values.yaml

#
# Gateways Configuration
# By default (if enabled) a pair of Ingress and Egress Gateways will be created for the mesh.
# You can add more gateways in addition to the defaults but make sure those are uniquely named
# and that NodePorts are not conflicting.
# Disable specifc gateway by setting the `enabled` to false.
#
enabled: true

istio-ingressgateway:
  enabled: true
  #
  # Secret Discovery Service (SDS) configuration for ingress gateway.
  #
  sds:
    # If true, ingress gateway fetches credentials from SDS server to handle TLS connections.
    enabled: false
    # SDS server that watches kubernetes secrets and provisions credentials to ingress gateway.
    # This server runs in the same pod as ingress gateway.
    image: node-agent-k8s
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 2000m
        memory: 1024Mi

  labels:
    app: istio-ingressgateway
    istio: ingressgateway
  autoscaleEnabled: true
  autoscaleMin: 1
  autoscaleMax: 5
  # specify replicaCount when autoscaleEnabled: false
  # replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 2000m
      memory: 1024Mi
  cpu:
    targetAverageUtilization: 80
  loadBalancerIP: ""
  loadBalancerSourceRanges: []
  externalIPs: []
  serviceAnnotations: {}
  podAnnotations: {}
  type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be
  #externalTrafficPolicy: Local #change to Local to preserve source IP or Cluster for default behaviour or leave commented out
  ports:
    ## You can add custom gateway ports
    # Note that AWS ELB will by default perform health checks on the first port
    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
  - port: 15020
    targetPort: 15020
    name: status-port
  - port: 80
    targetPort: 80
    name: http2
    nodePort: 31380
  - port: 443
    name: https
    nodePort: 31390
  # Example of a port to add. Remove if not needed
  - port: 31400
    name: tcp
    nodePort: 31400
  ### PORTS FOR UI/metrics #####
  ## Disable if not needed
  - port: 15029
    targetPort: 15029
    name: https-kiali
  - port: 15030
    targetPort: 15030
    name: https-prometheus
  - port: 15031
    targetPort: 15031
    name: https-grafana
  - port: 15032
    targetPort: 15032
    name: https-tracing
    # This is the port where sni routing happens
  - port: 15443
    targetPort: 15443
    name: tls
  #### MESH EXPANSION PORTS  ########
  # Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
  # to pilot/citadel if global.meshExpansion settings are enabled.
  # Delete these ports if mesh expansion is not enabled, to avoid
  # exposing unnecessary ports on the web.
  # You can remove these ports if you are not using mesh expansion
  meshExpansionPorts:
  - port: 15011
    targetPort: 15011
    name: tcp-pilot-grpc-tls
  - port: 15004
    targetPort: 15004
    name: tcp-mixer-grpc-tls
  - port: 8060
    targetPort: 8060
    name: tcp-citadel-grpc-tls
  - port: 853
    targetPort: 853
    name: tcp-dns-tls
  ####### end MESH EXPANSION PORTS ######
  ##############
  secretVolumes:
  - name: ingressgateway-certs
    secretName: istio-ingressgateway-certs
    mountPath: /etc/istio/ingressgateway-certs
  - name: ingressgateway-ca-certs
    secretName: istio-ingressgateway-ca-certs
    mountPath: /etc/istio/ingressgateway-ca-certs
  ### Advanced options ############

  # Ports to explicitly check for readiness. If configured, the readiness check will expect a
  # listener on these ports. A comma separated list is expected, such as "80,443".
  #
  # Warning: If you do not have a gateway configured for the ports provided, this check will always
  # fail. This is intended for use cases where you always expect to have a listener on the port,
  # such as 80 or 443 in typical setups.
  applicationPorts: ""

  env:
    # A gateway with this mode ensures that pilot generates an additional
    # set of clusters for internal services but without Istio mTLS, to
    # enable cross cluster routing.
    ISTIO_META_ROUTER_MODE: "sni-dnat"
  nodeSelector: {}
  tolerations: []

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

istio-egressgateway:
  enabled: false
  labels:
    app: istio-egressgateway
    istio: egressgateway
  autoscaleEnabled: true
  autoscaleMin: 1
  autoscaleMax: 5
  # specify replicaCount when autoscaleEnabled: false
  # replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 2000m
      memory: 1024Mi
  cpu:
    targetAverageUtilization: 80
  serviceAnnotations: {}
  podAnnotations: {}
  type: ClusterIP #change to NodePort or LoadBalancer if need be
  ports:
  - port: 80
    name: http2
  - port: 443
    name: https
    # This is the port where sni routing happens
  - port: 15443
    targetPort: 15443
    name: tls
  secretVolumes:
  - name: egressgateway-certs
    secretName: istio-egressgateway-certs
    mountPath: /etc/istio/egressgateway-certs
  - name: egressgateway-ca-certs
    secretName: istio-egressgateway-ca-certs
    mountPath: /etc/istio/egressgateway-ca-certs
  #### Advanced options ########
  env:
    # Set this to "external" if and only if you want the egress gateway to
    # act as a transparent SNI gateway that routes mTLS/TLS traffic to
    # external services defined using service entries, where the service
    # entry has resolution set to DNS, has one or more endpoints with
    # network field set to "external". By default its set to "" so that
    # the egress gateway sees the same set of endpoints as the sidecars
    # preserving backward compatibility
    # ISTIO_META_REQUESTED_NETWORK_VIEW: ""
    # A gateway with this mode ensures that pilot generates an additional
    # set of clusters for internal services but without Istio mTLS, to
    # enable cross cluster routing.
    ISTIO_META_ROUTER_MODE: "sni-dnat"
  nodeSelector: {}
  tolerations: []
  
  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

# Mesh ILB gateway creates a gateway of type InternalLoadBalancer,
# for mesh expansion. It exposes the mtls ports for Pilot,CA as well
# as non-mtls ports to support upgrades and gradual transition.
istio-ilbgateway:
  enabled: false
  labels:
    app: istio-ilbgateway
    istio: ilbgateway
  autoscaleEnabled: true
  autoscaleMin: 1
  autoscaleMax: 5
  # specify replicaCount when autoscaleEnabled: false
  # replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  cpu:
    targetAverageUtilization: 80
  resources:
    requests:
      cpu: 800m
      memory: 512Mi
    #limits:
    #  cpu: 1800m
    #  memory: 256Mi
  loadBalancerIP: ""
  serviceAnnotations:
    cloud.google.com/load-balancer-type: "internal"
  podAnnotations: {}
  type: LoadBalancer
  ports:
  ## You can add custom gateway ports - google ILB default quota is 5 ports,
  - port: 15011
    name: grpc-pilot-mtls
  # Insecure port - only for migration from 0.8. Will be removed in 1.1
  - port: 15010
    name: grpc-pilot
  - port: 8060
    targetPort: 8060
    name: tcp-citadel-grpc-tls
  # Port 5353 is forwarded to kube-dns
  - port: 5353
    name: tcp-dns
  secretVolumes:
  - name: ilbgateway-certs
    secretName: istio-ilbgateway-certs
    mountPath: /etc/istio/ilbgateway-certs
  - name: ilbgateway-ca-certs
    secretName: istio-ilbgateway-ca-certs
    mountPath: /etc/istio/ilbgateway-ca-certs
  nodeSelector: {}
  tolerations: []