1575 lines
104 KiB
YAML
1575 lines
104 KiB
YAML
---
|
|
# Source: linkerd-viz/templates/metrics-api-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: metrics-api
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: prometheus
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: web
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-rbac.yaml
|
|
kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector-k8s-tls
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRVENDQWltZ0F3SUJBZ0lSQVAwVWVGU0I4cW96WlZnV2xvSWdSL1l3RFFZSktvWklodmNOQVFFTEJRQXcKSnpFbE1DTUdBMVVFQXhNY2RHRndMV2x1YW1WamRHOXlMbXhwYm10bGNtUXRkbWw2TG5OMll6QWVGdzB5TmpBegpNVFF5TVRFek16SmFGdzB5TnpBek1UUXlNVEV6TXpKYU1DY3hKVEFqQmdOVkJBTVRISFJoY0MxcGJtcGxZM1J2CmNpNXNhVzVyWlhKa0xYWnBlaTV6ZG1Nd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFEYXQyM3Z2K0VSQVl2Vi85a1dYTWNiLyt6N3BuRkF3Ykhvb1dESVpYLzhpMjlDRWJmWDVld2tvWk5wYjZtdwpQYkxzMmczUHN6Kzg4UzBrb1pLNDVkN3pLZXFkanNGTXpDNEhQb2JxUUl0RUlHVlpsQU0zTVJLQ1EyRytXUFJnCkI1dkR3aFRJTlR0bGFaakk4SC9OMXkwc3JWU203d0pqS3JVK2F6eVVoTzNoVUtjaVJCYkdVRDFEZFU5ZXZUWmgKMEVLMGhFeDhLYmxkelU1NS9kT2NLWnlVSE9CSjl5UERMbUhUK0M0RG8zZ08rVVVpejRVNUE3NFJyRC9xU1NBVQp0eWMwZDJxNnppeGFaZWFPZ1RaV0paeW5TQnpGTm9zUTRiQkcrTTg0dHMxeVlvdG5EUlRlUjV4cTZxQk5iQ2hFCkcyNjVvcGtRYTNPcitaaklpRDdZQ3IvbkFnTUJBQUdqYURCbU1BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlYKSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQW5CZ05WSFJFRQpJREFlZ2h4MFlYQXRhVzVxWldOMGIzSXViR2x1YTJWeVpDMTJhWG91YzNaak1BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUFIdG8xbXNGcTRJY29pbnIyTjNmNkpoY1hWZ2d3aHNLUmVSME9GZDdZM1FqcTJrc3JCTkI2MWZNbmsKbDJkV243VHR0MjlVeGJ3VE5NNDhYeVdlL0E1bTlnMXN0cjJvMngzNTB2WXVhZ1lzUkdTRlhLSHpyQ2JpcGhTaApQZDZMSm9lK3FTQVl2RkJ6dVZCaTMyU0hmcE15M1VqQzdMM29lQ21vSUt6V1VHRm9OdndrWXhOMktmbDZsT3l3Ci9HN1A1QWc1SWdxYlVqK2szM3lFN2RqNkNUSUFTcVZFSnNyQTB3WU5GcG5CTkNtc0VYbHJxN05scU53N3o0c0wKY25oTWRmNkFxOWQ5dDlrd25SMHdzcDlqc1NJbmRubUllVG1VajROQitvZ3ZaK1Eza1NuZ2g5U05xTkV3TVI4VQp1MGNsalhUZXNhZXFtZzREbmcvRDlkRkVEbXFkCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
|
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMnJkdDc3L2hFUUdMMWYvWkZsekhHLy9zKzZaeFFNR3g2S0ZneUdWLy9JdHZRaEczCjErWHNKS0dUYVcrcHNEMnk3Tm9OejdNL3ZQRXRKS0dTdU9YZTh5bnFuWTdCVE13dUJ6Nkc2a0NMUkNCbFdaUUQKTnpFU2drTmh2bGowWUFlYnc4SVV5RFU3WldtWXlQQi96ZGN0TEsxVXB1OENZeXExUG1zOGxJVHQ0VkNuSWtRVwp4bEE5UTNWUFhyMDJZZEJDdElSTWZDbTVYYzFPZWYzVG5DbWNsQnpnU2Zjand5NWgwL2d1QTZONER2bEZJcytGCk9RTytFYXcvNmtrZ0ZMY25OSGRxdXM0c1dtWG1qb0UyVmlXY3AwZ2N4VGFMRU9Hd1J2alBPTGJOY21LTFp3MFUKM2tlY2F1cWdUV3dvUkJ0dXVhS1pFR3R6cS9tWXlJZysyQXEvNXdJREFRQUJBb0lCQUYxR25DS0NyT3dSUWo4MgpPVEZoeU9LR2oxMDFPeGg0WXJUSTJoc3N1bHdNWlJzQ3JtcHJXbjIyME1USEE5R3ZSbmJmZWNOcCtSVk5yOGh2CkJjRkgrNEN0a0NxNG5uUnZvWE9pZFd4Q3NZSVE1TmhDbU9wNVNhRDNOcUMwbENlK0p1NWgvM1h3eWM5eXJOK0oKUGFBZUU5eDVZV0ErRDBFV2ppdzhGSjVzWUh6Vm5ERWU1N1JVeFlwQkRreG40SzRnYnlqQXVYQmtzWk91REMyYQoxSGlFZUxEZHdmclNjWDlEQVFJb0NpL2dGNUNzZ3lGWWlHSG9pN0djdjVBbzBObWxkZEZlS241ZElJaXlYeW8yCndHQzRWL3FJUDNrYW9jV3o1RFNmUDRyYzNRYXNZeU5IU3FoSXpJQ1hhN1gzOFlrb1F6K3VzS2xzUTJpVlJrMzMKWlliYkpzVUNnWUVBNCs4QXd3aEFlb2VjUWRkSGJzOE12OGlEZlN0b0lsT1FWaXkzejdleHkwVjIxOFloMGIyVgpuN0Z6L2czOEMrQ3pZK3VlNFNBSXkzYlN3b0h0RlB5eHFUaTlqMGEzVVlVUUlxbmRXZ3ZjM3RKWWt5UEJjZW9ZCnlTaCs4b3JaTUJ1S3hDN01yZFVjcWJ3emFpUUJSRG1RWmJNdWk1c1ErbVlzSXdnSkhGZTlWOE1DZ1lFQTlhWGgKN3JlSCtWNkZwLzl2NkZyTFZ3NVF0STlSY0ROb2psNGdiZE9kaFRDUXFCeWZIZXEzOEYvZGpETXFjckROY3hEego0NnhnMFR4ZkFsTWx4UFROQWE3WG8rV2g0L2l2dmwxYUxvQWJjU2U2MUhiUytubERjbXRYaVNkZXlTWHY2MkpPCnVCdjluWmZHMXRyYkxQQ1MwMytSZmdNck1jN2JjN0t5T0tSRDJRMENnWUVBeUY0U2ttQVBwbWJOd3NkSFFTNTcKNjUrTmp4djRSNnlqeGswN0xEc3o3UmZjVitRUldMcEs3SDNuRkY4Z3dTUS9Ma2d6ZTMxWW5kdVBmSE1RZ1pGOQpiOSswSzE0anltS3BnMzlGV1dIeVFHSXlnTzQrb0RBRXA5aVVlQXY4enFCM2hPd0srNGpLMEo3anA1dU5EWGQ0CjZ4M3ZmY1BMMGdLOUsvSmxaK2Z0UjFjQ2dZQkhYN1Z2eVAvSEl3R3V1SGRwaWNmL09YZVZudmJJcFFkQ0puTkIKdGZUVTJER1B4eEVzZmlDSHhUTDRJMzIzNlVzb25jcGZZcHlXN3ZXa0ZVaXFHMzdkZUZITG0xTVlqQTkwUG1lUApqMFZwOFdORmpHanN3Z01vNGF1RGZGNzhEdnZRNXJWOHBSVmhqdElGWjMyN1p3TWlWTFNQYXBoSVZwUkkzNmtNCjhCMk9tUUtCZ1FDdVY0eU85S240NFF5c09jTStMS0lnTUozUkhnRjJTQ044WW1sM0tsa0JocmVrYjM3eVZIeVkKQXhDRTViZGpaOWNlaU1RSVRPbzBzbzY3OGUrMXR4dkVzZzBxeHA4T0ZmSk1LOEpOY2o3amhCLzkzRjFqU0xkcgo2MjBHZ2xEak9IL0t6NFUxOURScHU5TnF6WVlXMGtlQjR6Y0FKbEkvbGgwZW9CbzdQNVRsL2c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-k8s-tls
