Update istio config and add rancher proxy

  * add istio and certmanager CRDs
  * add rancher system default registry config
  * add rancher proxy to the Grafana, Prometheus, Kiali and Tracing
  * remove not used demo values.yaml files and serviceGraph(deprecated)

charts/rancher-istio/1.1.5-rancher1/.helmignore

@@ -19,3 +19,4 @@
 .project
 .idea/
 *.tmproj
+tests/

charts/rancher-istio/1.1.5-rancher1/Chart.yaml

 apiVersion: v1
-name: istio
-version: 1.1.0
-appVersion: 1.1.0
+name: rancher-istio
+version: 1.1.5-rancher1
+appVersion: 1.1.5
 tillerVersion: ">=2.7.2-0"
 description: Helm chart for all istio components
+home: https://istio.io/
 keywords:
   - istio
   - security
@@ -15,3 +16,5 @@ sources:
   - http://github.com/istio/istio
 engine: gotpl
 icon: https://istio.io/favicons/android-192x192.png
+maintainers:
+  - name: istio

charts/rancher-istio/1.1.5-rancher1/app-readme.md

+# Istio
+
+[Istio](https://istio.io/) is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
+
+## Introduction
+
+This chart bootstraps all istio [components](https://istio.io/docs/concepts/what-is-istio/overview.html) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Chart Details
+
+This chart can install multiple istio components as subcharts:
+- gateways
+- sidecarInjectorWebhook
+- galley
+- mixer
+- pilot
+- security(citadel)
+- tracing(jaeger)
+- kiali
+- grafana
+- prometheus
+
+To enable or disable each component, change the corresponding `enabled` flag.
+
+Notes: You will need to apply `kubectl label namespace $your-namesapce istio-injection=enabled` to enabled automatic sidecar injection of your desired kubernetes namespaces.

charts/rancher-istio/1.1.5-rancher1/charts/certmanager/templates/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         app: certmanager
         chart: {{ template "certmanager.chart" . }}
         heritage: {{ .Release.Service }}
-        release: {{ .Release.Name }}        
+        release: {{ .Release.Name }}
         {{- if .Values.podLabels }}
 {{ toYaml .Values.podLabels | indent 8 }}
         {{- end }}
@@ -35,7 +35,11 @@ spec:
 {{- end }}
       containers:
       - name: certmanager
-        image: "{{ .Values.hub }}/cert-manager-controller:{{ .Values.tag }}"
+      {{- if .Values.global.systemDefaultRegistry }}
+        image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+      {{- else }}
+        image: {{ .Values.image.hub }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}
+      {{- end }}
         imagePullPolicy: {{ .Values.global.imagePullPolicy }}
         args:
         - --cluster-resource-namespace=$(POD_NAMESPACE)
@@ -50,7 +54,6 @@ spec:
               fieldPath: metadata.namespace
         resources:
 {{ toYaml .Values.resources | indent 10 }}
-      
       {{- if .Values.podDnsPolicy }}
       dnsPolicy: {{ .Values.podDnsPolicy }}
       {{- end }}
@@ -60,4 +63,4 @@ spec:
       {{- end }}
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
-      {{- include "podAntiAffinity" . | indent 6 }}
+      {{- include "podAntiAffinity" . | indent 6 }}
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/certmanager/values.yaml

@@ -4,8 +4,10 @@
 # gateway must be updated by adding 'secretVolumes'. After the gateway
 # restart, DestinationRules can be created using the ACME-signed certificates.
 enabled: false
-hub: quay.io/jetstack
-tag: v0.6.2
+image:
+  hub: quay.io
+  repository: jetstack/cert-manager-controller
+  tag: v0.6.2
 resources: {}
 nodeSelector: {}
 

charts/rancher-istio/1.1.5-rancher1/charts/galley/templates/deployment.yaml

@@ -32,7 +32,7 @@ spec:
 {{- end }}
       containers:
         - name: galley
-          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           ports:
           - containerPort: 443

charts/rancher-istio/1.1.5-rancher1/charts/galley/values.yaml

@@ -3,7 +3,6 @@
 #
 enabled: true
 replicaCount: 1
-image: galley
 nodeSelector: {}
 
 # Specify the pod anti-affinity that allows you to constrain which nodes

charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/_affinity.tpl

@@ -11,6 +11,10 @@
 {{- define "gatewayNodeAffinityRequiredDuringScheduling" }}
       nodeSelectorTerms:
       - matchExpressions:
+        - key: beta.kubernetes.io/os
+          operator: In
+          values:
+          - linux
         - key: beta.kubernetes.io/arch
           operator: In
           values:

charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/deployment.yaml

@@ -43,11 +43,7 @@ spec:
 {{- if $.Values.global.proxy.enableCoreDump }}
       initContainers:
         - name: enable-core-dump
-{{- if contains "/" $.Values.global.proxy_init.image }}
-          image: "{{ $.Values.global.proxy_init.image }}"
-{{- else }}
-          image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy_init.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+          image: "{{ template "system_default_registry" $ }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh
@@ -61,11 +57,7 @@ spec:
 {{- if $spec.sds }}
 {{- if $spec.sds.enabled }}
         - name: ingress-sds
-{{- if contains "/" $spec.sds.image }}
-          image: "{{ $spec.sds.image }}"
-{{- else }}
-          image: "{{ $.Values.global.hub }}/{{ $spec.sds.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+          image: "{{ template "system_default_registry" $ }}{{ $.Values.global.nodeAgent.repository }}:{{ $.Values.global.nodeAgent.tag }}"
           imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
           env:
           - name: "ENABLE_WORKLOAD_SDS"
@@ -83,11 +75,7 @@ spec:
 {{- end }}
 {{- end }}
         - name: istio-proxy
-{{- if contains "/" $.Values.global.proxy.image }}
-          image: "{{ $.Values.global.proxy.image }}"
-{{- else }}
-          image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+          image: "{{ template "system_default_registry" $ }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
           imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
           ports:
             {{- range $key, $val := $spec.ports }}

charts/rancher-istio/1.1.5-rancher1/charts/gateways/templates/service.yaml

@@ -45,6 +45,16 @@ spec:
       {{ $pkey}}: {{ $pval }}
       {{- end }}
     {{- end }}
+
+    # range addon ports
+    {{- range $key, $val := $spec.addOnPorts }}
+    -
+      {{- range $pkey, $pval := $val }}
+      {{ $pkey}}: {{ $pval }}
+      {{- end }}
+    {{- end }}
+
+    # range meshExpansion ports
     {{- if $.Values.global.meshExpansion.enabled }}
     {{- range $key, $val := $spec.meshExpansionPorts }}
     -

charts/rancher-istio/1.1.5-rancher1/charts/gateways/values.yaml

@@ -17,7 +17,6 @@ istio-ingressgateway:
     enabled: false
     # SDS server that watches kubernetes secrets and provisions credentials to ingress gateway.
     # This server runs in the same pod as ingress gateway.
-    image: node-agent-k8s
   labels:
     app: istio-ingressgateway
     istio: ingressgateway
@@ -47,9 +46,6 @@ istio-ingressgateway:
     # Note that AWS ELB will by default perform health checks on the first port
     # on this list. Setting this to the health check port will ensure that health
     # checks always work. https://github.com/istio/istio/issues/12503
-  - port: 15020
-    targetPort: 15020
-    name: status-port
   - port: 80
     targetPort: 80
     name: http2
@@ -57,28 +53,28 @@ istio-ingressgateway:
   - port: 443
     name: https
     nodePort: 31390
-  # Example of a port to add. Remove if not needed
-  - port: 31400
-    name: tcp
-    nodePort: 31400
   ### PORTS FOR UI/metrics #####
   ## Disable if not needed
-  - port: 15029
-    targetPort: 15029
-    name: https-kiali
-  - port: 15030
-    targetPort: 15030
-    name: https-prometheus
-  - port: 15031
-    targetPort: 15031
-    name: https-grafana
-  - port: 15032
-    targetPort: 15032
-    name: https-tracing
-    # This is the port where sni routing happens
-  - port: 15443
-    targetPort: 15443
-    name: tls
+  addOnPorts:
+  # - port: 15029
+  #   targetPort: 15029
+  #   name: https-kiali
+  # - port: 15030
+  #   targetPort: 15030
+  #   name: https-prometheus
+  # - port: 15031
+  #   targetPort: 15031
+  #   name: https-grafana
+  # - port: 15032
+  #   targetPort: 15032
+  #   name: https-tracing
+  #   # This is the port where sni routing happens
+  # - port: 15443
+  #   targetPort: 15443
+  #   name: tls
+  # - port: 15020
+  #   targetPort: 15020
+  #   name: status-port
   #### MESH EXPANSION PORTS  ########
   # Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
   # to pilot/citadel if global.meshExpansion settings are enabled.

