net-istio.yaml

# Generated when HEAD was b82e4d043aca33ea7224c5522080dba81951ba26
#
# Copyright 2019 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # These are the permissions needed by the Istio Ingress implementation.
  name: knative-serving-istio
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    serving.knative.dev/controller: "true"
    networking.knative.dev/ingress-provider: istio
rules:
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices", "gateways", "destinationrules"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

---
# Copyright 2019 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This is the shared Gateway for all Knative routes to use.
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: knative-ingress-gateway
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"

---
# Copyright 2019 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# A cluster local gateway to allow pods outside of the mesh to access
# Services and Routes not exposing through an ingress.  If the users
# do have a service mesh setup, this isn't required.
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: knative-local-gateway
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 8081
        name: http
        protocol: HTTP
      hosts:
        - "*"
---
apiVersion: v1
kind: Service
metadata:
  name: knative-local-gateway
  namespace: istio-system
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
    experimental.istio.io/disable-gateway-port-translation: "true"
spec:
  type: ClusterIP
  selector:
    istio: ingressgateway
  ports:
    - name: http2
      port: 80
      targetPort: 8081
    - name: https
      port: 443
      targetPort: 8444

---
# Copyright 2018 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-istio
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
data:
  # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.


    # external-gateways defines a gateway and Istio service to serve external traffic.
    # It is the new and preferred way to define the configuration.
    # The format is as follow:
    # ```
    # external-gateways: |
    #   - name: {{gateway_name}}
    #     namespace: {{gateway_namespace}}
    #     service: {{ingress_name}}.{{ingress_namespace}}.svc.cluster.local
    #     labelSelector:
    #       matchExpressions:
    #       - key: {{label_key}}
    #         operator: {{operator}}
    #         values: [{{label_value}}]
    #       matchLabels:
    #         {{label_key}}: {{label_value}}
    # ```
    # name, namespace & service are mandatory and can't be empty. labelSelector is optional.
    # If labelSelector is specified, the external gateway will be used by the knative service with matching labels.
    # See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more details about labelSelector.
    # Only one external gateway can be specified without a selector. It will act as the default external gateway.
    external-gateways: |
      - name: knative-ingress-gateway
        namespace: knative-serving
        service: istio-ingressgateway.istio-system.svc.cluster.local
    #
    #
    # The old format has the following pattern:
    # ```
    # gateway.{{gateway_namespace}}.{{gateway_name}}: "{{ingress_name}}.{{ingress_namespace}}.svc.cluster.local"
    # ```
    # Please use the new configuration format `external-gateways` for future compatibility.
    # This configuration will raise an error if either `external-gateways` or `local-gateways` is defined.
    gateway.knative-serving.knative-ingress-gateway: "istio-ingressgateway.istio-system.svc.cluster.local"


    # local-gateways defines a cluster local gateway to allow pods outside of the mesh to access
    # Services and Routes not exposing through an ingress. If the users
    # do have a service mesh setup, this isn't required and can be removed.
    #
    # An example use case is when users want to use Istio without any
    # sidecar injection (like Knative's istio-ci-no-mesh.yaml). Since every pod
    # is outside of the service mesh in that case, a cluster-local service
    # will need to be exposed to a cluster-local gateway to be accessible.
    #
    # It is the new and preferred way to define the configuration.
    # The format is as follow:
    # ```
    # local-gateways: |
    #   - name: {{local_gateway_name}}
    #     namespace: {{local_gateway_namespace}}
    #     service: {{cluster_local_gateway_name}}.{{cluster_local_gateway_namespace}}.svc.cluster.local
    #     labelSelector:
    #       matchExpressions:
    #       - key: {{label_key}}
    #         operator: {{operator}}
    #         values: [{{label_value}}]
    #       matchLabels:
    #         {{label_key}}: {{label_value}}
    # ```
    # name, namespace & service are mandatory and can't be empty. labelSelector is optional.
    # If labelSelector is specified, the local gateway will be used by the knative service with matching labels.
    # See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more details about labelSelector.
    # Only one local gateway can be specified without a selector. It will act as the default local gateway.
    local-gateways: |
      - name: knative-local-gateway
        namespace: knative-serving
        service: knative-local-gateway.istio-system.svc.cluster.local
    #
    #
    # The old format has the following pattern:
    # ```
    # local-gateway.{{local_gateway_namespace}}.{{local_gateway_name}}:
    # "{{cluster_local_gateway_name}}.{{cluster_local_gateway_namespace}}.svc.cluster.local"
    # ```
    # Please use the new configuration format `local-gateways` for future compatibility.
    # This configuration will raise an error if either `external-gateways` or `local-gateways` is defined.
    local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"

---
# Allows the Webhooks to be reached by kube-api with or without
# sidecar injection and with mTLS PERMISSIVE and STRICT.
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "webhook"
  namespace: "knative-serving"
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: webhook
  portLevelMtls:
    "8443":
      mode: PERMISSIVE
---
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "net-istio-webhook"
  namespace: "knative-serving"
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: net-istio-webhook
  portLevelMtls:
    "8443":
      mode: PERMISSIVE

