--- # Source: linkerd-control-plane/templates/destination-rbac.yaml kind: ServiceAccount apiVersion: v1 metadata: name: linkerd-destination namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd --- # Source: linkerd-control-plane/templates/heartbeat-rbac.yaml kind: ServiceAccount apiVersion: v1 metadata: name: linkerd-heartbeat namespace: linkerd labels: linkerd.io/control-plane-component: heartbeat linkerd.io/control-plane-ns: linkerd --- # Source: linkerd-control-plane/templates/identity-rbac.yaml kind: ServiceAccount apiVersion: v1 metadata: name: linkerd-identity namespace: linkerd labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd --- # Source: linkerd-control-plane/templates/proxy-injector-rbac.yaml kind: ServiceAccount apiVersion: v1 metadata: name: linkerd-proxy-injector namespace: linkerd labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd --- # Source: linkerd-control-plane/templates/destination-rbac.yaml kind: Secret apiVersion: v1 metadata: name: linkerd-sp-validator-k8s-tls namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 type: kubernetes.io/tls data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURURENDQWpTZ0F3SUJBZ0lRSGpQNzgxWFVuNzJTZHEwd3QwZ3RWekFOQmdrcWhraUc5dzBCQVFzRkFEQXIKTVNrd0p3WURWUVFERXlCc2FXNXJaWEprTFhOd0xYWmhiR2xrWVhSdmNpNXNhVzVyWlhKa0xuTjJZekFlRncweQpOakF6TVRReU1URXpORGRhRncweU56QXpNVFF5TVRFek5EZGFNQ3N4S1RBbkJnTlZCQU1USUd4cGJtdGxjbVF0CmMzQXRkbUZzYVdSaGRHOXlMbXhwYm10bGNtUXVjM1pqTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEEKTUlJQkNnS0NBUUVBc1ozNmh5Uit0djl2YW9jOVpSZVR4Um5PdU5VZHcvMjdRTUdNWDdjdnpsSjYvNWZsdjU1RgpqUU5Pc1B3bm5SMFY2NzFaTGF4R1ZBTnFTVDlsOWNqU1JIQWNOWmhkdlBsU0l2djBvVjlJbFVrcnQ5R0VHbHQzClcySEM3MXFac3l1ZnpkOWoxSzlNK2x2R3A5NjVVSStJaSttZUNnRlE1Q2FwMWpkdDBDRk1DdWFiS2tieXFDWU4Kbit4QVZlNll1U09XeXVvMFBRVnczNDRoaXNLS3k1YlFYVHFqN2F1YTIzOVJqT202UitPdzkvakJHU3k3M2xlYQp0UlhBK2lUQjRUY0FFZTIvMFdtUnVveHFYWVBNQU1aUFJaYzVkWDRqMDNQY1p2NWwvTFVkcVVrYmRRUkpicHBECmNhRzlKOWJWR2RGUVlaL0hyQUMrTkUzcW1yRmRwc09UTXdJREFRQUJvMnd3YWpBT0JnTlZIUThCQWY4RUJBTUMKQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBdwpLd1lEVlIwUkJDUXdJb0lnYkdsdWEyVnlaQzF6Y0MxMllXeHBaR0YwYjNJdWJHbHVhMlZ5WkM1emRtTXdEUVlKCktvWklodmNOQVFFTEJRQURnZ0VCQUZRWkEwVlZxS29WNEpIVklaNjltR3VwcVAxdlpsam9JUkFTRXkzNHdqT0IKaFNuVlMzQW9DTVljRjJ1UVIzNEkvaFVBUmQxWXA1RmNzck1CSmNXWTZlcjRIcTA4aDloeEdCeDBHaEFhRUlsSAovRmthMHJlWXZGTWZMSWtkMDdrSzJvQmJBRTVDTUgrMkF5WVRndGdDcnZpNVlWQ0dDOVAzcEd2SGM2aG9Kcm1FCjMrS2JWcXlicmhkQ3NxMW9YSTh2V3pGZm53WllBaVhaS2VjNEpWMFRUa1BpY2t5cmFxblNQQTdLdHBTc2RUL2sKZmdwQTVTTEJXY1czVW1yWnFpSnhqbjR4a2lzWS9jMDZHQ1BRZDk5R284MzdnY0JIK3pBbDBmU3I5UjVLNlZueApZb2dDNndudzlnZDRQanU0N2JINmM5ZTZldlJ5SlBjU251YUpqR1h4SzZVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBc1ozNmh5Uit0djl2YW9jOVpSZVR4Um5PdU5VZHcvMjdRTUdNWDdjdnpsSjYvNWZsCnY1NUZqUU5Pc1B3bm5SMFY2NzFaTGF4R1ZBTnFTVDlsOWNqU1JIQWNOWmhkdlBsU0l2djBvVjlJbFVrcnQ5R0UKR2x0M1cySEM3MXFac3l1ZnpkOWoxSzlNK2x2R3A5NjVVSStJaSttZUNnRlE1Q2FwMWpkdDBDRk1DdWFiS2tieQpxQ1lObit4QVZlNll1U09XeXVvMFBRVnczNDRoaXNLS3k1YlFYVHFqN2F1YTIzOVJqT202UitPdzkvakJHU3k3CjNsZWF0UlhBK2lUQjRUY0FFZTIvMFdtUnVveHFYWVBNQU1aUFJaYzVkWDRqMDNQY1p2NWwvTFVkcVVrYmRRUkoKYnBwRGNhRzlKOWJWR2RGUVlaL0hyQUMrTkUzcW1yRmRwc09UTXdJREFRQUJBb0lCQUZHSEZESG9ISW5mSWNNaQpKSm84Z2tXY25QaldTZjFtZ0FjdlVFRzNFaWlBVDVqMm5peWdkNGhNbGxoQ3hlUW1MNk92bkRtTXRCTm9KZWROClJIM1hHanp6d044USt5WDh3eWp2d2RBNHJsWm42YnRNWG5qQ3R6eW8yUk9JNExnUE5DRUpnd2RqRjlCclEvcFcKRDNYZERHNDhZNkJ3RGpOTFUvWFNKNE83Wk80ek85TWUvcEFWNHcweHRZRlNXV1R1a0tqRFROTjFPVm9XaXduagpCMksyZmVmRncxRmlxU2kzalNyYWRpQThudEgyQnp0N0NzcG9pVGtlMjJWYVk4T3lxd2ZRcFdESHhNTnBwM0VyCmgrODkzd0Q0YjNRemdQczBpVER2NDd5c0Jndk9rRGpISVRwenRzbjFxTG9mOGRreDVmQW5xNGlMeVpqTnA2UTcKTHFMOG0yRUNnWUVBeXYzNWl3aGo4Rjc0ejNrNlJUL3Z3S0JzQmZtQVJvVlUwaVFweFEzQmJIdmFlZzZKdTEzdgpmMU5ucDlieGZiZk91SDFVRzFvNW1ESEhtaHNRRHlOOWo2d0I0WFpFWWRqQ0hBZWp6M3NUcnVoUkxtc0poZDVPCjhaNVFmUXI3UHE0R0hUWkV5ZUVhU0VMOGZWRDV6WHBqT01WWGFLZ3p0c293ZkFSSjUrdm5vdmtDZ1lFQTMvK3YKZ3ZkYmJBdzdxeDBCKzU4ZnE5TlpuL3hrZnpRbWxCTEorOTRuNWdmNjZ5QW1Rbk50dzg0ZE9DYmlsVzlXT1l1KwpLSXUyeE0wQWQ2NW5zaWxqMzJIajdWSldDZXJCbmxLM3l0NHY2Tnp0OFhpZWFJOHltUk1kd3JaVDZndklkd0kyCmdNZ2dWWnp1cHNNUU1VdWdBSzhUaHJpVDM4VUNSL1BuNHZKZVJvc0NnWUFVVHpiUlowU0FmekFMcWdoZmQxY28KZ2FSdE1KcFo4K3NabjA2aWpZN0ZxTnFpRGFSUUg4VGZpMXU2bWpITkx6KzZpNmVIbVE1Y0lOYmtuMEtMRVRUMQowL0xZT1BuOGhEQmZsNUFYS1N3OStyWnNtMzczYXRlaEt3TElqL20xT3JvWDRCOGZ4NnJXZ2dVN0VJZjl1L29ECmF4TWt3SGQwR1dTaWM5ZGxJZUFxR1FLQmdCY2xZSWx6N2VwNFNTSWhXVGNhOWpiWEhBZkFHTkpjSFRCbjBKOUsKRVcxZm5ibjJGSDRCVjNKSU5oUzdUK2FKSHF2TG1OYXZ1UzhVejl1T0ZnRCs3ZWNEUW40ZloreVdhWE5tc0w4eAp2bG1kbXFpOUFnRmo2cUtPcXlDWG5vd3NzNFk0b0ZFbVhORDc2bDBwQXQ5VkpTOXM1K09mNXdmVVg2djN0QnByCldQcUpBb0dBVFg4QXROK0N2a2FMbWZJa3kweEttZzJ4b1FNSTBGQ2RTQ08vZkdZeEpYRG1zdTBqSmdhZ2RYTFkKaGxZa3RsSjBmYWxsbmt5c1lJZFlLemdJQkc4ZEJ3alVmWHNYUEtDNGJtTG56YXZVdTVCNlFDeHBWekp5d2dFcQptVHpPRUcyK2tzTGhCeWlLV2JIbGc1dGo0anJscFh3bXYwZk1IbHBtVUpTNFBWTHdqVTg9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t --- # Source: linkerd-control-plane/templates/destination-rbac.yaml kind: Secret apiVersion: v1 metadata: name: linkerd-policy-validator-k8s-tls namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 type: kubernetes.io/tls data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXRENDQWtDZ0F3SUJBZ0lRZXljOVNmUU1qd2Y3NjhxcUxBRjdkakFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlSc2FXNXJaWEprTFhCdmJHbGplUzEyWVd4cFpHRjBiM0l1YkdsdWEyVnlaQzV6ZG1NdwpIaGNOTWpZd016RTBNakV4TXpRM1doY05NamN3TXpFME1qRXhNelEzV2pBdk1TMHdLd1lEVlFRREV5UnNhVzVyClpYSmtMWEJ2YkdsamVTMTJZV3hwWkdGMGIzSXViR2x1YTJWeVpDNXpkbU13Z2dFaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURmY2lReHNKcXF0MnhVM1V2bDRvSmxmckJQdmJ3c05YNzlSSk44Q0MzNwpRM2l5UEJ1dHNPNkFERG9kcXNubThHQ3p2NFZpSFNKN2s2QjNIUG4wamZML0NLVTdlSm5MZ3U2dWc2aWYxWVRWCjczS3FiS2pvbWxzUVhyOHlWb1hNUVNGVFNSSkc2NkM0NWxidW5rTzFsWXFyZEUvcmY1N3YwTUdUL2RNTWxiZm0KeEZMSnNGV1VxSy9ZaFZBMVpUc2JiNk1UbkUzNko4VklFcmtzamlvcHRjNWlMSTVpSHYxVzVYN0tXUk82ZWZveApkYjFBQ012REQxUWJNYUtCMkptOGNhRlRwRGEycGQyMmVaUFhQRk5Pd2FHTkVjeG5OSmZ6TEpPQUYvZlVQamJTCkRpWGt5eEx4MDE0blZWb3djVzFDeVFRZ1lTTVEwSEgzMmJqL1F6aDB0cHJwQWdNQkFBR2pjREJ1TUE0R0ExVWQKRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdEQVlEVlIwVApBUUgvQkFJd0FEQXZCZ05WSFJFRUtEQW1naVJzYVc1clpYSmtMWEJ2YkdsamVTMTJZV3hwWkdGMGIzSXViR2x1CmEyVnlaQzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFLQksrQ0gyWjFubUgyOXNKUExlNzVucW5Jcm0KVTV2Vk5aQnUrNXl3UnQyRDQ5QWJ1aDFyaHB6Q0pMTWRoRThqcUp6Rkp6amNXZkFnZ2NzSUF0Wkt2R05YUWhPegpadHdsN0pWOWducVg0RHJ0OUFvbjR4cGJQdWlwWG8zUmVTczhldERXSy92RVROak1Nb1U5aCtsTEtNckFEa1pQCmFqVjROMUp1b1FLK0syYlVYUjlIRGhpMjAwbCsyYnVEVUp4d3RWbUVubVFmcFdVb1FUNkxJTzhYWVN3VXdvM2IKUyttSlZsNWgvMGphMXlwdW1rS0c4TDNqNU9GT2pybHIxYm5TOHFXMklrcDVYUGFOYmNJVEdYRTVUbmFYV0pDKwpPajBXZWpvZ3haWVdUVUxMTGcrSTB5QjE0cmNBeVdpQzYrb0o1dkc0dWVDRHdybmpUd0orYi9sdTRzQT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ== tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMzNJa01iQ2FxcmRzVk4xTDVlS0NaWDZ3VDcyOExEVisvVVNUZkFndCswTjRzandiCnJiRHVnQXc2SGFySjV2QmdzNytGWWgwaWU1T2dkeHo1OUkzeS93aWxPM2laeTRMdXJvT29uOVdFMWU5eXFteW8KNkpwYkVGNi9NbGFGekVFaFUwa1NSdXVndU9aVzdwNUR0WldLcTNSUDYzK2U3OURCay8zVERKVzM1c1JTeWJCVgpsS2l2MklWUU5XVTdHMitqRTV4TitpZkZTQks1TEk0cUtiWE9ZaXlPWWg3OVZ1Vit5bGtUdW5uNk1YVzlRQWpMCnd3OVVHekdpZ2RpWnZIR2hVNlEydHFYZHRubVQxenhUVHNHaGpSSE1aelNYOHl5VGdCZjMxRDQyMGc0bDVNc1MKOGROZUoxVmFNSEZ0UXNrRUlHRWpFTkJ4OTltNC8wTTRkTGFhNlFJREFRQUJBb0lCQUFoS2ZERFMwSDVlcFhpbApxSFFNZWxHcFNJSUE5SXRBWmVpZ1k0ZVI1eURnWVVsZHhSb21DMGQ1akt0K281UzczUjYyVDh6eTcwMWVEakYxClJBb1F2VkE4d2lMSmlBMWUyNXZpbXo1cEJnK0pIYnhZb1ZEV0wyUlZXNnRTdmc2MDZQZGw2ZlZ6TjBpOUZVTXYKNEt2TGMzU0dzWk4zcmc1UWRPcFltL3ptemtiVDlzaTdhSmR0dGpLWS9ieWtESHJvQjhWSTIwVGpYM2M1K0tiaQpoTFFSb0ZvS3Mxc0MvN0toUjRqRExFeXdTaHF3MXRHRE1USkxzb1BxWmhpMFZabmtVenI5bkNVanByTlkraWl6CmJQNzVVU1gvTWdFd0xKdzZIdjJQOTkzcTYwY2NYdk5Mc0ZmNXQrbVJ6RG1OcU5Od2tPSTRpY1NjNHluOHJTOTYKVGMvbEdLRUNnWUVBNUVNN3ZQQVhkMDhIdWVFUHExV2YzbWdnWlZmaWJneEdDTWZ5dkljZFcwOFNyV2dJREpjNApXMkVSNVQ2dmZhK1JCaXNja1BxY3dJT05LYlJHNTFDU3J1Z3ZVdzVZOUlUNmJQYnZZSGZKTVZZWFhHaWhpRkhoCk9ySHhtdkJuYUNodGc4N05JUW9CN09scWlpckpDR1RtRnJJNWNIenFIMmtmb050amlzak83RmtDZ1lFQStwa1IKbEEzalpuVGp2eWx1YTN2MTlzeTh1YndnZ3A5UkFVSXc0YmVDbzh4N3FhK0xiaXRMaURUb281YlBpUFZIbDhDRQpxN0RNWlNlV1hTaGdEZTdySHBvQkp3OGw4emlJQlQrcmZYOEI1bTVEZUp6alA1ZStJQkhScldrSWdKbExXdEwvCkt0Q3RlZzM0R1VnNnZOQU41ZGpBMGRyQ1VPTHBCMEQwOElhZkVSRUNnWUJ6Y3huMHpzNWZsc1pHbW5GdGJBcEcKMkEyQ2xIZSt4MUJvd3BDZ0VBcW1FeEZVU1dqQXpYOUFvSkVIakxQLzh0dDc3alF0azhQU2p2Ykg0Qmw0aDBVWgpWL0FQcHhNUTRXMHp6WlYzQ2o3bFNERGFtVVVTQ0svTkd4RWpGM0tGdU9UakpLYVZqbFU0K1RuY2xoVkZ2SnF2CllnY3hRTXk5aEZMdDdlaWoyanJtU1FLQmdHYkRmSFRsV1JvNzF1VWVYVnlRWWVZS1FWNDlLbXZHWDFhUHlUSFcKcWlqM2dzS3I3UmFKaEpqZmNZTWNKaEQ0M0puN1pheHVmUE1DVCtQMTJhWDlFc2ZpeVpRMTN3OGxZSW9lZVBtbQpxcVhQRTdZVFNCRmM3YWVEQnlRQWpXOEc3ZUxaNGEreUVXR2E5dUdQUUI4TGhwZDUwbUI4UC9FaGpBUGdmRkZpCk16cXhBb0dCQUpaVkdwYzAxNmxtcnoxNllMMmkvWW9ORWFBL3R2dWxqUW9hbEpET3hkbzFBdDljeUJhSVZLSFAKTGVZbGZTZ2FvV1k1cG94UjJVK3YrN09kSWFNMkxQRURkbEhoUFhGeTVIcTAyQzIyQUxCRXBObEg0bUU4cFZUOQpyYkhiTER6QXZoUjRxWkR2bHBibXhXbFRaMnhrVDQwSm5vZmlyRmZ2aDRUT2ozZS9KMTVrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t --- # Source: linkerd-control-plane/templates/proxy-injector-rbac.yaml kind: Secret apiVersion: v1 metadata: name: linkerd-proxy-injector-k8s-tls namespace: linkerd labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 type: kubernetes.io/tls data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWp1Z0F3SUJBZ0lSQVBRR2NSMGdreEhDWlZuQ3p0ZFl2SnN3RFFZSktvWklodmNOQVFFTEJRQXcKTFRFck1Da0dBMVVFQXhNaWJHbHVhMlZ5WkMxd2NtOTRlUzFwYm1wbFkzUnZjaTVzYVc1clpYSmtMbk4yWXpBZQpGdzB5TmpBek1UUXlNVEV6TkRaYUZ3MHlOekF6TVRReU1URXpORFphTUMweEt6QXBCZ05WQkFNVElteHBibXRsCmNtUXRjSEp2ZUhrdGFXNXFaV04wYjNJdWJHbHVhMlZ5WkM1emRtTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUEKQTRJQkR3QXdnZ0VLQW9JQkFRQ1dOVHNnVmlqeUNrZ29tNkxIWFB4bmRTZVhiTlRQY0pKVHh2NFZsMlNYQXBjOApJeGNQUHozemNqZlpwU0NKdjA3alp0UGR4QXhEd0VPbTVaWXRSUUZzZXpsOUNNNUVHRmdvL0xQQWlXOUZ2VW9HCkt3Rm5sUDhiWmZlcWl3N0hZQktJQ2N2UTQxdEdKcmxrZVI2VWdkYWRwcHNxMW9yRFlUQ1lPaTh2c2dNc2Z3US8KTTRFM3U2RUVBTW5sTGxOZ1VCNW9IdlBtK281MHlib2FaSVBJb2FKZGpuMW9XMjZoay8zN1phMlhpazRiMWxJNApUeXEzMDk0SUZPNndiTEJxQXk2ZVNURlFEZG9iVEJkSi9raVI2WDVsVC80WHBSa3BjYm04YU1wbUdTN3VrQ09qCkZka0tuWmpTZVA0Q0o2SFB2bjNzanpDNTZRcXVzYUZtTGIxbVk2dUxBZ01CQUFHamJqQnNNQTRHQTFVZER3RUIKL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFILwpCQUl3QURBdEJnTlZIUkVFSmpBa2dpSnNhVzVyWlhKa0xYQnliM2g1TFdsdWFtVmpkRzl5TG14cGJtdGxjbVF1CmMzWmpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNMOUF5SUFtbUlua3JTYUdHdEVCMDdYRi9aL1h5R056T1YKcjgwak0wc2F4RDcyTUtSbTJYb2l0YlVFMW9XUHVxVGdxVlVFemdjZVpFbW53b082MEYyaVRvSEZrSTNvbTFrMgpZcVdhQVNMTTRHd09HeXVKRnQ4WFZncHBCdW9oWWl4MThBOU11dFlLVkdYS0JiY0RaOVFKcENyOGN3a2s0dlQ5CkQ5MnNxd2VhUHF3WWdJeHdqbkpKNEJ3bDhVZnFzMHhHdXdXYVZzdVNhTGhiWGJDWjZjdG1nNkN4RFhQOG1EcWkKZytBQkoxQjhJR1N5SS9tUWo5Rk9OaEV3MWNtQVdEcmJ5anlDV0FSZXhoMkQ3dVFCZHJxRm0vWlVEVlZpREJUeApOcVVlYmdpeDBKbkxTVnRzQUlDWFBseFFtQ1l6VE53bHRZcHVUc2dpdm1TRi9LWlRxamlYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0= tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBbGpVN0lGWW84Z3BJS0p1aXgxejhaM1VubDJ6VXozQ1NVOGIrRlpka2x3S1hQQ01YCkR6ODk4M0kzMmFVZ2liOU80MmJUM2NRTVE4QkRwdVdXTFVVQmJIczVmUWpPUkJoWUtQeXp3SWx2UmIxS0Jpc0IKWjVUL0cyWDNxb3NPeDJBU2lBbkwwT05iUmlhNVpIa2VsSUhXbmFhYkt0YUt3MkV3bURvdkw3SURMSDhFUHpPQgpON3VoQkFESjVTNVRZRkFlYUI3ejV2cU9kTW02R21TRHlLR2lYWTU5YUZ0dW9aUDkrMld0bDRwT0c5WlNPRThxCnQ5UGVDQlR1c0d5d2FnTXVua2t4VUEzYUcwd1hTZjVJa2VsK1pVLytGNlVaS1hHNXZHaktaaGt1N3BBam94WFoKQ3AyWTBuaitBaWVoejc1OTdJOHd1ZWtLcnJHaFppMjlabU9yaXdJREFRQUJBb0lCQUF0R2g2eUM4YVBwc09BeAo1UmFudGtYOFNwanlLdUtsN0VMZ0dtYXU3S202N1VISWFJeTdRV2JlSmhXSTExZ01rbHNLRUo0MWYwZkxnUHZHCnREdXNIdElLU1RCNjBmRUlRVEs4RHhjU0lHL1E5V09UaXQ1QUZqNWFSbC80L0ZOcjZBVUQybkNFTTlZNlJmRS8KcXlCbEtlNi9yQ2NCMytNcDljQksxRDhvdVZhcTFtUnRscCtLRmsyd2k1MW4rM0gyOE1PWXdrdnMyWGg0TVRObAp2OUdJQk50UjZzVUhaMkNtSXU0d1JBU2lFaEk4MEREbmRaSThwK2ZiT3UrSEJ3V2NNcCtkandOeFhpQldpY1VpClU1VjFjSitHdjJXUzExRXBma0ZPRmZONUpGazc0R3laaHRlTEdXNjlBQkszbkdzdUhXdlhpdDdYbmx4YUJwQXAKdTZDYysyRUNnWUVBeGdXOWpDQ1NPZ3lQZTR0SkxlbXNubjMxb3pxa1FUVVJCRUsrVnpya1oyZWwzOVgydkZFMgo3RlV1eWZPTWNwd0VBQ013dnc2blRUZjFYcklxUGVPS2ZqUnBTOHMwKzFaNlI3S09BVTBELzlKZC9DanQ3aEhECmkyZXl6L2V6SUVmM1YrMlBINlVIc2l0Q0NCay92TjVtckRzRW91TW1kdWdqRUZNak8zbjBOMmtDZ1lFQXdpK3QKeWtkRTZCZCtwSkZ6SHVqWmhIeWVIS25NNzNPaFQ1bmlVK09tWUZ0OFdvVWxhMlUrdzRrZG5BTVc0YlQxQkdxdgplV29TcWk0bGlXV3JQZG9LbTl1K0NqbS9xa29hYUM0c2NwTXJQWCtrSjNjcUQ0M3k4UUxKaW9pVzBJVW9IMnY5CmtFWVRQT3J4cXZpRE1qVVdnMDYvQXZ3ZUtXbitvSWVtZ1BnS0FOTUNnWUVBbkZ2RUEzVmtnUG1TQWhkRlBUK1oKMGJ2YnpYdHNYeUNyd3hXQWZoZythWGZwL2doUXZ2blJ5R0txZzBRUHpoOXErVURRS014RlJpKzlTM3lhNWl0WgpHN1grdnA1Qnc0UFJJZlBYTlNlKzFLMGpFUXl3Y3A4TUxITkJPZjE0THpFa0dRVzNVV0ZaNWxGSjNtTXhkTXlYCmZiOU1OZUh1YVUxN0FsVGpLUDl1MnFFQ2dZQjQ3cFIrdXEreEVxQ3VBRjcvU3VmYjJIZm5SZC80NTd2NEJNK3MKaXNPY2twejVDcDVwS1o1U3k5dUN3M0hHa3BsY2JNeG5BcVlwRWFBUzF4d3o0c3hra0E3ajgxN253RXA5d3ZPdgpUdlBJMHVyNklQNHl2YVlrYmlYeGZtcmQ1Vzg5VWxXUk9mTFZKMFBsdytxQXBBc25MeTFKd0pWUUdWQ1h6S0xuCkFwSElQUUtCZ0VET1Y1NTV1cktlZkp3dGtaRGJ2Y0lGR0JXbTlTVW5OTnRjdXhPSTZVdVVRQmxjTkxLRFBzTmYKN1VFTjh6d2JRUU45N1NleENScmtSUDA5dGpwVXhraDYzNUtHbnd5V2xMTFVJSW5BcU9KNG95NnlDdTliQ3dsdwpmdUxKaUplSVVDcEFRUTYxY0dsMzVNSWdzMXFiYWtMYUtmRVpPNEo0WEh5Ymk3MVVBUEt0Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t --- # Source: linkerd-control-plane/templates/config.yaml kind: ConfigMap apiVersion: v1 metadata: name: linkerd-config namespace: linkerd labels: linkerd.io/control-plane-component: controller linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 data: linkerd-crds-chart-version: linkerd-crds-1.0.0-edge values: | clusterDomain: cluster.local clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 cniEnabled: false commonLabels: {} controlPlaneTracing: false controlPlaneTracingNamespace: linkerd-jaeger controllerImage: cr.l5d.io/linkerd/controller controllerImageVersion: "" controllerLogFormat: plain controllerLogLevel: info controllerReplicas: 1 controllerUID: 2103 debugContainer: image: name: cr.l5d.io/linkerd/debug pullPolicy: "" version: "" deploymentStrategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% disableHeartBeat: false enableEndpointSlices: true enableH2Upgrade: true enablePSP: false enablePodAntiAffinity: false enablePodDisruptionBudget: false enablePprof: false identity: externalCA: false issuer: clockSkewAllowance: 20s issuanceLifetime: 24h0m0s scheme: kubernetes.io/tls tls: crtPEM: | -----BEGIN CERTIFICATE----- MIIBtjCCAVygAwIBAgIUdd/8fSGsrGBI7FrbZ1lA+jS489UwCgYIKoZIzj0EAwIw JTEjMCEGA1UEAwwacm9vdC5saW5rZXJkLmNsdXN0ZXIubG9jYWwwHhcNMjYwMzEz MjMwNTI2WhcNMjcwMzEzMjMwNTI2WjApMScwJQYDVQQDDB5pZGVudGl0eS5saW5r ZXJkLmNsdXN0ZXIubG9jYWwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQHU88u R1qhnrxcDySFKz4BqLYs/fjGwvD77PqxLp37K23lzbM5UpXVB06cnCB03plrbxg3 VzM4Y3CTU/OgCN0/o2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQE AwIBhjAdBgNVHQ4EFgQUc3Y9kn7kJpEqFvXxFtE302o289AwHwYDVR0jBBgwFoAU 1uwi63bm3tlO4ajCwZC2lUyfn+EwCgYIKoZIzj0EAwIDSAAwRQIhAPjSBYscyTfN 99dm/or5OxYSPIS6WbaySvHrfar+9ReCAiAMkdZ8P5IrGUERW2kKhzU6jWsPfFbw ddI8y/PwVTDuRw== -----END CERTIFICATE----- kubeAPI: clientBurst: 200 clientQPS: 100 serviceAccountTokenProjection: true identityTrustAnchorsPEM: | -----BEGIN CERTIFICATE----- MIIBnjCCAUWgAwIBAgIUS9ANIQmpVrY6qbpdl8Arg18p9RQwCgYIKoZIzj0EAwIw JTEjMCEGA1UEAwwacm9vdC5saW5rZXJkLmNsdXN0ZXIubG9jYWwwHhcNMjYwMzEz MjMwNDA3WhcNMzYwMzEwMjMwNDA3WjAlMSMwIQYDVQQDDBpyb290LmxpbmtlcmQu Y2x1c3Rlci5sb2NhbDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCnfBtfAlgkD LVSDBOuJWBv9D0kRT2p5uZMUGY24KdR9KSua7/sRGkdnsm8NBOjj1a41wSm8N8W9 NLV2QlPzMdmjUzBRMB0GA1UdDgQWBBTW7CLrdube2U7hqMLBkLaVTJ+f4TAfBgNV HSMEGDAWgBTW7CLrdube2U7hqMLBkLaVTJ+f4TAPBgNVHRMBAf8EBTADAQH/MAoG CCqGSM49BAMCA0cAMEQCICMroSX4r66e28v/rtycwBX4bvwzTe7QDuszGmkcIcEs AiABAkzRzbYpipt+fuGliHDYMsEZd1zPqTuLCK3xp2jjHg== -----END CERTIFICATE----- identityTrustDomain: cluster.local imagePullPolicy: IfNotPresent imagePullSecrets: [] kubeAPI: clientBurst: 200 clientQPS: 100 linkerdVersion: stable-2.14.10 networkValidator: connectAddr: 1.1.1.1:20001 enableSecurityContext: true listenAddr: 0.0.0.0:4140 logFormat: plain logLevel: debug timeout: 10s nodeSelector: kubernetes.io/os: linux podAnnotations: {} podLabels: {} podMonitor: controller: enabled: true namespaceSelector: | matchNames: - {{ .Release.Namespace }} - linkerd-viz - linkerd-jaeger enabled: false labels: {} proxy: enabled: true scrapeInterval: 10s scrapeTimeout: 10s serviceMirror: enabled: true policyController: image: name: cr.l5d.io/linkerd/policy-controller pullPolicy: "" version: "" logLevel: info probeNetworks: - 0.0.0.0/0 resources: cpu: limit: "" request: "" ephemeral-storage: limit: "" request: "" memory: limit: "" request: "" policyValidator: caBundle: "" crtPEM: "" externalSecret: false injectCaFrom: "" injectCaFromSecret: "" namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled priorityClassName: "" profileValidator: caBundle: "" crtPEM: "" externalSecret: false injectCaFrom: "" injectCaFromSecret: "" namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled prometheusUrl: "" proxy: await: true cores: 0 defaultInboundPolicy: all-unauthenticated disableInboundProtocolDetectTimeout: false disableOutboundProtocolDetectTimeout: false enableExternalProfiles: false image: name: cr.l5d.io/linkerd/proxy pullPolicy: "" version: "" inboundConnectTimeout: 100ms inboundDiscoveryCacheUnusedTimeout: 90s logFormat: plain logLevel: warn,linkerd=info,trust_dns=error opaquePorts: 25,587,3306,4444,5432,6379,9300,11211 outboundConnectTimeout: 1000ms outboundDiscoveryCacheUnusedTimeout: 5s ports: admin: 4191 control: 4190 inbound: 4143 outbound: 4140 requireIdentityOnInboundPorts: "" resources: cpu: limit: "" request: "" ephemeral-storage: limit: "" request: "" memory: limit: "" request: "" shutdownGracePeriod: "" uid: 2102 waitBeforeExitSeconds: 0 proxyInit: closeWaitTimeoutSecs: 0 ignoreInboundPorts: 4567,4568 ignoreOutboundPorts: 4567,4568 image: name: cr.l5d.io/linkerd/proxy-init pullPolicy: "" version: v2.2.3 iptablesMode: legacy kubeAPIServerPorts: 443,6443 logFormat: "" logLevel: "" privileged: false resources: cpu: limit: 100m request: 100m ephemeral-storage: limit: "" request: "" memory: limit: 20Mi request: 20Mi runAsRoot: false runAsUser: 65534 skipSubnets: "" xtMountPath: mountPath: /run name: linkerd-proxy-init-xtables-lock proxyInjector: caBundle: "" crtPEM: "" externalSecret: false injectCaFrom: "" injectCaFromSecret: "" namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled - key: kubernetes.io/metadata.name operator: NotIn values: - kube-system - cert-manager objectSelector: matchExpressions: - key: linkerd.io/control-plane-component operator: DoesNotExist - key: linkerd.io/cni-resource operator: DoesNotExist runtimeClassName: "" webhookFailurePolicy: Ignore --- # Source: linkerd-control-plane/templates/identity.yaml kind: ConfigMap apiVersion: v1 metadata: name: linkerd-identity-trust-roots namespace: linkerd labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 data: ca-bundle.crt: |- -----BEGIN CERTIFICATE----- MIIBnjCCAUWgAwIBAgIUS9ANIQmpVrY6qbpdl8Arg18p9RQwCgYIKoZIzj0EAwIw JTEjMCEGA1UEAwwacm9vdC5saW5rZXJkLmNsdXN0ZXIubG9jYWwwHhcNMjYwMzEz MjMwNDA3WhcNMzYwMzEwMjMwNDA3WjAlMSMwIQYDVQQDDBpyb290LmxpbmtlcmQu Y2x1c3Rlci5sb2NhbDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCnfBtfAlgkD LVSDBOuJWBv9D0kRT2p5uZMUGY24KdR9KSua7/sRGkdnsm8NBOjj1a41wSm8N8W9 NLV2QlPzMdmjUzBRMB0GA1UdDgQWBBTW7CLrdube2U7hqMLBkLaVTJ+f4TAfBgNV HSMEGDAWgBTW7CLrdube2U7hqMLBkLaVTJ+f4TAPBgNVHRMBAf8EBTADAQH/MAoG CCqGSM49BAMCA0cAMEQCICMroSX4r66e28v/rtycwBX4bvwzTe7QDuszGmkcIcEs AiABAkzRzbYpipt+fuGliHDYMsEZd1zPqTuLCK3xp2jjHg== -----END CERTIFICATE----- --- # Source: linkerd-control-plane/templates/destination-rbac.yaml ### ### Destination Controller Service ### kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-destination labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd rules: - apiGroups: ["apps"] resources: ["replicasets"] verbs: ["list", "get", "watch"] - apiGroups: ["batch"] resources: ["jobs"] verbs: ["list", "get", "watch"] - apiGroups: [""] resources: ["pods", "endpoints", "services", "nodes"] verbs: ["list", "get", "watch"] - apiGroups: ["linkerd.io"] resources: ["serviceprofiles"] verbs: ["list", "get", "watch"] - apiGroups: ["discovery.k8s.io"] resources: ["endpointslices"] verbs: ["list", "get", "watch"] --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: linkerd-policy labels: app.kubernetes.io/part-of: Linkerd linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd rules: - apiGroups: - "" resources: - pods verbs: - get - list - watch - apiGroups: - apps resources: - deployments verbs: - get - apiGroups: - policy.linkerd.io resources: - authorizationpolicies - httproutes - meshtlsauthentications - networkauthentications - servers - serverauthorizations verbs: - get - list - watch - apiGroups: - gateway.networking.k8s.io resources: - httproutes verbs: - get - list - watch - apiGroups: - policy.linkerd.io resources: - httproutes/status verbs: - patch - apiGroups: - gateway.networking.k8s.io resources: - httproutes/status verbs: - patch - apiGroups: - coordination.k8s.io resources: - leases verbs: - create - get - patch --- # Source: linkerd-control-plane/templates/heartbeat-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: linkerd-heartbeat labels: linkerd.io/control-plane-ns: linkerd rules: - apiGroups: [""] resources: ["namespaces"] verbs: ["list"] - apiGroups: ["linkerd.io"] resources: ["serviceprofiles"] verbs: ["list"] --- # Source: linkerd-control-plane/templates/identity-rbac.yaml ### ### Identity Controller Service RBAC ### kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-identity labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd rules: - apiGroups: ["authentication.k8s.io"] resources: ["tokenreviews"] verbs: ["create"] # TODO(ver) Restrict this to the Linkerd namespace. See # https://github.com/linkerd/linkerd2/issues/9367 - apiGroups: [""] resources: ["events"] verbs: ["create", "patch"] --- # Source: linkerd-control-plane/templates/proxy-injector-rbac.yaml ### ### Proxy Injector RBAC ### kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-proxy-injector labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "patch"] - apiGroups: [""] resources: ["namespaces", "replicationcontrollers"] verbs: ["list", "get", "watch"] - apiGroups: [""] resources: ["pods"] verbs: ["list", "watch"] - apiGroups: ["extensions", "apps"] resources: ["deployments", "replicasets", "daemonsets", "statefulsets"] verbs: ["list", "get", "watch"] - apiGroups: ["extensions", "batch"] resources: ["cronjobs", "jobs"] verbs: ["list", "get", "watch"] --- # Source: linkerd-control-plane/templates/destination-rbac.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-destination labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: linkerd-linkerd-destination subjects: - kind: ServiceAccount name: linkerd-destination namespace: linkerd --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: linkerd-destination-policy labels: app.kubernetes.io/part-of: Linkerd linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: linkerd-policy subjects: - kind: ServiceAccount name: linkerd-destination namespace: linkerd --- # Source: linkerd-control-plane/templates/heartbeat-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: linkerd-heartbeat labels: linkerd.io/control-plane-ns: linkerd roleRef: kind: ClusterRole name: linkerd-heartbeat apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: linkerd-heartbeat namespace: linkerd --- # Source: linkerd-control-plane/templates/identity-rbac.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-identity labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: linkerd-linkerd-identity subjects: - kind: ServiceAccount name: linkerd-identity namespace: linkerd --- # Source: linkerd-control-plane/templates/proxy-injector-rbac.