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/create-custom-resources-job.yaml

@@ -73,7 +73,7 @@ spec:
       serviceAccountName: istio-grafana-post-install-account
       containers:
         - name: kubectl
-          image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
           command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ]
           volumeMounts:
             - mountPath: "/tmp/grafana"

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/deployment.yaml

@@ -21,7 +21,6 @@ spec:
         sidecar.istio.io/inject: "false"
     spec:
       securityContext:
-        runAsUser: 472
         fsGroup: 472
 {{- if .Values.global.priorityClassName }}
       priorityClassName: "{{ .Values.global.priorityClassName }}"
@@ -34,7 +33,7 @@ spec:
 {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           ports:
           - containerPort: 3000
@@ -94,6 +93,25 @@ spec:
           - name: config
             mountPath: "/etc/grafana/provisioning/dashboards/dashboardproviders.yaml"
             subPath: dashboardproviders.yaml
+        - name: grafana-proxy
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
+          args:
+          - nginx
+          - -g
+          - daemon off;
+          - -c
+          - /nginx/nginx.conf
+          ports:
+          - name: http
+            containerPort: 80
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /nginx/
+            name: grafana-nginx
+          {{- if and .Values.resources .Values.resources.proxy }}
+          resources:
+  {{ toYaml .Values.resources.proxy | indent 10 }}
+          {{- end }}
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
       {{- include "podAntiAffinity" . | indent 6 }}
@@ -101,10 +119,17 @@ spec:
       - name: config
         configMap:
           name: istio-grafana
+      - name: grafana-nginx
+        configMap:
+          name: grafana-nginx
+          items:
+          - key: nginx.conf
+            mode: 438
+            path: nginx.conf
       - name: data
-{{- if .Values.persist }}
+{{- if .Values.persistence.enabled }}
         persistentVolumeClaim:
-          claimName: istio-grafana-pvc
+          claimName: {{ .Values.persistence.existingClaim | default ("istio-grafana-pvc") }}
 {{- else }}
         emptyDir: {}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/nginx-configmap.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-nginx
+  labels:
+    app: grafana-nginx
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+data:
+  nginx.conf: |-
+    user                  nginx;
+    worker_processes      auto;
+    error_log             /dev/stdout warn;
+    pid                   /var/run/nginx.pid;
+
+    events {
+       worker_connections 1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      log_format    main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
+
+      proxy_connect_timeout       10;
+      proxy_read_timeout          180;
+      proxy_send_timeout          5;
+      proxy_buffering             off;
+      proxy_cache_path            /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
+
+      server {
+        listen          80;
+        access_log      off;
+
+        gzip            on;
+        gzip_min_length 1k;
+        gzip_comp_level 2;
+        gzip_types      text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
+        gzip_vary       on;
+        gzip_disable    "MSIE [1-6]\.";
+
+        proxy_set_header Host $host;
+
+        location /api/dashboards {
+          proxy_pass     http://localhost:3000;
+        }
+
+        location /api/search {
+          proxy_pass     http://localhost:3000;
+
+          sub_filter_types application/json;
+          sub_filter_once off;
+          sub_filter '"url":"/d' '"url":"d';
+        }
+
+        location / {
+          proxy_cache         my_zone;
+          proxy_cache_valid   200 302 1d;
+          proxy_cache_valid   301 30d;
+          proxy_cache_valid   any 5m;
+          proxy_cache_bypass  $http_cache_control;
+          add_header          X-Proxy-Cache $upstream_cache_status;
+          add_header          Cache-Control "public";
+
+          proxy_pass     http://localhost:3000/;
+
+          sub_filter_types text/html;
+          sub_filter_once off;
+          sub_filter '"appSubUrl":""' '"appSubUrl":"."';
+          sub_filter '"url":"/' '"url":"./';
+          sub_filter ':"/avatar/' ':"avatar/';
+
+          if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
+            expires             90d;
+          }
+        }
+      }
+    }

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/pvc.yaml

-{{- if .Values.persist }}
+{{- if .Values.persistence.enabled }}
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
@@ -10,10 +10,10 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
 spec:
-  storageClassName: {{ .Values.storageClassName }}
+  storageClassName: {{ .Values.persistence.storageClass }}
   accessModes:
-    - {{ .Values.accessMode }}
+    - {{ .Values.persistence.accessMode }}
   resources:
     requests:
-      storage: 5Gi
+      storage: {{ .Values.persistence.size }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/service.yaml

@@ -12,21 +12,13 @@ metadata:
     chart: {{ template "grafana.chart" . }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+    kubernetes.io/cluster-service: "true"
 spec:
   type: {{ .Values.service.type }}
   ports:
-    - port: {{ .Values.service.externalPort }}
-      targetPort: 3000
-      protocol: TCP
-      name: {{ .Values.service.name }}
+  - name: http-access-grafana
+    protocol: TCP
+    targetPort: 80
+    port: 80
   selector:
     app: grafana
-{{- if .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
-{{- end }}
-  {{if .Values.service.loadBalancerSourceRanges}}
-  loadBalancerSourceRanges:
-    {{range $rangeList := .Values.service.loadBalancerSourceRanges}}
-    - {{ $rangeList }}
-    {{end}}
-  {{end}}
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/grafana/templates/tests/test-grafana-connection.yaml

@@ -19,12 +19,11 @@ spec:
 {{- end }}
   containers:
     - name: "{{ template "grafana.fullname" . }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
+      image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
       imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
       command: ['curl']
       args: ['http://grafana:{{ .Values.grafana.service.externalPort }}']
   restartPolicy: Never
   affinity:
     {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/grafana/values.yaml

@@ -3,9 +3,6 @@
 #
 enabled: false
 replicaCount: 1
-image:
-  repository: grafana/grafana
-  tag: 6.0.2
 ingress:
   enabled: false
   ## Used to create an Ingress record.
@@ -19,9 +16,12 @@ ingress:
     # - secretName: grafana-tls
     #   hosts:
     #     - grafana.local
-persist: false
-storageClassName: ""
-accessMode: ReadWriteMany
+persistence:
+  enabled: false
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  existingClaim: ""
+  size: 5Gi
 security:
   enabled: false
   secretName: grafana
@@ -53,11 +53,7 @@ podAntiAffinityTermLabelSelector: {}
 contextPath: /grafana
 service:
   annotations: {}
-  name: http
   type: ClusterIP
-  externalPort: 3000
-  loadBalancerIP:
-  loadBalancerSourceRanges:
 
 datasources:
   datasources.yaml:
@@ -84,3 +80,5 @@ dashboardProviders:
       disableDeletion: false
       options:
         path: /var/lib/grafana/dashboards/istio
+
+resources: {}
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/istiocoredns/templates/deployment.yaml

