update kubeflow dip-catalog
This commit is contained in:
ChanghoWoo
@@ -0,0 +1,2 @@
|
||||
approvers:
|
||||
|
||||
@@ -0,0 +1,132 @@
|
||||
# Knative
|
||||
|
||||
## Knative-Serving
|
||||
|
||||
The manifests for Knative Serving are based off the following:
|
||||
|
||||
- [Knative serving (v1.12.4)](https://github.com/knative/serving/releases/tag/knative-v1.12.4)
|
||||
- [Knative ingress controller for Istio (v1.12.3)](https://github.com/knative-extensions/net-istio/releases/tag/knative-v1.12.3)
|
||||
|
||||
1. Download the knative-serving manifests with the following commands:
|
||||
|
||||
```sh
|
||||
# No need to install serving-crds.
|
||||
# See: https://github.com/knative/serving/issues/9945
|
||||
wget -O knative-serving/base/upstream/serving-core.yaml 'https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-core.yaml'
|
||||
wget -O knative-serving/base/upstream/net-istio.yaml 'https://github.com/knative-extensions/net-istio/releases/download/knative-v1.12.3/net-istio.yaml'
|
||||
wget -O knative-serving-post-install-jobs/base/serving-post-install-jobs.yaml 'https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-post-install-jobs.yaml'
|
||||
```
|
||||
|
||||
1. Remove all comments, since `yq` does not handle them correctly. See:
|
||||
https://github.com/mikefarah/yq/issues/788
|
||||
|
||||
```sh
|
||||
yq eval -i '... comments=""' knative-serving/base/upstream/serving-core.yaml
|
||||
yq eval -i '... comments=""' knative-serving/base/upstream/net-istio.yaml
|
||||
yq eval -i '... comments=""' knative-serving-post-install-jobs/base/serving-post-install-jobs.yaml
|
||||
```
|
||||
|
||||
1. Remove all YAML anchors and aliases, as kustomize does not support them. See:
|
||||
https://github.com/kubernetes-sigs/kustomize/issues/3614
|
||||
https://github.com/kubernetes-sigs/kustomize/issues/3446
|
||||
|
||||
```sh
|
||||
yq eval -i 'explode(.)' knative-serving/base/upstream/serving-core.yaml
|
||||
yq eval -i 'explode(.)' knative-serving/base/upstream/net-istio.yaml
|
||||
yq eval -i 'explode(.)' knative-serving-post-install-jobs/base/serving-post-install-jobs.yaml
|
||||
```
|
||||
|
||||
1. Set `metadata.name` in the serving post-install job, to be deploy-able with
|
||||
`kustomize` and `kubectl apply`:
|
||||
|
||||
```sh
|
||||
# We are not using the '|=' operator because it generates an empty object
|
||||
# ({}) which crashes kustomize.
|
||||
yq eval -i 'select(.kind == "Job" and .metadata.generateName == "storage-version-migration-serving-") | .metadata.name = "storage-version-migration-serving"' knative-serving-post-install-jobs/base/serving-post-install-jobs.yaml
|
||||
```
|
||||
|
||||
### Changes from upstream
|
||||
|
||||
- The `knative-ingress-gateway` Gateway is removed since we use the Kubeflow gateway.
|
||||
- In `config-istio`, the Knative gateway is set to use `gateway.kubeflow.kubeflow-gateway`.
|
||||
- In `config-deployment`, `progressDeadline` is set to `600s` as sometimes large models need longer than
|
||||
the default of `120s` to start the containers.
|
||||
|
||||
## Knative-Eventing
|
||||
|
||||
The manifests for Knative Eventing are based off the [v1.12.6 release](https://github.com/knative/eventing/releases/tag/knative-v1.12.6).