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: linkerd-linkerd-proxy-injector labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd subjects: - kind: ServiceAccount name: linkerd-proxy-injector namespace: linkerd apiGroup: "" roleRef: kind: ClusterRole name: linkerd-linkerd-proxy-injector apiGroup: rbac.authorization.k8s.io --- # Source: linkerd-control-plane/templates/config-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 name: ext-namespace-metadata-linkerd-config namespace: linkerd rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] resourceNames: ["linkerd-config"] --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: remote-discovery namespace: linkerd labels: app.kubernetes.io/part-of: Linkerd linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd rules: - apiGroups: - "" resources: - secrets verbs: - get - list - watch --- # Source: linkerd-control-plane/templates/heartbeat-rbac.yaml ### ### Heartbeat RBAC ### apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: linkerd-heartbeat namespace: linkerd labels: linkerd.io/control-plane-ns: linkerd rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] resourceNames: ["linkerd-config"] --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: linkerd-destination-remote-discovery namespace: linkerd labels: app.kubernetes.io/part-of: Linkerd linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: remote-discovery subjects: - kind: ServiceAccount name: linkerd-destination namespace: linkerd --- # Source: linkerd-control-plane/templates/heartbeat-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: linkerd-heartbeat namespace: linkerd labels: linkerd.io/control-plane-ns: linkerd roleRef: kind: Role name: linkerd-heartbeat apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: linkerd-heartbeat namespace: linkerd --- # Source: linkerd-control-plane/templates/destination.yaml ### ### Destination Controller Service ### kind: Service apiVersion: v1 metadata: name: linkerd-dst namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: type: ClusterIP selector: linkerd.io/control-plane-component: destination ports: - name: grpc port: 8086 targetPort: 8086 --- # Source: linkerd-control-plane/templates/destination.yaml kind: Service apiVersion: v1 metadata: name: linkerd-dst-headless namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: clusterIP: None selector: linkerd.io/control-plane-component: destination ports: - name: grpc port: 8086 targetPort: 8086 --- # Source: linkerd-control-plane/templates/destination.yaml kind: Service apiVersion: v1 metadata: name: linkerd-sp-validator namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: type: ClusterIP selector: linkerd.io/control-plane-component: destination ports: - name: sp-validator port: 443 targetPort: sp-validator --- # Source: linkerd-control-plane/templates/destination.yaml kind: Service apiVersion: v1 metadata: name: linkerd-policy namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: clusterIP: None selector: linkerd.io/control-plane-component: destination ports: - name: grpc port: 8090 targetPort: 8090 --- # Source: linkerd-control-plane/templates/destination.yaml kind: Service apiVersion: v1 metadata: name: linkerd-policy-validator namespace: linkerd labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: type: ClusterIP selector: linkerd.io/control-plane-component: destination ports: - name: policy-https port: 443 targetPort: policy-https --- # Source: linkerd-control-plane/templates/identity.yaml kind: Service apiVersion: v1 metadata: name: linkerd-identity namespace: linkerd labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: type: ClusterIP selector: linkerd.io/control-plane-component: identity ports: - name: grpc port: 8080 targetPort: 8080 --- # Source: linkerd-control-plane/templates/identity.yaml kind: Service apiVersion: v1 metadata: name: linkerd-identity-headless namespace: linkerd labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: clusterIP: None selector: linkerd.io/control-plane-component: identity ports: - name: grpc port: 8080 targetPort: 8080 --- # Source: linkerd-control-plane/templates/proxy-injector.yaml kind: Service apiVersion: v1 metadata: name: linkerd-proxy-injector namespace: linkerd labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 config.linkerd.io/opaque-ports: "443" spec: type: ClusterIP selector: linkerd.io/control-plane-component: proxy-injector ports: - name: proxy-injector port: 443 targetPort: proxy-injector --- # Source: linkerd-control-plane/templates/destination.yaml apiVersion: apps/v1 kind: Deployment metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 labels: app.kubernetes.io/name: destination app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-destination namespace: linkerd spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% template: metadata: annotations: checksum/config: 9274001d145801fceac8556ccb4e4a142033d354bb35e80ad3fda0bebcb8c2fe linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" linkerd.io/trust-root-sha256: f77fc5ba134a267d8b99be098d5f6496c6efdd752da8571b112656b5323da6e3 config.linkerd.io/default-inbound-policy: "all-unauthenticated" labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/workload-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination spec: nodeSelector: kubernetes.io/os: linux containers: - env: - name: _pod_name valueFrom: fieldRef: fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: "warn,linkerd=info,trust_dns=error" - name: LINKERD2_PROXY_LOG_FORMAT value: "plain" - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: localhost.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: localhost.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: "$(_pod_ns):$(_pod_name)" - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: "100ms" - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: "1000ms" - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: "5s" - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: "90s" - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: "8086,8090,8443,9443,9990,9996,9997" - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: "25,587,3306,4444,5432,6379,9300,11211" - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: name: linkerd-identity-trust-roots key: ca-bundle.crt - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /live port: 4191 initialDelaySeconds: 10 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy - containerPort: 4191 name: linkerd-admin readinessProbe: httpGet: path: /ready port: 4191 initialDelaySeconds: 2 resources: securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - destination - -addr=:8086 - -controller-namespace=linkerd - -enable-h2-upgrade=true - -log-level=info - -log-format=plain - -enable-endpoint-slices=true - -cluster-domain=cluster.local - -identity-trust-domain=cluster.local - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /ping port: 9996 initialDelaySeconds: 10 name: destination ports: - containerPort: 8086 name: grpc - containerPort: 9996 name: admin-http readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9996 securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault - args: - sp-validator - -log-level=info - -log-format=plain - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /ping port: 9997 initialDelaySeconds: 10 name: sp-validator ports: - containerPort: 8443 name: sp-validator - containerPort: 9997 name: admin-http readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9997 securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /var/run/linkerd/tls name: sp-tls readOnly: true - args: - --admin-addr=0.0.0.0:9990 - --control-plane-namespace=linkerd - --grpc-addr=0.0.0.0:8090 - --server-addr=0.0.0.0:9443 - --server-tls-key=/var/run/linkerd/tls/tls.key - --server-tls-certs=/var/run/linkerd/tls/tls.crt - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - --identity-domain=cluster.local - --cluster-domain=cluster.local - --default-policy=all-unauthenticated - --log-level=info - --log-format=plain - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - --probe-networks=0.0.0.0/0 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /live port: admin-http name: policy ports: - containerPort: 8090 name: grpc - containerPort: 9990 name: admin-http - containerPort: 9443 name: policy-https readinessProbe: failureThreshold: 7 httpGet: path: /ready port: admin-http initialDelaySeconds: 10 resources: securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /var/run/linkerd/tls name: policy-tls readOnly: true initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - "4190,4191,4567,4568" - --outbound-ports-to-ignore - "443,6443" image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: "100m" memory: "20Mi" requests: cpu: "100m" memory: "20Mi" securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false runAsNonRoot: true runAsUser: 65534 readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock securityContext: seccompProfile: type: RuntimeDefault serviceAccountName: linkerd-destination volumes: - name: sp-tls secret: secretName: linkerd-sp-validator-k8s-tls - name: policy-tls secret: secretName: linkerd-policy-validator-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: sources: - serviceAccountToken: path: linkerd-identity-token expirationSeconds: 86400 audience: identity.l5d.io - emptyDir: medium: Memory name: linkerd-identity-end-entity --- # Source: linkerd-control-plane/templates/identity.yaml apiVersion: apps/v1 kind: Deployment metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 labels: app.kubernetes.io/name: identity app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd name: linkerd-identity namespace: linkerd spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% template: metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" linkerd.io/trust-root-sha256: f77fc5ba134a267d8b99be098d5f6496c6efdd752da8571b112656b5323da6e3 config.linkerd.io/default-inbound-policy: "all-unauthenticated" labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/workload-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity spec: nodeSelector: kubernetes.io/os: linux containers: - args: - identity - -log-level=info - -log-format=plain - -controller-namespace=linkerd - -identity-trust-domain=cluster.local - -identity-issuance-lifetime=24h0m0s - -identity-clock-skew-allowance=20s - -identity-scheme=kubernetes.io/tls - -enable-pprof=false - -kube-apiclient-qps=100 - -kube-apiclient-burst=200 env: - name: LINKERD_DISABLED value: "linkerd-await cannot block the identity controller" image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /ping port: 9990 initialDelaySeconds: 10 name: identity ports: - containerPort: 8080 name: grpc - containerPort: 9990 name: admin-http readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9990 securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /var/run/linkerd/identity/issuer name: identity-issuer - mountPath: /var/run/linkerd/identity/trust-roots/ name: trust-roots - env: - name: _pod_name valueFrom: fieldRef: fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: fieldPath: spec.nodeName - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS value: "8080" - name: LINKERD2_PROXY_LOG value: "warn,linkerd=info,trust_dns=error" - name: LINKERD2_PROXY_LOG_FORMAT value: "plain" - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: "$(_pod_ns):$(_pod_name)" - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: "100ms" - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: "1000ms" - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: "5s" - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: "90s" - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: "8080,9990" - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: "25,587,3306,4444,5432,6379,9300,11211" - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: name: linkerd-identity-trust-roots key: ca-bundle.crt - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: localhost.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /live port: 4191 initialDelaySeconds: 10 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy - containerPort: 4191 name: linkerd-admin readinessProbe: httpGet: path: /ready port: 4191 initialDelaySeconds: 2 resources: securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - "4190,4191,4567,4568" - --outbound-ports-to-ignore - "443,6443" image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: "100m" memory: "20Mi" requests: cpu: "100m" memory: "20Mi" securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false runAsNonRoot: true runAsUser: 65534 readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock securityContext: seccompProfile: type: RuntimeDefault serviceAccountName: linkerd-identity volumes: - name: identity-issuer secret: secretName: linkerd-identity-issuer - configMap: name: linkerd-identity-trust-roots name: trust-roots - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: sources: - serviceAccountToken: path: linkerd-identity-token expirationSeconds: 86400 audience: identity.l5d.io - emptyDir: medium: Memory name: linkerd-identity-end-entity --- # Source: linkerd-control-plane/templates/proxy-injector.yaml ### ### Proxy Injector ### apiVersion: apps/v1 kind: Deployment metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 labels: app.kubernetes.io/name: proxy-injector app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd name: linkerd-proxy-injector namespace: linkerd spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: proxy-injector strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% template: metadata: annotations: checksum/config: b0eb81f400c02a291be268ec9dd91e3085b1afc59b7aaaeadd76fdcf69d07e12 linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" linkerd.io/trust-root-sha256: f77fc5ba134a267d8b99be098d5f6496c6efdd752da8571b112656b5323da6e3 config.linkerd.io/opaque-ports: "8443" config.linkerd.io/default-inbound-policy: "all-unauthenticated" labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/workload-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector spec: nodeSelector: kubernetes.io/os: linux containers: - env: - name: _pod_name valueFrom: fieldRef: fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: "warn,linkerd=info,trust_dns=error" - name: LINKERD2_PROXY_LOG_FORMAT value: "plain" - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: "$(_pod_ns):$(_pod_name)" - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: "100ms" - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: "1000ms" - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: "5s" - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: "90s" - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: "8443,9995" - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: "25,587,3306,4444,5432,6379,9300,11211" - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: name: linkerd-identity-trust-roots key: ca-bundle.crt - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /live port: 4191 initialDelaySeconds: 10 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy - containerPort: 4191 name: linkerd-admin readinessProbe: httpGet: path: /ready port: 4191 initialDelaySeconds: 2 resources: securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - proxy-injector - -log-level=info - -log-format=plain - -linkerd-namespace=linkerd - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: httpGet: path: /ping port: 9995 initialDelaySeconds: 10 name: proxy-injector ports: - containerPort: 8443 name: proxy-injector - containerPort: 9995 name: admin-http readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9995 securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /var/run/linkerd/config name: config - mountPath: /var/run/linkerd/identity/trust-roots name: trust-roots - mountPath: /var/run/linkerd/tls name: tls readOnly: true initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - "4190,4191,4567,4568" - --outbound-ports-to-ignore - "443,6443" image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: "100m" memory: "20Mi" requests: cpu: "100m" memory: "20Mi" securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false runAsNonRoot: true runAsUser: 65534 readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock securityContext: seccompProfile: type: RuntimeDefault serviceAccountName: linkerd-proxy-injector volumes: - configMap: name: linkerd-config name: config - configMap: name: linkerd-identity-trust-roots name: trust-roots - name: tls secret: secretName: linkerd-proxy-injector-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: sources: - serviceAccountToken: path: linkerd-identity-token expirationSeconds: 86400 audience: identity.l5d.io - emptyDir: medium: Memory name: linkerd-identity-end-entity --- # Source: linkerd-control-plane/templates/heartbeat.yaml ### ### Heartbeat ### apiVersion: batch/v1 kind: CronJob metadata: name: linkerd-heartbeat namespace: linkerd labels: app.kubernetes.io/name: heartbeat app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: heartbeat linkerd.io/control-plane-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: concurrencyPolicy: Replace schedule: "23 21 * * *" successfulJobsHistoryLimit: 0 jobTemplate: spec: template: metadata: labels: linkerd.io/control-plane-component: heartbeat linkerd.io/workload-ns: linkerd annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 spec: nodeSelector: kubernetes.io/os: linux securityContext: seccompProfile: type: RuntimeDefault serviceAccountName: linkerd-heartbeat restartPolicy: Never containers: - name: heartbeat image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent env: - name: LINKERD_DISABLED value: "the heartbeat controller does not use the proxy" args: - "heartbeat" - "-controller-namespace=linkerd" - "-log-level=info" - "-log-format=plain" - "-prometheus-url=http://prometheus.linkerd-viz.svc.cluster.local:9090" securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault --- # Source: linkerd-control-plane/templates/proxy-injector-rbac.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: linkerd-proxy-injector-webhook-config labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd webhooks: - name: linkerd-proxy-injector.linkerd.io namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled - key: kubernetes.io/metadata.name operator: NotIn values: - kube-system - cert-manager objectSelector: matchExpressions: - key: linkerd.io/control-plane-component operator: DoesNotExist - key: linkerd.io/cni-resource operator: DoesNotExist clientConfig: service: name: linkerd-proxy-injector namespace: linkerd path: "/" caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWp1Z0F3SUJBZ0lSQVBRR2NSMGdreEhDWlZuQ3p0ZFl2SnN3RFFZSktvWklodmNOQVFFTEJRQXcKTFRFck1Da0dBMVVFQXhNaWJHbHVhMlZ5WkMxd2NtOTRlUzFwYm1wbFkzUnZjaTVzYVc1clpYSmtMbk4yWXpBZQpGdzB5TmpBek1UUXlNVEV6TkRaYUZ3MHlOekF6TVRReU1URXpORFphTUMweEt6QXBCZ05WQkFNVElteHBibXRsCmNtUXRjSEp2ZUhrdGFXNXFaV04wYjNJdWJHbHVhMlZ5WkM1emRtTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUEKQTRJQkR3QXdnZ0VLQW9JQkFRQ1dOVHNnVmlqeUNrZ29tNkxIWFB4bmRTZVhiTlRQY0pKVHh2NFZsMlNYQXBjOApJeGNQUHozemNqZlpwU0NKdjA3alp0UGR4QXhEd0VPbTVaWXRSUUZzZXpsOUNNNUVHRmdvL0xQQWlXOUZ2VW9HCkt3Rm5sUDhiWmZlcWl3N0hZQktJQ2N2UTQxdEdKcmxrZVI2VWdkYWRwcHNxMW9yRFlUQ1lPaTh2c2dNc2Z3US8KTTRFM3U2RUVBTW5sTGxOZ1VCNW9IdlBtK281MHlib2FaSVBJb2FKZGpuMW9XMjZoay8zN1phMlhpazRiMWxJNApUeXEzMDk0SUZPNndiTEJxQXk2ZVNURlFEZG9iVEJkSi9raVI2WDVsVC80WHBSa3BjYm04YU1wbUdTN3VrQ09qCkZka0tuWmpTZVA0Q0o2SFB2bjNzanpDNTZRcXVzYUZtTGIxbVk2dUxBZ01CQUFHamJqQnNNQTRHQTFVZER3RUIKL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFILwpCQUl3QURBdEJnTlZIUkVFSmpBa2dpSnNhVzVyWlhKa0xYQnliM2g1TFdsdWFtVmpkRzl5TG14cGJtdGxjbVF1CmMzWmpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNMOUF5SUFtbUlua3JTYUdHdEVCMDdYRi9aL1h5R056T1YKcjgwak0wc2F4RDcyTUtSbTJYb2l0YlVFMW9XUHVxVGdxVlVFemdjZVpFbW53b082MEYyaVRvSEZrSTNvbTFrMgpZcVdhQVNMTTRHd09HeXVKRnQ4WFZncHBCdW9oWWl4MThBOU11dFlLVkdYS0JiY0RaOVFKcENyOGN3a2s0dlQ5CkQ5MnNxd2VhUHF3WWdJeHdqbkpKNEJ3bDhVZnFzMHhHdXdXYVZzdVNhTGhiWGJDWjZjdG1nNkN4RFhQOG1EcWkKZytBQkoxQjhJR1N5SS9tUWo5Rk9OaEV3MWNtQVdEcmJ5anlDV0FSZXhoMkQ3dVFCZHJxRm0vWlVEVlZpREJUeApOcVVlYmdpeDBKbkxTVnRzQUlDWFBseFFtQ1l6VE53bHRZcHVUc2dpdm1TRi9LWlRxamlYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0= failurePolicy: Ignore admissionReviewVersions: ["v1", "v1beta1"] rules: - operations: [ "CREATE" ] apiGroups: [""] apiVersions: ["v1"] resources: ["pods", "services"] sideEffects: None --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: linkerd-sp-validator-webhook-config labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd webhooks: - name: linkerd-sp-validator.linkerd.io namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled clientConfig: service: name: linkerd-sp-validator namespace: linkerd path: "/" caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURURENDQWpTZ0F3SUJBZ0lRSGpQNzgxWFVuNzJTZHEwd3QwZ3RWekFOQmdrcWhraUc5dzBCQVFzRkFEQXIKTVNrd0p3WURWUVFERXlCc2FXNXJaWEprTFhOd0xYWmhiR2xrWVhSdmNpNXNhVzVyWlhKa0xuTjJZekFlRncweQpOakF6TVRReU1URXpORGRhRncweU56QXpNVFF5TVRFek5EZGFNQ3N4S1RBbkJnTlZCQU1USUd4cGJtdGxjbVF0CmMzQXRkbUZzYVdSaGRHOXlMbXhwYm10bGNtUXVjM1pqTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEEKTUlJQkNnS0NBUUVBc1ozNmh5Uit0djl2YW9jOVpSZVR4Um5PdU5VZHcvMjdRTUdNWDdjdnpsSjYvNWZsdjU1RgpqUU5Pc1B3bm5SMFY2NzFaTGF4R1ZBTnFTVDlsOWNqU1JIQWNOWmhkdlBsU0l2djBvVjlJbFVrcnQ5R0VHbHQzClcySEM3MXFac3l1ZnpkOWoxSzlNK2x2R3A5NjVVSStJaSttZUNnRlE1Q2FwMWpkdDBDRk1DdWFiS2tieXFDWU4Kbit4QVZlNll1U09XeXVvMFBRVnczNDRoaXNLS3k1YlFYVHFqN2F1YTIzOVJqT202UitPdzkvakJHU3k3M2xlYQp0UlhBK2lUQjRUY0FFZTIvMFdtUnVveHFYWVBNQU1aUFJaYzVkWDRqMDNQY1p2NWwvTFVkcVVrYmRRUkpicHBECmNhRzlKOWJWR2RGUVlaL0hyQUMrTkUzcW1yRmRwc09UTXdJREFRQUJvMnd3YWpBT0JnTlZIUThCQWY4RUJBTUMKQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBdwpLd1lEVlIwUkJDUXdJb0lnYkdsdWEyVnlaQzF6Y0MxMllXeHBaR0YwYjNJdWJHbHVhMlZ5WkM1emRtTXdEUVlKCktvWklodmNOQVFFTEJRQURnZ0VCQUZRWkEwVlZxS29WNEpIVklaNjltR3VwcVAxdlpsam9JUkFTRXkzNHdqT0IKaFNuVlMzQW9DTVljRjJ1UVIzNEkvaFVBUmQxWXA1RmNzck1CSmNXWTZlcjRIcTA4aDloeEdCeDBHaEFhRUlsSAovRmthMHJlWXZGTWZMSWtkMDdrSzJvQmJBRTVDTUgrMkF5WVRndGdDcnZpNVlWQ0dDOVAzcEd2SGM2aG9Kcm1FCjMrS2JWcXlicmhkQ3NxMW9YSTh2V3pGZm53WllBaVhaS2VjNEpWMFRUa1BpY2t5cmFxblNQQTdLdHBTc2RUL2sKZmdwQTVTTEJXY1czVW1yWnFpSnhqbjR4a2lzWS9jMDZHQ1BRZDk5R284MzdnY0JIK3pBbDBmU3I5UjVLNlZueApZb2dDNndudzlnZDRQanU0N2JINmM5ZTZldlJ5SlBjU251YUpqR1h4SzZVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t failurePolicy: Ignore admissionReviewVersions: ["v1", "v1beta1"] rules: - operations: ["CREATE", "UPDATE"] apiGroups: ["linkerd.io"] apiVersions: ["v1alpha1", "v1alpha2"] resources: ["serviceprofiles"] sideEffects: None --- # Source: linkerd-control-plane/templates/destination-rbac.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: linkerd-policy-validator-webhook-config labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd webhooks: - name: linkerd-policy-validator.linkerd.io namespaceSelector: matchExpressions: - key: config.linkerd.io/admission-webhooks operator: NotIn values: - disabled clientConfig: service: name: linkerd-policy-validator namespace: linkerd path: "/" caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXRENDQWtDZ0F3SUJBZ0lRZXljOVNmUU1qd2Y3NjhxcUxBRjdkakFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlSc2FXNXJaWEprTFhCdmJHbGplUzEyWVd4cFpHRjBiM0l1YkdsdWEyVnlaQzV6ZG1NdwpIaGNOTWpZd016RTBNakV4TXpRM1doY05NamN3TXpFME1qRXhNelEzV2pBdk1TMHdLd1lEVlFRREV5UnNhVzVyClpYSmtMWEJ2YkdsamVTMTJZV3hwWkdGMGIzSXViR2x1YTJWeVpDNXpkbU13Z2dFaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURmY2lReHNKcXF0MnhVM1V2bDRvSmxmckJQdmJ3c05YNzlSSk44Q0MzNwpRM2l5UEJ1dHNPNkFERG9kcXNubThHQ3p2NFZpSFNKN2s2QjNIUG4wamZML0NLVTdlSm5MZ3U2dWc2aWYxWVRWCjczS3FiS2pvbWxzUVhyOHlWb1hNUVNGVFNSSkc2NkM0NWxidW5rTzFsWXFyZEUvcmY1N3YwTUdUL2RNTWxiZm0KeEZMSnNGV1VxSy9ZaFZBMVpUc2JiNk1UbkUzNko4VklFcmtzamlvcHRjNWlMSTVpSHYxVzVYN0tXUk82ZWZveApkYjFBQ012REQxUWJNYUtCMkptOGNhRlRwRGEycGQyMmVaUFhQRk5Pd2FHTkVjeG5OSmZ6TEpPQUYvZlVQamJTCkRpWGt5eEx4MDE0blZWb3djVzFDeVFRZ1lTTVEwSEgzMmJqL1F6aDB0cHJwQWdNQkFBR2pjREJ1TUE0R0ExVWQKRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdEQVlEVlIwVApBUUgvQkFJd0FEQXZCZ05WSFJFRUtEQW1naVJzYVc1clpYSmtMWEJ2YkdsamVTMTJZV3hwWkdGMGIzSXViR2x1CmEyVnlaQzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFLQksrQ0gyWjFubUgyOXNKUExlNzVucW5Jcm0KVTV2Vk5aQnUrNXl3UnQyRDQ5QWJ1aDFyaHB6Q0pMTWRoRThqcUp6Rkp6amNXZkFnZ2NzSUF0Wkt2R05YUWhPegpadHdsN0pWOWducVg0RHJ0OUFvbjR4cGJQdWlwWG8zUmVTczhldERXSy92RVROak1Nb1U5aCtsTEtNckFEa1pQCmFqVjROMUp1b1FLK0syYlVYUjlIRGhpMjAwbCsyYnVEVUp4d3RWbUVubVFmcFdVb1FUNkxJTzhYWVN3VXdvM2IKUyttSlZsNWgvMGphMXlwdW1rS0c4TDNqNU9GT2pybHIxYm5TOHFXMklrcDVYUGFOYmNJVEdYRTVUbmFYV0pDKwpPajBXZWpvZ3haWVdUVUxMTGcrSTB5QjE0cmNBeVdpQzYrb0o1dkc0dWVDRHdybmpUd0orYi9sdTRzQT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ== failurePolicy: Ignore admissionReviewVersions: ["v1", "v1beta1"] rules: - operations: ["CREATE", "UPDATE"] apiGroups: ["policy.linkerd.io"] apiVersions: ["*"] resources: - authorizationpolicies - httproutes - networkauthentications - meshtlsauthentications - serverauthorizations - servers sideEffects: None --- # Source: linkerd-control-plane/templates/identity.yaml ### ### Identity Controller Service ###