---
kind: Namespace
apiVersion: v1
metadata:
  name: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
    pod-security.kubernetes.io/enforce: privileged
---
###
### Jaeger Injector
###
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    linkerd.io/extension: jaeger
    app.kubernetes.io/name: jaeger-injector
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: jaeger-injector
  name: jaeger-injector
  namespace: linkerd-jaeger
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      linkerd.io/extension: jaeger
      component: jaeger-injector
  template:
    metadata:
      annotations:
        checksum/config: ef6a752f286d2259e5083a5a8477ccee1dfbaebb7b1c35374e7f8d8fe305aaff
        linkerd.io/inject: enabled
        config.linkerd.io/proxy-await: "enabled"
        config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
      labels:
        linkerd.io/extension: jaeger
        component: jaeger-injector
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      
      automountServiceAccountToken: false
      containers:
      - args:
        - -collector-svc-addr=collector.linkerd-jaeger:4317
        - -collector-trace-protocol=opentelemetry
        - -collector-trace-svc-name=linkerd-proxy
        - -collector-svc-account=collector
        - -log-level=info
        - -cluster-domain=cluster.local
        - -linkerd-namespace=linkerd
        - -enable-pprof=false
        image: cr.l5d.io/linkerd/jaeger-webhook:dev-undefined
        livenessProbe:
          httpGet:
            path: /ping
            port: 9995
          initialDelaySeconds: 10
        name: jaeger-injector
        ports:
        - containerPort: 8443
          name: jaeger-injector
        - containerPort: 9995
          name: admin
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9995
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 2103
          runAsGroup: 2103
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /var/run/linkerd/tls
          name: tls
          readOnly: true
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kube-api-access
          readOnly: true
        resources:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: jaeger-injector
      volumes:
      - name: tls
        secret:
          secretName: jaeger-injector-k8s-tls
      - name: kube-api-access
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
---
kind: Service
apiVersion: v1
metadata:
  name: jaeger-injector
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
    component: jaeger-injector
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: jaeger
    component: jaeger-injector
  ports:
  - name: jaeger-injector
    port: 443
    targetPort: jaeger-injector
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: jaeger-injector-webhook
  labels:
    linkerd.io/extension: jaeger
    component: jaeger-injector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      linkerd.io/extension: jaeger
      component: jaeger-injector
  port: jaeger-injector
  proxyProtocol: TLS
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: jaeger-injector
  labels:
    linkerd.io/extension: jaeger
    component: jaeger-injector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: jaeger-injector-webhook
  requiredAuthenticationRefs:
  - group: policy.linkerd.io
    kind: NetworkAuthentication
    name: kube-api-server
---
apiVersion: policy.linkerd.io/v1alpha1
kind: NetworkAuthentication
metadata:
  namespace: linkerd-jaeger
  name: kube-api-server
  labels:
    linkerd.io/extension: viz
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  # Ideally, this should be restricted to the actual set of IPs the kube-api
  # server uses for webhooks in a cluster. This can't easily be discovered.
  networks:
  - cidr: "0.0.0.0/0"
  - cidr: "::/0"
---
###
### collector RBAC
###
kind: ServiceAccount
apiVersion: v1
metadata:
  name: collector
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: collector
  labels:
    linkerd.io/extension: jaeger
rules:
- apiGroups: [""]
  resources: ["pods", "namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["daemonsets", "replicasets", "statefulsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: collector
  labels:
    linkerd.io/extension: jaeger
subjects:
- kind: ServiceAccount
  name: collector
  namespace: linkerd-jaeger
roleRef:
  kind: ClusterRole
  name: collector
  apiGroup: rbac.authorization.k8s.io
---
###
### Jaeger Injector RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-jaeger-injector
  labels:
    linkerd.io/extension: jaeger
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-jaeger-injector
  labels:
    linkerd.io/extension: jaeger
subjects:
- kind: ServiceAccount
  name: jaeger-injector
  namespace: linkerd-jaeger
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: linkerd-jaeger-injector
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: jaeger-injector
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: linkerd-jaeger-injector-webhook-config
  labels:
    linkerd.io/extension: jaeger
webhooks:
- name: jaeger-injector.linkerd.io
  namespaceSelector:
    matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      - kube-system
  clientConfig:
    service:
      name: jaeger-injector
      namespace: linkerd-jaeger
      path: "/"
    caBundle: dGVzdC13ZWJob29rLWNhLWJ1bmRsZQ==
  failurePolicy: Ignore
  admissionReviewVersions: ["v1", "v1beta1"]
  reinvocationPolicy: IfNeeded
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    scope: "Namespaced"
  sideEffects: None
---