|
||||
|
||||
- [Eventing Core](https://github.com/knative/eventing/releases/download/knative-v1.12.6/eventing-core.yaml)
|
||||
- [In-Memory Channel](https://github.com/knative/eventing/releases/download/knative-v1.12.6/in-memory-channel.yaml)
|
||||
- [MT Channel Broker](https://github.com/knative/eventing/releases/download/knative-v1.12.6/mt-channel-broker.yaml)
|
||||
|
||||
|
||||
1. Download the knative-eventing manifests with the following commands:
|
||||
|
||||
```sh
|
||||
wget -O knative-eventing/base/upstream/eventing-core.yaml 'https://github.com/knative/eventing/releases/download/knative-v1.12.6/eventing-core.yaml'
|
||||
wget -O knative-eventing/base/upstream/in-memory-channel.yaml 'https://github.com/knative/eventing/releases/download/knative-v1.12.6/in-memory-channel.yaml'
|
||||
wget -O knative-eventing/base/upstream/mt-channel-broker.yaml 'https://github.com/knative/eventing/releases/download/knative-v1.12.6/mt-channel-broker.yaml'
|
||||
wget -O knative-eventing-post-install-jobs/base/eventing-post-install.yaml 'https://github.com/knative/eventing/releases/download/knative-v1.12.6/eventing-post-install.yaml'
|
||||
```
|
||||
|
||||
1. Remove all comments, since `yq` does not handle them correctly. See:
|
||||
https://github.com/mikefarah/yq/issues/788
|
||||
|
||||
```sh
|
||||
yq eval -i '... comments=""' knative-eventing/base/upstream/eventing-core.yaml
|
||||
yq eval -i '... comments=""' knative-eventing/base/upstream/in-memory-channel.yaml
|
||||
yq eval -i '... comments=""' knative-eventing/base/upstream/mt-channel-broker.yaml
|
||||
yq eval -i '... comments=""' knative-eventing-post-install-jobs/base/eventing-post-install.yaml
|
||||
```
|
||||
|
||||
1. Remove all YAML anchors and aliases, as kustomize does not support them. See:
|
||||
https://github.com/kubernetes-sigs/kustomize/issues/3614
|
||||
https://github.com/kubernetes-sigs/kustomize/issues/3446
|
||||
|
||||
```sh
|
||||
yq eval -i 'explode(.)' knative-eventing/base/upstream/eventing-core.yaml
|
||||
yq eval -i 'explode(.)' knative-eventing/base/upstream/in-memory-channel.yaml
|
||||
yq eval -i 'explode(.)' knative-eventing/base/upstream/mt-channel-broker.yaml
|
||||
yq eval -i 'explode(.)' knative-eventing-post-install-jobs/base/eventing-post-install.yaml
|
||||
```
|
||||
|
||||
1. Set `metadata.name` in the eventing post-install job, to be deploy-able with
|
||||
`kustomize` and `kubectl apply`:
|
||||
|
||||
```sh
|
||||
# We are not using the '|=' operator because it generates an empty object
|
||||
# ({}) which crashes kustomize.
|
||||
yq eval -i 'select(.kind == "Job" and .metadata.generateName == "storage-version-migration-eventing-") | .metadata.name = "storage-version-migration-eventing"' knative-eventing-post-install-jobs/base/eventing-post-install.yaml
|
||||
```
|
||||
|
||||
1. Remove the `config-observability` and `config-tracing` ConfigMaps resource definitions from the In-Memory Channel, as they are already defined in eventing core.
|
||||
|
||||
```sh
|
||||
yq eval -i 'select((.kind == "ConfigMap" and .metadata.name == "config-observability") | not)' knative-eventing/base/upstream/in-memory-channel.yaml
|
||||
yq eval -i 'select((.kind == "ConfigMap" and .metadata.name == "config-tracing") | not)' knative-eventing/base/upstream/in-memory-channel.yaml
|
||||
```
|
||||
|
||||
NOTE: Make sure to remove a redundant `{}` at the end of the `knative-eventing/base/upstream/in-memory-channel.yaml` file after running the above commands.
|
||||
|
||||
## Copyright
|
||||
|
||||
The files under the folders `knative-serving/base/upstream` and
|
||||
`knative-eventing/base/upstream` are downloaded from upstream Knative repos, as
|
||||
we mentioned above.
|
||||
Because `yq` does not handle comments correctly, we are removing comments from
|
||||
the downloaded manifests. For this reason, we include the copyright comment
|
||||
here verbatim, as it appears in the original files:
|
||||
|
||||
```
|
||||
Copyright 2018 The Knative Authors
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
```
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
generateName: storage-version-migration-eventing-
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app: "storage-version-migration-eventing"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
app.kubernetes.io/component: storage-version-migration-job
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
name: storage-version-migration-eventing
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 600
|
||||
backoffLimit: 10
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: "storage-version-migration-eventing"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
app.kubernetes.io/component: storage-version-migration-job
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
spec:
|
||||
serviceAccountName: knative-eventing-post-install-job
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: migrate
|
||||
image: gcr.io/knative-releases/knative.dev/pkg/apiextensions/storageversion/cmd/migrate@sha256:d438c3ad2fcef3c7ea1b3abb910f5fa911c8a1466d6460ac0b11bf034797d6f6
|
||||
args:
|
||||
- "apiserversources.sources.knative.dev"
|
||||
- "brokers.eventing.knative.dev"
|
||||
- "channels.messaging.knative.dev"
|
||||
- "containersources.sources.knative.dev"
|
||||
- "eventtypes.eventing.knative.dev"
|
||||
- "inmemorychannels.messaging.knative.dev"
|
||||
- "parallels.flows.knative.dev"
|
||||
- "pingsources.sources.knative.dev"
|
||||
- "sequences.flows.knative.dev"
|
||||
- "sinkbindings.sources.knative.dev"
|
||||
- "subscriptions.messaging.knative.dev"
|
||||
- "triggers.eventing.knative.dev"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- eventing-post-install.yaml
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: knative-eventing
|
||||
resources:
|
||||
- upstream/eventing-core.yaml
|
||||
# Uncomment to install In-Memory Channels as messaging layer:
|
||||
# - upstream/in-memory-channel.yaml
|
||||
# Uncomment to install MT-channel-based Broker layer
|
||||
# - upstream/mt-channel-broker.yaml
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
app.kubernetes.io/component: knative-eventing
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
kustomize.component: knative
|
||||
patches:
|
||||
- path: patches/clusterrole-patch.yaml
|
||||
@@ -0,0 +1,60 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-namespaced-edit
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-namespaced-view
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-messaging-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-flows-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-sources-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-bindings-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,964 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: imc-controller
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: imc-controller
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: imc-controller
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: imc-controller
