mirror of https://github.com/linkerd/linkerd2.git
929 lines
22 KiB
Plaintext
929 lines
22 KiB
Plaintext
---
|
|
###
|
|
### Linkerd Viz Extension Namespace
|
|
###
|
|
kind: Namespace
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
annotations:
|
|
linkerd.io/inject: enabled
|
|
---
|
|
###
|
|
### Metrics API RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
rules:
|
|
- apiGroups: ["extensions", "apps"]
|
|
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "batch"]
|
|
resources: ["cronjobs", "jobs"]
|
|
verbs: ["list" , "get", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["linkerd.io"]
|
|
resources: ["serviceprofiles"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["split.smi-spec.io"]
|
|
resources: ["trafficsplits"]
|
|
verbs: ["list", "get", "watch"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-metrics-api
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-metrics-api
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-metrics-api
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
---
|
|
###
|
|
### Grafana RBAC
|
|
###
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-grafana
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
---
|
|
###
|
|
### Tap RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods", "services", "replicationcontrollers", "namespaces", "nodes"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "apps"]
|
|
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
|
|
verbs: ["list", "get", "watch"]
|
|
- apiGroups: ["extensions", "batch"]
|
|
resources: ["cronjobs", "jobs"]
|
|
verbs: ["list" , "get", "watch"]
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-admin
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
rules:
|
|
- apiGroups: ["tap.linkerd.io"]
|
|
resources: ["*"]
|
|
verbs: ["watch"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-tap
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-auth-delegator
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:auth-delegator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-tap-auth-reader
|
|
namespace: kube-system
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: extension-apiserver-authentication-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-tap-k8s-tls
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
|
|
tls.key: dGVzdC10YXAta2V5LXBlbQ==
|
|
---
|
|
apiVersion: apiregistration.k8s.io/v1
|
|
kind: APIService
|
|
metadata:
|
|
name: v1alpha1.tap.linkerd.io
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
spec:
|
|
group: tap.linkerd.io
|
|
version: v1alpha1
|
|
groupPriorityMinimum: 1000
|
|
versionPriority: 100
|
|
service:
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
caBundle: dGVzdC10YXAtY2EtYnVuZGxl
|
|
---
|
|
###
|
|
### Web RBAC
|
|
###
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: linkerd-web
|
|
namespace: linkerd
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get"]
|
|
resourceNames: ["linkerd-config"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "configmaps"]
|
|
verbs: ["get"]
|
|
- apiGroups: [""]
|
|
resources: ["serviceaccounts", "pods"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["replicasets"]
|
|
verbs: ["list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: linkerd-web
|
|
namespace: linkerd
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd
|
|
roleRef:
|
|
kind: Role
|
|
name: linkerd-web
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-check
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
rules:
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources: ["clusterroles", "clusterrolebindings"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
|
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["policy"]
|
|
resources: ["podsecuritypolicies"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["linkerd.io"]
|
|
resources: ["serviceprofiles"]
|
|
verbs: ["list"]
|
|
- apiGroups: ["apiregistration.k8s.io"]
|
|
resources: ["apiservices"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-check
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-web-check
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-linkerd-viz-web-admin
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: linkerd-linkerd-viz-tap-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: linkerd-viz-psp
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
kind: Role
|
|
name: linkerd-psp
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
- kind: ServiceAccount
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
- kind: ServiceAccount
|
|
name: linkerd-grafana
|
|
namespace: linkerd-viz
|
|
---
|
|
###
|
|
### Metrics API
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-metrics-api
