IstioLifecycleManager

  apiVersion: admin.gloo.solo.io/v2
kind: IstioLifecycleManager
metadata:
  name: istiod-control-plane
  namespace: gloo-mesh
spec:
  installations:
  # The revision for this installation, such as 1-18-3
  - revision: $REVISION
    # List all workload clusters to install Istio into
    clusters:
    - name: $REMOTE_CLUSTER1
      # If set to true, the spec for this revision is applied in the cluster
      defaultRevision: true
    - name: $REMOTE_CLUSTER2
      defaultRevision: true
    istioOperatorSpec:
      # Only the control plane components are installed
      # (https://istio.io/latest/docs/setup/additional-setup/config-profiles/)
      profile: minimal
      # Repository for the Solo distribution of Istio; required to use Solo images.
      # You get the repo key from your Solo Account Representative.
      hub: $REPO
      # Tag for Solo distribution of Istio
      tag: $ISTIO_IMAGE
      namespace: istio-system
      # Mesh configuration
      meshConfig:
        # Enable access logging only if using.
        accessLogFile: /dev/stdout
        # Encoding for the proxy access log (TEXT or JSON). Default value is TEXT.
        accessLogEncoding: JSON
        # Enable span tracing only if using.
        enableTracing: true
        defaultConfig:
          # Wait for the istio-proxy to start before starting application pods
          holdApplicationUntilProxyStarts: true
          # Legacy metrics pipeline only, in Gloo Istio 1.17 and earlier:
          # Enable the legacy Gloo metrics service. For more info, see https://docs.solo.io/gloo-mesh/latest/observability/pipeline/.
          envoyMetricsService:
            address: gloo-mesh-agent.gloo-mesh:9977
          # Legacy metrics pipeline only, in Gloo Istio 1.17 and earlier: Enable Gloo access logging.
          envoyAccessLogService:
            address: gloo-mesh-agent.gloo-mesh:9977
          proxyMetadata:
            # For known hosts, enable the Istio agent to handle DNS requests for any custom ServiceEntry, such as non-Kubernetes services.
            # Unknown hosts are automatically resolved using upstream DNS servers in resolv.conf (for proxy-dns)
            ISTIO_META_DNS_CAPTURE: "true"
        # Set the default behavior of the sidecar for handling outbound traffic
        # from the application
        outboundTrafficPolicy:
          mode: ALLOW_ANY
        # The administrative root namespace for Istio configuration
        rootNamespace: istio-system
        # Set to the cluster name by default.
        trustDomain: ${CLUSTER_NAME}
      # Traffic management
      components:
        pilot:
          k8s:
            env:
            # Disable selecting workload entries for local service routing, so that Kubernetes 
            # will not automatically match services to workload entries with matching selector labels.
            # Required for Gloo Mesh VirtualDestination functionality.
            # For more info, see https://istio.io/latest/docs/reference/commands/pilot-discovery/
            - name: PILOT_ENABLE_K8S_SELECT_WORKLOAD_ENTRIES
              value: "false"
            # Skip the validation step for mTLS within the cluster.
            # This approach is not recommended if you integrated Istio with your own CA,
            # but is useful for PoCs or demos in which you use self-signed certificates.
            - name: PILOT_SKIP_VALIDATE_TRUST_DOMAIN
              value: "true"
      # Helm values overrides
      values:
        global:
          multiCluster:
            # Set to the cluster name by default.
            clusterName: $CLUSTER_NAME