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
namespace: knative-eventing
|
||||
name: imc-controller
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: imc-controller
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: knative-inmemorychannel-webhook
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: imc-controller-resolver
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: imc-controller
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: addressable-resolver
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: imc-dispatcher
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: imc-dispatcher
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: imc-dispatcher
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: imc-dispatcher
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: imc-dispatcher-tls-role-binding
|
||||
namespace: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: imc-dispatcher
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: imc-dispatcher-tls-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: imc-dispatcher-tls-role
|
||||
namespace: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config-imc-event-dispatcher
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: imc-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
data:
|
||||
MaxIdleConnections: "1000"
|
||||
MaxIdleConnectionsPerHost: "100"
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: imc-controller
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
knative.dev/high-availability: "true"
|
||||
app.kubernetes.io/component: imc-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: controller
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: controller
|
||||
app.kubernetes.io/component: imc-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: controller
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
serviceAccountName: imc-controller
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: controller
|
||||
image: gcr.io/knative-releases/knative.dev/eventing/cmd/in_memory/channel_controller@sha256:5386029f1fdcce1398dcca436864051a2f7eb5abed176453104f41b7b9b587f9
|
||||
env:
|
||||
- name: WEBHOOK_NAME
|
||||
value: inmemorychannel-webhook
|
||||
- name: WEBHOOK_PORT
|
||||
value: "8443"
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/inmemorychannel-controller
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: DISPATCHER_IMAGE
|
||||
value: gcr.io/knative-releases/knative.dev/eventing/cmd/in_memory/channel_dispatcher@sha256:fa64db1ad126874f4e5ce1c17c2414b0fc3dde2a7e0db6fde939cafdbd4d96cd
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
- name: profiling
|
||||
containerPort: 8008
|
||||
- name: https-webhook
|
||||
containerPort: 8443
|
||||
readinessProbe:
|
||||
periodSeconds: 1
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
port: 8443
|
||||
httpHeaders:
|
||||
- name: k-kubelet-probe
|
||||
value: "webhook"
|
||||
livenessProbe:
|
||||
periodSeconds: 1
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
port: 8443
|
||||
httpHeaders:
|
||||
- name: k-kubelet-probe
|
||||
value: "webhook"
|
||||
initialDelaySeconds: 120
|
||||
terminationGracePeriodSeconds: 300
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: imc-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
name: inmemorychannel-webhook
|
||||
namespace: knative-eventing
|
||||
spec:
|
||||
ports:
|
||||
- name: https-webhook
|
||||
port: 443
|
||||
targetPort: 8443
|
||||
- name: http-metrics
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
- name: http-profiling
|
||||
port: 8008
|
||||
targetPort: 8008
|
||||
selector:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: controller
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: imc-dispatcher
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: dispatcher
|
||||
app.kubernetes.io/component: imc-dispatcher
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: dispatcher
|
||||
ports:
|
||||
- name: http-dispatcher
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
- name: https-dispatcher
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
- name: http-metrics
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: imc-dispatcher
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
knative.dev/high-availability: "true"
|
||||
app.kubernetes.io/component: imc-dispatcher
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: dispatcher
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: dispatcher
|
||||
app.kubernetes.io/component: imc-dispatcher
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
messaging.knative.dev/channel: in-memory-channel
|
||||
messaging.knative.dev/role: dispatcher
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
serviceAccountName: imc-dispatcher
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: dispatcher
|
||||
image: gcr.io/knative-releases/knative.dev/eventing/cmd/in_memory/channel_dispatcher@sha256:fa64db1ad126874f4e5ce1c17c2414b0fc3dde2a7e0db6fde939cafdbd4d96cd
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
initialDelaySeconds: 5
|
||||
env:
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/inmemorychannel-dispatcher
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: CONTAINER_NAME
|
||||
value: dispatcher
|
||||
- name: MAX_IDLE_CONNS
|
||||
value: "1000"
|
||||
- name: MAX_IDLE_CONNS_PER_HOST
|
||||
value: "1000"
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 9090
|
||||
name: metrics
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: inmemorychannels.messaging.knative.dev
|
||||
labels:
|
||||
knative.dev/crd-install: "true"
|
||||
messaging.knative.dev/subscribable: "true"
|
||||
duck.knative.dev/addressable: "true"
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
group: messaging.knative.dev
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: 'InMemoryChannel is a resource representing an in memory channel'
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
description: Spec defines the desired state of the Channel.
|
||||
type: object
|
||||
properties:
|
||||
delivery:
|
||||
description: DeliverySpec contains the default delivery spec for each subscription to this Channelable. Each subscription delivery spec, if any, overrides this global delivery spec.
|
||||
type: object
|
||||
properties:
|
||||
backoffDelay:
|
||||
description: 'BackoffDelay is the delay before retrying. More information on Duration format: - https://www.iso.org/iso-8601-date-and-time-format.html - https://en.wikipedia.org/wiki/ISO_8601 For linear policy, backoff delay is backoffDelay*<numberOfRetries>. For exponential policy, backoff delay is backoffDelay*2^<numberOfRetries>.'
|
||||
type: string
|
||||
backoffPolicy:
|
||||
description: BackoffPolicy is the retry backoff policy (linear, exponential).
|
||||
type: string
|
||||
deadLetterSink:
|
||||
description: DeadLetterSink is the sink receiving event that could not be sent to a destination.
|
||||
type: object
|
||||
properties:
|
||||
ref:
|
||||
description: Ref points to an Addressable.
