insecure |
bool |
false |
Set to true to enable insecure communication between Gloo Mesh components |
devMode |
bool |
false |
Set to true to enable dev mode for the logger. |
verbose |
bool |
false |
If true, enables verbose/debug logging. |
leaderElection |
bool |
true |
If true, leader election will be enabled |
readOnlyGeneratedResources |
bool |
false |
If true, the component will only read in outputs that have been created by GP. Non-GP resources will no longer be visible in the GP Dashboard |
cluster |
string |
|
the cluster in which the agent will be deployed |
relay |
struct |
|
options for configuring relay on the agent |
relay.serverAddress |
string |
|
address of the relay server |
relay.authority |
string |
gloo-mesh-mgmt-server.gloo-mesh |
set the authority/host header to this value when dialing the Relay gRPC Server |
relay.clientTlsSecret |
struct |
|
Reference to a Secret containing the Client TLS Certificates used to identify the Relay Agent to the Server. If the secret does not exist, a Token and Root cert secret are required. |
relay.clientTlsSecret.name |
string |
relay-client-tls-secret |
|
relay.clientTlsSecret.namespace |
string |
|
|
relay.rootTlsSecret |
struct |
|
Reference to a Secret containing a Root TLS Certificates used to verify the Relay Server Certificate. The secret can also optionally specify a ‘tls.key’ which will be used to generate the Agent Client Certificate. |
relay.rootTlsSecret.name |
string |
relay-root-tls-secret |
|
relay.rootTlsSecret.namespace |
string |
|
|
relay.tokenSecret |
struct |
|
Reference to a Secret containing a shared Token for authenticating to the Relay Server |
relay.tokenSecret.name |
string |
relay-identity-token-secret |
Name of the Kubernetes Secret |
relay.tokenSecret.namespace |
string |
|
Namespace of the Kubernetes Secret |
relay.tokenSecret.key |
string |
token |
Key value of the data within the Kubernetes Secret |
relay.clientTlsSecretRotationGracePeriodRatio |
string |
|
The ratio of the client TLS Certificate lifetime to when Relay starts the certificate rotation process. |
maxGrpcMessageSize |
string |
4294967295 |
Specify to set a custom maximum message size for grpc messages sent and received by the Relay server |
metricsBufferSize |
int |
50 |
the number of metrics messages to buffer per envoy proxy |
accessLogsBufferSize |
int |
50 |
the number of access logs to buffer per envoy proxy |
istiodSidecar |
struct |
|
settings pertaining to the istiod sidecar deployment |
istiodSidecar.createRoleBinding |
bool |
false |
create cluster role binding needed by istiod sidecar |
istiodSidecar.istiodServiceAccount |
struct |
|
object reference to istiod service account |
istiodSidecar.istiodServiceAccount.name |
string |
istiod |
|
istiodSidecar.istiodServiceAccount.namespace |
string |
istio-system |
|
ext-auth-service |
struct |
|
customizations to the ext-auth-service helm chart |
ext-auth-service.enabled |
bool |
false |
if true, deploy the dependency service (default false) |
ext-auth-service.extraTemplateAnnotations |
map[string, string] |
{“proxy.istio.io/config”:"{ "holdApplicationUntilProxyStarts": true }"} |
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
ext-auth-service.extraTemplateAnnotations.<MAP_KEY> |
string |
|
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
ext-auth-service.extraTemplateAnnotations.proxy.istio.io/config |
string |
{ “holdApplicationUntilProxyStarts”: true } |
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
rate-limiter |
struct |
|
customizations to the rate-limiter helm chart |
rate-limiter.enabled |
bool |
false |
if true, deploy the dependency service (default false) |
rate-limiter.extraTemplateAnnotations |
map[string, string] |
{“proxy.istio.io/config”:"{ "holdApplicationUntilProxyStarts": true }"} |
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
rate-limiter.extraTemplateAnnotations.<MAP_KEY> |
string |
|
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
rate-limiter.extraTemplateAnnotations.proxy.istio.io/config |
string |
{ “holdApplicationUntilProxyStarts”: true } |
extra annotations to add to the dependency service pods. Defaults to proxy.istio.io/config: ‘{ “holdApplicationUntilProxyStarts”: true }’ |
sidecar-accel |
struct |
|
customizations to the sidecar-accel helm chart |