@@ -27,7 +27,7 @@ spec:
 {{- end }}
       containers:
       - name: coredns
-        image: {{ .Values.coreDNSImage }}
+        image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: IfNotPresent
         args: [ "-conf", "/etc/coredns/Corefile" ]
         volumeMounts:
@@ -61,7 +61,7 @@ spec:
       - name: istio-coredns-plugin
         command:
         - /usr/local/bin/plugin
-        image: {{ .Values.coreDNSPluginImage }}
+        image: "{{ template "system_default_registry" . }}{{ .Values.pluginImage.repository }}:{{ .Values.pluginImage.tag }}"
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8053

charts/rancher-istio/1.1.5-rancher1/charts/istiocoredns/values.yaml

@@ -3,11 +3,9 @@
 #
 enabled: false
 replicaCount: 1
-coreDNSImage: coredns/coredns:1.1.2
 # Source code for the plugin can be found at
 # https://github.com/istio-ecosystem/istio-coredns-plugin
 # The plugin listens for DNS requests from coredns server at 127.0.0.1:8053
-coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1
 nodeSelector: {}
 
 # Specify the pod anti-affinity that allows you to constrain which nodes

charts/rancher-istio/1.1.5-rancher1/charts/kiali/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v1
 description: Kiali is an open source project for service mesh observability, refer to https://www.kiali.io for details.
 name: kiali
 version: 1.1.0
-appVersion: 0.16
+appVersion: 0.17
 tillerVersion: ">=2.7.2"

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/configmap.yaml

@@ -17,6 +17,14 @@ data:
       istio:
         url_service_version: http://istio-pilot:8080/version
       jaeger:
+        service: "jaeger-query"
+        {{- if .Values.dashboard.jaegerURL }}
         url: {{ .Values.dashboard.jaegerURL }}
+        {{- end }}
       grafana:
+        custom_metrics_url: "http://prometheus.{{ .Release.Namespace }}:9090"
+        {{- if .Values.dashboard.grafanaURL }}
         url: {{ .Values.dashboard.grafanaURL }}
+        {{- else }}
+        url: "http://prometheus.{{ .Release.Namespace }}:9090"
+        {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/deployment.yaml

@@ -23,16 +23,13 @@ spec:
         release: {{ .Release.Name }}
       annotations:
         sidecar.istio.io/inject: "false"
-        scheduler.alpha.kubernetes.io/critical-pod: ""
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "9090"
     spec:
       serviceAccountName: kiali-service-account
 {{- if .Values.global.priorityClassName }}
       priorityClassName: "{{ .Values.global.priorityClassName }}"
 {{- end }}
       containers:
-      - image: "{{ .Values.hub }}/kiali:{{ .Values.tag }}"
+      - image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
         name: kiali
         command:
         - "/opt/kiali/kiali"
@@ -45,6 +42,20 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: AUTH_STRATEGY
+          value: {{ .Values.dashboard.authStrategy }}
+        - name: SERVER_CREDENTIALS_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.dashboard.secretName }}
+              key: username
+              optional: true
+        - name: SERVER_CREDENTIALS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.dashboard.secretName }}
+              key: passphrase
+              optional: true
         - name: PROMETHEUS_SERVICE_URL
           value: {{ .Values.prometheusAddr }}
 {{- if .Values.contextPath }}
@@ -54,22 +65,42 @@ spec:
         volumeMounts:
         - name: kiali-configuration
           mountPath: "/kiali-configuration"
-        - name: kiali-secret
-          mountPath: "/kiali-secret"
         resources:
 {{- if .Values.resources }}
 {{ toYaml .Values.resources | indent 10 }}
 {{- else }}
 {{ toYaml .Values.global.defaultResources | indent 10 }}
 {{- end }}
+      - name: kiali-proxy
+        image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
+        args:
+        - nginx
+        - -g
+        - daemon off;
+        - -c
+        - /nginx/nginx.conf
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /nginx/
+          name: kiali-nginx
+        {{- if and .Values.resources .Values.resources.proxy }}
+        resources:
+{{ toYaml .Values.resources.proxy | indent 10 }}
+        {{- end }}
       volumes:
       - name: kiali-configuration
         configMap:
           name: kiali
-      - name: kiali-secret
-        secret:
-          secretName: {{ .Values.dashboard.secretName }}
-          optional: true
+      - name: kiali-nginx
+        configMap:
+          name: kiali-nginx
+          items:
+          - key: nginx.conf
+            mode: 438
+            path: nginx.conf
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
       {{- include "podAntiAffinity" . | indent 6 }}

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/nginx-configmap.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kiali-nginx
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: kiali-nginx
+    chart: {{ template "kiali.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+data:
+  nginx.conf: |-
+    user                  nginx;
+    worker_processes      auto;
+    error_log             /dev/stdout warn;
+    pid                   /var/run/nginx.pid;
+
+    events {
+       worker_connections 1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      log_format    main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
+
+      proxy_connect_timeout       10;
+      proxy_read_timeout          180;
+      proxy_send_timeout          5;
+      proxy_buffering             off;
+      proxy_cache_path            /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
+
+      server {
+        listen          80;
+        access_log      off;
+
+        gzip            on;
+        gzip_min_length 1k;
+        gzip_comp_level 2;
+        gzip_types      text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
+        gzip_vary       on;
+        gzip_disable    "MSIE [1-6]\.";
+
+        proxy_set_header Host $host;
+
+        location / {
+          proxy_cache         my_zone;
+          proxy_cache_valid   200 302 1d;
+          proxy_cache_valid   301 30d;
+          proxy_cache_valid   any 5m;
+          proxy_cache_bypass  $http_cache_control;
+          add_header          X-Proxy-Cache $upstream_cache_status;
+          add_header          Cache-Control "public";
+
+          proxy_pass     http://localhost:20001/;
+          sub_filter_types text/html;
+          sub_filter_once on;
+          sub_filter </head> '<script>var path = window.location.pathname; var pathName = path.substring(0, path.lastIndexOf("/proxy") + 6); window.WEB_ROOT = window.WEB_ROOT ? pathName + window.WEB_ROOT:pathName</script></head>';
+          if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
+            expires             90d;
+          }
+        }
+      }
+    }

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/demosecret.yaml → charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/secret.yaml

-{{- if .Values.createDemoSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Values.dashboard.secretName }}
+  name: kiali
   namespace: {{ .Release.Namespace }}
   labels:
     app: {{ template "kiali.name" . }}
@@ -11,6 +10,5 @@ metadata:
     release: {{ .Release.Name }}
 type: Opaque
 data:
-  username: YWRtaW4=   # admin
-  passphrase: YWRtaW4= # admin
-{{- end }}
+  username: {{ .Values.dashboard.username | b64enc | quote }}
+  passphrase: {{ .Values.dashboard.passphrase | b64enc | quote }}

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/service.yaml

@@ -9,9 +9,30 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
 spec:
+  type: ClusterIP
   ports:
   - name: http-kiali
     protocol: TCP
     port: 20001
   selector:
     app: kiali
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kiali-http
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "kiali.name" . }}
+    chart: {{ template "kiali.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    kubernetes.io/cluster-service: "true"
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+  - name: http-access-kiali
+    protocol: TCP
+    port: 80
+  selector:
+    app: kiali

charts/rancher-istio/1.1.5-rancher1/charts/kiali/templates/tests/test-kiali-connection.yaml

@@ -19,12 +19,11 @@ spec:
 {{- end }}
   containers:
     - name: "{{ template "kiali.fullname" . }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
+      image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
       imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
       command: ['curl']
       args: ['http://kiali:20001']
   restartPolicy: Never
   affinity:
     {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/kiali/values.yaml

 #
 # addon kiali
 #
-enabled: false # Note that if using the demo or demo-auth yaml when installing via Helm, this default will be `true`.
+enabled: false
 replicaCount: 1
-hub: docker.io/kiali
-tag: v0.16
-contextPath: /kiali # The root context path to access the Kiali UI.
+contextPath: /
 nodeSelector: {}
 