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ This is optional field, it gets defaulted to the object holding it if left out.'
|
||||
type: string
|
||||
uri:
|
||||
description: URI can be an absolute URL(non-empty scheme and non-empty host) pointing to the target or a relative URI. Relative URIs will be resolved using the base URI retrieved from Ref.
|
||||
type: string
|
||||
CACerts:
|
||||
description: Certification Authority (CA) certificates in PEM format that the source trusts when sending events to the sink.
|
||||
type: string
|
||||
audience:
|
||||
description: Audience is the OIDC audience. This only needs to be set if the target is not an Addressable and thus the Audience can't be received from the Addressable itself. If the target is an Addressable and specifies an Audience, the target's Audience takes precedence.
|
||||
type: string
|
||||
retry:
|
||||
description: Retry is the minimum number of retries the sender should attempt when sending an event before moving it to the dead letter sink.
|
||||
type: integer
|
||||
format: int32
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
subscribers:
|
||||
description: This is the list of subscriptions for this subscribable.
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
delivery:
|
||||
description: DeliverySpec contains options controlling the event delivery
|
||||
type: object
|
||||
properties:
|
||||
backoffDelay:
|
||||
description: 'BackoffDelay is the delay before retrying. More information on Duration format: - https://www.iso.org/iso-8601-date-and-time-format.html - https://en.wikipedia.org/wiki/ISO_8601 For linear policy, backoff delay is backoffDelay*<numberOfRetries>. For exponential policy, backoff delay is backoffDelay*2^<numberOfRetries>.'
|
||||
type: string
|
||||
backoffPolicy:
|
||||
description: BackoffPolicy is the retry backoff policy (linear, exponential).
|
||||
type: string
|
||||
deadLetterSink:
|
||||
description: DeadLetterSink is the sink receiving event that could not be sent to a destination.
|
||||
type: object
|
||||
properties:
|
||||
ref:
|
||||
description: Ref points to an Addressable.
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ This is optional field, it gets defaulted to the object holding it if left out.'
|
||||
type: string
|
||||
uri:
|
||||
description: URI can be an absolute URL(non-empty scheme and non-empty host) pointing to the target or a relative URI. Relative URIs will be resolved using the base URI retrieved from Ref.
|
||||
type: string
|
||||
CACerts:
|
||||
description: Certification Authority (CA) certificates in PEM format that the source trusts when sending events to the sink.
|
||||
type: string
|
||||
audience:
|
||||
description: Audience is the OIDC audience. This only needs to be set if the target is not an Addressable and thus the Audience can't be received from the Addressable itself. If the target is an Addressable and specifies an Audience, the target's Audience takes precedence.
|
||||
type: string
|
||||
retry:
|
||||
description: Retry is the minimum number of retries the sender should attempt when sending an event before moving it to the dead letter sink.
|
||||
type: integer
|
||||
format: int32
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
generation:
|
||||
description: Generation of the origin of the subscriber with uid:UID.
|
||||
type: integer
|
||||
format: int64
|
||||
replyUri:
|
||||
description: ReplyURI is the endpoint for the reply
|
||||
type: string
|
||||
replyCACerts:
|
||||
description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
|
||||
type: string
|
||||
replyAudience:
|
||||
description: ReplyAudience is the OIDC audience for the replyUri.
|
||||
type: string
|
||||
subscriberUri:
|
||||
description: SubscriberURI is the endpoint for the subscriber
|
||||
type: string
|
||||
subscriberCACerts:
|
||||
description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
|
||||
type: string
|
||||
subscriberAudience:
|
||||
description: SubscriberAudience is the OIDC audience for the subscriberUri.
|
||||
type: string
|
||||
uid:
|
||||
description: UID is used to understand the origin of the subscriber.
|
||||
type: string
|
||||
status:
|
||||
description: Status represents the current state of the Channel. This data may be out of date.
|
||||
type: object
|
||||
properties:
|
||||
address:
|
||||
description: InMemoryChannel is Addressable. It exposes the endpoint as an URI to get events delivered into the channel mesh.
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
url:
|
||||
type: string
|
||||
CACerts:
|
||||
type: string
|
||||
audience:
|
||||
type: string
|
||||
addresses:
|
||||
description: InMemoryChannel is Addressable. It exposes the endpoints as URIs to get events delivered into the channel mesh.
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
url:
|
||||
type: string
|
||||
CACerts:
|
||||
type: string
|
||||
audience:
|
||||
type: string
|
||||
annotations:
|
||||
description: Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
conditions:
|
||||
description: Conditions the latest available observations of a resource's current state.
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required:
|
||||
- type
|
||||
- status
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details about the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
severity:
|
||||
description: Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of condition.
|
||||
type: string
|
||||
deadLetterChannel:
|
||||
description: DeadLetterChannel is a KReference and is set by the channel when it supports native error handling via a channel Failed messages are delivered here.