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKakNDQWc2Z0F3SUJBZ0lSQUxRdG9IeHpWR29jTDRITlVJQzNjTmN3RFFZSktvWklodmNOQVFFTEJRQXcKSGpFY01Cb0dBMVVFQXhNVGRHRndMbXhwYm10bGNtUXRkbWw2TG5OMll6QWVGdzB5TmpBek1UUXlNVEV6TXpGYQpGdzB5TnpBek1UUXlNVEV6TXpGYU1CNHhIREFhQmdOVkJBTVRFM1JoY0M1c2FXNXJaWEprTFhacGVpNXpkbU13CmdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURESDlwTW5IZnY1YkovWVpqK3dLU0EKeFR6MkU3MlZlZjIxOFZuS2tsdEMrSGpZanFTdWFNVlhLcURYNG9ZT2FiZHFsZ0pFSjVvOXJwNjVnY084TmdqUQphU2JuZ0U4Zm90UGJUQTRGNmpHb3R3Nm5MbzdlOWZFM294eXRmK1BuMFdJbE9wY1cza1VCMDEzTkRyYzNoL2VNCm51ekpWcmhKUGh6VVJZYmpZTFE4QnJ0c0k5cHYwbW1tZnZ1TVB3VGVhR3o4dGlXK21jdlJxMmpoWStvWUFiSCsKeElRNUZMbHlDZEVpdTJSTXZEdk9Fenk4YXZGUFcwaWFQcWJOaEFjZVRiK2hjMHNoK2RSNS9oVHZjMm9ZZDVBTgpGR1Z3b2hqYnJNYzZCZFAzWktEMlhGVXlXZDd1RzlWTzhZZlNLV3EvUnZoRGwvNThINE5DWE9mcklJS1BNRUNuCkFnTUJBQUdqWHpCZE1BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWVCZ05WSFJFRUZ6QVZnaE4wWVhBdWJHbHVhMlZ5WkMxMgphWG91YzNaak1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQlFOaEFscHloQ2N5Ukh4ejIwR2F3K0VpWFEzZXpJClhQTUtOWmgrenQ5RHN2WllVTy8vdkJhcWN5TzZDNzllb0VPbFE0TndLTWRRZ29CUUZyK3l0Yk5iN1hiNWZ4eGcKVDRhTVBhZkpnYzBLMzlxaHVQUVZuNkVLRGNTSC94SVphQmpLMXkyYWtHT1BuSjdPeXJUN2Y1Wkg2T3VkYkVYRAo4UERqRitJSzJpOWRKUkFKeWFVWW82Mk9VRU16clFHOU5hUEc0MEVvTVZUNGNHQXBYOUZUVHZOTysrZnN6bXk1CndWZTNUa3dZSGdPUTJhckFBVURtK3FEMW9OOG1Lc0gxb0xSNncydTR0U2R2UnRxNlRuUnRGOWhmcFJTWjlickMKeVV0bjFLcmtWQThqVlIrZnZ0b1JId0JUMjNaZDNVZmtJM0kvczdEZ3kzUkJhL0xMdmJaVUhiU1QKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
|
|
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBd3gvYVRKeDM3K1d5ZjJHWS9zQ2tnTVU4OWhPOWxYbjl0ZkZaeXBKYlF2aDQySTZrCnJtakZWeXFnMStLR0RtbTNhcFlDUkNlYVBhNmV1WUhEdkRZSTBHa201NEJQSDZMVDIwd09CZW94cUxjT3B5Nk8KM3ZYeE42TWNyWC9qNTlGaUpUcVhGdDVGQWROZHpRNjNONGYzako3c3lWYTRTVDRjMUVXRzQyQzBQQWE3YkNQYQpiOUpwcG43N2pEOEUzbWhzL0xZbHZwbkwwYXRvNFdQcUdBR3gvc1NFT1JTNWNnblJJcnRrVEx3N3poTTh2R3J4ClQxdEltajZtellRSEhrMi9vWE5MSWZuVWVmNFU3M05xR0hlUURSUmxjS0lZMjZ6SE9nWFQ5MlNnOWx4Vk1sbmUKN2h2VlR2R0gwaWxxdjBiNFE1ZitmQitEUWx6bjZ5Q0NqekJBcHdJREFRQUJBb0lCQUVrL2VkbHNtM0dKRHJyVwp6bkpEcXYxVURaQnExSzU2UHcyLzdtOG5CZTljQ3pGd1NzM1dNczZJQ0IxQ3dnUkRGMEdCMHBQM01lV1oyYWZWCjJMNmNvaTVxYXRwWXhsc2Y2dHZWN3lXMVJyTUpGUTBaWXpTN3FyT3lIWi9iOUpnZmQvSjF6aVlkaGxZckhIbFAKM3VPUHZSUWl6TXpBS3lvRGtScjJocTV3clBnaS9ySzJidDVvS2p5ODZYcjhxNmxoOFlSWUdtQm9SYjBnRjhLcwpBRWpRQWNXenI2TEovNCtaaGRKdGQ0NGx5bGZmVVAwb21weE5jVk9jYmJXb2FLcVcwcklwQ2pIdjRxVExWeGd1CnRLZ0hIeTd0TkZpRFlLUy9rSTViNC9oeDl4akJLcm9oR2F4OHVrUHNFbFhIVTVxN3dUNkUwMm1ZTjdEYU5QZCsKeENQRkFlRUNnWUVBN2ZwQ2cxU25sNVFWVGtoQW1lRlpRUFZScGdUUWdOSDZSd0UvYS9QT2NrM3hVaWV2RWFsUwp3SHJmZlI5YlE5S1FFNU5WV2dOK25PU1JOd29Mb3Zjd1MxemJDRnNLQnkyU29XaHRhNGpiaTVjWG5Ca3lzNnlVCml1N3lxWjYreEp5aldoV1h6NWV4RXlRcExTb0VVSWhST29OSnNYMExOQUttSWRsZ3BJYlRIdWtDZ1lFQTBlYkoKVkE4V0FLaTRrZnVtOFBOTmlMMkVMK05ob1ZucEphMFM5YXhTOERjZ1JFc3hwTy9rTzB4eE9YTEtsTHlmeEhNWAo5MFRKSEttY0JrcDQySCtjTG9UYzVKTXRtd0xrdmFRNVNSbDNSZGw3ZVBpZkpTckRoUmVQN1FNSDR3WCs5RFhXClpRV2s1YjlwM2pvK2I2cFMzMEVyTnE2ckV2MHVaaWN3RzBaWlNROENnWUVBdFhWQ0Nrb2VrR0lGN084QzgxTDEKYjZhZlgyd0VZSFc3MVRDS1g1SkVOTHhoNmpjQU13TmRhZzlISW0wcWRnaTBlM2k0ZUM1NStNQUFTbXVLZS9UbwpDazcvWk51bVJkcm1GOVU4dWVaZElZOVFIV0xKV2wrWjFHWm0raGRsZHgzSklRT2VBbGkwV05nVjNhNVFJK2dOCnFBUTd5TzZFQUdDVXRQSy8walJML3lFQ2dZRUFpYjdxWUQrR01PaUlOMFR1U1RGaHNGcXVaTDdUVXcrdDhRdWoKWlpXdzEvTlZPWHdmR0I1VnFKU0J1VEdid0FBSTJPS3UxNVpNWklMcDRUYitGeFduYU4vSUZqaC90VG93NGtMagpWUlZoTUhXSWtkcVdsYzE2Z2R6MGxwVm1sNVZYdXV1WnhySHRoTmdZb2IyWE83Q0tzZmdTWTlBOGREbXlPVmQrCk9tZndNQUVDZ1lBMEZmSG5tNkdDdEV6bjNqalNxcVh4eExia3lKdW1zLzl0Rk45SFBtTzRVczQ5Sm5lMXZ5UDcKd2YrM2Z6QWpESUFCUDZnZzA5SkZwcmQ0cjYvL2xMOG9tV3lJS05iRGtaSVpLNnh2eDVycHp2WDUrbG5GY2RFdwptMFB3aFBxQUovWnlCc2lIVWI1SVNBdnNwd1FSNFNwclVQMnpvSitDcGprWGRUY0U1VTM2SEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus.yaml
|
|
###
|
|
### Prometheus
|
|
###
|
|
kind: ConfigMap
|
|
apiVersion: v1
|
|
metadata:
|
|
name: prometheus-config
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
data:
|
|
prometheus.yml: |-
|
|
global:
|
|
evaluation_interval: 10s
|
|
scrape_interval: 10s
|
|
scrape_timeout: 10s
|
|
|
|
rule_files:
|
|
- /etc/prometheus/*_rules.yml
|
|
- /etc/prometheus/*_rules.yaml
|
|
|
|
scrape_configs:
|
|
- job_name: 'prometheus'
|
|