 # Specify the pod anti-affinity that allows you to constrain which nodes
@@ -44,10 +42,20 @@ ingress:
     #     - kiali.local
 
 dashboard:
-  secretName: kiali # You must create a secret with this name - one is not provided out-of-box.
-  grafanaURL:  # If you have Grafana installed and it is accessible to client browsers, then set this to its external URL. Kiali will redirect users to this URL when Grafana metrics are to be shown.
-  jaegerURL:  # If you have Jaeger installed and it is accessible to client browsers, then set this property to its external URL. Kiali will redirect users to this URL when Jaeger tracing is to be shown.
+  # login/anonymous
+  authStrategy: anonymous
+  secretName: kiali
+  username: admin
+  passphrase: admin
+
+  # Override the automatically detected Grafana URL, useful when Grafana service has no ExternalIPs
+  grafanaURL:
+
+  # Override the automatically detected Jaeger URL, useful when Jaeger service has no ExternalIPs
+  jaegerURL:
 prometheusAddr: http://prometheus:9090
 
-# When true, a secret will be created with a default username and password. Useful for demos.
-createDemoSecret: false
+service:
+  type: ClusterIP
+
+resources: {}
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/mixer/templates/deployment.yaml

@@ -20,11 +20,7 @@
       {{- include "podAntiAffinity" . | indent 6 }}
       containers:
       - name: mixer
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.repository }}:{{ $.Values.tag }}"
         imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
         ports:
         - containerPort: {{ .Values.global.monitoringPort }}
@@ -86,11 +82,7 @@
           initialDelaySeconds: 5
           periodSeconds: 5
       - name: istio-proxy
-{{- if contains "/" $.Values.global.proxy.image }}
-        image: "{{ $.Values.global.proxy.image }}"
-{{- else }}
-        image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
         imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
         ports:
         - containerPort: 9091
@@ -168,11 +160,7 @@
       {{- include "podAntiAffinity" . | indent 6 }}
       containers:
       - name: mixer
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.repository }}:{{ $.Values.tag }}"
         imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
         ports:
         - containerPort: {{ .Values.global.monitoringPort }}
@@ -244,11 +232,7 @@
           initialDelaySeconds: 5
           periodSeconds: 5
       - name: istio-proxy
-{{- if contains "/" $.Values.global.proxy.image }}
-        image: "{{ $.Values.global.proxy.image }}"
-{{- else }}
-        image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}"
         imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
         ports:
         - containerPort: 9091

charts/rancher-istio/1.1.5-rancher1/charts/mixer/templates/service.yaml

@@ -36,4 +36,3 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
-

charts/rancher-istio/1.1.5-rancher1/charts/mixer/values.yaml

@@ -2,7 +2,6 @@
 # mixer configuration
 #
 enabled: true
-image: mixer
 
 env:
   GODEBUG: gctrace=1

charts/rancher-istio/1.1.5-rancher1/charts/nodeagent/templates/daemonset.yaml

@@ -22,11 +22,7 @@ spec:
       serviceAccountName: istio-nodeagent-service-account
       containers:
       - name: nodeagent
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.global.nodeAgent.repository }}:{{ $.Values.global.nodeAgent.tag }}"
         imagePullPolicy: {{ .Values.global.imagePullPolicy }}
         volumeMounts:
         - mountPath: /var/run/sds

charts/rancher-istio/1.1.5-rancher1/charts/pilot/templates/_helpers.tpl

@@ -30,3 +30,4 @@ Create chart name and version as used by the chart label.
 {{- define "pilot.chart" -}}
 {{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+

charts/rancher-istio/1.1.5-rancher1/charts/pilot/templates/deployment.yaml

@@ -44,11 +44,7 @@ spec:
 {{- end }}
       containers:
         - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
-{{- end }}
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           args:
           - "discovery"
@@ -126,11 +122,7 @@ spec:
             readOnly: true
 {{- if .Values.sidecar }}
         - name: istio-proxy
-{{- if contains "/" .Values.global.proxy.image }}
-          image: "{{ .Values.global.proxy.image }}"
-{{- else }}
-          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
-{{- end }}
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           ports:
           - containerPort: 15003

charts/rancher-istio/1.1.5-rancher1/charts/pilot/templates/meshexpansion.yaml

@@ -88,4 +88,3 @@ spec:
 ---
 {{- end }}
 {{- end }}
-

charts/rancher-istio/1.1.5-rancher1/charts/pilot/values.yaml

@@ -7,7 +7,6 @@ autoscaleMin: 1
 autoscaleMax: 5
 # specify replicaCount when autoscaleEnabled: false
 # replicaCount: 1
-image: pilot
 sidecar: true
 traceSampling: 1.0
 # Resources for a small pilot install

charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/deployment.yaml

@@ -30,7 +30,7 @@ spec:
 {{- end }}
       containers:
         - name: prometheus
-          image: "{{ .Values.hub }}/prometheus:{{ .Values.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           args:
             - '--storage.tsdb.retention={{ .Values.retention }}'
@@ -57,6 +57,31 @@ spec:
             mountPath: /etc/prometheus
           - mountPath: /etc/istio-certs
             name: istio-certs
+        - name: prometheus-nginx
+          command:
+          - /bin/sh
+          - -c
+          - cp /nginx/run-sh.tmpl /var/run/nginx-start.sh; chmod +x /var/run/nginx-start.sh; /var/run/nginx-start.sh
+          env:
+          - name: POD_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
+          ports:
+          - containerPort: 80
+            name: http
+            protocol: TCP
+          {{- if and .Values.resources .Values.resources.proxy }}
+          resources:
+      {{ toYaml .Values.resources.proxy | indent 6 }}
+          {{- end }}
+          securityContext:
+            runAsNonRoot: false
+            runAsUser: 0
+          volumeMounts:
+          - mountPath: /nginx
+            name: prometheus-nginx
       volumes:
       - name: config-volume
         configMap:
@@ -64,10 +89,11 @@ spec:
       - name: istio-certs
         secret:
           defaultMode: 420
-{{- if not .Values.security.enabled }}
           optional: true
-{{- end }}
           secretName: istio.default
+      - name: prometheus-nginx
+        configMap:
+          name: {{ template "prometheus.chart" . }}-nginx
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
       {{- include "podAntiAffinity" . | indent 6 }}

charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/nginx-configmap.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prometheus-nginx
+  labels:
+    app: prometheus-nginx
+    chart: {{ template "prometheus.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+data:
+  run-sh.tmpl: |-
+    #!/bin/sh
+    set -e
+
+    srcpath="/nginx/nginx-conf.tmpl"
+    dstpath="/var/run/nginx.conf"
+
+    if ! [ -f $srcpath ]; then
+      exit 1
+    fi
+
+    token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+    sed "s/REPLACE_PARAM_AUTHORIZATION/Bearer ${token}/g" $srcpath | sed "s/REPLACE_PARAM_IP/${POD_IP}/g" > $dstpath
+    
+    exec nginx -g "daemon off;" -c /var/run/nginx.conf
+
+  nginx-conf.tmpl: |-
+    user                  nginx;
+    worker_processes      auto;
+    error_log             /dev/stdout warn;
+    pid                   /var/run/nginx.pid;
+
+    events {
+       worker_connections 1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      log_format    main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
+
+      proxy_connect_timeout       10;
+      proxy_read_timeout          180;
+      proxy_send_timeout          5;
+      proxy_buffering             off;
+      proxy_cache_path            /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
+
+      server {
+        listen          80;
+        access_log      off;
+
+        gzip            on;
+        gzip_min_length 1k;
+        gzip_comp_level 2;
+        gzip_types      text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
+        gzip_vary       on;
+        gzip_disable    "MSIE [1-6]\.";
+
+        proxy_set_header    Host $host;
+        proxy_set_header    Authorization "REPLACE_PARAM_AUTHORIZATION";
+        proxy_pass_header   Authorization;
+
+        location / {
+          proxy_cache         my_zone;
+          proxy_cache_valid   200 302 1d;
+          proxy_cache_valid   301 30d;
+          proxy_cache_valid   any 5m;
+          proxy_cache_bypass  $http_cache_control;
+          add_header          X-Proxy-Cache $upstream_cache_status;
+          add_header          Cache-Control "public";
+
+          proxy_pass          http://REPLACE_PARAM_IP:9090/;
+
+          sub_filter_types    text/html;
+          sub_filter_once     off;
+          sub_filter          'var PATH_PREFIX = "";' 'var PATH_PREFIX = ".";';
+
+          if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
+            expires             90d;
+          }
+        }
+      }
+    }
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/service.yaml

