Skip to content

istio-controlplane values.yamlπŸ“œ

profileπŸ“œ

Type: string

Default value
"default"

Description: The istio profile to use

hubπŸ“œ

Type: string

Default value
"registry1.dso.mil/ironbank/opensource/istio"

Description: The hub to use for all images, images are built as .Values.hub/<component>:.Values.tag

tagπŸ“œ

Type: string

Default value
"1.22.3"

Description: The tag to use for all images

enterpriseπŸ“œ

Type: bool

Default value
false

Description: Tetrate Istio Distribution - Tetrate provides FIPs verified Istio and Envoy software and support, validated through the FIPs Boring Crypto module. Find out more from Tetrate - https://www.tetrate.io/tetrate-istio-subscription

tidHubπŸ“œ

Type: string

Default value
"registry1.dso.mil/ironbank/tetrate/istio"

tidTagπŸ“œ

Type: string

Default value
"1.22.3-tetratefips-v0"

domainπŸ“œ

Type: string

Default value
"dev.bigbang.mil"

Description: The domain to use for the default gateway

mtls.modeπŸ“œ

Type: string

Default value
"STRICT"

Description: STRICT = Allow only mutual TLS traffic, PERMISSIVE = Allow both plain text and mutual TLS traffic

revisionπŸ“œ

Type: string

Default value
""

Description: Revision of the Istio control plane

openshiftπŸ“œ

Type: bool

Default value
false

Description: Openshift feature switch toggle

imagePullSecretsπŸ“œ

Type: list

Default value
[]

Description: Pull secrets for images

monitoringπŸ“œ

Type: object

Default value
enabled: false

Description: Big Bang Monitoring interaction controls

monitoring.enabledπŸ“œ

Type: bool

Default value
false

Description: Toggle monitoring on/off (controls networkPolicies)

kialiπŸ“œ

Type: object

Default value
enabled: false

Description: Big Bang Kiali interaction controls

kiali.enabledπŸ“œ

Type: bool

Default value
false

Description: Toggle kiali on/off (controls networkPolicies)

authserviceπŸ“œ

Type: object

Default value
enabled: false

Description: If authservice is enabled, it will be added to extension providers as an external authorization system. https://istio.io/latest/docs/tasks/security/authorization/authz-custom/

ingressGatewaysπŸ“œ

Type: object

Default value
istio-ingressgateway:
  enabled: true
  extraLabels: {}
  k8s:
    affinity: {}
    nodeSelector: {}
    podAnnotations: {}
    resources: {}
    service:
      type: LoadBalancer
    serviceAnnotations: {}
    tolerations: []

Description: Ingress gateways, The following items are automatically set for every ingress gateway: - label: β€œapp: {name of ingress gateway}”

ingressGateways.istio-ingressgatewayπŸ“œ

Type: object

Default value
enabled: true
extraLabels: {}
k8s:
  affinity: {}
  nodeSelector: {}
  podAnnotations: {}
  resources: {}
  service:
    type: LoadBalancer
  serviceAnnotations: {}
  tolerations: []

Description: This key becomes the name of the ingressGateway

ingressGateways.istio-ingressgateway.extraLabelsπŸ“œ

Type: object

Default value
{}

Description: Labels to use for selecting the ingress gateway from the service Automatic labels: β€˜app: {ingress gateway name}’ and istio: ingressgateway

ingressGateways.istio-ingressgateway.k8sπŸ“œ

Type: object

Default value
affinity: {}
nodeSelector: {}
podAnnotations: {}
resources: {}
service:
  type: LoadBalancer
serviceAnnotations: {}
tolerations: []

Description: Set any value from https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#KubernetesResourcesSpec

ingressGateways.istio-ingressgateway.k8s.service.typeπŸ“œ

Type: string

Default value
"LoadBalancer"

Description: β€œLoadBalancer” or β€œNodePort”

ingressGateways.istio-ingressgateway.k8s.podAnnotationsπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

ingressGateways.istio-ingressgateway.k8s.serviceAnnotationsπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

ingressGateways.istio-ingressgateway.k8s.nodeSelectorπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

ingressGateways.istio-ingressgateway.k8s.affinityπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity

ingressGateways.istio-ingressgateway.k8s.tolerationsπŸ“œ

Type: list

Default value
[]