static_configs:
|
|
- targets: ['localhost:9090']
|
|
|
|
# Required for: https://grafana.com/grafana/dashboards/315
|
|
- job_name: 'kubernetes-nodes-cadvisor'
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
insecure_skip_verify: true
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
kubernetes_sd_configs:
|
|
- role: node
|
|
relabel_configs:
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_node_label_(.+)
|
|
- target_label: __address__
|
|
replacement: kubernetes.default.svc:443
|
|
- source_labels: [__meta_kubernetes_node_name]
|
|
regex: (.+)
|
|
target_label: __metrics_path__
|
|
replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
|
|
metric_relabel_configs:
|
|
- source_labels: [__name__]
|
|
regex: '(container|machine)_(cpu|memory|network|fs)_(.+)'
|
|
action: keep
|
|
- source_labels: [__name__]
|
|
regex: 'container_memory_failures_total' # unneeded large metric
|
|
action: drop
|
|
|
|
- job_name: 'linkerd-controller'
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
namespaces:
|
|
names:
|
|
- 'linkerd'
|
|
- 'linkerd-viz'
|
|
relabel_configs:
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_container_port_name
|
|
action: keep
|
|
regex: admin-http
|
|
- source_labels: [__meta_kubernetes_pod_container_name]
|
|
action: replace
|
|
target_label: component
|
|
|
|
- job_name: 'linkerd-service-mirror'
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs:
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_label_component
|
|
- __meta_kubernetes_pod_container_port_name
|
|
action: keep
|
|
regex: linkerd-service-mirror;admin-http$
|
|
- source_labels: [__meta_kubernetes_pod_container_name]
|
|
action: replace
|
|
target_label: component
|
|
|
|
- job_name: 'linkerd-proxy'
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs:
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_container_name
|
|
- __meta_kubernetes_pod_container_port_name
|
|
- __meta_kubernetes_pod_label_linkerd_io_control_plane_ns
|
|
action: keep
|
|
regex: ^linkerd-proxy;linkerd-admin;linkerd$
|
|
- source_labels: [__meta_kubernetes_namespace]
|
|
action: replace
|
|
target_label: namespace
|
|
- source_labels: [__meta_kubernetes_pod_name]
|
|
action: replace
|
|
target_label: pod
|
|
# special case k8s' "job" label, to not interfere with prometheus' "job"
|
|
# label
|
|
# __meta_kubernetes_pod_label_linkerd_io_proxy_job=foo =>
|
|
# k8s_job=foo
|
|
- source_labels: [__meta_kubernetes_pod_label_linkerd_io_proxy_job]
|
|
action: replace
|
|
target_label: k8s_job
|
|
# drop __meta_kubernetes_pod_label_linkerd_io_proxy_job
|
|
- action: labeldrop
|
|
regex: __meta_kubernetes_pod_label_linkerd_io_proxy_job
|
|
# __meta_kubernetes_pod_label_linkerd_io_proxy_deployment=foo =>
|
|
# deployment=foo
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+)
|
|
# drop all labels that we just made copies of in the previous labelmap
|
|
- action: labeldrop
|
|
regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+)
|
|
# __meta_kubernetes_pod_label_linkerd_io_foo=bar =>
|
|
# foo=bar
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_linkerd_io_(.+)
|
|
# Copy all pod labels to tmp labels
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
replacement: __tmp_pod_label_$1
|
|
# Take `linkerd_io_` prefixed labels and copy them without the prefix
|
|
- action: labelmap
|
|
regex: __tmp_pod_label_linkerd_io_(.+)
|
|
replacement: __tmp_pod_label_$1
|
|
# Drop the `linkerd_io_` originals
|
|
- action: labeldrop
|
|
regex: __tmp_pod_label_linkerd_io_(.+)
|
|
# Copy tmp labels into real labels
|
|
- action: labelmap
|
|
regex: __tmp_pod_label_(.+)
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api-rbac.yaml
|
|
###
|
|
### Metrics API RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
rules:
|
|
- apiGroups: ["extensions", "apps"]
|
|
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "batch"]
|
|
resources: ["cronjobs", "jobs"]
|
|
verbs: ["list" , "get", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["linkerd.io"]
|
|
resources: ["serviceprofiles"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["policy.linkerd.io"]
|
|
resources: ["servers", "serverauthorizations", "authorizationpolicies", "httproutes"]
|
|
verbs: ["list", "get"]