@@ -14,32 +14,31 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
 spec:
+  type: ClusterIP
   selector:
     app: prometheus
   ports:
-  - name: http-prometheus
+  - name: prometheus
     protocol: TCP
     port: 9090
-
-{{- if .Values.service.nodePort.enabled }}
-# Using separate ingress for nodeport, to avoid conflict with pilot e2e test configs.
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: prometheus-nodeport
+  name: prometheus-http
   namespace: {{ .Release.Namespace }}
+  annotations:
   labels:
     app: prometheus
     chart: {{ template "prometheus.chart" . }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+    kubernetes.io/cluster-service: "true"
 spec:
-  type: NodePort
-  ports:
-  - port: 9090
-    nodePort: {{ .Values.service.nodePort.port }}
-    name: http-prometheus
+  type: ClusterIP
   selector:
     app: prometheus
-{{- end }}
+  ports:
+  - name: access-prometheus
+    protocol: TCP
+    port: 80

charts/rancher-istio/1.1.5-rancher1/charts/prometheus/templates/tests/test-prometheus-connection.yaml

@@ -19,11 +19,10 @@ spec:
 {{- end }}
   containers:
     - name: "{{ template "prometheus.fullname" . }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
+      image: {{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}
       imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
       command: ['sh', '-c', 'for i in 1 2 3; do curl http://prometheus:9090/-/ready && break || sleep 15; done']
   restartPolicy: Never
   affinity:
     {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/prometheus/values.yaml

@@ -3,8 +3,7 @@
 #
 enabled: true
 replicaCount: 1
-hub: docker.io/prom
-tag: v2.3.1
+
 retention: 6h
 nodeSelector: {}
 
@@ -50,9 +49,8 @@ ingress:
 
 service:
   annotations: {}
-  nodePort:
-    enabled: false
-    port: 32090
 
 security:
   enabled: true
+
+resources: {}

charts/rancher-istio/1.1.5-rancher1/charts/security/templates/cleanup-secrets.yaml

@@ -95,7 +95,7 @@ spec:
       serviceAccountName: istio-cleanup-secrets-service-account
       containers:
         - name: kubectl
-          image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
           imagePullPolicy: IfNotPresent
           command:
           - /bin/bash

charts/rancher-istio/1.1.5-rancher1/charts/security/templates/create-custom-resources-job.yaml

@@ -77,7 +77,7 @@ spec:
       serviceAccountName: istio-security-post-install-account	
       containers:	
         - name: kubectl	
-          image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"	
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
           imagePullPolicy: IfNotPresent	
           command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ]	
           volumeMounts:	

charts/rancher-istio/1.1.5-rancher1/charts/security/templates/deployment.yaml

@@ -11,7 +11,7 @@ metadata:
     release: {{ .Release.Name }}
     istio: citadel
 spec:
-  replicas: 1
+  replicas: {{ .Values.replicaCount }}
   strategy:
     rollingUpdate:
       maxSurge: 1
@@ -33,7 +33,7 @@ spec:
 {{- end }}
       containers:
         - name: citadel
-          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           args:
             - --append-dns-names=true

charts/rancher-istio/1.1.5-rancher1/charts/security/templates/tests/test-citadel-connection.yaml

@@ -19,11 +19,10 @@ spec:
 {{- end }}
   containers:
     - name: "{{ template "security.fullname" . }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
+      image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
       imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
       command: ['sh', '-c', 'for i in 1 2 3; do curl http://istio-citadel:8060/-/ready && break || sleep 15; done']
   restartPolicy: Never
   affinity:
     {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/security/values.yaml

@@ -2,7 +2,7 @@
 # security configuration
 #
 enabled: true
-image: citadel
+replicaCount: 1
 selfSigned: true # indicate if self-signed CA is used.
 createMeshPolicy: true
 nodeSelector: {}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/.helmignore

-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/Chart.yaml

-apiVersion: v1
-description: A Helm chart for Kubernetes
-name: servicegraph
-version: 1.1.0
-appVersion: 1.1.0
-tillerVersion: ">=2.7.2"

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/NOTES.txt

-1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range .Values.ingress.hosts }}
-  http://{{ . }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "servicegraph.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get svc -w {{ template "servicegraph.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "servicegraph.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
-  echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "servicegraph.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl port-forward $POD_NAME 8080:8088
-{{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/_helpers.tpl

-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "servicegraph.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "servicegraph.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "servicegraph.chart" -}}
-{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/deployment.yaml

-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: servicegraph
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: servicegraph
-    chart: {{ template "servicegraph.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  template:
-    metadata:
-      labels:
-        app: servicegraph
-        chart: {{ template "servicegraph.chart" . }}
-        heritage: {{ .Release.Service }}
-        release: {{ .Release.Name }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-    spec:
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-{{- end }}
-{{- end }}
-      containers:
-        - name: servicegraph
-          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-          ports:
-            - containerPort: 8088
-          args:
-          - --prometheusAddr={{- .Values.prometheusAddr }}
-          livenessProbe:
-            httpGet:
-              path: /graph
-              port: 8088
-          readinessProbe:
-            httpGet:
-              path: /graph
-              port: 8088
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | indent 12 }}
-{{- end }}
-      affinity:
-      {{- include "nodeaffinity" . | indent 6 }}
-      {{- include "podAntiAffinity" . | indent 6 }}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/ingress.yaml

-{{- if .Values.ingress.enabled -}}
-{{- $servicePort := .Values.service.externalPort -}}
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: {{ template "servicegraph.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: servicegraph
-    chart: {{ template "servicegraph.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-  annotations:
-    {{- range $key, $value := .Values.ingress.annotations }}
-      {{ $key }}: {{ $value | quote }}
-    {{- end }}
-spec:
-  rules:
-    {{- range $host := .Values.ingress.hosts }}
-    - host: {{ $host }}
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: servicegraph
-              servicePort: {{ $servicePort }}
-    {{- end -}}
-  {{- if .Values.ingress.tls }}
-  tls:
-{{ toYaml .Values.ingress.tls | indent 4 }}
-  {{- end -}}
-{{- end -}}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/service.yaml

-apiVersion: v1
-kind: Service
-metadata:
-  name: servicegraph
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{- range $key, $val := .Values.service.annotations }}
-    {{ $key }}: {{ $val | quote }}
-    {{- end }}
-  labels:
-    app: servicegraph
-    chart: {{ template "servicegraph.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.externalPort }}
-      targetPort: 8088
-      protocol: TCP
-      name: {{ .Values.service.name }}
-  selector:
-    app: servicegraph
-{{- if .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
-{{- end }}
-  {{if .Values.service.loadBalancerSourceRanges}}
-  loadBalancerSourceRanges:
-    {{range $rangeList := .Values.service.loadBalancerSourceRanges}}
-    - {{ $rangeList }}
-    {{end}}
-  {{end}}
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/templates/tests/test-servicegraph-connection.yaml

-{{- if .Values.global.enableHelmTest }}
-apiVersion: v1
-kind: Pod
-metadata:
-  name: {{ template "servicegraph.fullname" . }}-test
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: servicegraph-test
-    chart: {{ template "servicegraph.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-    istio: servicegraph
-  annotations:
-    sidecar.istio.io/inject: "false"
-    helm.sh/hook: test-success
-spec:
-{{- if .Values.global.priorityClassName }}
-  priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-  containers:
-    - name: "{{ template "servicegraph.fullname" . }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
-      imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
-      command: ['curl']
-      args: ['http://servicegraph:{{ .Values.servicegraph.service.externalPort }}']
-  restartPolicy: Never
-  affinity:
-    {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
-{{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/servicegraph/values.yaml

