linkerd
/
linkerd2
mirror of https://github.com/linkerd/linkerd2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

viz: add tap-injector (#5540) 

## What this changes

This adds a tap-injector component to the `linkerd-viz` extension which is
responsible for adding the tap service name environment variable to the Linkerd
proxy container.

If a pod does not have a Linkerd proxy, no action is taken. If tap is disabled
via annotation on the pod or the namespace, no action is taken.

This also removes the environment variable for explicitly disabling tap through
an environment variable. Tap status for a proxy is now determined only be the
presence or absence of the tap service name environment variable.

Closes #5326

## How it changes

### tap-injector

The tap-injector component determines if `LINKERD2_PROXY_TAP_SVC_NAME` should be
added to a pod's Linkerd proxy container environment. If the pod satisfies the
following, it is added:

- The pod has a Linkerd proxy container
- The pod has not already been mutated
- Tap is not disabled via annotation on the pod or the pod's namespace

### LINKERD2_PROXY_TAP_DISABLED

Now that tap is an extension of Linkerd and not a core component, it no longer
made sense to explicitly enable or disable tap through this Linkerd proxy
environment variable. The status of tap is now determined only be if the
tap-injector adds or does not add the `LINKERD2_PROXY_TAP_SVC_NAME` environment
variable.

### controller image

The tap-injector has been added to the controller image's several startup
commands which determines what it will do in the cluster.

As a follow-up, I think splitting out the `tap` and `tap-injector` commands from
the controller image into a linkerd-viz image (or something like that) makes
sense.

Signed-off-by: Kevin Leimkuhler <kevin@kleimkuhler.com>
This commit is contained in:
Kevin Leimkuhler 2021-01-21 11:24:08 -05:00 committed by GitHub
parent 6f954c3823
commit e7f2a3fba3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
62 changed files with 764 additions and 245 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
charts/partials/templates/_proxy.tpl
View File

@ -90,13 +90,6 @@ env:
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
{{ end -}}
{{ if .Values.global.proxy.disableTap -}}
- name: LINKERD2_PROXY_TAP_DISABLED
value: "true"
{{ else if not .Values.global.proxy.disableIdentity -}}
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
{{ end -}}
image: {{.Values.global.proxy.image.name}}:{{.Values.global.proxy.image.version}}
imagePullPolicy: {{.Values.global.proxy.image.pullPolicy}}
livenessProbe:

2
cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml vendored
View File

@ -96,8 +96,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

4
cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml vendored
View File

@ -96,8 +96,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -265,8 +263,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml vendored
View File

@ -96,8 +96,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_contour.golden.yml vendored
View File

@ -125,8 +125,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

8
cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml vendored
View File

@ -107,8 +107,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -287,8 +285,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -467,8 +463,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -647,8 +641,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment.golden.yml vendored
View File

@ -107,8 +107,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml vendored
View File

@ -115,8 +115,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml vendored
View File

@ -118,8 +118,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_DISABLED
value: "true"
image: ghcr.io/linkerd/proxy:override
imagePullPolicy: IfNotPresent
livenessProbe:

4
cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml vendored
View File

@ -107,8 +107,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -287,8 +285,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml vendored
View File

@ -112,8 +112,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml vendored
View File

@ -107,8 +107,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml vendored
View File

@ -108,8 +108,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml vendored
View File

@ -107,8 +107,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml vendored
View File

@ -108,8 +108,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml vendored
View File

@ -109,8 +109,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml vendored
View File

@ -109,8 +109,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

4
cli/cmd/testdata/inject_emojivoto_list.golden.yml vendored
View File

@ -109,8 +109,6 @@ items:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -283,8 +281,6 @@ items:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

4
cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml vendored
View File

@ -109,8 +109,6 @@ items:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -283,8 +281,6 @@ items:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_pod.golden.yml vendored
View File

@ -92,8 +92,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml vendored
View File

@ -94,8 +94,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml vendored
View File

@ -96,8 +96,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml vendored
View File

@ -108,8 +108,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

4
cli/cmd/testdata/inject_gettest_deployment.good.golden.yml vendored
View File

@ -109,8 +109,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:testinjectversion
imagePullPolicy: IfNotPresent
livenessProbe:
@ -291,8 +289,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:testinjectversion
imagePullPolicy: IfNotPresent
livenessProbe:

2
cli/cmd/testdata/inject_tap_deployment_debug.golden.yml vendored
View File

@ -160,8 +160,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-inject-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_controlplane_tracing_output.golden vendored
View File

@ -915,8 +915,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1150,8 +1148,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1403,8 +1399,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1663,8 +1657,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1918,8 +1910,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_custom_registry.golden vendored
View File

@ -914,8 +914,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: my.custom.registry/linkerd-io/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1148,8 +1146,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: my.custom.registry/linkerd-io/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1400,8 +1396,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: my.custom.registry/linkerd-io/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1660,8 +1654,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: my.custom.registry/linkerd-io/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1915,8 +1907,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: my.custom.registry/linkerd-io/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_default.golden vendored
View File

