Руководство по установке#

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: stats-filter-1.6-basic
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        listener:
          filterChain:
            filter:
              name: envoy.http_connection_manager
              subFilter:
                name: envoy.router
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio"
                  }
                root_id: stats_outbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: stats_outbound
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.http_connection_manager
              subFilter:
                name: envoy.router
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio"
                  }
                root_id: stats_inbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: stats_inbound
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: envoy.http_connection_manager
              subFilter:
                name: envoy.router
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                    "disable_host_header_fallback": true
                  }
                root_id: stats_outbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: stats_outbound
#  Для централизованной VISL добавить блок
#  workloadSelector:
#    labels: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-stats-filter-1.6-basic
spec:
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.tcp_proxy
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio"
                  }
                root_id: stats_inbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: tcp_stats_inbound
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_OUTBOUND
        listener:
          filterChain:
            filter:
              name: envoy.tcp_proxy
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio"
                  }
                root_id: stats_outbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: tcp_stats_outbound
    - applyTo: NETWORK_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: envoy.tcp_proxy
        proxy:
          proxyVersion: ^1\.6.*
      patch:
        operation: INSERT_BEFORE
        value:
          name: istio.stats
          typed_config:
            '@type': type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm
            value:
              config:
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio"
                  }
                root_id: stats_outbound
                vm_config:
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  runtime: envoy.wasm.runtime.null
                  vm_id: tcp_stats_outbound
#  Для централизованной VISL добавить блок
#  workloadSelector:
#    labels: {}

# kubernetes or openshift
containerOrchestrationSystem: kubernetes

# for manual installation, ex. image: example.registry/visl/visl:latest
image:

# for SMDL installation
common:
  registry: example.registry
  registry_path: registry_path

imagePullSecrets:
  - name: image-pull
nameOverride: ""
fullnameOverride: visl

# "true" or "false"
automountServiceAccountToken: "false"

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: "visl"

podAnnotations:
  prometheus.io/port: "9090"
  prometheus.io/scrape: "true"

ingress:
  # true or false
  enabled: false
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
  host: visl.example.host
  path: /
  pathType: Prefix
  tls: {}
  #  - secretName: chart-example-tls

resources:
  requests:
    cpu: 200m
    memory: 200Mi
  limits:
    cpu: 200m
    memory: 200Mi

config:
  api:
    namespaces:
      # panel version
      # used when fetching the list of available namespaces
      label_selector:
        # true or false
        enabled: false
        value: istio.io/rev=istio-system
  auth:
    # authentication strategy to use when users log into VISL
    # strategy: anonymous
    # strategy: token
    strategy: openshift
    openshift:
      # config.auth.openshift.client_id_prefix = fullnameOverride
      # <Route manifest metadata.name> = config.auth.openshift.client_id_prefix
      # <OAuthClient manifest metadata.name> = <Route manifest metadata.name>-<Route manifest metadata.namespace>
      # To use openshift strategy need to provide Role/visl for the VISL service account in VISL namespace
      client_id_prefix: visl
  deployment:
    # VISL namespace
    namespace: visl-namespace
    # list of namespaces to which VISL is to be given permissions
    accessible_namespaces:
      # true or false
      enabled: true
      value: [metrics, visl-namespace, new-project]
  external_services:
    istio:
      istiod:

    # prometheus configuration to get Istio SE telemetry
    prometheus:
      # auth:
      #   ca_file: /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
      #   insecure_skip_verify: false
      #   password: ''
      #   token: ''
      #   type: basic
      #   use_kiali_token: false
      #   username: internal
      # component_status:
      #   app_label: prometheus-sbt
      #   is_core: true
      #   namespace: visl-test3
      url: http://prometheus-tls.metrics.svc.cluster.local:9080

  installation_tag: VISL [visl-namespace]
  istio_component_namespaces:
    # Istio SE namespace
    istiod: visl-namespace
    prometheus: metrics
  istio_labels:
    # used to define what application a workload belongs to
    app_label_name: app
    # used to define what version of the application a workload belongs to
    version_label_name: version
  # Istio SE namespace
  istio_namespace: visl-namespace
  # Istiod service name
  istio_serviceIstiod: istiod-istio-system

  kubernetes_config:
    # true or false
    # for caching need to provide ClusterRole/kiali-se-central-cluster-role for the VISL service account in each cache_namespaces
    cache_enabled: true
    # panel version [".*"]
    # cluster version [visl-namespace, new-project]
    cache_namespaces:
      - metrics
      - visl-namespace
      - new-project
  server: {}
  # server:
    # path for the VISL console and API endpoints and readiness probes
    # web_root: /kiali

openshift:
  route:
    # true or false
    enabled: true
    host: visl.example.host
    tls:
      enabled: true
      termination: passthrough