sidecar-accel.enabled |
bool |
false |
if true, deploy the dependency service (default false) |
managedInstallations |
struct |
|
Subchart for setting up managed installations of Control Planes and Gateways in workload clusters. |
managedInstallations.images |
struct |
|
Options for the container images |
managedInstallations.images.hub |
string |
|
Istio image repository, such as a Solo.io Istio image repository. If you are using the Solo.io Istio image repo, contact your account representative for a repo key. |
managedInstallations.images.tag |
string |
1.13.5 |
Istio image tag |
managedInstallations.controlPlane |
struct |
|
Install an Istio control plane instance in the cluster. |
managedInstallations.controlPlane.enabled |
bool |
true |
Enable installation of the control plane. |
managedInstallations.controlPlane.Overrides |
struct |
{} |
A set of overrides to merge into the Istio operator spec that installs the control plane (https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/) |
managedInstallations.eastWestGateways[] |
[]struct |
null |
Install an east-west gateway in the cluster. |
managedInstallations.eastWestGateways[] |
struct |
|
Install an east-west gateway in the cluster. |
managedInstallations.eastWestGateways[].name |
string |
|
Name of the gateway. Must be unique. |
managedInstallations.eastWestGateways[].enabled |
bool |
|
Enable installation of the gateway. |
managedInstallations.eastWestGateways[].Overrides |
struct |
|
A set of overrides to merge into the Istio operator spec that installs the gateway (https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/) |
managedInstallations.cluster |
string |
|
The cluster that the agent and managed installation are deployed to. |
managedInstallations.revision |
string |
gm |
The name of the Istio revision to be deployed. |
managedInstallations.defaultRevision |
bool |
true |
If true this installation will be used as the default Istio revision for the cluster, anything that uses the ‘istio-injection’ label will use this revision. |
managedInstallations.enabled |
bool |
false |
Enable the managed installation. |
metricscollector |
struct |
|
Helm values for configuring the Gloo Platform MetricsGateway Collector. See the OpenTelemetry Helm chart for the complete set of values. |
metricscollector.nameOverride |
string |
|
|
metricscollector.fullnameOverride |
string |
gloo-metrics-collector |
|
metricscollector.enabled |
bool |
false |
|
metricscollector.mode |
string |
daemonset |
|
metricscollector.replicaCount |
int |
0 |
|
metricscollector.command |
map[string, interface] |
{“extraArgs”:["–config=/conf/relay.yaml”],“name”:“gloo-otel-collector”} |
|
metricscollector.command.<MAP_KEY> |
interface |
|
|
metricscollector.command.extraArgs |
interface |
|
|
metricscollector.command.name |
interface |
|
|
metricscollector.image |
struct |
|
|
metricscollector.image.pullPolicy |
string |
IfNotPresent |
|
metricscollector.image.repository |
string |
gcr.io/gloo-mesh/gloo-otel-collector |
|
metricscollector.image.tag |
string |
|
|
metricscollector.extraVolumes[] |
[]map |
[{“name”:“root-ca”,“secret”:{“defaultMode”:420,“secretName”:“relay-root-tls-secret”}},{“configMap”:{“items”:[{“key”:“relay”,“path”:“relay.yaml”}],“name”:“gloo-metrics-collector-config”},“name”:“metrics-configmap”}] |
|
metricscollector.extraVolumes[] |
map[string, interface] |
|
|
metricscollector.extraVolumes[].<MAP_KEY> |
interface |
|
|
metricscollector.extraVolumeMounts[] |
[]map |
[{“mountPath”:"/etc/otel-certs”,“name”:“root-ca”,“readOnly”:true},{“mountPath”:"/conf”,“name”:“metrics-configmap”}] |
|
metricscollector.extraVolumeMounts[] |
map[string, interface] |
|
|
metricscollector.extraVolumeMounts[].<MAP_KEY> |
interface |
|
|
metricscollector.resources |
map[string, interface] |
{“requests”:{“cpu”:“100m”,“memory”:“300Mi”}} |
|
metricscollector.resources.<MAP_KEY> |
interface |
|
|
metricscollector.resources.requests |
interface |
|
|
metricscollector.extraEnvs[] |
[]map |
[{“name”:“KUBE_NODE_NAME”,“valueFrom”:{“fieldRef”:{“fieldPath”:“spec.nodeName”}}},{“name”:“KUBE_POD_NAME”,“valueFrom”:{“fieldRef”:{“fieldPath”:“metadata.name”}}}] |
|
metricscollector.extraEnvs[] |
map[string, interface] |
|
|
metricscollector.extraEnvs[].<MAP_KEY> |