@ -914,8 +914,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1148,8 +1146,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1400,8 +1396,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1660,8 +1654,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1915,8 +1907,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_default_override_dst_get_nets.golden vendored
View File

@ -914,8 +914,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1148,8 +1146,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1400,8 +1396,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1660,8 +1654,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1915,8 +1907,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_ha_output.golden vendored
View File

@ -995,8 +995,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1279,8 +1277,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1581,8 +1577,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1881,8 +1875,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -2202,8 +2194,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_ha_with_overrides_output.golden vendored
View File

@ -995,8 +995,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1279,8 +1277,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1581,8 +1577,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1881,8 +1875,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -2202,8 +2194,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_heartbeat_disabled_output.golden vendored
View File

@ -870,8 +870,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1104,8 +1102,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1356,8 +1352,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1570,8 +1564,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1825,8 +1817,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_helm_output.golden vendored
View File

@ -907,8 +907,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1132,8 +1130,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1375,8 +1371,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1628,8 +1622,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1874,8 +1866,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_helm_output_ha.golden vendored
View File

@ -988,8 +988,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1263,8 +1261,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1556,8 +1552,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1849,8 +1843,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -2161,8 +2153,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_helm_output_ha_labels.golden vendored
View File

@ -996,8 +996,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1275,8 +1273,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1572,8 +1568,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1873,8 +1867,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -2189,8 +2181,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden vendored
View File

@ -988,8 +988,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1263,8 +1261,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1556,8 +1552,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1849,8 +1843,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -2161,8 +2153,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:test-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_no_init_container.golden vendored
View File

@ -911,8 +911,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1107,8 +1105,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1321,8 +1317,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1543,8 +1537,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1760,8 +1752,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

10
cli/cmd/testdata/install_output.golden vendored
View File

@ -910,8 +910,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ProxyImageName:ProxyVersion
imagePullPolicy: ImagePullPolicy
livenessProbe:
@ -1146,8 +1144,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ProxyImageName:ProxyVersion
imagePullPolicy: ImagePullPolicy
livenessProbe:
@ -1400,8 +1396,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ProxyImageName:ProxyVersion
imagePullPolicy: ImagePullPolicy
livenessProbe:
@ -1662,8 +1656,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ProxyImageName:ProxyVersion
imagePullPolicy: ImagePullPolicy
livenessProbe:
@ -1919,8 +1911,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ProxyImageName:ProxyVersion
imagePullPolicy: ImagePullPolicy
livenessProbe:

10
cli/cmd/testdata/install_proxy_ignores.golden vendored
View File

@ -914,8 +914,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1148,8 +1146,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1400,8 +1396,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1660,8 +1654,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:
@ -1915,8 +1907,6 @@ spec:
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
- name: LINKERD2_PROXY_TAP_SVC_NAME
value: linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/proxy:install-proxy-version
imagePullPolicy: IfNotPresent
livenessProbe:

3
controller/cmd/main.go
View File

@ -11,6 +11,7 @@ import (
publicapi "github.com/linkerd/linkerd2/controller/cmd/public-api"
spvalidator "github.com/linkerd/linkerd2/controller/cmd/sp-validator"
"github.com/linkerd/linkerd2/controller/cmd/tap"
tapinjector "github.com/linkerd/linkerd2/controller/cmd/tap-injector"
servicemirror "github.com/linkerd/linkerd2/multicluster/cmd/service-mirror"
)
@ -35,6 +36,8 @@ func main() {
spvalidator.Main(os.Args[2:])
case "tap":
tap.Main(os.Args[2:])
case "tap-injector":
tapinjector.Main(os.Args[2:])
case "service-mirror":
servicemirror.Main(os.Args[2:])
default:

31
controller/cmd/tap-injector/main.go Normal file
View File

@ -0,0 +1,31 @@
package tapinjector
import (
"context"
"flag"
"fmt"
"github.com/linkerd/linkerd2/controller/k8s"
tapinjector "github.com/linkerd/linkerd2/controller/tap-injector"
"github.com/linkerd/linkerd2/controller/webhook"
"github.com/linkerd/linkerd2/pkg/flags"
)
// Main executes the tap-injector subcommand
func Main(args []string) {
cmd := flag.NewFlagSet("tap-injector", flag.ExitOnError)
metricsAddr := cmd.String("metrics-addr", fmt.Sprintf(":%d", 9995), "address to serve scrapable metrics on")
addr := cmd.String("addr", ":8443", "address to serve on")
kubeconfig := cmd.String("kubeconfig", "", "path to kubeconfig")
tapSvcName := cmd.String("tap-service-name", "", "name of the tap service")
flags.ConfigureAndParse(cmd, args)
webhook.Launch(
context.Background(),
[]k8s.APIResource{k8s.NS},
tapinjector.Mutate(*tapSvcName),
"tap-injector",
*metricsAddr,
*addr,
*kubeconfig,
)
}

4
controller/proxy-injector/fake/data/pod-with-debug.patch.json
View File

@ -183,10 +183,6 @@
{
"name": "LINKERD2_PROXY_IDENTITY_DISABLED",
"value": "disabled"
},
{
"name": "LINKERD2_PROXY_TAP_DISABLED",
"value": "true"
}
],
"image": "ghcr.io/linkerd/proxy:dev-undefined",