igeg:
  # add IstioSE configuration(ingress/egress gateway, sidecar)?
  # true or false
  enabled: true
  # IGEG version
  version: 1.17.3-1_sberlinux
  imagePullSecrets:
    - name: image-pull
  image: example.registry/polm/proxyv2:latest
  # Control plane configuration to which VISL is connected
  controlPlane:
    # Istio SE namespace
    namespace: istio-system
    # Istiod service name
    serviceIstiod: istiod-istio-system
  # add secman-injector?
  secman:
    # true or false
    enabled: true
  proxyConfig:
    # IGEG tracing configuration
    tracing:
      enable: true
      custom_tags:
        enabled: true
      zipkin:
        address: synapse-tracer-svc.istio-system.svc.cluster.local:8788
      tlsSettings:
        enabled: true
        caCertificates: /var/run/secrets/istio/root-cert.pem
        mode: SIMPLE
        subjectAltNames:
          - spiffe://cluster.local/ns/istio-system.svc/sa/default
  vaultAnnotations:
    vault.hashicorp.com/role: synapse
    vault.hashicorp.com/namespace: ""
    vault.hashicorp.com/auth-path: auth/synapse
    vault.hashicorp.com/log-level: info
    vault.hashicorp.com/agent-inject: 'true'
    vault.hashicorp.com/agent-init-first: 'true'
    vault.hashicorp.com/agent-requests-cpu: 125m
    vault.hashicorp.com/agent-requests-mem: 32Mi
    vault.hashicorp.com/agent-limits-cpu: 250m
    vault.hashicorp.com/agent-limits-mem: 64Mi
    vault.hashicorp.com/agent-pre-populate: 'true'
    vault.hashicorp.com/agent-pre-populate-only: 'true'
    vault.hashicorp.com/agent-inject-secret-tls.key: 'true'
    vault.hashicorp.com/agent-inject-secret-ca.crt: 'true'
    vault.hashicorp.com/agent-inject-secret-tls.crt: 'true'
    vault.hashicorp.com/agent-run-as-group: '10011001'
    vault.hashicorp.com/agent-run-as-user: '10011001'
    vault.hashicorp.com/agent-run-as-same-user: 'true'
  ingress:
    # plain http - igeg.ingress.port.protocol = HTTP  & igeg.ingress.tls.enabled = false
    # tls        - igeg.ingress.port.protocol = HTTPS & igeg.ingress.tls.enabled = true & igeg.ingress.tls.mode = SIMPLE
    # mtls       - igeg.ingress.port.protocol = HTTPS & igeg.ingress.tls.enabled = true & igeg.ingress.tls.mode = MUTUAL
    dns: visl.example.host
    port:
      # HTTPS, HTTP
      protocol: HTTPS
    tls:
      enabled: true
      # MUTUAL, SIMPLE
      mode: SIMPLE
    fullnameOverride: ingressgateway-visl
    jwt_policy: third-party-jwt
    resources:
      limits:
        cpu: 300m
        memory: 500Mi
      requests:
        cpu: 300m
        memory: 500Mi
    podAnnotations:
      vault.hashicorp.com/secret-volume-path: '/visl-cert'
      vault.hashicorp.com/agent-inject-template-ca.crt: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ .Data.data.rootcer }}
        {{- end }}
      vault.hashicorp.com/agent-inject-template-tls.crt: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ .Data.data.publishedcer }}
        {{- end }}
      vault.hashicorp.com/agent-inject-template-tls.key: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ .Data.data.mtlskey }}
        {{- end }}
  egress:
    # prometheus configuration
    # plain http - igeg.egress.metrics.protocol = HTTP  & igeg.egress.metrics.tls.enabled = false
    # tls        - igeg.egress.metrics.protocol = HTTPS & igeg.egress.metrics.tls.enabled = true & igeg.egress.metrics.tls.mode = SIMPLE
    # mtls       - igeg.egress.metrics.protocol = HTTPS & igeg.egress.metrics.tls.enabled = true & igeg.egress.metrics.tls.mode = MUTUAL
    metrics:
      dns: prometheus-tls.metrics.svc.cluster.local
      port: 9090
      # port in Istio SE mesh
      meshPort: 9080
      # HTTPS, HTTP
      protocol: HTTPS
      tls:
        enabled: true
        # MUTUAL, SIMPLE
        mode: MUTUAL
    # kubeapi configuration
    # tcp - igeg.egress.kubeapi.protocol = TCP & igeg.egress.kubeapi.ip = <kubeapi-ip>
    # tls - igeg.egress.kubeapi.protocol = TLS
    kubeapi:
      dns: kubernetes.default.svc
      port: 443
      # port in Istio SE mesh
      meshPort: 443
      # TCP, TLS
      protocol: TLS
      # TCP
      # ip: 10.96.0.1
    fullnameOverride: egressgateway-visl
    jwt_policy: third-party-jwt
    resources:
      limits:
        cpu: 300m
        memory: 500Mi
      requests:
        cpu: 300m
        memory: 500Mi
    podAnnotations:
      vault.hashicorp.com/secret-volume-path: '/metrics-cert'
      vault.hashicorp.com/agent-inject-template-ca.crt: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ index .Data.data "prom-ca-crt" }}
        {{- end }}
      vault.hashicorp.com/agent-inject-template-tls.crt: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ index .Data.data "prom-client-crt" }}
        {{- end }}
      vault.hashicorp.com/agent-inject-template-tls.key: |
        {{- with secret "SYNAPSE/KV/VISL3" -}}
          {{ index .Data.data "prom-client-key" }}
        {{- end }}

