istio

package
v1.43.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 30, 2026 License: Apache-2.0 Imports: 34 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	IstioNamespace                    = common.CalicoNamespace
	IstioReleaseName                  = "calico-istio"
	IstioIstiodDeploymentName         = "istiod"
	IstioCNIDaemonSetName             = "istio-cni-node"
	IstioZTunnelDaemonSetName         = "ztunnel"
	IstioSidecarInjectorConfigMapName = "istio-sidecar-injector"
	IstioOperatorAnnotationMode       = "operator.tigera.io/istioAmbientMode"
	IstioOperatorAnnotationDSCP       = "operator.tigera.io/istioDSCPMark"
	IstioFinalizer                    = "operator.tigera.io/calico-istio"
	IstioIstiodPolicyName             = networkpolicy.CalicoComponentPolicyPrefix + IstioIstiodDeploymentName
	IstioCNIPolicyName                = networkpolicy.CalicoComponentPolicyPrefix + IstioCNIDaemonSetName
	IstioZTunnelPolicyName            = networkpolicy.CalicoComponentPolicyPrefix + IstioZTunnelDaemonSetName
	IstioIstiodServiceName            = "istiod"
)
View Source 
const (
	// L7WaypointDefaultsConfigMapName is the class-level defaults ConfigMap that
	// Istio's deployment controller applies to every Gateway using the
	// istio-waypoint GatewayClass.
	L7WaypointDefaultsConfigMapName = "tigera-waypoint-l7-defaults"

	// L7WaypointALSFilterName is the EnvoyFilter that enables gRPC ALS access
	// logging on the waypoint's main_internal listener.
	L7WaypointALSFilterName = "tigera-waypoint-l7-als"

	// L7WaypointSrcPortFilterName is the EnvoyFilter that captures the original
	// client IP from the Forwarded header on the connect_terminate listener and
	// propagates it as filter state to main_internal.
	L7WaypointSrcPortFilterName = "tigera-waypoint-l7-srcport"

	// L7WaypointEnvoyFilterRoleName is the Role/RoleBinding (in the Istio system
	// namespace) that grants the operator create/update/delete on the waypoint
	// EnvoyFilters. The operator's cluster-wide ClusterRole holds only
	// get/list/watch on envoyfilters (the controller-runtime cache lists and
	// watches them cluster-wide), so the namespace-scoped write verbs live here,
	// confining the operator's EnvoyFilter mutations to this one namespace.
	L7WaypointEnvoyFilterRoleName = "tigera-waypoint-l7-envoyfilters"

	// IstioWaypointGatewayClass is the standard Istio-provided GatewayClass for
	// waypoint proxies. Every Gateway using this class automatically receives
	// L7 logging via the class-level defaults ConfigMap.
	IstioWaypointGatewayClass = "istio-waypoint"
)

Variables

This section is empty.

Functions

func AddEnvoyFilterToScheme added in v1.43.0 

func AddEnvoyFilterToScheme(s *runtime.Scheme) error

AddEnvoyFilterToScheme registers the EnvoyFilter type with the given runtime.Scheme so the operator's client can create, update, and delete it. It is wired into pkg/apis' AddToSchemes alongside the other third-party types, so the manager scheme learns the type centrally; it returns error to satisfy runtime.SchemeBuilder.

func Istio 

func Istio(cfg *Configuration) (*IstioComponentCRDs, *IstioComponent, error)

func L7WaypointObjects added in v1.43.0 

func L7WaypointObjects(namespace, l7CollectorImage string) []client.Object

L7WaypointObjects returns the resources the operator manages to enable L7 logging on every Gateway using the istio-waypoint GatewayClass:

  • A defaults ConfigMap (gateway.istio.io/defaults-for-class=istio-waypoint) that Istio applies as a strategic merge patch to every waypoint Deployment, injecting the l7-collector sidecar and its shared volumes.
  • A Role + RoleBinding granting the operator create/update/delete on EnvoyFilters in this namespace (see renderEnvoyFilterWriterRole).
  • An EnvoyFilter enabling gRPC ALS on main_internal.
  • An EnvoyFilter capturing the Forwarded header on connect_terminate and propagating it as filter state to main_internal.