4
controller/proxy-injector/fake/data/pod.patch.json
View File

@ -173,10 +173,6 @@
{
"name": "LINKERD2_PROXY_IDENTITY_DISABLED",
"value": "disabled"
},
{
"name": "LINKERD2_PROXY_TAP_DISABLED",
"value": "true"
}
],
"image": "ghcr.io/linkerd/proxy:dev-undefined",

12
controller/tap-injector/patch.go Normal file
View File

@ -0,0 +1,12 @@
package tapinjector
const tpl = `[
{
"op": "add",
"path": "/spec/containers/{{.ProxyIndex}}/env/-",
"value": {
"name": "LINKERD2_PROXY_TAP_SVC_NAME",
"value": "{{.ProxyTapSvcName}}"
}
}
]`

83
controller/tap-injector/webhook.go Normal file
View File

@ -0,0 +1,83 @@
package tapinjector
import (
"bytes"
"context"
"html/template"
"github.com/ghodss/yaml"
"github.com/linkerd/linkerd2/controller/k8s"
"github.com/linkerd/linkerd2/controller/webhook"
labels "github.com/linkerd/linkerd2/pkg/k8s"
"github.com/prometheus/common/log"
admissionv1beta1 "k8s.io/api/admission/v1beta1"
corev1 "k8s.io/api/core/v1"
"k8s.io/client-go/tools/record"
)
// Params holds the values used in the patch template.
type Params struct {
ProxyIndex int
ProxyTapSvcName string
}
// Mutate mutates an AdmissionRequest and adds the LINKERD2_PROXY_TAP_SVC_NAME
// env var to a pod's proxy container if tap is not disabled via annotation on the
// pod or the namespace.
func Mutate(tapSvcName string) webhook.Handler {
return func(
ctx context.Context,
k8sAPI *k8s.API,
request *admissionv1beta1.AdmissionRequest,
recorder record.EventRecorder,
) (*admissionv1beta1.AdmissionResponse, error) {
log.Debugf("request object bytes: %s", request.Object.Raw)
admissionResponse := &admissionv1beta1.AdmissionResponse{
UID: request.UID,
Allowed: true,
}
var pod *corev1.Pod
if err := yaml.Unmarshal(request.Object.Raw, &pod); err != nil {
return nil, err
}
params := Params{
ProxyIndex: webhook.GetProxyContainerIndex(pod.Spec.Containers),
ProxyTapSvcName: tapSvcName,
}
if params.ProxyIndex < 0 {
return admissionResponse, nil
}
if alreadyMutated(pod.Spec.Containers[params.ProxyIndex]) {
return admissionResponse, nil
}
namespace, err := k8sAPI.NS().Lister().Get(request.Namespace)
if err != nil {
return nil, err
}
var t *template.Template
if labels.IsTapDisabled(namespace) || labels.IsTapDisabled(pod) {
return admissionResponse, nil
}
t, err = template.New("tpl").Parse(tpl)
if err != nil {
return nil, err
}
var patchJSON bytes.Buffer
if err = t.Execute(&patchJSON, params); err != nil {
return nil, err
}
patchType := admissionv1beta1.PatchTypeJSONPatch
admissionResponse.Patch = patchJSON.Bytes()
admissionResponse.PatchType = &patchType
return admissionResponse, nil
}
}
func alreadyMutated(container corev1.Container) bool {
for _, envVar := range container.Env {
if envVar.Name == "LINKERD2_PROXY_TAP_SVC_NAME" {
return true
}
}
return false
}

17
controller/webhook/util.go Normal file
View File

@ -0,0 +1,17 @@
package webhook
import (
labels "github.com/linkerd/linkerd2/pkg/k8s"
corev1 "k8s.io/api/core/v1"
)
// GetProxyContainerIndex gets the proxy container index of a pod; the index
// is required in webhooks because of how patches are created.
func GetProxyContainerIndex(containers []corev1.Container) int {
for i, c := range containers {
if c.Name == labels.ProxyContainerName {
return i
}
}
return -1
}

11
jaeger/injector/mutator/webhook.go
View File

@ -56,7 +56,7 @@ func Mutate(collectorSvcAddr, collectorSvcAccount string) webhook.Handler {
}
params := Params{
ProxyIndex: getProxyContainerIndex(pod.Spec.Containers),
ProxyIndex: webhook.GetProxyContainerIndex(pod.Spec.Containers),
CollectorSvcAddr: collectorSvcAddr,
CollectorSvcAccount: collectorSvcAccount,
}
@ -88,15 +88,6 @@ func Mutate(collectorSvcAddr, collectorSvcAccount string) webhook.Handler {
}
}
func getProxyContainerIndex(containers []corev1.Container) int {
for i, c := range containers {
if c.Name == labels.ProxyContainerName {
return i
}
}
return -1
}
func alreadyMutated(pod *corev1.Pod, proxyIndex int) bool {
for _, v := range pod.Spec.Volumes {
if v.DownwardAPI != nil && v.Name == "podinfo" {