###
### jaeger RBAC
###
kind: ServiceAccount
apiVersion: v1
metadata:
  name: jaeger
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
---
###
### Tracing Collector Service
###
apiVersion: v1
kind: ConfigMap
metadata:
  name: collector-config
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
    component: collector
data:
  collector-config: |
    exporters:
      jaeger:
        endpoint: jaeger.${POD_NAMESPACE}:14250
        tls:
          insecure: true
    extensions:
      health_check: null
    processors:
      batch: null
      k8sattributes:
        auth_type: serviceAccount
        extract:
          labels:
          - from: pod
            key: app.kubernetes.io/name
            tag_name: kube_app_name
          - from: pod
            key: app.kubernetes.io/instance
            tag_name: kube_app_instance
          - from: pod
            key: app.kubernetes.io/version
            tag_name: kube_app_version
          - from: pod
            key: app.kubernetes.io/component
            tag_name: kube_app_component
          - from: pod
            key: app.kubernetes.io/part-of
            tag_name: kube_app_part_of
          - from: pod
            key: app.kubernetes.io/managed-by
            tag_name: kube_app_managed_by
          metadata:
          - k8s.pod.name
          - k8s.pod.uid
          - k8s.deployment.name
          - k8s.node.name
          - k8s.namespace.name
          - k8s.pod.start_time
          - k8s.replicaset.name
          - k8s.replicaset.uid
          - k8s.daemonset.name
          - k8s.daemonset.uid
          - k8s.job.name
          - k8s.job.uid
          - k8s.cronjob.name
          - k8s.statefulset.name
          - k8s.statefulset.uid
          - container.image.name
          - container.image.tag
          - container.id
          - k8s.container.name
          - container.image.name
          - container.image.tag
          - container.id
        pod_association:
        - sources:
          - from: resource_attribute
            name: k8s.pod.name
          - from: resource_attribute
            name: k8s.namespace.name
      resource:
        attributes:
        - action: insert
          from_attribute: host.name
          key: k8s.pod.name
        - action: insert
          from_attribute: linkerd.io/workload-ns
          key: k8s.namespace.name
    receivers:
      opencensus: null
      otlp:
        protocols:
          grpc: null
    service:
      extensions:
      - health_check
      pipelines:
        traces:
          exporters:
          - jaeger
          processors:
          - resource
          - k8sattributes
          - batch
          receivers:
          - opencensus
          - otlp
---
apiVersion: v1
kind: Service
metadata:
  name: collector
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
    component: collector
spec:
  type: ClusterIP
  ports:
  - name: otlp
    port: 4317
    protocol: TCP
    targetPort: 4317
  - name: otlp-http
    port: 4318
    protocol: TCP
    targetPort: 4318
  - name: opencensus
    port: 55678
    protocol: TCP
    targetPort: 55678
  - name: zipkin
    port: 9411
    protocol: TCP
    targetPort: 9411
  - name: jaeger-thrift
    port: 14268
    protocol: TCP
    targetPort: 14268
  - name: jaeger-grpc
    port: 14250
    protocol: TCP
    targetPort: 14250
  selector:
    component: collector
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    linkerd.io/extension: jaeger
    app.kubernetes.io/name: collector
    app.kubernetes.io/part-of: Linkerd
    component: collector
  name: collector
  namespace: linkerd-jaeger
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      component: collector
  minReadySeconds: 5
  progressDeadlineSeconds: 120
  template:
    metadata:
      annotations:
        checksum/config: a5b9a0f939a556548f732f80a6cfe7b27a55f1c309ad2decacd1ce63d469d4a3
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        config.alpha.linkerd.io/proxy-wait-before-exit-seconds: "0"
        config.linkerd.io/proxy-await: "enabled"
        linkerd.io/inject: enabled
        prometheus.io/path: /metrics
        prometheus.io/port: "8888"
        prometheus.io/scrape: "true"
      labels:
        linkerd.io/extension: jaeger
        component: collector
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      
      automountServiceAccountToken: false
      containers:
      - command:
        - /otelcol-contrib
        - --config=/conf/collector-config.yaml
        env:
        - name: GOGC
          value: "80"
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        image: otel/opentelemetry-collector-contrib:0.83.0
        livenessProbe:
          httpGet:
            path: /
            port: 13133
        name: ot-collector
        ports:
        - containerPort: 13133
        - containerPort: 4317
        - containerPort: 4318
        - containerPort: 55678
        - containerPort: 9411
        - containerPort: 14268
        - containerPort: 14250
        - containerPort: 8888
        readinessProbe:
          httpGet:
            path: /
            port: 13133
        resources:
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 2103
          runAsGroup: 2103
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /conf
          name: collector-config-val
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kube-api-access
          readOnly: true
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: collector
      volumes:
      - configMap:
          items:
          - key: collector-config
