Merge pull request #1 from thegippygeek/o11y-ob/initial-deploy

O11y ob/initial deploy
2020-03-17 21:46:41 +11:00 · 2020-03-17 21:46:41 +11:00 · 17e7fd2989
commit 17e7fd2989
parent ccff406cdc 3469a4c436
1323 changed files with 246968 additions and 78 deletions
--- a/139
+++ b/139
@ -0,0 +1,139 @@
+SHELL := /bin/bash #--rcfile ~/.bash_profile
+
+# COLORS
+GREEN  := $(shell tput -Txterm setaf 2)
+YELLOW := $(shell tput -Txterm setaf 3)
+WHITE  := $(shell tput -Txterm setaf 7)
+RESET  := $(shell tput -Txterm sgr0)
+TARGET_MAX_CHAR_NUM=20
+
+CLUSTER_NAME=o11y-ob
+PROJECTID=tonyh-gke-o11y-anz-openbanking
+ZONE=australia-southeast1-a
+ISTIO_VERSION=1.5.0
+
+a: help
+
+## Use Istio Version 1.5.0
+istio150:
+	PATH=`echo $PATH | sed -e 's/istio-1.3.5/istio-1.5.0/g'`
+
+## Use Istio Version 1.3.5
+istio135:
+	PATH=`echo $\PATH | sed -e 's/istio-1.5.0/istio-1.3.5/g'`
+
+## Create GKE Cluster with istio enabled
+cluster.create.istio:
+ 	@gcloud container clusters create ${CLUSTER_NAME} --enable-autoupgrade \
+	--enable-autoscaling --min-nodes=1 --max-nodes=10 --num-nodes=4 --zone=${ZONE} \
+	--addons=Istio --istio-config=auth=MTLS_PERMISSIVE \
+	--machine-type=n1-standard-2
+
+## Enable Istio on exisiting cluster
+cluster.enable.istio:
+	@gcloud beta container clusters update ${CLUSTER_NAME} \
+	--update-addons=Istio=ENABLED \
+	--zone=${ZONE}
+
+## Increase Cluster Size
+cluster.resize:
+	@gcloud container clusters resize o11y-ob --node-pool default-pool --num-nodes 6 --zone australia-southeast1-a
+
+
+## Create GKE Cluster
+cluster.create:
+	@gcloud container clusters create ${CLUSTER_NAME} --enable-autoupgrade \
+	--enable-autoscaling --min-nodes=1 --max-nodes=10 --num-nodes=4 --zone=${ZONE} \
+	--machine-type=n1-standard-2
+
+## Get Cluster Creds
+get.creds:
+	@gcloud container clusters get-credentials ${CLUSTER_NAME} \
+	--zone ${ZONE} \
+	--project ${PROJECTID}
+
+## Create istio-system namespace
+ns.create.istio-system:
+	@kubectl create -f istio-manifests/namespace.yaml
+
+## default ns istio enabled
+ns.istio.enabled:
+	@kubectl label namespace default istio-injection=enabled --overwrite
+## default ns istio disabled
+ns.istio.disabled:
+	@kubectl label namespace default istio-injection=disabled --overwrite
+
+## Installs Istio CRDS
+istio.init:
+	@helm template istio-${ISTIO_VERSION}/install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl apply -f -
+
+istio.init.delete:
+	@helm template istio-${ISTIO_VERSION}/install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl delete -f -
+
+
+## Generate Istio Template
+istio.template:
+	@helm template istio-${ISTIO_VERSION}/install/kubernetes/helm/istio --name istio --namespace istio-system \
+	--values istio-${ISTIO_VERSION}/install/kubernetes/helm/istio/values-istio-demo.yaml > istio-manifests/istio-demo.yaml
+
+## Deploy Istio Config
+istio.deploy: istio.template
+	@kubectl apply -f istio-manifests/istio-demo.yaml
+
+## Delete Istio Config
+istio.delete:
+	@kubectl delete -f istio-manifests/istio-demo.yaml
+
+#####################################################
+
+## Scale Loadgenartor to 0
+loadgen.off:
+	@kubectl scale deployment loadgenerator --replicas 0
+
+## Scale Loadgenartor to 1
+loadgen.on:
+	@kubectl scale deployment loadgenerator --replicas 1
+
+## Skaffold GCB
+skaffold.dev.gcp:
+	@skaffold dev --default-repo=asia.gcr.io/${PROJECTID} -p gcb --tail=false
+
+## Skaffold GCB Istio
+skaffold.dev.gcp.istio:
+	@skaffold dev --default-repo=asia.gcr.io/${PROJECTID} -p gcb-istio --tail=false
+
+## Skaffold GCB
+skaffold.run.gcp:
+	@skaffold run --default-repo=asia.gcr.io/${PROJECTID} -p gcb --tail=false
+
+## Skaffold GCB Istio
+skaffold.run.gcp.istio:
+	@skaffold run --default-repo=asia.gcr.io/${PROJECTID} -p gcb-istio --tail=false
+
+## Skaffold GCB Tracing
+skaffold.run.gcp.tracing:
+	@skaffold run --default-repo=asia.gcr.io/${PROJECTID} -p gcb-tracing --tail=false
+
+## Skaffold GCB Build
+skaffold.build.gcp:
+	@skaffold run --default-repo=asia.gcr.io/${PROJECTID} -p gcb --tail=false
+
+## Delete the GKE Cluster
+cluster.delete:
+	@gcloud container clusters delete ${CLUSTER_NAME} --zone ${ZONE}
+
+help:
+	@echo ''
+	@echo 'Usage:'
+	@echo '  $(YELLOW)make$(RESET) $(GREEN)<target>$(RESET)'
+	@echo ''
+	@echo 'Targets:'
+	@awk '/^[a-zA-Z\-\.\_0-9]+:/ { \
+		helpMessage = match(lastLine, /^## (.*)/); \
+		if (helpMessage) { \
+			helpCommand = substr($$1, 0, index($$1, ":")-1); \
+			helpMessage = substr(lastLine, RSTART + 3, RLENGTH); \
+			printf "  ${YELLOW}%-$(TARGET_MAX_CHAR_NUM)s${RESET} ${GREEN}%s${RESET}\n", helpCommand, helpMessage; \
+		} \
+	} \
+	{ lastLine = $$0 }' $(MAKEFILE_LIST)
