ers) .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled }} {{- end }} {{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}} {{ define "default-sd-metrics" }} {{- and (not .Values.meshConfig.defaultProviders) .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled }} {{- end }} {{/* SD has metrics and logging split. */}} {{ define "default-sd-logs" }} {{- and (not .Values.meshCon...

apiVersion: v1
kind: Service
metadata:
  namespace: {{.Release.Namespace}}
  labels:
    name: istio-operator
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
spec:
  ports:
  - name: http-metrics
    port: 8383
    targetPort: 8383
    protocol: TCP
  selector:
    name: istio-operator

    resources: ["nodes"]
    verbs: ["patch"]
{{- end }}

  # ingress controller
{{- if .Values.global.istiod.enableAnalysis }}
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]
{{- end}}
  - apiGroups: ["networking.k8s.io"]

  type: ExternalName
  externalName: {{ .Values.global.remotePilotAddress }}
  {{- end }}
{{- if .Values.global.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
{{- end }}
{{- if .Values.global.ipFamilies }}
  ipFamilies:
{{- range .Values.global.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---

      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}

  kind: ClusterRole
  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Values.global.istioNamespace }}
{{- end }}

metadata:
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
subjects:
- kind: ServiceAccount
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{.Release.Namespace}}
roleRef:
  kind: ClusterRole
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: {{ $gateway.name }}-service-account
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}

# Should be used for remote secret creation.
apiVersion: v1
kind: ServiceAccount
  {{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
    {{- end }}
    {{- end }}
metadata:
  name: istio-reader-service-account
  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istio-reader

  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
data:
  extra.pem: {{ .Values.pilot.jwksResolverExtraRootCA | quote }}