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus-rbac.yaml
|
|
###
|
|
### Prometheus RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-prometheus
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["nodes", "nodes/proxy", "pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-rbac.yaml
|
|
###
|
|
### Tap Injector RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-tap-injector
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
###
|
|
### Tap RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods", "services", "replicationcontrollers", "namespaces", "nodes"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "apps"]
|
|
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "batch"]
|
|
resources: ["cronjobs", "jobs"]
|
|
verbs: ["list" , "get", "watch"]
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-admin
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["tap.linkerd.io"]
|
|
resources: ["*"]
|
|
verbs: ["watch"]
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-check
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
rules:
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources: ["clusterroles", "clusterrolebindings"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
|
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["linkerd.io"]
|
|
resources: ["serviceprofiles"]
|
|
verbs: ["list"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes", "pods", "services"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apiregistration.k8s.io"]
|
|
resources: ["apiservices"]
|
|
verbs: ["get"]
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["list"]
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api-rbac.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: metrics-api
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus-rbac.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-prometheus
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-prometheus
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: prometheus
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-rbac.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-tap-injector
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: linkerd-tap-injector
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-tap
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-auth-delegator
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:auth-delegator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-check
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-web-check
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: web
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-admin
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-tap-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: web
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-web-api
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: web
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
###
|
|
### Web RBAC
|
|
###
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: web
|
|
namespace: linkerd
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get"]
|
|
resourceNames: ["linkerd-config"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "configmaps"]
|
|
verbs: ["get"]
|
|
- apiGroups: [""]
|
|
resources: ["serviceaccounts", "pods"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["replicasets"]
|
|
verbs: ["list"]
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-auth-reader
|
|
namespace: kube-system
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: extension-apiserver-authentication-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/web-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: web
|
|
namespace: linkerd
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd
|
|
roleRef:
|
|
kind: Role
|
|
name: web
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: web
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api.yaml
|
|
###
|
|
### Metrics API
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: metrics-api
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
ports:
|
|
- name: http
|
|
port: 8085
|
|
targetPort: 8085
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus.yaml
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: prometheus