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@ -1,4 +1,4 @@
-# This configuration file is used to build and deploy the app into a 
+# This configuration file is used to build and deploy the app into a
 # GKE cluster using Google Cloud Build.
 #
 # PREREQUISITES:
@ -13,11 +13,11 @@ steps:
 - id: 'Deploy application to cluster'
  name: 'gcr.io/k8s-skaffold/skaffold:v0.20.0'
  entrypoint: 'bash'
-  args: 
+  args:
  - '-c'
-  - > 
+  - >
    gcloud container clusters get-credentials --zone=$_ZONE $_CLUSTER;
-    skaffold run -f=skaffold.yaml --default-repo=gcr.io/$PROJECT_ID;
+    skaffold run -f=skaffold.yaml --default-repo=asia.gcr.io/$PROJECT_ID;

 # Add more power, and more time, for heavy Skaffold build
 timeout: '3600s'
--- a/istio-1.3.5/LICENSE
+++ b/istio-1.3.5/LICENSE
@ -0,0 +1,202 @@
+
+                                Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2016-2019 Istio Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
--- a/istio-1.3.5/README.md
+++ b/istio-1.3.5/README.md
@ -0,0 +1,110 @@
+[![Go Report Card](https://goreportcard.com/badge/github.com/istio/istio)](https://goreportcard.com/report/github.com/istio/istio)
+[![GoDoc](https://godoc.org/istio.io/istio?status.svg)](https://godoc.org/istio.io/istio)
+[![codecov.io](https://codecov.io/github/istio/istio/coverage.svg?branch=master)](https://codecov.io/github/istio/istio?branch=master)
+[![GolangCI](https://golangci.com/badges/github.com/istio/istio.svg)](https://golangci.com/r/github.com/istio/istio)
+
+# Istio
+
+An open platform to connect, manage, and secure microservices.
+
+- For in-depth information about how to use Istio, visit [istio.io](https://istio.io)                                   
+- To ask questions and get assistance from our community, visit [discuss.istio.io](https://discuss.istio.io)
+- To learn how to participate in our overall community, visit [our community page](https://istio.io/about/community)
+
+In this README:
+
+- [Introduction](#introduction)
+- [Repositories](#repositories)
+- [Issue management](#issue-management)
+
+In addition, here are some other documents you may wish to read:
+
+- [Istio Community](https://github.com/istio/community) - describes how to get involved and contribute to the Istio project
+- [Istio Developer's Guide](https://github.com/istio/istio/wiki/Preparing-for-Development) - explains how to set up and use an Istio development environment
+- [Project Conventions](https://github.com/istio/istio/wiki/Development-Conventions) - describes the conventions we use within the code base
+- [Creating Fast and Lean Code](https://github.com/istio/istio/wiki/Writing-Fast-and-Lean-Code) - performance-oriented advice and guidelines for the code base
+
+You'll find many other useful documents on our [Wiki](https://github.com/istio/istio/wiki).
+
+## Introduction
+
+Istio is an open platform for providing a uniform way to integrate
+microservices, manage traffic flow across microservices, enforce policies
+and aggregate telemetry data. Istio's control plane provides an abstraction
+layer over the underlying cluster management platform, such as Kubernetes.
+
+Istio is composed of these components:
+
+- **Envoy** - Sidecar proxies per microservice to handle ingress/egress traffic
+   between services in the cluster and from a service to external
+   services. The proxies form a _secure microservice mesh_ providing a rich
+   set of functions like discovery, rich layer-7 routing, circuit breakers,
+   policy enforcement and telemetry recording/reporting
+   functions.
+
+  > Note: The service mesh is not an overlay network. It
+  > simplifies and enhances how microservices in an application talk to each
+  > other over the network provided by the underlying platform.
+
+- **Mixer** - Central component that is leveraged by the proxies and microservices
+   to enforce policies such as authorization, rate limits, quotas, authentication, request
+   tracing and telemetry collection.
+
+- **Pilot** - A component responsible for configuring the proxies at runtime.
+
+- **Citadel** - A centralized component responsible for certificate issuance and rotation.
+
+- **Citadel Agent** - A per-node component responsible for certificate issuance and rotation.
+
+- **Galley**- Central component for validating, ingesting, aggregating, transforming and distributing config within Istio.
+
+Istio currently supports Kubernetes and Consul-based environments. We plan support for additional platforms such as
+Cloud Foundry, and Mesos in the near future.
+
+## Repositories
+
+The Istio project is divided across a few GitHub repositories.
+
+- [istio/istio](README.md). This is the main repository that you are
+currently looking at. It hosts Istio's core components and also
+the sample programs and the various documents that govern the Istio open source
+project. It includes:
+  - [security](security/). This directory contains security related code,
+including Citadel (acting as Certificate Authority), citadel agent, etc.
+  - [pilot](pilot/). This directory
+contains platform-specific code to populate the
+[abstract service model](https://istio.io/docs/concepts/traffic-management/overview.html), dynamically reconfigure the proxies
+when the application topology changes, as well as translate
+[routing rules](https://istio.io/docs/reference/config/istio.networking.v1alpha3/) into proxy specific configuration.