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ This is optional field, it gets defaulted to the object holding it if left out.'
|
||||
type: string
|
||||
deadLetterSinkUri:
|
||||
description: DeadLetterSinkURI is the resolved URI of the dead letter ref if one is specified in the Spec.Delivery.
|
||||
type: string
|
||||
deadLetterSinkCACerts:
|
||||
description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.
|
||||
type: integer
|
||||
format: int64
|
||||
subscribers:
|
||||
description: This is the list of subscription's statuses for this channel.
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
message:
|
||||
description: A human readable message indicating details of Ready status.
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: Generation of the origin of the subscriber with uid:UID.
|
||||
type: integer
|
||||
format: int64
|
||||
ready:
|
||||
description: Status of the subscriber.
|
||||
type: string
|
||||
uid:
|
||||
description: UID is used to understand the origin of the subscriber.
|
||||
type: string
|
||||
auth:
|
||||
description: Auth provides the relevant information for OIDC authentication.
|
||||
type: object
|
||||
properties:
|
||||
serviceAccountName:
|
||||
description: ServiceAccountName is the name of the generated service account used for this components OIDC authentication.
|
||||
type: string
|
||||
additionalPrinterColumns:
|
||||
- name: URL
|
||||
type: string
|
||||
jsonPath: .status.address.url
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
- name: Ready
|
||||
type: string
|
||||
jsonPath: ".status.conditions[?(@.type==\"Ready\")].status"
|
||||
- name: Reason
|
||||
type: string
|
||||
jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
|
||||
names:
|
||||
kind: InMemoryChannel
|
||||
plural: inmemorychannels
|
||||
singular: inmemorychannel
|
||||
categories:
|
||||
- all
|
||||
- knative
|
||||
- messaging
|
||||
- channel
|
||||
shortNames:
|
||||
- imc
|
||||
scope: Namespaced
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: imc-addressable-resolver
|
||||
labels:
|
||||
duck.knative.dev/addressable: "true"
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels
|
||||
- inmemorychannels/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: imc-channelable-manipulator
|
||||
labels:
|
||||
duck.knative.dev/channelable: "true"
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels
|
||||
- inmemorychannels/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: imc-controller
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels
|
||||
- inmemorychannels/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels/finalizers
|
||||
- inmemorychannels/status
|
||||
- inmemorychannels
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- "admissionregistration.k8s.io"
|
||||
resources:
|
||||
- "mutatingwebhookconfigurations"
|
||||
- "validatingwebhookconfigurations"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "create"
|
||||
- "update"
|
||||
- "delete"
|
||||
- "patch"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces"
|
||||
verbs:
|
||||
- "get"
|
||||
- "create"
|
||||
- "update"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces/finalizers"
|
||||
verbs:
|
||||
- "update"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: imc-dispatcher
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels
|
||||
- inmemorychannels/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- messaging.knative.dev
|
||||
resources:
|
||||
- inmemorychannels/finalizers
|
||||
- inmemorychannels/status
|
||||
- inmemorychannels
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- eventing.knative.dev
|
||||
resources:
|
||||
- eventtypes
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
namespace: knative-eventing
|
||||
name: knative-inmemorychannel-webhook
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "create"
|
||||
- "update"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "patch"
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: inmemorychannel.eventing.knative.dev
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: inmemorychannel-webhook
|
||||
namespace: knative-eventing
|
||||
sideEffects: None
|
||||
failurePolicy: Fail
|
||||
name: inmemorychannel.eventing.knative.dev
|
||||
timeoutSeconds: 10
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: validation.inmemorychannel.eventing.knative.dev
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: inmemorychannel-webhook
|
||||
namespace: knative-eventing
|
||||
sideEffects: None
|
||||
failurePolicy: Fail
|
||||
name: validation.inmemorychannel.eventing.knative.dev
|
||||
timeoutSeconds: 10
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: inmemorychannel-webhook-certs
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
---
|
||||
|
||||
@@ -0,0 +1,580 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-mt-channel-broker-controller
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces/finalizers"
|
||||
verbs:
|
||||
- "update"
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "create"
|
||||
- "update"
|
||||
- "delete"
|
||||
- "patch"
|
||||
- "watch"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-mt-broker-filter
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- eventing.knative.dev
|
||||
resources:
|
||||
- triggers
|
||||
- triggers/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-eventing-mt-broker-ingress
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- eventing.knative.dev
|
||||
resources:
|
||||
- eventtypes
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- eventing.knative.dev
|
||||
resources:
|
||||
- brokers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: eventing-mt-channel-broker-controller
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: eventing-controller
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: knative-eventing-mt-channel-broker-controller
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: knative-eventing-mt-broker-filter
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: knative-eventing-mt-broker-filter
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: mt-broker-filter
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: knative-eventing-mt-broker-ingress