            path: collector-config.yaml
          name: collector-config
        name: collector-config-val
      - name: kube-api-access
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
---
###
### Tracing Jaeger Service
###
apiVersion: v1
kind: Service
metadata:
  name: jaeger
  namespace: linkerd-jaeger
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
spec:
  type: ClusterIP
  selector:
    component: jaeger
  ports:
    - name: collection
      port: 14268
    - name: grpc
      port: 14250
    - name: ui
      port: 16686
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    linkerd.io/extension: jaeger
    app.kubernetes.io/name: jaeger
    app.kubernetes.io/part-of: Linkerd
    component: jaeger
  name: jaeger
  namespace: linkerd-jaeger
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      component: jaeger
  template:
    metadata:
      annotations:
        linkerd.io/inject: enabled
        config.linkerd.io/proxy-await: "enabled"
        prometheus.io/path: /metrics
        prometheus.io/port: "14269"
        prometheus.io/scrape: "true"
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
      labels:
        linkerd.io/extension: jaeger
        component: jaeger
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      
      automountServiceAccountToken: false
      containers:
      - args:
        - --query.base-path=/jaeger
        image: jaegertracing/all-in-one:1.31
        name: jaeger
        ports:
        - containerPort: 14269
          name: admin
        - containerPort: 14268
          name: collection
        - containerPort: 14250
          name: grpc
        - containerPort: 16686
          name: ui
        resources:
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 2103
          runAsGroup: 2103
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kube-api-access
          readOnly: true
      dnsPolicy: ClusterFirst
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: jaeger
      volumes:
      - name: kube-api-access
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-otlp
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 4317
  proxyProtocol: gRPC
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-otlp-http
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 4318
  proxyProtocol: HTTP/1
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-opencensus
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 55678
  proxyProtocol: gRPC
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-zipkin
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 9411
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-jaeger-thrift
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 14268
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-jaeger-grpc
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 14250
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: collector-admin
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: collector
  port: 13133
  proxyProtocol: HTTP/1
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-otlp
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-otlp
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-otlp-http
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-otlp-http
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-opencensus
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-opencensus
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-zipkin
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-zipkin
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-jaeger-thrift
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-jaeger-thrift
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: collector-jaeger-grpc
  labels:
    linkerd.io/extension: jaeger
    component: collector
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: collector-jaeger-grpc
  # allow connections from any pod (meshed or not) sending trace data
  requiredAuthenticationRefs: []
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: jaeger-grpc
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: jaeger
  port: grpc
  proxyProtocol: gRPC
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: jaeger-grpc
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: jaeger-grpc
  requiredAuthenticationRefs:
    - kind: ServiceAccount
      name: collector
      namespace: linkerd-jaeger
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: jaeger-admin
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: jaeger
  port: admin
  proxyProtocol: HTTP/1
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: jaeger-admin
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: jaeger-admin
  requiredAuthenticationRefs:
    # if not using linkerd-viz' prometheus, replace its SA here
    - kind: ServiceAccount
      name: prometheus
      namespace: linkerd-viz
---
apiVersion: policy.linkerd.io/v1beta3
kind: Server
metadata:
  namespace: linkerd-jaeger
  name: jaeger-ui
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  podSelector:
    matchLabels:
      component: jaeger
  port: ui
  proxyProtocol: HTTP/1
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
  namespace: linkerd-jaeger
  name: jaeger-ui
  labels:
    linkerd.io/extension: jaeger
    component: jaeger
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
spec:
  targetRef:
    group: policy.linkerd.io
    kind: Server
    name: jaeger-ui
  requiredAuthenticationRefs:
    # for the optional dashboard integration
    - kind: ServiceAccount
      name: web
      namespace: linkerd-viz