+  - [istioctl](istioctl/). This directory contains code for the
+[_istioctl_](https://istio.io/docs/reference/commands/istioctl.html) command line utility.
+  - [mixer](mixer/). This directory
+contains code to enforce various policies for traffic passing through the
+proxies, and collect telemetry data from proxies and services. There
+are plugins for interfacing with various cloud platforms, policy
+management services, and monitoring services.
+
+- [istio/api](https://github.com/istio/api). This repository defines
+component-level APIs and common configuration formats for the Istio platform.
+
+- [istio/proxy](https://github.com/istio/proxy). The Istio proxy contains
+extensions to the [Envoy proxy](https://github.com/envoyproxy/envoy) (in the form of
+Envoy filters), that allow the proxy to delegate policy enforcement
+decisions to Mixer.
+
+## Issue management
+
+We use GitHub combined with ZenHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:
+
+- **Epic**. An epic represents a feature area for Istio as a whole. Epics are fairly broad in scope and are basically product-level things.
+Each issue is ultimately part of an epic.
+
+- **Milestone**. Each issue is assigned a milestone. This is 0.1, 0.2, ..., or 'Nebulous Future'. The milestone indicates when we
+think the issue should get addressed.
+
+- **Priority/Pipeline**. Each issue has a priority which is represented by the Pipeline field within GitHub. Priority can be one of
+P0, P1, P2, or >P2. The priority indicates how important it is to address the issue within the milestone. P0 says that the
+milestone cannot be considered achieved if the issue isn't resolved.
+
+We don't annotate issues with Releases; Milestones are used instead. We don't use GitHub projects at all, that
+support is disabled for our organization.
--- a/istio-1.3.5/install/README.md
+++ b/istio-1.3.5/install/README.md
@ -0,0 +1,32 @@
+# Istio installation
+
+This directory contains the default Istio installation configuration in several
+different flavors. Also contained is the script for updating it.
+ 
+## updateVersion.sh
+
+The [updateVersion.sh](updateVersion.sh) script is used to update image versions in
+[../istio.VERSION](../istio.VERSION) and the istio installation yaml files.
+
+### Options
+
+* `-p <hub>,<tag>` new pilot image
+* `-x <hub>,<tag>` new mixer image
+* `-c <hub>,<tag>` new citadel image
+* `-g <hub>,<tag>` new galley image
+* `-a <hub>,<tag>` specifies same hub and tag for pilot, mixer, proxy, citadel and galley containers
+* `-o <hub>,<tag>` new proxy image
+* `-n <namespace>` namespace in which to install Istio control plane components (defaults to istio-system)
+* `-P` URL to download pilot debian packages
+* `-d <dir>` directory to store updated/generated files (optional, defaults to source code tree)
+
+Default values for the `-p`, `-x`, `-c`, `-o`, `-g` and `-a` options are as specified in `istio.VERSION`
+(i.e., they are left unchanged).
+
+### Examples
+
+Update the pilot and istioctl:
+
+```
+./updateVersion.sh -p "docker.io/istio,2017-05-09-06.14.22"
+```
--- a/istio-1.3.5/install/consul/README.md
+++ b/istio-1.3.5/install/consul/README.md
@ -0,0 +1,6 @@
+# Install Istio with Consul in a simple Docker Compose setup
+
+Please follow the installation instructions on [istio.io](https://istio.io/docs/setup/consul/).
+
+The install file `istio.yaml` deploys Istio Pilot, Consul, Registrator, and
+the Istio API server with etcd as Docker containers.
--- a/istio-1.3.5/install/consul/consul_config/agent-loglevel.json
+++ b/istio-1.3.5/install/consul/consul_config/agent-loglevel.json
@ -0,0 +1,3 @@
+{
+        "log_level": "INFO"
+}
--- a/istio-1.3.5/install/consul/consul_config/agent.json
+++ b/istio-1.3.5/install/consul/consul_config/agent.json
@ -0,0 +1,8 @@
+{
+        "client_addr": "0.0.0.0",
+        "leave_on_terminate": true,
+        "dns_config": {
+                "allow_stale": true,
+                "max_stale": "1s"
+        }
+}
--- a/istio-1.3.5/install/consul/consul_config/disable_update_check.json
+++ b/istio-1.3.5/install/consul/consul_config/disable_update_check.json
@ -0,0 +1,3 @@
+{
+        "disable_update_check": true
+}
--- a/istio-1.3.5/install/consul/consul_config/server.json
+++ b/istio-1.3.5/install/consul/consul_config/server.json
@ -0,0 +1,6 @@
+{
+        "ui": true,
+        "dns_config": {
+                "allow_stale": false
+        }
+}
--- a/istio-1.3.5/install/consul/istio.yaml
+++ b/istio-1.3.5/install/consul/istio.yaml
@ -0,0 +1,103 @@
+# GENERATED FILE. Use with Docker-Compose and consul
+# TO UPDATE, modify files in install/consul/templates and run install/updateVersion.sh
+version: '2'
+services:
+  etcd:
+    image: quay.io/coreos/etcd:latest
+    networks:
+      istiomesh:
+        aliases:
+          - etcd
+    ports:
+      - "4001:4001"
+      - "2380:2380"
+      - "2379:2379"
+    environment:
+      - SERVICE_IGNORE=1
+    command: ["/usr/local/bin/etcd", "-advertise-client-urls=http://0.0.0.0:2379", "-listen-client-urls=http://0.0.0.0:2379"]
