apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: security
    istio: citadel
  name: istio-citadel
spec:
  replicas: 1
  selector:
    matchLabels:
      istio: citadel
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: security
        istio: citadel
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --sds-enabled=true
        - --append-dns-names=true
        - --grpc-port=8060
        - --citadel-storage-namespace=$(namespace)
        - --custom-dns-names=istio-pilot-service-account.$(namespace):istio-pilot.$(namespace)
        - --monitoring-port=15014
        - --self-signed-ca=true
        - --workload-cert-ttl=2160h
        env:
        - name: CITADEL_ENABLE_NAMESPACES_BY_DEFAULT
          value: "true"
        image: gcr.io/istio-release/citadel:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: citadel
        resources:
          requests:
            cpu: 10m
      serviceAccountName: istio-citadel-service-account

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: galley
    istio: galley
  name: istio-galley
spec:
  replicas: 1
  selector:
    matchLabels:
      istio: galley
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: galley
        istio: galley
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - command:
        - /usr/local/bin/galley
        - server
        - --meshConfigFile=/etc/mesh-config/mesh
        - --livenessProbeInterval=1s
        - --livenessProbePath=/healthliveness
        - --readinessProbePath=/healthready
        - --readinessProbeInterval=1s
        - --deployment-namespace=$(namespace)
        - --insecure=false
        - --validation-webhook-config-file
        - /etc/config/validating-webhook-configuration.yaml
        - --monitoringPort=15014
        - --log_output_level=default:info
        image: gcr.io/istio-release/galley:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        livenessProbe:
          exec:
            command:
            - /usr/local/bin/galley
            - probe
            - --probe-path=/healthliveness
            - --interval=10s
          initialDelaySeconds: 5
          periodSeconds: 5
        name: galley
        ports:
        - containerPort: 443
        - containerPort: 15014
        - containerPort: 9901
        readinessProbe:
          exec:
            command:
            - /usr/local/bin/galley
            - probe
            - --probe-path=/healthready
            - --interval=10s
          initialDelaySeconds: 5
          periodSeconds: 5
        resources:
          requests:
            cpu: 10m
        volumeMounts:
        - mountPath: /etc/certs
          name: certs
          readOnly: true
        - mountPath: /etc/config
          name: config
          readOnly: true
        - mountPath: /etc/mesh-config
          name: mesh-config
          readOnly: true
      serviceAccountName: istio-galley-service-account
      volumes:
      - name: certs
        secret:
          secretName: istio.istio-galley-service-account
      - configMap:
          name: istio-galley-configuration
        name: config
      - configMap:
          name: istio
        name: mesh-config

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
  name: istio-ingressgateway
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: istio-ingressgateway
        istio: ingressgateway
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - proxy
        - router
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --log_output_level=default:info
        - --drainDuration
        - 45s
        - --parentShutdownDuration
        - 1m0s
        - --connectTimeout
        - 10s
        - --serviceCluster
        - istio-ingressgateway
        - --zipkinAddress
        - zipkin:9411
        - --proxyAdminPort
        - "15000"
        - --statusPort
        - "15020"
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
        - --discoveryAddress
        - istio-pilot:15011
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        - name: ISTIO_META_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: ISTIO_META_CONFIG_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: SDS_ENABLED
          value: "true"
        - name: ISTIO_META_WORKLOAD_NAME
          value: istio-ingressgateway
        - name: ISTIO_META_OWNER
          value: kubernetes://api/apps/v1/namespaces/$(namespace)/deployments/istio-ingressgateway
        - name: ISTIO_META_ROUTER_MODE
          value: sni-dnat
        image: gcr.io/istio-release/proxyv2:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: istio-proxy
        ports:
        - containerPort: 15020
        - containerPort: 80
        - containerPort: 443
        - containerPort: 31400
        - containerPort: 15029
        - containerPort: 15030
        - containerPort: 15031
        - containerPort: 15032
        - containerPort: 15443
        - containerPort: 15090
          name: http-envoy-prom
          protocol: TCP
        readinessProbe:
          failureThreshold: 30
          httpGet:
            path: /healthz/ready
            port: 15020
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 2
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - mountPath: /var/run/sds
          name: sdsudspath
          readOnly: true
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /etc/istio/ingressgateway-certs
          name: ingressgateway-certs
          readOnly: true
        - mountPath: /etc/istio/ingressgateway-ca-certs
          name: ingressgateway-ca-certs
          readOnly: true
      serviceAccountName: istio-ingressgateway-service-account
      volumes:
      - hostPath:
          path: /var/run/sds
        name: sdsudspath
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - name: istio-certs
        secret:
          optional: true
          secretName: istio.istio-ingressgateway-service-account
      - name: ingressgateway-certs
        secret:
          optional: true
          secretName: istio-ingressgateway-certs
      - name: ingressgateway-ca-certs
        secret:
          optional: true
          secretName: istio-ingressgateway-ca-certs

