From aa0e248a452f2bd12096d2da99bd8dd3bf7d3808 Mon Sep 17 00:00:00 2001 From: Steinkirch Date: Mon, 6 Apr 2020 17:23:26 -0700 Subject: [PATCH] kustomize --- .../api-service/base/deployment.yaml | 20 + .../api-service/base/kustomization.yaml | 13 + .../api-service/base/role-binding.yaml | 11 + .../kustomize/api-service/base/role.yaml | 28 + .../api-service/base/service-account.yaml | 4 + .../kustomize/api-service/base/service.yaml | 14 + .../kustomize/api-service/kustomization.yaml | 5 + .../kustomize/application-crds/base/crd.yaml | 239 + .../application-crds/base/kustomization.yaml | 4 + .../application-crds/kustomization.yaml | 5 + .../base/cluster-role-binding.yaml | 11 + .../application/base/cluster-role.yaml | 21 + .../application/base/kustomization.yaml | 29 + .../kustomize/application/base/params.env | 1 + .../kustomize/application/base/params.yaml | 3 + .../application/base/service-account.yaml | 4 + .../kustomize/application/base/service.yaml | 7 + .../application/base/stateful-set.yaml | 19 + .../kustomize/application/kustomization.yaml | 14 + .../overlays/application/application.yaml | 31 + .../overlays/application/kustomization.yaml | 13 + .../overlays/debug/kustomization.yaml | 6 + .../overlays/debug/stateful-set.yaml | 22 + .../argo/base/cluster-role-binding.yaml | 29 + .../kustomize/argo/base/cluster-role.yaml | 77 + .../kfapp/kustomize/argo/base/config-map.yaml | 27 + kubeflow/kfapp/kustomize/argo/base/crd.yaml | 15 + .../kfapp/kustomize/argo/base/deployment.yaml | 105 + .../kustomize/argo/base/kustomization.yaml | 104 + kubeflow/kfapp/kustomize/argo/base/params.env | 11 + .../kfapp/kustomize/argo/base/params.yaml | 7 + .../kustomize/argo/base/service-account.yaml | 11 + .../kfapp/kustomize/argo/base/service.yaml | 23 + .../kfapp/kustomize/argo/kustomization.yaml | 9 + .../argo/overlays/istio/kustomization.yaml | 8 + .../kustomize/argo/overlays/istio/params.yaml | 3 + .../argo/overlays/istio/virtual-service.yaml | 20 + .../bootstrap/base/cluster-role-binding.yaml | 11 + .../bootstrap/base/cluster-role.yaml | 25 + .../kustomize/bootstrap/base/config-map.yaml | 131 + .../bootstrap/base/kustomization.yaml | 39 + .../kfapp/kustomize/bootstrap/base/params.env | 2 + .../kustomize/bootstrap/base/params.yaml | 3 + .../bootstrap/base/service-account.yaml | 4 + .../bootstrap/base/stateful-set.yaml | 26 + .../kustomize/bootstrap/kustomization.yaml | 5 + .../base/clusterrole-binding.yaml | 14 + .../centraldashboard/base/clusterrole.yaml | 17 + .../centraldashboard/base/deployment.yaml | 31 + .../centraldashboard/base/kustomization.yaml | 54 + .../centraldashboard/base/params.env | 3 + .../centraldashboard/base/params.yaml | 9 + .../centraldashboard/base/role-binding.yaml | 14 + .../kustomize/centraldashboard/base/role.yaml | 25 + .../base/service-account.yaml | 4 + .../centraldashboard/base/service.yaml | 24 + .../centraldashboard/kustomization.yaml | 9 + .../overlays/application/application.yaml | 52 + .../overlays/application/kustomization.yaml | 13 + .../overlays/istio/kustomization.yaml | 9 + .../overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 20 + .../kfapp/kustomize/istio-crds/base/crds.yaml | 1535 ++ .../istio-crds/base/kustomization.yaml | 5 + .../kustomize/istio-crds/kustomization.yaml | 5 + .../istio-install/base/istio-noauth.yaml | 17336 ++++++++++++++++ .../istio-install/base/kustomization.yaml | 5 + .../istio-install/kustomization.yaml | 5 + kubeflow/kfapp/kustomize/istio/base/README.md | 7 + .../istio/base/kf-istio-resources.yaml | 110 + .../kustomize/istio/base/kustomization.yaml | 18 + .../kfapp/kustomize/istio/base/params.env | 1 + .../kfapp/kustomize/istio/base/params.yaml | 3 + .../kfapp/kustomize/istio/kustomization.yaml | 5 + .../base/cluster-role-binding.yaml | 11 + .../jupyter-web-app/base/cluster-role.yaml | 41 + .../jupyter-web-app/base/config-map.yaml | 143 + .../jupyter-web-app/base/deployment.yaml | 37 + .../jupyter-web-app/base/kustomization.yaml | 70 + .../kustomize/jupyter-web-app/base/params.env | 7 + .../jupyter-web-app/base/params.yaml | 9 + .../jupyter-web-app/base/role-binding.yaml | 11 + .../kustomize/jupyter-web-app/base/role.yaml | 35 + .../jupyter-web-app/base/service-account.yaml | 4 + .../jupyter-web-app/base/service.yaml | 23 + .../jupyter-web-app/kustomization.yaml | 15 + .../overlays/application/application.yaml | 47 + .../overlays/application/kustomization.yaml | 13 + .../overlays/istio/kustomization.yaml | 6 + .../overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 24 + .../katib-controller/base/experiment-crd.yaml | 25 + .../base/katib-controller-deployment.yaml | 40 + .../base/katib-controller-rbac.yaml | 76 + .../base/katib-controller-secret.yaml | 4 + .../base/katib-controller-service.yaml | 11 + .../katib-controller/base/kustomization.yaml | 14 + .../katib-controller/base/trial-crd.yaml | 25 + .../katib-controller/base/trial-template.yaml | 18 + .../katib-controller/kustomization.yaml | 5 + .../katib-db/base/katib-db-deployment.yaml | 51 + .../kustomize/katib-db/base/katib-db-pvc.yaml | 10 + .../katib-db/base/katib-db-secret.yaml | 7 + .../katib-db/base/katib-db-service.yaml | 16 + .../katib-db/base/kustomization.yaml | 11 + .../kustomize/katib-db/kustomization.yaml | 5 + .../base/katib-manager-deployment.yaml | 39 + .../base/katib-manager-rest-deployment.yaml | 25 + .../base/katib-manager-rest-service.yaml | 16 + .../base/katib-manager-service.yaml | 16 + .../katib-manager/base/kustomization.yaml | 13 + .../katib-manager/kustomization.yaml | 5 + .../katib-ui/base/katib-ui-deployment.yaml | 26 + .../katib-ui/base/katib-ui-rbac.yaml | 35 + .../katib-ui/base/katib-ui-service.yaml | 16 + .../katib-ui/base/kustomization.yaml | 30 + .../kfapp/kustomize/katib-ui/base/params.env | 1 + .../kfapp/kustomize/katib-ui/base/params.yaml | 7 + .../kustomize/katib-ui/kustomization.yaml | 9 + .../istio/katib-ui-virtual-service.yaml | 20 + .../overlays/istio/kustomization.yaml | 8 + .../katib-ui/overlays/istio/params.yaml | 3 + .../base/cluster-role-binding.yaml | 11 + .../kustomize/metacontroller/base/crd.yaml | 45 + .../metacontroller/base/kustomization.yaml | 13 + .../metacontroller/base/service-account.yaml | 4 + .../metacontroller/base/stateful-set.yaml | 41 + .../metacontroller/kustomization.yaml | 5 + kubeflow/kfapp/kustomize/metadata/OWNERS | 5 + .../metadata/base/kustomization.yaml | 43 + .../metadata/base/metadata-db-deployment.yaml | 49 + .../metadata/base/metadata-db-pvc.yaml | 10 + .../metadata/base/metadata-db-secret.yaml | 7 + .../metadata/base/metadata-db-service.yaml | 14 + .../metadata/base/metadata-deployment.yaml | 32 + .../metadata/base/metadata-service.yaml | 14 + .../metadata/base/metadata-ui-deployment.yaml | 24 + .../metadata/base/metadata-ui-role.yaml | 26 + .../base/metadata-ui-rolebinding.yaml | 14 + .../metadata/base/metadata-ui-sa.yaml | 4 + .../metadata/base/metadata-ui-service.yaml | 12 + .../kfapp/kustomize/metadata/base/params.env | 1 + .../kustomize/metadata/kustomization.yaml | 9 + .../overlays/istio/kustomization.yaml | 8 + .../metadata/overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 21 + .../metrics-collector/base/kustomization.yaml | 9 + .../base/metrics-collector-rbac.yaml | 36 + .../metrics-collector-template-configmap.yaml | 40 + .../metrics-collector/kustomization.yaml | 5 + .../kustomize/minio/base/deployment.yaml | 30 + .../kustomize/minio/base/kustomization.yaml | 27 + .../kfapp/kustomize/minio/base/params.env | 1 + .../kfapp/kustomize/minio/base/params.yaml | 5 + .../minio/base/persistent-volume-claim.yaml | 10 + .../kfapp/kustomize/minio/base/secret.yaml | 8 + .../kfapp/kustomize/minio/base/service.yaml | 11 + .../kfapp/kustomize/minio/kustomization.yaml | 5 + .../minio/overlays/minioPd/kustomization.yaml | 31 + .../minio/overlays/minioPd/params.env | 2 + .../minio/overlays/minioPd/params.yaml | 9 + .../minioPd/persistent-volume-claim.yaml | 7 + .../overlays/minioPd/persistent-volume.yaml | 12 + .../kustomize/mysql/base/deployment.yaml | 25 + .../kustomize/mysql/base/kustomization.yaml | 26 + .../kfapp/kustomize/mysql/base/params.env | 1 + .../kfapp/kustomize/mysql/base/params.yaml | 5 + .../mysql/base/persistent-volume-claim.yaml | 10 + .../kfapp/kustomize/mysql/base/service.yaml | 7 + .../kfapp/kustomize/mysql/kustomization.yaml | 5 + .../mysql/overlays/mysqlPd/kustomization.yaml | 31 + .../mysql/overlays/mysqlPd/params.env | 2 + .../mysql/overlays/mysqlPd/params.yaml | 9 + .../mysqlPd/persistent-volume-claim.yaml | 7 + .../overlays/mysqlPd/persistent-volume.yaml | 12 + .../base/cluster-role-binding.yaml | 11 + .../base/cluster-role.yaml | 39 + .../notebook-controller/base/crd.yaml | 62 + .../notebook-controller/base/deployment.yaml | 19 + .../base/kustomization.yaml | 38 + .../notebook-controller/base/params.env | 2 + .../base/service-account.yaml | 4 + .../notebook-controller/base/service.yaml | 7 + .../notebook-controller/kustomization.yaml | 22 + .../overlays/application/application.yaml | 39 + .../overlays/application/kustomization.yaml | 13 + .../overlays/istio/deployment.yaml | 12 + .../overlays/istio/kustomization.yaml | 12 + .../overlays/istio/params.env | 1 + .../base/clusterrole-binding.yaml | 11 + .../persistent-agent/base/clusterrole.yaml | 21 + .../persistent-agent/base/deployment.yaml | 17 + .../persistent-agent/base/kustomization.yaml | 13 + .../base/service-account.yaml | 4 + .../persistent-agent/kustomization.yaml | 5 + .../base/cluster-role-binding.yaml | 11 + .../pipelines-runner/base/cluster-role.yaml | 75 + .../pipelines-runner/base/kustomization.yaml | 9 + .../base/service-account.yaml | 4 + .../pipelines-runner/kustomization.yaml | 5 + .../pipelines-ui/base/deployment.yaml | 22 + .../pipelines-ui/base/kustomization.yaml | 46 + .../kustomize/pipelines-ui/base/params.env | 1 + .../kustomize/pipelines-ui/base/params.yaml | 3 + .../pipelines-ui/base/role-binding.yaml | 13 + .../kustomize/pipelines-ui/base/role.yaml | 26 + .../pipelines-ui/base/service-account.yaml | 4 + .../kustomize/pipelines-ui/base/service.yaml | 48 + .../kustomize/pipelines-ui/kustomization.yaml | 9 + .../overlays/istio/kustomization.yaml | 8 + .../pipelines-ui/overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 43 + .../base/cluster-role-binding.yaml | 11 + .../pipelines-viewer/base/cluster-role.yaml | 30 + .../kustomize/pipelines-viewer/base/crd.yaml | 18 + .../pipelines-viewer/base/deployment.yaml | 17 + .../pipelines-viewer/base/kustomization.yaml | 15 + .../base/service-account.yaml | 4 + .../pipelines-viewer/kustomization.yaml | 5 + .../kfapp/kustomize/profiles/base/README.md | 5 + .../profiles/base/cluster-role-binding.yaml | 11 + .../kfapp/kustomize/profiles/base/crd.yaml | 51 + .../kustomize/profiles/base/deployment.yaml | 31 + .../profiles/base/kustomization.yaml | 52 + .../kfapp/kustomize/profiles/base/params.env | 3 + .../kfapp/kustomize/profiles/base/params.yaml | 11 + .../kustomize/profiles/base/role-binding.yaml | 11 + .../kfapp/kustomize/profiles/base/role.yaml | 13 + .../profiles/base/service-account.yaml | 10 + .../kustomize/profiles/base/service.yaml | 7 + .../kustomize/profiles/kustomization.yaml | 9 + .../profiles/overlays/debug/deployment.yaml | 22 + .../overlays/debug/kustomization.yaml | 21 + .../profiles/overlays/debug/params.env | 1 + .../profiles/overlays/debug/params.yaml | 3 + .../profiles/overlays/devices/deployment.yaml | 16 + .../overlays/devices/kustomization.yaml | 6 + .../overlays/istio/kustomization.yaml | 8 + .../profiles/overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 24 + .../profiles/overlays/test/app_test.yaml | 23 + .../profiles/overlays/test/kustomization.yaml | 6 + .../kustomize/pytorch-job-crds/base/crd.yaml | 45 + .../pytorch-job-crds/base/kustomization.yaml | 4 + .../pytorch-job-crds/kustomization.yaml | 5 + .../base/cluster-role-binding.yaml | 13 + .../pytorch-operator/base/cluster-role.yaml | 50 + .../pytorch-operator/base/config-map.yaml | 9 + .../pytorch-operator/base/deployment.yaml | 39 + .../pytorch-operator/base/kustomization.yaml | 16 + .../pytorch-operator/base/params.env | 3 + .../base/service-account.yaml | 6 + .../pytorch-operator/base/service.yaml | 19 + .../pytorch-operator/kustomization.yaml | 5 + .../overlays/application/application.yaml | 44 + .../overlays/application/kustomization.yaml | 13 + .../kustomize/scheduledworkflow/base/crd.yaml | 18 + .../scheduledworkflow/base/deployment.yaml | 17 + .../scheduledworkflow/base/kustomization.yaml | 14 + .../scheduledworkflow/base/role-binding.yaml | 11 + .../scheduledworkflow/base/role.yaml | 29 + .../base/service-account.yaml | 4 + .../scheduledworkflow/kustomization.yaml | 5 + .../base/clusterrole.yaml | 162 + .../seldon-core-operator/base/crd.yaml | 2299 ++ .../base/kustomization.yaml | 8 + .../base/rolebinding.yaml | 12 + .../seldon-core-operator/base/secret.yaml | 4 + .../base/service-account.yaml | 4 + .../seldon-core-operator/base/service.yaml | 13 + .../base/statefulset.yaml | 85 + .../seldon-core-operator/kustomization.yaml | 14 + .../overlays/application/application.yaml | 32 + .../overlays/application/kustomization.yaml | 13 + .../spartakus/base/cluster-role-binding.yaml | 13 + .../spartakus/base/cluster-role.yaml | 14 + .../kustomize/spartakus/base/deployment.yaml | 21 + .../spartakus/base/kustomization.yaml | 28 + .../kfapp/kustomize/spartakus/base/params.env | 1 + .../kustomize/spartakus/base/params.yaml | 3 + .../spartakus/base/service-account.yaml | 6 + .../kustomize/spartakus/kustomization.yaml | 5 + .../suggestion/base/kustomization.yaml | 25 + ...stion-bayesianoptimization-deployment.yaml | 23 + ...ggestion-bayesianoptimization-service.yaml | 16 + .../base/suggestion-grid-deployment.yaml | 23 + .../base/suggestion-grid-service.yaml | 16 + .../base/suggestion-hyperband-deployment.yaml | 23 + .../base/suggestion-hyperband-service.yaml | 16 + .../base/suggestion-nasrl-deployment.yaml | 22 + .../base/suggestion-nasrl-service.yaml | 16 + .../base/suggestion-random-deployment.yaml | 23 + .../base/suggestion-random-service.yaml | 16 + .../kustomize/suggestion/kustomization.yaml | 5 + .../tensorboard/base/deployment.yaml | 31 + .../tensorboard/base/kustomization.yaml | 28 + .../kustomize/tensorboard/base/params.env | 27 + .../kustomize/tensorboard/base/params.yaml | 3 + .../kustomize/tensorboard/base/service.yaml | 24 + .../kustomize/tensorboard/kustomization.yaml | 9 + .../overlays/istio/kustomization.yaml | 8 + .../tensorboard/overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 20 + .../base/cluster-role-binding.yaml | 28 + .../tf-job-operator/base/cluster-role.yaml | 106 + .../tf-job-operator/base/config-map.yaml | 9 + .../kustomize/tf-job-operator/base/crd.yaml | 51 + .../tf-job-operator/base/deployment.yaml | 60 + .../tf-job-operator/base/kustomization.yaml | 33 + .../kustomize/tf-job-operator/base/params.env | 2 + .../tf-job-operator/base/params.yaml | 3 + .../tf-job-operator/base/service-account.yaml | 14 + .../tf-job-operator/base/service.yaml | 39 + .../tf-job-operator/kustomization.yaml | 9 + .../overlays/application/application.yaml | 44 + .../overlays/application/kustomization.yaml | 13 + .../overlays/istio/kustomization.yaml | 8 + .../overlays/istio/params.yaml | 3 + .../overlays/istio/virtual-service.yaml | 20 + .../webhook/base/cluster-role-binding.yaml | 11 + .../kustomize/webhook/base/cluster-role.yaml | 17 + .../kfapp/kustomize/webhook/base/crd.yaml | 51 + .../kustomize/webhook/base/deployment.yaml | 19 + .../kustomize/webhook/base/kustomization.yaml | 48 + .../base/mutating-webhook-configuration.yaml | 21 + .../kfapp/kustomize/webhook/base/params.env | 1 + .../kfapp/kustomize/webhook/base/params.yaml | 7 + .../webhook/base/service-account.yaml | 4 + .../kfapp/kustomize/webhook/base/service.yaml | 8 + .../kustomize/webhook/kustomization.yaml | 5 + 330 files changed, 27690 insertions(+) create mode 100644 kubeflow/kfapp/kustomize/api-service/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/api-service/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application-crds/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/application-crds/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application-crds/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/params.env create mode 100644 kubeflow/kfapp/kustomize/application/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/application/base/stateful-set.yaml create mode 100644 kubeflow/kfapp/kustomize/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/application/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application/overlays/debug/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/application/overlays/debug/stateful-set.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/config-map.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/params.env create mode 100644 kubeflow/kfapp/kustomize/argo/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/argo/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/config-map.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/params.env create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/base/stateful-set.yaml create mode 100644 kubeflow/kfapp/kustomize/bootstrap/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/params.env create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-crds/base/crds.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-crds/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-crds/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-install/base/istio-noauth.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-install/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/istio-install/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/istio/base/README.md create mode 100644 kubeflow/kfapp/kustomize/istio/base/kf-istio-resources.yaml create mode 100644 kubeflow/kfapp/kustomize/istio/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/istio/base/params.env create mode 100644 kubeflow/kfapp/kustomize/istio/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/config-map.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/params.env create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/experiment-crd.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-rbac.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-secret.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/trial-crd.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/base/trial-template.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-controller/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/base/katib-db-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/base/katib-db-pvc.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/base/katib-db-secret.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/base/katib-db-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-db/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-manager/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-rbac.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/params.env create mode 100644 kubeflow/kfapp/kustomize/katib-ui/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/overlays/istio/katib-ui-virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/katib-ui/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/base/stateful-set.yaml create mode 100644 kubeflow/kfapp/kustomize/metacontroller/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/OWNERS create mode 100644 kubeflow/kfapp/kustomize/metadata/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-db-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-db-pvc.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-db-secret.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-db-service.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-service.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-ui-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-ui-role.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-ui-rolebinding.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-ui-sa.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/metadata-ui-service.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/base/params.env create mode 100644 kubeflow/kfapp/kustomize/metadata/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/metadata/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/metrics-collector/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-rbac.yaml create mode 100644 kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-template-configmap.yaml create mode 100644 kubeflow/kfapp/kustomize/metrics-collector/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/params.env create mode 100644 kubeflow/kfapp/kustomize/minio/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/persistent-volume-claim.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/secret.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/overlays/minioPd/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.env create mode 100644 kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume-claim.yaml create mode 100644 kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/base/params.env create mode 100644 kubeflow/kfapp/kustomize/mysql/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/base/persistent-volume-claim.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.env create mode 100644 kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume-claim.yaml create mode 100644 kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/params.env create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/params.env create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole.yaml create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/persistent-agent/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-runner/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-runner/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-runner/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/params.env create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/pipelines-viewer/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/README.md create mode 100644 kubeflow/kfapp/kustomize/profiles/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/params.env create mode 100644 kubeflow/kfapp/kustomize/profiles/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/debug/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/debug/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/debug/params.env create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/debug/params.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/devices/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/devices/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/test/app_test.yaml create mode 100644 kubeflow/kfapp/kustomize/profiles/overlays/test/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-job-crds/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-job-crds/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-job-crds/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/config-map.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/params.env create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/role.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/scheduledworkflow/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/clusterrole.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/rolebinding.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/secret.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/base/statefulset.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/params.env create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/spartakus/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-service.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-service.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-service.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-service.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-service.yaml create mode 100644 kubeflow/kfapp/kustomize/suggestion/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/base/params.env create mode 100644 kubeflow/kfapp/kustomize/tensorboard/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/tensorboard/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/config-map.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/params.env create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/application.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/params.yaml create mode 100644 kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/virtual-service.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/cluster-role-binding.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/cluster-role.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/crd.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/deployment.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/kustomization.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/mutating-webhook-configuration.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/params.env create mode 100644 kubeflow/kfapp/kustomize/webhook/base/params.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/service-account.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/base/service.yaml create mode 100644 kubeflow/kfapp/kustomize/webhook/kustomization.yaml diff --git a/kubeflow/kfapp/kustomize/api-service/base/deployment.yaml b/kubeflow/kfapp/kustomize/api-service/base/deployment.yaml new file mode 100644 index 0000000..212f67e --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/deployment.yaml @@ -0,0 +1,20 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: ml-pipeline +spec: + template: + spec: + containers: + - name: ml-pipeline-api-server + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: gcr.io/ml-pipeline/api-server:0.1.23 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 8888 + - containerPort: 8887 + serviceAccountName: ml-pipeline diff --git a/kubeflow/kfapp/kustomize/api-service/base/kustomization.yaml b/kubeflow/kfapp/kustomize/api-service/base/kustomization.yaml new file mode 100644 index 0000000..7beaa0f --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + app: ml-pipeline +resources: +- deployment.yaml +- role-binding.yaml +- role.yaml +- service-account.yaml +- service.yaml +images: +- name: gcr.io/ml-pipeline/api-server + newTag: '0.1.23' diff --git a/kubeflow/kfapp/kustomize/api-service/base/role-binding.yaml b/kubeflow/kfapp/kustomize/api-service/base/role-binding.yaml new file mode 100644 index 0000000..2185bbd --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: ml-pipeline +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline +subjects: +- kind: ServiceAccount + name: ml-pipeline diff --git a/kubeflow/kfapp/kustomize/api-service/base/role.yaml b/kubeflow/kfapp/kustomize/api-service/base/role.yaml new file mode 100644 index 0000000..0c4a0b6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: ml-pipeline +rules: +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - create + - get + - list + - update + - patch + - delete diff --git a/kubeflow/kfapp/kustomize/api-service/base/service-account.yaml b/kubeflow/kfapp/kustomize/api-service/base/service-account.yaml new file mode 100644 index 0000000..95ff314 --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline diff --git a/kubeflow/kfapp/kustomize/api-service/base/service.yaml b/kubeflow/kfapp/kustomize/api-service/base/service.yaml new file mode 100644 index 0000000..c708e13 --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/base/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline +spec: + ports: + - name: http + port: 8888 + protocol: TCP + targetPort: 8888 + - name: grpc + port: 8887 + protocol: TCP + targetPort: 8887 diff --git a/kubeflow/kfapp/kustomize/api-service/kustomization.yaml b/kubeflow/kfapp/kustomize/api-service/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/api-service/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/application-crds/base/crd.yaml b/kubeflow/kfapp/kustomize/application-crds/base/crd.yaml new file mode 100644 index 0000000..133342c --- /dev/null +++ b/kubeflow/kfapp/kustomize/application-crds/base/crd.yaml @@ -0,0 +1,239 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + creationTimestamp: null + name: applications.app.k8s.io +spec: + group: app.k8s.io + names: + kind: Application + plural: applications + scope: Namespaced + validation: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + addOwnerRef: + type: boolean + assemblyPhase: + type: string + componentKinds: + items: + type: object + type: array + descriptor: + properties: + description: + type: string + icons: + items: + properties: + size: + type: string + src: + type: string + type: + type: string + required: + - src + type: object + type: array + keywords: + items: + type: string + type: array + links: + items: + properties: + description: + type: string + url: + type: string + type: object + type: array + maintainers: + items: + properties: + email: + type: string + name: + type: string + url: + type: string + type: object + type: array + notes: + type: string + owners: + items: + properties: + email: + type: string + name: + type: string + url: + type: string + type: object + type: array + type: + type: string + version: + type: string + type: object + info: + items: + properties: + name: + type: string + type: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + key: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + resourceVersion: + type: string + uid: + type: string + type: object + ingressRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + host: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + path: + type: string + resourceVersion: + type: string + uid: + type: string + type: object + secretKeyRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + key: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + resourceVersion: + type: string + uid: + type: string + type: object + serviceRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + path: + type: string + port: + format: int32 + type: integer + resourceVersion: + type: string + uid: + type: string + type: object + type: + type: string + type: object + type: object + type: array + selector: + type: object + type: object + status: + properties: + components: + items: + properties: + group: + type: string + kind: + type: string + link: + type: string + name: + type: string + status: + type: string + type: object + type: array + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + lastUpdateTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - type + - status + type: object + type: array + observedGeneration: + format: int64 + type: integer + type: object + version: v1beta1 +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/kubeflow/kfapp/kustomize/application-crds/base/kustomization.yaml b/kubeflow/kfapp/kustomize/application-crds/base/kustomization.yaml new file mode 100644 index 0000000..6e120e7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application-crds/base/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- crd.yaml diff --git a/kubeflow/kfapp/kustomize/application-crds/kustomization.yaml b/kubeflow/kfapp/kustomize/application-crds/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/application-crds/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/application/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/application/base/cluster-role-binding.yaml new file mode 100644 index 0000000..f7fe51d --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-role +subjects: +- kind: ServiceAccount + name: service-account diff --git a/kubeflow/kfapp/kustomize/application/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/application/base/cluster-role.yaml new file mode 100644 index 0000000..169fc3b --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/cluster-role.yaml @@ -0,0 +1,21 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - get + - list + - update + - patch + - watch +- apiGroups: + - app.k8s.io + resources: + - '*' + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/application/base/kustomization.yaml b/kubeflow/kfapp/kustomize/application/base/kustomization.yaml new file mode 100644 index 0000000..980f64a --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/kustomization.yaml @@ -0,0 +1,29 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role.yaml +- cluster-role-binding.yaml +- service-account.yaml +- service.yaml +- stateful-set.yaml +namespace: kubeflow +nameprefix: application-controller- +configMapGenerator: +- name: parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/kubernetes-sigs/application + newName: gcr.io/kubeflow-images-public/kubernetes-sigs/application + newTag: 1.0-beta +vars: +- name: project + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.project +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/application/base/params.env b/kubeflow/kfapp/kustomize/application/base/params.env new file mode 100644 index 0000000..8a76300 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/params.env @@ -0,0 +1 @@ +project= diff --git a/kubeflow/kfapp/kustomize/application/base/params.yaml b/kubeflow/kfapp/kustomize/application/base/params.yaml new file mode 100644 index 0000000..e544ce9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/template/spec/containers/image + kind: StatefulSet diff --git a/kubeflow/kfapp/kustomize/application/base/service-account.yaml b/kubeflow/kfapp/kustomize/application/base/service-account.yaml new file mode 100644 index 0000000..a36cbd8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: service-account diff --git a/kubeflow/kfapp/kustomize/application/base/service.yaml b/kubeflow/kfapp/kustomize/application/base/service.yaml new file mode 100644 index 0000000..c7368f9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/service.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Service +metadata: + name: service +spec: + ports: + - port: 443 diff --git a/kubeflow/kfapp/kustomize/application/base/stateful-set.yaml b/kubeflow/kfapp/kustomize/application/base/stateful-set.yaml new file mode 100644 index 0000000..d8272a8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/base/stateful-set.yaml @@ -0,0 +1,19 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: stateful-set +spec: + serviceName: service + template: + spec: + containers: + - name: manager + command: + - /root/manager + image: gcr.io/kubeflow-images-public/kubernetes-sigs/application + imagePullPolicy: Always + env: + - name: project + value: $(project) + serviceAccountName: service-account + volumeClaimTemplates: [] diff --git a/kubeflow/kfapp/kustomize/application/kustomization.yaml b/kubeflow/kfapp/kustomize/application/kustomization.yaml new file mode 100644 index 0000000..0c1f4c0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +commonLabels: + app.kubernetes.io/component: kubeflow + app.kubernetes.io/instance: kubeflow + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/name: kubeflow + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 +kind: Kustomization +namespace: kubeflow +resources: +- overlays/application/application.yaml diff --git a/kubeflow/kfapp/kustomize/application/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/application/overlays/application/application.yaml new file mode 100644 index 0000000..86ffbe0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/overlays/application/application.yaml @@ -0,0 +1,31 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: kubeflow +spec: + selector: + matchLabels: + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 + componentKinds: + - group: app.k8s.io + kind: Application + descriptor: + type: kubeflow + version: v0.6.2 + description: application that aggregates all kubeflow applications + maintainers: + - name: Jeremy Lewi + email: jlewi@google.com + - name: Kam Kasravi + email: kam.d.kasravi@intel.com + owners: + - name: Jeremy Lewi + email: jlewi@google.com + keywords: + - kubeflow + links: + - description: About + url: "https://kubeflow.org" + addOwnerRef: true diff --git a/kubeflow/kfapp/kustomize/application/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/application/overlays/application/kustomization.yaml new file mode 100644 index 0000000..d15622c --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: kubeflow + app.kubernetes.io/instance: kubeflow + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: kubeflow + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/application/overlays/debug/kustomization.yaml b/kubeflow/kfapp/kustomize/application/overlays/debug/kustomization.yaml new file mode 100644 index 0000000..1b437f9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/overlays/debug/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +patchesStrategicMerge: +- stateful-set.yaml diff --git a/kubeflow/kfapp/kustomize/application/overlays/debug/stateful-set.yaml b/kubeflow/kfapp/kustomize/application/overlays/debug/stateful-set.yaml new file mode 100644 index 0000000..c37fa20 --- /dev/null +++ b/kubeflow/kfapp/kustomize/application/overlays/debug/stateful-set.yaml @@ -0,0 +1,22 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: stateful-set +spec: + template: + spec: + containers: + - name: manager + image: gcr.io/$(project)/application-controller:latest + command: + - /go/bin/dlv + args: + - --listen=:2345 + - --headless=true + - --api-version=2 + - exec + - /go/src/github.com/kubernetes-sigs/application/manager + ports: + - containerPort: 2345 + securityContext: + privileged: true diff --git a/kubeflow/kfapp/kustomize/argo/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/argo/base/cluster-role-binding.yaml new file mode 100644 index 0000000..979873c --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/cluster-role-binding.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: argo + name: argo +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argo +subjects: +- kind: ServiceAccount + name: argo + namespace: kubeflow +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: argo-ui + name: argo-ui +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argo-ui +subjects: +- kind: ServiceAccount + name: argo-ui diff --git a/kubeflow/kfapp/kustomize/argo/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/argo/base/cluster-role.yaml new file mode 100644 index 0000000..d6d4dce --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/cluster-role.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: argo + name: argo +rules: +- apiGroups: + - "" + resources: + - pods + - pods/exec + verbs: + - create + - get + - list + - watch + - update + - patch +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - watch + - list +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: argo + name: argo-ui +rules: +- apiGroups: + - "" + resources: + - pods + - pods/exec + - pods/log + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - get +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch diff --git a/kubeflow/kfapp/kustomize/argo/base/config-map.yaml b/kubeflow/kfapp/kustomize/argo/base/config-map.yaml new file mode 100644 index 0000000..e5fb4d3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/config-map.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: workflow-controller-configmap + namespace: kubeflow +data: + config: | + { + executorImage: $(executorImage), + artifactRepository: + { + s3: { + bucket: $(artifactRepositoryBucket), + keyPrefix: $(artifactRepositoryKeyPrefix), + endpoint: $(artifactRepositoryEndpoint), + insecure: $(artifactRepositoryInsecure), + accessKeySecret: { + name: $(artifactRepositoryAccessKeySecretName), + key: $(artifactRepositoryAccessKeySecretKey) + }, + secretKeySecret: { + name: $(artifactRepositorySecretKeySecretName), + key: $(artifactRepositorySecretKeySecretKey) + } + } + } + } diff --git a/kubeflow/kfapp/kustomize/argo/base/crd.yaml b/kubeflow/kfapp/kustomize/argo/base/crd.yaml new file mode 100644 index 0000000..1b978a7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/crd.yaml @@ -0,0 +1,15 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: workflows.argoproj.io +spec: + group: argoproj.io + names: + kind: Workflow + listKind: WorkflowList + plural: workflows + shortNames: + - wf + singular: workflow + scope: Namespaced + version: v1alpha1 diff --git a/kubeflow/kfapp/kustomize/argo/base/deployment.yaml b/kubeflow/kfapp/kustomize/argo/base/deployment.yaml new file mode 100644 index 0000000..a8e86ad --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/deployment.yaml @@ -0,0 +1,105 @@ +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + labels: + app: argo-ui + name: argo-ui + namespace: kubeflow +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: argo-ui + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + app: argo-ui + spec: + containers: + - env: + - name: ARGO_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: IN_CLUSTER + value: "true" + - name: BASE_HREF + value: /argo/ + image: argoproj/argoui:v2.3.0 + imagePullPolicy: IfNotPresent + name: argo-ui + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + readinessProbe: + httpGet: + path: / + port: 8001 + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + serviceAccount: argo-ui + serviceAccountName: argo-ui + terminationGracePeriodSeconds: 30 +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + labels: + app: workflow-controller + name: workflow-controller + namespace: kubeflow +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: workflow-controller + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + app: workflow-controller + spec: + containers: + - args: + - --configmap + - workflow-controller-configmap + command: + - workflow-controller + env: + - name: ARGO_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + image: argoproj/workflow-controller:v2.3.0 + imagePullPolicy: IfNotPresent + name: workflow-controller + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + serviceAccount: argo + serviceAccountName: argo + terminationGracePeriodSeconds: 30 diff --git a/kubeflow/kfapp/kustomize/argo/base/kustomization.yaml b/kubeflow/kfapp/kustomize/argo/base/kustomization.yaml new file mode 100644 index 0000000..f0a4270 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/kustomization.yaml @@ -0,0 +1,104 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- config-map.yaml +- crd.yaml +- deployment.yaml +- service-account.yaml +- service.yaml +commonLabels: + kustomize.component: argo +images: + - name: argoproj/argoui + newName: argoproj/argoui + newTag: v2.3.0 + - name: argoproj/workflow-controller + newName: argoproj/workflow-controller + newTag: v2.3.0 +configMapGenerator: +- name: workflow-controller-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: executorImage + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.executorImage +- name: artifactRepositoryBucket + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryBucket +- name: artifactRepositoryKeyPrefix + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryKeyPrefix +- name: artifactRepositoryEndpoint + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryEndpoint +- name: artifactRepositoryInsecure + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryInsecure +- name: artifactRepositoryAccessKeySecretName + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryAccessKeySecretName +- name: artifactRepositoryAccessKeySecretKey + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositoryAccessKeySecretKey +- name: artifactRepositorySecretKeySecretName + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositorySecretKeySecretName +- name: artifactRepositorySecretKeySecretKey + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.artifactRepositorySecretKeySecretKey +- name: namespace + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.namespace +- name: clusterDomain + objref: + kind: ConfigMap + name: workflow-controller-parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/argo/base/params.env b/kubeflow/kfapp/kustomize/argo/base/params.env new file mode 100644 index 0000000..3630ad4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/params.env @@ -0,0 +1,11 @@ +namespace=kubeflow +executorImage=argoproj/argoexec:v2.3.0 +artifactRepositoryBucket=mlpipeline +artifactRepositoryKeyPrefix=artifacts +artifactRepositoryEndpoint=minio-service.kubeflow:9000 +artifactRepositoryInsecure=true +artifactRepositoryAccessKeySecretName=mlpipeline-minio-artifact +artifactRepositoryAccessKeySecretKey=accesskey +artifactRepositorySecretKeySecretName=mlpipeline-minio-artifact +artifactRepositorySecretKeySecretKey=secretkey +clusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/argo/base/params.yaml b/kubeflow/kfapp/kustomize/argo/base/params.yaml new file mode 100644 index 0000000..eade9a8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/params.yaml @@ -0,0 +1,7 @@ +varReference: +- path: data/config + kind: ConfigMap +- path: data/config + kind: Deployment +- path: metadata/annotations/getambassador.io\/config + kind: Service diff --git a/kubeflow/kfapp/kustomize/argo/base/service-account.yaml b/kubeflow/kfapp/kustomize/argo/base/service-account.yaml new file mode 100644 index 0000000..6f463d9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/service-account.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-ui + namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/argo/base/service.yaml b/kubeflow/kfapp/kustomize/argo/base/service.yaml new file mode 100644 index 0000000..ee0e0bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/base/service.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: argo-ui-mapping + prefix: /argo/ + service: argo-ui.$(namespace) + labels: + app: argo-ui + name: argo-ui + namespace: kubeflow +spec: + ports: + - port: 80 + targetPort: 8001 + selector: + app: argo-ui + sessionAffinity: None + type: NodePort diff --git a/kubeflow/kfapp/kustomize/argo/kustomization.yaml b/kubeflow/kfapp/kustomize/argo/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/argo/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/argo/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/argo/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/argo/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/argo/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/argo/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..59449ed --- /dev/null +++ b/kubeflow/kfapp/kustomize/argo/overlays/istio/virtual-service.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: argo-ui +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /argo/ + rewrite: + uri: / + route: + - destination: + host: argo-ui.$(namespace).svc.$(clusterDomain) + port: + number: 80 diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role-binding.yaml new file mode 100644 index 0000000..c868ca5 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-role +subjects: +- kind: ServiceAccount + name: service-account diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role.yaml new file mode 100644 index 0000000..5cb8e6e --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/cluster-role.yaml @@ -0,0 +1,25 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: cluster-role +rules: +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - '*' +- apiGroups: + - "" + resources: + - secrets + verbs: + - '*' +- apiGroups: + - "" + resources: + - pods + verbs: + - list + - delete + diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/config-map.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/config-map.yaml new file mode 100644 index 0000000..0de0997 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/config-map.yaml @@ -0,0 +1,131 @@ +apiVersion: v1 +data: + create_ca.sh: | + #!/bin/bash + + set -e + + usage() { + cat <> ${tmpdir}/csr.conf + [req] + req_extensions = v3_req + distinguished_name = req_distinguished_name + [req_distinguished_name] + [ v3_req ] + basicConstraints = CA:FALSE + keyUsage = nonRepudiation, digitalSignature, keyEncipherment + extendedKeyUsage = serverAuth + subjectAltName = @alt_names + [alt_names] + DNS.1 = ${service} + DNS.2 = ${service}.${namespace} + DNS.3 = ${service}.${namespace}.svc + EOF + + openssl genrsa -out ${tmpdir}/server-key.pem 2048 + openssl req -new -key ${tmpdir}/server-key.pem -subj "/CN=${service}.${namespace}.svc" -out ${tmpdir}/server.csr -config ${tmpdir}/csr.conf + + # Self sign + openssl x509 -req -days 365 -in ${tmpdir}/server.csr -CA ${tmpdir}/self_ca.crt -CAkey ${tmpdir}/self_ca.key -CAcreateserial -out ${tmpdir}/server-cert.pem + + # create the secret with CA cert and server cert/key + kubectl create secret generic ${secret} \ + --from-file=key.pem=${tmpdir}/server-key.pem \ + --from-file=cert.pem=${tmpdir}/server-cert.pem \ + --dry-run -o yaml | + kubectl -n ${namespace} apply -f - + + # Webhook pod needs to be restarted so that the service reload the secret + # http://github.com/kueflow/kubeflow/issues/3227 + webhookPod=$(kubectl get pods -n ${namespace} |grep ${webhookDeploymentName} |awk '{print $1;}') + # ignore error if webhook pod does not exist + kubectl delete pod ${webhookPod} 2>/dev/null || true + echo "webhook ${webhookPod} is restarted to utilize the new secret" + + cat ${tmpdir}/self_ca.crt + + # -a means base64 encode + caBundle=$(cat ${tmpdir}/self_ca.crt | openssl enc -a -A) + echo ${caBundle} + + patchString='[{"op": "replace", "path": "/webhooks/0/clientConfig/caBundle", "value":"{{CA_BUNDLE}}"}]' + patchString=$(echo ${patchString} | sed "s|{{CA_BUNDLE}}|${caBundle}|g") + echo ${patchString} + + checkWebhookConfig() { + currentBundle=$(kubectl get mutatingwebhookconfigurations -n ${namespace} ${mutatingWebhookConfigName} -o jsonpath='{.webhooks[0].clientConfig.caBundle}') + [[ "$currentBundle" == "$caBundle" ]] + } + + while true; do + if ! checkWebhookConfig; then + echo "patching ca bundle for webhook configuration..." + kubectl patch mutatingwebhookconfiguration ${mutatingWebhookConfigName} \ + --type='json' -p="${patchString}" + fi + sleep 10 + done +kind: ConfigMap +metadata: + name: config-map diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/kustomization.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/kustomization.yaml new file mode 100644 index 0000000..007bfa0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/kustomization.yaml @@ -0,0 +1,39 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- config-map.yaml +- service-account.yaml +- stateful-set.yaml +commonLabels: + kustomize.component: admission-webhook-bootstrap +namePrefix: admission-webhook-bootstrap- +images: + - name: gcr.io/kubeflow-images-public/ingress-setup + newName: gcr.io/kubeflow-images-public/ingress-setup + newTag: latest +generatorOptions: + disableNameSuffixHash: true +configurations: +- params.yaml +namespace: kubeflow +configMapGenerator: +- name: config-map + behavior: merge + env: params.env +vars: +- name: webhookNamePrefix + objref: + kind: ConfigMap + name: config-map + apiVersion: v1 + fieldref: + fieldpath: data.webhookNamePrefix +- name: namespace + objref: + kind: ConfigMap + name: config-map + apiVersion: v1 + fieldref: + fieldpath: data.namespace diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/params.env b/kubeflow/kfapp/kustomize/bootstrap/base/params.env new file mode 100644 index 0000000..764fb2f --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/params.env @@ -0,0 +1,2 @@ +namespace=kubeflow +webhookNamePrefix=admission-webhook- diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/params.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/params.yaml new file mode 100644 index 0000000..3c77a16 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: data/create_ca.sh + kind: ConfigMap diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/service-account.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/service-account.yaml new file mode 100644 index 0000000..a36cbd8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: service-account diff --git a/kubeflow/kfapp/kustomize/bootstrap/base/stateful-set.yaml b/kubeflow/kfapp/kustomize/bootstrap/base/stateful-set.yaml new file mode 100644 index 0000000..2ce2a98 --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/base/stateful-set.yaml @@ -0,0 +1,26 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: stateful-set +spec: + replicas: 1 + serviceName: service + template: + spec: + containers: + - command: + - sh + - /var/webhook-config/create_ca.sh + image: gcr.io/kubeflow-images-public/ingress-setup:latest + name: bootstrap + volumeMounts: + - mountPath: /var/webhook-config/ + name: admission-webhook-config + restartPolicy: Always + serviceAccountName: service-account + volumes: + - configMap: + name: config-map + name: admission-webhook-config + # Workaround for https://github.com/kubernetes-sigs/kustomize/issues/677 + volumeClaimTemplates: [] diff --git a/kubeflow/kfapp/kustomize/bootstrap/kustomization.yaml b/kubeflow/kfapp/kustomize/bootstrap/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/bootstrap/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole-binding.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole-binding.yaml new file mode 100644 index 0000000..6731c5a --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole-binding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app: centraldashboard + name: centraldashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: centraldashboard +subjects: +- kind: ServiceAccount + name: centraldashboard + namespace: $(namespace) diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole.yaml new file mode 100644 index 0000000..aa251d2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/clusterrole.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: centraldashboard + name: centraldashboard +rules: +- apiGroups: + - "" + resources: + - events + - namespaces + - nodes + verbs: + - get + - list + - watch diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/deployment.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/deployment.yaml new file mode 100644 index 0000000..2ed1e00 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + labels: + app: centraldashboard + name: centraldashboard +spec: + replicas: 1 + selector: + matchLabels: + app: centraldashboard + template: + metadata: + labels: + app: centraldashboard + spec: + containers: + - image: gcr.io/kubeflow-images-public/centraldashboard:v0.5.0 + imagePullPolicy: IfNotPresent + name: centraldashboard + ports: + - containerPort: 8082 + protocol: TCP + env: + - name: USERID_HEADER + value: $(userid-header) + - name: USERID_PREFIX + value: $(userid-prefix) + - name: PROFILES_KFAM_SERVICE_HOST + value: profiles-kfam.kubeflow + serviceAccountName: centraldashboard diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/kustomization.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/kustomization.yaml new file mode 100644 index 0000000..fcc665a --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/kustomization.yaml @@ -0,0 +1,54 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- clusterrole-binding.yaml +- clusterrole.yaml +- deployment.yaml +- role-binding.yaml +- role.yaml +- service-account.yaml +- service.yaml +namespace: kubeflow +commonLabels: + kustomize.component: centraldashboard +images: + - name: gcr.io/kubeflow-images-public/centraldashboard + newName: gcr.io/kubeflow-images-public/centraldashboard + newTag: v20190823-v0.6.0-rc.0-69-gcb7dab59 +configMapGenerator: +- name: parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: namespace + objref: + kind: Service + name: centraldashboard + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: clusterDomain + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +- name: userid-header + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-header +- name: userid-prefix + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-prefix +configurations: +- params.yaml + diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/params.env b/kubeflow/kfapp/kustomize/centraldashboard/base/params.env new file mode 100644 index 0000000..8aa02e9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/params.env @@ -0,0 +1,3 @@ +clusterDomain=cluster.local +userid-header= +userid-prefix= diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/params.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/params.yaml new file mode 100644 index 0000000..29daaa8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/params.yaml @@ -0,0 +1,9 @@ +varReference: +- path: metadata/annotations/getambassador.io\/config + kind: Service +- path: spec/http/route/destination/host + kind: VirtualService +- path: spec/template/spec/containers/0/env/0/value + kind: Deployment +- path: spec/template/spec/containers/0/env/1/value + kind: Deployment \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/role-binding.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/role-binding.yaml new file mode 100644 index 0000000..53eedc8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/role-binding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app: centraldashboard + name: centraldashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: centraldashboard +subjects: +- kind: ServiceAccount + name: centraldashboard + namespace: $(namespace) diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/role.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/role.yaml new file mode 100644 index 0000000..11ffd36 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/role.yaml @@ -0,0 +1,25 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app: centraldashboard + name: centraldashboard +rules: +- apiGroups: + - "" + - "app.k8s.io" + resources: + - applications + - pods + - pods/exec + - pods/log + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - get diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/service-account.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/service-account.yaml new file mode 100644 index 0000000..b5a417a --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: centraldashboard diff --git a/kubeflow/kfapp/kustomize/centraldashboard/base/service.yaml b/kubeflow/kfapp/kustomize/centraldashboard/base/service.yaml new file mode 100644 index 0000000..363af0c --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/base/service.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: centralui-mapping + prefix: / + rewrite: / + service: centraldashboard.$(namespace) + labels: + app: centraldashboard + name: centraldashboard +spec: + ports: + - port: 80 + protocol: TCP + targetPort: 8082 + selector: + app: centraldashboard + sessionAffinity: None + type: ClusterIP diff --git a/kubeflow/kfapp/kustomize/centraldashboard/kustomization.yaml b/kubeflow/kfapp/kustomize/centraldashboard/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/application.yaml new file mode 100644 index 0000000..b9395ea --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/application.yaml @@ -0,0 +1,52 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: centraldashboard +spec: + selector: + matchLabels: + app.kubernetes.io/name: + app.kubernetes.io/instance: centraldashboard + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: centraldashboard + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 + componentKinds: + - group: core + kind: ConfigMap + - group: apps + kind: Deployment + - group: rbac.authorization.k8s.io + kind: RoleBinding + - group: rbac.authorization.k8s.io + kind: Role + - group: core + kind: ServiceAccount + - group: networking.istio.io + kind: VirtualService + descriptor: + type: centraldashboard + version: v0.6.2 + description: Provides a Dashboard UI for kubeflow + maintainers: + - name: Jason Prodonovich + email: prodonjs@gmail.com + - name: Apoorv Verma + email: apverma@google.com + - name: Adhita Selvaraj + email: adhita94@gmail.com + owners: + - name: Jason Prodonovich + email: prodonjs@gmail.com + - name: Apoorv Verma + email: apverma@google.com + - name: Adhita Selvaraj + email: adhita94@gmail.com + keywords: + - centraldashboard + - kubeflow + links: + - description: About + url: https://github.com/kubeflow/kubeflow/tree/master/components/centraldashboard + addOwnerRef: true + diff --git a/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/kustomization.yaml new file mode 100644 index 0000000..8b5827b --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: centraldashboard + app.kubernetes.io/instance: centraldashboard + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: centraldashboard + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..2718e55 --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml + diff --git a/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..f302d9d --- /dev/null +++ b/kubeflow/kfapp/kustomize/centraldashboard/overlays/istio/virtual-service.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: centraldashboard +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: / + rewrite: + uri: / + route: + - destination: + host: centraldashboard.$(namespace).svc.$(clusterDomain) + port: + number: 80 diff --git a/kubeflow/kfapp/kustomize/istio-crds/base/crds.yaml b/kubeflow/kfapp/kustomize/istio-crds/base/crds.yaml new file mode 100644 index 0000000..f58a3c2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-crds/base/crds.yaml @@ -0,0 +1,1535 @@ +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: virtualservices.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: VirtualService + listKind: VirtualServiceList + plural: virtualservices + singular: virtualservice + shortNames: + - vs + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 + additionalPrinterColumns: + - JSONPath: .spec.gateways + description: The names of gateways and sidecars that should apply these routes + name: Gateways + type: string + - JSONPath: .spec.hosts + description: The destination hosts to which traffic is being sent + name: Hosts + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: destinationrules.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: DestinationRule + listKind: DestinationRuleList + plural: destinationrules + singular: destinationrule + shortNames: + - dr + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 + additionalPrinterColumns: + - JSONPath: .spec.host + description: The name of a service from the service registry + name: Host + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: serviceentries.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: ServiceEntry + listKind: ServiceEntryList + plural: serviceentries + singular: serviceentry + shortNames: + - se + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 + additionalPrinterColumns: + - JSONPath: .spec.hosts + description: The hosts associated with the ServiceEntry + name: Hosts + type: string + - JSONPath: .spec.location + description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) + name: Location + type: string + - JSONPath: .spec.resolution + description: Service discovery mode for the hosts (NONE, STATIC, or DNS) + name: Resolution + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: gateways.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: Gateway + plural: gateways + singular: gateway + shortNames: + - gw + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: envoyfilters.