|
||||
labels:
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: knative-eventing-mt-broker-ingress
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: mt-broker-ingress
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mt-broker-filter
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: broker-filter
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
eventing.knative.dev/brokerRole: filter
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
eventing.knative.dev/brokerRole: filter
|
||||
app.kubernetes.io/component: broker-filter
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
serviceAccountName: mt-broker-filter
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: filter
|
||||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
image: gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter@sha256:4e3cf0703024129c60b66529f41a1d29310f61f6aced24d25fd241e43b1a2e8e
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
initialDelaySeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 9092
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
terminationMessagePath: /dev/termination-log
|
||||
env:
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: CONTAINER_NAME
|
||||
value: filter
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/internal/eventing
|
||||
- name: FILTER_PORT
|
||||
value: "8080"
|
||||
- name: FILTER_PORT_HTTPS
|
||||
value: "8443"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
eventing.knative.dev/brokerRole: filter
|
||||
app.kubernetes.io/component: broker-filter
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
name: broker-filter
|
||||
namespace: knative-eventing
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
- name: http-metrics
|
||||
port: 9092
|
||||
protocol: TCP
|
||||
targetPort: 9092
|
||||
selector:
|
||||
eventing.knative.dev/brokerRole: filter
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mt-broker-ingress
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: broker-ingress
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
eventing.knative.dev/brokerRole: ingress
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
eventing.knative.dev/brokerRole: ingress
|
||||
app.kubernetes.io/component: broker-ingress
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
serviceAccountName: mt-broker-ingress
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: ingress
|
||||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
image: gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress@sha256:65412cf797d0bb7c7e22454431f57f8d9dcedf93620769f4c1206947acf05abb
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 2
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
initialDelaySeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 9092
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
terminationMessagePath: /dev/termination-log
|
||||
env:
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: CONTAINER_NAME
|
||||
value: ingress
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/internal/eventing
|
||||
- name: INGRESS_PORT
|
||||
value: "8080"
|
||||
- name: INGRESS_PORT_HTTPS
|
||||
value: "8443"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
eventing.knative.dev/brokerRole: ingress
|
||||
app.kubernetes.io/component: broker-ingress
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
name: broker-ingress
|
||||
namespace: knative-eventing
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
- name: http-metrics
|
||||
port: 9092
|
||||
protocol: TCP
|
||||
targetPort: 9092
|
||||
selector:
|
||||
eventing.knative.dev/brokerRole: ingress
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mt-broker-controller
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: mt-broker-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mt-broker-controller
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mt-broker-controller
|
||||
app.kubernetes.io/component: broker-controller
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: mt-broker-controller
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
serviceAccountName: eventing-controller
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: mt-broker-controller
|
||||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
image: gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker@sha256:9dc9e0b00325f1ec994ef6f48761ba7d9217333fa0c2cbfccfa9b204e3f616a9
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
env:
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/eventing
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
- name: profiling
|
||||
containerPort: 8008
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: broker-ingress-hpa
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: broker-ingress
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: mt-broker-ingress
|
||||
minReplicas: 1
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: broker-filter-hpa
|
||||
namespace: knative-eventing
|
||||
labels:
|
||||
app.kubernetes.io/component: broker-filter
|
||||
app.kubernetes.io/version: "1.12.6"
|
||||
app.kubernetes.io/name: knative-eventing
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: mt-broker-filter
|
||||
minReplicas: 1
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- serving-post-install-jobs.yaml
|
||||
|
||||
# patches:
|
||||
# - patch: |
|
||||
# - op: add
|
||||
# path: /metadata/name
|
||||
# value: storage-version-migration-serving
|
||||
# target:
|
||||
# kind: Job
|
||||
# labelSelector: app=storage-version-migration-serving
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
generateName: storage-version-migration-serving-
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app: storage-version-migration-serving
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/component: storage-version-migration-job
|
||||
app.kubernetes.io/version: "1.12.4"
|
||||
name: storage-version-migration-serving
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 600
|
||||
backoffLimit: 10
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
labels:
|
||||
app: storage-version-migration-serving
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/component: storage-version-migration-job