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
ports:
|
|
- name: http
|
|
port: 8085
|
|
targetPort: 8085
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
app.kubernetes.io/name: metrics-api
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: dev-undefined
|
|
component: metrics-api
|
|
name: linkerd-metrics-api
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: 6827b2203b1cd90692d9dd6a973a2162e574dc9fd7b5b9e346ceac7e287204a6
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: metrics-api
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- -controller-namespace=linkerd
|
|
- -log-level=info
|
|
- -cluster-domain=cluster.local
|
|
- -prometheus-url=external-prom.com
|
|
image: ghcr.io/linkerd/metrics-api:dev-undefined
|
|
imagePullPolicy:
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9995
|
|
initialDelaySeconds: 10
|
|
name: metrics-api
|
|
ports:
|
|
- containerPort: 8085
|
|
name: http
|
|
- containerPort: 9995
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9995
|
|
resources:
|
|
securityContext:
|
|
runAsUser: 2103
|
|
serviceAccountName: linkerd-metrics-api
|
|
---
|
|
###
|
|
### Grafana
|
|
###
|
|
kind: ConfigMap
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-grafana-config
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
data:
|
|
grafana.ini: |-
|
|
instance_name = linkerd-grafana
|
|
[server]
|
|
root_url = %(protocol)s://%(domain)s:/grafana/
|
|
[auth]
|
|
disable_login_form = true
|
|
[auth.anonymous]
|
|
enabled = true
|
|
org_role = Editor
|
|
[auth.basic]
|
|
enabled = false
|
|
[analytics]
|
|
check_for_updates = false
|
|
[panels]
|
|
disable_sanitize_html = true
|
|
datasources.yaml: |-
|
|
apiVersion: 1
|
|
datasources:
|
|
- name: prometheus
|
|
type: prometheus
|
|
access: proxy
|
|
orgId: 1
|
|
url: external-prom.com
|
|
isDefault: true
|
|
jsonData:
|
|
timeInterval: "5s"
|
|
version: 1
|
|
editable: true
|
|
|
|
dashboards.yaml: |-
|
|
apiVersion: 1
|
|
providers:
|
|
- name: 'default'
|
|
orgId: 1
|
|
folder: ''
|
|
type: file
|
|
disableDeletion: true
|
|
editable: true
|
|
options:
|
|
path: /var/lib/grafana/dashboards
|
|
homeDashboardId: linkerd-top-line
|
|
---
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-grafana
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
ports:
|
|
- name: http
|
|
port: 3000
|
|
targetPort: 3000
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
app.kubernetes.io/name: grafana
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: dev-undefined
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
name: linkerd-grafana
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: grafana
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
containers:
|
|
- env:
|
|
- name: GF_PATHS_DATA
|
|
value: /data
|
|
# Force using the go-based DNS resolver instead of the OS' to avoid failures in some environments
|
|
# see https://github.com/grafana/grafana/issues/20096
|
|
- name: GODEBUG
|
|
value: netdns=go
|
|
image: ghcr.io/linkerd/grafana:dev-undefined
|
|
imagePullPolicy:
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
initialDelaySeconds: 30
|
|
name: grafana
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
resources:
|
|
securityContext:
|
|
runAsUser: 472
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
- mountPath: /etc/grafana
|
|
name: grafana-config
|
|
readOnly: true
|
|
serviceAccountName: linkerd-grafana
|
|
volumes:
|
|
- emptyDir: {}
|
|
name: data
|
|
- configMap:
|
|
items:
|
|
- key: grafana.ini
|
|
path: grafana.ini
|
|
- key: datasources.yaml
|
|
path: provisioning/datasources/datasources.yaml
|
|
- key: dashboards.yaml
|
|
path: provisioning/dashboards/dashboards.yaml
|
|
name: linkerd-grafana-config
|
|
name: grafana-config
|
|
---
|
|
###
|
|
### Tap
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
ports:
|
|
- name: grpc
|
|
port: 8088
|
|
targetPort: 8088
|
|
- name: apiserver
|
|
port: 443
|
|
targetPort: apiserver
|
|
---
|
|
kind: Deployment
|
|
apiVersion: apps/v1
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
app.kubernetes.io/name: tap
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: dev-undefined
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
name: linkerd-tap
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: bbc82b03e8c9fdc549e1ef5d3f795c07c21fb3b4c089351186f170b722689d86
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- api
|
|
- -api-namespace=linkerd
|
|
- -log-level=info
|
|
- -identity-trust-domain=cluster.local
|
|
image: ghcr.io/linkerd/tap:dev-undefined
|
|
imagePullPolicy:
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9998
|
|
initialDelaySeconds: 10
|
|
name: tap
|
|
ports:
|
|