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: EnvoyFilter + plural: envoyfilters + singular: envoyfilter + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: clusterrbacconfigs.rbac.istio.io + labels: + app: istio-pilot + istio: rbac + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: rbac.istio.io + names: + kind: ClusterRbacConfig + plural: clusterrbacconfigs + singular: clusterrbacconfig + categories: + - istio-io + - rbac-istio-io + scope: Cluster + version: v1alpha1 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: policies.authentication.istio.io + labels: + app: istio-citadel + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: authentication.istio.io + names: + kind: Policy + plural: policies + singular: policy + categories: + - istio-io + - authentication-istio-io + scope: Namespaced + version: v1alpha1 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: meshpolicies.authentication.istio.io + labels: + app: istio-citadel + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: authentication.istio.io + names: + kind: MeshPolicy + listKind: MeshPolicyList + plural: meshpolicies + singular: meshpolicy + categories: + - istio-io + - authentication-istio-io + scope: Cluster + version: v1alpha1 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: httpapispecbindings.config.istio.io + labels: + app: istio-mixer + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: HTTPAPISpecBinding + plural: httpapispecbindings + singular: httpapispecbinding + categories: + - istio-io + - apim-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: httpapispecs.config.istio.io + labels: + app: istio-mixer + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: HTTPAPISpec + plural: httpapispecs + singular: httpapispec + categories: + - istio-io + - apim-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: quotaspecbindings.config.istio.io + labels: + app: istio-mixer + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: QuotaSpecBinding + plural: quotaspecbindings + singular: quotaspecbinding + categories: + - istio-io + - apim-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: quotaspecs.config.istio.io + labels: + app: istio-mixer + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: QuotaSpec + plural: quotaspecs + singular: quotaspec + categories: + - istio-io + - apim-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: rules.config.istio.io + labels: + app: mixer + package: istio.io.mixer + istio: core + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: rule + plural: rules + singular: rule + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: attributemanifests.config.istio.io + labels: + app: mixer + package: istio.io.mixer + istio: core + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: attributemanifest + plural: attributemanifests + singular: attributemanifest + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: bypasses.config.istio.io + labels: + app: mixer + package: bypass + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: bypass + plural: bypasses + singular: bypass + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: circonuses.config.istio.io + labels: + app: mixer + package: circonus + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: circonus + plural: circonuses + singular: circonus + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: deniers.config.istio.io + labels: + app: mixer + package: denier + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: denier + plural: deniers + singular: denier + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: fluentds.config.istio.io + labels: + app: mixer + package: fluentd + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: fluentd + plural: fluentds + singular: fluentd + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: kubernetesenvs.config.istio.io + labels: + app: mixer + package: kubernetesenv + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: kubernetesenv + plural: kubernetesenvs + singular: kubernetesenv + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: listcheckers.config.istio.io + labels: + app: mixer + package: listchecker + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: listchecker + plural: listcheckers + singular: listchecker + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: memquotas.config.istio.io + labels: + app: mixer + package: memquota + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: memquota + plural: memquotas + singular: memquota + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: noops.config.istio.io + labels: + app: mixer + package: noop + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: noop + plural: noops + singular: noop + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: opas.config.istio.io + labels: + app: mixer + package: opa + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: opa + plural: opas + singular: opa + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: prometheuses.config.istio.io + labels: + app: mixer + package: prometheus + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: prometheus + plural: prometheuses + singular: prometheus + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: rbacs.config.istio.io + labels: + app: mixer + package: rbac + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: rbac + plural: rbacs + singular: rbac + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: redisquotas.config.istio.io + labels: + app: mixer + package: redisquota + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: redisquota + plural: redisquotas + singular: redisquota + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: signalfxs.config.istio.io + labels: + app: mixer + package: signalfx + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: signalfx + plural: signalfxs + singular: signalfx + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: solarwindses.config.istio.io + labels: + app: mixer + package: solarwinds + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: solarwinds + plural: solarwindses + singular: solarwinds + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: stackdrivers.config.istio.io + labels: + app: mixer + package: stackdriver + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: stackdriver + plural: stackdrivers + singular: stackdriver + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: statsds.config.istio.io + labels: + app: mixer + package: statsd + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: statsd + plural: statsds + singular: statsd + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: stdios.config.istio.io + labels: + app: mixer + package: stdio + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: stdio + plural: stdios + singular: stdio + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: apikeys.config.istio.io + labels: + app: mixer + package: apikey + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: apikey + plural: apikeys + singular: apikey + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: authorizations.config.istio.io + labels: + app: mixer + package: authorization + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: authorization + plural: authorizations + singular: authorization + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: checknothings.config.istio.io + labels: + app: mixer + package: checknothing + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: checknothing + plural: checknothings + singular: checknothing + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: kuberneteses.config.istio.io + labels: + app: mixer + package: adapter.template.kubernetes + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: kubernetes + plural: kuberneteses + singular: kubernetes + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: listentries.config.istio.io + labels: + app: mixer + package: listentry + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: listentry + plural: listentries + singular: listentry + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: logentries.config.istio.io + labels: + app: mixer + package: logentry + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: logentry + plural: logentries + singular: logentry + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 + additionalPrinterColumns: + - JSONPath: .spec.severity + description: The importance of the log entry + name: Severity + type: string + - JSONPath: .spec.timestamp + description: The time value for the log entry + name: Timestamp + type: string + - JSONPath: .spec.monitored_resource_type + description: Optional expression to compute the type of the monitored resource this log entry is being recorded on + name: Res Type + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: edges.config.istio.io + labels: + app: mixer + package: edge + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: edge + plural: edges + singular: edge + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: metrics.config.istio.io + labels: + app: mixer + package: metric + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: metric + plural: metrics + singular: metric + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: quotas.config.istio.io + labels: + app: mixer + package: quota + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: quota + plural: quotas + singular: quota + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: reportnothings.config.istio.io + labels: + app: mixer + package: reportnothing + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: reportnothing + plural: reportnothings + singular: reportnothing + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: tracespans.config.istio.io + labels: + app: mixer + package: tracespan + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: tracespan + plural: tracespans + singular: tracespan + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: rbacconfigs.rbac.istio.io + labels: + app: mixer + package: istio.io.mixer + istio: rbac + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: rbac.istio.io + names: + kind: RbacConfig + plural: rbacconfigs + singular: rbacconfig + categories: + - istio-io + - rbac-istio-io + scope: Namespaced + version: v1alpha1 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: serviceroles.rbac.istio.io + labels: + app: mixer + package: istio.io.mixer + istio: rbac + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: rbac.istio.io + names: + kind: ServiceRole + plural: serviceroles + singular: servicerole + categories: + - istio-io + - rbac-istio-io + scope: Namespaced + version: v1alpha1 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: servicerolebindings.rbac.istio.io + labels: + app: mixer + package: istio.io.mixer + istio: rbac + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: rbac.istio.io + names: + kind: ServiceRoleBinding + plural: servicerolebindings + singular: servicerolebinding + categories: + - istio-io + - rbac-istio-io + scope: Namespaced + version: v1alpha1 + additionalPrinterColumns: + - JSONPath: .spec.roleRef.name + description: The name of the ServiceRole object being referenced + name: Reference + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: adapters.config.istio.io + labels: + app: mixer + package: adapter + istio: mixer-adapter + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: adapter + plural: adapters + singular: adapter + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: instances.config.istio.io + labels: + app: mixer + package: instance + istio: mixer-instance + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: instance + plural: instances + singular: instance + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: templates.config.istio.io + labels: + app: mixer + package: template + istio: mixer-template + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: template + plural: templates + singular: template + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: handlers.config.istio.io + labels: + app: mixer + package: handler + istio: mixer-handler + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: handler + plural: handlers + singular: handler + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: cloudwatches.config.istio.io + labels: + app: mixer + package: cloudwatch + istio: mixer-adapter + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: cloudwatch + plural: cloudwatches + singular: cloudwatch + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: dogstatsds.config.istio.io + labels: + app: mixer + package: dogstatsd + istio: mixer-adapter + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: dogstatsd + plural: dogstatsds + singular: dogstatsd + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: sidecars.networking.istio.io + labels: + app: istio-pilot + chart: istio + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: networking.istio.io + names: + kind: Sidecar + plural: sidecars + singular: sidecar + categories: + - istio-io + - networking-istio-io + scope: Namespaced + version: v1alpha3 +--- +kind: CustomResourceDefinition +apiVersion: apiextensions.k8s.io/v1beta1 +metadata: + name: zipkins.config.istio.io + labels: + app: mixer + package: zipkin + istio: mixer-adapter + annotations: + "helm.sh/resource-policy": keep +spec: + group: config.istio.io + names: + kind: zipkin + plural: zipkins + singular: zipkin + categories: + - istio-io + - policy-istio-io + scope: Namespaced + version: v1alpha2 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: clusterissuers.certmanager.k8s.io + labels: + app: certmanager + chart: certmanager + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: certmanager.k8s.io + version: v1alpha1 + names: + kind: ClusterIssuer + plural: clusterissuers + scope: Cluster +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: issuers.certmanager.k8s.io + labels: + app: certmanager + chart: certmanager + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + group: certmanager.k8s.io + version: v1alpha1 + names: + kind: Issuer + plural: issuers + scope: Namespaced +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: certificates.certmanager.k8s.io + labels: + app: certmanager + chart: certmanager + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + additionalPrinterColumns: + - JSONPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - JSONPath: .spec.secretName + name: Secret + type: string + - JSONPath: .spec.issuerRef.name + name: Issuer + type: string + priority: 1 + - JSONPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + priority: 1 + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date + group: certmanager.k8s.io + version: v1alpha1 + scope: Namespaced + names: + kind: Certificate + plural: certificates + shortNames: + - cert + - certs +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: orders.certmanager.k8s.io + labels: + app: certmanager + chart: certmanager + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + additionalPrinterColumns: + - JSONPath: .status.state + name: State + type: string + - JSONPath: .spec.issuerRef.name + name: Issuer + type: string + priority: 1 + - JSONPath: .status.reason + name: Reason + type: string + priority: 1 + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date + group: certmanager.k8s.io + version: v1alpha1 + names: + kind: Order + plural: orders + scope: Namespaced +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: challenges.certmanager.k8s.io + labels: + app: certmanager + chart: certmanager + heritage: Tiller + release: istio + annotations: + "helm.sh/resource-policy": keep +spec: + additionalPrinterColumns: + - JSONPath: .status.state + name: State + type: string + - JSONPath: .spec.dnsName + name: Domain + type: string + - JSONPath: .status.reason + name: Reason + type: string + - JSONPath: .metadata.creationTimestamp + description: |- + CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + name: Age + type: date + group: certmanager.k8s.io + version: v1alpha1 + names: + kind: Challenge + plural: challenges + scope: Namespaced diff --git a/kubeflow/kfapp/kustomize/istio-crds/base/kustomization.yaml b/kubeflow/kfapp/kustomize/istio-crds/base/kustomization.yaml new file mode 100644 index 0000000..ca49cac --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-crds/base/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- crds.yaml +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/istio-crds/kustomization.yaml b/kubeflow/kfapp/kustomize/istio-crds/kustomization.yaml new file mode 100644 index 0000000..e907d64 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-crds/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: istio-system diff --git a/kubeflow/kfapp/kustomize/istio-install/base/istio-noauth.yaml b/kubeflow/kfapp/kustomize/istio-install/base/istio-noauth.yaml new file mode 100644 index 0000000..baec863 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-install/base/istio-noauth.yaml @@ -0,0 +1,17336 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: istio-system + labels: + istio-injection: disabled +--- +# Source: istio/charts/kiali/templates/demosecret.yaml + +apiVersion: v1 +kind: Secret +metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +type: Opaque +data: + username: YWRtaW4= # admin + passphrase: YWRtaW4= # admin + +--- +# Source: istio/charts/galley/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-galley-configuration + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley +data: + validatingwebhookconfiguration.yaml: |- + apiVersion: admissionregistration.k8s.io/v1beta1 + kind: ValidatingWebhookConfiguration + metadata: + name: istio-galley + namespace: istio-system + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley + webhooks: + - name: pilot.validation.istio.io + clientConfig: + service: + name: istio-galley + namespace: istio-system + path: "/admitpilot" + caBundle: "" + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - config.istio.io + apiVersions: + - v1alpha2 + resources: + - httpapispecs + - httpapispecbindings + - quotaspecs + - quotaspecbindings + - operations: + - CREATE + - UPDATE + apiGroups: + - rbac.istio.io + apiVersions: + - "*" + resources: + - "*" + - operations: + - CREATE + - UPDATE + apiGroups: + - authentication.istio.io + apiVersions: + - "*" + resources: + - "*" + - operations: + - CREATE + - UPDATE + apiGroups: + - networking.istio.io + apiVersions: + - "*" + resources: + - destinationrules + - envoyfilters + - gateways + - serviceentries + - sidecars + - virtualservices + failurePolicy: Fail + - name: mixer.validation.istio.io + clientConfig: + service: + name: istio-galley + namespace: istio-system + path: "/admitmixer" + caBundle: "" + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - config.istio.io + apiVersions: + - v1alpha2 + resources: + - rules + - attributemanifests + - circonuses + - deniers + - fluentds + - kubernetesenvs + - listcheckers + - memquotas + - noops + - opas + - prometheuses + - rbacs + - solarwindses + - stackdrivers + - cloudwatches + - dogstatsds + - statsds + - stdios + - apikeys + - authorizations + - checknothings + # - kuberneteses + - listentries + - logentries + - metrics + - quotas + - reportnothings + - tracespans + failurePolicy: Fail +--- +# Source: istio/charts/grafana/templates/configmap-custom-resources.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-custom-resources + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + custom-resources.yaml: |- + apiVersion: authentication.istio.io/v1alpha1 + kind: Policy + metadata: + name: grafana-ports-mtls-disabled + namespace: istio-system + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + spec: + targets: + - name: grafana + ports: + - number: 3000 + run.sh: |- + #!/bin/sh + + set -x + + if [ "$#" -ne "1" ]; then + echo "first argument should be path to custom resource yaml" + exit 1 + fi + + pathToResourceYAML=${1} + + kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null + if [ "$?" -eq 0 ]; then + echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready" + while true; do + kubectl -n istio-system get deployment istio-galley 2>/dev/null + if [ "$?" -eq 0 ]; then + break + fi + sleep 1 + done + kubectl -n istio-system rollout status deployment istio-galley + if [ "$?" -ne 0 ]; then + echo "istio-galley deployment rollout status check failed" + exit 1 + fi + echo "istio-galley deployment ready for configuration validation" + fi + sleep 5 + kubectl apply -f ${pathToResourceYAML} + + +--- +# Source: istio/charts/grafana/templates/configmap-dashboards.yaml + +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-galley-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + galley-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 0, + "links": [], + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 5, + "w": 24, + "x": 0, + "y": 0 + }, + "id": 46, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(istio_build{component=\"galley\"}) by (tag)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ tag }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Galley Versions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 5 + }, + "id": 40, + "panels": [], + "title": "Resource Usage", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 6, + "x": 0, + "y": 6 + }, + "id": 36, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "process_virtual_memory_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Virtual Memory", + "refId": "A" + }, + { + "expr": "process_resident_memory_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Resident Memory", + "refId": "B" + }, + { + "expr": "go_memstats_heap_sys_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "heap sys", + "refId": "C" + }, + { + "expr": "go_memstats_heap_alloc_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "heap alloc", + "refId": "D" + }, + { + "expr": "go_memstats_alloc_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Alloc", + "refId": "F" + }, + { + "expr": "go_memstats_heap_inuse_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Heap in-use", + "refId": "G" + }, + { + "expr": "go_memstats_stack_inuse_bytes{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Stack in-use", + "refId": "H" + }, + { + "expr": "sum(container_memory_usage_bytes{container_name=~\"galley\", pod_name=~\"istio-galley-.*\"})", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Total (kis)", + "refId": "E" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Memory", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 6, + "x": 6, + "y": 6 + }, + "id": 38, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(container_cpu_usage_seconds_total{container_name=~\"galley\", pod_name=~\"istio-galley-.*\"}[1m]))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Total (k8s)", + "refId": "A" + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{container_name=~\"galley\", pod_name=~\"istio-galley-.*\"}[1m])) by (container_name)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ container_name }} (k8s)", + "refId": "B" + }, + { + "expr": "irate(process_cpu_seconds_total{job=\"galley\"}[1m])", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "galley (self-reported)", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "CPU", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 6, + "x": 12, + "y": 6 + }, + "id": 42, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "process_open_fds{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Open FDs (galley)", + "refId": "A" + }, + { + "expr": "container_fs_usage_bytes{container_name=~\"galley\", pod_name=~\"istio-galley-.*\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ container_name }} ", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Disk", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 6, + "x": 18, + "y": 6 + }, + "id": 44, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "go_goroutines{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "goroutines_total", + "refId": "A" + }, + { + "expr": "galley_mcp_source_clients_total", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "clients_total", + "refId": "B" + }, + { + "expr": "go_goroutines{job=\"galley\"}/galley_mcp_source_clients_total", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "avg_goroutines_per_client", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Goroutines", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 14 + }, + "id": 10, + "panels": [], + "title": "Runtime", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 15 + }, + "id": 2, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(galley_runtime_strategy_on_change_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Strategy Change Events", + "refId": "A" + }, + { + "expr": "sum(rate(galley_runtime_processor_events_processed_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Processed Events", + "refId": "B" + }, + { + "expr": "sum(rate(galley_runtime_processor_snapshots_published_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Snapshot Published", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Event Rates", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Events/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": "", + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 15 + }, + "id": 4, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(galley_runtime_strategy_timer_max_time_reached_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Max Time Reached", + "refId": "A" + }, + { + "expr": "sum(rate(galley_runtime_strategy_timer_quiesce_reached_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Quiesce Reached", + "refId": "B" + }, + { + "expr": "sum(rate(galley_runtime_strategy_timer_resets_total[1m])) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Timer Resets", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Timer Rates", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Events/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 15 + }, + "id": 8, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 3, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": true, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "P50", + "refId": "A" + }, + { + "expr": "histogram_quantile(0.90, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "P90", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.95, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "P95", + "refId": "C" + }, + { + "expr": "histogram_quantile(0.99, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "P99", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Events Per Snapshot", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 21 + }, + "id": 6, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum by (typeURL) (galley_runtime_state_type_instances_total)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ typeURL }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "State Type Instances", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Count", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 27 + }, + "id": 34, + "panels": [], + "title": "Validation", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 28 + }, + "id": 28, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "galley_validation_cert_key_updates{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Key Updates", + "refId": "A" + }, + { + "expr": "galley_validation_cert_key_update_errors{job=\"galley\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Key Update Errors: {{ error }}", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Validation Webhook Certificate", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 28 + }, + "id": 30, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(galley_validation_passed{job=\"galley\"}) by (group, version, resource)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Passed: {{ group }}/{{ version }}/{{resource}}", + "refId": "A" + }, + { + "expr": "sum(galley_validation_failed{job=\"galley\"}) by (group, version, resource, reason)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Failed: {{ group }}/{{ version }}/{{resource}} ({{ reason}})", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Resource Validation", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 28 + }, + "id": 32, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(galley_validation_http_error{job=\"galley\"}) by (status)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ status }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Validation HTTP Errors", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 34 + }, + "id": 12, + "panels": [], + "title": "Kubernetes Source", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 35 + }, + "id": 14, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "rate(galley_source_kube_event_success_total[1m]) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Success", + "refId": "A" + }, + { + "expr": "rate(galley_source_kube_event_error_total[1m]) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Error", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Source Event Rate", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Events/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 35 + }, + "id": 16, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "rate(galley_source_kube_dynamic_converter_success_total[1m]) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{apiVersion=\"{{apiVersion}}\",group=\"{{group}}\",kind=\"{{kind}}\"}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Kubernetes Object Conversion Successes", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Conversions/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 35 + }, + "id": 24, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "rate(galley_source_kube_dynamic_converter_failure_total[1m]) * 60", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Error", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Kubernetes Object Conversion Failures", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "Failures/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 41 + }, + "id": 18, + "panels": [], + "title": "Mesh Configuration Protocol", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 42 + }, + "id": 20, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(galley_mcp_source_clients_total)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Clients", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Connected Clients", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 42 + }, + "id": 22, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum by(collection)(irate(galley_mcp_source_request_acks_total[1m]) * 60)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Request ACKs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "ACKs/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 42 + }, + "id": 26, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "rate(galley_mcp_source_request_nacks_total[1m]) * 60", + "format": "time_series", + "intervalFactor": 1, + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Request NACKs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "NACKs/min", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": "5s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Istio Galley Dashboard", + "uid": "TSEY6jLmk", + "version": 1 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-istio-mesh-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + istio-mesh-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__requires": [ + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "5.2.3" + }, + { + "type": "panel", + "id": "graph", + "name": "Graph", + "version": "5.0.0" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "singlestat", + "name": "Singlestat", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "table", + "name": "Table", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "text", + "name": "Text", + "version": "5.0.0" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 0, + "id": null, + "links": [], + "panels": [ + { + "content": "
\n
\n Istio\n
\n
\n Istio is an open platform that provides a uniform way to connect,\n manage, and \n secure microservices.\n
\n Need help? Join the Istio community.\n
\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 0 + }, + "height": "50px", + "id": 13, + "links": [], + "mode": "html", + "style": { + "font-size": "18pt" + }, + "title": "", + "transparent": true, + "type": "text" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 0, + "y": 3 + }, + "id": 20, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\"}[1m])), 0.001)", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "Global Request Volume", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "percentunit", + "gauge": { + "maxValue": 100, + "minValue": 80, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": false + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 6, + "y": 3 + }, + "id": 21, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(rate(istio_requests_total{reporter=\"destination\", response_code!~\"5.*\"}[1m])) / sum(rate(istio_requests_total{reporter=\"destination\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "95, 99, 99.5", + "title": "Global Success Rate (non-5xx responses)", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 12, + "y": 3 + }, + "id": 22, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", response_code=~\"4.*\"}[1m])) ", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "4xxs", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 18, + "y": 3 + }, + "id": 23, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", response_code=~\"5.*\"}[1m])) ", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "5xxs", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "columns": [], + "datasource": "Prometheus", + "fontSize": "100%", + "gridPos": { + "h": 21, + "w": 24, + "x": 0, + "y": 6 + }, + "hideTimeOverride": false, + "id": 73, + "links": [], + "pageSize": null, + "repeat": null, + "repeatDirection": "v", + "scroll": true, + "showHeader": true, + "sort": { + "col": 4, + "desc": true + }, + "styles": [ + { + "alias": "Workload", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": false, + "linkTargetBlank": false, + "linkTooltip": "Workload dashboard", + "linkUrl": "/dashboard/db/istio-workload-dashboard?var-namespace=$__cell_2&var-workload=$__cell_", + "pattern": "destination_workload", + "preserveFormat": false, + "sanitize": false, + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Time", + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "Requests", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #A", + "thresholds": [], + "type": "number", + "unit": "ops" + }, + { + "alias": "P50 Latency", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #B", + "thresholds": [], + "type": "number", + "unit": "s" + }, + { + "alias": "P90 Latency", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #D", + "thresholds": [], + "type": "number", + "unit": "s" + }, + { + "alias": "P99 Latency", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #E", + "thresholds": [], + "type": "number", + "unit": "s" + }, + { + "alias": "Success Rate", + "colorMode": "cell", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #F", + "thresholds": [ + ".95", + " 1.00" + ], + "type": "number", + "unit": "percentunit" + }, + { + "alias": "Workload", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": true, + "linkTooltip": "$__cell dashboard", + "linkUrl": "/dashboard/db/istio-workload-dashboard?var-workload=$__cell_2&var-namespace=$__cell_3", + "pattern": "destination_workload_var", + "thresholds": [], + "type": "number", + "unit": "short" + }, + { + "alias": "Service", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": true, + "linkTooltip": "$__cell dashboard", + "linkUrl": "/dashboard/db/istio-service-dashboard?var-service=$__cell", + "pattern": "destination_service", + "thresholds": [], + "type": "string", + "unit": "short" + }, + { + "alias": "", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "destination_workload_namespace", + "thresholds": [], + "type": "hidden", + "unit": "short" + } + ], + "targets": [ + { + "expr": "label_join(sum(rate(istio_requests_total{reporter=\"destination\", response_code=\"200\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload}}.{{ destination_workload_namespace }}", + "refId": "A" + }, + { + "expr": "label_join(histogram_quantile(0.50, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload}}.{{ destination_workload_namespace }}", + "refId": "B" + }, + { + "expr": "label_join(histogram_quantile(0.90, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}", + "refId": "D" + }, + { + "expr": "label_join(histogram_quantile(0.99, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}", + "refId": "E" + }, + { + "expr": "label_join((sum(rate(istio_requests_total{reporter=\"destination\", response_code!~\"5.*\"}[1m])) by (destination_workload, destination_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\"}[1m])) by (destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}", + "refId": "F" + } + ], + "timeFrom": null, + "title": "HTTP/GRPC Workloads", + "transform": "table", + "transparent": false, + "type": "table" + }, + { + "columns": [], + "datasource": "Prometheus", + "fontSize": "100%", + "gridPos": { + "h": 18, + "w": 24, + "x": 0, + "y": 27 + }, + "hideTimeOverride": false, + "id": 109, + "links": [], + "pageSize": null, + "repeatDirection": "v", + "scroll": true, + "showHeader": true, + "sort": { + "col": 2, + "desc": true + }, + "styles": [ + { + "alias": "Workload", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": false, + "linkTargetBlank": false, + "linkTooltip": "$__cell dashboard", + "linkUrl": "/dashboard/db/istio-tcp-workload-dashboard?var-namespace=$__cell_2&&var-workload=$__cell", + "pattern": "destination_workload", + "preserveFormat": false, + "sanitize": false, + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "Bytes Sent", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #A", + "thresholds": [ + "" + ], + "type": "number", + "unit": "Bps" + }, + { + "alias": "Bytes Received", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #C", + "thresholds": [], + "type": "number", + "unit": "Bps" + }, + { + "alias": "", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Time", + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "Workload", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": true, + "linkTooltip": "$__cell dashboard", + "linkUrl": "/dashboard/db/istio-workload-dashboard?var-namespace=$__cell_3&var-workload=$__cell_2", + "pattern": "destination_workload_var", + "thresholds": [], + "type": "string", + "unit": "short" + }, + { + "alias": "", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "destination_workload_namespace", + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "Service", + "colorMode": null, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "link": true, + "linkTooltip": "$__cell dashboard", + "linkUrl": "/dashboard/db/istio-service-dashboard?var-service=$__cell", + "pattern": "destination_service", + "thresholds": [], + "type": "number", + "unit": "short" + } + ], + "targets": [ + { + "expr": "label_join(sum(rate(istio_tcp_received_bytes_total{reporter=\"source\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}", + "refId": "C" + }, + { + "expr": "label_join(sum(rate(istio_tcp_sent_bytes_total{reporter=\"source\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}", + "refId": "A" + } + ], + "timeFrom": null, + "title": "TCP Workloads", + "transform": "table", + "transparent": false, + "type": "table" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 24, + "x": 0, + "y": 45 + }, + "id": 111, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(istio_build) by (component, tag)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ component }}: {{ tag }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Istio Components by Version", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "transparent": false, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": "5s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "browser", + "title": "Istio Mesh Dashboard", + "version": 4 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-istio-performance-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + istio-performance-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__requires": [ + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "5.2.3" + }, + { + "type": "panel", + "id": "graph", + "name": "Graph", + "version": "5.0.0" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "text", + "name": "Text", + "version": "5.0.0" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 0, + "id": null, + "links": [], + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 12, + "x": 0, + "y": 0 + }, + "id": 2, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "(sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-telemetry-.*\",container_name=~\"mixer|istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-telemetry", + "refId": "A" + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-ingressgateway-.*\",container_name=\"istio-proxy\"}[1m])) / (round(sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\", reporter=\"source\"}[1m])), 0.001)/1000)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-ingressgateway", + "refId": "B" + }, + { + "expr": "(sum(rate(container_cpu_usage_seconds_total{namespace!=\"istio-system\",container_name=\"istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-proxy", + "refId": "C" + }, + { + "expr": "(sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-policy-.*\",container_name=~\"mixer|istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000)) / (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-policy", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "vCPU / 1k rps", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 12, + "x": 12, + "y": 0 + }, + "id": 6, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-telemetry-.*\",container_name=~\"mixer|istio-proxy\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-telemetry", + "refId": "A" + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-ingressgateway-.*\",container_name=\"istio-proxy\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-ingressgateway", + "refId": "B" + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{namespace!=\"istio-system\",container_name=\"istio-proxy\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-proxy", + "refId": "C" + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{pod_name=~\"istio-policy-.*\",container_name=~\"mixer|istio-proxy\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-policy", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "vCPU", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 12, + "x": 0, + "y": 9 + }, + "id": 4, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "(sum(container_memory_usage_bytes{pod_name=~\"istio-telemetry-.*\"}) / (sum(irate(istio_requests_total[1m])) / 1000)) / (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-telemetry / 1k rps", + "refId": "A" + }, + { + "expr": "sum(container_memory_usage_bytes{pod_name=~\"istio-ingressgateway-.*\"}) / count(container_memory_usage_bytes{pod_name=~\"istio-ingressgateway-.*\",container_name!=\"POD\"})", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "per istio-ingressgateway", + "refId": "C" + }, + { + "expr": "sum(container_memory_usage_bytes{namespace!=\"istio-system\",container_name=\"istio-proxy\"}) / count(container_memory_usage_bytes{namespace!=\"istio-system\",container_name=\"istio-proxy\"})", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "per istio-proxy", + "refId": "B" + }, + { + "expr": "(sum(container_memory_usage_bytes{pod_name=~\"istio-policy-.*\"}) / (sum(irate(istio_requests_total[1m])) / 1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-policy / 1k rps", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Memory", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 12, + "x": 12, + "y": 9 + }, + "id": 5, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(istio_response_bytes_sum{destination_workload=\"istio-telemetry\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload=\"istio-telemetry\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-telemetry", + "refId": "A" + }, + { + "expr": "sum(irate(istio_response_bytes_sum{source_workload=\"istio-ingressgateway\", reporter=\"source\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-ingressgateway", + "refId": "C" + }, + { + "expr": "sum(irate(istio_response_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m])) + sum(irate(istio_response_bytes_sum{destination_workload_namespace!=\"istio-system\", reporter=\"destination\"}[1m])) + sum(irate(istio_request_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload_namespace!=\"istio-system\", reporter=\"destination\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-proxy", + "refId": "D" + }, + { + "expr": "sum(irate(istio_response_bytes_sum{destination_workload=\"istio-policy\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload=\"istio-policy\"}[1m]))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "istio-policy", + "refId": "E" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes transferred / sec", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 9, + "w": 24, + "x": 0, + "y": 18 + }, + "id": 8, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(istio_build) by (component, tag)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ component }}: {{ tag }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Istio Components by Version", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "transparent": false, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "The charts on this dashboard are intended to show Istio main components cost in terms resources utilization under steady load.\n\n- **vCPU/1k rps:** shows vCPU utilization by the main Istio components normalized by 1000 requests/second. When idle or low traffic, this chart will be blank. The curve for istio-proxy refers to the services sidecars only. \n- **vCPU:** vCPU utilization by Istio components, not normalized.\n- **Memory:** memory footprint for the components. Telemetry and policy are normalized by 1k rps, and no data is shown when there is no traffic. For ingress and istio-proxy, the data is per instance. \n- **Bytes transferred/ sec:** shows the number of bytes flowing through each Istio component.", + "gridPos": { + "h": 4, + "w": 24, + "x": 0, + "y": 18 + }, + "id": 11, + "links": [], + "mode": "markdown", + "title": "Istio Performance Dashboard Readme", + "type": "text" + } + ], + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Istio Performance Dashboard", + "version": 4 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-istio-service-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + istio-service-dashboard.json: '{ + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 0, + "iteration": 1536442501501, + "links": [], + "panels": [ + { + "content": "
\nSERVICE: $service\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 0 + }, + "id": 89, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 0, + "y": 3 + }, + "id": 12, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\"}[5m])), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "Client Request Volume", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "current" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(50, 172, 45, 0.97)", + "rgba(237, 129, 40, 0.89)", + "rgba(245, 54, 54, 0.9)" + ], + "datasource": "Prometheus", + "decimals": null, + "format": "percentunit", + "gauge": { + "maxValue": 100, + "minValue": 80, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": false + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 6, + "y": 3 + }, + "id": 14, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\"}[5m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "B" + } + ], + "thresholds": "95, 99, 99.5", + "title": "Client Success Rate (non-5xx responses)", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 4, + "w": 6, + "x": 12, + "y": 3 + }, + "id": 87, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": false, + "hideZero": false, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "interval": "", + "intervalFactor": 1, + "legendFormat": "P50", + "refId": "A" + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P90", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P99", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Client Request Duration", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "#299c46", + "rgba(237, 129, 40, 0.89)", + "#d44a3a" + ], + "datasource": "Prometheus", + "format": "Bps", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 18, + "y": 3 + }, + "id": 84, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", destination_service=~\"$service\"}[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": "", + "title": "TCP Received Bytes", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 0, + "y": 7 + }, + "id": 97, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\"}[5m])), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "Server Request Volume", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "current" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(50, 172, 45, 0.97)", + "rgba(237, 129, 40, 0.89)", + "rgba(245, 54, 54, 0.9)" + ], + "datasource": "Prometheus", + "decimals": null, + "format": "percentunit", + "gauge": { + "maxValue": 100, + "minValue": 80, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": false + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 6, + "y": 7 + }, + "id": 98, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\"}[5m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "B" + } + ], + "thresholds": "95, 99, 99.5", + "title": "Server Success Rate (non-5xx responses)", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 4, + "w": 6, + "x": 12, + "y": 7 + }, + "id": 99, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": false, + "hideZero": false, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "interval": "", + "intervalFactor": 1, + "legendFormat": "P50", + "refId": "A" + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P90", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P99", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Server Request Duration", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "#299c46", + "rgba(237, 129, 40, 0.89)", + "#d44a3a" + ], + "datasource": "Prometheus", + "format": "Bps", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 6, + "x": 18, + "y": 7 + }, + "id": 100, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"source\", destination_service=~\"$service\"}[1m])) ", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": "", + "title": "TCP Sent Bytes", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "content": "
\nCLIENT WORKLOADS\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 11 + }, + "id": 45, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 0, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 14 + }, + "id": 25, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null as zero", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\",destination_service=~\"$service\",reporter=\"source\",source_workload=~\"$srcwl\",source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }} (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", reporter=\"source\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }}", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Requests by Source And Response Code", + "tooltip": { + "shared": false, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [ + "total" + ] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 14 + }, + "id": 26, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Success Rate (non-5xx responses) By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "label": null, + "logBase": 1, + "max": "1.01", + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "description": "", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 20 + }, + "id": 27, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Duration by Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 20 + }, + "id": 28, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 20 + }, + "id": 68, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Response Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 26 + }, + "id": 80, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Received from Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 26 + }, + "id": 82, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Sent to Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "
\nSERVICE WORKLOADS\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 32 + }, + "id": 69, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 0, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 35 + }, + "id": 90, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null as zero", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\",destination_service=~\"$service\",reporter=\"destination\",destination_workload=~\"$dstwl\",destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace, response_code), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} : {{ response_code }} (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", reporter=\"destination\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace, response_code), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} : {{ response_code }}", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Requests by Destination And Response Code", + "tooltip": { + "shared": false, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [ + "total" + ] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 35 + }, + "id": 91, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Success Rate (non-5xx responses) By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "label": null, + "logBase": 1, + "max": "1.01", + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "description": "", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 41 + }, + "id": 94, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Duration by Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 41 + }, + "id": 95, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 41 + }, + "id": 96, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Response Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 47 + }, + "id": 92, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace}} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace}}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Received from Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 47 + }, + "id": 93, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{destination_workload_namespace }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_workload }}.{{destination_workload_namespace }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Sent to Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": "10s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [ + { + "allValue": null, + "datasource": "Prometheus", + "hide": 0, + "includeAll": false, + "label": "Service", + "multi": false, + "name": "service", + "options": [], + "query": "label_values(destination_service)", + "refresh": 1, + "regex": "", + "sort": 0, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": { + "text": "All", + "value": "$__all" + }, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Client Workload Namespace", + "multi": true, + "name": "srcns", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=\"$service\"}) by (source_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\"}) by (source_workload_namespace))", + "refresh": 1, + "regex": "/.*namespace=\"([^\"]*).*/", + "sort": 2, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": { + "text": "All", + "value": "$__all" + }, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Client Workload", + "multi": true, + "name": "srcwl", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=~\"$service\", source_workload_namespace=~\"$srcns\"}) by (source_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\", source_workload_namespace=~\"$srcns\"}) by (source_workload))", + "refresh": 1, + "regex": "/.*workload=\"([^\"]*).*/", + "sort": 3, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": { + "text": "All", + "value": "$__all" + }, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Service Workload Namespace", + "multi": true, + "name": "dstns", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=\"$service\"}) by (destination_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\"}) by (destination_workload_namespace))", + "refresh": 1, + "regex": "/.*namespace=\"([^\"]*).*/", + "sort": 2, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": { + "text": "All", + "value": "$__all" + }, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Service Workload", + "multi": true, + "name": "dstwl", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=~\"$service\", destination_workload_namespace=~\"$dstns\"}) by (destination_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\", destination_workload_namespace=~\"$dstns\"}) by (destination_workload))", + "refresh": 1, + "regex": "/.*workload=\"([^\"]*).*/", + "sort": 3, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Istio Service Dashboard", + "uid": "LJ_uJAvmk", + "version": 1 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-istio-workload-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + istio-workload-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__requires": [ + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "5.0.4" + }, + { + "type": "panel", + "id": "graph", + "name": "Graph", + "version": "5.0.0" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "singlestat", + "name": "Singlestat", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "text", + "name": "Text", + "version": "5.0.0" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 0, + "id": null, + "iteration": 1531345461465, + "links": [], + "panels": [ + { + "content": "
\nWORKLOAD: $workload.$namespace\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 0 + }, + "id": 89, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "datasource": "Prometheus", + "format": "ops", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 8, + "x": 0, + "y": 3 + }, + "id": 12, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\"}[5m])), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "thresholds": "", + "title": "Incoming Request Volume", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "current" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "rgba(50, 172, 45, 0.97)", + "rgba(237, 129, 40, 0.89)", + "rgba(245, 54, 54, 0.9)" + ], + "datasource": "Prometheus", + "decimals": null, + "format": "percentunit", + "gauge": { + "maxValue": 100, + "minValue": 80, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": false + }, + "gridPos": { + "h": 4, + "w": 8, + "x": 8, + "y": 3 + }, + "id": 14, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\"}[5m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "B" + } + ], + "thresholds": "95, 99, 99.5", + "title": "Incoming Success Rate (non-5xx responses)", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 4, + "w": 8, + "x": 16, + "y": 3 + }, + "id": 87, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": false, + "hideZero": false, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))", + "format": "time_series", + "interval": "", + "intervalFactor": 1, + "legendFormat": "P50", + "refId": "A" + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P90", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "P99", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Request Duration", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "#299c46", + "rgba(237, 129, 40, 0.89)", + "#d44a3a" + ], + "datasource": "Prometheus", + "format": "Bps", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 12, + "x": 0, + "y": 7 + }, + "id": 84, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\"}[1m])) + sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\"}[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": "", + "title": "TCP Server Traffic", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "cacheTimeout": null, + "colorBackground": false, + "colorValue": false, + "colors": [ + "#299c46", + "rgba(237, 129, 40, 0.89)", + "#d44a3a" + ], + "datasource": "Prometheus", + "format": "Bps", + "gauge": { + "maxValue": 100, + "minValue": 0, + "show": false, + "thresholdLabels": false, + "thresholdMarkers": true + }, + "gridPos": { + "h": 4, + "w": 12, + "x": 12, + "y": 7 + }, + "id": 85, + "interval": null, + "links": [], + "mappingType": 1, + "mappingTypes": [ + { + "name": "value to text", + "value": 1 + }, + { + "name": "range to text", + "value": 2 + } + ], + "maxDataPoints": 100, + "nullPointMode": "connected", + "nullText": null, + "postfix": "", + "postfixFontSize": "50%", + "prefix": "", + "prefixFontSize": "50%", + "rangeMaps": [ + { + "from": "null", + "text": "N/A", + "to": "null" + } + ], + "sparkline": { + "fillColor": "rgba(31, 118, 189, 0.18)", + "full": true, + "lineColor": "rgb(31, 120, 193)", + "show": true + }, + "tableColumn": "", + "targets": [ + { + "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\"}[1m])) + sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\"}[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": "", + "title": "TCP Client Traffic", + "transparent": false, + "type": "singlestat", + "valueFontSize": "80%", + "valueMaps": [ + { + "op": "=", + "text": "N/A", + "value": "null" + } + ], + "valueName": "avg" + }, + { + "content": "
\nINBOUND WORKLOADS\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 11 + }, + "id": 45, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 0, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 14 + }, + "id": 25, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null as zero", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", reporter=\"destination\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }} (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", reporter=\"destination\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }}", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Requests by Source And Response Code", + "tooltip": { + "shared": false, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [ + "total" + ] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 14 + }, + "id": 26, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Success Rate (non-5xx responses) By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "label": null, + "logBase": 1, + "max": "1.01", + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "description": "", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 20 + }, + "id": 27, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Duration by Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 20 + }, + "id": 28, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Request Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 20 + }, + "id": 68, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Response Size By Source", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 26 + }, + "id": 80, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Received from Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 26 + }, + "id": 82, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Sent to Incoming TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ] + }, + { + "content": "
\nOUTBOUND SERVICES\n
", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 32 + }, + "id": 69, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 0, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 35 + }, + "id": 70, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null as zero", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", reporter=\"source\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service, response_code), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} : {{ response_code }} (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", reporter=\"source\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service, response_code), 0.001)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} : {{ response_code }}", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Outgoing Requests by Destination And Response Code", + "tooltip": { + "shared": false, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [ + "total" + ] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 35 + }, + "id": 71, + "legend": { + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\",response_code!~\"5.*\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\",response_code!~\"5.*\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service)", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{destination_service }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Outgoing Success Rate (non-5xx responses) By Destination", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "label": null, + "logBase": 1, + "max": "1.01", + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "description": "", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 41 + }, + "id": 72, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Outgoing Request Duration by Destination", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 41 + }, + "id": 73, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Outgoing Request Size By Destination", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 41 + }, + "id": 74, + "legend": { + "alignAsTable": false, + "avg": false, + "current": false, + "hideEmpty": true, + "max": false, + "min": false, + "rightSide": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50 (🔐mTLS)", + "refId": "D", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90 (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95 (🔐mTLS)", + "refId": "B", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99 (🔐mTLS)", + "refId": "C", + "step": 2 + }, + { + "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P50", + "refId": "E", + "step": 2 + }, + { + "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P90", + "refId": "F", + "step": 2 + }, + { + "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P95", + "refId": "G", + "step": 2 + }, + { + "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} P99", + "refId": "H", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Response Size By Destination", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "decbytes", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 0, + "y": 47 + }, + "id": 76, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_service }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Sent on Outgoing TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ] + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 12, + "x": 12, + "y": 47 + }, + "id": 78, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_service }} (🔐mTLS)", + "refId": "A", + "step": 2 + }, + { + "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ destination_service }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Bytes Received from Outgoing TCP Connection", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "label": null, + "logBase": 1, + "max": null, + "min": "0", + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ] + } + ], + "refresh": "10s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [ + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": false, + "label": "Namespace", + "multi": false, + "name": "namespace", + "options": [], + "query": "query_result(sum(istio_requests_total) by (destination_workload_namespace) or sum(istio_tcp_sent_bytes_total) by (destination_workload_namespace))", + "refresh": 1, + "regex": "/.*_namespace=\"([^\"]*).*/", + "sort": 0, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": false, + "label": "Workload", + "multi": false, + "name": "workload", + "options": [], + "query": "query_result((sum(istio_requests_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_requests_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)) or (sum(istio_tcp_sent_bytes_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_tcp_sent_bytes_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)))", + "refresh": 1, + "regex": "/.*workload=\"([^\"]*).*/", + "sort": 1, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Inbound Workload Namespace", + "multi": true, + "name": "srcns", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\"}) by (source_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\"}) by (source_workload_namespace))", + "refresh": 1, + "regex": "/.*namespace=\"([^\"]*).*/", + "sort": 2, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Inbound Workload", + "multi": true, + "name": "srcwl", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload_namespace=~\"$srcns\"}) by (source_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload_namespace=~\"$srcns\"}) by (source_workload))", + "refresh": 1, + "regex": "/.*workload=\"([^\"]*).*/", + "sort": 3, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Destination Service", + "multi": true, + "name": "dstsvc", + "options": [], + "query": "query_result( sum(istio_requests_total{reporter=\"source\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\"}) by (destination_service) or sum(istio_tcp_sent_bytes_total{reporter=\"source\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\"}) by (destination_service))", + "refresh": 1, + "regex": "/.*destination_service=\"([^\"]*).*/", + "sort": 4, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Istio Workload Dashboard", + "uid": "UbsSZTDik", + "version": 1 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-mixer-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + mixer-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__requires": [ + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "5.2.3" + }, + { + "type": "panel", + "id": "graph", + "name": "Graph", + "version": "5.0.0" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "text", + "name": "Text", + "version": "5.0.0" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "limit": 100, + "name": "Annotations & Alerts", + "showIn": 0, + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 1, + "id": null, + "iteration": 1543881232533, + "links": [], + "panels": [ + { + "content": "