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
ports:
|
|
- name: admin-http
|
|
port: 9090
|
|
targetPort: 9090
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector.yaml
|
|
###
|
|
### Tap Injector
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
ports:
|
|
- name: tap-injector
|
|
port: 443
|
|
targetPort: tap-injector
|
|
---
|
|
# Source: linkerd-viz/templates/tap.yaml
|
|
###
|
|
### Tap
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
ports:
|
|
- name: grpc
|
|
port: 8088
|
|
targetPort: 8088
|
|
- name: apiserver
|
|
port: 443
|
|
targetPort: apiserver
|
|
---
|
|
# Source: linkerd-viz/templates/web.yaml
|
|
###
|
|
### Web
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: web
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
|
|
linkerd.io/inject: enabled
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
ports:
|
|
- name: http
|
|
port: 8084
|
|
targetPort: 8084
|
|
- name: admin-http
|
|
port: 9994
|
|
targetPort: 9994
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.linkerd.io/proxy-await: "enabled"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: metrics-api
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
component: metrics-api
|
|
name: metrics-api
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: b73fb1bf343c4203fbab8ee108c5eba2e07d184177e204677dc83d4cad2cd12b
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
|
|
containers:
|
|
- args:
|
|
- -controller-namespace=linkerd
|
|
- -log-level=info
|
|
- -log-format=plain
|
|
- -cluster-domain=cluster.local
|
|
- -prometheus-url=http://prometheus.linkerd-viz.svc.cluster.local:9090
|
|
- -enable-pprof=false
|
|
image: cr.l5d.io/linkerd/metrics-api:stable-2.14.10
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9995
|
|
initialDelaySeconds: 10
|
|
name: metrics-api
|
|
ports:
|
|
- containerPort: 8085
|
|
name: http
|
|
- containerPort: 9995
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9995
|
|
resources:
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
runAsUser: 2103
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: metrics-api
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.linkerd.io/proxy-await: "enabled"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: prometheus
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
name: prometheus
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- --log.level=info
|
|
- --log.format=logfmt
|
|
- --config.file=/etc/prometheus/prometheus.yml
|
|
- --storage.tsdb.path=/data
|
|
- --storage.tsdb.retention.time=6h
|
|
image: prom/prometheus:v2.48.0
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /-/healthy
|
|
port: 9090
|
|
initialDelaySeconds: 30
|
|
timeoutSeconds: 30
|
|
name: prometheus
|
|
ports:
|
|
- containerPort: 9090
|
|
name: admin-http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /-/ready
|
|
port: 9090
|
|
initialDelaySeconds: 30
|
|
timeoutSeconds: 30
|
|
resources:
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
runAsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
- mountPath: /etc/prometheus/prometheus.yml
|
|
name: prometheus-config
|
|
subPath: prometheus.yml
|
|
readOnly: true
|
|
securityContext:
|
|
fsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: prometheus
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- configMap:
|
|
name: prometheus-config
|
|
name: prometheus-config
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector.yaml
|
|
kind: Deployment
|
|
apiVersion: apps/v1
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.linkerd.io/proxy-await: "enabled"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: tap-injector
|
|
app.kubernetes.io/part-of: Linkerd
|
|
component: tap-injector
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
component: tap-injector
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: 0e0fc0b5f39f25e84594dde44fd06517a5e0a5289d367f87b9c404ce6793af77
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
|
|
containers:
|
|
- args:
|
|
- injector
|
|
- -tap-service-name=tap.linkerd-viz.serviceaccount.identity.linkerd.cluster.local
|
|
- -log-level=info
|
|
- -log-format=plain
|
|
- -enable-pprof=false
|
|
image: cr.l5d.io/linkerd/tap:stable-2.14.10
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9995
|