|
||||
app.kubernetes.io/version: "1.12.4"
|
||||
spec:
|
||||
serviceAccountName: controller
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: migrate
|
||||
image: gcr.io/knative-releases/knative.dev/pkg/apiextensions/storageversion/cmd/migrate@sha256:232d6ffd88dfc0d0ec02c6f3a95520283d076c16b77543cee04f4ef276e0b7ae
|
||||
args:
|
||||
- "services.serving.knative.dev"
|
||||
- "configurations.serving.knative.dev"
|
||||
- "revisions.serving.knative.dev"
|
||||
- "routes.serving.knative.dev"
|
||||
- "domainmappings.serving.knative.dev"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1000Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
@@ -0,0 +1,78 @@
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: activator-service
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
action: ALLOW
|
||||
selector:
|
||||
matchLabels:
|
||||
app: activator
|
||||
rules:
|
||||
- {}
|
||||
---
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: autoscaler
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
action: ALLOW
|
||||
selector:
|
||||
matchLabels:
|
||||
app: autoscaler
|
||||
rules:
|
||||
- {}
|
||||
---
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: controller
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
action: ALLOW
|
||||
selector:
|
||||
matchLabels:
|
||||
app: controller
|
||||
rules:
|
||||
- {}
|
||||
---
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: webhook
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
action: ALLOW
|
||||
selector:
|
||||
matchLabels:
|
||||
role: webhook
|
||||
rules:
|
||||
- {}
|
||||
|
||||
---
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: istio-webhook
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
action: ALLOW
|
||||
selector:
|
||||
matchLabels:
|
||||
app: net-istio-webhook
|
||||
rules:
|
||||
- {}
|
||||
---
|
||||
|
||||
# DestinationRule for mTLS
|
||||
apiVersion: "networking.istio.io/v1alpha3"
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: knative
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
host: "*.knative-serving.svc.cluster.local"
|
||||
trafficPolicy:
|
||||
tls:
|
||||
mode: ISTIO_MUTUAL
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- upstream/serving-core.yaml
|
||||
- upstream/net-istio.yaml
|
||||
- istio-authorization-policy.yaml
|
||||
patches:
|
||||
- path: patches/sidecar-injection.yaml
|
||||
target:
|
||||
kind: Deployment
|
||||
- path: patches/config-deployment.yaml
|
||||
- path: patches/config-istio.yaml
|
||||
- path: patches/namespace-injection.yaml
|
||||
- path: patches/knative-serving-namespaced-admin.yaml
|
||||
- path: patches/knative-serving-namespaced-edit.yaml
|
||||
- path: patches/knative-serving-namespaced-view.yaml
|
||||
- path: patches/service-labels.yaml
|
||||
- path: patches/remove-gateway.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config-deployment
|
||||
namespace: knative-serving
|
||||
data:
|
||||
progressDeadline: 600s
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config-istio
|
||||
namespace: knative-serving
|
||||
data:
|
||||
gateway.kubeflow.kubeflow-gateway: istio-ingressgateway.istio-system.svc.cluster.local
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-serving-namespaced-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-serving-namespaced-edit
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: knative-serving-namespaced-view
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: knative-serving
|
||||
labels:
|
||||
istio-injection: enabled
|
||||
@@ -0,0 +1,6 @@
|
||||
$patch: delete
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: knative-ingress-gateway
|
||||
namespace: knative-serving
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: knative-local-gateway
|
||||
namespace: istio-system
|
||||
labels:
|
||||
experimental.istio.io/disable-gateway-port-translation: "true"
|
||||
@@ -0,0 +1,10 @@
|
||||
patches:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "*"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "true"
|
||||
@@ -0,0 +1,422 @@
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: knative-serving-istio
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
serving.knative.dev/controller: "true"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
rules:
|
||||
- apiGroups: ["networking.istio.io"]
|
||||
resources: ["virtualservices", "gateways", "destinationrules"]
|
||||
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: knative-ingress-gateway
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: knative-local-gateway
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 8081
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: knative-local-gateway
|
||||
namespace: istio-system
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
experimental.istio.io/disable-gateway-port-translation: "true"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
ports:
|
||||
- name: http2
|
||||
port: 80
|
||||
targetPort: 8081
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config-istio
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
data:
|
||||
_example: |
|
||||
################################
|
||||
# #
|
||||
# EXAMPLE CONFIGURATION #
|
||||
# #
|
||||
################################
|
||||
|
||||
# This block is not actually functional configuration,
|
||||
# but serves to illustrate the available configuration
|
||||
# options and document them in a way that is accessible
|
||||
# to users that `kubectl edit` this config map.
|
||||
#
|
||||
# These sample configuration options may be copied out of
|
||||
# this example block and unindented to be in the data block
|
||||
# to actually change the configuration.
|
||||
|
||||
# A gateway and Istio service to serve external traffic.
|
||||
# The configuration format should be
|
||||
# `gateway.{{gateway_namespace}}.{{gateway_name}}: "{{ingress_name}}.{{ingress_namespace}}.svc.cluster.local"`.
|
||||
# The {{gateway_namespace}} is optional; when it is omitted, the system will search for
|
||||
# the gateway in the serving system namespace `knative-serving`
|
||||
gateway.knative-serving.knative-ingress-gateway: "istio-ingressgateway.istio-system.svc.cluster.local"