Deployed Versions

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 0 + }, + "height": "40", + "id": 62, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 5, + "w": 24, + "x": 0, + "y": 3 + }, + "id": 64, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(istio_build{component=\"mixer\"}) by (tag)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ tag }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Mixer Versions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

Resource Usage

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 8 + }, + "height": "40", + "id": 29, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 0, + "y": 11 + }, + "id": 5, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(process_virtual_memory_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "instant": false, + "intervalFactor": 2, + "legendFormat": "Virtual Memory ({{ job }})", + "refId": "I" + }, + { + "expr": "sum(process_resident_memory_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Resident Memory ({{ job }})", + "refId": "H" + }, + { + "expr": "sum(go_memstats_heap_sys_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "hide": true, + "intervalFactor": 2, + "legendFormat": "heap sys ({{ job }})", + "refId": "A" + }, + { + "expr": "sum(go_memstats_heap_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "hide": true, + "intervalFactor": 2, + "legendFormat": "heap alloc ({{ job }})", + "refId": "D" + }, + { + "expr": "sum(go_memstats_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Alloc ({{ job }})", + "refId": "F" + }, + { + "expr": "sum(go_memstats_heap_inuse_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "Heap in-use ({{ job }})", + "refId": "E" + }, + { + "expr": "sum(go_memstats_stack_inuse_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Stack in-use ({{ job }})", + "refId": "G" + }, + { + "expr": "sum(label_replace(container_memory_usage_bytes{container_name=~\"mixer|istio-proxy\", pod_name=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod_name\", \"(istio-telemetry|istio-policy)-.*\")) by (service)", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ service }} total (k8s)", + "refId": "C" + }, + { + "expr": "sum(label_replace(container_memory_usage_bytes{container_name=~\"mixer|istio-proxy\", pod_name=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod_name\", \"(istio-telemetry|istio-policy)-.*\")) by (container_name, service)", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ service }} - {{ container_name }} (k8s)", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Memory", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 6, + "y": 11 + }, + "id": 6, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(sum(rate(container_cpu_usage_seconds_total{container_name=~\"mixer|istio-proxy\", pod_name=~\"istio-telemetry-.*|istio-policy-.*\"}[1m])) by (pod_name), \"service\", \"$1\" , \"pod_name\", \"(istio-telemetry|istio-policy)-.*\")", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ service }} total (k8s)", + "refId": "A" + }, + { + "expr": "label_replace(sum(rate(container_cpu_usage_seconds_total{container_name=~\"mixer|istio-proxy\", pod_name=~\"istio-telemetry-.*|istio-policy-.*\"}[1m])) by (container_name, pod_name), \"service\", \"$1\" , \"pod_name\", \"(istio-telemetry|istio-policy)-.*\")", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ service }} - {{ container_name }} (k8s)", + "refId": "B" + }, + { + "expr": "sum(irate(process_cpu_seconds_total{job=~\"istio-telemetry|istio-policy\"}[1m])) by (job)", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ job }} (self-reported)", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "CPU", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 12, + "y": 11 + }, + "id": 7, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(process_open_fds{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "hide": true, + "instant": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "Open FDs ({{ job }})", + "refId": "A" + }, + { + "expr": "sum(label_replace(container_fs_usage_bytes{container_name=~\"mixer|istio-proxy\", pod_name=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod_name\", \"(istio-telemetry|istio-policy)-.*\")) by (container_name, service)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ service }} - {{ container_name }}", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Disk", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "label": "", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "decimals": null, + "format": "none", + "label": "", + "logBase": 1024, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 18, + "y": 11 + }, + "id": 4, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": false, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(go_goroutines{job=~\"istio-telemetry|istio-policy\"}) by (job)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Number of Goroutines ({{ job }})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Goroutines", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

Mixer Overview

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 18 + }, + "height": "40px", + "id": 30, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 6, + "x": 0, + "y": 21 + }, + "id": 9, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(grpc_io_server_completed_rpcs[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "mixer (Total)", + "refId": "B" + }, + { + "expr": "sum(rate(grpc_io_server_completed_rpcs[1m])) by (grpc_server_method)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "mixer ({{ grpc_server_method }})", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Incoming Requests", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 6, + "x": 6, + "y": 21 + }, + "id": 8, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [ + { + "alias": "{}", + "yaxis": 1 + } + ], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.5, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ grpc_server_method }} 0.5", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.9, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ grpc_server_method }} 0.9", + "refId": "C" + }, + { + "expr": "histogram_quantile(0.99, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ grpc_server_method }} 0.99", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Response Durations", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "ms", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 6, + "x": 12, + "y": 21 + }, + "id": 11, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(grpc_server_handled_total{grpc_code=~\"Unknown|Unimplemented|Internal|DataLoss\"}[1m])) by (grpc_method)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Mixer {{ grpc_method }}", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Server Error Rate (5xx responses)", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 6, + "x": 18, + "y": 21 + }, + "id": 12, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(grpc_server_handled_total{grpc_code!=\"OK\",grpc_service=~\".*Mixer\"}[1m])) by (grpc_method)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Mixer {{ grpc_method }}", + "refId": "B" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Non-successes (4xxs)", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

Adapters and Config

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 27 + }, + "id": 28, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 30 + }, + "id": 13, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(mixer_runtime_dispatches_total{adapter=~\"$adapter\"}[1m])) by (adapter)", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ adapter }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Adapter Dispatch Count", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 30 + }, + "id": 14, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "histogram_quantile(0.5, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ adapter }} - p50", + "refId": "A" + }, + { + "expr": "histogram_quantile(0.9, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ adapter }} - p90 ", + "refId": "B" + }, + { + "expr": "histogram_quantile(0.99, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ adapter }} - p99", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Adapter Dispatch Duration", + "tooltip": { + "shared": true, + "sort": 1, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 0, + "y": 37 + }, + "id": 60, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "scalar(topk(1, max(mixer_config_rule_config_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Rules", + "refId": "A" + }, + { + "expr": "scalar(topk(1, max(mixer_config_rule_config_error_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Config Errors", + "refId": "B" + }, + { + "expr": "scalar(topk(1, max(mixer_config_rule_config_match_error_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Match Errors", + "refId": "C" + }, + { + "expr": "scalar(topk(1, max(mixer_config_unsatisfied_action_handler_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Unsatisfied Actions", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Rules", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 6, + "y": 37 + }, + "id": 56, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "scalar(topk(1, max(mixer_config_instance_config_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Instances", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Instances in Latest Config", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 12, + "y": 37 + }, + "id": 54, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "scalar(topk(1, max(mixer_config_handler_config_count) by (configID)))", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Handlers", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Handlers in Latest Config", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 18, + "y": 37 + }, + "id": 58, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "scalar(topk(1, max(mixer_config_attribute_count) by (configID)))", + "format": "time_series", + "instant": false, + "intervalFactor": 1, + "legendFormat": "Attributes", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Attributes in Latest Config", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

Individual Adapters

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 44 + }, + "id": 23, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "collapsed": false, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 47 + }, + "id": 46, + "panels": [], + "repeat": "adapter", + "title": "$adapter Adapter", + "type": "row" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 48 + }, + "id": 17, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(irate(mixer_runtime_dispatches_total{adapter=\"$adapter\"}[1m]),\"handler\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ handler }} (error: {{ error }})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Dispatch Count By Handler", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 48 + }, + "id": 18, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(histogram_quantile(0.5, sum(rate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=\"$adapter\"}[1m])) by (handler, error, le)), \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "p50 - {{ handler_short }} (error: {{ error }})", + "refId": "A" + }, + { + "expr": "label_replace(histogram_quantile(0.9, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=\"$adapter\"}[1m])) by (handler, error, le)), \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "p90 - {{ handler_short }} (error: {{ error }})", + "refId": "D" + }, + { + "expr": "label_replace(histogram_quantile(0.99, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=\"$adapter\"}[1m])) by (handler, error, le)), \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "p99 - {{ handler_short }} (error: {{ error }})", + "refId": "E" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Dispatch Duration By Handler", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "s", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": "5s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [ + { + "allValue": null, + "current": {}, + "datasource": "Prometheus", + "hide": 0, + "includeAll": true, + "label": "Adapter", + "multi": true, + "name": "adapter", + "options": [], + "query": "label_values(adapter)", + "refresh": 2, + "regex": "", + "sort": 1, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Istio Mixer Dashboard", + "version": 4 +} +' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana-configuration-dashboards-pilot-dashboard + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + pilot-dashboard.json: '{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__requires": [ + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "5.2.3" + }, + { + "type": "panel", + "id": "graph", + "name": "Graph", + "version": "5.0.0" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "5.0.0" + }, + { + "type": "panel", + "id": "text", + "name": "Text", + "version": "5.0.0" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": false, + "gnetId": null, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "content": "

Deployed Versions

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 0 + }, + "height": "40", + "id": 58, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 5, + "w": 24, + "x": 0, + "y": 3 + }, + "id": 56, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(istio_build{component=\"pilot\"}) by (tag)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ tag }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Pilot Versions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

Resource Usage

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 8 + }, + "height": "40", + "id": 29, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 0, + "y": 11 + }, + "id": 5, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "process_virtual_memory_bytes{job=\"pilot\"}", + "format": "time_series", + "instant": false, + "intervalFactor": 2, + "legendFormat": "Virtual Memory", + "refId": "I", + "step": 2 + }, + { + "expr": "process_resident_memory_bytes{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Resident Memory", + "refId": "H", + "step": 2 + }, + { + "expr": "go_memstats_heap_sys_bytes{job=\"pilot\"}", + "format": "time_series", + "hide": true, + "intervalFactor": 2, + "legendFormat": "heap sys", + "refId": "A" + }, + { + "expr": "go_memstats_heap_alloc_bytes{job=\"pilot\"}", + "format": "time_series", + "hide": true, + "intervalFactor": 2, + "legendFormat": "heap alloc", + "refId": "D" + }, + { + "expr": "go_memstats_alloc_bytes{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Alloc", + "refId": "F", + "step": 2 + }, + { + "expr": "go_memstats_heap_inuse_bytes{job=\"pilot\"}", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "Heap in-use", + "refId": "E", + "step": 2 + }, + { + "expr": "go_memstats_stack_inuse_bytes{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Stack in-use", + "refId": "G", + "step": 2 + }, + { + "expr": "sum(container_memory_usage_bytes{container_name=~\"discovery|istio-proxy\", pod_name=~\"istio-pilot-.*\"})", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "Total (k8s)", + "refId": "C", + "step": 2 + }, + { + "expr": "container_memory_usage_bytes{container_name=~\"discovery|istio-proxy\", pod_name=~\"istio-pilot-.*\"}", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ container_name }} (k8s)", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Memory", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 6, + "y": 11 + }, + "id": 6, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(container_cpu_usage_seconds_total{container_name=~\"discovery|istio-proxy\", pod_name=~\"istio-pilot-.*\"}[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "Total (k8s)", + "refId": "A", + "step": 2 + }, + { + "expr": "sum(rate(container_cpu_usage_seconds_total{container_name=~\"discovery|istio-proxy\", pod_name=~\"istio-pilot-.*\"}[1m])) by (container_name)", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "{{ container_name }} (k8s)", + "refId": "B", + "step": 2 + }, + { + "expr": "irate(process_cpu_seconds_total{job=\"pilot\"}[1m])", + "format": "time_series", + "hide": false, + "intervalFactor": 2, + "legendFormat": "pilot (self-reported)", + "refId": "C", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "CPU", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 12, + "y": 11 + }, + "id": 7, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "process_open_fds{job=\"pilot\"}", + "format": "time_series", + "hide": true, + "instant": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "Open FDs (pilot)", + "refId": "A" + }, + { + "expr": "container_fs_usage_bytes{container_name=~\"discovery|istio-proxy\", pod_name=~\"istio-pilot-.*\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "{{ container_name }}", + "refId": "B", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Disk", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "label": "", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "decimals": null, + "format": "none", + "label": "", + "logBase": 1024, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 6, + "x": 18, + "y": 11 + }, + "id": 4, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": false, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "go_goroutines{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Number of Goroutines", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Goroutines", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": "", + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "content": "