Description: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

egressGatewaysπŸ“œ

Type: object

Default value
istio-egressgateway:
  enabled: false
  extraLabels: {}
  k8s:
    affinity: {}
    nodeSelector: {}
    podAnnotations: {}
    resources: {}
    service:
      type: LoadBalancer
    serviceAnnotations: {}
    tolerations: []

Description: Egress gateways, The following items are automatically set for every egress gateway: - label: β€œapp: {name of egress gateway}”

egressGateways.istio-egressgatewayπŸ“œ

Type: object

Default value
enabled: false
extraLabels: {}
k8s:
  affinity: {}
  nodeSelector: {}
  podAnnotations: {}
  resources: {}
  service:
    type: LoadBalancer
  serviceAnnotations: {}
  tolerations: []

Description: This key becomes the name of the egressGateway

egressGateways.istio-egressgateway.extraLabelsπŸ“œ

Type: object

Default value
{}

Description: Labels to use for selecting the egress gateway from the service Automatic labels: β€˜app: {egress gateway name}’ and istio: egressgateway

egressGateways.istio-egressgateway.k8sπŸ“œ

Type: object

Default value
affinity: {}
nodeSelector: {}
podAnnotations: {}
resources: {}
service:
  type: LoadBalancer
serviceAnnotations: {}
tolerations: []

Description: Set any value from https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#KubernetesResourcesSpec

egressGateways.istio-egressgateway.k8s.service.typeπŸ“œ

Type: string

Default value
"LoadBalancer"

Description: β€œLoadBalancer” or β€œNodePort”

egressGateways.istio-egressgateway.k8s.podAnnotationsπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

egressGateways.istio-egressgateway.k8s.serviceAnnotationsπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

egressGateways.istio-egressgateway.k8s.nodeSelectorπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

egressGateways.istio-egressgateway.k8s.affinityπŸ“œ

Type: object

Default value
{}

Description: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity

egressGateways.istio-egressgateway.k8s.tolerationsπŸ“œ

Type: list

Default value
[]

Description: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

gatewaysπŸ“œ

Type: object

Default value
main:
  autoHttpRedirect:
    enabled: true
  selector:
    app: istio-ingressgateway
  servers:
  - hosts:
    - '*.{{ .Values.domain }}'
    port:
      name: https
      number: 8443
      protocol: HTTPS
    tls:
      credentialName: wildcard-cert
      mode: SIMPLE

Description: See https://istio.io/latest/docs/reference/config/networking/gateway/#Gateway for spec

gateways.mainπŸ“œ

Type: object

Default value
autoHttpRedirect:
  enabled: true
selector:
  app: istio-ingressgateway
servers:
- hosts:
  - '*.{{ .Values.domain }}'
  port:
    name: https
    number: 8443
    protocol: HTTPS
  tls:
    credentialName: wildcard-cert
    mode: SIMPLE

Description: This key becomes the name of the gateway

gateways.main.autoHttpRedirectπŸ“œ

Type: object

Default value
enabled: true

Description: Controls default HTTP/8080 server entry with HTTP to HTTPS Redirect. Must add in HTTP server config if disabling.

istiodπŸ“œ

Type: object

Default value
affinity: {}
env: []
hpaSpec:
  maxReplicas: 3
  metrics:
  - resource:
      name: cpu
      target:
        averageUtilization: 60
        type: Utilization
    type: Resource
  minReplicas: 1
nodeSelector: {}
podAnnotations: {}
replicaCount: 1
resources:
  limits:
    cpu: 500m
    memory: 2Gi
  requests:
    cpu: 500m
    memory: 2Gi
serviceAnnotations: {}
strategy: {}
tolerations: []

Description: istiod / pilot configuration

istiod.podAnnotationsπŸ“œ

Type: object

Default value
{}

Description: k8s pod annotations. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

istiod.serviceAnnotationsπŸ“œ

Type: object

Default value
{}

Description: k8s service annotations. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

istiod.nodeSelectorπŸ“œ

Type: object

Default value
{}

Description: k8s nodeSelector. https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

istiod.affinityπŸ“œ

Type: object

Default value
{}

Description: k8s affinity / anti-affinity. https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity

istiod.tolerationsπŸ“œ

Type: list

Default value
[]

