istio-cni

# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.

# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.

image: istio-install-cni

global:

hub: chainreg.biz/chainguard-private

tag: 1.31.1-r2@sha256:aab0a1b8b275c079ffd5e1765f8c55673d00b13f6c51a837f9243f4240150412

variant: ""

_internal_defaults_do_not_set:

hub: ""

tag: ""

variant: ""

image: install-cni

pullPolicy: ""

# Same as `global.logging.level`, but will override it if set

logging:

level: ""

# Configuration file to insert istio-cni plugin configuration

# by default this will be the first file found in the cni-conf-dir

# Example

# cniConfFileName: 10-calico.conflist

# CNI-and-platform specific path defaults.

# These may need to be set to platform-specific values, consult

# overrides for your platform in `manifests/helm-profiles/platform-*.yaml`

cniBinDir: /opt/cni/bin

cniConfDir: /etc/cni/net.d

cniConfFileName: ""

cniNetnsDir: "/var/run/netns"

# If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist

istioOwnedCNIConfigFileName: ""

istioOwnedCNIConfig: false

excludeNamespaces:

- kube-system

# Allows user to set custom affinity for the DaemonSet

affinity: {}

# Additional labels to apply on the daemonset level

daemonSetLabels: {}

# Custom annotations on pod level, if you need them

podAnnotations: {}

# Additional labels to apply on the pod level

podLabels: {}

# Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?

# Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case

chained: true

# Custom configuration happens based on the CNI provider.

# Possible values: "default", "multus"

provider: "default"

# Configure ambient settings

ambient:

# If enabled, ambient redirection will be enabled

enabled: false

# If ambient is enabled, this selector will be used to identify the ambient-enabled pods

enablementSelectors:

- podSelector:

matchLabels: {istio.io/dataplane-mode: ambient}

- podSelector:

matchExpressions:

- {key: istio.io/dataplane-mode, operator: NotIn, values: [none]}

namespaceSelector:

matchLabels: {istio.io/dataplane-mode: ambient}

# Set ambient config dir path: defaults to /etc/ambient-config

configDir: ""

# If enabled, and ambient is enabled, DNS redirection will be enabled

dnsCapture: true

# If enabled, and ambient is enabled, enables ipv6 support

ipv6: true

# If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.

# This is enabled by default

reconcileIptablesOnStartup: true

# If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on

shareHostNetworkNamespace: false

# If enabled, the CNI agent will retry checking if a pod is ambient enabled when there are errors

enableAmbientDetectionRetry: false

repair:

enabled: true

hub: ""

tag: ""

# Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.

# This defines the action the controller will take when a pod is detected as broken.

# labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.

# This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).

# Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.

labelPods: false

# deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.

# Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.

deletePods: false

# repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.

# Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.

# This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.

repairPods: true

initContainerName: "istio-validation"

brokenPodLabelKey: "cni.istio.io/uninitialized"

brokenPodLabelValue: "true"

# Set to `type: RuntimeDefault` to use the default profile if available.

seccompProfile: {}

# SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.

seLinuxOptions: {}

# Use `useAppArmorAnnotation: true` to set up appArmor profile via `container.apparmor.security.beta.kubernetes.io` annotation.

# This is required for Kubernetes 1.29 (and earlier) which does not support setting appArmorProfile in the

# securityContext. Otherwise, appArmor profile will be set via appArmorProfile setting in securityContext.

useAppArmorAnnotation: true

resources:

requests:

cpu: 100m

memory: 100Mi

resourceQuotas:

enabled: false

pods: 5000

tolerations:

# Make sure istio-cni-node gets scheduled on all nodes.

- effect: NoSchedule

operator: Exists

# Mark the pod as a critical add-on for rescheduling.

- key: CriticalAddonsOnly

operator: Exists

- effect: NoExecute

operator: Exists

# K8s DaemonSet update strategy.

# https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).

updateStrategy:

type: RollingUpdate

rollingUpdate:

maxUnavailable: 1

# Sets the per-pod terminationGracePeriodSeconds setting.

# A higher value gives more time for CNI cleanup during rolling updates,

# preventing "failed to find plugin istio-cni" errors.

# Default K8s value is 30 seconds.

terminationGracePeriodSeconds: 30

# Revision is set as 'version' label and part of the resource names when installing multiple control planes.

revision: ""

# For Helm compatibility.

ownerName: ""

global:

# Default hub for Istio images.

# Releases are published to docker hub under 'istio' project.

# Dev builds from prow are on registry.istio.io/testing

hub: registry.istio.io/testing

# Default tag for Istio images.

tag: latest

# Variant of the image to use.

# Currently supported are: [debug, distroless]

variant: ""

# Specify image pull policy if default behavior isn't desired.

# Default behavior: latest images will be Always else IfNotPresent.

imagePullPolicy: ""

# change cni scope level to control logging out of istio-cni-node DaemonSet

logging:

level: info

logAsJson: false

# When enabled, default NetworkPolicy resources will be created

networkPolicy:

enabled: false

# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace

# to use for pulling any images in pods that reference this ServiceAccount.

# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)

# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.

# Must be set for any cluster configured with private docker registry.

imagePullSecrets: []

# - private-registry-key

# Default resources allocated

defaultResources:

requests:

cpu: 100m

memory: 100Mi

# In order to use native nftable rules instead of iptable rules, set this flag to true.

nativeNftables: false

# resourceScope controls what resources will be processed by helm.

# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.

# It can be one of:

# - all: all resources are processed

# - cluster: only cluster-scoped resources are processed

# - namespace: only namespace-scoped resources are processed

resourceScope: all

# A `key: value` mapping of environment variables to add to the pod

env: {}