xDS

", + "gridPos": { + "h": 3, + "w": 24, + "x": 0, + "y": 18 + }, + "id": 28, + "links": [], + "mode": "html", + "title": "", + "transparent": true, + "type": "text" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 21 + }, + "id": 40, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(irate(envoy_cluster_update_success{cluster_name=\"xds-grpc\"}[1m]))", + "format": "time_series", + "hide": false, + "intervalFactor": 1, + "legendFormat": "XDS GRPC Successes", + "refId": "C" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Updates", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 21 + }, + "id": 42, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "round(sum(rate(envoy_cluster_update_attempt{cluster_name=\"xds-grpc\"}[1m])) - sum(rate(envoy_cluster_update_success{cluster_name=\"xds-grpc\"}[1m])))", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "XDS GRPC ", + "refId": "A", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Failures", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "ops", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": false + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 21 + }, + "id": 41, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(envoy_cluster_upstream_cx_active{cluster_name=\"xds-grpc\"})", + "format": "time_series", + "intervalFactor": 2, + "legendFormat": "Pilot (XDS GRPC)", + "refId": "C", + "step": 2 + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Active Connections", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 8, + "x": 0, + "y": 27 + }, + "id": 45, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "pilot_conflict_inbound_listener{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Inbound Listeners", + "refId": "B" + }, + { + "expr": "pilot_conflict_outbound_listener_http_over_current_tcp{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Outbound Listeners (http over current tcp)", + "refId": "A" + }, + { + "expr": "pilot_conflict_outbound_listener_tcp_over_current_tcp{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Outbound Listeners (tcp over current tcp)", + "refId": "C" + }, + { + "expr": "pilot_conflict_outbound_listener_tcp_over_current_http{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Outbound Listeners (tcp over current http)", + "refId": "D" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Conflicts", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 8, + "x": 8, + "y": 27 + }, + "id": 47, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "pilot_virt_services{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Virtual Services", + "refId": "A" + }, + { + "expr": "pilot_services{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Services", + "refId": "B" + }, + { + "expr": "label_replace(sum(pilot_xds_cds_reject{job=\"pilot\"}) by (node, err), \"node\", \"$1\", \"node\", \".*~.*~(.*)~.*\")", + "format": "time_series", + "hide": true, + "intervalFactor": 1, + "legendFormat": "Rejected CDS Configs - {{ node }}: {{ err }}", + "refId": "C" + }, + { + "expr": "pilot_xds_eds_reject{job=\"pilot\"}", + "format": "time_series", + "hide": true, + "intervalFactor": 1, + "legendFormat": "Rejected EDS Configs", + "refId": "D" + }, + { + "expr": "pilot_xds{job=\"pilot\"}", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Connected Endpoints", + "refId": "E" + }, + { + "expr": "rate(pilot_xds_write_timeout{job=\"pilot\"}[1m])", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Write Timeouts", + "refId": "F" + }, + { + "expr": "rate(pilot_xds_push_timeout{job=\"pilot\"}[1m])", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Push Timeouts", + "refId": "G" + }, + { + "expr": "rate(pilot_xds_pushes{job=\"pilot\"}[1m])", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Pushes ({{ type }})", + "refId": "H" + }, + { + "expr": "rate(pilot_xds_push_errors{job=\"pilot\"}[1m])", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "Push Errors ({{ type }})", + "refId": "I" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "ADS Monitoring", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 8, + "w": 8, + "x": 16, + "y": 27 + }, + "id": 49, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(sum(pilot_xds_cds_reject{job=\"pilot\"}) by (node, err), \"node\", \"$1\", \"node\", \".*~.*~(.*)~.*\")", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ node }} ({{ err }})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Rejected CDS Configs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 8, + "x": 0, + "y": 35 + }, + "id": 52, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(sum(pilot_xds_eds_reject{job=\"pilot\"}) by (node, err), \"node\", \"$1\", \"node\", \".*~.*~(.*)~.*\")", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ node }} ({{err}})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Rejected EDS Configs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 8, + "x": 8, + "y": 35 + }, + "id": 54, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(sum(pilot_xds_lds_reject{job=\"pilot\"}) by (node, err), \"node\", \"$1\", \"node\", \".*~.*~(.*)~.*\")", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ node }} ({{err}})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Rejected LDS Configs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 8, + "x": 16, + "y": 35 + }, + "id": 53, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "label_replace(sum(pilot_xds_rds_reject{job=\"pilot\"}) by (node, err), \"node\", \"$1\", \"node\", \".*~.*~(.*)~.*\")", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ node }} ({{err}})", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "Rejected RDS Configs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": { + "outbound|80||default-http-backend.kube-system.svc.cluster.local": "rgba(255, 255, 255, 0.97)" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "Prometheus", + "fill": 1, + "gridPos": { + "h": 7, + "w": 8, + "x": 0, + "y": 42 + }, + "id": 51, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "percentage": false, + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [ + { + "alias": "outbound|80||default-http-backend.kube-system.svc.cluster.local", + "yaxis": 1 + } + ], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(pilot_xds_eds_instances{job=\"pilot\"}) by (cluster)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ cluster }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeShift": null, + "title": "EDS Instances", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": "5s", + "schemaVersion": 16, + "style": "dark", + "tags": [], + "templating": { + "list": [] + }, + "time": { + "from": "now-5m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "browser", + "title": "Istio Pilot Dashboard", + "version": 4 +} +' +--- + +--- +# Source: istio/charts/grafana/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-grafana + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + istio: grafana +data: + datasources.yaml: | + apiVersion: 1 + datasources: + - access: proxy + editable: true + isDefault: true + jsonData: + timeInterval: 5s + name: Prometheus + orgId: 1 + type: prometheus + url: http://prometheus:9090 + + dashboardproviders.yaml: | + apiVersion: 1 + providers: + - disableDeletion: false + folder: istio + name: istio + options: + path: /var/lib/grafana/dashboards/istio + orgId: 1 + type: file + +--- +# Source: istio/charts/kiali/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +data: + config.yaml: | + istio_namespace: istio-system + server: + port: 20001 + external_services: + istio: + url_service_version: http://istio-pilot:8080/version + jaeger: + url: + grafana: + url: + +--- +# Source: istio/charts/prometheus/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: prometheus + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio +data: + prometheus.yml: |- + global: + scrape_interval: 15s + scrape_configs: + + - job_name: 'istio-mesh' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-telemetry;prometheus + + # Scrape config for envoy stats + - job_name: 'envoy-stats' + metrics_path: /stats/prometheus + kubernetes_sd_configs: + - role: pod + + relabel_configs: + - source_labels: [__meta_kubernetes_pod_container_port_name] + action: keep + regex: '.*-envoy-prom' + - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] + action: replace + regex: ([^:]+)(?::\d+)?;(\d+) + replacement: $1:15090 + target_label: __address__ + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + - source_labels: [__meta_kubernetes_namespace] + action: replace + target_label: namespace + - source_labels: [__meta_kubernetes_pod_name] + action: replace + target_label: pod_name + + metric_relabel_configs: + # Exclude some of the envoy metrics that have massive cardinality + # This list may need to be pruned further moving forward, as informed + # by performance and scalability testing. + - source_labels: [ cluster_name ] + regex: '(outbound|inbound|prometheus_stats).*' + action: drop + - source_labels: [ tcp_prefix ] + regex: '(outbound|inbound|prometheus_stats).*' + action: drop + - source_labels: [ listener_address ] + regex: '(.+)' + action: drop + - source_labels: [ http_conn_manager_listener_prefix ] + regex: '(.+)' + action: drop + - source_labels: [ http_conn_manager_prefix ] + regex: '(.+)' + action: drop + - source_labels: [ __name__ ] + regex: 'envoy_tls.*' + action: drop + - source_labels: [ __name__ ] + regex: 'envoy_tcp_downstream.*' + action: drop + - source_labels: [ __name__ ] + regex: 'envoy_http_(stats|admin).*' + action: drop + - source_labels: [ __name__ ] + regex: 'envoy_cluster_(lb|retry|bind|internal|max|original).*' + action: drop + + - job_name: 'istio-policy' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-policy;http-monitoring + + - job_name: 'istio-telemetry' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-telemetry;http-monitoring + + - job_name: 'pilot' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-pilot;http-monitoring + + - job_name: 'galley' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-galley;http-monitoring + + - job_name: 'citadel' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - istio-system + + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: istio-citadel;http-monitoring + + # scrape config for API servers + - job_name: 'kubernetes-apiservers' + kubernetes_sd_configs: + - role: endpoints + namespaces: + names: + - default + scheme: https + tls_config: + ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + relabel_configs: + - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] + action: keep + regex: kubernetes;https + + # scrape config for nodes (kubelet) + - job_name: 'kubernetes-nodes' + scheme: https + tls_config: + ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + kubernetes_sd_configs: + - role: node + relabel_configs: + - action: labelmap + regex: __meta_kubernetes_node_label_(.+) + - target_label: __address__ + replacement: kubernetes.default.svc:443 + - source_labels: [__meta_kubernetes_node_name] + regex: (.+) + target_label: __metrics_path__ + replacement: /api/v1/nodes/${1}/proxy/metrics + + # Scrape config for Kubelet cAdvisor. + # + # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics + # (those whose names begin with 'container_') have been removed from the + # Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to + # retrieve those metrics. + # + # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor + # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics" + # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with + # the --cadvisor-port=0 Kubelet flag). + # + # This job is not necessary and should be removed in Kubernetes 1.6 and + # earlier versions, or it will cause the metrics to be scraped twice. + - job_name: 'kubernetes-cadvisor' + scheme: https + tls_config: + ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + kubernetes_sd_configs: + - role: node + relabel_configs: + - action: labelmap + regex: __meta_kubernetes_node_label_(.+) + - target_label: __address__ + replacement: kubernetes.default.svc:443 + - source_labels: [__meta_kubernetes_node_name] + regex: (.+) + target_label: __metrics_path__ + replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor + + # scrape config for service endpoints. + - job_name: 'kubernetes-service-endpoints' + kubernetes_sd_configs: + - role: endpoints + relabel_configs: + - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape] + action: keep + regex: true + - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme] + action: replace + target_label: __scheme__ + regex: (https?) + - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path] + action: replace + target_label: __metrics_path__ + regex: (.+) + - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port] + action: replace + target_label: __address__ + regex: ([^:]+)(?::\d+)?;(\d+) + replacement: $1:$2 + - action: labelmap + regex: __meta_kubernetes_service_label_(.+) + - source_labels: [__meta_kubernetes_namespace] + action: replace + target_label: kubernetes_namespace + - source_labels: [__meta_kubernetes_service_name] + action: replace + target_label: kubernetes_name + + - job_name: 'kubernetes-pods' + kubernetes_sd_configs: + - role: pod + relabel_configs: # If first two labels are present, pod should be scraped by the istio-secure job. + - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] + action: keep + regex: true + # Keep target if there's no sidecar or if prometheus.io/scheme is explicitly set to "http" + - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_prometheus_io_scheme] + action: keep + regex: ((;.*)|(.*;http)) + - source_labels: [__meta_kubernetes_pod_annotation_istio_mtls] + action: drop + regex: (true) + - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] + action: replace + target_label: __metrics_path__ + regex: (.+) + - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] + action: replace + regex: ([^:]+)(?::\d+)?;(\d+) + replacement: $1:$2 + target_label: __address__ + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + - source_labels: [__meta_kubernetes_namespace] + action: replace + target_label: namespace + - source_labels: [__meta_kubernetes_pod_name] + action: replace + target_label: pod_name + + - job_name: 'kubernetes-pods-istio-secure' + scheme: https + tls_config: + ca_file: /etc/istio-certs/root-cert.pem + cert_file: /etc/istio-certs/cert-chain.pem + key_file: /etc/istio-certs/key.pem + insecure_skip_verify: true # prometheus does not support secure naming. + kubernetes_sd_configs: + - role: pod + relabel_configs: + - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] + action: keep + regex: true + # sidecar status annotation is added by sidecar injector and + # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic. + - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls] + action: keep + regex: (([^;]+);([^;]*))|(([^;]*);(true)) + - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scheme] + action: drop + regex: (http) + - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] + action: replace + target_label: __metrics_path__ + regex: (.+) + - source_labels: [__address__] # Only keep address that is host:port + action: keep # otherwise an extra target with ':443' is added for https scheme + regex: ([^:]+):(\d+) + - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] + action: replace + regex: ([^:]+)(?::\d+)?;(\d+) + replacement: $1:$2 + target_label: __address__ + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + - source_labels: [__meta_kubernetes_namespace] + action: replace + target_label: namespace + - source_labels: [__meta_kubernetes_pod_name] + action: replace + target_label: pod_name +--- +# Source: istio/charts/security/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-security-custom-resources + labels: + app: security + chart: security + heritage: Tiller + release: istio + istio: citadel +data: + custom-resources.yaml: |- + # Authentication policy to enable permissive mode for all services (that have sidecar) in the mesh. + apiVersion: "authentication.istio.io/v1alpha1" + kind: "MeshPolicy" + metadata: + name: "default" + labels: + app: security + chart: security + heritage: Tiller + release: istio + spec: + peers: + - mtls: + mode: PERMISSIVE + run.sh: |- + #!/bin/sh + + set -x + + if [ "$#" -ne "1" ]; then + echo "first argument should be path to custom resource yaml" + exit 1 + fi + + pathToResourceYAML=${1} + + kubectl get validatingwebhookconfiguration istio-galley 2>/dev/null + if [ "$?" -eq 0 ]; then + echo "istio-galley validatingwebhookconfiguration found - waiting for istio-galley deployment to be ready" + while true; do + kubectl -n istio-system get deployment istio-galley 2>/dev/null + if [ "$?" -eq 0 ]; then + break + fi + sleep 1 + done + kubectl -n istio-system rollout status deployment istio-galley + if [ "$?" -ne 0 ]; then + echo "istio-galley deployment rollout status check failed" + exit 1 + fi + echo "istio-galley deployment ready for configuration validation" + fi + sleep 5 + kubectl apply -f ${pathToResourceYAML} + + +--- +# Source: istio/templates/configmap.yaml + +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio + labels: + app: istio + chart: istio + heritage: Tiller + release: istio +data: + mesh: |- + # Set the following variable to true to disable policy checks by the Mixer. + # Note that metrics will still be reported to the Mixer. + disablePolicyChecks: false + + # Set enableTracing to false to disable request tracing. + enableTracing: true + + # Set accessLogFile to empty string to disable access log. + accessLogFile: "/dev/stdout" + + # If accessLogEncoding is TEXT, value will be used directly as the log format + # example: "[%START_TIME%] %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\n" + # If AccessLogEncoding is JSON, value will be parsed as map[string]string + # example: '{"start_time": "%START_TIME%", "req_method": "%REQ(:METHOD)%"}' + # Leave empty to use default log format + accessLogFormat: "" + + # Set accessLogEncoding to JSON or TEXT to configure sidecar access log + accessLogEncoding: 'TEXT' + mixerCheckServer: istio-policy.istio-system.svc.cluster.local:9091 + mixerReportServer: istio-telemetry.istio-system.svc.cluster.local:9091 + # policyCheckFailOpen allows traffic in cases when the mixer policy service cannot be reached. + # Default is false which means the traffic is denied when the client is unable to connect to Mixer. + policyCheckFailOpen: false + # Let Pilot give ingresses the public IP of the Istio ingressgateway + ingressService: istio-ingressgateway + + # Default connect timeout for dynamic clusters generated by Pilot and returned via XDS + connectTimeout: 10s + + # DNS refresh rate for Envoy clusters of type STRICT_DNS + dnsRefreshRate: 5s + + # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get + # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty. + sdsUdsPath: + + # This flag is used by secret discovery service(SDS). + # If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount + # for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which + # will be used to generate key/cert eventually. This isn't supported for non-k8s case. + enableSdsTokenMount: false + + # This flag is used by secret discovery service(SDS). + # If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token' + # (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod) + # and pass to sds server, which will be used to request key/cert eventually. + # this flag is ignored if enableSdsTokenMount is set. + # This isn't supported for non-k8s case. + sdsUseK8sSaJwt: false + + # The trust domain corresponds to the trust root of a system. + # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain + trustDomain: + + # Set the default behavior of the sidecar for handling outbound traffic from the application: + # ALLOW_ANY - outbound traffic to unknown destinations will be allowed, in case there are no + # services or ServiceEntries for the destination port + # REGISTRY_ONLY - restrict outbound traffic to services defined in the service registry as well + # as those defined through ServiceEntries + outboundTrafficPolicy: + mode: ALLOW_ANY + + localityLbSetting: + {} + + + # The namespace to treat as the administrative root namespace for istio + # configuration. + rootNamespace: istio-system + configSources: + - address: istio-galley.istio-system.svc:9901 + + defaultConfig: + # + # TCP connection timeout between Envoy & the application, and between Envoys. Used for static clusters + # defined in Envoy's configuration file + connectTimeout: 10s + # + ### ADVANCED SETTINGS ############# + # Where should envoy's configuration be stored in the istio-proxy container + configPath: "/etc/istio/proxy" + binaryPath: "/usr/local/bin/envoy" + # The pseudo service name used for Envoy. + serviceCluster: istio-proxy + # These settings that determine how long an old Envoy + # process should be kept alive after an occasional reload. + drainDuration: 45s + parentShutdownDuration: 1m0s + # + # The mode used to redirect inbound connections to Envoy. This setting + # has no effect on outbound traffic: iptables REDIRECT is always used for + # outbound connections. + # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy. + # The "REDIRECT" mode loses source addresses during redirection. + # If "TPROXY", use iptables TPROXY to redirect to Envoy. + # The "TPROXY" mode preserves both the source and destination IP + # addresses and ports, so that they can be used for advanced filtering + # and manipulation. + # The "TPROXY" mode also configures the sidecar to run with the + # CAP_NET_ADMIN capability, which is required to use TPROXY. + #interceptionMode: REDIRECT + # + # Port where Envoy listens (on local host) for admin commands + # You can exec into the istio-proxy container in a pod and + # curl the admin port (curl http://localhost:15000/) to obtain + # diagnostic information from Envoy. See + # https://lyft.github.io/envoy/docs/operations/admin.html + # for more details + proxyAdminPort: 15000 + # + # Set concurrency to a specific number to control the number of Proxy worker threads. + # If set to 0 (default), then start worker thread for each CPU thread/core. + concurrency: 2 + # + tracing: + zipkin: + # Address of the Zipkin collector + address: zipkin.istio-system:9411 + # + # Mutual TLS authentication between sidecars and istio control plane. + controlPlaneAuthPolicy: NONE + # + # Address where istio Pilot service is running + discoveryAddress: istio-pilot.istio-system:15010 + + # Configuration file for the mesh networks to be used by the Split Horizon EDS. + meshNetworks: |- + networks: {} + +--- +# Source: istio/templates/sidecar-injector-configmap.yaml + +apiVersion: v1 +kind: ConfigMap +metadata: + name: istio-sidecar-injector + labels: + app: istio + chart: istio + heritage: Tiller + release: istio + istio: sidecar-injector +data: + config: |- + policy: enabled + template: |- + rewriteAppHTTPProbe: false + initContainers: + [[ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) "NONE" ]] + - name: istio-init + image: "docker.io/istio/proxy_init:1.1.6" + args: + - "-p" + - [[ .MeshConfig.ProxyListenPort ]] + - "-u" + - 1337 + - "-m" + - [[ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode ]] + - "-i" + - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` "*" ]]" + - "-x" + - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` "" ]]" + - "-b" + - "[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (includeInboundPorts .Spec.Containers) ]]" + - "-d" + - "[[ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` "" ) ]]" + [[ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -]] + - "-k" + - "[[ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` ]]" + [[ end -]] + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 10m + memory: 10Mi + limits: + cpu: 100m + memory: 50Mi + securityContext: + runAsUser: 0 + runAsNonRoot: false + capabilities: + add: + - NET_ADMIN + restartPolicy: Always + [[ end -]] + containers: + - name: istio-proxy + image: [[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` "docker.io/istio/proxyv2:1.1.6" ]] + ports: + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - sidecar + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --configPath + - [[ .ProxyConfig.ConfigPath ]] + - --binaryPath + - [[ .ProxyConfig.BinaryPath ]] + - --serviceCluster + [[ if ne "" (index .ObjectMeta.Labels "app") -]] + - [[ index .ObjectMeta.Labels "app" ]].$(POD_NAMESPACE) + [[ else -]] + - [[ valueOrDefault .DeploymentMeta.Name "istio-proxy" ]].[[ valueOrDefault .DeploymentMeta.Namespace "default" ]] + [[ end -]] + - --drainDuration + - [[ formatDuration .ProxyConfig.DrainDuration ]] + - --parentShutdownDuration + - [[ formatDuration .ProxyConfig.ParentShutdownDuration ]] + - --discoveryAddress + - [[ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress ]] + - --zipkinAddress + - [[ .ProxyConfig.GetTracing.GetZipkin.GetAddress ]] + - --connectTimeout + - [[ formatDuration .ProxyConfig.ConnectTimeout ]] + - --proxyAdminPort + - [[ .ProxyConfig.ProxyAdminPort ]] + [[ if gt .ProxyConfig.Concurrency 0 -]] + - --concurrency + - [[ .ProxyConfig.Concurrency ]] + [[ end -]] + - --controlPlaneAuthPolicy + - [[ annotation .ObjectMeta `sidecar.istio.io/controlPlaneAuthPolicy` .ProxyConfig.ControlPlaneAuthPolicy ]] + [[- if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) "0") ]] + - --statusPort + - [[ annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ]] + - --applicationPorts + - "[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/applicationPorts` (applicationPorts .Spec.Containers) ]]" + [[- end ]] + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + + - name: ISTIO_META_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: ISTIO_META_CONFIG_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ISTIO_META_INTERCEPTION_MODE + value: [[ or (index .ObjectMeta.Annotations "sidecar.istio.io/interceptionMode") .ProxyConfig.InterceptionMode.String ]] + [[ if .ObjectMeta.Annotations ]] + - name: ISTIO_METAJSON_ANNOTATIONS + value: | + [[ toJSON .ObjectMeta.Annotations ]] + [[ end ]] + [[ if .ObjectMeta.Labels ]] + - name: ISTIO_METAJSON_LABELS + value: | + [[ toJSON .ObjectMeta.Labels ]] + [[ end ]] + [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] + - name: ISTIO_BOOTSTRAP_OVERRIDE + value: "/etc/istio/custom-bootstrap/custom_bootstrap.json" + [[- end ]] + imagePullPolicy: IfNotPresent + [[ if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ) "0") ]] + readinessProbe: + httpGet: + path: /healthz/ready + port: [[ annotation .ObjectMeta `status.sidecar.istio.io/port` 15020 ]] + initialDelaySeconds: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` 1 ]] + periodSeconds: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` 2 ]] + failureThreshold: [[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` 30 ]] + [[ end -]]securityContext: + readOnlyRootFilesystem: true + [[ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) "TPROXY" -]] + capabilities: + add: + - NET_ADMIN + runAsGroup: 1337 + [[ else -]] + + runAsUser: 1337 + [[- end ]] + resources: + [[ if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -]] + requests: + [[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -]] + cpu: "[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` ]]" + [[ end ]] + [[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -]] + memory: "[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` ]]" + [[ end ]] + [[ else -]] + limits: + cpu: 2000m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + [[ end -]] + volumeMounts: + [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] + - mountPath: /etc/istio/custom-bootstrap + name: custom-bootstrap-volume + [[- end ]] + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /etc/certs/ + name: istio-certs + readOnly: true + [[- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` ]] + [[ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) ]] + - name: "[[ $index ]]" + [[ toYaml $value | indent 4 ]] + [[ end ]] + [[- end ]] + volumes: + [[- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) ]] + - name: custom-bootstrap-volume + configMap: + name: [[ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` `` ]] + [[- end ]] + - emptyDir: + medium: Memory + name: istio-envoy + - name: istio-certs + secret: + optional: true + [[ if eq .Spec.ServiceAccountName "" -]] + secretName: istio.default + [[ else -]] + secretName: [[ printf "istio.%s" .Spec.ServiceAccountName ]] + [[ end -]] + [[- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` ]] + [[ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) ]] + - name: "[[ $index ]]" + [[ toYaml $value | indent 2 ]] + [[ end ]] + [[ end ]] + +--- +# Source: istio/charts/galley/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-galley-service-account + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + +--- +# Source: istio/charts/gateways/templates/serviceaccount.yaml + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-egressgateway-service-account + labels: + app: istio-egressgateway + chart: gateways + heritage: Tiller + release: istio +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-ingressgateway-service-account + labels: + app: istio-ingressgateway + chart: gateways + heritage: Tiller + release: istio +--- + + +--- +# Source: istio/charts/grafana/templates/create-custom-resources-job.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-grafana-post-install-account + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-grafana-post-install-istio-system + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +rules: +- apiGroups: ["authentication.istio.io"] # needed to create default authn policy + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-grafana-post-install-role-binding-istio-system + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-grafana-post-install-istio-system +subjects: + - kind: ServiceAccount + name: istio-grafana-post-install-account + namespace: istio-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: istio-grafana-post-install-1.1.6 + annotations: + "helm.sh/hook": post-install + "helm.sh/hook-delete-policy": hook-succeeded + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +spec: + template: + metadata: + name: istio-grafana-post-install + labels: + app: istio-grafana + chart: grafana + heritage: Tiller + release: istio + spec: + serviceAccountName: istio-grafana-post-install-account + containers: + - name: kubectl + image: "docker.io/istio/kubectl:1.1.6" + command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ] + volumeMounts: + - mountPath: "/tmp/grafana" + name: tmp-configmap-grafana + volumes: + - name: tmp-configmap-grafana + configMap: + name: istio-grafana-custom-resources + restartPolicy: OnFailure + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/kiali/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kiali-service-account + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio + +--- +# Source: istio/charts/mixer/templates/serviceaccount.yaml + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-mixer-service-account + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio + +--- +# Source: istio/charts/pilot/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-pilot-service-account + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio + +--- +# Source: istio/charts/prometheus/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: prometheus + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio + +--- +# Source: istio/charts/security/templates/cleanup-secrets.yaml +# The reason for creating a ServiceAccount and ClusterRole specifically for this +# post-delete hooked job is because the citadel ServiceAccount is being deleted +# before this hook is launched. On the other hand, running this hook before the +# deletion of the citadel (e.g. pre-delete) won't delete the secrets because they +# will be re-created immediately by the to-be-deleted citadel. +# +# It's also important that the ServiceAccount, ClusterRole and ClusterRoleBinding +# will be ready before running the hooked Job therefore the hook weights. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-cleanup-secrets-service-account + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-delete-policy": hook-succeeded + "helm.sh/hook-weight": "1" + labels: + app: security + chart: security + heritage: Tiller + release: istio +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-cleanup-secrets-istio-system + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-delete-policy": hook-succeeded + "helm.sh/hook-weight": "1" + labels: + app: security + chart: security + heritage: Tiller + release: istio +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-cleanup-secrets-istio-system + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-delete-policy": hook-succeeded + "helm.sh/hook-weight": "2" + labels: + app: security + chart: security + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-cleanup-secrets-istio-system +subjects: + - kind: ServiceAccount + name: istio-cleanup-secrets-service-account + namespace: istio-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: istio-cleanup-secrets-1.1.6 + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-delete-policy": hook-succeeded + "helm.sh/hook-weight": "3" + labels: + app: security + chart: security + heritage: Tiller + release: istio +spec: + template: + metadata: + name: istio-cleanup-secrets + labels: + app: security + chart: security + heritage: Tiller + release: istio + spec: + serviceAccountName: istio-cleanup-secrets-service-account + containers: + - name: kubectl + image: "docker.io/istio/kubectl:1.1.6" + imagePullPolicy: IfNotPresent + command: + - /bin/bash + - -c + - > + kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" | while read -r entry; do + ns=$(echo $entry | awk '{print $1}'); + name=$(echo $entry | awk '{print $2}'); + kubectl delete secret $name -n $ns; + done + restartPolicy: OnFailure + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/security/templates/create-custom-resources-job.yaml + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-security-post-install-account + labels: + app: security + chart: security + heritage: Tiller + release: istio +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: istio-security-post-install-istio-system + labels: + app: security + chart: security + heritage: Tiller + release: istio +rules: +- apiGroups: ["authentication.istio.io"] # needed to create default authn policy + resources: ["*"] + verbs: ["*"] +- apiGroups: ["networking.istio.io"] # needed to create security destination rules + resources: ["*"] + verbs: ["*"] +- apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["get"] +- apiGroups: ["extensions", "apps"] + resources: ["deployments", "replicasets"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: istio-security-post-install-role-binding-istio-system + labels: + app: security + chart: security + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-security-post-install-istio-system +subjects: + - kind: ServiceAccount + name: istio-security-post-install-account + namespace: istio-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: istio-security-post-install-1.1.6 + annotations: + "helm.sh/hook": post-install + "helm.sh/hook-delete-policy": hook-succeeded + labels: + app: security + chart: security + heritage: Tiller + release: istio +spec: + template: + metadata: + name: istio-security-post-install + labels: + app: security + chart: security + heritage: Tiller + release: istio + spec: + serviceAccountName: istio-security-post-install-account + containers: + - name: kubectl + image: "docker.io/istio/kubectl:1.1.6" + imagePullPolicy: IfNotPresent + command: [ "/bin/bash", "/tmp/security/run.sh", "/tmp/security/custom-resources.yaml" ] + volumeMounts: + - mountPath: "/tmp/security" + name: tmp-configmap-security + volumes: + - name: tmp-configmap-security + configMap: + name: istio-security-custom-resources + restartPolicy: OnFailure + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/security/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-citadel-service-account + labels: + app: security + chart: security + heritage: Tiller + release: istio + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-sidecar-injector-service-account + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector + +--- +# Source: istio/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: istio-multi + +--- +# Source: istio/charts/galley/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-galley-istio-system + labels: + app: galley + chart: galley + heritage: Tiller + release: istio +rules: +- apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["*"] +- apiGroups: ["config.istio.io"] # istio mixer CRD watcher + resources: ["*"] + verbs: ["get", "list", "watch"] +- apiGroups: ["networking.istio.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] +- apiGroups: ["authentication.istio.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] +- apiGroups: ["rbac.istio.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] +- apiGroups: ["extensions","apps"] + resources: ["deployments"] + resourceNames: ["istio-galley"] + verbs: ["get"] +- apiGroups: [""] + resources: ["pods", "nodes", "services", "endpoints"] + verbs: ["get", "list", "watch"] +- apiGroups: ["extensions"] + resources: ["ingresses"] + verbs: ["get", "list", "watch"] +- apiGroups: ["extensions"] + resources: ["deployments/finalizers"] + resourceNames: ["istio-galley"] + verbs: ["update"] + +--- +# Source: istio/charts/gateways/templates/clusterrole.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-egressgateway-istio-system + labels: + app: egressgateway + chart: gateways + heritage: Tiller + release: istio +rules: +- apiGroups: ["networking.istio.io"] + resources: ["virtualservices", "destinationrules", "gateways"] + verbs: ["get", "watch", "list", "update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-ingressgateway-istio-system + labels: + app: ingressgateway + chart: gateways + heritage: Tiller + release: istio +rules: +- apiGroups: ["networking.istio.io"] + resources: ["virtualservices", "destinationrules", "gateways"] + verbs: ["get", "watch", "list", "update"] +--- + +--- +# Source: istio/charts/kiali/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +rules: +- apiGroups: [""] + resources: + - configmaps + - endpoints + - namespaces + - nodes + - pods + - services + - replicationcontrollers + verbs: + - get + - list + - watch +- apiGroups: ["extensions", "apps"] + resources: + - deployments + - statefulsets + - replicasets + verbs: + - get + - list + - watch +- apiGroups: ["autoscaling"] + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch +- apiGroups: ["batch"] + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch +- apiGroups: ["config.istio.io"] + resources: + - apikeys + - authorizations + - checknothings + - circonuses + - deniers + - fluentds + - handlers + - kubernetesenvs + - kuberneteses + - listcheckers + - listentries + - logentries + - memquotas + - metrics + - opas + - prometheuses + - quotas + - quotaspecbindings + - quotaspecs + - rbacs + - reportnothings + - rules + - solarwindses + - stackdrivers + - statsds + - stdios + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["networking.istio.io"] + resources: + - destinationrules + - gateways + - serviceentries + - virtualservices + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["authentication.istio.io"] + resources: + - policies + - meshpolicies + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["rbac.istio.io"] + resources: + - clusterrbacconfigs + - rbacconfigs + - serviceroles + - servicerolebindings + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["monitoring.kiali.io"] + resources: + - monitoringdashboards + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kiali-viewer + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +rules: +- apiGroups: [""] + resources: + - configmaps + - endpoints + - namespaces + - nodes + - pods + - services + - replicationcontrollers + verbs: + - get + - list + - watch +- apiGroups: ["extensions", "apps"] + resources: + - deployments + - statefulsets + - replicasets + verbs: + - get + - list + - watch +- apiGroups: ["autoscaling"] + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch +- apiGroups: ["batch"] + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch +- apiGroups: ["config.istio.io"] + resources: + - apikeys + - authorizations + - checknothings + - circonuses + - deniers + - fluentds + - handlers + - kubernetesenvs + - kuberneteses + - listcheckers + - listentries + - logentries + - memquotas + - metrics + - opas + - prometheuses + - quotas + - quotaspecbindings + - quotaspecs + - rbacs + - reportnothings + - rules + - servicecontrolreports + - servicecontrols + - solarwindses + - stackdrivers + - statsds + - stdios + verbs: + - get + - list + - watch +- apiGroups: ["networking.istio.io"] + resources: + - destinationrules + - gateways + - serviceentries + - virtualservices + verbs: + - get + - list + - watch +- apiGroups: ["authentication.istio.io"] + resources: + - policies + - meshpolicies + verbs: + - get + - list + - watch +- apiGroups: ["rbac.istio.io"] + resources: + - clusterrbacconfigs + - rbacconfigs + - serviceroles + - servicerolebindings + verbs: + - get + - list + - watch +- apiGroups: ["monitoring.kiali.io"] + resources: + - monitoringdashboards + verbs: + - get + +--- +# Source: istio/charts/mixer/templates/clusterrole.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-mixer-istio-system + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +rules: +- apiGroups: ["config.istio.io"] # istio CRD watcher + resources: ["*"] + verbs: ["create", "get", "list", "watch", "patch"] +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets", "replicationcontrollers"] + verbs: ["get", "list", "watch"] +- apiGroups: ["extensions", "apps"] + resources: ["replicasets"] + verbs: ["get", "list", "watch"] + +--- +# Source: istio/charts/pilot/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-pilot-istio-system + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio +rules: +- apiGroups: ["config.istio.io"] + resources: ["*"] + verbs: ["*"] +- apiGroups: ["rbac.istio.io"] + resources: ["*"] + verbs: ["get", "watch", "list"] +- apiGroups: ["networking.istio.io"] + resources: ["*"] + verbs: ["*"] +- apiGroups: ["authentication.istio.io"] + resources: ["*"] + verbs: ["*"] +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["*"] +- apiGroups: ["extensions"] + resources: ["ingresses", "ingresses/status"] + verbs: ["*"] +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["create", "get", "list", "watch", "update"] +- apiGroups: [""] + resources: ["endpoints", "pods", "services", "namespaces", "nodes", "secrets"] + verbs: ["get", "list", "watch"] + +--- +# Source: istio/charts/prometheus/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: prometheus-istio-system + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio +rules: +- apiGroups: [""] + resources: + - nodes + - services + - endpoints + - pods + - nodes/proxy + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: + - configmaps + verbs: ["get"] +- nonResourceURLs: ["/metrics"] + verbs: ["get"] + +--- +# Source: istio/charts/security/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-citadel-istio-system + labels: + app: security + chart: security + heritage: Tiller + release: istio +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["create", "get", "update"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create", "get", "watch", "list", "update", "delete"] +- apiGroups: [""] + resources: ["serviceaccounts", "services"] + verbs: ["get", "watch", "list"] +- apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["create"] + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: istio-sidecar-injector-istio-system + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] +- apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch", "patch"] + +--- +# Source: istio/templates/clusterrole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: istio-reader +rules: + - apiGroups: [''] + resources: ['nodes', 'pods', 'services', 'endpoints', "replicationcontrollers"] + verbs: ['get', 'watch', 'list'] + - apiGroups: ["extensions", "apps"] + resources: ["replicasets"] + verbs: ["get", "list", "watch"] + +--- +# Source: istio/charts/galley/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-galley-admin-role-binding-istio-system + labels: + app: galley + chart: galley + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-galley-istio-system +subjects: + - kind: ServiceAccount + name: istio-galley-service-account + namespace: istio-system + +--- +# Source: istio/charts/gateways/templates/clusterrolebindings.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-egressgateway-istio-system + labels: + app: egressgateway + chart: gateways + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-egressgateway-istio-system +subjects: +- kind: ServiceAccount + name: istio-egressgateway-service-account +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-ingressgateway-istio-system + labels: + app: ingressgateway + chart: gateways + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-ingressgateway-istio-system +subjects: +- kind: ServiceAccount + name: istio-ingressgateway-service-account +--- + +--- +# Source: istio/charts/kiali/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-kiali-admin-role-binding-istio-system + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kiali +subjects: +- kind: ServiceAccount + name: kiali-service-account + +--- +# Source: istio/charts/mixer/templates/clusterrolebinding.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-mixer-admin-role-binding-istio-system + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-mixer-istio-system +subjects: + - kind: ServiceAccount + name: istio-mixer-service-account + namespace: istio-system + +--- +# Source: istio/charts/pilot/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-pilot-istio-system + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-pilot-istio-system +subjects: + - kind: ServiceAccount + name: istio-pilot-service-account + namespace: istio-system + +--- +# Source: istio/charts/prometheus/templates/clusterrolebindings.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: prometheus-istio-system + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: prometheus-istio-system +subjects: +- kind: ServiceAccount + name: prometheus + +--- +# Source: istio/charts/security/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-citadel-istio-system + labels: + app: security + chart: security + heritage: Tiller + release: istio +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-citadel-istio-system +subjects: + - kind: ServiceAccount + name: istio-citadel-service-account + namespace: istio-system + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-sidecar-injector-admin-role-binding-istio-system + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-sidecar-injector-istio-system +subjects: + - kind: ServiceAccount + name: istio-sidecar-injector-service-account + namespace: istio-system + +--- +# Source: istio/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: istio-multi + labels: + chart: istio-1.1.0 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: istio-reader +subjects: +- kind: ServiceAccount + name: istio-multi + +--- +# Source: istio/charts/gateways/templates/role.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: istio-ingressgateway-sds +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "watch", "list"] +--- + +--- +# Source: istio/charts/gateways/templates/rolebindings.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: istio-ingressgateway-sds +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: istio-ingressgateway-sds +subjects: +- kind: ServiceAccount + name: istio-ingressgateway-service-account +--- + +--- +# Source: istio/charts/galley/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: istio-galley + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley +spec: + ports: + - port: 443 + name: https-validation + - port: 15014 + name: http-monitoring + - port: 9901 + name: grpc-mcp + selector: + istio: galley + +--- +# Source: istio/charts/gateways/templates/service.yaml + +apiVersion: v1 +kind: Service +metadata: + name: istio-egressgateway + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-egressgateway + istio: egressgateway +spec: + type: ClusterIP + selector: + release: istio + app: istio-egressgateway + istio: egressgateway + ports: + - + name: http2 + port: 80 + - + name: https + port: 443 + - + name: tls + port: 15443 + targetPort: 15443 +--- +apiVersion: v1 +kind: Service +metadata: + name: istio-ingressgateway + annotations: + beta.cloud.google.com/backend-config: '{"ports": {"http2":"iap-backendconfig"}}' + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-ingressgateway + istio: ingressgateway +spec: + type: NodePort + selector: + release: istio + app: istio-ingressgateway + istio: ingressgateway + ports: + - + name: status-port + port: 15020 + targetPort: 15020 + - + name: http2 + nodePort: 31380 + port: 80 + targetPort: 80 + - + name: https + nodePort: 31390 + port: 443 + - + name: tcp + nodePort: 31400 + port: 31400 + - + name: https-kiali + port: 15029 + targetPort: 15029 + - + name: https-prometheus + port: 15030 + targetPort: 15030 + - + name: https-grafana + port: 15031 + targetPort: 15031 + - + name: https-tracing + port: 15032 + targetPort: 15032 + - + name: tls + port: 15443 + targetPort: 15443 +--- + +--- +# Source: istio/charts/grafana/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: grafana + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +spec: + type: ClusterIP + ports: + - port: 3000 + targetPort: 3000 + protocol: TCP + name: http + selector: + app: grafana + +--- +# Source: istio/charts/kiali/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +spec: + ports: + - name: http-kiali + protocol: TCP + port: 20001 + selector: + app: kiali + +--- +# Source: istio/charts/mixer/templates/service.yaml + +apiVersion: v1 +kind: Service +metadata: + name: istio-policy + annotations: + networking.istio.io/exportTo: "*" + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio + istio: mixer +spec: + ports: + - name: grpc-mixer + port: 9091 + - name: grpc-mixer-mtls + port: 15004 + - name: http-monitoring + port: 15014 + selector: + istio: mixer + istio-mixer-type: policy +--- +apiVersion: v1 +kind: Service +metadata: + name: istio-telemetry + annotations: + networking.istio.io/exportTo: "*" + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio + istio: mixer +spec: + ports: + - name: grpc-mixer + port: 9091 + - name: grpc-mixer-mtls + port: 15004 + - name: http-monitoring + port: 15014 + - name: prometheus + port: 42422 + selector: + istio: mixer + istio-mixer-type: telemetry +--- + + +--- +# Source: istio/charts/pilot/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: istio-pilot + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio + istio: pilot +spec: + ports: + - port: 15010 + name: grpc-xds # direct + - port: 15011 + name: https-xds # mTLS + - port: 8080 + name: http-legacy-discovery # direct + - port: 15014 + name: http-monitoring + selector: + istio: pilot + +--- +# Source: istio/charts/prometheus/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: prometheus + annotations: + prometheus.io/scrape: 'true' + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio +spec: + selector: + app: prometheus + ports: + - name: http-prometheus + protocol: TCP + port: 9090 + +--- +# Source: istio/charts/security/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + # we use the normal name here (e.g. 