|
||||
|
||||
# A cluster local gateway to allow pods outside of the mesh to access
|
||||
# Services and Routes not exposing through an ingress. If the users
|
||||
# do have a service mesh setup, this isn't required and can be removed.
|
||||
#
|
||||
# An example use case is when users want to use Istio without any
|
||||
# sidecar injection (like Knative's istio-ci-no-mesh.yaml). Since every pod
|
||||
# is outside of the service mesh in that case, a cluster-local service
|
||||
# will need to be exposed to a cluster-local gateway to be accessible.
|
||||
# The configuration format should be `local-gateway.{{local_gateway_namespace}}.
|
||||
# {{local_gateway_name}}: "{{cluster_local_gateway_name}}.
|
||||
# {{cluster_local_gateway_namespace}}.svc.cluster.local"`. The
|
||||
# {{local_gateway_namespace}} is optional; when it is omitted, the system
|
||||
# will search for the local gateway in the serving system namespace
|
||||
# `knative-serving`
|
||||
local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"
|
||||
---
|
||||
apiVersion: "security.istio.io/v1beta1"
|
||||
kind: "PeerAuthentication"
|
||||
metadata:
|
||||
name: "webhook"
|
||||
namespace: "knative-serving"
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: webhook
|
||||
portLevelMtls:
|
||||
"8443":
|
||||
mode: PERMISSIVE
|
||||
---
|
||||
apiVersion: "security.istio.io/v1beta1"
|
||||
kind: "PeerAuthentication"
|
||||
metadata:
|
||||
name: "net-istio-webhook"
|
||||
namespace: "knative-serving"
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: net-istio-webhook
|
||||
portLevelMtls:
|
||||
"8443":
|
||||
mode: PERMISSIVE
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: net-istio-controller
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: net-istio-controller
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
labels:
|
||||
app: net-istio-controller
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
spec:
|
||||
serviceAccountName: controller
|
||||
containers:
|
||||
- name: controller
|
||||
image: gcr.io/knative-releases/knative.dev/net-istio/cmd/controller@sha256:5782b4a6b1a106d7cafe77d044b30905a9fecbbd2e0029946cb8a4b3507b40a4
|
||||
resources:
|
||||
requests:
|
||||
cpu: 30m
|
||||
memory: 40Mi
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 400Mi
|
||||
env:
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID
|
||||
value: "false"
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/net-istio
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readiness
|
||||
port: probes
|
||||
scheme: HTTP
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: probes
|
||||
scheme: HTTP
|
||||
periodSeconds: 5
|
||||
failureThreshold: 6
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
- name: profiling
|
||||
containerPort: 8008
|
||||
- name: probes
|
||||
containerPort: 8080
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: net-istio-webhook
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: net-istio-webhook
|
||||
role: net-istio-webhook
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: net-istio-webhook
|
||||
role: net-istio-webhook
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
spec:
|
||||
serviceAccountName: controller
|
||||
containers:
|
||||
- name: webhook
|
||||
image: gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook@sha256:eeff0ad31550f3ff519d988bb36bfe214e5b60c1ec4349c1f9bb2b2d8cad9479
|
||||
resources:
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 20Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 200Mi
|
||||
env:
|
||||
- name: SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONFIG_LOGGING_NAME
|
||||
value: config-logging
|
||||
- name: CONFIG_OBSERVABILITY_NAME
|
||||
value: config-observability
|
||||
- name: METRICS_DOMAIN
|
||||
value: knative.dev/net-istio
|
||||
- name: WEBHOOK_NAME
|
||||
value: net-istio-webhook
|
||||
- name: WEBHOOK_PORT
|
||||
value: "8443"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
readinessProbe:
|
||||
periodSeconds: 1
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
port: 8443
|
||||
httpHeaders:
|
||||
- name: k-kubelet-probe
|
||||
value: "webhook"
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
periodSeconds: 1
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
port: 8443
|
||||
httpHeaders:
|
||||
- name: k-kubelet-probe
|
||||
value: "webhook"
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 20
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
- name: profiling
|
||||
containerPort: 8008
|
||||
- name: https-webhook
|
||||
containerPort: 8443
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: net-istio-webhook-certs
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: net-istio-webhook
|
||||
namespace: knative-serving
|
||||
labels:
|
||||
role: net-istio-webhook
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
spec:
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: 9090
|
||||
targetPort: metrics
|
||||
- name: http-profiling
|
||||
port: 8008
|
||||
targetPort: profiling
|
||||
- name: https-webhook
|
||||
port: 443
|
||||
targetPort: https-webhook
|
||||
selector:
|
||||
app: net-istio-webhook
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: webhook.istio.networking.internal.knative.dev
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
service:
|
||||
name: net-istio-webhook
|
||||
namespace: knative-serving
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- {key: "serving.knative.dev/configuration", operator: Exists}
|
||||
name: webhook.istio.networking.internal.knative.dev
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: config.webhook.istio.networking.internal.knative.dev
|
||||
labels:
|
||||
app.kubernetes.io/component: net-istio
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/version: "1.12.3"
|
||||
networking.knative.dev/ingress-provider: istio
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
service:
|
||||
name: net-istio-webhook
|
||||
namespace: knative-serving
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
name: config.webhook.istio.networking.internal.knative.dev
|
||||
objectSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: knative-serving
|
||||
app.kubernetes.io/component: net-istio
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: routing-serving-certs
|
||||
namespace: istio-system
|
||||
labels:
|
||||
serving-certs-ctrl: "data-plane-routing"
|
||||
networking.internal.knative.dev/certificate-uid: "serving-certs"
|
||||
---
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,11 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
|
||||
# We want to Knative to use Istio's local Gateway and not the Ingress Gateway
|
||||
# See: https://github.com/kubeflow/manifests/issues/1966
|
||||
patches:
|
||||
- path: patches/gateway-selector-in-knative-serving.yaml
|
||||
- path: patches/gateway-selector-in-istio-system.yaml
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: knative-local-gateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
app: cluster-local-gateway
|
||||
istio: cluster-local-gateway
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: knative-local-gateway
|
||||
namespace: knative-serving
|
||||
spec:
|
||||
selector:
|
||||
app: cluster-local-gateway
|
||||
istio: cluster-local-gateway
|
||||
Reference in New Issue
Block a user