config:
  api:
    namespaces:
      label_selector:
        enabled: true
        value: istio.io/rev=istio-system
  deployment:
    # Проект в который устанавливается VISL
    namespace: visl-namespace
    # Пространства имен, которые будут подключены к централизованному VISL
    accessible_namespaces:
      enabled: false
      value: [metrics, visl-namespace, new-project]
  istio_component_namespaces:
    # Istio SE namespace
    istiod: istio-system
    prometheus: metrics
  istio_namespace: istio-system
  kubernetes_config:
    cache_enabled: true
    cache_namespaces: [".*"]

config:
  api:
    namespaces:
      label_selector:
        enabled: false
  deployment:
    namespace: visl-namespace
    accessible_namespaces:
      enabled: true
      value: [metrics, visl-namespace, new-project]
  istio_component_namespaces:
    istiod: visl-namespace
    prometheus: metrics
  istio_namespace: visl-namespace
  kubernetes_config:
    cache_enabled: true
    cache_namespaces:
      - metrics
      - visl-namespace
      - new-project

apiVersion: oauth.openshift.io/v1
grantMethod: auto
kind: OAuthClient
metadata:
  name: {{ oauth_client_name }}
redirectURIs:
# redirectURIs должен совпадать с тем URI, что выдается после создания Route
  - {{ redirectURI }}

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kiali-se-central-ci03189811
  namespace: {{ member_project_name }}
subjects:
  - kind: ServiceAccount
    name: visl
    namespace: {{ visl_project_name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kiali-se-central-cluster-role
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kiali-se-central-cluster-role
rules:
  - verbs:
      - get
      - list
      - watch
    apiGroups:
      - ''
    resources:
      - pods
      - services
  - verbs:
      - create
    apiGroups:
      - ''
    resources:
      - pods/portforward
  - verbs:
      - get
      - list
      - watch
    apiGroups:
      - apps
    resources:
      - deployments
  - verbs:
      - get
      - list
      - watch
    apiGroups:
      - config.istio.io
      - networking.istio.io
      - authentication.istio.io
      - rbac.istio.io
      - security.istio.io
    resources:
      - '*'
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: visl
  namespace: {{ visl_project_name }}
subjects:
  - kind: ServiceAccount
    name: visl
    namespace: {{ visl_project_name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: visl
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: visl
  namespace: {{ visl_project_name }}
rules:
  - verbs:
      - get
    apiGroups:
      - route.openshift.io
    resources:
      - routes
  - verbs:
      - get
    apiGroups:
      - ''
    resources:
      - configmaps
    resourceNames:
      - istio-basic

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: vmagent-synapse-ci03189811
  namespace: {{ member_project_name }}
subjects:
  - kind: ServiceAccount
    name: synapse-metrics-sa # имя сервис аккаунта компонента GATM
    namespace: {{ visl_project_name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: vmagent-service-discovery-synapse-cluster-role
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: vmagent-service-discovery-synapse-cluster-role
rules:
  - verbs:
      - get
      - watch
      - list
    apiGroups:
      - ''
    resources:
      - pods

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-from-{{ visl_project_name }}-namespace
  namespace: {{ member_project_name }}
spec:
  podSelector: {}
  ingress:
    - ports:
        - protocol: TCP
          port: 15090
      from:
        - podSelector:
            matchLabels:
              app: synapse-metrics-agent # метка
          namespaceSelector:
            matchLabels:
              projectId: {{ visl_project_name }}
  policyTypes:
    - Ingress

- name: PROMETHEUS_PASSWORD
  valueFrom:
    secretKeyRef:
      name: htpasswd
      key: rawPassword

    metadata:
      annotations:
        prometheus.io.path: /actuator/prometheus        # контроллер, с которого собирать метрики
        prometheus.io.port: '8080'                      # порт, на котором доступен web server
        prometheus.io.scrape: 'true'                    # включание сбора метрик с помощью MONA

- name: LOG_LEVEL
  value: '3'

spec:
  server:
    audit_log: false