|
initialDelaySeconds: 10
|
|
name: tap-injector
|
|
ports:
|
|
- containerPort: 8443
|
|
name: tap-injector
|
|
- containerPort: 9995
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9995
|
|
resources:
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 2103
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- mountPath: /var/run/linkerd/tls
|
|
name: tls
|
|
readOnly: true
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: tap-injector
|
|
volumes:
|
|
- name: tls
|
|
secret:
|
|
secretName: tap-injector-k8s-tls
|
|
---
|
|
# Source: linkerd-viz/templates/tap.yaml
|
|
kind: Deployment
|
|
apiVersion: apps/v1
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.linkerd.io/proxy-await: "enabled"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: tap
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: f0b9e964ef7d5ad4c0575a25c35ae38b97f6220063610ba25a54202cc301b3ee
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
|
|
containers:
|
|
- args:
|
|
- api
|
|
- -api-namespace=linkerd
|
|
- -log-level=info
|
|
- -log-format=plain
|
|
- -identity-trust-domain=cluster.local
|
|
- -enable-pprof=false
|
|
image: cr.l5d.io/linkerd/tap:stable-2.14.10
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9998
|
|
initialDelaySeconds: 10
|
|
name: tap
|
|
ports:
|
|
- containerPort: 8088
|
|
name: grpc
|
|
- containerPort: 8089
|
|
name: apiserver
|
|
- containerPort: 9998
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9998
|
|
resources:
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 2103
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- mountPath: /var/run/linkerd/tls
|
|
name: tls
|
|
readOnly: true
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: tap
|
|
volumes:
|
|
- name: tls
|
|
secret:
|
|
secretName: tap-k8s-tls
|
|
---
|
|
# Source: linkerd-viz/templates/web.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.linkerd.io/proxy-await: "enabled"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
component: web
|
|
namespace: linkerd-viz
|
|
name: web
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: enabled
|
|
config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- -linkerd-metrics-api-addr=metrics-api.linkerd-viz.svc.cluster.local:8085
|
|
- -cluster-domain=cluster.local
|
|
- -controller-namespace=linkerd
|
|
- -log-level=info
|
|
- -log-format=plain
|
|
- -enforced-host=^(localhost|127\.0\.0\.1|web\.linkerd-viz\.svc\.cluster\.local|web\.linkerd-viz\.svc|\[::1\])(:\d+)?$
|
|
- -enable-pprof=false
|
|
image: cr.l5d.io/linkerd/web:stable-2.14.10
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9994
|
|
initialDelaySeconds: 10
|
|
name: web
|
|
ports:
|
|
- containerPort: 8084
|
|
name: http
|
|
- containerPort: 9994
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9994
|
|
resources:
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 2103
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: web
|
|
---
|
|
# Source: linkerd-viz/templates/tap-rbac.yaml
|
|
apiVersion: apiregistration.k8s.io/v1
|
|
kind: APIService
|
|
metadata:
|
|
name: v1alpha1.tap.linkerd.io
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
spec:
|
|
group: tap.linkerd.io
|
|
version: v1alpha1
|
|
groupPriorityMinimum: 1000
|
|
versionPriority: 100
|
|
service:
|
|
name: tap
|
|
namespace: linkerd-viz
|
|
caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKakNDQWc2Z0F3SUJBZ0lSQUxRdG9IeHpWR29jTDRITlVJQzNjTmN3RFFZSktvWklodmNOQVFFTEJRQXcKSGpFY01Cb0dBMVVFQXhNVGRHRndMbXhwYm10bGNtUXRkbWw2TG5OMll6QWVGdzB5TmpBek1UUXlNVEV6TXpGYQpGdzB5TnpBek1UUXlNVEV6TXpGYU1CNHhIREFhQmdOVkJBTVRFM1JoY0M1c2FXNXJaWEprTFhacGVpNXpkbU13CmdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURESDlwTW5IZnY1YkovWVpqK3dLU0EKeFR6MkU3MlZlZjIxOFZuS2tsdEMrSGpZanFTdWFNVlhLcURYNG9ZT2FiZHFsZ0pFSjVvOXJwNjVnY084TmdqUQphU2JuZ0U4Zm90UGJUQTRGNmpHb3R3Nm5MbzdlOWZFM294eXRmK1BuMFdJbE9wY1cza1VCMDEzTkRyYzNoL2VNCm51ekpWcmhKUGh6VVJZYmpZTFE4QnJ0c0k5cHYwbW1tZnZ1TVB3VGVhR3o4dGlXK21jdlJxMmpoWStvWUFiSCsKeElRNUZMbHlDZEVpdTJSTXZEdk9Fenk4YXZGUFcwaWFQcWJOaEFjZVRiK2hjMHNoK2RSNS9oVHZjMm9ZZDVBTgpGR1Z3b2hqYnJNYzZCZFAzWktEMlhGVXlXZDd1RzlWTzhZZlNLV3EvUnZoRGwvNThINE5DWE9mcklJS1BNRUNuCkFnTUJBQUdqWHpCZE1BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWVCZ05WSFJFRUZ6QVZnaE4wWVhBdWJHbHVhMlZ5WkMxMgphWG91YzNaak1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQlFOaEFscHloQ2N5Ukh4ejIwR2F3K0VpWFEzZXpJClhQTUtOWmgrenQ5RHN2WllVTy8vdkJhcWN5TzZDNzllb0VPbFE0TndLTWRRZ29CUUZyK3l0Yk5iN1hiNWZ4eGcKVDRhTVBhZkpnYzBLMzlxaHVQUVZuNkVLRGNTSC94SVphQmpLMXkyYWtHT1BuSjdPeXJUN2Y1Wkg2T3VkYkVYRAo4UERqRitJSzJpOWRKUkFKeWFVWW82Mk9VRU16clFHOU5hUEc0MEVvTVZUNGNHQXBYOUZUVHZOTysrZnN6bXk1CndWZTNUa3dZSGdPUTJhckFBVURtK3FEMW9OOG1Lc0gxb0xSNncydTR0U2R2UnRxNlRuUnRGOWhmcFJTWjlickMKeVV0bjFLcmtWQThqVlIrZnZ0b1JId0JUMjNaZDNVZmtJM0kvczdEZ3kzUkJhL0xMdmJaVUhiU1QKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-rbac.yaml