'prometheus') + # as grafana is configured to use this as a data source + name: istio-citadel + labels: + app: security + chart: security + heritage: Tiller + release: istio + istio: citadel +spec: + ports: + - name: grpc-citadel + port: 8060 + targetPort: 8060 + protocol: TCP + - name: http-monitoring + port: 15014 + selector: + istio: citadel + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: istio-sidecar-injector + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector +spec: + ports: + - port: 443 + selector: + istio: sidecar-injector + +--- +# Source: istio/charts/galley/templates/deployment.yaml +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-galley + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley +spec: + replicas: 1 + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + template: + metadata: + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-galley-service-account + containers: + - name: galley + image: "docker.io/istio/galley:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 443 + - containerPort: 15014 + - containerPort: 9901 + command: + - /usr/local/bin/galley + - server + - --meshConfigFile=/etc/mesh-config/mesh + - --livenessProbeInterval=1s + - --livenessProbePath=/healthliveness + - --readinessProbePath=/healthready + - --readinessProbeInterval=1s + - --deployment-namespace=istio-system + - --insecure=true + - --validation-webhook-config-file + - /etc/config/validatingwebhookconfiguration.yaml + - --monitoringPort=15014 + - --log_output_level=default:info + volumeMounts: + - name: certs + mountPath: /etc/certs + readOnly: true + - name: config + mountPath: /etc/config + readOnly: true + - name: mesh-config + mountPath: /etc/mesh-config + readOnly: true + livenessProbe: + exec: + command: + - /usr/local/bin/galley + - probe + - --probe-path=/healthliveness + - --interval=10s + initialDelaySeconds: 5 + periodSeconds: 5 + readinessProbe: + exec: + command: + - /usr/local/bin/galley + - probe + - --probe-path=/healthready + - --interval=10s + initialDelaySeconds: 5 + periodSeconds: 5 + resources: + requests: + cpu: 10m + + volumes: + - name: certs + secret: + secretName: istio.istio-galley-service-account + - name: config + configMap: + name: istio-galley-configuration + - name: mesh-config + configMap: + name: istio + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/gateways/templates/deployment.yaml + +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-egressgateway + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-egressgateway + istio: egressgateway +spec: + template: + metadata: + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-egressgateway + istio: egressgateway + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-egressgateway-service-account + containers: + - name: istio-proxy + image: "docker.io/istio/proxyv2:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 80 + - containerPort: 443 + - containerPort: 15443 + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - router + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --log_output_level=default:info + - --drainDuration + - '45s' #drainDuration + - --parentShutdownDuration + - '1m0s' #parentShutdownDuration + - --connectTimeout + - '10s' #connectTimeout + - --serviceCluster + - istio-egressgateway + - --zipkinAddress + - zipkin:9411 + - --proxyAdminPort + - "15000" + - --statusPort + - "15020" + - --controlPlaneAuthPolicy + - NONE + - --discoveryAddress + - istio-pilot:15010 + readinessProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15020 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 2 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + - name: HOST_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.hostIP + - name: ISTIO_META_POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: ISTIO_META_CONFIG_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ISTIO_META_ROUTER_MODE + value: sni-dnat + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: egressgateway-certs + mountPath: "/etc/istio/egressgateway-certs" + readOnly: true + - name: egressgateway-ca-certs + mountPath: "/etc/istio/egressgateway-ca-certs" + readOnly: true + volumes: + - name: istio-certs + secret: + secretName: istio.istio-egressgateway-service-account + optional: true + - name: egressgateway-certs + secret: + secretName: "istio-egressgateway-certs" + optional: true + - name: egressgateway-ca-certs + secret: + secretName: "istio-egressgateway-ca-certs" + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-ingressgateway + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-ingressgateway + istio: ingressgateway +spec: + template: + metadata: + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-ingressgateway + istio: ingressgateway + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-ingressgateway-service-account + containers: + - name: istio-proxy + image: "docker.io/istio/proxyv2:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 15020 + - containerPort: 80 + - containerPort: 443 + - containerPort: 31400 + - containerPort: 15029 + - containerPort: 15030 + - containerPort: 15031 + - containerPort: 15032 + - containerPort: 15443 + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - router + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --log_output_level=default:info + - --drainDuration + - '45s' #drainDuration + - --parentShutdownDuration + - '1m0s' #parentShutdownDuration + - --connectTimeout + - '10s' #connectTimeout + - --serviceCluster + - istio-ingressgateway + - --zipkinAddress + - zipkin:9411 + - --proxyAdminPort + - "15000" + - --statusPort + - "15020" + - --controlPlaneAuthPolicy + - NONE + - --discoveryAddress + - istio-pilot:15010 + readinessProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15020 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 2 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + - name: HOST_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.hostIP + - name: ISTIO_META_POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: ISTIO_META_CONFIG_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ISTIO_META_ROUTER_MODE + value: sni-dnat + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: ingressgateway-certs + mountPath: "/etc/istio/ingressgateway-certs" + readOnly: true + - name: ingressgateway-ca-certs + mountPath: "/etc/istio/ingressgateway-ca-certs" + readOnly: true + volumes: + - name: istio-certs + secret: + secretName: istio.istio-ingressgateway-service-account + optional: true + - name: ingressgateway-certs + secret: + secretName: "istio-ingressgateway-certs" + optional: true + - name: ingressgateway-ca-certs + secret: + secretName: "istio-ingressgateway-ca-certs" + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x +--- + +--- +# Source: istio/charts/grafana/templates/deployment.yaml +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: grafana + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio +spec: + replicas: 1 + template: + metadata: + labels: + app: grafana + chart: grafana + heritage: Tiller + release: istio + annotations: + sidecar.istio.io/inject: "false" + spec: + securityContext: + runAsUser: 472 + fsGroup: 472 + containers: + - name: grafana + image: "grafana/grafana:6.0.2" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3000 + readinessProbe: + httpGet: + path: /login + port: 3000 + env: + - name: GRAFANA_PORT + value: "3000" + - name: GF_AUTH_BASIC_ENABLED + value: "false" + - name: GF_AUTH_ANONYMOUS_ENABLED + value: "true" + - name: GF_AUTH_ANONYMOUS_ORG_ROLE + value: Admin + - name: GF_PATHS_DATA + value: /data/grafana + resources: + requests: + cpu: 10m + + volumeMounts: + - name: data + mountPath: /data/grafana + - name: dashboards-istio-galley-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/galley-dashboard.json" + subPath: galley-dashboard.json + readOnly: true + - name: dashboards-istio-istio-mesh-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/istio-mesh-dashboard.json" + subPath: istio-mesh-dashboard.json + readOnly: true + - name: dashboards-istio-istio-performance-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/istio-performance-dashboard.json" + subPath: istio-performance-dashboard.json + readOnly: true + - name: dashboards-istio-istio-service-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/istio-service-dashboard.json" + subPath: istio-service-dashboard.json + readOnly: true + - name: dashboards-istio-istio-workload-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/istio-workload-dashboard.json" + subPath: istio-workload-dashboard.json + readOnly: true + - name: dashboards-istio-mixer-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/mixer-dashboard.json" + subPath: mixer-dashboard.json + readOnly: true + - name: dashboards-istio-pilot-dashboard + mountPath: "/var/lib/grafana/dashboards/istio/pilot-dashboard.json" + subPath: pilot-dashboard.json + readOnly: true + - name: config + mountPath: "/etc/grafana/provisioning/datasources/datasources.yaml" + subPath: datasources.yaml + - name: config + mountPath: "/etc/grafana/provisioning/dashboards/dashboardproviders.yaml" + subPath: dashboardproviders.yaml + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + volumes: + - name: config + configMap: + name: istio-grafana + - name: data + emptyDir: {} + - name: dashboards-istio-galley-dashboard + configMap: + name: istio-grafana-configuration-dashboards-galley-dashboard + - name: dashboards-istio-istio-mesh-dashboard + configMap: + name: istio-grafana-configuration-dashboards-istio-mesh-dashboard + - name: dashboards-istio-istio-performance-dashboard + configMap: + name: istio-grafana-configuration-dashboards-istio-performance-dashboard + - name: dashboards-istio-istio-service-dashboard + configMap: + name: istio-grafana-configuration-dashboards-istio-service-dashboard + - name: dashboards-istio-istio-workload-dashboard + configMap: + name: istio-grafana-configuration-dashboards-istio-workload-dashboard + - name: dashboards-istio-mixer-dashboard + configMap: + name: istio-grafana-configuration-dashboards-mixer-dashboard + - name: dashboards-istio-pilot-dashboard + configMap: + name: istio-grafana-configuration-dashboards-pilot-dashboard + +--- +# Source: istio/charts/kiali/templates/deployment.yaml +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio +spec: + replicas: 1 + selector: + matchLabels: + app: kiali + template: + metadata: + name: kiali + labels: + app: kiali + chart: kiali + heritage: Tiller + release: istio + annotations: + sidecar.istio.io/inject: "false" + scheduler.alpha.kubernetes.io/critical-pod: "" + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + spec: + serviceAccountName: kiali-service-account + containers: + - image: "docker.io/kiali/kiali:v0.16" + name: kiali + command: + - "/opt/kiali/kiali" + - "-config" + - "/kiali-configuration/config.yaml" + - "-v" + - "4" + env: + - name: ACTIVE_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: PROMETHEUS_SERVICE_URL + value: http://prometheus:9090 + - name: SERVER_WEB_ROOT + value: /kiali + volumeMounts: + - name: kiali-configuration + mountPath: "/kiali-configuration" + - name: kiali-secret + mountPath: "/kiali-secret" + resources: + requests: + cpu: 10m + + volumes: + - name: kiali-configuration + configMap: + name: kiali + - name: kiali-secret + secret: + secretName: kiali + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/mixer/templates/deployment.yaml + +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-policy + labels: + app: istio-mixer + chart: mixer + heritage: Tiller + release: istio + istio: mixer +spec: + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + selector: + matchLabels: + istio: mixer + istio-mixer-type: policy + template: + metadata: + labels: + app: policy + chart: mixer + heritage: Tiller + release: istio + istio: mixer + istio-mixer-type: policy + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-mixer-service-account + volumes: + - name: istio-certs + secret: + secretName: istio.istio-mixer-service-account + optional: true + - name: uds-socket + emptyDir: {} + - name: policy-adapter-secret + secret: + secretName: policy-adapter-secret + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + containers: + - name: mixer + image: "docker.io/istio/mixer:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 15014 + - containerPort: 42422 + args: + - --monitoringPort=15014 + - --address + - unix:///sock/mixer.socket + - --log_output_level=default:info + - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 + - --configDefaultNamespace=istio-system + - --useAdapterCRDs=true + - --trace_zipkin_url=http://zipkin:9411/api/v1/spans + env: + - name: GODEBUG + value: "gctrace=1" + - name: GOMAXPROCS + value: "6" + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 10m + memory: 100Mi + + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: uds-socket + mountPath: /sock + livenessProbe: + httpGet: + path: /version + port: 15014 + initialDelaySeconds: 5 + periodSeconds: 5 + - name: istio-proxy + image: "docker.io/istio/proxyv2:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 9091 + - containerPort: 15004 + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --serviceCluster + - istio-policy + - --templateFile + - /etc/istio/proxy/envoy_policy.yaml.tmpl + - --controlPlaneAuthPolicy + - NONE + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + resources: + limits: + cpu: 2000m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: uds-socket + mountPath: /sock + - name: policy-adapter-secret + mountPath: /var/run/secrets/istio.io/policy/adapter + readOnly: true + +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-telemetry + labels: + app: istio-mixer + chart: mixer + heritage: Tiller + release: istio + istio: mixer +spec: + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + selector: + matchLabels: + istio: mixer + istio-mixer-type: telemetry + template: + metadata: + labels: + app: telemetry + chart: mixer + heritage: Tiller + release: istio + istio: mixer + istio-mixer-type: telemetry + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-mixer-service-account + volumes: + - name: istio-certs + secret: + secretName: istio.istio-mixer-service-account + optional: true + - name: uds-socket + emptyDir: {} + - name: telemetry-adapter-secret + secret: + secretName: telemetry-adapter-secret + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + containers: + - name: mixer + image: "docker.io/istio/mixer:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 15014 + - containerPort: 42422 + args: + - --monitoringPort=15014 + - --address + - unix:///sock/mixer.socket + - --log_output_level=default:info + - --configStoreURL=mcp://istio-galley.istio-system.svc:9901 + - --configDefaultNamespace=istio-system + - --useAdapterCRDs=true + - --trace_zipkin_url=http://zipkin:9411/api/v1/spans + - --averageLatencyThreshold + - 100ms + - --loadsheddingMode + - enforce + env: + - name: GODEBUG + value: "gctrace=1" + - name: GOMAXPROCS + value: "6" + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 50m + memory: 100Mi + + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: telemetry-adapter-secret + mountPath: /var/run/secrets/istio.io/telemetry/adapter + readOnly: true + - name: uds-socket + mountPath: /sock + livenessProbe: + httpGet: + path: /version + port: 15014 + initialDelaySeconds: 5 + periodSeconds: 5 + - name: istio-proxy + image: "docker.io/istio/proxyv2:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 9091 + - containerPort: 15004 + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --serviceCluster + - istio-telemetry + - --templateFile + - /etc/istio/proxy/envoy_telemetry.yaml.tmpl + - --controlPlaneAuthPolicy + - NONE + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + resources: + limits: + cpu: 2000m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: uds-socket + mountPath: /sock + +--- + +--- +# Source: istio/charts/pilot/templates/deployment.yaml +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-pilot + # TODO: default template doesn't have this, which one is right ? + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio + istio: pilot + annotations: + checksum/config-volume: f8da08b6b8c170dde721efd680270b2901e750d4aa186ebb6c22bef5b78a43f9 +spec: + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + selector: + matchLabels: + istio: pilot + template: + metadata: + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio + istio: pilot + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-pilot-service-account + containers: + - name: discovery + image: "docker.io/istio/pilot:1.1.6" + imagePullPolicy: IfNotPresent + args: + - "discovery" + - --monitoringAddr=:15014 + - --log_output_level=default:info + - --domain + - cluster.local + - --secureGrpcAddr + - "" + - --keepaliveMaxServerConnectionAge + - "30m" + ports: + - containerPort: 8080 + - containerPort: 15010 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 30 + timeoutSeconds: 5 + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: GODEBUG + value: "gctrace=1" + - name: PILOT_PUSH_THROTTLE + value: "100" + - name: PILOT_TRACE_SAMPLING + value: "100" + - name: PILOT_DISABLE_XDS_MARSHALING_TO_ANY + value: "1" + resources: + limits: + cpu: 100m + memory: 200Mi + requests: + cpu: 10m + memory: 100Mi + + volumeMounts: + - name: config-volume + mountPath: /etc/istio/config + - name: istio-certs + mountPath: /etc/certs + readOnly: true + - name: istio-proxy + image: "docker.io/istio/proxyv2:1.1.6" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 15003 + - containerPort: 15005 + - containerPort: 15007 + - containerPort: 15011 + args: + - proxy + - --domain + - $(POD_NAMESPACE).svc.cluster.local + - --serviceCluster + - istio-pilot + - --templateFile + - /etc/istio/proxy/envoy_pilot.yaml.tmpl + - --controlPlaneAuthPolicy + - NONE + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + resources: + limits: + cpu: 2000m + memory: 128Mi + requests: + cpu: 10m + memory: 40Mi + + volumeMounts: + - name: istio-certs + mountPath: /etc/certs + readOnly: true + volumes: + - name: config-volume + configMap: + name: istio + - name: istio-certs + secret: + secretName: istio.istio-pilot-service-account + optional: true + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/prometheus/templates/deployment.yaml +# TODO: the original template has service account, roles, etc +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: prometheus + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio +spec: + replicas: 1 + selector: + matchLabels: + app: prometheus + template: + metadata: + labels: + app: prometheus + chart: prometheus + heritage: Tiller + release: istio + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: prometheus + containers: + - name: prometheus + image: "docker.io/prom/prometheus:v2.3.1" + imagePullPolicy: IfNotPresent + args: + - '--storage.tsdb.retention=6h' + - '--config.file=/etc/prometheus/prometheus.yml' + ports: + - containerPort: 9090 + name: http + livenessProbe: + httpGet: + path: /-/healthy + port: 9090 + readinessProbe: + httpGet: + path: /-/ready + port: 9090 + resources: + requests: + cpu: 10m + + volumeMounts: + - name: config-volume + mountPath: /etc/prometheus + - mountPath: /etc/istio-certs + name: istio-certs + volumes: + - name: config-volume + configMap: + name: prometheus + - name: istio-certs + secret: + defaultMode: 420 + secretName: istio.default + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/security/templates/deployment.yaml +# istio CA watching all namespaces +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-citadel + labels: + app: security + chart: security + heritage: Tiller + release: istio + istio: citadel +spec: + replicas: 1 + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + template: + metadata: + labels: + app: security + chart: security + heritage: Tiller + release: istio + istio: citadel + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-citadel-service-account + containers: + - name: citadel + image: "docker.io/istio/citadel:1.1.6" + imagePullPolicy: IfNotPresent + args: + - --append-dns-names=true + - --grpc-port=8060 + - --grpc-hostname=citadel + - --citadel-storage-namespace=istio-system + - --custom-dns-names=istio-pilot-service-account.istio-system:istio-pilot.istio-system + - --monitoring-port=15014 + - --self-signed-ca=true + livenessProbe: + httpGet: + path: /version + port: 15014 + initialDelaySeconds: 5 + periodSeconds: 5 + resources: + requests: + cpu: 10m + + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/deployment.yaml +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-sidecar-injector + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector +spec: + replicas: 1 + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + template: + metadata: + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio + istio: sidecar-injector + annotations: + sidecar.istio.io/inject: "false" + spec: + serviceAccountName: istio-sidecar-injector-service-account + containers: + - name: sidecar-injector-webhook + image: "docker.io/istio/sidecar_injector:1.1.6" + imagePullPolicy: IfNotPresent + args: + - --caCertFile=/etc/istio/certs/root-cert.pem + - --tlsCertFile=/etc/istio/certs/cert-chain.pem + - --tlsKeyFile=/etc/istio/certs/key.pem + - --injectConfig=/etc/istio/inject/config + - --meshConfig=/etc/istio/config/mesh + - --healthCheckInterval=2s + - --healthCheckFile=/health + volumeMounts: + - name: config-volume + mountPath: /etc/istio/config + readOnly: true + - name: certs + mountPath: /etc/istio/certs + readOnly: true + - name: inject-config + mountPath: /etc/istio/inject + readOnly: true + livenessProbe: + exec: + command: + - /usr/local/bin/sidecar-injector + - probe + - --probe-path=/health + - --interval=4s + initialDelaySeconds: 4 + periodSeconds: 4 + readinessProbe: + exec: + command: + - /usr/local/bin/sidecar-injector + - probe + - --probe-path=/health + - --interval=4s + initialDelaySeconds: 4 + periodSeconds: 4 + resources: + requests: + cpu: 10m + + volumes: + - name: config-volume + configMap: + name: istio + - name: certs + secret: + secretName: istio.istio-sidecar-injector-service-account + - name: inject-config + configMap: + name: istio-sidecar-injector + items: + - key: config + path: config + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + +--- +# Source: istio/charts/tracing/templates/deployment-jaeger.yaml + + +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: istio-tracing + labels: + app: jaeger + chart: tracing + heritage: Tiller + release: istio +spec: + template: + metadata: + labels: + app: jaeger + chart: tracing + heritage: Tiller + release: istio + annotations: + sidecar.istio.io/inject: "false" + prometheus.io/scrape: "true" + prometheus.io/port: "16686" + prometheus.io/path: "/jaeger/metrics" + spec: + containers: + - name: jaeger + image: "docker.io/jaegertracing/all-in-one:1.9" + imagePullPolicy: IfNotPresent + ports: + - containerPort: 9411 + - containerPort: 16686 + - containerPort: 5775 + protocol: UDP + - containerPort: 6831 + protocol: UDP + - containerPort: 6832 + protocol: UDP + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: COLLECTOR_ZIPKIN_HTTP_PORT + value: "9411" + - name: MEMORY_MAX_TRACES + value: "50000" + - name: QUERY_BASE_PATH + value: /jaeger + livenessProbe: + httpGet: + path: / + port: 16686 + readinessProbe: + httpGet: + path: / + port: 16686 + resources: + requests: + cpu: 10m + + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - ppc64le + - s390x + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - amd64 + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - ppc64le + - weight: 2 + preference: + matchExpressions: + - key: beta.kubernetes.io/arch + operator: In + values: + - s390x + + +--- +# Source: istio/charts/gateways/templates/autoscale.yaml + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: istio-egressgateway + labels: + app: egressgateway + chart: gateways + heritage: Tiller + release: istio +spec: + maxReplicas: 5 + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: istio-egressgateway + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: istio-ingressgateway + labels: + app: ingressgateway + chart: gateways + heritage: Tiller + release: istio +spec: + maxReplicas: 5 + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: istio-ingressgateway + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- + +--- +# Source: istio/charts/mixer/templates/autoscale.yaml + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: istio-policy + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + maxReplicas: 5 + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: istio-policy + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: istio-telemetry + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + maxReplicas: 5 + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: istio-telemetry + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- + +--- +# Source: istio/charts/pilot/templates/autoscale.yaml + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: istio-pilot + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio +spec: + maxReplicas: 5 + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: istio-pilot + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- + +--- +# Source: istio/charts/tracing/templates/service-jaeger.yaml + +apiVersion: v1 +kind: Service +metadata: + name: jaeger-query + annotations: + labels: + app: jaeger + jaeger-infra: jaeger-service + chart: tracing + heritage: Tiller + release: istio +spec: + ports: + - name: query-http + port: 16686 + protocol: TCP + targetPort: 16686 + selector: + app: jaeger + +--- + +apiVersion: v1 +kind: Service +metadata: + name: jaeger-collector + labels: + app: jaeger + jaeger-infra: collector-service + chart: tracing + heritage: Tiller + release: istio +spec: + ports: + - name: jaeger-collector-tchannel + port: 14267 + protocol: TCP + targetPort: 14267 + - name: jaeger-collector-http + port: 14268 + targetPort: 14268 + protocol: TCP + selector: + app: jaeger + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + name: jaeger-agent + labels: + app: jaeger + jaeger-infra: agent-service + chart: tracing + heritage: Tiller + release: istio +spec: + ports: + - name: agent-zipkin-thrift + port: 5775 + protocol: UDP + targetPort: 5775 + - name: agent-compact + port: 6831 + protocol: UDP + targetPort: 6831 + - name: agent-binary + port: 6832 + protocol: UDP + targetPort: 6832 + clusterIP: None + selector: + app: jaeger + + + +--- +# Source: istio/charts/tracing/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: zipkin + labels: + app: jaeger + chart: tracing + heritage: Tiller + release: istio +spec: + type: ClusterIP + ports: + - port: 9411 + targetPort: 9411 + protocol: TCP + name: http + selector: + app: jaeger +--- +apiVersion: v1 +kind: Service +metadata: + name: tracing + annotations: + labels: + app: jaeger + chart: tracing + heritage: Tiller + release: istio +spec: + ports: + - name: http-query + port: 80 + protocol: TCP + + targetPort: 16686 + + selector: + app: jaeger + +--- +# Source: istio/charts/sidecarInjectorWebhook/templates/mutatingwebhook.yaml +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: MutatingWebhookConfiguration +metadata: + name: istio-sidecar-injector + labels: + app: sidecarInjectorWebhook + chart: sidecarInjectorWebhook + heritage: Tiller + release: istio +webhooks: + - name: sidecar-injector.istio.io + clientConfig: + service: + name: istio-sidecar-injector + namespace: istio-system + path: "/inject" + caBundle: "" + rules: + - operations: [ "CREATE" ] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods"] + failurePolicy: Fail + namespaceSelector: + matchLabels: + istio-injection: enabled + + +--- +# Source: istio/charts/galley/templates/poddisruptionbudget.yaml + +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-galley + labels: + app: galley + chart: galley + heritage: Tiller + release: istio + istio: galley +spec: + + minAvailable: 1 + selector: + matchLabels: + app: galley + release: istio + istio: galley + +--- +# Source: istio/charts/gateways/templates/poddisruptionbudget.yaml + +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-egressgateway + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-egressgateway + istio: egressgateway +spec: + + minAvailable: 1 + selector: + matchLabels: + release: istio + app: istio-egressgateway + istio: egressgateway +--- +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-ingressgateway + labels: + chart: gateways + heritage: Tiller + release: istio + app: istio-ingressgateway + istio: ingressgateway +spec: + + minAvailable: 1 + selector: + matchLabels: + release: istio + app: istio-ingressgateway + istio: ingressgateway +--- + +--- +# Source: istio/charts/mixer/templates/poddisruptionbudget.yaml + +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-policy + labels: + app: policy + chart: mixer + heritage: Tiller + release: istio + version: 1.1.0 + istio: mixer + istio-mixer-type: policy +spec: + + minAvailable: 1 + selector: + matchLabels: + app: policy + release: istio + istio: mixer + istio-mixer-type: policy +--- +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-telemetry + labels: + app: telemetry + chart: mixer + heritage: Tiller + release: istio + version: 1.1.0 + istio: mixer + istio-mixer-type: telemetry +spec: + + minAvailable: 1 + selector: + matchLabels: + app: telemetry + release: istio + istio: mixer + istio-mixer-type: telemetry +--- +# Source: istio/charts/pilot/templates/poddisruptionbudget.yaml + +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: istio-pilot + labels: + app: pilot + chart: pilot + heritage: Tiller + release: istio + istio: pilot +spec: + + minAvailable: 1 + selector: + matchLabels: + app: pilot + release: istio + istio: pilot + +--- +apiVersion: "config.istio.io/v1alpha2" +kind: attributemanifest +metadata: + name: istioproxy + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + attributes: + origin.ip: + valueType: IP_ADDRESS + origin.uid: + valueType: STRING + origin.user: + valueType: STRING + request.headers: + valueType: STRING_MAP + request.id: + valueType: STRING + request.host: + valueType: STRING + request.method: + valueType: STRING + request.path: + valueType: STRING + request.url_path: + valueType: STRING + request.query_params: + valueType: STRING_MAP + request.reason: + valueType: STRING + request.referer: + valueType: STRING + request.scheme: + valueType: STRING + request.total_size: + valueType: INT64 + request.size: + valueType: INT64 + request.time: + valueType: TIMESTAMP + request.useragent: + valueType: STRING + response.code: + valueType: INT64 + response.duration: + valueType: DURATION + response.headers: + valueType: STRING_MAP + response.total_size: + valueType: INT64 + response.size: + valueType: INT64 + response.time: + valueType: TIMESTAMP + response.grpc_status: + valueType: STRING + response.grpc_message: + valueType: STRING + source.uid: + valueType: STRING + source.user: # DEPRECATED + valueType: STRING + source.principal: + valueType: STRING + destination.uid: + valueType: STRING + destination.principal: + valueType: STRING + destination.port: + valueType: INT64 + connection.event: + valueType: STRING + connection.id: + valueType: STRING + connection.received.bytes: + valueType: INT64 + connection.received.bytes_total: + valueType: INT64 + connection.sent.bytes: + valueType: INT64 + connection.sent.bytes_total: + valueType: INT64 + connection.duration: + valueType: DURATION + connection.mtls: + valueType: BOOL + connection.requested_server_name: + valueType: STRING + context.protocol: + valueType: STRING + context.proxy_error_code: + valueType: STRING + context.timestamp: + valueType: TIMESTAMP + context.time: + valueType: TIMESTAMP + # Deprecated, kept for compatibility + context.reporter.local: + valueType: BOOL + context.reporter.kind: + valueType: STRING + context.reporter.uid: + valueType: STRING + api.service: + valueType: STRING + api.version: + valueType: STRING + api.operation: + valueType: STRING + api.protocol: + valueType: STRING + request.auth.principal: + valueType: STRING + request.auth.audiences: + valueType: STRING + request.auth.presenter: + valueType: STRING + request.auth.claims: + valueType: STRING_MAP + request.auth.raw_claims: + valueType: STRING + request.api_key: + valueType: STRING + rbac.permissive.response_code: + valueType: STRING + rbac.permissive.effective_policy_id: + valueType: STRING + check.error_code: + valueType: INT64 + check.error_message: + valueType: STRING + check.cache_hit: + valueType: BOOL + quota.cache_hit: + valueType: BOOL + +--- +apiVersion: "config.istio.io/v1alpha2" +kind: attributemanifest +metadata: + name: kubernetes + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + attributes: + source.ip: + valueType: IP_ADDRESS + source.labels: + valueType: STRING_MAP + source.metadata: + valueType: STRING_MAP + source.name: + valueType: STRING + source.namespace: + valueType: STRING + source.owner: + valueType: STRING + source.serviceAccount: + valueType: STRING + source.services: + valueType: STRING + source.workload.uid: + valueType: STRING + source.workload.name: + valueType: STRING + source.workload.namespace: + valueType: STRING + destination.ip: + valueType: IP_ADDRESS + destination.labels: + valueType: STRING_MAP + destination.metadata: + valueType: STRING_MAP + destination.owner: + valueType: STRING + destination.name: + valueType: STRING + destination.container.name: + valueType: STRING + destination.namespace: + valueType: STRING + destination.service.uid: + valueType: STRING + destination.service.name: + valueType: STRING + destination.service.namespace: + valueType: STRING + destination.service.host: + valueType: STRING + destination.serviceAccount: + valueType: STRING + destination.workload.uid: + valueType: STRING + destination.workload.name: + valueType: STRING + destination.workload.namespace: + valueType: STRING +--- +apiVersion: "config.istio.io/v1alpha2" +kind: handler +metadata: + name: stdio + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + compiledAdapter: stdio + params: + outputAsJson: true +--- +apiVersion: "config.istio.io/v1alpha2" +kind: logentry +metadata: + name: accesslog + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + severity: '"Info"' + timestamp: request.time + variables: + sourceIp: source.ip | ip("0.0.0.0") + sourceApp: source.labels["app"] | "" + sourcePrincipal: source.principal | "" + sourceName: source.name | "" + sourceWorkload: source.workload.name | "" + sourceNamespace: source.namespace | "" + sourceOwner: source.owner | "" + destinationApp: destination.labels["app"] | "" + destinationIp: destination.ip | ip("0.0.0.0") + destinationServiceHost: destination.service.host | "" + destinationWorkload: destination.workload.name | "" + destinationName: destination.name | "" + destinationNamespace: destination.namespace | "" + destinationOwner: destination.owner | "" + destinationPrincipal: destination.principal | "" + apiClaims: request.auth.raw_claims | "" + apiKey: request.api_key | request.headers["x-api-key"] | "" + protocol: request.scheme | context.protocol | "http" + method: request.method | "" + url: request.path | "" + responseCode: response.code | 0 + responseFlags: context.proxy_error_code | "" + responseSize: response.size | 0 + permissiveResponseCode: rbac.permissive.response_code | "none" + permissiveResponsePolicyID: rbac.permissive.effective_policy_id | "none" + requestSize: request.size | 0 + requestId: request.headers["x-request-id"] | "" + clientTraceId: request.headers["x-client-trace-id"] | "" + latency: response.duration | "0ms" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + requestedServerName: connection.requested_server_name | "" + userAgent: request.useragent | "" + responseTimestamp: response.time + receivedBytes: request.total_size | 0 + sentBytes: response.total_size | 0 + referer: request.referer | "" + httpAuthority: request.headers[":authority"] | request.host | "" + xForwardedFor: request.headers["x-forwarded-for"] | "0.0.0.0" + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + grpcStatus: response.grpc_status | "" + grpcMessage: response.grpc_message | "" + monitored_resource_type: '"global"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: logentry +metadata: + name: tcpaccesslog + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + severity: '"Info"' + timestamp: context.time | timestamp("2017-01-01T00:00:00Z") + variables: + connectionEvent: connection.event | "" + sourceIp: source.ip | ip("0.0.0.0") + sourceApp: source.labels["app"] | "" + sourcePrincipal: source.principal | "" + sourceName: source.name | "" + sourceWorkload: source.workload.name | "" + sourceNamespace: source.namespace | "" + sourceOwner: source.owner | "" + destinationApp: destination.labels["app"] | "" + destinationIp: destination.ip | ip("0.0.0.0") + destinationServiceHost: destination.service.host | "" + destinationWorkload: destination.workload.name | "" + destinationName: destination.name | "" + destinationNamespace: destination.namespace | "" + destinationOwner: destination.owner | "" + destinationPrincipal: destination.principal | "" + protocol: context.protocol | "tcp" + connectionDuration: connection.duration | "0ms" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + requestedServerName: connection.requested_server_name | "" + receivedBytes: connection.received.bytes | 0 + sentBytes: connection.sent.bytes | 0 + totalReceivedBytes: connection.received.bytes_total | 0 + totalSentBytes: connection.sent.bytes_total | 0 + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + responseFlags: context.proxy_error_code | "" + monitored_resource_type: '"global"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: stdio + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "http" || context.protocol == "grpc" + actions: + - handler: stdio + instances: + - accesslog.logentry +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: stdiotcp + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "tcp" + actions: + - handler: stdio + instances: + - tcpaccesslog.logentry +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: requestcount + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: "1" + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + request_protocol: api.protocol | context.protocol | "unknown" + response_code: response.code | 200 + response_flags: context.proxy_error_code | "-" + permissive_response_code: rbac.permissive.response_code | "none" + permissive_response_policyid: rbac.permissive.effective_policy_id | "none" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: requestduration + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: response.duration | "0ms" + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + request_protocol: api.protocol | context.protocol | "unknown" + response_code: response.code | 200 + response_flags: context.proxy_error_code | "-" + permissive_response_code: rbac.permissive.response_code | "none" + permissive_response_policyid: rbac.permissive.effective_policy_id | "none" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: requestsize + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: request.size | 0 + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + request_protocol: api.protocol | context.protocol | "unknown" + response_code: response.code | 200 + response_flags: context.proxy_error_code | "-" + permissive_response_code: rbac.permissive.response_code | "none" + permissive_response_policyid: rbac.permissive.effective_policy_id | "none" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: responsesize + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: response.size | 0 + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + request_protocol: api.protocol | context.protocol | "unknown" + response_code: response.code | 200 + response_flags: context.proxy_error_code | "-" + permissive_response_code: rbac.permissive.response_code | "none" + permissive_response_policyid: rbac.permissive.effective_policy_id | "none" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: tcpbytesent + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: connection.sent.bytes | 0 + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + response_flags: context.proxy_error_code | "-" + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: tcpbytereceived + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: connection.received.bytes | 0 + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.host | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + response_flags: context.proxy_error_code | "-" + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: tcpconnectionsopened + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: "1" + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.name | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + response_flags: context.proxy_error_code | "-" + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: metric +metadata: + name: tcpconnectionsclosed + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + value: "1" + dimensions: + reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination") + source_workload: source.workload.name | "unknown" + source_workload_namespace: source.workload.namespace | "unknown" + source_principal: source.principal | "unknown" + source_app: source.labels["app"] | "unknown" + source_version: source.labels["version"] | "unknown" + destination_workload: destination.workload.name | "unknown" + destination_workload_namespace: destination.workload.namespace | "unknown" + destination_principal: destination.principal | "unknown" + destination_app: destination.labels["app"] | "unknown" + destination_version: destination.labels["version"] | "unknown" + destination_service: destination.service.name | "unknown" + destination_service_name: destination.service.name | "unknown" + destination_service_namespace: destination.service.namespace | "unknown" + connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none")) + response_flags: context.proxy_error_code | "-" + monitored_resource_type: '"UNSPECIFIED"' +--- +apiVersion: "config.istio.io/v1alpha2" +kind: handler +metadata: + name: prometheus + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + compiledAdapter: prometheus + params: + metricsExpirationPolicy: + metricsExpiryDuration: "10m" + metrics: + - name: requests_total + instance_name: requestcount.metric.istio-system + kind: COUNTER + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - request_protocol + - response_code + - response_flags + - permissive_response_code + - permissive_response_policyid + - connection_security_policy + - name: request_duration_seconds + instance_name: requestduration.metric.istio-system + kind: DISTRIBUTION + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - request_protocol + - response_code + - response_flags + - permissive_response_code + - permissive_response_policyid + - connection_security_policy + buckets: + explicit_buckets: + bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10] + - name: request_bytes + instance_name: requestsize.metric.istio-system + kind: DISTRIBUTION + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - request_protocol + - response_code + - response_flags + - permissive_response_code + - permissive_response_policyid + - connection_security_policy + buckets: + exponentialBuckets: + numFiniteBuckets: 8 + scale: 1 + growthFactor: 10 + - name: response_bytes + instance_name: responsesize.metric.istio-system + kind: DISTRIBUTION + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - request_protocol + - response_code + - response_flags + - permissive_response_code + - permissive_response_policyid + - connection_security_policy + buckets: + exponentialBuckets: + numFiniteBuckets: 8 + scale: 1 + growthFactor: 10 + - name: tcp_sent_bytes_total + instance_name: tcpbytesent.metric.istio-system + kind: COUNTER + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - connection_security_policy + - response_flags + - name: tcp_received_bytes_total + instance_name: tcpbytereceived.metric.istio-system + kind: COUNTER + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - connection_security_policy + - response_flags + - name: tcp_connections_opened_total + instance_name: tcpconnectionsopened.metric.istio-system + kind: COUNTER + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - connection_security_policy + - response_flags + - name: tcp_connections_closed_total + instance_name: tcpconnectionsclosed.metric.istio-system + kind: COUNTER + label_names: + - reporter + - source_app + - source_principal + - source_workload + - source_workload_namespace + - source_version + - destination_app + - destination_principal + - destination_workload + - destination_workload_namespace + - destination_version + - destination_service + - destination_service_name + - destination_service_namespace + - connection_security_policy + - response_flags +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: promhttp + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: (context.protocol == "http" || context.protocol == "grpc") && (match((request.useragent | "-"), "kube-probe*") == false) + actions: + - handler: prometheus + instances: + - requestcount.metric + - requestduration.metric + - requestsize.metric + - responsesize.metric +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: promtcp + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "tcp" + actions: + - handler: prometheus + instances: + - tcpbytesent.metric + - tcpbytereceived.metric +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: promtcpconnectionopen + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "tcp" && ((connection.event | "na") == "open") + actions: + - handler: prometheus + instances: + - tcpconnectionsopened.metric +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: promtcpconnectionclosed + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "tcp" && ((connection.event | "na") == "close") + actions: + - handler: prometheus + instances: + - tcpconnectionsclosed.metric +--- +apiVersion: "config.istio.io/v1alpha2" +kind: handler +metadata: + name: kubernetesenv + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + compiledAdapter: kubernetesenv + params: + # when running from mixer root, use the following config after adding a + # symbolic link to a kubernetes config file via: + # + # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig + # + # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig" + +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: kubeattrgenrulerule + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + actions: + - handler: kubernetesenv + instances: + - attributes.kubernetes +--- +apiVersion: "config.istio.io/v1alpha2" +kind: rule +metadata: + name: tcpkubeattrgenrulerule + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + match: context.protocol == "tcp" + actions: + - handler: kubernetesenv + instances: + - attributes.kubernetes +--- +apiVersion: "config.istio.io/v1alpha2" +kind: kubernetes +metadata: + name: attributes + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + # Pass the required attribute data to the adapter + source_uid: source.uid | "" + source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr + destination_uid: destination.uid | "" + destination_port: destination.port | 0 + attribute_bindings: + # Fill the new attributes from the adapter produced output. + # $out refers to an instance of OutputTemplate message + source.ip: $out.source_pod_ip | ip("0.0.0.0") + source.uid: $out.source_pod_uid | "unknown" + source.labels: $out.source_labels | emptyStringMap() + source.name: $out.source_pod_name | "unknown" + source.namespace: $out.source_namespace | "default" + source.owner: $out.source_owner | "unknown" + source.serviceAccount: $out.source_service_account_name | "unknown" + source.workload.uid: $out.source_workload_uid | "unknown" + source.workload.name: $out.source_workload_name | "unknown" + source.workload.namespace: $out.source_workload_namespace | "unknown" + destination.ip: $out.destination_pod_ip | ip("0.0.0.0") + destination.uid: $out.destination_pod_uid | "unknown" + destination.labels: $out.destination_labels | emptyStringMap() + destination.name: $out.destination_pod_name | "unknown" + destination.container.name: $out.destination_container_name | "unknown" + destination.namespace: $out.destination_namespace | "default" + destination.owner: $out.destination_owner | "unknown" + destination.serviceAccount: $out.destination_service_account_name | "unknown" + destination.workload.uid: $out.destination_workload_uid | "unknown" + destination.workload.name: $out.destination_workload_name | "unknown" + destination.workload.namespace: $out.destination_workload_namespace | "unknown" +--- +# Configuration needed by Mixer. +# Mixer cluster is delivered via CDS +# Specify mixer cluster settings +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: istio-policy + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + host: istio-policy.istio-system.svc.cluster.local + trafficPolicy: + connectionPool: + http: + http2MaxRequests: 10000 + maxRequestsPerConnection: 10000 +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: istio-telemetry + labels: + app: mixer + chart: mixer + heritage: Tiller + release: istio +spec: + host: istio-telemetry.istio-system.svc.cluster.local + trafficPolicy: + connectionPool: + http: + http2MaxRequests: 10000 + maxRequestsPerConnection: 10000 +--- diff --git a/kubeflow/kfapp/kustomize/istio-install/base/kustomization.yaml b/kubeflow/kfapp/kustomize/istio-install/base/kustomization.yaml new file mode 100644 index 0000000..8e7b1d7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-install/base/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- istio-noauth.yaml +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/istio-install/kustomization.yaml b/kubeflow/kfapp/kustomize/istio-install/kustomization.yaml new file mode 100644 index 0000000..e907d64 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio-install/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: istio-system diff --git a/kubeflow/kfapp/kustomize/istio/base/README.md b/kubeflow/kfapp/kustomize/istio/base/README.md new file mode 100644 index 0000000..861a387 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/base/README.md @@ -0,0 +1,7 @@ +# Manifest for Istio in Kubeflow + +- `install` dir contains the manifest to install Istio +- kf-istio-resources.yaml has + - Gateway for routing + - VirtualService for Grafana + - ServiceEntry and VirtualService for egress traffic diff --git a/kubeflow/kfapp/kustomize/istio/base/kf-istio-resources.yaml b/kubeflow/kfapp/kustomize/istio/base/kf-istio-resources.yaml new file mode 100644 index 0000000..8494258 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/base/kf-istio-resources.yaml @@ -0,0 +1,110 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: kubeflow-gateway +spec: + selector: + istio: ingressgateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: grafana-vs +spec: + hosts: + - "*" + gateways: + - "kubeflow-gateway" + http: + - match: + - uri: + prefix: "/istio/grafana/" + method: + exact: "GET" + rewrite: + uri: "/" + route: + - destination: + host: "grafana.istio-system.svc.cluster.local" + port: + number: 3000 +--- +apiVersion: networking.istio.io/v1alpha3 +kind: ServiceEntry +metadata: + name: google-api-entry +spec: + hosts: + - www.googleapis.com + ports: + - number: 443 + name: https + protocol: HTTPS + resolution: DNS + location: MESH_EXTERNAL +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: google-api-vs +spec: + hosts: + - www.googleapis.com + tls: + - match: + - port: 443 + sni_hosts: + - www.googleapis.com + route: + - destination: + host: www.googleapis.com + port: + number: 443 + weight: 100 +--- +apiVersion: networking.istio.io/v1alpha3 +kind: ServiceEntry +metadata: + name: google-storage-api-entry +spec: + hosts: + - storage.googleapis.com + ports: + - number: 443 + name: https + protocol: HTTPS + resolution: DNS + location: MESH_EXTERNAL +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: google-storage-api-vs +spec: + hosts: + - storage.googleapis.com + tls: + - match: + - port: 443 + sni_hosts: + - storage.googleapis.com + route: + - destination: + host: storage.googleapis.com + port: + number: 443 + weight: 100 +--- +apiVersion: rbac.istio.io/v1alpha1 +kind: ClusterRbacConfig +metadata: + name: default +spec: + mode: $(clusterRbacConfig) diff --git a/kubeflow/kfapp/kustomize/istio/base/kustomization.yaml b/kubeflow/kfapp/kustomize/istio/base/kustomization.yaml new file mode 100644 index 0000000..e34fff2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/base/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- kf-istio-resources.yaml +namespace: kubeflow +configMapGenerator: +- name: istio-parameters + env: params.env +vars: +- name: clusterRbacConfig + objref: + kind: ConfigMap + name: istio-parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterRbacConfig +configurations: + - params.yaml diff --git a/kubeflow/kfapp/kustomize/istio/base/params.env b/kubeflow/kfapp/kustomize/istio/base/params.env new file mode 100644 index 0000000..b39a745 --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/base/params.env @@ -0,0 +1 @@ +clusterRbacConfig=OFF diff --git a/kubeflow/kfapp/kustomize/istio/base/params.yaml b/kubeflow/kfapp/kustomize/istio/base/params.yaml new file mode 100644 index 0000000..e894f9b --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/mode + kind: ClusterRbacConfig diff --git a/kubeflow/kfapp/kustomize/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/istio/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/istio/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role-binding.yaml new file mode 100644 index 0000000..f7fe51d --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-role +subjects: +- kind: ServiceAccount + name: service-account diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role.yaml new file mode 100644 index 0000000..a43963b --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/cluster-role.yaml @@ -0,0 +1,41 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-role +rules: +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - create + - delete +- apiGroups: + - kubeflow.org + resources: + - notebooks + - poddefaults + verbs: + - get + - list + - create + - delete +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/config-map.