- containerPort: 8088
|
|
name: grpc
|
|
- containerPort: 8089
|
|
name: apiserver
|
|
- containerPort: 9998
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9998
|
|
resources:
|
|
securityContext:
|
|
runAsUser: 2103
|
|
volumeMounts:
|
|
- mountPath: /var/run/linkerd/tls
|
|
name: tls
|
|
readOnly: true
|
|
serviceAccountName: linkerd-tap
|
|
volumes:
|
|
- name: tls
|
|
secret:
|
|
secretName: linkerd-tap-k8s-tls
|
|
|
|
---
|
|
###
|
|
### Tap Injector RBAC
|
|
###
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-tap-injector
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: linkerd-tap-injector
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: linkerd-tap-injector
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
kind: ServiceAccount
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
---
|
|
kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector-k8s-tls
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
|
|
tls.key: dGVzdC10YXAta2V5LXBlbQ==
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
name: linkerd-tap-injector-webhook-config
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
webhooks:
|
|
- name: tap-injector.linkerd.io
|
|
clientConfig:
|
|
service:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
path: "/"
|
|
caBundle: dGVzdC10YXAtY2EtYnVuZGxl
|
|
failurePolicy: Ignore
|
|
admissionReviewVersions: ["v1", "v1beta1"]
|
|
reinvocationPolicy: IfNeeded
|
|
rules:
|
|
- operations: [ "CREATE" ]
|
|
apiGroups: [""]
|
|
apiVersions: ["v1"]
|
|
resources: ["pods"]
|
|
sideEffects: None
|
|
---
|
|
###
|
|
### Tap Injector
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap-injector
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
component: tap-injector
|
|
ports:
|
|
- name: tap-injector
|
|
port: 443
|
|
targetPort: tap-injector
|
|
---
|
|
kind: Deployment
|
|
apiVersion: apps/v1
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
app.kubernetes.io/name: tap-injector
|
|
app.kubernetes.io/part-of: Linkerd
|
|
component: tap-injector
|
|
name: tap-injector
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
component: tap-injector
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: 0120b5feafdef04a057ab39fd63ed315ebbcc2bfc0b0657e3007fa34ffb8b7e2
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: tap-injector
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- injector
|
|
- -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
|
|
- -log-level=info
|
|
image: ghcr.io/linkerd/tap:dev-undefined
|
|
imagePullPolicy:
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9995
|
|
initialDelaySeconds: 10
|
|
name: tap-injector
|
|
ports:
|
|
- containerPort: 8443
|
|
name: tap-injector
|
|
- containerPort: 9995
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9995
|
|
resources:
|
|
securityContext:
|
|
runAsUser: 2103
|
|
volumeMounts:
|
|
- mountPath: /var/run/linkerd/tls
|
|
name: tls
|
|
readOnly: true
|
|
serviceAccountName: tap-injector
|
|
volumes:
|
|
- name: tls
|
|
secret:
|
|
secretName: tap-injector-k8s-tls
|
|
---
|
|
###
|
|
### Web
|
|
###
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
ports:
|
|
- name: http
|
|
port: 8084
|
|
targetPort: 8084
|
|
- name: admin-http
|
|
port: 9994
|
|
targetPort: 9994
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: Linkerd
|
|
app.kubernetes.io/version: dev-undefined
|
|
component: web
|
|
namespace: linkerd-viz
|
|
name: linkerd-web
|
|
namespace: linkerd-viz
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
linkerd.io/created-by: linkerd/helm dev-undefined
|
|
labels:
|
|
linkerd.io/extension: linkerd-viz
|
|
component: web
|
|
namespace: linkerd-viz
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
containers:
|
|
- args:
|
|
- -linkerd-controller-api-addr=linkerd-controller-api.linkerd.svc.cluster.local:8085
|
|
- -linkerd-metrics-api-addr=linkerd-metrics-api.linkerd-viz.svc.cluster.local:8085
|
|
- -cluster-domain=cluster.local
|
|
- -grafana-addr=linkerd-grafana.linkerd-viz.svc.cluster.local:3000
|
|
- -controller-namespace=linkerd
|
|
- -viz-namespace=linkerd-viz
|
|
- -log-level=info
|
|
- -enforced-host=^(localhost|127\.0\.0\.1|linkerd-web\.linkerd-viz\.svc\.cluster\.local|linkerd-web\.linkerd-viz\.svc|\[::1\])(:\d+)?$
|
|
image: ghcr.io/linkerd/web:dev-undefined
|
|
imagePullPolicy:
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: 9994
|
|
initialDelaySeconds: 10
|
|
name: web
|
|
ports:
|
|
- containerPort: 8084
|
|
name: http
|
|
- containerPort: 9994
|
|
name: admin-http
|
|
readinessProbe:
|
|
failureThreshold: 7
|
|
httpGet:
|
|
path: /ready
|
|
port: 9994
|
|
resources:
|
|
securityContext:
|
|
runAsUser: 2103
|
|
serviceAccountName: linkerd-web
|