsers: https://tracing-service:4443/jaeger jaegerGRPCEndpoint: http://tracing.myjaeger.svc:16685/
- string
Accessible from cluster address of jaeger GRPC interface for system queries by Kiali.
When not configured, Kiali will only show external links using the
jaegerURLForUsers
config without interpretationing.Example:
jaegerGRPCEndpoint: http://tracing.myjaeger.svc:16685/
- number
The sampling rate option can be used to control what percentage of requests get reported to your tracing system.
This should be configured depending upon your traffic in the mesh and the amount of tracing data you want to collect.
It is possible to override this option with the following Pod annotation:
proxy.istio.io/config: | tracing: sampling: 100.0
Default:
1.0
Allowed values:
0.01 <= X <= 100.0
Example:
sampling: 50.05
Authentication
user-authn module provides authentication by default. Also, externalAuthentication can be configured (see below). If these options are disabled, the module will use basic auth with the auto-generated password.
Use kubectl to see password:
kubectl -n d8-system exec svc/deckhouse-leader -c deckhouse -- deckhouse-controller module values istio -o json | jq '.istio.internal.auth.password'
Delete the Secret to re-generate password:
kubectl -n d8-istio delete secret/kiali-basic-auth
Note! The
auth.password
parameter is deprecated.