+
+  istio-apiserver:
+    image: gcr.io/google_containers/kube-apiserver-amd64:v1.7.3
+    networks:
+      istiomesh:
+        ipv4_address: 172.28.0.13
+        aliases:
+          - apiserver
+    ports:
+      - "8080:8080"
+    privileged: true
+    environment:
+      - SERVICE_IGNORE=1
+    command: ["kube-apiserver", "--etcd-servers", "http://etcd:2379", "--service-cluster-ip-range", "10.99.0.0/16", "--insecure-port", "8080", "-v", "2", "--insecure-bind-address", "0.0.0.0"]
+
+  consul:
+    image: consul:1.3.0
+    networks:
+      istiomesh:
+        aliases:
+          - consul
+    ports:
+      - "8500:8500"
+      - "${DOCKER_GATEWAY}53:8600/udp"
+      - "8400:8400"
+      - "8502:8502"
+    environment:
+      - SERVICE_IGNORE=1
+      - DNS_RESOLVES=consul
+      - DNS_PORT=8600
+      - CONSUL_DATA_DIR=/consul/data
+      - CONSUL_CONFIG_DIR=/consul/config
+    entrypoint:
+      - "docker-entrypoint.sh"
+    command: ["agent", "-bootstrap", "-server", "-ui",
+              "-grpc-port", "8502"
+              ]
+    volumes:
+      - ./consul_config:/consul/config
+
+  registrator:
+    image: gliderlabs/registrator:master
+    networks:
+      istiomesh:
+    volumes:
+      - /var/run/docker.sock:/tmp/docker.sock
+    command: ["-internal", "-retry-attempts=-1", "consul://consul:8500"]
+
+  pilot:
+    image: docker.io/istio/pilot:1.3.5
+    networks:
+      istiomesh:
+        aliases:
+          - istio-pilot
+    expose:
+      - "15007"
+      - "15010"
+      - "15012"
+    ports:
+      - "8081:15007"
+    command: ["discovery",
+              "--httpAddr", ":15007",
+              "--registries", "Consul",
+              "--consulserverURL", "http://consul:8500",
+              "--kubeconfig", "/etc/istio/config/kubeconfig",
+              "--secureGrpcAddr", "",
+              ]
+    volumes:
+      - ./kubeconfig:/etc/istio/config/kubeconfig
+
+  zipkin:
+    image: docker.io/openzipkin/zipkin:2.7
+    networks:
+      istiomesh:
+        aliases:
+          - zipkin
+    ports:
+      - "9411:9411"
+
+networks:
+  istiomesh:
+    ipam:
+      driver: default
+      config:
+        - subnet: 172.28.0.0/16
+          gateway: 172.28.0.1
--- a/istio-1.3.5/install/consul/kubeconfig
+++ b/istio-1.3.5/install/consul/kubeconfig
@ -0,0 +1,11 @@
+apiVersion: v1
+clusters:
+- cluster:
+    server: http://istio-apiserver:8080
+  name: istio
+contexts:
+- context:
+    cluster: istio
+    user: ""
+  name: istio
+current-context: istio
--- a/istio-1.3.5/install/gcp/README.md
+++ b/istio-1.3.5/install/gcp/README.md
@ -0,0 +1,4 @@
+# Google Cloud Platform Installation
+
+This directory contains contributed solutions for installing Istio that are
+specific to Google Cloud Platform.
--- a/istio-1.3.5/install/gcp/bootstrap/gcp_envoy_bootstrap.json
+++ b/istio-1.3.5/install/gcp/bootstrap/gcp_envoy_bootstrap.json
@ -0,0 +1,79 @@
+{
+  "node": {
+    "id": "{{ .nodeID }}",
+    "cluster": "{{ .cluster }}",
+    "locality": {
+      {{ if .region }}
+      "region": "{{ .region }}",
+      {{ end }}
+      {{ if .zone }}
+      "zone": "{{ .zone }}",
+      {{ end }}
+      {{ if .sub_zone }}
+      "sub_zone": "{{ .sub_zone }}",
+      {{ end }}
+    },
+    "metadata": {{ .meta_json_str }}
+  },
+  "dynamic_resources": {
+    "lds_config": {
+      "ads": {}
+    },
+    "cds_config": {
+      "ads": {}
+    },
+    "ads_config": {
+      "api_type": "GRPC",
+      "grpc_services": [
+        {
+          "google_grpc": {
+            "target_uri": "{{ .discovery_address }}",
+            "stat_prefix": "googlegrpcxds",
+            "channel_credentials": {
+              "ssl_credentials": {
+                "root_certs": {
+                  "filename": "/etc/ssl/certs/ca-certificates.crt"
+                }
+              }
+            },
+            "call_credentials": {
+              "google_compute_engine": {}
+            }
+          }
+        }
+      ]
+    }
+  },
+  "cluster_manager": {
+    "load_stats_config": {
+      "api_type": "GRPC",
+      "grpc_services": [
+        {
+          "google_grpc": {
+            "target_uri": "{{ .discovery_address }}",
+            "stat_prefix": "googlegrpcxds",
+            "channel_credentials": {
+              "ssl_credentials": {
+                "root_certs": {
+                  "filename": "/etc/ssl/certs/ca-certificates.crt"
+                }
+              }
+            },
+            "call_credentials": {
+              "google_compute_engine": {}
+            }
+          }
+        }
+      ]
+    }
+  },
+  "admin": {
+    "access_log_path": "/dev/null",
+    "address": {
+      "socket_address": {
+        "address": "127.0.0.1",
+        "port_value": {{ .config.ProxyAdminPort }}
+      }
+    }
+  }
+}
--- a/istio-1.3.5/install/kubernetes/README.md
+++ b/istio-1.3.5/install/kubernetes/README.md
@ -0,0 +1,6 @@
+# Install Istio on an existing Kubernetes cluster
+
+Please follow the installation instructions on [istio.io](https://istio.io/docs/setup/kubernetes/).