-#
-# addon servicegraph configuration
-#
-enabled: false
-replicaCount: 1
-image: servicegraph
-nodeSelector: {}
-
-# Specify the pod anti-affinity that allows you to constrain which nodes
-# your pod is eligible to be scheduled based on labels on pods that are
-# already running on the node rather than based on labels on nodes.
-# There are currently two types of anti-affinity:
-#    "requiredDuringSchedulingIgnoredDuringExecution"
-#    "preferredDuringSchedulingIgnoredDuringExecution"
-# which denote “hard” vs. “soft” requirements, you can define your values
-# in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
-# correspondingly.
-# For example:
-# podAntiAffinityLabelSelector:
-# - key: security
-#   operator: In
-#   values: S1,S2
-#   topologyKey: "kubernetes.io/hostname"
-# This pod anti-affinity rule says that the pod requires not to be scheduled
-# onto a node if that node is already running a pod with label having key
-# “security” and value “S1”.
-podAntiAffinityLabelSelector: {}
-podAntiAffinityTermLabelSelector: {}
-
-service:
-  annotations: {}
-  name: http
-  type: ClusterIP
-  externalPort: 8088
-  loadBalancerIP:
-  loadBalancerSourceRanges:
-ingress:
-  enabled: false
-  # Used to create an Ingress record.
-  hosts:
-    - servicegraph.local
-  annotations:
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  tls:
-    # Secrets must be manually created in the namespace.
-    # - secretName: servicegraph-tls
-    #   hosts:
-    #     - servicegraph.local
-# prometheus address
-prometheusAddr: http://prometheus:9090

charts/rancher-istio/1.1.5-rancher1/charts/sidecarInjectorWebhook/templates/deployment.yaml

@@ -32,7 +32,7 @@ spec:
 {{- end }}
       containers:
         - name: sidecar-injector-webhook
-          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.repository }}:{{ .Values.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           args:
             - --caCertFile=/etc/istio/certs/root-cert.pem

charts/rancher-istio/1.1.5-rancher1/charts/sidecarInjectorWebhook/values.yaml

@@ -3,7 +3,6 @@
 #
 enabled: true
 replicaCount: 1
-image: sidecar_injector
 enableNamespacesByDefault: false
 nodeSelector: {}
 

charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/deployment-jaeger.yaml

@@ -39,7 +39,7 @@ spec:
 {{- end }}
       containers:
         - name: jaeger
-          image: "{{ .Values.jaeger.hub }}/all-in-one:{{ .Values.jaeger.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.jaeger.repository }}:{{ .Values.jaeger.tag }}"
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           ports:
             - containerPort: 9411
@@ -76,6 +76,33 @@ spec:
 {{- else }}
 {{ toYaml .Values.global.defaultResources | indent 12 }}
 {{- end }}
+        - name: jaeger-proxy
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
+          args:
+          - nginx
+          - -g
+          - daemon off;
+          - -c
+          - /nginx/nginx.conf
+          ports:
+          - name: http
+            containerPort: 80
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /nginx/
+            name: tracing-nginx
+          {{- if and .Values.jaeger.proxy .Values.jaeger.proxy.resources }}
+          resources:
+  {{ toYaml .Values.jaeger.proxy.resources | indent 12 }}
+          {{- end }}
+      volumes:
+      - name: tracing-nginx
+        configMap:
+          name: tracing-nginx
+          items:
+          - key: nginx.conf
+            mode: 438
+            path: nginx.conf
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
       {{- include "podAntiAffinity" . | indent 6 }}

charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/deployment-zipkin.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.zipkin.hub }}/zipkin:{{ .Values.zipkin.tag }}"
+          image: "{{ template "system_default_registry" . }}{{ .Values.zipkin.repository }}:{{ .Values.zipkin.tag }}"
           ports:
             - containerPort: {{ .Values.zipkin.queryPort }}
           livenessProbe:
@@ -51,6 +51,33 @@ spec:
               value: "mem"
             - name: ZIPKIN_STORAGE_MEM_MAXSPANS
               value: "{{ .Values.zipkin.maxSpans }}"
+        - name: zipkin-proxy
+          image: "{{ template "system_default_registry" . }}{{ .Values.global.nginxProxy.repository }}:{{ .Values.global.nginxProxy.tag }}"
+          args:
+          - nginx
+          - -g
+          - daemon off;
+          - -c
+          - /nginx/nginx.conf
+          ports:
+          - name: http
+            containerPort: 80
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /nginx/
+            name: tracing-nginx
+          {{- if and .Values.zipkin.proxy .Values.zipkin.proxy.resources }}
+          resources:
+  {{ toYaml .Values.zipkin.proxy.resources | indent 12 }}
+          {{- end }}
+      volumes:
+      - name: tracing-nginx
+        configMap:
+          name: tracing-nginx
+          items:
+          - key: nginx.conf
+            mode: 438
+            path: nginx.conf
       affinity:
       {{- include "nodeaffinity" . | indent 6 }}
       {{- include "podAntiAffinity" . | indent 6 }}

charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/nginx-configmap.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tracing-nginx
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: tracing-nginx
+    chart: {{ template "tracing.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+data:
+  nginx.conf: |-
+    user                  nginx;
+    worker_processes      auto;
+    error_log             /dev/stdout warn;
+    pid                   /var/run/nginx.pid;
+
+    events {
+       worker_connections 1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      log_format    main '[$time_local - $status] $remote_addr - $remote_user $request ($http_referer)';
+
+      proxy_connect_timeout       10;
+      proxy_read_timeout          180;
+      proxy_send_timeout          5;
+      proxy_buffering             off;
+      proxy_cache_path            /tmp/nginx levels=1:2 keys_zone=my_zone:100m inactive=1d max_size=10g;
+
+      server {
+        listen          80;
+        access_log      off;
+
+        gzip            on;
+        gzip_min_length 1k;
+        gzip_comp_level 2;
+        gzip_types      text/plain application/javascript application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png;
+        gzip_vary       on;
+        gzip_disable    "MSIE [1-6]\.";
+
+        proxy_set_header Host $host;
+
+        location / {
+          proxy_cache         my_zone;
+          proxy_cache_valid   200 302 1d;
+          proxy_cache_valid   301 30d;
+          proxy_cache_valid   any 5m;
+          proxy_cache_bypass  $http_cache_control;
+          add_header          X-Proxy-Cache $upstream_cache_status;
+          add_header          Cache-Control "public";
+{{ if eq .Values.provider "jaeger" }}
+          proxy_pass     http://localhost:16686/;
+{{ else }}
+          proxy_pass     http://localhost:9411/;
+{{ end}}      
+          if ($request_filename ~ .*\.(?:js|css|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm)$) {
+            expires             90d;
+          }
+        }
+      }
+    }

charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/service.yaml

@@ -42,15 +42,13 @@ items:
       chart: {{ template "tracing.chart" . }}
       heritage: {{ .Release.Service }}
       release: {{ .Release.Name }}
+      kubernetes.io/cluster-service: "true"
   spec:
+    type: {{ .Values.service.uiType }}
     ports:
-      - name: http-query
+      - name: http-access-tracing
         port: 80
         protocol: TCP
-{{ if eq .Values.provider "jaeger" }}
-        targetPort: 16686
-{{ else }}
-        targetPort: 9411
-{{ end}}
+        targetPort: 80
     selector:
       app: {{ .Values.provider }}

charts/rancher-istio/1.1.5-rancher1/charts/tracing/templates/tests/test-tracing-connection.yaml