All are created in the Istio system namespace (the root namespace Istiod reads class-level defaults and mesh-wide EnvoyFilters from). The Role and RoleBinding are ordered before the EnvoyFilters so the write grant exists first; on a fresh install the controller re-reconciles to absorb any RBAC propagation lag.

func WaypointPullSecretObjects added in v1.43.0 

func WaypointPullSecretObjects(namespace string, pullSecrets []*corev1.Secret) []client.Object

WaypointPullSecretObjects returns the objects a namespace containing waypoint Gateways needs so its waypoint pods can pull images from a private registry:

  • A tigera-operator-secrets RoleBinding granting the operator permission to manage secrets in the namespace.
  • A copy of each Installation pull secret.

The RoleBinding is ordered first: it is the grant that lets the operator write the copies that follow it.

Every object carries MultipleOwnersLabel, which makes the component handler merge the owner reference it adds into the owners already on the object instead of replacing them. These land in user namespaces that other features write to as well — an egress gateway in the same namespace renders the same RoleBinding — and replacing its owner reference would have that feature's objects garbage collected when the CR owning them here is deleted. Stamping the label here keeps the invariant with the objects, so anything added to the set inherits it.

Which namespaces get these is a question about live cluster state and stays with the caller.

Types

type AmbientConfig 

type AmbientConfig struct {
	Enabled                    bool `json:"enabled,omitempty"`
	ReconcileIptablesOnStartup bool `json:"reconcileIptablesOnStartup,omitempty"`
}

type BaseOpts 

type BaseOpts struct {
	Global *GlobalConfig `json:"global,omitempty"`
}

type Configuration 

type Configuration struct {
	Installation   *operatorv1.InstallationSpec
	PullSecrets    []*corev1.Secret
	Istio          *operatorv1.Istio
	IstioNamespace string
	Scheme         *runtime.Scheme
}

type EnvoyFilter added in v1.43.0 

type EnvoyFilter struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              map[string]interface{} `json:"spec,omitempty"`
}

EnvoyFilter is a typed wrapper around Istio's networking.istio.io/v1alpha3 EnvoyFilter, used to avoid the full istio.io/client-go dependency while still letting the operator's component handler treat it as a metav1.ObjectMetaAccessor. Only the fields the operator needs to manage are represented; the Spec is an opaque map so we do not have to mirror the full EnvoyFilter schema.

func (*EnvoyFilter) DeepCopyInto added in v1.43.0 

func (e *EnvoyFilter) DeepCopyInto(out *EnvoyFilter)

DeepCopyInto copies the EnvoyFilter fields into the provided destination.

func (*EnvoyFilter) DeepCopyObject added in v1.43.0 

func (e *EnvoyFilter) DeepCopyObject() runtime.Object

DeepCopyObject implements runtime.Object.

type EnvoyFilterList added in v1.43.0 

type EnvoyFilterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EnvoyFilter `json:"items"`
}

EnvoyFilterList is the list form of EnvoyFilter. Controller-runtime's caching client requires the List kind to be registered alongside the item kind for watches and List calls to work.

func (*EnvoyFilterList) DeepCopyObject added in v1.43.0 

func (l *EnvoyFilterList) DeepCopyObject() runtime.Object

DeepCopyObject implements runtime.Object.

