aeraki.yaml

# Copyright Aeraki Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aeraki
  namespace: istio-system
  labels:
    app: aeraki
spec:
  selector:
    matchLabels:
      app: aeraki
  replicas: 1
  template:
    metadata:
      labels:
        app: aeraki
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: aeraki
      containers:
        - name: aeraki
          image: aeraki/aeraki:${AERAKI_TAG}
          # imagePullPolicy should be set to Never so Minikube can use local image for e2e testing
          imagePullPolicy: ${AERAKI_IMG_PULL_POLICY}
          env:
            - name: AERAKI_IS_MASTER
              value: "${AERAKI_IS_MASTER}"
            - name: AERAKI_ISTIOD_ADDR
              value: ${AERAKI_ISTIOD_ADDR}
            - name: AERAKI_CLUSTER_ID
              value: ${AERAKI_CLUSTER_ID}
            # In case of TCM, Istio config store can be a different k8s API server from the one Aeraki is running with
            - name: AERAKI_ISTIO_CONFIG_STORE_SECRET
              value: ${AERAKI_ISTIO_CONFIG_STORE_SECRET}
            - name: AERAKI_XDS_LISTEN_ADDR
              value: ":15010"
            - name: AERAKI_ENABLE_ENVOY_FILTER_NS_SCOPE
              # False(Default): The generated envoyFilters will be placed under Istio root namespace
              # True: The generated envoyFilters will be placed under the service namespace
              value: "${AERAKI_ENABLE_ENVOY_FILTER_NS_SCOPE}"
            - name: AERAKI_LOG_LEVEL
              value: "all:debug"
            - name: AERAKI_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: AERAKI_SERVER_ID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          volumeMounts:
            - name: istiod-ca-cert
              mountPath: /var/run/secrets/istio
              readOnly: true
      volumes:
        - name: istiod-ca-cert
          configMap:
            name: istio-ca-root-cert
            defaultMode: 420
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: aeraki
  name: aeraki
  namespace: istio-system
spec:
  ports:
    - name: grpc-xds
      port: 15010
      protocol: TCP
      targetPort: 15010
    - name: https-validation
      port: 443
      protocol: TCP
      targetPort: 15017
  selector:
    app: aeraki
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: aeraki
  namespace: istio-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: aeraki
  name: aeraki
  namespace: istio-system
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - events
    verbs:
      - '*'
  - apiGroups:
      - coordination.k8s.io
    resources:
      - '*'
    verbs:
      - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: aeraki
  name: aeraki
  namespace: istio-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: aeraki
subjects:
  - kind: ServiceAccount
    name: aeraki
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: aeraki
  name: aeraki
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
  - apiGroups:
      - networking.istio.io
    resources:
      - '*'
    verbs:
      - '*'
  - apiGroups:
      - redis.aeraki.io
      - dubbo.aeraki.io
      - metaprotocol.aeraki.io
    resources:
      - '*'
    verbs:
      - '*'
  - apiGroups:
      - networking.istio.io
    resources:
      - virtualservices
      - destinationrules
      - envoyfilters
      - serviceentries
    verbs:
      - '*'
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
    verbs:
      - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: aeraki
  name: aeraki
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: aeraki
subjects:
  - kind: ServiceAccount
    name: aeraki
    namespace: istio-system
---
apiVersion: metaprotocol.aeraki.io/v1alpha1
kind: ApplicationProtocol
metadata:
  name: dubbo
spec:
  protocol: dubbo
  codec: aeraki.meta_protocol.codec.dubbo
---
apiVersion: metaprotocol.aeraki.io/v1alpha1
kind: ApplicationProtocol
metadata:
  name: thrift
spec:
  protocol: thrift
  codec: aeraki.meta_protocol.codec.thrift