15
pkg/k8s/labels.go
View File

@ -478,10 +478,17 @@ func IsMeshed(pod *corev1.Pod, controllerNS string) bool {
return pod.Labels[ControllerNSLabel] == controllerNS
}
// IsTapDisabled returns true if the pod has an annotation for explicitly
// disabling tap
func IsTapDisabled(pod *corev1.Pod) bool {
if valStr := pod.Annotations[ProxyDisableTapAnnotation]; valStr != "" {
// IsTapDisabled returns true if a namespace or pod has an annotation for
// explicitly disabling tap
func IsTapDisabled(obj interface{}) bool {
var valStr string
switch resource := obj.(type) {
case *corev1.Pod:
valStr = resource.GetAnnotations()[ProxyDisableTapAnnotation]
case *corev1.Namespace:
valStr = resource.GetAnnotations()[ProxyDisableTapAnnotation]
}
if valStr != "" {
valBool, err := strconv.ParseBool(valStr)
if err == nil && valBool {
return true

2
test/integration/install_test.go
View File

@ -496,6 +496,7 @@ func TestInstallHelm(t *testing.T) {
"--set", "dashboard.image.tag=" + TestHelper.GetVersion(),
"--set", "grafana.image.tag=" + TestHelper.GetVersion(),
"--set", "tap.image.tag=" + TestHelper.GetVersion(),
"--set", "tapInjector.image.tag=" + TestHelper.GetVersion(),
}
// Install Viz Extension Chart
if stdout, stderr, err := TestHelper.HelmInstallPlain(vizChart, "l5d-viz", vizArgs...); err != nil {
@ -605,6 +606,7 @@ func TestUpgradeHelm(t *testing.T) {
"--set", "dashboard.image.tag=" + TestHelper.GetVersion(),
"--set", "grafana.image.tag=" + TestHelper.GetVersion(),
"--set", "tap.image.tag=" + TestHelper.GetVersion(),
"--set", "tapInjector.image.tag=" + TestHelper.GetVersion(),
"--wait",
}
// Install Viz Extension Chart

3
test/integration/stat/stat_test.go
View File

@ -80,6 +80,7 @@ func TestCliStatForLinkerdNamespace(t *testing.T) {
"linkerd-prometheus": "1/1",
"linkerd-tap": "1/1",
"linkerd-web": "1/1",
"tap-injector": "1/1",
},
},
{
@ -116,7 +117,7 @@ func TestCliStatForLinkerdNamespace(t *testing.T) {
{
args: []string{"viz", "stat", "ns", TestHelper.GetVizNamespace()},
expectedRows: map[string]string{
TestHelper.GetVizNamespace(): "4/4",
TestHelper.GetVizNamespace(): "5/5",
},
},
{

11
testutil/inject_validator.go
View File

@ -77,6 +77,15 @@ func (iv *InjectValidator) validateEnvVar(container *v1.Container, envName, expe
return fmt.Errorf("cannot find env: %s", envName)
}
func (iv *InjectValidator) validateNoEnvVar(container *v1.Container, envName string) error {
for _, env := range container.Env {
if env.Name == envName {
return fmt.Errorf("env: %s, expected to not be set, actual %s", envName, env.Value)
}
}
return nil
}
func (iv *InjectValidator) validatePort(container *v1.Container, portName string, expectedValue int) error {
for _, port := range container.Ports {
if port.Name == portName {
@ -129,7 +138,7 @@ func (iv *InjectValidator) validateProxyContainer(pod *v1.PodSpec) error {
}
if iv.DisableTap {
if err := iv.validateEnvVar(proxyContainer, "LINKERD2_PROXY_TAP_DISABLED", enabled); err != nil {
if err := iv.validateNoEnvVar(proxyContainer, "LINKERD2_PROXY_TAP_SVC"); err != nil {
return err
}
}