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
name: linkerd-tap-injector-webhook-config
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
webhooks:
|
|
- name: tap-injector.linkerd.io
|
|
clientConfig:
|
|
service:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
path: "/"
|
|
caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRVENDQWltZ0F3SUJBZ0lSQVAwVWVGU0I4cW96WlZnV2xvSWdSL1l3RFFZSktvWklodmNOQVFFTEJRQXcKSnpFbE1DTUdBMVVFQXhNY2RHRndMV2x1YW1WamRHOXlMbXhwYm10bGNtUXRkbWw2TG5OMll6QWVGdzB5TmpBegpNVFF5TVRFek16SmFGdzB5TnpBek1UUXlNVEV6TXpKYU1DY3hKVEFqQmdOVkJBTVRISFJoY0MxcGJtcGxZM1J2CmNpNXNhVzVyWlhKa0xYWnBlaTV6ZG1Nd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFEYXQyM3Z2K0VSQVl2Vi85a1dYTWNiLyt6N3BuRkF3Ykhvb1dESVpYLzhpMjlDRWJmWDVld2tvWk5wYjZtdwpQYkxzMmczUHN6Kzg4UzBrb1pLNDVkN3pLZXFkanNGTXpDNEhQb2JxUUl0RUlHVlpsQU0zTVJLQ1EyRytXUFJnCkI1dkR3aFRJTlR0bGFaakk4SC9OMXkwc3JWU203d0pqS3JVK2F6eVVoTzNoVUtjaVJCYkdVRDFEZFU5ZXZUWmgKMEVLMGhFeDhLYmxkelU1NS9kT2NLWnlVSE9CSjl5UERMbUhUK0M0RG8zZ08rVVVpejRVNUE3NFJyRC9xU1NBVQp0eWMwZDJxNnppeGFaZWFPZ1RaV0paeW5TQnpGTm9zUTRiQkcrTTg0dHMxeVlvdG5EUlRlUjV4cTZxQk5iQ2hFCkcyNjVvcGtRYTNPcitaaklpRDdZQ3IvbkFnTUJBQUdqYURCbU1BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlYKSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQW5CZ05WSFJFRQpJREFlZ2h4MFlYQXRhVzVxWldOMGIzSXViR2x1YTJWeVpDMTJhWG91YzNaak1BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUFIdG8xbXNGcTRJY29pbnIyTjNmNkpoY1hWZ2d3aHNLUmVSME9GZDdZM1FqcTJrc3JCTkI2MWZNbmsKbDJkV243VHR0MjlVeGJ3VE5NNDhYeVdlL0E1bTlnMXN0cjJvMngzNTB2WXVhZ1lzUkdTRlhLSHpyQ2JpcGhTaApQZDZMSm9lK3FTQVl2RkJ6dVZCaTMyU0hmcE15M1VqQzdMM29lQ21vSUt6V1VHRm9OdndrWXhOMktmbDZsT3l3Ci9HN1A1QWc1SWdxYlVqK2szM3lFN2RqNkNUSUFTcVZFSnNyQTB3WU5GcG5CTkNtc0VYbHJxN05scU53N3o0c0wKY25oTWRmNkFxOWQ5dDlrd25SMHdzcDlqc1NJbmRubUllVG1VajROQitvZ3ZaK1Eza1NuZ2g5U05xTkV3TVI4VQp1MGNsalhUZXNhZXFtZzREbmcvRDlkRkVEbXFkCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
|
failurePolicy: Ignore
|
|
admissionReviewVersions: ["v1", "v1beta1"]
|
|
reinvocationPolicy: IfNeeded
|
|
rules:
|
|
- operations: [ "CREATE" ]
|
|
apiGroups: [""]
|
|
apiVersions: ["v1"]
|
|
resources: ["pods"]
|
|
sideEffects: None
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: metrics-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
targetRef:
|
|
group: policy.linkerd.io
|
|
kind: Server
|
|
name: metrics-api
|
|
requiredAuthenticationRefs:
|
|
- group: policy.linkerd.io
|
|
kind: MeshTLSAuthentication
|
|
name: metrics-api-web
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: prometheus-admin
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
targetRef:
|
|
group: policy.linkerd.io
|
|
kind: Server
|
|
name: prometheus-admin
|
|
requiredAuthenticationRefs:
|
|
- kind: ServiceAccount
|
|
name: metrics-api
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: tap-injector
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
targetRef:
|
|
group: policy.linkerd.io
|
|
kind: Server
|
|
name: tap-injector-webhook
|
|
requiredAuthenticationRefs:
|
|
- group: policy.linkerd.io
|
|
kind: NetworkAuthentication
|
|
name: kube-api-server
|
|
---
|
|
# Source: linkerd-viz/templates/tap-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: tap
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
targetRef:
|
|
group: policy.linkerd.io
|
|
kind: Server
|
|
name: tap-api
|
|
requiredAuthenticationRefs:
|
|
- group: policy.linkerd.io
|
|
kind: NetworkAuthentication
|
|
name: kube-api-server
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: MeshTLSAuthentication
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: metrics-api-web
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
identityRefs:
|
|
- kind: ServiceAccount
|
|
name: web
|
|
---
|
|
# Source: linkerd-viz/templates/admin-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: NetworkAuthentication
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: kubelet
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
# Ideally, this should be restricted to the actual set of IPs kubelet uses in
|
|
# a cluster. This can't easily be discovered.
|
|
networks:
|
|
- cidr: "0.0.0.0/0"
|
|
- cidr: "::/0"
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1alpha1
|
|
kind: NetworkAuthentication
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: kube-api-server
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
# Ideally, this should be restricted to the actual set of IPs the kubelet API
|
|
# server uses for webhooks in a cluster. This can't easily be discovered.
|
|
networks:
|
|
- cidr: "0.0.0.0/0"
|
|
- cidr: "::/0"
|
|
---
|
|
# Source: linkerd-viz/templates/metrics-api-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1beta1
|
|
kind: Server
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: metrics-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: metrics-api
|
|
port: http
|
|
proxyProtocol: HTTP/1
|
|
---
|
|
# Source: linkerd-viz/templates/prometheus-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1beta1
|
|
kind: Server
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: prometheus-admin
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: prometheus
|
|
namespace: linkerd-viz
|
|
port: admin-http
|
|
proxyProtocol: HTTP/1
|
|
---
|
|
# Source: linkerd-viz/templates/tap-injector-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1beta1
|
|
kind: Server
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: tap-injector-webhook
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: tap-injector
|
|
port: tap-injector
|
|
proxyProtocol: TLS
|
|
---
|
|
# Source: linkerd-viz/templates/tap-policy.yaml
|
|
apiVersion: policy.linkerd.io/v1beta1
|
|
kind: Server
|
|
metadata:
|
|
namespace: linkerd-viz
|
|
name: tap-api
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
linkerd.io/extension: viz
|
|
component: tap
|
|
port: apiserver
|
|
proxyProtocol: TLS
|
|
---
|
|
# Source: linkerd-viz/templates/service-profiles.yaml
|
|
apiVersion: linkerd.io/v1alpha2
|
|
kind: ServiceProfile
|
|
metadata:
|
|
name: metrics-api.linkerd-viz.svc.cluster.local
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
spec:
|
|
routes:
|
|
- name: POST /api/v1/StatSummary
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/StatSummary
|
|
- name: POST /api/v1/TopRoutes
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/TopRoutes
|
|
- name: POST /api/v1/ListPods
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/ListPods
|
|
- name: POST /api/v1/ListServices
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/ListServices
|
|
- name: POST /api/v1/SelfCheck
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/SelfCheck
|
|
- name: POST /api/v1/Gateways
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/Gateways
|
|
- name: POST /api/v1/Edges
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/Edges
|
|
---
|
|
# Source: linkerd-viz/templates/service-profiles.yaml
|
|
apiVersion: linkerd.io/v1alpha2
|
|
kind: ServiceProfile
|
|
metadata:
|
|
name: prometheus.linkerd-viz.svc.cluster.local
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
spec:
|
|
routes:
|
|
- name: POST /api/v1/query
|
|
condition:
|
|
method: POST
|
|
pathRegex: /api/v1/query
|
|
- name: GET /api/v1/query_range
|
|
condition:
|
|
method: GET
|
|
pathRegex: /api/v1/query_range
|
|
- name: GET /api/v1/series
|
|
condition:
|
|
method: GET
|
|
pathRegex: /api/v1/series
|
|
---
|
|
# Source: linkerd-viz/templates/namespace-metadata-rbac.yaml
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/namespace-metadata-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "patch"]
|
|
resourceNames: ["linkerd-viz"]
|
|
---
|
|
# Source: linkerd-viz/templates/namespace-metadata-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
kind: Role
|
|
name: namespace-metadata
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/namespace-metadata-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
namespace: linkerd
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
name: viz-namespace-metadata-linkerd-config
|
|
roleRef:
|
|
kind: Role
|
|
name: ext-namespace-metadata-linkerd-config
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
---
|
|
# Source: linkerd-viz/templates/namespace-metadata.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "1"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: namespace-metadata
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
name: namespace-metadata
|
|
namespace: linkerd-viz
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm stable-2.14.10
|
|
linkerd.io/inject: disabled
|
|
labels:
|
|
linkerd.io/extension: viz
|
|
app.kubernetes.io/name: namespace-metadata
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: stable-2.14.10
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
restartPolicy: Never
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: namespace-metadata
|
|
containers:
|
|
- name: namespace-metadata
|
|
image: cr.l5d.io/linkerd/extension-init:v0.1.0
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
runAsUser: 2103
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
args:
|
|
- --log-format
|
|
- plain
|
|
- --log-level
|
|
- info
|
|
- --extension
|
|
- viz
|
|
- --namespace
|
|
- linkerd-viz
|
|
- --linkerd-namespace
|
|
- linkerd
|