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/config-map.yaml new file mode 100644 index 0000000..43c8f3b --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/config-map.yaml @@ -0,0 +1,143 @@ +apiVersion: v1 +data: + spawner_ui_config.yaml: | + # Configuration file for the Jupyter UI. + # + # Each Jupyter UI option is configured by two keys: 'value' and 'readOnly' + # - The 'value' key contains the default value + # - The 'readOnly' key determines if the option will be available to users + # + # If the 'readOnly' key is present and set to 'true', the respective option + # will be disabled for users and only set by the admin. Also when a + # Notebook is POSTED to the API if a necessary field is not present then + # the value from the config will be used. + # + # If the 'readOnly' key is missing (defaults to 'false'), the respective option + # will be available for users to edit. + # + # Note that some values can be templated. Such values are the names of the + # Volumes as well as their StorageClass + spawnerFormDefaults: + image: + # The container Image for the user's Jupyter Notebook + # If readonly, this value must be a member of the list below + value: gcr.io/kubeflow-images-public/tensorflow-1.13.1-notebook-cpu:v0.5.0 + # The list of available standard container Images + options: + - gcr.io/kubeflow-images-public/tensorflow-1.5.1-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.5.1-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.6.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.6.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.7.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.7.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.8.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.8.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.9.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.9.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.10.1-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.10.1-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.11.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.11.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.12.0-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.12.0-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.13.1-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-1.13.1-notebook-gpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-2.0.0a-notebook-cpu:v0.5.0 + - gcr.io/kubeflow-images-public/tensorflow-2.0.0a-notebook-gpu:v0.5.0 + # By default, custom container Images are allowed + # Uncomment the following line to only enable standard container Images + readOnly: false + cpu: + # CPU for user's Notebook + value: '0.5' + readOnly: false + memory: + # Memory for user's Notebook + value: 1.0Gi + readOnly: false + workspaceVolume: + # Workspace Volume to be attached to user's Notebook + # Each Workspace Volume is declared with the following attributes: + # Type, Name, Size, MountPath and Access Mode + value: + type: + # The Type of the Workspace Volume + # Supported values: 'New', 'Existing' + value: New + name: + # The Name of the Workspace Volume + # Note that this is a templated value. Special values: + # {notebook-name}: Replaced with the name of the Notebook. The frontend + # will replace this value as the user types the name + value: 'workspace-{notebook-name}' + size: + # The Size of the Workspace Volume (in Gi) + value: '10Gi' + mountPath: + # The Path that the Workspace Volume will be mounted + value: /home/jovyan + accessModes: + # The Access Mode of the Workspace Volume + # Supported values: 'ReadWriteOnce', 'ReadWriteMany', 'ReadOnlyMany' + value: ReadWriteOnce + class: + # The StrageClass the PVC will use if type is New. Special values are: + # {none}: default StorageClass + # {empty}: empty string "" + value: '{none}' + readOnly: false + dataVolumes: + # List of additional Data Volumes to be attached to the user's Notebook + value: [] + # Each Data Volume is declared with the following attributes: + # Type, Name, Size, MountPath and Access Mode + # + # For example, a list with 2 Data Volumes: + # value: + # - value: + # type: + # value: New + # name: + # value: '{notebook-name}-vol-1' + # size: + # value: '10Gi' + # class: + # value: standard + # mountPath: + # value: /home/jovyan/vol-1 + # accessModes: + # value: ReadWriteOnce + # class: + # value: {none} + # - value: + # type: + # value: New + # name: + # value: '{notebook-name}-vol-2' + # size: + # value: '10Gi' + # mountPath: + # value: /home/jovyan/vol-2 + # accessModes: + # value: ReadWriteMany + # class: + # value: {none} + readOnly: false + extraResources: + # Extra Resource Limits for user's Notebook + # e.x. "{'nvidia.com/gpu': 2}" + value: "{}" + readOnly: false + shm: + value: true + readOnly: false + configurations: + # List of labels to be selected, these are the labels from PodDefaults + # value: + # - add-gcp-secret + # - default-editor + value: [] + readOnly: false +kind: ConfigMap +metadata: + name: config diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/deployment.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/deployment.yaml new file mode 100644 index 0000000..6eb2cc4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/deployment.yaml @@ -0,0 +1,37 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: deployment +spec: + replicas: 1 + template: + spec: + containers: + - env: + - name: ROK_SECRET_NAME + valueFrom: + configMapKeyRef: + name: parameters + key: ROK_SECRET_NAME + - name: UI + valueFrom: + configMapKeyRef: + name: parameters + key: UI + - name: USERID_HEADER + value: $(userid-header) + - name: USERID_PREFIX + value: $(userid-prefix) + image: gcr.io/kubeflow-images-public/jupyter-web-app:v0.5.0 + imagePullPolicy: $(policy) + name: jupyter-web-app + ports: + - containerPort: 5000 + volumeMounts: + - mountPath: /etc/config + name: config-volume + serviceAccountName: service-account + volumes: + - configMap: + name: config + name: config-volume diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/kustomization.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/kustomization.yaml new file mode 100644 index 0000000..043ec69 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/kustomization.yaml @@ -0,0 +1,70 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- config-map.yaml +- deployment.yaml +- role-binding.yaml +- role.yaml +- service-account.yaml +- service.yaml +namePrefix: jupyter-web-app- +namespace: kubeflow +commonLabels: + app: jupyter-web-app + kustomize.component: jupyter-web-app +images: + - name: gcr.io/kubeflow-images-public/jupyter-web-app + newName: gcr.io/kubeflow-images-public/jupyter-web-app + newTag: 9419d4d +configMapGenerator: +- name: parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: policy + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.policy +- name: prefix + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.prefix +- name: clusterDomain + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +- name: namespace + objref: + kind: Service + name: service + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: userid-header + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-header +- name: userid-prefix + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-prefix +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.env b/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.env new file mode 100644 index 0000000..141d07a --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.env @@ -0,0 +1,7 @@ +UI=default +ROK_SECRET_NAME=secret-rok-{username} +policy=Always +prefix=jupyter +clusterDomain=cluster.local +userid-header= +userid-prefix= diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.yaml new file mode 100644 index 0000000..65ff484 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/params.yaml @@ -0,0 +1,9 @@ +varReference: +- path: spec/template/spec/containers/imagePullPolicy + kind: Deployment +- path: metadata/annotations/getambassador.io\/config + kind: Service +- path: spec/template/spec/containers/0/env/2/value + kind: Deployment +- path: spec/template/spec/containers/0/env/3/value + kind: Deployment \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/role-binding.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/role-binding.yaml new file mode 100644 index 0000000..5400a70 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: jupyter-notebook-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: jupyter-notebook-role +subjects: +- kind: ServiceAccount + name: jupyter-notebook diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/role.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/role.yaml new file mode 100644 index 0000000..bcd601a --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/role.yaml @@ -0,0 +1,35 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: jupyter-notebook-role +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + - secrets + - services + verbs: + - '*' +- apiGroups: + - "" + - apps + - extensions + resources: + - deployments + - replicasets + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - '*' + verbs: + - '*' +- apiGroups: + - batch + resources: + - jobs + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/service-account.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/service-account.yaml new file mode 100644 index 0000000..a36cbd8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: service-account diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/base/service.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/base/service.yaml new file mode 100644 index 0000000..d22b9ed --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/base/service.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: webapp_mapping + prefix: /$(prefix)/ + service: jupyter-web-app-service.$(namespace) + add_request_headers: + x-forwarded-prefix: /jupyter + labels: + run: jupyter-web-app + name: service +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 5000 + type: ClusterIP diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/kustomization.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/kustomization.yaml new file mode 100644 index 0000000..7255692 --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +- overlays/istio +commonLabels: + app.kubernetes.io/component: jupyter + app.kubernetes.io/instance: jupyter-web-app + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/name: jupyter-web-app + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 +kind: Kustomization +namespace: kubeflow +resources: +- overlays/application/application.yaml diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/application.yaml new file mode 100644 index 0000000..bedb56e --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/application.yaml @@ -0,0 +1,47 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: jupyter-web-app +spec: + selector: + matchLabels: + app.kubernetes.io/name: jupyter-web-app + app.kubernetes.io/instance: jupyter-web-app + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: jupyter + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 + componentKinds: + - group: core + kind: ConfigMap + - group: apps + kind: Deployment + - group: rbac.authorization.k8s.io + kind: RoleBinding + - group: rbac.authorization.k8s.io + kind: Role + - group: core + kind: ServiceAccount + - group: networking.istio.io + kind: VirtualService + descriptor: + type: jupyter-web-app + version: v0.6.2 + description: Provides a UI which allows the user to create/conect/delete jupyter notebooks. + maintainers: + - name: Kimonas Sotirchos + email: kimwnasptd@arrikto.com + owners: + - name: Kimonas Sotirchos + email: kimwnasptd@arrikto.com + keywords: + - jupyterhub + - jupyter ui + - notebooks + links: + - description: About + url: https://github.com/kubeflow/kubeflow/tree/master/components/jupyter-web-app + - description: Docs + url: https://www.kubeflow.org/docs/notebooks + addOwnerRef: true + diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/kustomization.yaml new file mode 100644 index 0000000..eed2a8d --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: jupyter-web-app + app.kubernetes.io/instance: jupyter-web-app + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: jupyter + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..0991e8f --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..589a8ee --- /dev/null +++ b/kubeflow/kfapp/kustomize/jupyter-web-app/overlays/istio/virtual-service.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: jupyter-web-app +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - headers: + request: + add: + x-forwarded-prefix: /jupyter + match: + - uri: + prefix: /jupyter/ + rewrite: + uri: / + route: + - destination: + host: jupyter-web-app-service.$(namespace).svc.$(clusterDomain) + port: + number: 80 diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/experiment-crd.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/experiment-crd.yaml new file mode 100644 index 0000000..78f090b --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/experiment-crd.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: experiments.kubeflow.org +spec: + additionalPrinterColumns: + - JSONPath: .status.conditions[-1:].type + name: Status + type: string + - JSONPath: .metadata.creationTimestamp + name: Age + type: date + group: kubeflow.org + version: v1alpha2 + scope: Namespaced + subresources: + status: {} + names: + kind: Experiment + singular: experiment + plural: experiments + categories: + - all + - kubeflow + - katib diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-deployment.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-deployment.yaml new file mode 100644 index 0000000..d9b4d88 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-deployment.yaml @@ -0,0 +1,40 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: katib-controller + labels: + app: katib-controller +spec: + replicas: 1 + selector: + matchLabels: + app: katib-controller + template: + metadata: + labels: + app: katib-controller + spec: + serviceAccountName: katib-controller + containers: + - name: katib-controller + image: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-controller:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + command: ["./katib-controller"] + ports: + - containerPort: 443 + name: webhook + protocol: TCP + env: + - name: KATIB_CORE_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - mountPath: /tmp/cert + name: cert + readOnly: true + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: katib-controller diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-rbac.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-rbac.yaml new file mode 100644 index 0000000..32979a4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-rbac.yaml @@ -0,0 +1,76 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: katib-controller +rules: +- apiGroups: + - "" + resources: + - configmaps + - serviceaccounts + - services + - secrets + verbs: + - "*" +- apiGroups: + - "" + resources: + - pods + - pods/log + - pods/status + verbs: + - "*" +- apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - "*" +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - get +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - experiments + - experiments/status + - trials + - trials/status + verbs: + - "*" +- apiGroups: + - kubeflow.org + resources: + - tfjobs + - pytorchjobs + verbs: + - "*" +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: katib-controller +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: katib-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: katib-controller +subjects: +- kind: ServiceAccount + name: katib-controller diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-secret.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-secret.yaml new file mode 100644 index 0000000..8341a6a --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-secret.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Secret +metadata: + name: katib-controller diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-service.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-service.yaml new file mode 100644 index 0000000..e197738 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/katib-controller-service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-controller +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 443 + selector: + app: katib-controller diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/kustomization.yaml new file mode 100644 index 0000000..4ff9c34 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/kustomization.yaml @@ -0,0 +1,14 @@ +namespace: kubeflow +resources: +- experiment-crd.yaml +- katib-controller-deployment.yaml +- katib-controller-rbac.yaml +- katib-controller-secret.yaml +- katib-controller-service.yaml +- trial-crd.yaml +- trial-template.yaml +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-controller + newTag: v0.6.0-rc.0 diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/trial-crd.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/trial-crd.yaml new file mode 100644 index 0000000..a766a9a --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/trial-crd.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: trials.kubeflow.org +spec: + additionalPrinterColumns: + - JSONPath: .status.conditions[-1:].type + name: Status + type: string + - JSONPath: .metadata.creationTimestamp + name: Age + type: date + group: kubeflow.org + version: v1alpha2 + scope: Namespaced + subresources: + status: {} + names: + kind: Trial + singular: trial + plural: trials + categories: + - all + - kubeflow + - katib diff --git a/kubeflow/kfapp/kustomize/katib-controller/base/trial-template.yaml b/kubeflow/kfapp/kustomize/katib-controller/base/trial-template.yaml new file mode 100644 index 0000000..bf4ed40 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/base/trial-template.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: trial-template +data: + defaultTrialTemplate.yaml : |- + apiVersion: batch/v1 + kind: Job + metadata: + name: {{.Trial}} + namespace: {{.NameSpace}} + spec: + template: + spec: + containers: + - name: {{.Trial}} + image: alpine + restartPolicy: Never diff --git a/kubeflow/kfapp/kustomize/katib-controller/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-controller/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-controller/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/katib-db/base/katib-db-deployment.yaml b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-deployment.yaml new file mode 100644 index 0000000..a6ed864 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-deployment.yaml @@ -0,0 +1,51 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-db + labels: + app: katib + component: db +spec: + replicas: 1 + template: + metadata: + name: katib-db + labels: + app: katib + component: db + spec: + containers: + - name: katib-db + image: mysql:8.0.3 + args: + - --datadir + - /var/lib/mysql/datadir + env: + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: katib-db-secrets + key: MYSQL_ROOT_PASSWORD + - name: MYSQL_ALLOW_EMPTY_PASSWORD + value: "true" + - name: MYSQL_DATABASE + value: "katib" + ports: + - name: dbapi + containerPort: 3306 + readinessProbe: + exec: + command: + - "/bin/bash" + - "-c" + - "mysql -D $$MYSQL_DATABASE -p$$MYSQL_ROOT_PASSWORD -e 'SELECT 1'" + initialDelaySeconds: 5 + periodSeconds: 2 + timeoutSeconds: 1 + volumeMounts: + - name: katib-mysql + mountPath: /var/lib/mysql + volumes: + - name: katib-mysql + persistentVolumeClaim: + claimName: katib-mysql diff --git a/kubeflow/kfapp/kustomize/katib-db/base/katib-db-pvc.yaml b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-pvc.yaml new file mode 100644 index 0000000..d8f8a82 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-pvc.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: katib-mysql +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi diff --git a/kubeflow/kfapp/kustomize/katib-db/base/katib-db-secret.yaml b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-secret.yaml new file mode 100644 index 0000000..8fca796 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: katib-db-secrets +data: + MYSQL_ROOT_PASSWORD: dGVzdA== # "test" diff --git a/kubeflow/kfapp/kustomize/katib-db/base/katib-db-service.yaml b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-service.yaml new file mode 100644 index 0000000..5a7afd4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/base/katib-db-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-db + labels: + app: katib + component: db +spec: + type: ClusterIP + ports: + - port: 3306 + protocol: TCP + name: dbapi + selector: + app: katib + component: db diff --git a/kubeflow/kfapp/kustomize/katib-db/base/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-db/base/kustomization.yaml new file mode 100644 index 0000000..7b59dde --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/base/kustomization.yaml @@ -0,0 +1,11 @@ +namespace: kubeflow +resources: +- katib-db-deployment.yaml +- katib-db-pvc.yaml +- katib-db-secret.yaml +- katib-db-service.yaml +generatorOptions: + disableNameSuffixHash: true +images: + - name: mysql + newTag: 8.0.3 diff --git a/kubeflow/kfapp/kustomize/katib-db/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-db/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-db/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-deployment.yaml b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-deployment.yaml new file mode 100644 index 0000000..d9ce6ea --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-deployment.yaml @@ -0,0 +1,39 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-manager + labels: + app: katib + component: manager +spec: + replicas: 1 + template: + metadata: + name: katib-manager + labels: + app: katib + component: manager + spec: + containers: + - name: katib-manager + image: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-manager:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + env: + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: katib-db-secrets + key: MYSQL_ROOT_PASSWORD + command: + - './katib-manager' + ports: + - name: api + containerPort: 6789 + readinessProbe: + exec: + command: ["/bin/grpc_health_probe", "-addr=:6789"] + initialDelaySeconds: 5 + livenessProbe: + exec: + command: ["/bin/grpc_health_probe", "-addr=:6789"] + initialDelaySeconds: 10 diff --git a/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-deployment.yaml b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-deployment.yaml new file mode 100644 index 0000000..0d56761 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-deployment.yaml @@ -0,0 +1,25 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-manager-rest + labels: + app: katib + component: manager-rest +spec: + replicas: 1 + template: + metadata: + name: katib-manager-rest + labels: + app: katib + component: manager-rest + spec: + containers: + - name: katib-manager-rest + image: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-manager-rest:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + command: + - './katib-manager-rest' + ports: + - name: api + containerPort: 80 diff --git a/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-service.yaml b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-service.yaml new file mode 100644 index 0000000..48e93ff --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-rest-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-manager-rest + labels: + app: katib + component: manager-rest +spec: + type: ClusterIP + ports: + - port: 80 + protocol: TCP + name: api + selector: + app: katib + component: manager-rest diff --git a/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-service.yaml b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-service.yaml new file mode 100644 index 0000000..f5477b0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/base/katib-manager-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-manager + labels: + app: katib + component: manager +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: manager diff --git a/kubeflow/kfapp/kustomize/katib-manager/base/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-manager/base/kustomization.yaml new file mode 100644 index 0000000..8147124 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/base/kustomization.yaml @@ -0,0 +1,13 @@ +namespace: kubeflow +resources: +- katib-manager-deployment.yaml +- katib-manager-rest-deployment.yaml +- katib-manager-rest-service.yaml +- katib-manager-service.yaml +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-manager + newTag: v0.6.0-rc.0 + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-manager-rest + newTag: v0.6.0-rc.0 diff --git a/kubeflow/kfapp/kustomize/katib-manager/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-manager/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-manager/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-deployment.yaml b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-deployment.yaml new file mode 100644 index 0000000..4fcee7e --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-deployment.yaml @@ -0,0 +1,26 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-ui + labels: + app: katib + component: ui +spec: + replicas: 1 + template: + metadata: + name: katib-ui + labels: + app: katib + component: ui + spec: + containers: + - name: katib-ui + image: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-ui:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + command: + - './katib-ui' + ports: + - name: ui + containerPort: 80 + serviceAccountName: katib-ui diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-rbac.yaml b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-rbac.yaml new file mode 100644 index 0000000..c155fcc --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-rbac.yaml @@ -0,0 +1,35 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: katib-ui +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - "*" +- apiGroups: + - kubeflow.org + resources: + - experiments + - trials + verbs: + - "*" +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: katib-ui +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: katib-ui +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: katib-ui +subjects: +- kind: ServiceAccount + name: katib-ui diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-service.yaml b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-service.yaml new file mode 100644 index 0000000..ee9e156 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/katib-ui-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-ui + labels: + app: katib + component: ui +spec: + type: ClusterIP + ports: + - port: 80 + protocol: TCP + name: ui + selector: + app: katib + component: ui diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-ui/base/kustomization.yaml new file mode 100644 index 0000000..69a9642 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/kustomization.yaml @@ -0,0 +1,30 @@ +namespace: kubeflow +resources: +- katib-ui-deployment.yaml +- katib-ui-rbac.yaml +- katib-ui-service.yaml +configMapGenerator: +- name: katib-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/katib-ui + newTag: v0.6.0-rc.0 +vars: +- name: clusterDomain + objref: + kind: ConfigMap + name: katib-parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +- name: namespace + objref: + kind: Service + name: katib-ui + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/params.env b/kubeflow/kfapp/kustomize/katib-ui/base/params.env new file mode 100644 index 0000000..bdd6604 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/params.env @@ -0,0 +1 @@ +clusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/katib-ui/base/params.yaml b/kubeflow/kfapp/kustomize/katib-ui/base/params.yaml new file mode 100644 index 0000000..eade9a8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/base/params.yaml @@ -0,0 +1,7 @@ +varReference: +- path: data/config + kind: ConfigMap +- path: data/config + kind: Deployment +- path: metadata/annotations/getambassador.io\/config + kind: Service diff --git a/kubeflow/kfapp/kustomize/katib-ui/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-ui/kustomization.yaml new file mode 100644 index 0000000..2a88ffb --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/katib-ui-virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/katib-ui-virtual-service.yaml b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/katib-ui-virtual-service.yaml new file mode 100644 index 0000000..d13cca8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/katib-ui-virtual-service.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: katib-ui +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /katib/ + rewrite: + uri: /katib/ + route: + - destination: + host: katib-ui.$(namespace).svc.$(clusterDomain) + port: + number: 80 diff --git a/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..0f16884 --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- katib-ui-virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/katib-ui/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/metacontroller/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/metacontroller/base/cluster-role-binding.yaml new file mode 100644 index 0000000..dc9c732 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: meta-controller-cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: meta-controller-service diff --git a/kubeflow/kfapp/kustomize/metacontroller/base/crd.yaml b/kubeflow/kfapp/kustomize/metacontroller/base/crd.yaml new file mode 100644 index 0000000..0ae8700 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/base/crd.yaml @@ -0,0 +1,45 @@ +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: compositecontrollers.metacontroller.k8s.io +spec: + group: metacontroller.k8s.io + names: + kind: CompositeController + plural: compositecontrollers + shortNames: + - cc + - cctl + singular: compositecontroller + scope: Cluster + version: v1alpha1 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: controllerrevisions.metacontroller.k8s.io +spec: + group: metacontroller.k8s.io + names: + kind: ControllerRevision + plural: controllerrevisions + singular: controllerrevision + scope: Namespaced + version: v1alpha1 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: decoratorcontrollers.metacontroller.k8s.io +spec: + group: metacontroller.k8s.io + names: + kind: DecoratorController + plural: decoratorcontrollers + shortNames: + - dec + - decorators + singular: decoratorcontroller + scope: Cluster + version: v1alpha1 diff --git a/kubeflow/kfapp/kustomize/metacontroller/base/kustomization.yaml b/kubeflow/kfapp/kustomize/metacontroller/base/kustomization.yaml new file mode 100644 index 0000000..4007653 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/base/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- crd.yaml +- service-account.yaml +- stateful-set.yaml +commonLabels: + kustomize.component: metacontroller +images: + - name: metacontroller/metacontroller + newName: metacontroller/metacontroller + newTag: v0.3.0 diff --git a/kubeflow/kfapp/kustomize/metacontroller/base/service-account.yaml b/kubeflow/kfapp/kustomize/metacontroller/base/service-account.yaml new file mode 100644 index 0000000..85c48de --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: meta-controller-service diff --git a/kubeflow/kfapp/kustomize/metacontroller/base/stateful-set.yaml b/kubeflow/kfapp/kustomize/metacontroller/base/stateful-set.yaml new file mode 100644 index 0000000..5db85b3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/base/stateful-set.yaml @@ -0,0 +1,41 @@ +apiVersion: apps/v1beta2 +kind: StatefulSet +metadata: + labels: + app: metacontroller + name: metacontroller +spec: + replicas: 1 + selector: + matchLabels: + app: metacontroller + serviceName: "" + template: + metadata: + labels: + app: metacontroller + spec: + containers: + - command: + - /usr/bin/metacontroller + - --logtostderr + - -v=4 + - --discovery-interval=20s + image: metacontroller/metacontroller:v0.3.0 + imagePullPolicy: Always + name: metacontroller + ports: + - containerPort: 2345 + resources: + limits: + cpu: "4" + memory: 4Gi + requests: + cpu: 500m + memory: 1Gi + securityContext: + allowPrivilegeEscalation: true + privileged: true + serviceAccountName: meta-controller-service + # Workaround for https://github.com/kubernetes-sigs/kustomize/issues/677 + volumeClaimTemplates: [] diff --git a/kubeflow/kfapp/kustomize/metacontroller/kustomization.yaml b/kubeflow/kfapp/kustomize/metacontroller/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/metacontroller/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/metadata/OWNERS b/kubeflow/kfapp/kustomize/metadata/OWNERS new file mode 100644 index 0000000..b8bf7ba --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/OWNERS @@ -0,0 +1,5 @@ +approvers: + - neuromage + - prodonjs + - rileyjbauer + - zhenghuiwang diff --git a/kubeflow/kfapp/kustomize/metadata/base/kustomization.yaml b/kubeflow/kfapp/kustomize/metadata/base/kustomization.yaml new file mode 100644 index 0000000..f639853 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/kustomization.yaml @@ -0,0 +1,43 @@ +namePrefix: metadata- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + kustomize.component: metadata +configMapGenerator: +- name: ui-parameters + env: params.env +resources: +- metadata-db-pvc.yaml +- metadata-db-secret.yaml +- metadata-db-deployment.yaml +- metadata-db-service.yaml +- metadata-deployment.yaml +- metadata-service.yaml +- metadata-ui-deployment.yaml +- metadata-ui-role.yaml +- metadata-ui-rolebinding.yaml +- metadata-ui-sa.yaml +- metadata-ui-service.yaml +namespace: kubeflow +vars: +- name: ui-namespace + objref: + kind: Service + name: ui + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: ui-clusterDomain + objref: + kind: ConfigMap + name: ui-parameters + version: v1 + fieldref: + fieldpath: data.uiClusterDomain +- name: service + objref: + kind: Service + name: ui + apiVersion: v1 + fieldref: + fieldpath: metadata.name \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-db-deployment.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-deployment.yaml new file mode 100644 index 0000000..c222fc9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-deployment.yaml @@ -0,0 +1,49 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: db + labels: + component: db +spec: + replicas: 1 + template: + metadata: + name: db + labels: + component: db + spec: + containers: + - name: db-container + image: mysql:8.0.3 + args: + - --datadir + - /var/lib/mysql/datadir + env: + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: metadata-db-secrets + key: MYSQL_ROOT_PASSWORD + - name: MYSQL_ALLOW_EMPTY_PASSWORD + value: "true" + - name: MYSQL_DATABASE + value: "metadb" + ports: + - name: dbapi + containerPort: 3306 + readinessProbe: + exec: + command: + - "/bin/bash" + - "-c" + - "mysql -D $$MYSQL_DATABASE -p$$MYSQL_ROOT_PASSWORD -e 'SELECT 1'" + initialDelaySeconds: 5 + periodSeconds: 2 + timeoutSeconds: 1 + volumeMounts: + - name: metadata-mysql + mountPath: /var/lib/mysql + volumes: + - name: metadata-mysql + persistentVolumeClaim: + claimName: metadata-mysql diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-db-pvc.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-pvc.yaml new file mode 100644 index 0000000..46685a1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-pvc.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: mysql +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-db-secret.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-secret.yaml new file mode 100644 index 0000000..c44ab61 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: db-secrets +data: + MYSQL_ROOT_PASSWORD: dGVzdA== # "test" diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-db-service.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-service.yaml new file mode 100644 index 0000000..87ecf49 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-db-service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: db + labels: + component: db +spec: + type: ClusterIP + ports: + - port: 3306 + protocol: TCP + name: dbapi + selector: + component: db diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-deployment.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-deployment.yaml new file mode 100644 index 0000000..f49c847 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-deployment.yaml @@ -0,0 +1,32 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: deployment + labels: + component: server +spec: + replicas: 3 + template: + metadata: + labels: + component: server + spec: + containers: + - name: container + image: gcr.io/kubeflow-images-public/metadata:v0.1.8 + env: + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: metadata-db-secrets + key: MYSQL_ROOT_PASSWORD + command: ["./server/server", + "--http_port=8080", + "--mysql_service_host=metadata-db.kubeflow", + "--mysql_service_port=3306", + "--mysql_service_user=root", + "--mysql_service_password=$(MYSQL_ROOT_PASSWORD)", + "--mlmd_db_name=metadb"] + ports: + - name: backendapi + containerPort: 8080 diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-service.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-service.yaml new file mode 100644 index 0000000..5005e06 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-service.yaml @@ -0,0 +1,14 @@ +kind: Service +apiVersion: v1 +metadata: + labels: + app: metadata + name: service +spec: + selector: + component: server + type: ClusterIP + ports: + - port: 8080 + protocol: TCP + name: backendapi diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-deployment.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-deployment.yaml new file mode 100644 index 0000000..bca2ea7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-deployment.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: ui + labels: + app: metadata-ui +spec: + selector: + matchLabels: + app: metadata-ui + template: + metadata: + name: ui + labels: + app: metadata-ui + spec: + containers: + - image: gcr.io/kubeflow-images-public/metadata-frontend:v0.1.8 + imagePullPolicy: IfNotPresent + name: metadata-ui + ports: + - containerPort: 3000 + serviceAccountName: ui + diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-role.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-role.yaml new file mode 100644 index 0000000..a0b45cd --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-role.yaml @@ -0,0 +1,26 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + labels: + app: metadata-ui + name: ui +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - create + - get + - list +- apiGroups: + - "kubeflow.org" + resources: + - viewers + verbs: + - create + - get + - list + - watch + - delete diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-rolebinding.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-rolebinding.yaml new file mode 100644 index 0000000..23c5a0e --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + labels: + app: metadata-ui + name: ui +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ui +subjects: +- kind: ServiceAccount + name: ui + namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-sa.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-sa.yaml new file mode 100644 index 0000000..8d7a53a --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-sa.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ui diff --git a/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-service.yaml b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-service.yaml new file mode 100644 index 0000000..e7a4afa --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/metadata-ui-service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: ui + labels: + app: metadata-ui +spec: + ports: + - port: 80 + targetPort: 3000 + selector: + app: metadata-ui diff --git a/kubeflow/kfapp/kustomize/metadata/base/params.env b/kubeflow/kfapp/kustomize/metadata/base/params.env new file mode 100644 index 0000000..def9236 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/base/params.env @@ -0,0 +1 @@ +uiClusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/metadata/kustomization.yaml b/kubeflow/kfapp/kustomize/metadata/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/metadata/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/metadata/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/metadata/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/metadata/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/metadata/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/metadata/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..49b58fb --- /dev/null +++ b/kubeflow/kfapp/kustomize/metadata/overlays/istio/virtual-service.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: metadata-ui +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /metadata + rewrite: + uri: /metadata + route: + - destination: + host: $(service).$(ui-namespace).svc.$(ui-clusterDomain) + port: + number: 80 + timeout: 300s diff --git a/kubeflow/kfapp/kustomize/metrics-collector/base/kustomization.yaml b/kubeflow/kfapp/kustomize/metrics-collector/base/kustomization.yaml new file mode 100644 index 0000000..8ed1e1d --- /dev/null +++ b/kubeflow/kfapp/kustomize/metrics-collector/base/kustomization.yaml @@ -0,0 +1,9 @@ +namespace: kubeflow +resources: +- metrics-collector-rbac.yaml +- metrics-collector-template-configmap.yaml +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/metrics-collector + newTag: v0.6.0-rc.0 diff --git a/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-rbac.yaml b/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-rbac.yaml new file mode 100644 index 0000000..4ee1046 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-rbac.yaml @@ -0,0 +1,36 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: metrics-collector +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + - pods/status + verbs: + - "*" +- apiGroups: + - batch + resources: + - jobs + verbs: + - "*" +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: metrics-collector +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: metrics-collector +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: metrics-collector +subjects: +- kind: ServiceAccount + name: metrics-collector diff --git a/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-template-configmap.yaml b/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-template-configmap.yaml new file mode 100644 index 0000000..4483ad6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/metrics-collector/base/metrics-collector-template-configmap.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: metrics-collector-template +data: + defaultMetricsCollectorTemplate.yaml : |- + apiVersion: batch/v1beta1 + kind: CronJob + metadata: + name: {{.Trial}} + namespace: {{.NameSpace}} + spec: + schedule: "*/1 * * * *" + successfulJobsHistoryLimit: 0 + failedJobsHistoryLimit: 1 + jobTemplate: + spec: + backoffLimit: 0 + template: + spec: + serviceAccountName: metrics-collector + containers: + - name: {{.Trial}} + image: gcr.io/kubeflow-images-public/katib/v1alpha2/metrics-collector:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + command: ["./metricscollector"] + args: + - "-e" + - "{{.Experiment}}" + - "-t" + - "{{.Trial}}" + - "-k" + - "{{.JobKind}}" + - "-n" + - "{{.NameSpace}}" + - "-m" + - "{{.ManagerService}}" + - "-mn" + - "{{.MetricNames}}" + restartPolicy: Never diff --git a/kubeflow/kfapp/kustomize/metrics-collector/kustomization.yaml b/kubeflow/kfapp/kustomize/metrics-collector/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/metrics-collector/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/minio/base/deployment.yaml b/kubeflow/kfapp/kustomize/minio/base/deployment.yaml new file mode 100644 index 0000000..440c6c9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + name: minio +spec: + strategy: + type: Recreate + template: + spec: + containers: + - name: minio + args: + - server + - /data + env: + - name: MINIO_ACCESS_KEY + value: minio + - name: MINIO_SECRET_KEY + value: minio123 + image: minio/minio:RELEASE.2018-02-09T22-40-05Z + ports: + - containerPort: 9000 + volumeMounts: + - mountPath: /data + name: data + subPath: minio + volumes: + - name: data + persistentVolumeClaim: + claimName: $(minioPvcName) diff --git a/kubeflow/kfapp/kustomize/minio/base/kustomization.yaml b/kubeflow/kfapp/kustomize/minio/base/kustomization.yaml new file mode 100644 index 0000000..e5e68f8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/kustomization.yaml @@ -0,0 +1,27 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + app: minio +resources: +- deployment.yaml +- secret.yaml +- service.yaml +- persistent-volume-claim.yaml +configMapGenerator: +- name: pipeline-minio-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: minioPvcName + objref: + kind: ConfigMap + name: pipeline-minio-parameters + apiVersion: v1 + fieldref: + fieldpath: data.minioPvcName +images: +- name: minio/minio + newTag: RELEASE.2018-02-09T22-40-05Z +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/minio/base/params.env b/kubeflow/kfapp/kustomize/minio/base/params.env new file mode 100644 index 0000000..b5b9a6f --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/params.env @@ -0,0 +1 @@ +minioPvcName=minio-pv-claim diff --git a/kubeflow/kfapp/kustomize/minio/base/params.yaml b/kubeflow/kfapp/kustomize/minio/base/params.yaml new file mode 100644 index 0000000..5f19982 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/params.yaml @@ -0,0 +1,5 @@ +varReference: +- path: spec/template/spec/volumes/persistentVolumeClaim/claimName + kind: Deployment +- path: metadata/name + kind: PersistentVolumeClaim \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/minio/base/persistent-volume-claim.yaml b/kubeflow/kfapp/kustomize/minio/base/persistent-volume-claim.yaml new file mode 100644 index 0000000..4b4cf71 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/persistent-volume-claim.