---

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9
  labels:
    app: pilot
    istio: pilot
  name: istio-pilot
spec:
  selector:
    matchLabels:
      istio: pilot
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: pilot
        istio: pilot
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - discovery
        - --monitoringAddr=:15014
        - --log_output_level=default:info
        - --domain
        - cluster.local
        - --secureGrpcAddr
        - ""
        - --keepaliveMaxServerConnectionAge
        - 30m
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: GODEBUG
          value: gctrace=1
        - name: PILOT_PUSH_THROTTLE
          value: "100"
        - name: PILOT_TRACE_SAMPLING
          value: "1"
        - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
          value: "true"
        - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
          value: "false"
        image: gcr.io/istio-release/pilot:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: discovery
        ports:
        - containerPort: 8080
        - containerPort: 15010
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 30
          timeoutSeconds: 5
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
        volumeMounts:
        - mountPath: /etc/istio/config
          name: config-volume
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
      - args:
        - proxy
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --serviceCluster
        - istio-pilot
        - --templateFile
        - /etc/istio/proxy/envoy_pilot.yaml.tmpl
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: SDS_ENABLED
          value: "true"
        image: gcr.io/istio-release/proxyv2:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: istio-proxy
        ports:
        - containerPort: 15003
        - containerPort: 15005
        - containerPort: 15007
        - containerPort: 15011
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /var/run/sds
          name: sds-uds-path
          readOnly: true
        - mountPath: /var/run/secrets/tokens
          name: istio-token
      serviceAccountName: istio-pilot-service-account
      volumes:
      - hostPath:
          path: /var/run/sds
        name: sds-uds-path
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - configMap:
          name: istio
        name: config-volume
      - name: istio-certs
        secret:
          optional: true
          secretName: istio.istio-pilot-service-account

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: istio-mixer
    istio: mixer
  name: istio-policy
spec:
  selector:
    matchLabels:
      istio: mixer
      istio-mixer-type: policy
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: policy
        istio: mixer
        istio-mixer-type: policy
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --monitoringPort=15014
        - --address
        - unix:///sock/mixer.socket
        - --log_output_level=default:info
        - --configStoreURL=mcps://istio-galley.$(namespace).svc:9901
        - --configDefaultNamespace=$(namespace)
        - --useAdapterCRDs=false
        - --useTemplateCRDs=false
        - --trace_zipkin_url=http://zipkin.$(namespace):9411/api/v1/spans
        env:
        - name: GODEBUG
          value: gctrace=1
        - name: GOMAXPROCS
          value: "6"
        image: gcr.io/istio-release/mixer:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /version
            port: 15014
          initialDelaySeconds: 5
          periodSeconds: 5
        name: mixer
        ports:
        - containerPort: 15014
        - containerPort: 42422
        resources:
          requests:
            cpu: 10m
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /sock
          name: uds-socket
      - args:
        - proxy
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --serviceCluster
        - istio-policy
        - --templateFile
        - /etc/istio/proxy/envoy_policy.yaml.tmpl
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: SDS_ENABLED
          value: "true"
        image: gcr.io/istio-release/proxyv2:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: istio-proxy
        ports:
        - containerPort: 9091
        - containerPort: 15004
        - containerPort: 15090
          name: http-envoy-prom
          protocol: TCP
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /var/run/sds
          name: sds-uds-path
          readOnly: true
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /sock
          name: uds-socket
        - mountPath: /var/run/secrets/istio.io/policy/adapter
          name: policy-adapter-secret
          readOnly: true
      serviceAccountName: istio-mixer-service-account
      volumes:
      - name: istio-certs
        secret:
          optional: true
          secretName: istio.istio-mixer-service-account
      - hostPath:
          path: /var/run/sds
        name: sds-uds-path
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - name: uds-socket
      - name: policy-adapter-secret
        secret:
          optional: true
          secretName: policy-adapter-secret