23
viz/charts/linkerd-viz/README.md
View File

@ -71,7 +71,7 @@ Kubernetes: `>=1.13.0-0`
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| clusterDomain | string | `"cluster.local"` | Kubernetes DNS Domain name to use |
| clusterDomain | string | `"cluster.local"` | Kubernetes DNS Domain name to use |
| createdByAnnotation | string | `"linkerd.io/created-by"` | |
| dashboard.UID | int | `2103` | |
| dashboard.enforcedHostRegexp | string | `""` | Host header validation regex for the dashboard. See the [Linkerd documentation](https://linkerd.io/2/tasks/exposing-dashboard) for more information |
@ -99,7 +99,7 @@ Kubernetes: `>=1.13.0-0`
| grafana.resources.cpu.request | string | `nil` | Amount of CPU units that the grafana container requests |
| grafana.resources.memory.limit | string | `nil` | Maximum amount of memory that grafana container can use |
| grafana.resources.memory.request | string | `nil` | Amount of memory that the grafana container requests |
| identityTrustDomain | string | `"cluster.local"` | Trust domain used for identity |
| identityTrustDomain | string | `"cluster.local"` | Trust domain used for identity |
| imagePullSecrets | list | `[]` | For Private docker registries, authentication is needed. Registry secrets are applied to the respective service accounts |
| installNamespace | bool | `true` | Set to false when installing in a custom namespace. |
| linkerdNamespace | string | `"linkerd"` | Namespace of the Linkerd core control-plane install |
@ -132,7 +132,7 @@ Kubernetes: `>=1.13.0-0`
| tap.image.name | string | `"controller"` | Docker image name for the tap instance |
| tap.image.registry | string | `"ghcr.io/linkerd"` | Docker registry for the tap instance |
| tap.image.tag | string | `"linkerdVersionValue"` | Docker image tag for the tap instance |
| tap.keyPEM | string | `""` | Certificate key for Tap component. If not provided then Helm will generate one. |
| tap.keyPEM | string | `""` | Certificate key for Tap component. If not provided then Helm will generate one. |
| tap.logLevel | string | `"info"` | log level of the tap component |
| tap.proxy | string | `nil` | |
| tap.replicas | int | `1` | |
@ -140,6 +140,23 @@ Kubernetes: `>=1.13.0-0`
| tap.resources.cpu.request | string | `nil` | Amount of CPU units that the tap container requests |
| tap.resources.memory.limit | string | `nil` | Maximum amount of memory that tap container can use |
| tap.resources.memory.request | string | `nil` | Amount of memory that the tap container requests |
| tapInjector.UID | int | `2103` | |
| tapInjector.caBundle | string | `""` | Bundle of CA certificates for the tapInjector. If not provided then Helm will use the certificate generated for `tapInjector.crtPEM`. If `tapInjector.externalSecret` is set to true, this value must be set, as no certificate will be generated. |
| tapInjector.crtPEM | string | `""` | Certificate for the tapInjector. If not provided then Helm will generate one. |
| tapInjector.externalSecret | bool | `false` | Do not create a secret resource for the tapInjector webhook. If this is set to `true`, the value `tapInjector.caBundle` must be set (see below) |
| tapInjector.failurePolicy | string | `"Ignore"` | |
| tapInjector.image.name | string | `"controller"` | Docker image name for the tapInjector instance |
| tapInjector.image.registry | string | `"ghcr.io/linkerd"` | Docker registry for the tapInjector instance |
| tapInjector.image.tag | string | `"linkerdVersionValue"` | Docker image tag for the tapInjector instance |
| tapInjector.keyPEM | string | `""` | Certificate key for the tapInjector. If not provided then Helm will generate one. |
| tapInjector.namespaceSelector | string | `nil` | |
| tapInjector.objectSelector | string | `nil` | |
| tapInjector.proxy | string | `nil` | |
| tapInjector.replicas | int | `1` | Number of replicas of tapInjector |
| tapInjector.resources.cpu.limit | string | `nil` | Maximum amount of CPU units that the tapInjector container can use |
| tapInjector.resources.cpu.request | string | `nil` | Amount of CPU units that the tapInjector container requests |
| tapInjector.resources.memory.limit | string | `nil` | Maximum amount of memory that tapInjector container can use |
| tapInjector.resources.memory.request | string | `nil` | Amount of memory that the tapInjector container requests |
----------------------------------------------
Autogenerated from chart metadata using [helm-docs v1.4.0](https://github.com/norwoodj/helm-docs/releases/v1.4.0)

2
viz/charts/linkerd-viz/templates/grafana.yaml
View File

@ -130,7 +130,7 @@ spec:
# see https://github.com/grafana/grafana/issues/20096
- name: GODEBUG
value: netdns=go
image: {{.Values.grafana.image.registry}}/{{.Values.grafana.image.name}}:{{ default (default .Values.linkerdVersion .Values.controllerImageVersion) .Values.grafana.image.tag}}
image: {{.Values.grafana.image.registry}}/{{.Values.grafana.image.name}}:{{.Values.grafana.image.tag}}
imagePullPolicy: {{.Values.imagePullPolicy}}
livenessProbe:
httpGet:

86
viz/charts/linkerd-viz/templates/tap-injector-rbac.yaml Normal file
View File

@ -0,0 +1,86 @@
###
### Tap Injector RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
subjects:
- kind: ServiceAccount
name: tap-injector
namespace: {{.Values.namespace}}
roleRef:
kind: ClusterRole
name: linkerd-tap-injector
apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
name: tap-injector
namespace: {{.Values.namespace}}
{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }}
---
{{- $host := printf "tap-injector.%s.svc" .Values.namespace }}
{{- $ca := genSelfSignedCert $host (list) (list $host) 365 }}
{{- if (not .Values.tapInjector.externalSecret) }}
kind: Secret
apiVersion: v1
metadata:
name: tap-injector-k8s-tls
namespace: {{ .Values.namespace }}
annotations:
{{.Values.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.linkerdVersion) .Values.cliVersion}}
type: kubernetes.io/tls
data:
tls.crt: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.tapInjector.crtPEM)) (empty .Values.tapInjector.crtPEM) }}
tls.key: {{ ternary (b64enc (trim $ca.Key)) (b64enc (trim .Values.tapInjector.keyPEM)) (empty .Values.tapInjector.keyPEM) }}
---
{{- end }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
name: linkerd-tap-injector-webhook-config
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
webhooks:
- name: tap-injector.linkerd.io
{{- if .Values.tapInjector.namespaceSelector }}
namespaceSelector:
{{ toYaml .Values.tapInjector.namespaceSelector | trim | indent 4 -}}
{{- end }}
{{- if .Values.tapInjector.objectSelector }}
objectSelector:
{{ toYaml .Values.tapInjector.objectSelector | trim | indent 4 -}}
{{- end }}
clientConfig:
service:
name: tap-injector
namespace: {{ .Values.namespace }}
path: "/"
{{- if and (.Values.tapInjector.externalSecret) (empty .Values.tapInjector.caBundle) }}
{{- fail "If tapInjector.externalSecret is true then you need to provide tapInjector.caBundle" }}
{{- end }}
caBundle: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.tapInjector.caBundle)) (empty .Values.tapInjector.caBundle) }}
failurePolicy: {{.Values.tapInjector.failurePolicy}}
reinvocationPolicy: IfNeeded
rules:
- operations: [ "CREATE" ]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
sideEffects: None

106
viz/charts/linkerd-viz/templates/tap-injector.yaml Normal file
View File

@ -0,0 +1,106 @@
---
###
### Tap Injector
###
---
kind: Service
apiVersion: v1
metadata:
name: tap-injector
namespace: {{.Values.namespace}}
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
component: tap-injector
annotations:
{{.Values.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.linkerdVersion) .Values.cliVersion}}
spec:
type: ClusterIP
selector:
component: tap-injector
ports:
- name: tap-injector
port: 443
targetPort: tap-injector
---
kind: Deployment
apiVersion: apps/v1
metadata:
annotations:
{{.Values.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.linkerdVersion) .Values.cliVersion}}
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
app.kubernetes.io/name: tap-injector
app.kubernetes.io/part-of: Linkerd
component: tap-injector
name: tap-injector
namespace: {{.Values.namespace}}
spec:
replicas: {{.Values.tapInjector.replicas}}
selector:
matchLabels:
component: tap-injector
{{- if .Values.enablePodAntiAffinity }}
strategy:
rollingUpdate:
maxUnavailable: 1
{{- end }}
template:
metadata:
annotations:
{{- if empty .Values.cliVersion }}
checksum/config: {{ include (print $.Template.BasePath "/tap-injector-rbac.yaml") . | sha256sum }}
{{- end }}
{{.Values.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.linkerdVersion) .Values.cliVersion}}
{{- with .Values.tapInjector.proxy }}
{{- include "partials.proxy.config.annotations" .resources | nindent 8 }}
{{- end }}
{{- with .Values.podAnnotations }}{{ toYaml . | trim | nindent 8 }}{{- end }}
labels:
{{.Values.extensionAnnotation}}: linkerd-viz
component: tap-injector
{{- with .Values.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
spec:
{{- if .Values.tolerations -}}
{{- include "linkerd.tolerations" . | nindent 6 }}
{{- end -}}
{{- include "linkerd.node-selector" . | nindent 6 }}
{{- if .Values.enablePodAntiAffinity -}}
{{- $local := dict "component" "tap-injector" "label" "component" -}}
{{- include "linkerd.pod-affinity" $local | nindent 6 -}}
{{- end }}
containers:
- args:
- tap-injector
- -tap-service-name=linkerd-tap.{{.Values.namespace}}.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: {{.Values.tapInjector.image.registry}}/{{.Values.tapInjector.image.name}}:{{.Values.tapInjector.image.tag}}
imagePullPolicy: {{.Values.tapInjector.image.pullPolicy}}
livenessProbe:
httpGet:
path: /ping
port: 9995
initialDelaySeconds: 10
name: tap-injector
ports:
- containerPort: 8443
name: tap-injector
- containerPort: 9995
name: admin-http
readinessProbe:
failureThreshold: 7
httpGet:
path: /ready
port: 9995
{{- if .Values.tapInjector.resources -}}
{{- include "partials.resources" .Values.tapInjector.resources | nindent 8 }}
{{- end }}
securityContext:
runAsUser: {{.Values.tapInjector.UID}}
volumeMounts:
- mountPath: /var/run/linkerd/tls
name: tls
readOnly: true
serviceAccountName: tap-injector
volumes:
- name: tls
secret:
secretName: tap-injector-k8s-tls

2
viz/charts/linkerd-viz/templates/tap.yaml
View File

@ -84,7 +84,7 @@ spec:
- -controller-namespace={{.Values.linkerdNamespace}}
- -log-level={{.Values.tap.logLevel}}
- -identity-trust-domain={{.Values.identityTrustDomain}}
image: {{.Values.tap.image.registry}}/{{.Values.tap.image.name}}:{{ default (default .Values.linkerdVersion .Values.controllerImageVersion) .Values.tap.image.tag}}
image: {{.Values.tap.image.registry}}/{{.Values.tap.image.name}}:{{.Values.tap.image.tag}}
imagePullPolicy: {{.Values.tap.image.pullPolicy}}
livenessProbe:
httpGet:

2
viz/charts/linkerd-viz/templates/web.yaml
View File

@ -87,7 +87,7 @@ spec:
{{- $hostAbbrev := replace "." "\\." (printf "linkerd-web.%s.svc" .Values.namespace) }}
- -enforced-host=^(localhost|127\.0\.0\.1|{{ $hostFull }}|{{ $hostAbbrev }}|\[::1\])(:\d+)?$
{{- end}}
image: {{.Values.dashboard.image.registry}}/{{.Values.dashboard.image.name}}:{{ default (default .Values.linkerdVersion .Values.controllerImageVersion) .Values.dashboard.image.tag}}
image: {{.Values.dashboard.image.registry}}/{{.Values.dashboard.image.name}}:{{.Values.dashboard.image.tag}}
imagePullPolicy: {{.Values.dashboard.image.pullPolicy}}
livenessProbe:
httpGet:

62
viz/charts/linkerd-viz/values.yaml
View File

@ -10,10 +10,10 @@ linkerdVersion: &linkerd_version linkerdVersionValue
# -- Default Docker Registry
defaultRegistry: &default_registry ghcr.io/linkerd
# -- Kubernetes DNS Domain name to use
# -- Kubernetes DNS Domain name to use
clusterDomain: &cluster_domain cluster.local
# -- Trust domain used for identity
# -- Trust domain used for identity
identityTrustDomain: *cluster_domain
# -- Namespace of the Linkerd core control-plane install
@ -46,7 +46,7 @@ nodeSelector:
imagePullSecrets: []
# - name: my-private-docker-registry-login-secret
# -|- Tolerations section, See the
# -|- Tolerations section, See the
# [K8S documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
# for more information
# tolerations:
@ -78,7 +78,7 @@ tap:
crtPEM: |
# -- Certificate key for Tap component. If not provided then Helm will
# generate one.
# generate one.
keyPEM: |
# -- Bundle of CA certificates for Tap component. If not provided then Helm
@ -106,6 +106,60 @@ tap:
UID: *uid
# tapInjector configuration
tapInjector:
# -- Number of replicas of tapInjector
replicas: 1
image:
# -- Docker registry for the tapInjector instance
registry: *default_registry
# -- Docker image name for the tapInjector instance
name: controller
# -- Docker image tag for the tapInjector instance
tag: *linkerd_version
namespaceSelector:
# matchExpressions:
# - key: runlevel
# operator: NotIn
# values: ["0","1"]
objectSelector:
# matchLabels:
# foo: bar
UID: *uid
failurePolicy: Ignore
resources:
cpu:
# -- Maximum amount of CPU units that the tapInjector container can use
limit:
# -- Amount of CPU units that the tapInjector container requests
request:
memory:
# -- Maximum amount of memory that tapInjector container can use
limit:
# -- Amount of memory that the tapInjector container requests
request:
proxy:
# -- If set, overrides default proxy resources for the proxy injected
# into the tapInjector component
# resources:
# -- Do not create a secret resource for the tapInjector webhook. If this is
# set to `true`, the value `tapInjector.caBundle` must be set (see below)
externalSecret: false
# -- Certificate for the tapInjector. If not provided then Helm will
# generate one.
crtPEM: |
# -- Certificate key for the tapInjector. If not provided then Helm will
# generate one.
keyPEM: |
# -- Bundle of CA certificates for the tapInjector. If not provided then
# Helm will use the certificate generated for `tapInjector.crtPEM`. If
# `tapInjector.externalSecret` is set to true, this value must be set, as no
# certificate will be generated.
caBundle: |
# web dashboard configuration
dashboard:
# -- Number of replicas of dashboard

2
viz/cmd/install.go
View File

@ -32,6 +32,8 @@ var (
"templates/grafana.yaml",
"templates/prometheus.yaml",
"templates/tap.yaml",
"templates/tap-injector-rbac.yaml",
"templates/tap-injector.yaml",
"templates/web.yaml",
}
)

5
viz/cmd/install_test.go
View File

@ -17,6 +17,11 @@ func TestRender(t *testing.T) {
"crtPEM": "test-tap-crt-pem",
"caBundle": "test-tap-ca-bundle",
},
"tapInjector": map[string]interface{}{
"keyPEM": "test-tap-key-pem",
"crtPEM": "test-tap-crt-pem",
"caBundle": "test-tap-ca-bundle",
},
}
testCases := []struct {