type GatewaysConfig added in v1.43.0 

type GatewaysConfig struct {
	SeccompProfile *corev1.SeccompProfile `json:"seccompProfile,omitempty"`
}

type GlobalConfig 

type GlobalConfig struct {
	IstioNamespace         string           `json:"istioNamespace,omitempty"`
	OperatorManageWebhooks bool             `json:"operatorManageWebhooks,omitempty"`
	Proxy                  *ProxyConfig     `json:"proxy,omitempty"`
	ProxyInit              *ProxyInitConfig `json:"proxy_init,omitempty"`
	Platform               string           `json:"platform,omitempty"`
	ImagePullSecrets       []string         `json:"imagePullSecrets,omitempty"`
}

type IstioCNIOpts 

type IstioCNIOpts struct {
	Image   string         `json:"image,omitempty"`
	Global  *GlobalConfig  `json:"global,omitempty"`
	Ambient *AmbientConfig `json:"ambient,omitempty"`
}

type IstioComponent 

type IstioComponent struct {
	IstioPilotImage      string
	IstioInstallCNIImage string
	IstioZTunnelImage    string
	IstioProxyv2Image    string
	L7CollectorImage     string
	// contains filtered or unexported fields
}

func (*IstioComponent) Objects 

func (c *IstioComponent) Objects() ([]client.Object, []client.Object)

Objects implements the Component interface.

func (*IstioComponent) Ready 

func (c *IstioComponent) Ready() bool

func (*IstioComponent) ResolveImages 

func (c *IstioComponent) ResolveImages(is *operatorv1.ImageSet) error

func (*IstioComponent) SupportedOSType 

func (c *IstioComponent) SupportedOSType() rmeta.OSType

type IstioComponentCRDs 

type IstioComponentCRDs struct {
	// contains filtered or unexported fields
}

func (*IstioComponentCRDs) Objects 

func (c *IstioComponentCRDs) Objects() ([]client.Object, []client.Object)

func (*IstioComponentCRDs) Ready 

func (c *IstioComponentCRDs) Ready() bool

func (*IstioComponentCRDs) ResolveImages 

func (c *IstioComponentCRDs) ResolveImages(is *operatorv1.ImageSet) error

func (*IstioComponentCRDs) SupportedOSType 

func (c *IstioComponentCRDs) SupportedOSType() rmeta.OSType

type IstioResources 

type IstioResources struct {
	CRDs    []client.Object
	Base    []client.Object
	Istiod  []client.Object
	CNI     []client.Object
	ZTunnel []client.Object

	IstiodDeployment              *appsv1.Deployment
	CNIDaemonSet                  *appsv1.DaemonSet
	ZTunnelDaemonSet              *appsv1.DaemonSet
	IstioSidecarInjectorConfigMap *corev1.ConfigMap
}

type IstiodOpts 

type IstiodOpts struct {
	Image                   string          `json:"image,omitempty"`
	Global                  *GlobalConfig   `json:"global,omitempty"`
	Gateways                *GatewaysConfig `json:"gateways,omitempty"`
	Profile                 string          `json:"profile,omitempty"`
	TrustedZtunnelNamespace string          `json:"trustedZtunnelNamespace,omitempty"`
}

type ProxyConfig 

type ProxyConfig struct {
	Image string `json:"image,omitempty"`
}

type ProxyInitConfig 

type ProxyInitConfig struct {
	Image string `json:"image,omitempty"`
}

type ResourceOpts 

type ResourceOpts struct {
	Namespace   string
	ReleaseName string

	IstiodDeploymentName      string
	IstioCNIDaemonSetName     string
	IstioZTunnelDaemonSetName string

	BaseOpts     BaseOpts
	IstiodOpts   IstiodOpts
	IstioCNIOpts IstioCNIOpts
	ZTunnelOpts  ZTunnelOpts
}

func (*ResourceOpts) GetResources 

func (r *ResourceOpts) GetResources(scheme *runtime.Scheme) (*IstioResources, error)

GetResources returns istio-chart generated templates

type ZTunnelOpts 

type ZTunnelOpts struct {
	Image  string        `json:"image,omitempty"`
	Global *GlobalConfig `json:"global,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.