@@ -18,7 +18,7 @@ spec:
 {{- end }}
   containers:
     - name: "{{ .Values.provider }}-test"
-      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
+      image: "{{ template "system_default_registry" . }}{{ .Values.global.proxy.repository }}:{{ .Values.global.proxy.tag }}"
       imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
       command: ['curl']
       {{- if eq .Values.provider "jaeger" }}
@@ -29,5 +29,4 @@ spec:
   restartPolicy: Never
   affinity:
     {{- include "nodeaffinity" . | indent 4 }}
-    {{- include "podAntiAffinity" . | indent 4 }}
 {{- end }}

charts/rancher-istio/1.1.5-rancher1/charts/tracing/values.yaml

@@ -28,14 +28,12 @@ podAntiAffinityLabelSelector: {}
 podAntiAffinityTermLabelSelector: {}
 
 jaeger:
-  hub: docker.io/jaegertracing
-  tag: 1.9
   memory:
     max_traces: 50000
+  proxy:
+    resources: {}
 
 zipkin:
-  hub: docker.io/openzipkin
-  tag: 2
   probeStartupDelay: 200
   queryPort: 9411
   resources:
@@ -53,11 +51,14 @@ zipkin:
   maxSpans: 500000
   node:
     cpus: 2
+  proxy:
+    resources: {}
 
 service:
   annotations: {}
   name: http
   type: ClusterIP
+  uiType: ClusterIP
   externalPort: 9411
 
 ingress:

charts/rancher-istio/1.1.5-rancher1/example-values/README.md

-# Example Values
-
-These files provide various example values for different Istio setups.
-
-To use them, [read the docs](https://istio.io/docs/setup/kubernetes/helm-install/) and add the flag `--values example-file.yaml`.

charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-example-sds-vault.yaml

-global:
-  controlPlaneSecurityEnabled: false
-
-  mtls:
-    # Default setting for service-to-service mtls. Can be set explicitly using
-    # destination rules or service annotations.
-    enabled: true
-
-  sds:
-    enabled: true
-    udsPath: "unix:/var/run/sds/uds_path"
-    useNormalJwt: true
-
-nodeagent:
-  enabled: true
-  image: node-agent-k8s
-  env:
-    # https://35.233.249.249:8200 is the IP address and the port number
-    # of a testing Vault server.
-    CA_ADDR: "https://35.233.249.249:8200"
-    CA_PROVIDER: "VaultCA"
-    VALID_TOKEN: true
-    # https://35.233.249.249:8200 is the IP address and the port number
-    # of a testing Vault server.
-    VAULT_ADDR: "https://35.233.249.249:8200"
-    VAULT_AUTH_PATH: "auth/kubernetes/login"
-    VAULT_ROLE: "istio-cert"
-    VAULT_SIGN_CSR_PATH: "istio_ca/sign/istio-pki-role"
-    VAULT_TLS_ROOT_CERT: '-----BEGIN CERTIFICATE-----\nMIIC3jCCAcagAwIBAgIRAIcSFH1jneS0XPz5r2QDbigwDQYJKoZIhvcNAQELBQAw\nEDEOMAwGA1UEChMFVmF1bHQwIBcNMTgxMjI2MDkwMDU3WhgPMjExODEyMDIwOTAw\nNTdaMBAxDjAMBgNVBAoTBVZhdWx0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA2q5lfJCLAOTEjX3xV8qMLEX8zUQpd0AjD6zzOMzx51GVM7Plf7CJmaDq\nyloRz3zcrTEltHUrln5fvouvp4TetOlqEU979vvccnFLgXrSpn+Zt/EyjE0rUYY3\n5e2qxy9bP2E7zJSKONIT6zRDd2zUQGH3zUem1ZG0GFY1ZL5qFSOIy+PvuQ4u8HCa\n1CcnHmI613fVDbFbaxuF2G2MIwCZ/Fg6KBd9kgU7uCOvkbR4AtRe0ntwweIjOIas\nFiohPQzVY4obrYZiTV43HT4lGti7ySn2c96UnRSnmHLWyBb7cafd4WZN/t+OmYSd\nooxCVQ2Zqub6NlZ5OySYOz/0BJq6DQIDAQABozEwLzAOBgNVHQ8BAf8EBAMCBaAw\nDAYDVR0TAQH/BAIwADAPBgNVHREECDAGhwQj6fn5MA0GCSqGSIb3DQEBCwUAA4IB\nAQBORvUcW0wgg/Wo1aKFaZQuPPFVLjOZat0QpCJYNDhsSIO4Y0JS+Y1cEIkvXB3S\nQ3D7IfNP0gh1fhtP/d45LQSPqpyJF5vKWAvwa/LSPKpw2+Zys4oDahcH+SEKiQco\nIhkkHNEgC4LEKEaGvY4A8Cw7uWWquUJB16AapSSnkeD2vTcxErfCO59yR7yEWDa6\n8j6QNzmGNj2YXtT86+Mmedhfh65Rrh94mhAPQHBAdCNGCUwZ6zHPQ6Z1rj+x3Wm9\ngqpveVq2olloNbnLNmM3V6F9mqSZACgADmRqf42bixeHczkTfRDKThJcpY5U44vy\nw4Nm32yDWhD6AC68rDkXX68m\n-----END CERTIFICATE-----'
\ No newline at end of file

charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-gateways.yaml

-# Common settings.
-global:
-  # Omit the istio-sidecar-injector configmap when generate a
-  # standalone gateway. Gateways may be created in namespaces other
-  # than `istio-system` and we don't want to re-create the injector
-  # configmap in those.
-  omitSidecarInjectorConfigMap: true
-
-  # Istio control plane namespace: This specifies where the Istio control
-  # plane was installed earlier.  Modify this if you installed the control
-  # plane in a different namespace than istio-system.
-  istioNamespace: istio-system
-
-  proxy:
-    # Sets the destination Statsd in envoy (the value of the "--statsdUdpAddress" proxy argument
-    # would be <host>:<port>).
-    # Disabled by default.
-    # The istio-statsd-prom-bridge is deprecated and should not be used moving forward.
-    envoyStatsd:
-      # If enabled is set to true, host and port must also be provided. Istio no longer provides a statsd collector.
-      enabled: false
-      host: # example: statsd-svc.istio-system
-      port: # example: 9125
-
-
-#
-# Gateways Configuration
-# By default (if enabled) a pair of Ingress and Egress Gateways will be created for the mesh.
-# You can add more gateways in addition to the defaults but make sure those are uniquely named
-# and that NodePorts are not conflicting.
-# Disable specifc gateway by setting the `enabled` to false.
-#
-gateways:
-  enabled: true
-
-  custom-gateway:
-    enabled: true
-    labels:
-      app: custom-gateway
-    replicaCount: 1
-    autoscaleMin: 1
-    autoscaleMax: 5
-    resources: {}
-      # limits:
-      #  cpu: 100m
-      #  memory: 128Mi
-      #requests:
-      #  cpu: 1800m
-      #  memory: 256Mi
-    cpu:
-      targetAverageUtilization: 80
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: {}
-    externalIPs: []
-    serviceAnnotations: {}
-    podAnnotations: {}
-    type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be
-    #externalTrafficPolicy: Local #change to Local to preserve source IP or Cluster for default behaviour or leave commented out
-    ports:
-      ## You can add custom gateway ports
-    - port: 80
-      targetPort: 80
-      name: http2
-      # nodePort: 31380
-    - port: 443
-      name: https
-      # nodePort: 31390
-    - port: 31400
-      name: tcp
-      # nodePort: 31400
-    # Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
-    # to pilot/citadel if global.meshExpansion settings are enabled.
-    - port: 15011
-      targetPort: 15011
-      name: tcp-pilot-grpc-tls
-    - port: 8060
-      targetPort: 8060
-      name: tcp-citadel-grpc-tls
-    # Addon ports for kiali are enabled in gateway - but will only redirect if
-    # the gateway configuration for the various components are enabled.
-    - port: 15029
-      targetPort: 15029
-      name: http2-kiali
-    # Telemetry-related ports are enabled in gateway - but will only redirect if
-    # the gateway configuration for the various components are enabled.
-    - port: 15030
-      targetPort: 15030
-      name: http2-prometheus
-    - port: 15031
-      targetPort: 15031
-      name: http2-grafana
-    - port: 15032
-      targetPort: 15032
-      name: http2-tracing
-    secretVolumes:
-    - name: customgateway-certs
-      secretName: istio-customgateway-certs
-      mountPath: /etc/istio/customgateway-certs
-    - name: customgateway-ca-certs
-      secretName: istio-customgateway-ca-certs
-      mountPath: /etc/istio/customgateway-ca-certs
-
-# all other components are disabled except the gateways
-security:
-  enabled: false
-
-sidecarInjectorWebhook:
-  enabled: false
-
-galley:
-  enabled: false
-
-mixer:
-  policy:
-    enabled: false
-  telemetry:
-    enabled: false
-
-pilot:
-  enabled: false
-
-grafana:
-  enabled: false
-
-prometheus:
-  enabled: false
-
-servicegraph:
-  enabled: false
-
-tracing:
-  enabled: false
-
-kiali:
-  enabled: false
-
-certmanager:
-  enabled: false

charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-googleca.yaml

-global:
-  controlPlaneSecurityEnabled: false
-
-  mtls:
-    # Default setting for service-to-service mtls. Can be set explicitly using
-    # destination rules or service annotations.
-    enabled: true
-
-  sds:
-    enabled: true
-    udsPath: "unix:/var/run/sds/uds_path"
-    useTrustworthyJwt: true 
-
-  trustDomain: ""
-
-nodeagent:
-  enabled: true
-  image: node-agent-k8s
-  env:
-    CA_PROVIDER: "GoogleCA"
-    CA_ADDR: "istioca.googleapis.com:443"
-    Plugins: "GoogleTokenExchange"

charts/rancher-istio/1.1.5-rancher1/example-values/values-istio-multicluster-gateways.yaml

-global:
-  # Provides dns resolution for global services
-  podDNSSearchNamespaces:
-  - global
-  - "[[ valueOrDefault .DeploymentMeta.Namespace \"default\" ]].global"
-
-  multiCluster:
-    enabled: true
-
-  controlPlaneSecurityEnabled: true
-
-# Multicluster with gateways requires a root CA
-# Cluster local CAs are bootstrapped with the root CA.
-security:
-  selfSigned: false
-
-# Provides dns resolution for service entries of form
-# name.namespace.global
-istiocoredns:
-  enabled: true
-
-gateways:
-  istio-egressgateway:
-    enabled: true
-    env:
-      # Needed to route traffic via egress gateway if desired.
-      ISTIO_META_REQUESTED_NETWORK_VIEW: "external"

charts/rancher-istio/1.1.5-rancher1/requirements.yaml

@@ -23,9 +23,6 @@ dependencies:
   - name: prometheus
     version: 1.1.0
     condition: prometheus.enabled
-  - name: servicegraph
-    version: 1.1.0
-    condition: servicegraph.enabled
   - name: tracing
     version: 1.1.0
     condition: tracing.enabled

charts/rancher-istio/1.1.5-rancher1/templates/_affinity.tpl

@@ -11,6 +11,10 @@
 {{- define "nodeAffinityRequiredDuringScheduling" }}
       nodeSelectorTerms:
       - matchExpressions:
+        - key: beta.kubernetes.io/os
+          operator: In
+          values:
+          - linux
         - key: beta.kubernetes.io/arch
           operator: In
           values:

charts/rancher-istio/1.1.5-rancher1/templates/_helpers.tpl

@@ -44,3 +44,12 @@ Configmap checksum.
 {{- define "istio.configmap.checksum" -}}
 {{- print $.Template.BasePath "/configmap.yaml" | sha256sum -}}
 {{- end -}}
+
+
+{{- define "system_default_registry" -}}
+{{- if .Values.global.systemDefaultRegistry -}}
+{{- printf "%s/" .Values.global.systemDefaultRegistry -}}
+{{- else -}}
+{{- "" -}}
+{{- end -}}
+{{- end -}}

charts/rancher-istio/1.1.5-rancher1/templates/crd-certmanager.yaml

+{{- if and .Values.enableCRDs .Values.certmanager.enabled }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterissuers.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": "crd-install"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: ClusterIssuer
+    plural: clusterissuers
+  scope: Cluster
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: issuers.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": "crd-install"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: Issuer
+    plural: issuers
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": "crd-install"
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.conditions[?(@.type=="Ready")].status
+      name: Ready
+      type: string
+    - JSONPath: .spec.secretName
+      name: Secret
+      type: string
+    - JSONPath: .spec.issuerRef.name
+      name: Issuer
+      type: string
+      priority: 1
+    - JSONPath: .status.conditions[?(@.type=="Ready")].message
+      name: Status
+      type: string
+      priority: 1
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  version: v1alpha1
+  scope: Namespaced
+  names:
+    kind: Certificate
+    plural: certificates
+    shortNames:
+      - cert
+      - certs
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: orders.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": "crd-install"
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.state
+      name: State
+      type: string
+    - JSONPath: .spec.issuerRef.name
+      name: Issuer
+      type: string
+      priority: 1
+    - JSONPath: .status.reason
+      name: Reason
+      type: string
+      priority: 1
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: Order
+    plural: orders
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: challenges.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": "crd-install"
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.state
+      name: State
+      type: string
+    - JSONPath: .spec.dnsName
+      name: Domain
+      type: string
+    - JSONPath: .status.reason
+      name: Reason
+      type: string
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: Challenge
+    plural: challenges
+  scope: Namespaced
+{{- end }}

charts/rancher-istio/1.1.5-rancher1/templates/sidecar-injector-configmap.yaml

@@ -20,11 +20,7 @@ data:
       {{ "[[ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) \"NONE\" ]]" }}
 {{- if not .Values.istio_cni.enabled }}
       - name: istio-init
-{{- if contains "/" .Values.global.proxy_init.image }}
-        image: "{{ .Values.global.proxy_init.image }}"
-{{- else }}
-        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
-{{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
         args:
         - "-p"
         - {{ "[[ .MeshConfig.ProxyListenPort ]]" }}
@@ -71,11 +67,7 @@ data:
         - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
         command:
           - /bin/sh
-  {{- if contains "/" .Values.global.proxy_init.image }}
-        image: "{{ .Values.global.proxy_init.image }}"
-  {{- else }}
-        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
-  {{- end }}
+        image: "{{ template "system_default_registry" . }}{{ $.Values.global.proxy_init.repository }}:{{ $.Values.global.proxy_init.tag }}"
         imagePullPolicy: IfNotPresent
         resources: {}
         securityContext:
@@ -86,11 +78,7 @@ data:
 {{- end }}
       containers:
       - name: istio-proxy
-{{- if contains "/" .Values.global.proxy.image }}
-        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.proxy.image }}" {{ " ]]" }}
-{{- else }}
-        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}" {{ " ]]" }}
-{{- end }}
+        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ template "system_default_registry" . }}{{ $.Values.global.proxy.repository }}:{{ $.Values.global.proxy.tag }}" {{ " ]]" }}
         ports:
         - containerPort: 15090
           protocol: TCP
@@ -131,9 +119,6 @@ data:
         - --datadogAgentAddress
         - {{ "[[ .ProxyConfig.GetTracing.GetDatadog.GetAddress ]]" }}
       {{- end }}
-      {{- if $.Values.global.proxy.logLevel }}
-        - --proxyLogLevel={{ .Values.global.proxy.logLevel }}
-      {{- end}}
         - --connectTimeout
         - {{ "[[ formatDuration .ProxyConfig.ConnectTimeout ]]" }}
       {{- if .Values.global.proxy.envoyStatsd.enabled }}