---
# Copyright 2019 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: net-istio-controller
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: net-istio-controller
  template:
    metadata:
      annotations:
        # This must be outside of the mesh to probe the gateways.
        # NOTE: this is allowed here and not elsewhere because
        # this is the Istio controller, and so it may be Istio-aware.
        sidecar.istio.io/inject: "false"
      labels:
        app: net-istio-controller
        app.kubernetes.io/component: net-istio
        app.kubernetes.io/name: knative-serving
        app.kubernetes.io/version: "20240426-b82e4d04"
    spec:
      serviceAccountName: controller
      containers:
        - name: controller
          # This is the Go import path for the binary that is containerized
          # and substituted here.
          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:7acd63fee39e2089064d6e9565441373bf1005da17fb10bf8d48a154be52ffa6
          resources:
            requests:
              cpu: 30m
              memory: 40Mi
            limits:
              cpu: 300m
              memory: 400Mi
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: config-observability
            - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID
              value: "false"
            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
            - name: METRICS_DOMAIN
              value: knative.dev/net-istio
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          readinessProbe:
            httpGet:
              path: /readiness
              port: probes
              scheme: HTTP
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: probes
              scheme: HTTP
            periodSeconds: 5
            failureThreshold: 6
          ports:
            - name: metrics
              containerPort: 9090
            - name: profiling
              containerPort: 8008
            - name: probes
              containerPort: 8080

# Unlike other controllers, this doesn't need a Service defined for metrics and
# profiling because it opts out of the mesh (see annotation above).

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: net-istio-webhook
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: net-istio-webhook
      role: net-istio-webhook
  template:
    metadata:
      labels:
        app: net-istio-webhook
        role: net-istio-webhook
        app.kubernetes.io/component: net-istio
        app.kubernetes.io/name: knative-serving
        app.kubernetes.io/version: "20240426-b82e4d04"
    spec:
      serviceAccountName: controller
      containers:
        - name: webhook
          # This is the Go import path for the binary that is containerized
          # and substituted here.
          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:68d29afd3bad0a35acc1e7aaf9adf67399f260d9f73c723e11699ee6a5711aae
          resources:
            requests:
              cpu: 20m
              memory: 20Mi
            limits:
              cpu: 200m
              memory: 200Mi
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: config-observability
            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
            - name: METRICS_DOMAIN
              value: knative.dev/net-istio
            - name: WEBHOOK_NAME
              value: net-istio-webhook
            # If you change WEBHOOK_PORT, you will also need to change the
            # containerPort "https-webhook" to the same value.
            - name: WEBHOOK_PORT
              value: "8443"
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          readinessProbe:
            periodSeconds: 1
            httpGet:
              scheme: HTTPS
              port: 8443
            failureThreshold: 3
          livenessProbe:
            periodSeconds: 1
            httpGet:
              scheme: HTTPS
              port: 8443
            failureThreshold: 6
            initialDelaySeconds: 20
          ports:
            - name: metrics
              containerPort: 9090
            - name: profiling
              containerPort: 8008
            - name: https-webhook
              containerPort: 8443

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Secret
metadata:
  name: net-istio-webhook-certs
  namespace: knative-serving
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Service
metadata:
  name: net-istio-webhook
  namespace: knative-serving
  labels:
    role: net-istio-webhook
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
spec:
  ports:
    # Define metrics and profiling for them to be accessible within service meshes.
    - name: http-metrics
      port: 9090
      targetPort: metrics
    - name: http-profiling
      port: 8008
      targetPort: profiling
    - name: https-webhook
      port: 443
      targetPort: https-webhook
  selector:
    app: net-istio-webhook

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: webhook.istio.networking.internal.knative.dev
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: net-istio-webhook
        namespace: knative-serving
    failurePolicy: Fail
    sideEffects: None
    objectSelector:
      matchExpressions:
        - {key: "serving.knative.dev/configuration", operator: Exists}
    name: webhook.istio.networking.internal.knative.dev

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: config.webhook.istio.networking.internal.knative.dev
  labels:
    app.kubernetes.io/component: net-istio
    app.kubernetes.io/name: knative-serving
    app.kubernetes.io/version: "20240426-b82e4d04"
    networking.knative.dev/ingress-provider: istio
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: net-istio-webhook
        namespace: knative-serving
    failurePolicy: Fail
    sideEffects: None
    name: config.webhook.istio.networking.internal.knative.dev
    objectSelector:
      matchLabels:
        app.kubernetes.io/name: knative-serving
        app.kubernetes.io/component: net-istio

---
# Copyright 2023 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: networking.internal.knative.dev/v1alpha1
kind: Certificate
metadata:
  annotations:
    networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev
  labels:
    networking.knative.dev/certificate-type: system-internal
    knative.dev/install-knative-certificate: "true"
  name: routing-serving-certs
  namespace: istio-system
spec:
  dnsNames:
    - kn-routing
  secretName: routing-serving-certs
# The data is populated when system-internal-tls is enabled.

---