156
viz/cmd/testdata/install_default.golden vendored
View File

@ -841,6 +841,162 @@ spec:
secret:
secretName: linkerd-tap-k8s-tls
###
### Tap Injector RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
linkerd.io/extension: linkerd-viz
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
linkerd.io/extension: linkerd-viz
subjects:
- kind: ServiceAccount
name: tap-injector
namespace: linkerd-viz
roleRef:
kind: ClusterRole
name: linkerd-tap-injector
apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
name: tap-injector
namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
name: tap-injector-k8s-tls
namespace: linkerd-viz
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
name: linkerd-tap-injector-webhook-config
labels:
linkerd.io/extension: linkerd-viz
webhooks:
- name: tap-injector.linkerd.io
clientConfig:
service:
name: tap-injector
namespace: linkerd-viz
path: "/"
caBundle: dGVzdC10YXAtY2EtYnVuZGxl
failurePolicy: Ignore
reinvocationPolicy: IfNeeded
rules:
- operations: [ "CREATE" ]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
sideEffects: None
---
###
### Tap Injector
###
---
kind: Service
apiVersion: v1
metadata:
name: tap-injector
namespace: linkerd-viz
labels:
linkerd.io/extension: linkerd-viz
component: tap-injector
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
spec:
type: ClusterIP
selector:
component: tap-injector
ports:
- name: tap-injector
port: 443
targetPort: tap-injector
---
kind: Deployment
apiVersion: apps/v1
metadata:
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
labels:
linkerd.io/extension: linkerd-viz
app.kubernetes.io/name: tap-injector
app.kubernetes.io/part-of: Linkerd
component: tap-injector
name: tap-injector
namespace: linkerd-viz
spec:
replicas: 1
selector:
matchLabels:
component: tap-injector
template:
metadata:
annotations:
checksum/config: 33e988bace52d67983db9661563009d9e7f2a4877dd05add7300d2f25d2579ba
linkerd.io/created-by: linkerd/helm dev-undefined
labels:
linkerd.io/extension: linkerd-viz
component: tap-injector
spec:
nodeSelector:
beta.kubernetes.io/os: linux
containers:
- args:
- tap-injector
- -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/controller:dev-undefined
imagePullPolicy:
livenessProbe:
httpGet:
path: /ping
port: 9995
initialDelaySeconds: 10
name: tap-injector
ports:
- containerPort: 8443
name: tap-injector
- containerPort: 9995
name: admin-http
readinessProbe:
failureThreshold: 7
httpGet:
path: /ready
port: 9995
resources:
securityContext:
runAsUser: 2103
volumeMounts:
- mountPath: /var/run/linkerd/tls
name: tls
readOnly: true
serviceAccountName: tap-injector
volumes:
- name: tls
secret:
secretName: tap-injector-k8s-tls
---
###
### Web

156
viz/cmd/testdata/install_prometheus_disabled.golden vendored
View File

@ -549,6 +549,162 @@ spec:
secret:
secretName: linkerd-tap-k8s-tls
###
### Tap Injector RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
linkerd.io/extension: linkerd-viz
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: linkerd-tap-injector
labels:
linkerd.io/extension: linkerd-viz
subjects:
- kind: ServiceAccount
name: tap-injector
namespace: linkerd-viz
roleRef:
kind: ClusterRole
name: linkerd-tap-injector
apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
name: tap-injector
namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
name: tap-injector-k8s-tls
namespace: linkerd-viz
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
name: linkerd-tap-injector-webhook-config
labels:
linkerd.io/extension: linkerd-viz
webhooks:
- name: tap-injector.linkerd.io
clientConfig:
service:
name: tap-injector
namespace: linkerd-viz
path: "/"
caBundle: dGVzdC10YXAtY2EtYnVuZGxl
failurePolicy: Ignore
reinvocationPolicy: IfNeeded
rules:
- operations: [ "CREATE" ]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
sideEffects: None
---
###
### Tap Injector
###
---
kind: Service
apiVersion: v1
metadata:
name: tap-injector
namespace: linkerd-viz
labels:
linkerd.io/extension: linkerd-viz
component: tap-injector
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
spec:
type: ClusterIP
selector:
component: tap-injector
ports:
- name: tap-injector
port: 443
targetPort: tap-injector
---
kind: Deployment
apiVersion: apps/v1
metadata:
annotations:
linkerd.io/created-by: linkerd/helm dev-undefined
labels:
linkerd.io/extension: linkerd-viz
app.kubernetes.io/name: tap-injector
app.kubernetes.io/part-of: Linkerd
component: tap-injector
name: tap-injector
namespace: linkerd-viz
spec:
replicas: 1
selector:
matchLabels:
component: tap-injector
template:
metadata:
annotations:
checksum/config: 33e988bace52d67983db9661563009d9e7f2a4877dd05add7300d2f25d2579ba
linkerd.io/created-by: linkerd/helm dev-undefined
labels:
linkerd.io/extension: linkerd-viz
component: tap-injector
spec:
nodeSelector:
beta.kubernetes.io/os: linux
containers:
- args:
- tap-injector
- -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
image: ghcr.io/linkerd/controller:dev-undefined
imagePullPolicy:
livenessProbe:
httpGet:
path: /ping
port: 9995
initialDelaySeconds: 10
name: tap-injector
ports:
- containerPort: 8443
name: tap-injector
- containerPort: 9995
name: admin-http
readinessProbe:
failureThreshold: 7
httpGet:
path: /ready
port: 9995
resources:
securityContext:
runAsUser: 2103
volumeMounts:
- mountPath: /var/run/linkerd/tls
name: tls
readOnly: true
serviceAccountName: tap-injector
volumes:
- name: tls
secret:
secretName: tap-injector-k8s-tls
---
###
### Web