interface |
|
|
metricscollector.presets |
map[string, interface] |
{“clusterMetrics”:{“enabled”:false},“hostMetrics”:{“enabled”:false},“kubeletMetrics”:{“enabled”:false},“kubernetesAttributes”:{“enabled”:false},“logsCollection”:{“enabled”:false,“includeCollectorLogs”:false}} |
|
metricscollector.presets.<MAP_KEY> |
interface |
|
|
metricscollector.presets.clusterMetrics |
interface |
|
|
metricscollector.presets.hostMetrics |
interface |
|
|
metricscollector.presets.kubeletMetrics |
interface |
|
|
metricscollector.presets.kubernetesAttributes |
interface |
|
|
metricscollector.presets.logsCollection |
interface |
|
|
metricscollector.configMap |
map[string, interface] |
{“create”:false} |
|
metricscollector.configMap.<MAP_KEY> |
interface |
|
|
metricscollector.configMap.create |
interface |
|
|
metricscollector.clusterRole |
map[string, interface] |
{“create”:true,“rules”:[{“apiGroups”:[""],“resources”:[“nodes”,“nodes/proxy”,“nodes/metrics”,“services”,“endpoints”,“pods”,“ingresses”,“configmaps”],“verbs”:[“get”,“list”,“watch”]},{“apiGroups”:[“extensions”,“networking.k8s.io”],“resources”:[“ingresses/status”,“ingresses”],“verbs”:[“get”,“list”,“watch”]},{“nonResourceURLs”:["/metrics”],“verbs”:[“get”]}]} |
|
metricscollector.clusterRole.<MAP_KEY> |
interface |
|
|
metricscollector.clusterRole.create |
interface |
|
|
metricscollector.clusterRole.rules |
interface |
|
|
metricscollector.service |
map[string, interface] |
null |
|
metricscollector.service.<MAP_KEY> |
interface |
|
|
metricscollector.podAnnotations |
map[string, interface] |
null |
|
metricscollector.podAnnotations.<MAP_KEY> |
interface |
|
|
metricscollector.ports |
map[string, interface] |
{“jaeger-compact”:{“hostPort”:0},“jaeger-grpc”:{“hostPort”:0},“jaeger-thrift”:{“hostPort”:0},“otlp”:{“hostPort”:0},“otlp-http”:{“hostPort”:0},“zipkin”:{“hostPort”:0}} |
|
metricscollector.ports.<MAP_KEY> |
interface |
|
|
metricscollector.ports.jaeger-compact |
interface |
|
|
metricscollector.ports.jaeger-grpc |
interface |
|
|
metricscollector.ports.jaeger-thrift |
interface |
|
|
metricscollector.ports.otlp |
interface |
|
|
metricscollector.ports.otlp-http |
interface |
|
|
metricscollector.ports.zipkin |
interface |
|
|
metricscollectorCustomization |
struct |
|
Helm values for customizing the Gloo Platform Metrics Collector. |
metricscollectorCustomization.disableCertGeneration |
bool |
false |
if true, disable cert generation for the Gloo MetricsGateway Gateway (default false) |
metricscollectorCustomization.serverName |
string |
gloo-metrics-gateway.gloo-mesh |
The SNI and Certificate Subject Alternative Name used in collector and metrics gateway certificate |
metricscollectorCustomization.extraReceivers |
map[string, interface] |
null |
extra receivers to add to the pipeline |
metricscollectorCustomization.extraReceivers.<MAP_KEY> |
interface |
|
extra receivers to add to the pipeline |
metricscollectorCustomization.extraProcessors |
map[string, interface] |
{“batch”:{“send_batch_max_size”:3000,“send_batch_size”:2000,“timeout”:“600ms”},“memory_limiter”:{“check_interval”:“1s”,“limit_percentage”:85,“spike_limit_percentage”:10}} |
extra processors to add to the pipeline |
metricscollectorCustomization.extraProcessors.<MAP_KEY> |
interface |
|
extra processors to add to the pipeline |
metricscollectorCustomization.extraProcessors.batch |
interface |
|
extra processors to add to the pipeline |
metricscollectorCustomization.extraProcessors.memory_limiter |
interface |
|
extra processors to add to the pipeline |
metricscollectorCustomization.extraExporters |
map[string, interface] |
null |
extra exporters to add to the pipeline |
metricscollectorCustomization.extraExporters.<MAP_KEY> |
interface |
|
extra exporters to add to the pipeline |
metricscollectorCustomization.extraPipelines |
map[string, interface] |
null |
extra pipelines to add to the pipeline |
metricscollectorCustomization.extraPipelines.<MAP_KEY> |
interface |
|
extra pipelines to add to the pipeline |
metricscollectorCustomization.telemetry |
map[string, interface] |
{“metrics”:{“address”:“0.0.0.0:8888”}} |
Configure the service telemetry (logs and metrics) as described in the otel-collector docs |
metricscollectorCustomization.telemetry.<MAP_KEY> |
interface |
|