+
+If you want to install Istio using the istio/istio repository instead of downloading a release,
+refer to the [developer wiki](https://github.com/istio/istio/wiki) for instructions.
--- a/istio-1.3.5/install/kubernetes/global-default-sidecar-scope.yaml
+++ b/istio-1.3.5/install/kubernetes/global-default-sidecar-scope.yaml
@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: istio-config
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: Sidecar
+metadata:
+  name: default-sidecar-scope
+  namespace: istio-config
+spec:
+  egress:
+    # If this config is applied, sidecars will only be able to talk to
+    # other services in the same namespace, in addition to istio-telemetry
+    # and istio-policy
+  - hosts:
+    - "./*"
+    - "istio-system/istio-telemetry.istio-system.svc.cluster.local"
+    - "istio-system/istio-policy.istio-system.svc.cluster.local"
+---
--- a/istio-1.3.5/install/kubernetes/helm/README.md
+++ b/istio-1.3.5/install/kubernetes/helm/README.md
@ -0,0 +1,7 @@
+# Installation using Helm
+
+Please follow the installation instructions from [istio.io](https://istio.io/docs/setup/kubernetes/install/helm/).
+
+# Development
+
+Future development for the installer is taking place on [istio/installer](https://github.com/istio/installer). Please add new features to this repository, as only bug fixes will be allowed here.
--- a/istio-1.3.5/install/kubernetes/helm/helm-service-account.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/helm-service-account.yaml
@ -0,0 +1,21 @@
+# Create a service account for Helm and grant the cluster admin role.
+# It is assumed that helm should be installed with this service account
+# (tiller).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tiller
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: tiller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: tiller
+  namespace: kube-system
--- a/istio-1.3.5/install/kubernetes/helm/istio-cni/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-cni/Chart.yaml
@ -0,0 +1,13 @@
+apiVersion: v1
+name: istio-cni
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2"
+description: Helm chart for istio-cni components
+keywords:
+  - istio-cni
+  - istio
+sources:
+  - http://github.com/istio/cni
+engine: gotpl
+icon: https://istio.io/favicons/android-192x192.png
--- a/istio-1.3.5/install/kubernetes/helm/istio-cni/templates/_labels.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio-cni/templates/_labels.tpl
@ -0,0 +1,10 @@
+{{- define "common_labels" }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    version: {{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+{{- end }}
+
+{{- define "common_template_labels" }}
+        version: {{ .Chart.Version }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-cni/templates/istio-cni.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-cni/templates/istio-cni.yaml
@ -0,0 +1,146 @@
+# Istio-CNI Version v0.1-dev
+#
+# This manifest installs the following component versions:
+#   istio-cni:v0.1
+
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: istio-cni
+rules:
+  - apiGroups: [""]
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-cni
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-cni
+subjects:
+- kind: ServiceAccount
+  name: istio-cni
+  namespace: {{ .Release.Namespace }}
+
+---
+# This ConfigMap is used to configure a self-hosted Istio CNI installation.
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: istio-cni-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- template "common_labels" . }}
+data:
+  # The CNI network configuration to add to the plugin chain on each node.  The special
+  # values in this config will be automatically populated.
+  cni_network_config: |-
+        {
+          "type": "istio-cni",
+          "log_level": {{ quote .Values.logLevel }},
+          "kubernetes": {
+              "kubeconfig": "__KUBECONFIG_FILEPATH__",
+              "cni_bin_dir": {{ quote .Values.cniBinDir }},
+              "exclude_namespaces": [ {{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }}, {{ end }}{{ quote $ns }}{{ end }} ]
+          }
+        }
+
+---
+
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: istio-cni-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: istio-cni-node
+    {{- template "common_labels" . }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: istio-cni-node
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  template:
+    metadata:
+      labels:
+        k8s-app: istio-cni-node
+      annotations:
+        # This, along with the CriticalAddonsOnly toleration below,
+        # marks the pod as a critical add-on, ensuring it gets
+        # priority scheduling and that its resources are reserved
+        # if it ever gets evicted.
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+    spec:
+      nodeSelector:
+        beta.kubernetes.io/os: linux
+      hostNetwork: true
+      tolerations:
+        # Make sure istio-cni-node gets scheduled on all nodes.
+        - effect: NoSchedule
+          operator: Exists
+        # Mark the pod as a critical add-on for rescheduling.
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      priorityClassName: system-cluster-critical
+      serviceAccountName: istio-cni
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+          image: {{ .Values.hub }}/install-cni:{{ .Values.tag }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          command: ["/install-cni.sh"]
+          env:
+{{- if .Values.cniConfFileName }}
+            # Name of the CNI config file to create.
+            - name: CNI_CONF_NAME
+              value: "{{ .Values.cniConfFileName }}"
+{{- end }}
+            # The CNI network config to install on each node.