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: $(minioPvcName) +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi diff --git a/kubeflow/kfapp/kustomize/minio/base/secret.yaml b/kubeflow/kfapp/kustomize/minio/base/secret.yaml new file mode 100644 index 0000000..3ae64f1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/secret.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +data: + accesskey: bWluaW8= + secretkey: bWluaW8xMjM= +kind: Secret +metadata: + name: mlpipeline-minio-artifact +type: Opaque diff --git a/kubeflow/kfapp/kustomize/minio/base/service.yaml b/kubeflow/kfapp/kustomize/minio/base/service.yaml new file mode 100644 index 0000000..f49cf52 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/base/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio-service +spec: + ports: + - port: 9000 + protocol: TCP + targetPort: 9000 + selector: + app: minio diff --git a/kubeflow/kfapp/kustomize/minio/kustomization.yaml b/kubeflow/kfapp/kustomize/minio/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/minio/overlays/minioPd/kustomization.yaml b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/kustomization.yaml new file mode 100644 index 0000000..0b9c2b6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/kustomization.yaml @@ -0,0 +1,31 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- persistent-volume.yaml +patchesStrategicMerge: +- persistent-volume-claim.yaml +configMapGenerator: +- name: pipeline-minio-parameters + behavior: merge + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: minioPd + objref: + kind: ConfigMap + name: pipeline-minio-parameters + apiVersion: v1 + fieldref: + fieldpath: data.minioPd +- name: minioPvName + objref: + kind: ConfigMap + name: pipeline-minio-parameters + apiVersion: v1 + fieldref: + fieldpath: data.minioPvName +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.env b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.env new file mode 100644 index 0000000..cc3d9a5 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.env @@ -0,0 +1,2 @@ +minioPd=dls-kf-storage-artifact-store +minioPvName= diff --git a/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.yaml b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.yaml new file mode 100644 index 0000000..ab22818 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/params.yaml @@ -0,0 +1,9 @@ +varReference: +- path: spec/gcePersistentDisk/pdName + kind: PersistentVolume +- path: metadata/name + kind: PersistentVolume +- path: spec/volumeName + kind: PersistentVolumeClaim +- path: metadata/name + kind: PersistentVolumeClaim diff --git a/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume-claim.yaml b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume-claim.yaml new file mode 100644 index 0000000..44b1f68 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume-claim.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: $(minioPvcName) +spec: + volumeName: $(minioPvName) + storageClassName: "" \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume.yaml b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume.yaml new file mode 100644 index 0000000..e8edd40 --- /dev/null +++ b/kubeflow/kfapp/kustomize/minio/overlays/minioPd/persistent-volume.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: $(minioPvName) +spec: + capacity: + storage: 20Gi + accessModes: + - ReadWriteOnce + gcePersistentDisk: + pdName: $(minioPd) + fsType: ext4 diff --git a/kubeflow/kfapp/kustomize/mysql/base/deployment.yaml b/kubeflow/kfapp/kustomize/mysql/base/deployment.yaml new file mode 100644 index 0000000..9d983b6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/deployment.yaml @@ -0,0 +1,25 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: mysql +spec: + strategy: + type: Recreate + template: + spec: + containers: + - name: mysql + env: + - name: MYSQL_ALLOW_EMPTY_PASSWORD + value: "true" + image: mysql:5.6 + ports: + - containerPort: 3306 + name: mysql + volumeMounts: + - mountPath: /var/lib/mysql + name: mysql-persistent-storage + volumes: + - name: mysql-persistent-storage + persistentVolumeClaim: + claimName: $(mysqlPvcName) diff --git a/kubeflow/kfapp/kustomize/mysql/base/kustomization.yaml b/kubeflow/kfapp/kustomize/mysql/base/kustomization.yaml new file mode 100644 index 0000000..25f6994 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/kustomization.yaml @@ -0,0 +1,26 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + app: mysql +resources: +- deployment.yaml +- service.yaml +- persistent-volume-claim.yaml +configMapGenerator: +- name: pipeline-mysql-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: mysqlPvcName + objref: + kind: ConfigMap + name: pipeline-mysql-parameters + apiVersion: v1 + fieldref: + fieldpath: data.mysqlPvcName +images: +- name: mysql + newTag: '5.6' +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/mysql/base/params.env b/kubeflow/kfapp/kustomize/mysql/base/params.env new file mode 100644 index 0000000..683a665 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/params.env @@ -0,0 +1 @@ +mysqlPvcName=mysql-pv-claim diff --git a/kubeflow/kfapp/kustomize/mysql/base/params.yaml b/kubeflow/kfapp/kustomize/mysql/base/params.yaml new file mode 100644 index 0000000..5f19982 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/params.yaml @@ -0,0 +1,5 @@ +varReference: +- path: spec/template/spec/volumes/persistentVolumeClaim/claimName + kind: Deployment +- path: metadata/name + kind: PersistentVolumeClaim \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/mysql/base/persistent-volume-claim.yaml b/kubeflow/kfapp/kustomize/mysql/base/persistent-volume-claim.yaml new file mode 100644 index 0000000..7f0b916 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/persistent-volume-claim.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: $(mysqlPvcName) +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/mysql/base/service.yaml b/kubeflow/kfapp/kustomize/mysql/base/service.yaml new file mode 100644 index 0000000..65250ec --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/base/service.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Service +metadata: + name: mysql +spec: + ports: + - port: 3306 diff --git a/kubeflow/kfapp/kustomize/mysql/kustomization.yaml b/kubeflow/kfapp/kustomize/mysql/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/kustomization.yaml b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/kustomization.yaml new file mode 100644 index 0000000..b0989f7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/kustomization.yaml @@ -0,0 +1,31 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- persistent-volume.yaml +patchesStrategicMerge: +- persistent-volume-claim.yaml +configMapGenerator: +- name: pipeline-mysql-parameters + behavior: merge + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: mysqlPd + objref: + kind: ConfigMap + name: pipeline-mysql-parameters + apiVersion: v1 + fieldref: + fieldpath: data.mysqlPd +- name: mysqlPvName + objref: + kind: ConfigMap + name: pipeline-mysql-parameters + apiVersion: v1 + fieldref: + fieldpath: data.mysqlPvName +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.env b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.env new file mode 100644 index 0000000..cb0ad4a --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.env @@ -0,0 +1,2 @@ +mysqlPd=dls-kf-storage-metadata-store +mysqlPvName= diff --git a/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.yaml b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.yaml new file mode 100644 index 0000000..00d90cb --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/params.yaml @@ -0,0 +1,9 @@ +varReference: +- path: spec/gcePersistentDisk/pdName + kind: PersistentVolume +- path: metadata/name + kind: PersistentVolume +- path: metadata/name + kind: PersistentVolumeClaim +- path: spec/volumeName + kind: PersistentVolumeClaim diff --git a/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume-claim.yaml b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume-claim.yaml new file mode 100644 index 0000000..719f7da --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume-claim.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: $(mysqlPvcName) +spec: + storageClassName: "" + volumeName: $(mysqlPvName) diff --git a/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume.yaml b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume.yaml new file mode 100644 index 0000000..0929775 --- /dev/null +++ b/kubeflow/kfapp/kustomize/mysql/overlays/mysqlPd/persistent-volume.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: $(mysqlPvName) +spec: + capacity: + storage: 20Gi + accessModes: + - ReadWriteOnce + gcePersistentDisk: + pdName: $(mysqlPd) + fsType: ext4 diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role-binding.yaml new file mode 100644 index 0000000..a1a3945 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: role +subjects: +- kind: ServiceAccount + name: service-account diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role.yaml new file mode 100644 index 0000000..d2dc5a5 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/cluster-role.yaml @@ -0,0 +1,39 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: role +rules: +- apiGroups: + - apps + resources: + - statefulsets + - deployments + verbs: + - '*' +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/status + verbs: + - '*' +- apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/crd.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/crd.yaml new file mode 100644 index 0000000..58fc4e3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/crd.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: notebooks.kubeflow.org +spec: + group: kubeflow.org + names: + kind: Notebook + plural: notebooks + singular: notebook + scope: Namespaced + subresources: + status: {} + version: v1alpha1 + validation: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + template: + description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster + Important: Run "make" to regenerate code after modifying this file' + properties: + spec: + type: object + type: object + type: object + status: + properties: + conditions: + description: Conditions is an array of current conditions + items: + properties: + type: + description: Type of the confition/ + type: string + required: + - type + type: object + type: array + required: + - conditions + type: object +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/deployment.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/deployment.yaml new file mode 100644 index 0000000..e75de09 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/deployment.yaml @@ -0,0 +1,19 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - name: manager + image: gcr.io/kubeflow-images-public/notebook-controller:v20190614-v0-160-g386f2749-e3b0c4 + command: + - /manager + env: + - name: USE_ISTIO + value: "false" + - name: POD_LABELS + value: $(POD_LABELS) + imagePullPolicy: Always + serviceAccountName: service-account diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/kustomization.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/kustomization.yaml new file mode 100644 index 0000000..9473d76 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/kustomization.yaml @@ -0,0 +1,38 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- crd.yaml +- deployment.yaml +- service-account.yaml +- service.yaml +namePrefix: notebook-controller- +namespace: kubeflow +commonLabels: + app: notebook-controller + kustomize.component: notebook-controller +images: + - name: gcr.io/kubeflow-images-public/notebook-controller + newName: gcr.io/kubeflow-images-public/notebook-controller + newTag: v20190603-v0-175-geeca4530-e3b0c4 +configMapGenerator: +- name: parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: POD_LABELS + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.POD_LABELS +- name: USE_ISTIO + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.USE_ISTIO diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/params.env b/kubeflow/kfapp/kustomize/notebook-controller/base/params.env new file mode 100644 index 0000000..f0e4dc9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/params.env @@ -0,0 +1,2 @@ +POD_LABELS=gcp-cred-secret=user-gcp-sa,gcp-cred-secret-filename=user-gcp-sa.json +USE_ISTIO=false diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/service-account.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/service-account.yaml new file mode 100644 index 0000000..a36cbd8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: service-account diff --git a/kubeflow/kfapp/kustomize/notebook-controller/base/service.yaml b/kubeflow/kfapp/kustomize/notebook-controller/base/service.yaml new file mode 100644 index 0000000..c7368f9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/base/service.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Service +metadata: + name: service +spec: + ports: + - port: 443 diff --git a/kubeflow/kfapp/kustomize/notebook-controller/kustomization.yaml b/kubeflow/kfapp/kustomize/notebook-controller/kustomization.yaml new file mode 100644 index 0000000..f0373c2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/kustomization.yaml @@ -0,0 +1,22 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +commonLabels: + app.kubernetes.io/component: notebook + app.kubernetes.io/instance: notebook-controller + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/name: notebook-controller + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 +configMapGenerator: +- behavior: merge + env: overlays/istio/params.env + name: parameters +generatorOptions: + disableNameSuffixHash: true +kind: Kustomization +namespace: kubeflow +patchesStrategicMerge: +- overlays/istio/deployment.yaml +resources: +- overlays/application/application.yaml diff --git a/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/application.yaml new file mode 100644 index 0000000..ef8bc88 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/application.yaml @@ -0,0 +1,39 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: notebook-controller +spec: + selector: + matchLabels: + app.kubernetes.io/name: notebook-controller + app.kubernetes.io/instance: notebook-controller + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: notebook + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 + componentKinds: + - group: core + kind: Service + - group: apps + kind: Deployment + - group: core + kind: ServiceAccount + descriptor: + type: notebook-controller + version: v0.6.2 + description: Notebooks controller allows users to create a custom resource \"Notebook\" (jupyter notebook). + maintainers: + - name: Lun-kai Hsu + email: lunkai@google.com + owners: + - name: Lun-kai Hsu + email: lunkai@gogle.com + keywords: + - jupyter + - notebook + - notebook-controller + - jupyterhub + links: + - description: About + url: "https://github.com/kubeflow/kubeflow/tree/master/components/notebook-controller" + addOwnerRef: true diff --git a/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/kustomization.yaml new file mode 100644 index 0000000..698f691 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: notebook-controller + app.kubernetes.io/instance: notebook-controller + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: notebook + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/deployment.yaml b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/deployment.yaml new file mode 100644 index 0000000..7912209 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/deployment.yaml @@ -0,0 +1,12 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - name: manager + env: + - name: USE_ISTIO + value: $(USE_ISTIO) diff --git a/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..7184bcd --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +patchesStrategicMerge: +- deployment.yaml +configMapGenerator: +- name: parameters + behavior: merge + env: params.env +generatorOptions: + disableNameSuffixHash: true diff --git a/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/params.env b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/params.env new file mode 100644 index 0000000..ec27186 --- /dev/null +++ b/kubeflow/kfapp/kustomize/notebook-controller/overlays/istio/params.env @@ -0,0 +1 @@ +USE_ISTIO=true diff --git a/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole-binding.yaml b/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole-binding.yaml new file mode 100644 index 0000000..b7ec1a4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: persistenceagent +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: persistenceagent diff --git a/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole.yaml b/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole.yaml new file mode 100644 index 0000000..0242d6f --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/base/clusterrole.yaml @@ -0,0 +1,21 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: persistenceagent +rules: +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - get + - list + - watch diff --git a/kubeflow/kfapp/kustomize/persistent-agent/base/deployment.yaml b/kubeflow/kfapp/kustomize/persistent-agent/base/deployment.yaml new file mode 100644 index 0000000..88abc58 --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/base/deployment.yaml @@ -0,0 +1,17 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: persistenceagent +spec: + template: + spec: + containers: + - name: ml-pipeline-persistenceagent + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: gcr.io/ml-pipeline/persistenceagent:0.1.23 + imagePullPolicy: IfNotPresent + serviceAccountName: ml-pipeline-persistenceagent diff --git a/kubeflow/kfapp/kustomize/persistent-agent/base/kustomization.yaml b/kubeflow/kfapp/kustomize/persistent-agent/base/kustomization.yaml new file mode 100644 index 0000000..660f418 --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/base/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +nameprefix: ml-pipeline- +commonLabels: + app: ml-pipeline-persistenceagent +resources: +- clusterrole-binding.yaml +- clusterrole.yaml +- deployment.yaml +- service-account.yaml +images: +- name: gcr.io/ml-pipeline/persistenceagent + newTag: '0.1.23' diff --git a/kubeflow/kfapp/kustomize/persistent-agent/base/service-account.yaml b/kubeflow/kfapp/kustomize/persistent-agent/base/service-account.yaml new file mode 100644 index 0000000..3e2b988 --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: persistenceagent diff --git a/kubeflow/kfapp/kustomize/persistent-agent/kustomization.yaml b/kubeflow/kfapp/kustomize/persistent-agent/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/persistent-agent/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role-binding.yaml new file mode 100644 index 0000000..1f1c2c2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: pipeline-runner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pipeline-runner +subjects: +- kind: ServiceAccount + name: pipeline-runner diff --git a/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role.yaml new file mode 100644 index 0000000..9b3b719 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-runner/base/cluster-role.yaml @@ -0,0 +1,75 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: pipeline-runner +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - watch + - list +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + verbs: + - create + - delete + - get +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - "" + resources: + - pods + - pods/exec + - pods/log + - services + verbs: + - '*' +- apiGroups: + - "" + - apps + - extensions + resources: + - deployments + - replicasets + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - '*' + verbs: + - '*' +- apiGroups: + - batch + resources: + - jobs + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/pipelines-runner/base/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-runner/base/kustomization.yaml new file mode 100644 index 0000000..0c50f07 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-runner/base/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +commonLabels: + app: pipeline-runner +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- service-account.yaml diff --git a/kubeflow/kfapp/kustomize/pipelines-runner/base/service-account.yaml b/kubeflow/kfapp/kustomize/pipelines-runner/base/service-account.yaml new file mode 100644 index 0000000..8cb2c66 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-runner/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: pipeline-runner diff --git a/kubeflow/kfapp/kustomize/pipelines-runner/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-runner/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-runner/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/deployment.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/deployment.yaml new file mode 100644 index 0000000..31d7be0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/deployment.yaml @@ -0,0 +1,22 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + labels: + app: ml-pipeline-ui + name: ml-pipeline-ui +spec: + selector: + matchLabels: + app: ml-pipeline-ui + template: + metadata: + labels: + app: ml-pipeline-ui + spec: + containers: + - name: ml-pipeline-ui + image: gcr.io/ml-pipeline/frontend:0.1.23 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3000 + serviceAccountName: ml-pipeline-ui diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/kustomization.yaml new file mode 100644 index 0000000..a8c6a3d --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/kustomization.yaml @@ -0,0 +1,46 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +resources: +- deployment.yaml +- role-binding.yaml +- role.yaml +- service-account.yaml +- service.yaml +configMapGenerator: +- name: ui-parameters + env: params.env +images: +- name: gcr.io/ml-pipeline/frontend + newTag: '0.1.23' +vars: +- name: ui-namespace + objref: + kind: Service + name: ml-pipeline-ui + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: ui-clusterDomain + objref: + kind: ConfigMap + name: ui-parameters + version: v1 + fieldref: + fieldpath: data.uiClusterDomain +- name: service + objref: + kind: Service + name: ml-pipeline-ui + apiVersion: v1 + fieldref: + fieldpath: metadata.name +- name: tensorboard-service + objref: + kind: Service + name: ml-pipeline-tensorboard-ui + apiVersion: v1 + fieldref: + fieldpath: metadata.name +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/params.env b/kubeflow/kfapp/kustomize/pipelines-ui/base/params.env new file mode 100644 index 0000000..def9236 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/params.env @@ -0,0 +1 @@ +uiClusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/params.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/params.yaml new file mode 100644 index 0000000..c8de9ba --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: metadata/annotations/getambassador.io\/config + kind: Service diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/role-binding.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/role-binding.yaml new file mode 100644 index 0000000..ab8654e --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/role-binding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + labels: + app: ml-pipeline-ui + name: ml-pipeline-ui +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline-ui +subjects: +- kind: ServiceAccount + name: ml-pipeline-ui diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/role.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/role.yaml new file mode 100644 index 0000000..1726f08 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/role.yaml @@ -0,0 +1,26 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + labels: + app: ml-pipeline-ui + name: ml-pipeline-ui +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - create + - get + - list +- apiGroups: + - "kubeflow.org" + resources: + - viewers + verbs: + - create + - get + - list + - watch + - delete diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/service-account.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/service-account.yaml new file mode 100644 index 0000000..4c890a2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-ui diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/base/service.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/base/service.yaml new file mode 100644 index 0000000..8887a5c --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/base/service.yaml @@ -0,0 +1,48 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline-ui + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: pipelineui-mapping + prefix: /pipeline + rewrite: /pipeline + timeout_ms: 300000 + service: $(service).$(ui-namespace) + use_websocket: true + labels: + app: ml-pipeline-ui +spec: + ports: + - port: 80 + targetPort: 3000 + selector: + app: ml-pipeline-ui +--- +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline-tensorboard-ui + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: pipeline-tensorboard-ui-mapping + prefix: /data + rewrite: /data + timeout_ms: 300000 + service: $(service).$(ui-namespace) + use_websocket: true + labels: + app: ml-pipeline-tensorboard-ui +spec: + ports: + - port: 80 + targetPort: 3000 + selector: + app: ml-pipeline-tensorboard-ui diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..1888b7c --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-ui/overlays/istio/virtual-service.yaml @@ -0,0 +1,43 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: ml-pipeline-tensorboard-ui +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /data + rewrite: + uri: /data + route: + - destination: + host: $(tensorboard-service).$(ui-namespace).svc.$(ui-clusterDomain) + port: + number: 80 + timeout: 300s +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: ml-pipeline-ui +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /pipeline + rewrite: + uri: /pipeline + route: + - destination: + host: $(service).$(ui-namespace).svc.$(ui-clusterDomain) + port: + number: 80 + timeout: 300s diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role-binding.yaml new file mode 100644 index 0000000..91eaab5 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: crd-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: controller-role +subjects: +- kind: ServiceAccount + name: crd-service-account diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role.yaml new file mode 100644 index 0000000..ad5de8b --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/cluster-role.yaml @@ -0,0 +1,30 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: controller-role +rules: +- apiGroups: + - '*' + resources: + - deployments + - services + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - viewers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/crd.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/crd.yaml new file mode 100644 index 0000000..dcb5db0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/crd.yaml @@ -0,0 +1,18 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: viewers.kubeflow.org +spec: + group: kubeflow.org + names: + kind: Viewer + listKind: ViewerList + plural: viewers + shortNames: + - vi + singular: viewer + scope: Namespaced + versions: + - name: v1beta1 + served: true + storage: true diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/deployment.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/deployment.yaml new file mode 100644 index 0000000..234f6c1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/deployment.yaml @@ -0,0 +1,17 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: controller-deployment +spec: + template: + spec: + containers: + - env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: gcr.io/ml-pipeline/viewer-crd-controller:0.1.23 + imagePullPolicy: Always + name: ml-pipeline-viewer-controller + serviceAccountName: crd-service-account diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/kustomization.yaml new file mode 100644 index 0000000..9f10733 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +nameprefix: ml-pipeline-viewer- +commonLabels: + app: ml-pipeline-viewer-crd +resources: +- crd.yaml +- cluster-role-binding.yaml +- cluster-role.yaml +- deployment.yaml +- service-account.yaml +images: +- name: gcr.io/ml-pipeline/viewer-crd-controller + newTag: '0.1.23' diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/base/service-account.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/base/service-account.yaml new file mode 100644 index 0000000..96b13b1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: crd-service-account diff --git a/kubeflow/kfapp/kustomize/pipelines-viewer/kustomization.yaml b/kubeflow/kfapp/kustomize/pipelines-viewer/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/pipelines-viewer/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/profiles/base/README.md b/kubeflow/kfapp/kustomize/profiles/base/README.md new file mode 100644 index 0000000..66cb68b --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/README.md @@ -0,0 +1,5 @@ +When profile-controller image updated, you can run below command to update it in manifest. + +``` +kustomize edit set image gcr.io/kubeflow-images-public/profile-controller:$NEW_TAG +``` diff --git a/kubeflow/kfapp/kustomize/profiles/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/profiles/base/cluster-role-binding.yaml new file mode 100644 index 0000000..9f55fc3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: controller-service-account diff --git a/kubeflow/kfapp/kustomize/profiles/base/crd.yaml b/kubeflow/kfapp/kustomize/profiles/base/crd.yaml new file mode 100644 index 0000000..3856277 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/crd.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + creationTimestamp: null + labels: + controller-tools.k8s.io: "1.0" + name: profiles.kubeflow.org +spec: + group: kubeflow.org + names: + kind: Profile + plural: profiles + scope: Cluster + validation: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + owner: + description: The profile owner + type: object + type: object + status: + properties: + message: + type: string + status: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state + of cluster Important: Run "make" to regenerate code after modifying + this file' + type: string + type: object + version: v1alpha1 +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/kubeflow/kfapp/kustomize/profiles/base/deployment.yaml b/kubeflow/kfapp/kustomize/profiles/base/deployment.yaml new file mode 100644 index 0000000..fac259d --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - command: + - /manager + args: + - "-userid-header" + - $(userid-header) + - "-userid-prefix" + - $(userid-prefix) + image: gcr.io/kubeflow-images-public/profile-controller:v20190619-v0-219-gbd3daa8c-dirty-1ced0e + imagePullPolicy: Always + name: manager + - command: + - /opt/kubeflow/access-management + args: + - "-cluster-admin" + - $(admin) + - "-userid-header" + - $(userid-header) + - "-userid-prefix" + - $(userid-prefix) + image: gcr.io/kubeflow-images-public/kfam:v20190612-v0-170-ga06cdb79-dirty-a33ee4 + imagePullPolicy: Always + name: kfam + serviceAccountName: controller-service-account diff --git a/kubeflow/kfapp/kustomize/profiles/base/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/base/kustomization.yaml new file mode 100644 index 0000000..a93987b --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/kustomization.yaml @@ -0,0 +1,52 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- crd.yaml +- service-account.yaml +- cluster-role-binding.yaml +- role.yaml +- role-binding.yaml +- service.yaml +- deployment.yaml +namePrefix: profiles- +namespace: kubeflow +commonLabels: + kustomize.component: profiles +configMapGenerator: + - name: profiles-parameters + env: params.env +images: + - name: gcr.io/kubeflow-images-public/profile-controller + newName: gcr.io/kubeflow-images-public/profile-controller + newTag: v20190619-v0-219-gbd3daa8c-dirty-1ced0e +vars: + - name: admin + objref: + kind: ConfigMap + name: profiles-parameters + apiVersion: v1 + fieldref: + fieldpath: data.admin + - name: userid-header + objref: + kind: ConfigMap + name: profiles-parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-header + - name: userid-prefix + objref: + kind: ConfigMap + name: profiles-parameters + apiVersion: v1 + fieldref: + fieldpath: data.userid-prefix + - name: namespace + objref: + kind: Service + name: kfam + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/profiles/base/params.env b/kubeflow/kfapp/kustomize/profiles/base/params.env new file mode 100644 index 0000000..be02730 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/params.env @@ -0,0 +1,3 @@ +admin=johnDoe@acme.com +userid-header= +userid-prefix= diff --git a/kubeflow/kfapp/kustomize/profiles/base/params.yaml b/kubeflow/kfapp/kustomize/profiles/base/params.yaml new file mode 100644 index 0000000..343ee46 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/params.yaml @@ -0,0 +1,11 @@ +varReference: +- path: spec/template/spec/containers/0/args/1 + kind: Deployment +- path: spec/template/spec/containers/0/args/3 + kind: Deployment +- path: spec/template/spec/containers/1/args/1 + kind: Deployment +- path: spec/template/spec/containers/1/args/3 + kind: Deployment +- path: spec/template/spec/containers/1/args/5 + kind: Deployment \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/profiles/base/role-binding.yaml b/kubeflow/kfapp/kustomize/profiles/base/role-binding.yaml new file mode 100644 index 0000000..ed611c1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: default-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: default-role +subjects: +- kind: ServiceAccount + name: default-service-account diff --git a/kubeflow/kfapp/kustomize/profiles/base/role.yaml b/kubeflow/kfapp/kustomize/profiles/base/role.yaml new file mode 100644 index 0000000..ddbc0a7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/role.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: default-role +rules: +- apiGroups: + - kubeflow.org + resources: + - profiles + verbs: + - create + - watch + - list diff --git a/kubeflow/kfapp/kustomize/profiles/base/service-account.yaml b/kubeflow/kfapp/kustomize/profiles/base/service-account.yaml new file mode 100644 index 0000000..417214e --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/service-account.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller-service-account +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: default-service-account diff --git a/kubeflow/kfapp/kustomize/profiles/base/service.yaml b/kubeflow/kfapp/kustomize/profiles/base/service.yaml new file mode 100644 index 0000000..9c0e659 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/base/service.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Service +metadata: + name: kfam +spec: + ports: + - port: 8081 \ No newline at end of file diff --git a/kubeflow/kfapp/kustomize/profiles/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/debug/deployment.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/debug/deployment.yaml new file mode 100644 index 0000000..6c007d7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/debug/deployment.yaml @@ -0,0 +1,22 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - name: manager + command: ["/go/bin/dlv"] + args: ["--listen=:2345", "--headless=true", "--api-version=2", "exec", "/go/src/github.com/kubeflow/kubeflow/components/profile-controller/manager"] + env: + - name: project + valueFrom: + configMapKeyRef: + name: parameters + key: project + image: gcr.io/$(project)/profile-controller:latest + ports: + - containerPort: 2345 + securityContext: + privileged: true diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/debug/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/debug/kustomization.yaml new file mode 100644 index 0000000..ab2fbfa --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/debug/kustomization.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +patchesStrategicMerge: +- deployment.yaml +configMapGenerator: +- name: parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: project + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.project +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.env b/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.env new file mode 100644 index 0000000..8a76300 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.env @@ -0,0 +1 @@ +project= diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.yaml new file mode 100644 index 0000000..3d38939 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/debug/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/template/spec/containers/image + kind: Deployment diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/devices/deployment.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/devices/deployment.yaml new file mode 100644 index 0000000..6fd2207 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/devices/deployment.yaml @@ -0,0 +1,16 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - name: manager + resources: + requests: + memory: "64Mi" + cpu: "250m" + limits: + memory: "128Mi" + cpu: "500m" diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/devices/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/devices/kustomization.yaml new file mode 100644 index 0000000..9080da8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/devices/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +patchesStrategicMerge: +- deployment.yaml diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..daf2dec --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/istio/virtual-service.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: kfam +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - headers: + request: + add: + x-forwarded-prefix: /kfam + match: + - uri: + prefix: /kfam/ + rewrite: + uri: /kfam/ + route: + - destination: + host: profiles-kfam.$(namespace).svc.cluster.local + port: + number: 8081 diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/test/app_test.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/test/app_test.yaml new file mode 100644 index 0000000..345d067 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/test/app_test.yaml @@ -0,0 +1,23 @@ +apiVersion: kfdef.apps.kubeflow.org/v1alpha1 +kind: KfDef +metadata: + name: plugin-test +spec: + appdir: . + componentParams: + profiles: + - name: overlay + value: debug + - name: overlay + value: devices + components: + - profiles + manifestsRepo: /Users/kdkasrav/plugin-test/.cache/manifests/pull/31/head + packageManager: kustomize@pull/31 + packages: + - profiles + repo: /Users/kdkasrav/plugin-test/.cache/kubeflow/master/kubeflow + useBasicAuth: false + useIstio: true + version: master +status: {} diff --git a/kubeflow/kfapp/kustomize/profiles/overlays/test/kustomization.yaml b/kubeflow/kfapp/kustomize/profiles/overlays/test/kustomization.yaml new file mode 100644 index 0000000..806e444 --- /dev/null +++ b/kubeflow/kfapp/kustomize/profiles/overlays/test/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +generators: +- app_test.yaml diff --git a/kubeflow/kfapp/kustomize/pytorch-job-crds/base/crd.yaml b/kubeflow/kfapp/kustomize/pytorch-job-crds/base/crd.yaml new file mode 100644 index 0000000..9a44929 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-job-crds/base/crd.yaml @@ -0,0 +1,45 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: pytorchjobs.kubeflow.org +spec: + additionalPrinterColumns: + - JSONPath: .status.conditions[-1:].type + name: State + type: string + - JSONPath: .metadata.creationTimestamp + name: Age + type: date + group: kubeflow.org + names: + kind: PyTorchJob + plural: pytorchjobs + singular: pytorchjob + scope: Namespaced + subresources: + status: {} + validation: + openAPIV3Schema: + properties: + spec: + properties: + pytorchReplicaSpecs: + properties: + Master: + properties: + replicas: + maximum: 1 + minimum: 1 + type: integer + Worker: + properties: + replicas: + minimum: 1 + type: integer + versions: + - name: v1beta2 + served: true + storage: false + - name: v1 + served: true + storage: true diff --git a/kubeflow/kfapp/kustomize/pytorch-job-crds/base/kustomization.yaml b/kubeflow/kfapp/kustomize/pytorch-job-crds/base/kustomization.yaml new file mode 100644 index 0000000..6e120e7 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-job-crds/base/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- crd.yaml diff --git a/kubeflow/kfapp/kustomize/pytorch-job-crds/kustomization.yaml b/kubeflow/kfapp/kustomize/pytorch-job-crds/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-job-crds/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role-binding.yaml new file mode 100644 index 0000000..595f0fd --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role-binding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: pytorch-operator + name: pytorch-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pytorch-operator +subjects: +- kind: ServiceAccount + name: pytorch-operator diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role.yaml new file mode 100644 index 0000000..5b1db04 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/cluster-role.yaml @@ -0,0 +1,50 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: pytorch-operator + name: pytorch-operator +rules: +- apiGroups: + - kubeflow.org + resources: + - pytorchjobs + - pytorchjobs/status + verbs: + - '*' +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - '*' +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - '*' +- apiGroups: + - batch + resources: + - jobs + verbs: + - '*' +- apiGroups: + - "" + resources: + - configmaps + - pods + - services + - endpoints + - persistentvolumeclaims + - events + verbs: + - '*' +- apiGroups: + - apps + - extensions + resources: + - deployments + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/config-map.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/config-map.yaml new file mode 100644 index 0000000..4123dc0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/config-map.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + controller_config_file.yaml: |- + { + + } +kind: ConfigMap +metadata: + name: pytorch-operator-config diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/deployment.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/deployment.yaml new file mode 100644 index 0000000..f3989e2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/deployment.yaml @@ -0,0 +1,39 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: pytorch-operator +spec: + replicas: 1 + selector: + matchLabels: + name: pytorch-operator + template: + metadata: + labels: + name: pytorch-operator + spec: + containers: + - command: + - /pytorch-operator.v1 + - --alsologtostderr + - -v=1 + - --monitoring-port=8443 + env: + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: gcr.io/kubeflow-images-public/pytorch-operator:v0.5.1-5-ge775742 + name: pytorch-operator + volumeMounts: + - mountPath: /etc/config + name: config-volume + serviceAccountName: pytorch-operator + volumes: + - configMap: + name: pytorch-operator-config + name: config-volume diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/kustomization.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/kustomization.yaml new file mode 100644 index 0000000..0cb5fca --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/kustomization.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- config-map.yaml +- deployment.yaml +- service-account.yaml +- service.yaml +commonLabels: + kustomize.component: pytorch-operator +images: + - name: gcr.io/kubeflow-images-public/pytorch-operator + newName: gcr.io/kubeflow-images-public/pytorch-operator + newTag: v1.0.0-rc.0 diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/params.env b/kubeflow/kfapp/kustomize/pytorch-operator/base/params.env new file mode 100644 index 0000000..47e9d44 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/params.env @@ -0,0 +1,3 @@ +pytorchDefaultImage=null +deploymentScope=cluster +deploymentNamespace=null diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/service-account.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/service-account.yaml new file mode 100644 index 0000000..3fe6033 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/service-account.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: pytorch-operator + name: pytorch-operator diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/base/service.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/base/service.yaml new file mode 100644 index 0000000..c788ab2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/base/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + prometheus.io/path: /metrics + prometheus.io/port: "8443" + prometheus.io/scrape: "true" + labels: + app: pytorch-operator + name: pytorch-operator +spec: + ports: + - name: monitoring-port + port: 8443 + targetPort: 8443 + selector: + name: pytorch-operator + type: ClusterIP + diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/kustomization.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/application.yaml new file mode 100644 index 0000000..a4c2b0d --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/application.yaml @@ -0,0 +1,44 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: pytorch-operator +spec: + selector: + matchLabels: + app.kubernetes.io/name: pytorch-operator + app.kubernetes.io/instance: pytorch-operator + app.kubernetes.io/version: v0.6.0 + app.kubernetes.io/component: pytorch + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/managed-by: kfctl + componentKinds: + - group: core + kind: Service + - group: apps + kind: Deployment + - group: core + kind: ConfigMap + - group: core + kind: ServiceAccount + - group: kubeflow.org + kind: PyTorchJob + descriptor: + type: "pytorch-operator" + version: "v1" + description: "Pytorch-operator allows users to create and manage the \"PyTorchJob\" custom resource." + maintainers: + - name: Johnu George + email: johnugeo@cisco.com + owners: + - name: Johnu George + email: johnugeo@cisco.com + keywords: + - "pytorchjob" + - "pytorch-operator" + - "pytorch-training" + links: + - description: About + url: "https://github.com/kubeflow/pytorch-operator" + - description: Docs + url: "https://www.kubeflow.org/docs/reference/pytorchjob/v1/pytorch/" + addOwnerRef: true diff --git a/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/kustomization.yaml new file mode 100644 index 0000000..13c17e8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/pytorch-operator/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: pytorch-operator + app.kubernetes.io/instance: pytorch-operator + app.kubernetes.io/version: v0.6.0 + app.kubernetes.io/component: pytorch + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/managed-by: kfctl diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/crd.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/crd.yaml new file mode 100644 index 0000000..22dc3c8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/crd.yaml @@ -0,0 +1,18 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: scheduledworkflows.kubeflow.org +spec: + group: kubeflow.org + names: + kind: ScheduledWorkflow + listKind: ScheduledWorkflowList + plural: scheduledworkflows + shortNames: + - swf + singular: scheduledworkflow + scope: Namespaced + versions: + - name: v1beta1 + served: true + storage: true diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/deployment.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/deployment.yaml new file mode 100644 index 0000000..9f6dc31 --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/deployment.yaml @@ -0,0 +1,17 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: ml-pipeline-scheduledworkflow +spec: + template: + spec: + containers: + - name: ml-pipeline-scheduledworkflow + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: gcr.io/ml-pipeline/scheduledworkflow:0.1.23 + imagePullPolicy: IfNotPresent + serviceAccountName: ml-pipeline-scheduledworkflow diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/kustomization.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/kustomization.yaml new file mode 100644 index 0000000..c4b2693 --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +commonLabels: + app: ml-pipeline-scheduledworkflow +resources: +- crd.yaml +- deployment.yaml +- role-binding.yaml +- role.yaml +- service-account.yaml +images: +- name: gcr.io/ml-pipeline/scheduledworkflow + newTag: '0.1.23' diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/role-binding.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/role-binding.yaml new file mode 100644 index 0000000..18ebc93 --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: ml-pipeline-scheduledworkflow +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: ml-pipeline-scheduledworkflow diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/role.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/role.yaml new file mode 100644 index 0000000..e922eae --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/role.yaml @@ -0,0 +1,29 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: ml-pipeline-scheduledworkflow +rules: +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/base/service-account.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/base/service-account.yaml new file mode 100644 index 0000000..285c137 --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-scheduledworkflow diff --git a/kubeflow/kfapp/kustomize/scheduledworkflow/kustomization.yaml b/kubeflow/kfapp/kustomize/scheduledworkflow/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/scheduledworkflow/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/clusterrole.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/clusterrole.yaml new file mode 100644 index 0000000..cd474b3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/clusterrole.yaml @@ -0,0 +1,162 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: seldon-operator-manager-role +rules: +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - apps + resources: + - deployments/status + verbs: + - get + - update + - patch +- apiGroups: + - v1 + resources: + - services + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - v1 + resources: + - services/status + verbs: + - get + - update + - patch +- apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - networking.istio.io + resources: + - virtualservices/status + verbs: + - get + - update + - patch +- apiGroups: + - networking.istio.io + resources: + - destinationrules + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - networking.istio.io + resources: + - destinationrules/status + verbs: + - get + - update + - patch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers/status + verbs: + - get + - update + - patch +- apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments/status + verbs: + - get + - update + - patch +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/crd.