Configure the service telemetry (logs and metrics) as described in the otel-collector docs |
metricscollectorCustomization.telemetry.metrics |
interface |
|
Configure the service telemetry (logs and metrics) as described in the otel-collector docs |
glooMeshAgent |
struct |
|
Configuration for the glooMeshAgent deployment. |
glooMeshAgent |
struct |
|
|
glooMeshAgent.image |
struct |
|
Specify the container image |
glooMeshAgent.image.tag |
string |
|
Tag for the container. |
glooMeshAgent.image.repository |
string |
gloo-mesh-agent |
Image name (repository). |
glooMeshAgent.image.registry |
string |
gcr.io/gloo-mesh |
Image registry. |
glooMeshAgent.image.pullPolicy |
string |
IfNotPresent |
Image pull policy. |
glooMeshAgent.image.pullSecret |
string |
|
Image pull secret. |
glooMeshAgent.Env[] |
slice |
[{“name”:“POD_NAMESPACE”,“valueFrom”:{“fieldRef”:{“fieldPath”:“metadata.namespace”}}}] |
Specify environment variables for the container. See the Kubernetes documentation for specification details. |
glooMeshAgent.resources |
struct |
|
Specify container resource requirements. See the Kubernetes documentation for specification details. |
glooMeshAgent.resources.limits |
map[string, struct] |
null |
|
glooMeshAgent.resources.limits.<MAP_KEY> |
struct |
|
|
glooMeshAgent.resources.limits.<MAP_KEY> |
string |
|
|
glooMeshAgent.resources.requests |
map[string, struct] |
{“cpu”:“50m”,“memory”:“128Mi”} |
|
glooMeshAgent.resources.requests.<MAP_KEY> |
struct |
|
|
glooMeshAgent.resources.requests.<MAP_KEY> |
string |
|
|
glooMeshAgent.resources.requests.cpu |
struct |
|
|
glooMeshAgent.resources.requests.cpu |
string |
DecimalSI |
|
glooMeshAgent.resources.requests.memory |
struct |
|
|
glooMeshAgent.resources.requests.memory |
string |
BinarySI |
|
glooMeshAgent.securityContext |
struct |
|
Specify container security context. Set to ‘false’ to omit the security context entirely. See the Kubernetes documentation for specification details. |
glooMeshAgent.securityContext.capabilities |
struct |
|
|
glooMeshAgent.securityContext.capabilities.add[] |
[]string |
|
|
glooMeshAgent.securityContext.capabilities.add[] |
string |
|
|
glooMeshAgent.securityContext.capabilities.drop[] |
[]string |
|
|
glooMeshAgent.securityContext.capabilities.drop[] |
string |
|
|
glooMeshAgent.securityContext.privileged |
bool |
|
|
glooMeshAgent.securityContext.seLinuxOptions |
struct |
|
|
glooMeshAgent.securityContext.seLinuxOptions.user |
string |
|
|
glooMeshAgent.securityContext.seLinuxOptions.role |
string |
|
|
glooMeshAgent.securityContext.seLinuxOptions.type |
string |
|
|
glooMeshAgent.securityContext.seLinuxOptions.level |
string |
|
|
glooMeshAgent.securityContext.windowsOptions |
struct |
|
|
glooMeshAgent.securityContext.windowsOptions.gmsaCredentialSpecName |
string |
|
|
glooMeshAgent.securityContext.windowsOptions.gmsaCredentialSpec |
string |
|
|
glooMeshAgent.securityContext.windowsOptions.runAsUserName |
string |
|
|
glooMeshAgent.securityContext.windowsOptions.hostProcess |
bool |
|
|
glooMeshAgent.securityContext.runAsUser |
int64 |
|
|
glooMeshAgent.securityContext.runAsGroup |
int64 |
|
|
glooMeshAgent.securityContext.runAsNonRoot |
bool |
|
|
glooMeshAgent.securityContext.readOnlyRootFilesystem |
bool |
|
|
glooMeshAgent.securityContext.allowPrivilegeEscalation |
bool |
|
|
glooMeshAgent.securityContext.procMount |
string |
|
|
glooMeshAgent.securityContext.seccompProfile |
struct |
|
|
glooMeshAgent.securityContext.seccompProfile.type |
string |
|
|
glooMeshAgent.securityContext.seccompProfile.localhostProfile |
string |
|
|
glooMeshAgent.sidecars |
map[string, struct] |
{} |
Configuration for the deployed containers. |
glooMeshAgent.sidecars.<MAP_KEY> |
struct |
|
Configuration for the deployed containers. |
glooMeshAgent.sidecars.<MAP_KEY>.image |
struct |
|
Specify the container image |
glooMeshAgent.sidecars.<MAP_KEY>.image.tag |
string |
|
Tag for the container. |
glooMeshAgent.sidecars.<MAP_KEY>.image.repository |
string |
|
Image name (repository). |
glooMeshAgent.sidecars.<MAP_KEY>.image.registry |
string |
|
Image registry. |
glooMeshAgent.sidecars.<MAP_KEY>.image.pullPolicy |
string |
|
Image pull policy. |
glooMeshAgent.sidecars.<MAP_KEY>.image.pullSecret |
string |
|
Image pull secret. |