+            - name: CNI_NETWORK_CONFIG
+              valueFrom:
+                configMapKeyRef:
+                  name: istio-cni-config
+                  key: cni_network_config
+            - name: CNI_NET_DIR
+              value: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ default "/opt/cni/bin" .Values.cniBinDir }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: istio-cni
+  namespace: {{ .Release.Namespace }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-cni/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-cni/values.yaml
@ -0,0 +1,21 @@
+hub: docker.io/istio
+tag: 1.3.5
+pullPolicy: Always
+
+logLevel: info
+
+# Configuration file to insert istio-cni plugin configuration
+# by default this will be the first file found in the cni-conf-dir
+# Example
+# cniConfFileName: 10-calico.conflist
+
+# CNI bin and conf dir override settings
+# defaults:
+cniBinDir: /opt/cni/bin
+cniConfDir: /etc/cni/net.d
+cniConfFileName: ""
+
+excludeNamespaces:
+  - istio-system
+
+
--- a/istio-1.3.5/install/kubernetes/helm/istio-cni/values_gke.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-cni/values_gke.yaml
@ -0,0 +1,18 @@
+hub: docker.io/istio
+tag: 1.3.5
+pullPolicy: Always
+
+logLevel: info
+
+# Configuration file to insert istio-cni plugin configuration
+# by default this will be the first file found in the cni-conf-dir
+# Example
+# cniConfFileName: 10-calico.conflist
+
+# CNI bin and conf dir override settings
+# defaults:
+cniBinDir: /home/kubernetes/bin
+cniConfDir: /etc/cni/net.d
+
+excludeNamespaces:
+  - istio-system
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/Chart.yaml
@ -0,0 +1,13 @@
+apiVersion: v1
+name: istio-init
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2-0"
+description: Helm chart to initialize Istio CRDs
+keywords:
+  - istio
+  - crd
+sources:
+  - http://github.com/istio/istio
+engine: gotpl
+icon: https://istio.io/favicons/android-192x192.png
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/README.md
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/README.md
@ -0,0 +1,77 @@
+# Istio
+
+[Istio](https://istio.io/) is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
+
+## Introduction
+
+This chart bootstraps Istio's [CRDs](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions)
+which are an internal implementation detail of Istio.  CRDs define data structures for storing runtime configuration
+specified by a human operator.
+
+This chart must be run to completion prior to running other Istio charts, or other Istio charts will fail to initialize.
+
+## Prerequisites
+
+- Kubernetes 1.9 or newer cluster with RBAC (Role-Based Access Control) enabled is required
+- Helm 2.7.2 or newer or alternately the ability to modify RBAC rules is also required
+
+## Resources Required
+
+The chart deploys pods that consume minimal resources.
+
+## Installing the Chart
+
+1. If a service account has not already been installed for Tiller, install one:
+    ```
+    $ kubectl apply -f install/kubernetes/helm/helm-service-account.yaml
+    ```
+
+1. If Tiller has not already been installed in your cluster, Install Tiller on your cluster with the service account:
+    ```
+    $ helm init --service-account tiller
+    ```
+
+1. Install the Istio initializer chart:
+    ```
+    $ helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
+    ```
+
+    > Although you can install the `istio-init` chart to any namespace, it is recommended to install `istio-init` in the same namespace(`istio-system`) as other Istio charts.
+
+## Configuration
+
+The Helm chart ships with reasonable defaults.  There may be circumstances in which defaults require overrides.
+To override Helm values, use `--set key=value` argument during the `helm install` command.  Multiple `--set` operations may be used in the same Helm operation.
+
+Helm charts expose configuration options which are currently in alpha.  The currently exposed options are explained in the following table:
+
+| Parameter | Description | Values | Default |
+| --- | --- | --- | --- |
+| `global.hub` | Specifies the HUB for most images used by Istio | registry/namespace | `docker.io/istio` |
+| `global.tag` | Specifies the TAG for most images used by Istio | valid image tag | `0.8.latest` |
+| `global.imagePullPolicy` | Specifies the image pull policy | valid image pull policy | `IfNotPresent` |
+
+
+## Uninstalling the Chart
+
+> Uninstalling this chart does not delete Istio's registered CRDs.  Istio by design expects
+> CRDs to leak into the Kubernetes environment.  As CRDs contain all runtime configuration
+> data in CustomResources the Istio designers feel it is better to explicitly delete this
+> configuration rather then unexpectedly lose it.
+
+To uninstall/delete the `istio-init` release but continue to track the release:
+    ```
+    $ helm delete istio-init
+    ```
+
+To uninstall/delete the `istio-init` release completely and make its name free for later use:
+    ```
+    $ helm delete --purge istio-init
+    ```
+
+> Warning: Deleting CRDs will delete any configuration that you have made to Istio.
+
+To delete all CRDs, run the following command
+    ```
+    $ for i in istio-init/files/*crd*yaml; do kubectl delete -f $i; done
+    ```
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-10.yaml
@ -0,0 +1,636 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: virtualservices.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: VirtualService
+    listKind: VirtualServiceList
+    plural: virtualservices
+    singular: virtualservice
+    shortNames:
+    - vs
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+  additionalPrinterColumns:
+  - JSONPath: .spec.gateways
+    description: The names of gateways and sidecars that should apply these routes
+    name: Gateways
+    type: string
+  - JSONPath: .spec.hosts
+    description: The destination hosts to which traffic is being sent
+    name: Hosts
+    type: string
+  - JSONPath: .metadata.creationTimestamp
+    description: |-
+      CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+      Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+    name: Age
+    type: date
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: destinationrules.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: DestinationRule
+    listKind: DestinationRuleList
+    plural: destinationrules
+    singular: destinationrule
+    shortNames:
+    - dr
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+  additionalPrinterColumns:
+  - JSONPath: .spec.host
+    description: The name of a service from the service registry
+    name: Host
+    type: string
+  - JSONPath: .metadata.creationTimestamp
+    description: |-
+      CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+      Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+    name: Age
+    type: date
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceentries.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: ServiceEntry
+    listKind: ServiceEntryList
+    plural: serviceentries
+    singular: serviceentry
+    shortNames:
+    - se
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+  additionalPrinterColumns:
+  - JSONPath: .spec.hosts
+    description: The hosts associated with the ServiceEntry
+    name: Hosts
+    type: string
+  - JSONPath: .spec.location
+    description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL)
+    name: Location
+    type: string
+  - JSONPath: .spec.resolution
+    description: Service discovery mode for the hosts (NONE, STATIC, or DNS)
+    name: Resolution
+    type: string
+  - JSONPath: .metadata.creationTimestamp
+    description: |-