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/crd.yaml new file mode 100644 index 0000000..2afcb31 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/crd.yaml @@ -0,0 +1,2299 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: seldondeployments.machinelearning.seldon.io +spec: + group: machinelearning.seldon.io + names: + kind: SeldonDeployment + plural: seldondeployments + shortNames: + - sdep + singular: seldondeployment + scope: Namespaced + validation: + openAPIV3Schema: + properties: + spec: + properties: + annotations: + type: object + name: + type: string + oauth_key: + type: string + oauth_secret: + type: string + predictors: + items: + properties: + annotations: + type: object + componentSpecs: + items: + properties: + hpaSpec: + properties: + maxReplicas: + format: int32 + type: integer + metrics: + items: + properties: + external: + properties: + metricName: + type: string + metricSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + targetAverageValue: + type: string + targetValue: + type: string + required: + - metricName + type: object + object: + properties: + averageValue: + type: string + metricName: + type: string + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + target: + properties: + apiVersion: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + targetValue: + type: string + required: + - target + - metricName + - targetValue + type: object + pods: + properties: + metricName: + type: string + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + targetAverageValue: + type: string + required: + - metricName + - targetAverageValue + type: object + resource: + properties: + name: + type: string + targetAverageUtilization: + format: int32 + type: integer + targetAverageValue: + type: string + required: + - name + type: object + type: + type: string + required: + - type + type: object + type: array + minReplicas: + format: int32 + type: integer + type: object + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + clusterName: + type: string + creationTimestamp: + format: date-time + type: string + deletionGracePeriodSeconds: + format: int64 + type: integer + deletionTimestamp: + format: date-time + type: string + finalizers: + items: + type: string + type: array + x-kubernetes-patch-strategy: merge + generateName: + type: string + generation: + format: int64 + type: integer + initializers: + properties: + pending: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + result: + properties: + apiVersion: + type: string + code: + format: int32 + type: integer + details: + properties: + causes: + items: + properties: + field: + type: string + message: + type: string + reason: + type: string + type: object + type: array + group: + type: string + kind: + type: string + name: + type: string + retryAfterSeconds: + format: int32 + type: integer + uid: + type: string + type: object + kind: + type: string + message: + type: string + metadata: + properties: + continue: + type: string + remainingItemCount: + format: int64 + type: integer + resourceVersion: + type: string + selfLink: + type: string + type: object + reason: + type: string + status: + type: string + type: object + x-kubernetes-group-version-kind: + - group: "" + kind: Status + version: v1 + required: + - pending + type: object + labels: + additionalProperties: + type: string + type: object + managedFields: + items: + properties: + apiVersion: + type: string + fields: + type: object + manager: + type: string + operation: + type: string + time: + format: date-time + type: string + type: object + type: array + name: + type: string + namespace: + type: string + ownerReferences: + items: + properties: + apiVersion: + type: string + blockOwnerDeletion: + type: boolean + controller: + type: boolean + kind: + type: string + name: + type: string + uid: + type: string + required: + - apiVersion + - kind + - name + - uid + type: object + type: array + x-kubernetes-patch-merge-key: uid + x-kubernetes-patch-strategy: merge + resourceVersion: + type: string + selfLink: + type: string + uid: + type: string + type: object + spec: + properties: + activeDeadlineSeconds: + format: int64 + type: integer + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + format: int32 + type: integer + required: + - weight + - preference + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + type: array + required: + - nodeSelectorTerms + type: object + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - weight + - podAffinityTerm + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - weight + - podAffinityTerm + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + x-kubernetes-patch-merge-key: key + x-kubernetes-patch-strategy: merge + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + automountServiceAccountToken: + type: boolean + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + resourceFieldRef: + properties: + containerName: + type: string + divisor: + type: string + resource: + type: string + required: + - resource + type: object + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + x-kubernetes-patch-merge-key: containerPort + x-kubernetes-patch-strategy: merge + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + timeoutSeconds: + format: int32 + type: integer + type: object + resources: + properties: + limits: + type: object + requests: + type: object + type: object + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + type: object + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - name + - devicePath + type: object + type: array + x-kubernetes-patch-merge-key: devicePath + x-kubernetes-patch-strategy: merge + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - name + - mountPath + type: object + type: array + x-kubernetes-patch-merge-key: mountPath + x-kubernetes-patch-strategy: merge + workingDir: + type: string + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + dnsConfig: + properties: + nameservers: + items: + type: string + type: array + options: + items: + properties: + name: + type: string + value: + type: string + type: object + type: array + searches: + items: + type: string + type: array + type: object + dnsPolicy: + type: string + enableServiceLinks: + type: boolean + hostAliases: + items: + properties: + hostnames: + items: + type: string + type: array + ip: + type: string + type: object + type: array + x-kubernetes-patch-merge-key: ip + x-kubernetes-patch-strategy: merge + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostname: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + initContainers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + resourceFieldRef: + properties: + containerName: + type: string + divisor: + type: string + resource: + type: string + required: + - resource + type: object + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + x-kubernetes-patch-merge-key: containerPort + x-kubernetes-patch-strategy: merge + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + format: int-or-string + type: string + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + format: int-or-string + type: string + required: + - port + type: object + timeoutSeconds: + format: int32 + type: integer + type: object + resources: + properties: + limits: + type: object + requests: + type: object + type: object + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + type: object + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - name + - devicePath + type: object + type: array + x-kubernetes-patch-merge-key: devicePath + x-kubernetes-patch-strategy: merge + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - name + - mountPath + type: object + type: array + x-kubernetes-patch-merge-key: mountPath + x-kubernetes-patch-strategy: merge + workingDir: + type: string + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + nodeName: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + overhead: + type: object + preemptionPolicy: + type: string + priority: + format: int32 + type: integer + priorityClassName: + type: string + readinessGates: + items: + properties: + conditionType: + type: string + required: + - conditionType + type: object + type: array + restartPolicy: + type: string + runtimeClassName: + type: string + schedulerName: + type: string + securityContext: + properties: + fsGroup: + format: int64 + type: integer + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceAccountName: + type: string + shareProcessNamespace: + type: boolean + subdomain: + type: string + terminationGracePeriodSeconds: + format: int64 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + volumeID: + type: string + required: + - volumeID + type: object + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + type: string + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + targetPortal: + type: string + required: + - targetPortal + - iqn + - lun + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - server + - path + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + required: + - sources + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + user: + type: string + required: + - monitors + - image + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - system + - secretRef + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge,retainKeys + required: + - containers + type: object + type: object + type: array + graph: + properties: + children: + items: + properties: + children: + items: + properties: + children: + type: array + endpoint: + properties: + service_host: + type: string + service_port: + type: integer + type: + enum: + - REST + - GRPC + type: string + implementation: + enum: + - UNKNOWN_IMPLEMENTATION + - SIMPLE_MODEL + - SIMPLE_ROUTER + - RANDOM_ABTEST + - AVERAGE_COMBINER + type: string + methods: + items: + enum: + - TRANSFORM_INPUT + - TRANSFORM_OUTPUT + - ROUTE + - AGGREGATE + - SEND_FEEDBACK + type: string + type: array + name: + type: string + type: + enum: + - UNKNOWN_TYPE + - ROUTER + - COMBINER + - MODEL + - TRANSFORMER + - OUTPUT_TRANSFORMER + type: string + type: array + endpoint: + properties: + service_host: + type: string + service_port: + type: integer + type: + enum: + - REST + - GRPC + type: string + implementation: + enum: + - UNKNOWN_IMPLEMENTATION + - SIMPLE_MODEL + - SIMPLE_ROUTER + - RANDOM_ABTEST + - AVERAGE_COMBINER + type: string + methods: + items: + enum: + - TRANSFORM_INPUT + - TRANSFORM_OUTPUT + - ROUTE + - AGGREGATE + - SEND_FEEDBACK + type: string + type: array + name: + type: string + type: + enum: + - UNKNOWN_TYPE + - ROUTER + - COMBINER + - MODEL + - TRANSFORMER + - OUTPUT_TRANSFORMER + type: string + type: array + endpoint: + properties: + service_host: + type: string + service_port: + type: integer + type: + enum: + - REST + - GRPC + type: string + implementation: + enum: + - UNKNOWN_IMPLEMENTATION + - SIMPLE_MODEL + - SIMPLE_ROUTER + - RANDOM_ABTEST + - AVERAGE_COMBINER + type: string + methods: + items: + enum: + - TRANSFORM_INPUT + - TRANSFORM_OUTPUT + - ROUTE + - AGGREGATE + - SEND_FEEDBACK + type: string + type: array + name: + type: string + type: + enum: + - UNKNOWN_TYPE + - ROUTER + - COMBINER + - MODEL + - TRANSFORMER + - OUTPUT_TRANSFORMER + type: string + labels: + type: object + name: + type: string + replicas: + type: integer + svcOrchSpec: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + resourceFieldRef: + properties: + containerName: + type: string + divisor: + type: string + resource: + type: string + required: + - resource + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + required: + - name + type: array + x-kubernetes-patch-merge-key: name + x-kubernetes-patch-strategy: merge + resources: + properties: + limits: + additionalProperties: true + type: object + requests: + additionalProperties: true + type: object + type: object + type: array + version: v1alpha2 + versions: + - name: v1alpha2 + served: true + storage: true diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/kustomization.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/kustomization.yaml new file mode 100644 index 0000000..4099443 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/kustomization.yaml @@ -0,0 +1,8 @@ +resources: +- clusterrole.yaml +- crd.yaml +- rolebinding.yaml +- secret.yaml +- service-account.yaml +- service.yaml +- statefulset.yaml diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/rolebinding.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/rolebinding.yaml new file mode 100644 index 0000000..25256e0 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/rolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: seldon-operator-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: seldon-operator-manager-role +subjects: +- kind: ServiceAccount + name: seldon-manager + namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/secret.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/secret.yaml new file mode 100644 index 0000000..abb3624 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/secret.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Secret +metadata: + name: seldon-operator-webhook-server-secret diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/service-account.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/service-account.yaml new file mode 100644 index 0000000..c5fdcf6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: seldon-manager diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/service.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/service.yaml new file mode 100644 index 0000000..518428d --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + control-plane: seldon-controller-manager + controller-tools.k8s.io: "1.0" + name: seldon-operator-controller-manager-service +spec: + ports: + - port: 443 + selector: + control-plane: seldon-controller-manager + controller-tools.k8s.io: "1.0" diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/base/statefulset.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/base/statefulset.yaml new file mode 100644 index 0000000..5e30c4b --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/base/statefulset.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + control-plane: seldon-controller-manager + controller-tools.k8s.io: "1.0" + name: seldon-operator-controller-manager +spec: + selector: + matchLabels: + app.kubernetes.io/instance: seldon-core-operator + app.kubernetes.io/name: seldon-core-operator + control-plane: seldon-controller-manager + controller-tools.k8s.io: "1.0" + serviceName: seldon-operator-controller-manager-service + template: + metadata: + annotations: + prometheus.io/scrape: "true" + labels: + app.kubernetes.io/instance: seldon-core-operator + app.kubernetes.io/name: seldon-core-operator + control-plane: seldon-controller-manager + controller-tools.k8s.io: "1.0" + spec: + containers: + - command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SECRET_NAME + value: seldon-operator-webhook-server-secret + - name: AMBASSADOR_ENABLED + value: "true" + - name: AMBASSADOR_SINGLE_NAMESPACE + value: "false" + - name: ENGINE_CONTAINER_IMAGE_AND_VERSION + value: docker.io/seldonio/engine:0.3.0 + - name: ENGINE_CONTAINER_IMAGE_PULL_POLICY + value: IfNotPresent + - name: ENGINE_CONTAINER_SERVICE_ACCOUNT_NAME + value: default + - name: ENGINE_CONTAINER_USER + value: "8888" + - name: PREDICTIVE_UNIT_SERVICE_PORT + value: "9000" + - name: ENGINE_SERVER_GRPC_PORT + value: "5001" + - name: ENGINE_SERVER_PORT + value: "8000" + - name: ENGINE_PROMETHEUS_PATH + value: prometheus + - name: ISTIO_ENABLED + value: "true" + - name: ISTIO_GATEWAY + value: kubeflow-gateway + image: docker.io/seldonio/seldon-core-operator:0.3.1 + imagePullPolicy: Always + name: manager + ports: + - containerPort: 8080 + name: metrics + protocol: TCP + - containerPort: 9876 + name: webhook-server + protocol: TCP + resources: + requests: + cpu: 100m + memory: 20Mi + volumeMounts: + - mountPath: /tmp/cert + name: cert + readOnly: true + serviceAccountName: seldon-manager + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: seldon-operator-webhook-server-secret + volumeClaimTemplates: [] diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/kustomization.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/kustomization.yaml new file mode 100644 index 0000000..cf3e708 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +commonLabels: + app.kubernetes.io/component: seldon + app.kubernetes.io/instance: seldon-core-operator + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/name: seldon-core-operator + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 +kind: Kustomization +namespace: kubeflow +resources: +- overlays/application/application.yaml diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/application.yaml new file mode 100644 index 0000000..3812cfb --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/application.yaml @@ -0,0 +1,32 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: "seldon-core-operator" +spec: + type: "seldon-core-operator" + componentKinds: + - group: apps/v1 + kind: StatefulSet + - group: v1 + kind: Service + - group: extensions/v1beta1 + kind: Deployment + - group: v1 + kind: Secret + - group: v1 + kind: ConfigMap + version: "v1alpha2" + description: "Seldon allows users to create ML Inference Graphs to deploy their models and serve predictions" + icons: + maintainers: + - name: Seldon + email: dev@seldon.io + owners: + - name: Seldon + email: dev@seldon.io + keywords: + - "seldon" + - "inference" + links: + - description: Docs + url: "https://docs.seldon.io/projects/seldon-core/en/v0.3.0/" diff --git a/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/kustomization.yaml new file mode 100644 index 0000000..36e6f41 --- /dev/null +++ b/kubeflow/kfapp/kustomize/seldon-core-operator/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: seldon-core-operator + app.kubernetes.io/instance: seldon-core-operator + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: seldon + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/spartakus/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/spartakus/base/cluster-role-binding.yaml new file mode 100644 index 0000000..e8e7ac1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/cluster-role-binding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: spartakus + name: spartakus +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: spartakus +subjects: +- kind: ServiceAccount + name: spartakus diff --git a/kubeflow/kfapp/kustomize/spartakus/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/spartakus/base/cluster-role.yaml new file mode 100644 index 0000000..5fdcb06 --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/cluster-role.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: spartakus + name: spartakus +rules: +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list diff --git a/kubeflow/kfapp/kustomize/spartakus/base/deployment.yaml b/kubeflow/kfapp/kustomize/spartakus/base/deployment.yaml new file mode 100644 index 0000000..7227770 --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/deployment.yaml @@ -0,0 +1,21 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + labels: + app: spartakus + name: spartakus-volunteer +spec: + replicas: 1 + template: + metadata: + labels: + app: spartakus-volunteer + spec: + containers: + - args: + - volunteer + - --cluster-id=$(usageId) + - --database=https://stats-collector.kubeflow.org + image: gcr.io/google_containers/spartakus-amd64:v1.1.0 + name: volunteer + serviceAccountName: spartakus diff --git a/kubeflow/kfapp/kustomize/spartakus/base/kustomization.yaml b/kubeflow/kfapp/kustomize/spartakus/base/kustomization.yaml new file mode 100644 index 0000000..e245e3d --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/kustomization.yaml @@ -0,0 +1,28 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- deployment.yaml +- service-account.yaml +commonLabels: + kustomize.component: spartakus +images: + - name: gcr.io/google_containers/spartakus-amd64 + newName: gcr.io/google_containers/spartakus-amd64 + newTag: v1.1.0 +configMapGenerator: +- name: spartakus-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: usageId + objref: + kind: ConfigMap + name: spartakus-parameters + apiVersion: v1 + fieldref: + fieldpath: data.usageId +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/spartakus/base/params.env b/kubeflow/kfapp/kustomize/spartakus/base/params.env new file mode 100644 index 0000000..dc3b748 --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/params.env @@ -0,0 +1 @@ +usageId= diff --git a/kubeflow/kfapp/kustomize/spartakus/base/params.yaml b/kubeflow/kfapp/kustomize/spartakus/base/params.yaml new file mode 100644 index 0000000..6ff80fe --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/template/spec/containers/0/args/1 + kind: Deployment diff --git a/kubeflow/kfapp/kustomize/spartakus/base/service-account.yaml b/kubeflow/kfapp/kustomize/spartakus/base/service-account.yaml new file mode 100644 index 0000000..9e3d193 --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/base/service-account.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: spartakus + name: spartakus diff --git a/kubeflow/kfapp/kustomize/spartakus/kustomization.yaml b/kubeflow/kfapp/kustomize/spartakus/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/spartakus/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/suggestion/base/kustomization.yaml b/kubeflow/kfapp/kustomize/suggestion/base/kustomization.yaml new file mode 100644 index 0000000..c80c09b --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/kustomization.yaml @@ -0,0 +1,25 @@ +namespace: kubeflow +resources: +- suggestion-bayesianoptimization-deployment.yaml +- suggestion-bayesianoptimization-service.yaml +- suggestion-grid-deployment.yaml +- suggestion-grid-service.yaml +- suggestion-hyperband-deployment.yaml +- suggestion-hyperband-service.yaml +- suggestion-nasrl-deployment.yaml +- suggestion-nasrl-service.yaml +- suggestion-random-deployment.yaml +- suggestion-random-service.yaml +generatorOptions: + disableNameSuffixHash: true +images: + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-hyperband + newTag: v0.6.0-rc.0 + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-bayesianoptimization + newTag: v0.6.0-rc.0 + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-grid + newTag: v0.6.0-rc.0 + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-random + newTag: v0.6.0-rc.0 + - name: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-nasrl + newTag: v0.6.0-rc.0 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-deployment.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-deployment.yaml new file mode 100644 index 0000000..c007b42 --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-suggestion-bayesianoptimization + labels: + app: katib + component: suggestion-bayesianoptimization +spec: + replicas: 1 + template: + metadata: + name: katib-suggestion-bayesianoptimization + labels: + app: katib + component: suggestion-bayesianoptimization + spec: + containers: + - name: katib-suggestion-bayesianoptimization + image: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-bayesianoptimization:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + ports: + - name: api + containerPort: 6789 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-service.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-service.yaml new file mode 100644 index 0000000..5cab301 --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-bayesianoptimization-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-suggestion-bayesianoptimization + labels: + app: katib + component: suggestion-bayesianoptimization +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: suggestion-bayesianoptimization diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-deployment.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-deployment.yaml new file mode 100644 index 0000000..160832c --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-suggestion-grid + labels: + app: katib + component: suggestion-grid +spec: + replicas: 1 + template: + metadata: + name: katib-suggestion-grid + labels: + app: katib + component: suggestion-grid + spec: + containers: + - name: katib-suggestion-grid + image: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-grid:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + ports: + - name: api + containerPort: 6789 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-service.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-service.yaml new file mode 100644 index 0000000..3043ded --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-grid-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-suggestion-grid + labels: + app: katib + component: suggestion-grid +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: suggestion-grid diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-deployment.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-deployment.yaml new file mode 100644 index 0000000..294efcb --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-suggestion-hyperband + labels: + app: katib + component: suggestion-hyperband +spec: + replicas: 1 + template: + metadata: + name: katib-suggestion-hyperband + labels: + app: katib + component: suggestion-hyperband + spec: + containers: + - name: katib-suggestion-hyperband + image: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-hyperband:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + ports: + - name: api + containerPort: 6789 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-service.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-service.yaml new file mode 100644 index 0000000..ec58658 --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-hyperband-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-suggestion-hyperband + labels: + app: katib + component: suggestion-hyperband +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: suggestion-hyperband diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-deployment.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-deployment.yaml new file mode 100644 index 0000000..0e1b8fa --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-deployment.yaml @@ -0,0 +1,22 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-suggestion-nasrl + labels: + app: katib + component: suggestion-nasrl +spec: + replicas: 1 + template: + metadata: + name: katib-suggestion-nasrl + labels: + app: katib + component: suggestion-nasrl + spec: + containers: + - name: katib-suggestion-nasrl + image: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-nasrl:v0.1.2-alpha-289-g14dad8b + ports: + - name: api + containerPort: 6789 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-service.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-service.yaml new file mode 100644 index 0000000..223c5cd --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-nasrl-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-suggestion-nasrl + labels: + app: katib + component: suggestion-nasrl +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: suggestion-nasrl diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-deployment.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-deployment.yaml new file mode 100644 index 0000000..b99bdc3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: katib-suggestion-random + labels: + app: katib + component: suggestion-random +spec: + replicas: 1 + template: + metadata: + name: katib-suggestion-random + labels: + app: katib + component: suggestion-random + spec: + containers: + - name: katib-suggestion-random + image: gcr.io/kubeflow-images-public/katib/v1alpha2/suggestion-random:v0.1.2-alpha-289-g14dad8b + imagePullPolicy: IfNotPresent + ports: + - name: api + containerPort: 6789 diff --git a/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-service.yaml b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-service.yaml new file mode 100644 index 0000000..29ee8cd --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/base/suggestion-random-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: katib-suggestion-random + labels: + app: katib + component: suggestion-random +spec: + type: ClusterIP + ports: + - port: 6789 + protocol: TCP + name: api + selector: + app: katib + component: suggestion-random diff --git a/kubeflow/kfapp/kustomize/suggestion/kustomization.yaml b/kubeflow/kfapp/kustomize/suggestion/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/suggestion/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow diff --git a/kubeflow/kfapp/kustomize/tensorboard/base/deployment.yaml b/kubeflow/kfapp/kustomize/tensorboard/base/deployment.yaml new file mode 100644 index 0000000..05b81e2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/base/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + labels: + app: tensorboard + name: tensorboard +spec: + replicas: 1 + template: + metadata: + labels: + app: tensorboard + spec: + containers: + - args: + - --logdir=logs + - --port=6006 + command: + - /usr/local/bin/tensorboard + image: tensorflow/tensorflow:1.8.0 + imagePullPolicy: IfNotPresent + name: tensorboard + ports: + - containerPort: 6006 + resources: + limits: + cpu: "4" + memory: 4Gi + requests: + cpu: "1" + memory: 1Gi diff --git a/kubeflow/kfapp/kustomize/tensorboard/base/kustomization.yaml b/kubeflow/kfapp/kustomize/tensorboard/base/kustomization.yaml new file mode 100644 index 0000000..7f6b41d --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/base/kustomization.yaml @@ -0,0 +1,28 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +resources: +- deployment.yaml +- service.yaml +commonLabels: + kustomize.component: tensorboard +configMapGenerator: +- name: parameters + env: params.env +vars: +- name: namespace + objref: + kind: Service + name: tensorboard + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: clusterDomain + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/tensorboard/base/params.env b/kubeflow/kfapp/kustomize/tensorboard/base/params.env new file mode 100644 index 0000000..4ba9119 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/base/params.env @@ -0,0 +1,27 @@ +# GCP +# @optionalParam logDir string logs Name of the log directory holding the TF events file +# @optionalParam targetPort number 6006 Name of the targetPort +# @optionalParam servicePort number 9000 Name of the servicePort +# @optionalParam serviceType string ClusterIP The service type for Jupyterhub. +# @optionalParam defaultTbImage string tensorflow/tensorflow:1.8.0 default tensorboard image to use +# @optionalParam gcpCredentialSecretName string null Name of the k8s secrets containing gcp credentials +# AWS +# @optionalParam logDir string logs Name of the log directory holding the TF events file +# @optionalParam targetPort number 6006 Name of the targetPort +# @optionalParam servicePort number 9000 Name of the servicePort +# @optionalParam serviceType string ClusterIP The service type for tensorboard service +# @optionalParam defaultTbImage string tensorflow/tensorflow:1.8.0 default tensorboard image to use +# @optionalParam s3Enabled string false Whether or not to use S3 +# @optionalParam s3SecretName string null Name of the k8s secrets containing S3 credentials +# @optionalParam s3SecretAccesskeyidKeyName string null Name of the key in the k8s secret containing AWS_ACCESS_KEY_ID +# @optionalParam s3SecretSecretaccesskeyKeyName string null Name of the key in the k8s secret containing AWS_SECRET_ACCESS_KEY +# @optionalParam s3AwsRegion string us-west-1 S3 region +# @optionalParam s3UseHttps string true Whether or not to use https +# @optionalParam s3VerifySsl string true Whether or not to verify https certificates for S3 connections +# @optionalParam s3Endpoint string s3.us-west-1.amazonaws.com URL for your s3-compatible endpoint +# @optionalParam efsEnabled string false Whether or not to use EFS +# @optionalParam efsPvcName string null Name of the Persistent Volume Claim used for EFS +# @optionalParam efsVolumeName string null Name of the Volume to mount to the pod +# @optionalParam efsMountPath string null Where to mount the EFS Volume +namespace=kubeflow +clusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/tensorboard/base/params.yaml b/kubeflow/kfapp/kustomize/tensorboard/base/params.yaml new file mode 100644 index 0000000..c8de9ba --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: metadata/annotations/getambassador.io\/config + kind: Service diff --git a/kubeflow/kfapp/kustomize/tensorboard/base/service.yaml b/kubeflow/kfapp/kustomize/tensorboard/base/service.yaml new file mode 100644 index 0000000..086dd27 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/base/service.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: tb-mapping-tensorboard-get + prefix: /tensorboard/ tensorboard/ + rewrite: / + method: GET + service: tensorboard.$(namespace):9000 + labels: + app: tensorboard + name: tensorboard +spec: + ports: + - name: tb + port: 9000 + targetPort: 6006 + selector: + app: tensorboard + type: ClusterIP diff --git a/kubeflow/kfapp/kustomize/tensorboard/kustomization.yaml b/kubeflow/kfapp/kustomize/tensorboard/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..b0068b6 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tensorboard/overlays/istio/virtual-service.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: tensorboard +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /tensorboard/tensorboard/ + rewrite: + uri: / + route: + - destination: + host: tensorboard.$(namespace).svc.$(clusterDomain) + port: + number: 9000 diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role-binding.yaml new file mode 100644 index 0000000..14235c9 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role-binding.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: tf-job-dashboard + name: tf-job-dashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tf-job-dashboard +subjects: +- kind: ServiceAccount + name: tf-job-dashboard +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: tf-job-operator + name: tf-job-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tf-job-operator +subjects: +- kind: ServiceAccount + name: tf-job-operator diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role.yaml new file mode 100644 index 0000000..8694d0f --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/cluster-role.yaml @@ -0,0 +1,106 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: tf-job-dashboard + name: tf-job-dashboard +rules: +- apiGroups: + - tensorflow.org + - kubeflow.org + resources: + - tfjobs + - tfjobs/status + verbs: + - '*' +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - '*' +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - '*' +- apiGroups: + - batch + resources: + - jobs + verbs: + - '*' +- apiGroups: + - "" + resources: + - configmaps + - pods + - services + - endpoints + - persistentvolumeclaims + - events + - pods/log + - namespaces + verbs: + - '*' +- apiGroups: + - apps + - extensions + resources: + - deployments + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: tf-job-operator + name: tf-job-operator +rules: +- apiGroups: + - tensorflow.org + - kubeflow.org + resources: + - tfjobs + - tfjobs/status + verbs: + - '*' +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - '*' +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - '*' +- apiGroups: + - batch + resources: + - jobs + verbs: + - '*' +- apiGroups: + - "" + resources: + - configmaps + - pods + - services + - endpoints + - persistentvolumeclaims + - events + verbs: + - '*' +- apiGroups: + - apps + - extensions + resources: + - deployments + verbs: + - '*' diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/config-map.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/config-map.yaml new file mode 100644 index 0000000..90d01b3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/config-map.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + controller_config_file.yaml: |- + { + "grpcServerFilePath": "/opt/mlkube/grpc_tensorflow_server/grpc_tensorflow_server.py" + } +kind: ConfigMap +metadata: + name: tf-job-operator-config diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/crd.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/crd.yaml new file mode 100644 index 0000000..d707b58 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/crd.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: tfjobs.kubeflow.org +spec: + additionalPrinterColumns: + - JSONPath: .status.conditions[-1:].type + name: State + type: string + - JSONPath: .metadata.creationTimestamp + name: Age + type: date + group: kubeflow.org + names: + kind: TFJob + plural: tfjobs + singular: tfjob + scope: Namespaced + subresources: + status: {} + validation: + openAPIV3Schema: + properties: + spec: + properties: + tfReplicaSpecs: + properties: + Chief: + properties: + replicas: + maximum: 1 + minimum: 1 + type: integer + PS: + properties: + replicas: + minimum: 1 + type: integer + Worker: + properties: + replicas: + minimum: 1 + type: integer + version: v1 + versions: + - name: v1 + served: true + storage: true + - name: v1beta2 + served: true + storage: false diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/deployment.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/deployment.yaml new file mode 100644 index 0000000..b72a0be --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/deployment.yaml @@ -0,0 +1,60 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: tf-job-dashboard +spec: + template: + metadata: + labels: + name: tf-job-dashboard + spec: + containers: + - command: + - /opt/tensorflow_k8s/dashboard/backend + env: + - name: KUBEFLOW_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: gcr.io/kubeflow-images-public/tf_operator:v0.6.0.rc0 + name: tf-job-dashboard + ports: + - containerPort: 8080 + serviceAccountName: tf-job-dashboard +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: tf-job-operator +spec: + replicas: 1 + template: + metadata: + labels: + name: tf-job-operator + spec: + containers: + - command: + - /opt/kubeflow/tf-operator.v1 + - --alsologtostderr + - -v=1 + - --monitoring-port=8443 + env: + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: gcr.io/kubeflow-images-public/tf_operator:v0.6.0.rc0 + name: tf-job-operator + volumeMounts: + - mountPath: /etc/config + name: config-volume + serviceAccountName: tf-job-operator + volumes: + - configMap: + name: tf-job-operator-config + name: config-volume diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/kustomization.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/kustomization.yaml new file mode 100644 index 0000000..e9a5f17 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/kustomization.yaml @@ -0,0 +1,33 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kubeflow +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- config-map.yaml +- crd.yaml +- deployment.yaml +- service-account.yaml +- service.yaml +commonLabels: + kustomize.component: tf-job-operator +configMapGenerator: +- name: parameters + env: params.env +vars: +- name: namespace + objref: + kind: Service + name: tf-job-dashboard + apiVersion: v1 + fieldref: + fieldpath: metadata.namespace +- name: clusterDomain + objref: + kind: ConfigMap + name: parameters + apiVersion: v1 + fieldref: + fieldpath: data.clusterDomain +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/params.env b/kubeflow/kfapp/kustomize/tf-job-operator/base/params.env new file mode 100644 index 0000000..ce3d230 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/params.env @@ -0,0 +1,2 @@ +namespace=kubeflow +clusterDomain=cluster.local diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/params.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/params.yaml new file mode 100644 index 0000000..c8de9ba --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: metadata/annotations/getambassador.io\/config + kind: Service diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/service-account.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/service-account.yaml new file mode 100644 index 0000000..c7be4e3 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/service-account.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: tf-job-dashboard + name: tf-job-dashboard +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: tf-job-operator + name: tf-job-operator diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/base/service.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/base/service.yaml new file mode 100644 index 0000000..140fe0d --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/base/service.yaml @@ -0,0 +1,39 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + getambassador.io/config: |- + --- + apiVersion: ambassador/v0 + kind: Mapping + name: tfjobs-ui-mapping + prefix: /tfjobs/ + rewrite: /tfjobs/ + service: tf-job-dashboard.$(namespace) + name: tf-job-dashboard +spec: + ports: + - port: 80 + targetPort: 8080 + selector: + name: tf-job-dashboard + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + prometheus.io/path: /metrics + prometheus.io/scrape: "true" + prometheus.io/port: "8443" + labels: + app: tf-job-operator + name: tf-job-operator +spec: + ports: + - name: monitoring-port + port: 8443 + targetPort: 8443 + selector: + name: tf-job-operator + type: ClusterIP diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/kustomization.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/kustomization.yaml new file mode 100644 index 0000000..b3ca804 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +configurations: +- overlays/istio/params.yaml +kind: Kustomization +namespace: kubeflow +resources: +- overlays/istio/virtual-service.yaml diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/application.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/application.yaml new file mode 100644 index 0000000..5a6e9f8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/application.yaml @@ -0,0 +1,44 @@ +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: "application" +spec: + selector: + matchLabels: + app.kubernetes.io/name: tf-job-operator + app.kubernetes.io/instance: tf-job-operator + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: tfjob + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 + componentKinds: + - group: core + kind: Service + - group: apps + kind: Deployment + - group: core + kind: ConfigMap + - group: core + kind: ServiceAccount + - group: kubeflow.org + kind: TFJob + descriptor: + type: "tf-job-operator" + version: "v1" + description: "Tf-operator allows users to create and manage the \"TFJob\" custom resource." + maintainers: + - name: Richard Liu + email: ricliu@google.com + owners: + - name: Richard Liu + email: ricliu@google.com + keywords: + - "tfjob" + - "tf-operator" + - "tf-training" + links: + - description: About + url: "https://github.com/kubeflow/tf-operator" + - description: Docs + url: "https://www.kubeflow.org/docs/reference/tfjob/v1/tensorflow/" + addOwnerRef: true diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/kustomization.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/kustomization.yaml new file mode 100644 index 0000000..d5b504f --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/application/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- application.yaml +commonLabels: + app.kubernetes.io/name: tf-job-operator + app.kubernetes.io/instance: tf-job-operator + app.kubernetes.io/managed-by: kfctl + app.kubernetes.io/component: tfjob + app.kubernetes.io/part-of: kubeflow + app.kubernetes.io/version: v0.6 diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/kustomization.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/kustomization.yaml new file mode 100644 index 0000000..fcd00db --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../base +resources: +- virtual-service.yaml +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/params.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/params.yaml new file mode 100644 index 0000000..eea869e --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/params.yaml @@ -0,0 +1,3 @@ +varReference: +- path: spec/http/route/destination/host + kind: VirtualService diff --git a/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/virtual-service.yaml b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/virtual-service.yaml new file mode 100644 index 0000000..51e42e1 --- /dev/null +++ b/kubeflow/kfapp/kustomize/tf-job-operator/overlays/istio/virtual-service.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: tf-job-dashboard +spec: + gateways: + - kubeflow-gateway + hosts: + - '*' + http: + - match: + - uri: + prefix: /tfjobs/ + rewrite: + uri: /tfjobs/ + route: + - destination: + host: tf-job-dashboard.$(namespace).svc.$(clusterDomain) + port: + number: 80 diff --git a/kubeflow/kfapp/kustomize/webhook/base/cluster-role-binding.yaml b/kubeflow/kfapp/kustomize/webhook/base/cluster-role-binding.yaml new file mode 100644 index 0000000..f7fe51d --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/cluster-role-binding.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-role +subjects: +- kind: ServiceAccount + name: service-account diff --git a/kubeflow/kfapp/kustomize/webhook/base/cluster-role.yaml b/kubeflow/kfapp/kustomize/webhook/base/cluster-role.yaml new file mode 100644 index 0000000..1a4faa2 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/cluster-role.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-role +rules: +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - watch + - list + - update + - create + - patch + - delete diff --git a/kubeflow/kfapp/kustomize/webhook/base/crd.yaml b/kubeflow/kfapp/kustomize/webhook/base/crd.yaml new file mode 100644 index 0000000..df2b459 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/crd.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: poddefaults.kubeflow.org +spec: + group: kubeflow.org + names: + kind: PodDefault + plural: poddefaults + singular: poddefault + scope: Namespaced + version: v1alpha1 + validation: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + desc: + type: string + serviceAccountName: + type: string + env: + items: + type: object + type: array + envFrom: + items: + type: object + type: array + selector: + type: object + volumeMounts: + items: + type: object + type: array + volumes: + items: + type: object + type: array + required: + - selector + type: object + status: + type: object + type: object diff --git a/kubeflow/kfapp/kustomize/webhook/base/deployment.yaml b/kubeflow/kfapp/kustomize/webhook/base/deployment.yaml new file mode 100644 index 0000000..b4687c8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/deployment.yaml @@ -0,0 +1,19 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: deployment +spec: + template: + spec: + containers: + - image: gcr.io/kubeflow-images-public/admission-webhook:v20190520-v0-139-gcee39dbc-dirty-0d8f4c + name: admission-webhook + volumeMounts: + - mountPath: /etc/webhook/certs + name: webhook-cert + readOnly: true + volumes: + - name: webhook-cert + secret: + secretName: webhook-certs + serviceAccountName: service-account diff --git a/kubeflow/kfapp/kustomize/webhook/base/kustomization.yaml b/kubeflow/kfapp/kustomize/webhook/base/kustomization.yaml new file mode 100644 index 0000000..286fdd4 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/kustomization.yaml @@ -0,0 +1,48 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cluster-role-binding.yaml +- cluster-role.yaml +- deployment.yaml +- mutating-webhook-configuration.yaml +- service-account.yaml +- service.yaml +- crd.yaml +commonLabels: + kustomize.component: admission-webhook + app: admission-webhook +namePrefix: admission-webhook- +images: + - name: gcr.io/kubeflow-images-public/admission-webhook + newName: gcr.io/kubeflow-images-public/admission-webhook + newTag: v20190520-v0-139-gcee39dbc-dirty-0d8f4c +namespace: kubeflow +configMapGenerator: +- name: admission-webhook-parameters + env: params.env +generatorOptions: + disableNameSuffixHash: true +vars: +- name: namespace + objref: + kind: ConfigMap + name: admission-webhook-parameters + apiVersion: v1 + fieldref: + fieldpath: data.namespace +- name: serviceName + objref: + kind: Service + name: service + apiVersion: v1 + fieldref: + fieldpath: metadata.name +- name: deploymentName + objref: + kind: Deployment + name: deployment + apiVersion: extensions/v1beta1 + fieldref: + fieldpath: metadata.name +configurations: +- params.yaml diff --git a/kubeflow/kfapp/kustomize/webhook/base/mutating-webhook-configuration.yaml b/kubeflow/kfapp/kustomize/webhook/base/mutating-webhook-configuration.yaml new file mode 100644 index 0000000..0893ab8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/mutating-webhook-configuration.yaml @@ -0,0 +1,21 @@ +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: MutatingWebhookConfiguration +metadata: + name: mutating-webhook-configuration +webhooks: +- clientConfig: + caBundle: "" + service: + name: $(serviceName) + namespace: $(namespace) + path: /apply-poddefault + name: $(deploymentName).kubeflow.org + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods diff --git a/kubeflow/kfapp/kustomize/webhook/base/params.env b/kubeflow/kfapp/kustomize/webhook/base/params.env new file mode 100644 index 0000000..7816643 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/params.env @@ -0,0 +1 @@ +namespace=kubeflow diff --git a/kubeflow/kfapp/kustomize/webhook/base/params.yaml b/kubeflow/kfapp/kustomize/webhook/base/params.yaml new file mode 100644 index 0000000..444edea --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/params.yaml @@ -0,0 +1,7 @@ +varReference: +- path: webhooks/clientConfig/service/namespace + kind: MutatingWebhookConfiguration +- path: webhooks/clientConfig/service/name + kind: MutatingWebhookConfiguration +- path: webhooks/name + kind: MutatingWebhookConfiguration diff --git a/kubeflow/kfapp/kustomize/webhook/base/service-account.yaml b/kubeflow/kfapp/kustomize/webhook/base/service-account.yaml new file mode 100644 index 0000000..a36cbd8 --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/service-account.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: service-account diff --git a/kubeflow/kfapp/kustomize/webhook/base/service.yaml b/kubeflow/kfapp/kustomize/webhook/base/service.yaml new file mode 100644 index 0000000..b772a6a --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/base/service.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Service +metadata: + name: service +spec: + ports: + - port: 443 + targetPort: 443 diff --git a/kubeflow/kfapp/kustomize/webhook/kustomization.yaml b/kubeflow/kfapp/kustomize/webhook/kustomization.yaml new file mode 100644 index 0000000..4e745bd --- /dev/null +++ b/kubeflow/kfapp/kustomize/webhook/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +bases: +- base +kind: Kustomization +namespace: kubeflow