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sidecarInjectorWebhook
    istio: sidecar-injector
  name: istio-sidecar-injector
spec:
  replicas: 1
  selector:
    matchLabels:
      istio: sidecar-injector
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: sidecarInjectorWebhook
        istio: sidecar-injector
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --caCertFile=/etc/istio/certs/root-cert.pem
        - --tlsCertFile=/etc/istio/certs/cert-chain.pem
        - --tlsKeyFile=/etc/istio/certs/key.pem
        - --injectConfig=/etc/istio/inject/config
        - --meshConfig=/etc/istio/config/mesh
        - --healthCheckInterval=2s
        - --healthCheckFile=/health
        image: gcr.io/istio-release/sidecar_injector:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        livenessProbe:
          exec:
            command:
            - /usr/local/bin/sidecar-injector
            - probe
            - --probe-path=/health
            - --interval=4s
          initialDelaySeconds: 4
          periodSeconds: 4
        name: sidecar-injector-webhook
        readinessProbe:
          exec:
            command:
            - /usr/local/bin/sidecar-injector
            - probe
            - --probe-path=/health
            - --interval=4s
          initialDelaySeconds: 4
          periodSeconds: 4
        resources:
          requests:
            cpu: 10m
        volumeMounts:
        - mountPath: /etc/istio/config
          name: config-volume
          readOnly: true
        - mountPath: /etc/istio/certs
          name: certs
          readOnly: true
        - mountPath: /etc/istio/inject
          name: inject-config
          readOnly: true
      serviceAccountName: istio-sidecar-injector-service-account
      volumes:
      - configMap:
          name: istio
        name: config-volume
      - name: certs
        secret:
          secretName: istio.istio-sidecar-injector-service-account
      - configMap:
          items:
          - key: config
            path: config
          - key: values
            path: values
          name: istio-sidecar-injector
        name: inject-config

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: istio-mixer
    istio: mixer
  name: istio-telemetry
spec:
  selector:
    matchLabels:
      istio: mixer
      istio-mixer-type: telemetry
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: telemetry
        istio: mixer
        istio-mixer-type: telemetry
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --monitoringPort=15014
        - --address
        - unix:///sock/mixer.socket
        - --log_output_level=default:info
        - --configStoreURL=mcps://istio-galley.$(namespace).svc:9901
        - --certFile=/etc/certs/cert-chain.pem
        - --keyFile=/etc/certs/key.pem
        - --caCertFile=/etc/certs/root-cert.pem
        - --configDefaultNamespace=$(namespace)
        - --useAdapterCRDs=false
        - --trace_zipkin_url=http://zipkin.$(namespace):9411/api/v1/spans
        - --averageLatencyThreshold
        - 100ms
        - --loadsheddingMode
        - enforce
        env:
        - name: GODEBUG
          value: gctrace=1
        - name: GOMAXPROCS
          value: "6"
        image: gcr.io/istio-release/mixer:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /version
            port: 15014
          initialDelaySeconds: 5
          periodSeconds: 5
        name: mixer
        ports:
        - containerPort: 15014
        - containerPort: 42422
        resources:
          limits:
            cpu: 4800m
            memory: 4G
          requests:
            cpu: 1000m
            memory: 1G
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /var/run/secrets/istio.io/telemetry/adapter
          name: telemetry-adapter-secret
          readOnly: true
        - mountPath: /sock
          name: uds-socket
      - args:
        - proxy
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --serviceCluster
        - istio-telemetry
        - --templateFile
        - /etc/istio/proxy/envoy_telemetry.yaml.tmpl
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: SDS_ENABLED
          value: "true"
        image: gcr.io/istio-release/proxyv2:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: istio-proxy
        ports:
        - containerPort: 9091
        - containerPort: 15004
        - containerPort: 15090
          name: http-envoy-prom
          protocol: TCP
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /var/run/sds
          name: sds-uds-path
          readOnly: true
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /sock
          name: uds-socket
      serviceAccountName: istio-mixer-service-account
      volumes:
      - name: istio-certs
        secret:
          optional: true
          secretName: istio.istio-mixer-service-account
      - hostPath:
          path: /var/run/sds
        name: sds-uds-path
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - name: uds-socket
      - name: telemetry-adapter-secret
        secret:
          optional: true
          secretName: telemetry-adapter-secret

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: prometheus
  name: prometheus
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prometheus
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: prometheus
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --storage.tsdb.retention=6h
        - --config.file=/etc/prometheus/prometheus.yaml
        image: docker.io/prom/prometheus:v2.8.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /-/healthy
            port: 9090
        name: prometheus
        ports:
        - containerPort: 9090
          name: http
        readinessProbe:
          httpGet:
            path: /-/ready
            port: 9090
        resources:
          requests:
            cpu: 10m
        volumeMounts:
        - mountPath: /etc/prometheus
          name: config-volume
        - mountPath: /etc/istio-certs
          name: istio-certs
      serviceAccountName: prometheus
      volumes:
      - configMap:
          name: prometheus
        name: config-volume
      - name: istio-certs
        secret:
          defaultMode: 420
          secretName: istio.default