glooMeshAgent.sidecars.<MAP_KEY>.Env[] |
slice |
|
Specify environment variables for the container. See the Kubernetes documentation for specification details. |
glooMeshAgent.sidecars.<MAP_KEY>.resources |
struct |
|
Specify container resource requirements. See the Kubernetes documentation for specification details. |
glooMeshAgent.sidecars.<MAP_KEY>.resources.limits |
map[string, struct] |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.resources.limits.<MAP_KEY> |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.resources.limits.<MAP_KEY> |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.resources.requests |
map[string, struct] |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.resources.requests.<MAP_KEY> |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.resources.requests.<MAP_KEY> |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext |
struct |
|
Specify container security context. Set to ‘false’ to omit the security context entirely. See the Kubernetes documentation for specification details. |
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.capabilities |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.capabilities.add[] |
[]string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.capabilities.add[] |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.capabilities.drop[] |
[]string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.capabilities.drop[] |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.privileged |
bool |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seLinuxOptions |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seLinuxOptions.user |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seLinuxOptions.role |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seLinuxOptions.type |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seLinuxOptions.level |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.windowsOptions |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.windowsOptions.gmsaCredentialSpecName |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.windowsOptions.gmsaCredentialSpec |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.windowsOptions.runAsUserName |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.windowsOptions.hostProcess |
bool |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.runAsUser |
int64 |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.runAsGroup |
int64 |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.runAsNonRoot |
bool |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.readOnlyRootFilesystem |
bool |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.allowPrivilegeEscalation |
bool |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.procMount |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seccompProfile |
struct |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seccompProfile.type |
string |
|
|
glooMeshAgent.sidecars.<MAP_KEY>.securityContext.seccompProfile.localhostProfile |
string |
|
|
glooMeshAgent.floatingUserId |
bool |
false |
Allow the pod to be assigned a dynamic user ID. |
glooMeshAgent.runAsUser |
uint32 |
10101 |
Static user ID to run the containers as. Unused if floatingUserId is ‘true’. |
glooMeshAgent.serviceType |
string |
ClusterIP |
Specify the service type. Can be either “ClusterIP”, “NodePort”, “LoadBalancer”, or “ExternalName”. |
glooMeshAgent.ports |
map[string, uint32] |
{“grpc”:9977,“http”:9988,“stats”:9091} |
Specify service ports as a map from port name to port number. |
glooMeshAgent.ports.<MAP_KEY> |
uint32 |
|
Specify service ports as a map from port name to port number. |
glooMeshAgent.ports.grpc |
uint32 |
9977 |
Specify service ports as a map from port name to port number. |
glooMeshAgent.ports.http |
uint32 |
9988 |
Specify service ports as a map from port name to port number. |
glooMeshAgent.ports.stats |
uint32 |
9091 |
Specify service ports as a map from port name to port number. |
glooMeshAgent.DeploymentOverrides |
invalid |
|
Provide arbitrary overrides for the component's deployment template |
glooMeshAgent.ServiceOverrides |
invalid |
|
Provide arbitrary overrides for the component's service template. |
glooMeshAgent.enabled |
bool |
true |
Enables or disables creation of the operator deployment/service |