Description: k8s toleration https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

tracing.enabledπŸ“œ

Type: bool

Default value
false

tracing.addressπŸ“œ

Type: string

Default value
"jaeger-collector.jaeger.svc"

tracing.portπŸ“œ

Type: int

Default value
9411

tracing.samplingπŸ“œ

Type: int

Default value
10

Description: percent of traces to send to jaeger

cni.image.hubπŸ“œ

Type: string

Default value
"registry1.dso.mil/ironbank/opensource/istio"

cni.image.nameπŸ“œ

Type: string

Default value
"install-cni"

cni.image.tagπŸ“œ

Type: string

Default value
"1.22.3"

cni.podAnnotationsπŸ“œ

Type: object

Default value
{}

Description: k8s pod annotations. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

cni.nodeSelectorπŸ“œ

Type: object

Default value
{}

Description: k8s nodeSelector. https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

cni.affinityπŸ“œ

Type: object

Default value
{}

Description: k8s affinity / anti-affinity. https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity

cni.tolerationsπŸ“œ

Type: list

Default value
[]

Description: k8s toleration https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

meshConfigπŸ“œ

Type: object

Default value
meshMTLS:
  minProtocolVersion: TLSV1_2

Description: Global mesh-wide settings https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig

defaultConfigπŸ“œ

Type: object

Default value
{}

Description: Default Proxy Config for the entire mesh (inserts under meshConfig in IstioOperator resource)

values.globalπŸ“œ

Type: object

Default value
proxy:
  resources:
    limits:
      cpu: 100m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 256Mi
proxy_init:
  resources:
    limits:
      cpu: 100m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 256Mi

Description: Global IstioOperator values

values.defaultRevisionπŸ“œ

Type: string

Default value
"default"

Description: Set defaultRevision name, must be non-empty to deploy validating webhook

values.pilotπŸ“œ

Type: object

Default value
env:
  ENABLE_NATIVE_SIDECARS: true

Description: Istio pilot values. https://github.com/istio/istio/blob/master/manifests/charts/istio-control/istio-discovery/values.yaml

envoyFiltersπŸ“œ

Type: list

Default value
[]

Description: Custom EnvoyFilters. https://istio.io/latest/docs/reference/config/networking/envoy-filter/

networkPoliciesπŸ“œ

Type: object

Default value
additionalPolicies: []
controlPlaneCidr: 0.0.0.0/0
enabled: false

Description: Big Bang NetworkPolicy controls

networkPolicies.enabledπŸ“œ

Type: bool

Default value
false

Description: Toggle ALL NetworkPolicies on/off

networkPolicies.controlPlaneCidrπŸ“œ

Type: string

Default value
"0.0.0.0/0"

Description: See kubectl cluster-info and then resolve to IP

postInstallHook.imageπŸ“œ

Type: string

Default value
"registry1.dso.mil/ironbank/big-bang/base"

Description: Image used to run readiness check, requires kubectl

postInstallHook.tagπŸ“œ

Type: string

Default value
"2.1.0"

postInstallHook.securityContextπŸ“œ

Type: object

Default value
fsGroup: 1001
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001

Description: Pod security context for readiness check

postInstallHook.containerSecurityContextπŸ“œ

Type: object

Default value
capabilities:
  drop:
  - ALL

Description: Container security context for readiness check

postInstallHook.containerResources.resources.requests.cpuπŸ“œ

Type: string

Default value
"100m"

postInstallHook.containerResources.resources.requests.memoryπŸ“œ

Type: string

Default value
"256Mi"

postInstallHook.containerResources.resources.limits.cpuπŸ“œ

Type: string

Default value
"100m"

postInstallHook.containerResources.resources.limits.memoryπŸ“œ

Type: string

Default value
"256Mi"

hardened.enabledπŸ“œ

Type: bool

Default value
false

hardened.customAuthorizationPoliciesπŸ“œ

Type: list

Default value
[]

hardened.ingressGateway.authzRules[0]πŸ“œ

Type: object

Default value
{}