+      CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+      Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+    name: Age
+    type: date
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: Gateway
+    plural: gateways
+    singular: gateway
+    shortNames:
+    - gw
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: envoyfilters.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: EnvoyFilter
+    plural: envoyfilters
+    singular: envoyfilter
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: clusterrbacconfigs.rbac.istio.io
+  labels:
+    app: istio-pilot
+    istio: rbac
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: rbac.istio.io
+  names:
+    kind: ClusterRbacConfig
+    plural: clusterrbacconfigs
+    singular: clusterrbacconfig
+    categories:
+    - istio-io
+    - rbac-istio-io
+  scope: Cluster
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: policies.authentication.istio.io
+  labels:
+    app: istio-citadel
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: authentication.istio.io
+  names:
+    kind: Policy
+    plural: policies
+    singular: policy
+    categories:
+    - istio-io
+    - authentication-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: meshpolicies.authentication.istio.io
+  labels:
+    app: istio-citadel
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: authentication.istio.io
+  names:
+    kind: MeshPolicy
+    listKind: MeshPolicyList
+    plural: meshpolicies
+    singular: meshpolicy
+    categories:
+    - istio-io
+    - authentication-istio-io
+  scope: Cluster
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: httpapispecbindings.config.istio.io
+  labels:
+    app: istio-mixer
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: HTTPAPISpecBinding
+    plural: httpapispecbindings
+    singular: httpapispecbinding
+    categories:
+    - istio-io
+    - apim-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: httpapispecs.config.istio.io
+  labels:
+    app: istio-mixer
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: HTTPAPISpec
+    plural: httpapispecs
+    singular: httpapispec
+    categories:
+    - istio-io
+    - apim-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: quotaspecbindings.config.istio.io
+  labels:
+    app: istio-mixer
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: QuotaSpecBinding
+    plural: quotaspecbindings
+    singular: quotaspecbinding
+    categories:
+    - istio-io
+    - apim-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: quotaspecs.config.istio.io
+  labels:
+    app: istio-mixer
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: QuotaSpec
+    plural: quotaspecs
+    singular: quotaspec
+    categories:
+    - istio-io
+    - apim-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: rules.config.istio.io
+  labels:
+    app: mixer
+    package: istio.io.mixer
+    istio: core
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: rule
+    plural: rules
+    singular: rule
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: attributemanifests.config.istio.io
+  labels:
+    app: mixer
+    package: istio.io.mixer
+    istio: core
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: attributemanifest
+    plural: attributemanifests
+    singular: attributemanifest
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: rbacconfigs.rbac.istio.io
+  labels:
+    app: mixer
+    package: istio.io.mixer
+    istio: rbac
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: rbac.istio.io
+  names:
+    kind: RbacConfig
+    plural: rbacconfigs
+    singular: rbacconfig
+    categories:
+    - istio-io
+    - rbac-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: serviceroles.rbac.istio.io
+  labels:
+    app: mixer
+    package: istio.io.mixer
+    istio: rbac
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: rbac.istio.io
+  names:
+    kind: ServiceRole
+    plural: serviceroles
+    singular: servicerole
+    categories:
+    - istio-io
+    - rbac-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: servicerolebindings.rbac.istio.io
+  labels:
+    app: mixer
+    package: istio.io.mixer
+    istio: rbac
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: rbac.istio.io
+  names:
+    kind: ServiceRoleBinding
+    plural: servicerolebindings
+    singular: servicerolebinding
+    categories:
+    - istio-io
+    - rbac-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  additionalPrinterColumns:
+  - JSONPath: .spec.roleRef.name
+    description: The name of the ServiceRole object being referenced
+    name: Reference
+    type: string
+  - JSONPath: .metadata.creationTimestamp
+    description: |-
+      CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+      Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+    name: Age
+    type: date
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: adapters.config.istio.io
+  labels:
+    app: mixer
+    package: adapter
+    istio: mixer-adapter
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: adapter
+    plural: adapters
+    singular: adapter
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: instances.config.istio.io
+  labels:
+    app: mixer
+    package: instance
+    istio: mixer-instance
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: instance
+    plural: instances
+    singular: instance
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: templates.config.istio.io
+  labels:
+    app: mixer
+    package: template
+    istio: mixer-template
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: template
+    plural: templates
+    singular: template
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: handlers.config.istio.io
+  labels:
+    app: mixer
+    package: handler
+    istio: mixer-handler
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: config.istio.io
+  names:
+    kind: handler
+    plural: handlers
+    singular: handler
+    categories:
+    - istio-io
+    - policy-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha2
+      served: true
+      storage: true
+---
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-11.yaml
@ -0,0 +1,26 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: sidecars.networking.istio.io
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: networking.istio.io
+  names:
+    kind: Sidecar
+    plural: sidecars
+    singular: sidecar
+    categories:
+    - istio-io
+    - networking-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha3
+      served: true
+      storage: true
+---
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-12.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-12.yaml
@ -0,0 +1,24 @@
+kind: CustomResourceDefinition
+apiVersion: apiextensions.k8s.io/v1beta1
+metadata:
+  name: authorizationpolicies.rbac.istio.io
+  labels:
+    app: istio-pilot
+    istio: rbac
+    heritage: Tiller
+    release: istio
+spec:
+  group: rbac.istio.io
+  names:
+    kind: AuthorizationPolicy
+    plural: authorizationpolicies
+    singular: authorizationpolicy
+    categories:
+      - istio-io
+      - rbac-istio-io
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+---
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-certmanager-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-certmanager-10.yaml
@ -0,0 +1,91 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterissuers.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: certmanager.k8s.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  names:
+    kind: ClusterIssuer
+    plural: clusterissuers
+  scope: Cluster
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: issuers.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  group: certmanager.k8s.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  names:
+    kind: Issuer
+    plural: issuers
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.conditions[?(@.type=="Ready")].status
+      name: Ready
+      type: string
+    - JSONPath: .spec.secretName
+      name: Secret
+      type: string
+    - JSONPath: .spec.issuerRef.name
+      name: Issuer
+      type: string
+      priority: 1
+    - JSONPath: .status.conditions[?(@.type=="Ready")].message
+      name: Status
+      type: string
+      priority: 1
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  scope: Namespaced
+  names:
+    kind: Certificate
+    plural: certificates
+    shortNames:
+      - cert
+      - certs
+---
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-certmanager-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/files/crd-certmanager-11.yaml
@ -0,0 +1,80 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: orders.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.state
+      name: State
+      type: string
+    - JSONPath: .spec.issuerRef.name
+      name: Issuer
+      type: string
+      priority: 1
+    - JSONPath: .status.reason
+      name: Reason
+      type: string
+      priority: 1
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  names:
+    kind: Order
+    plural: orders
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: challenges.certmanager.k8s.io
+  labels:
+    app: certmanager
+    chart: certmanager
+    heritage: Tiller
+    release: istio
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  additionalPrinterColumns:
+    - JSONPath: .status.state
+      name: State
+      type: string
+    - JSONPath: .spec.dnsName
+      name: Domain
+      type: string
+    - JSONPath: .status.reason
+      name: Reason
+      type: string
+    - JSONPath: .metadata.creationTimestamp
+      description: |-
+        CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+        Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+      name: Age
+      type: date
+  group: certmanager.k8s.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  names:
+    kind: Challenge
+    plural: challenges
+  scope: Namespaced
+---
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/clusterrole.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/clusterrole.yaml
@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-init-{{ .Release.Namespace }}
+  labels:
+    app: istio-init
+    istio: init
+rules:
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create", "get", "list", "watch", "patch"]
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/clusterrolebinding.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/clusterrolebinding.yaml
@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-init-admin-role-binding-{{ .Release.Namespace }}
+  labels:
+    app: istio-init
+    istio: init
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-init-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istio-init-service-account
+    namespace: {{ .Release.Namespace }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-10.yaml
@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-crd-10
+data:
+  crd-10.yaml: |-
+{{.Files.Get "files/crd-10.yaml" | printf "%s" | indent 4}}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-11.yaml
@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-crd-11
+data:
+  crd-11.yaml: |-
+{{.Files.Get "files/crd-11.yaml" | printf "%s" | indent 4}}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-12.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-12.yaml
@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-crd-12
+data:
+  crd-12.yaml: |-
+{{.Files.Get "files/crd-12.yaml" | printf "%s" | indent 4}}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-certmanager-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-certmanager-10.yaml
@ -0,0 +1,10 @@
+{{- if .Values.certmanager.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-crd-certmanager-10
+data:
+  crd-certmanager-10.yaml: |-
+{{.Files.Get "files/crd-certmanager-10.yaml" | printf "%s" | indent 4}}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-certmanager-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/configmap-crd-certmanager-11.yaml
@ -0,0 +1,10 @@
+{{- if .Values.certmanager.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-crd-certmanager-11
+data:
+  crd-certmanager-11.yaml: |-
+{{.Files.Get "files/crd-certmanager-11.yaml" | printf "%s" | indent 4}}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-10.yaml
@ -0,0 +1,26 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-init-crd-10-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-init-service-account
+      containers:
+      - name: istio-init-crd-10
+        image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        volumeMounts:
+        - name: crd-10
+          mountPath: /etc/istio/crd-10
+          readOnly: true
+        command: ["kubectl",  "apply", "-f", "/etc/istio/crd-10/crd-10.yaml"]
+      volumes:
+      - name: crd-10
+        configMap:
+          name: istio-crd-10
+      restartPolicy: OnFailure
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-11.yaml
@ -0,0 +1,26 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-init-crd-11-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-init-service-account
+      containers:
+      - name: istio-init-crd-11
+        image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        volumeMounts:
+        - name: crd-11
+          mountPath: /etc/istio/crd-11
+          readOnly: true
+        command: ["kubectl",  "apply", "-f", "/etc/istio/crd-11/crd-11.yaml"]
+      volumes:
+      - name: crd-11
+        configMap:
+          name: istio-crd-11
+      restartPolicy: OnFailure
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-12.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-12.yaml
@ -0,0 +1,26 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-init-crd-12-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-init-service-account
+      containers:
+        - name: istio-init-crd-12
+          image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          volumeMounts:
+            - name: crd-12
+              mountPath: /etc/istio/crd-12
+              readOnly: true
+          command: ["kubectl",  "apply", "-f", "/etc/istio/crd-12/crd-12.yaml"]
+      volumes:
+        - name: crd-12
+          configMap:
+            name: istio-crd-12
+      restartPolicy: OnFailure
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-certmanager-10.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-certmanager-10.yaml
@ -0,0 +1,28 @@
+{{- if .Values.certmanager.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-init-crd-certmanager-10-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-init-service-account
+      containers:
+      - name: istio-init-crd-certmanager-10
+        image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        volumeMounts:
+        - name: crd-certmanager-10
+          mountPath: /etc/istio/crd-certmanager-10
+          readOnly: true
+        command: ["kubectl",  "apply", "-f", "/etc/istio/crd-certmanager-10/crd-certmanager-10.yaml"]
+      volumes:
+      - name: crd-certmanager-10
+        configMap:
+          name: istio-crd-certmanager-10
+      restartPolicy: OnFailure
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-certmanager-11.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/job-crd-certmanager-11.yaml
@ -0,0 +1,28 @@
+{{- if .Values.certmanager.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: istio-init-crd-certmanager-11-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-init-service-account
+      containers:
+      - name: istio-init-crd-certmanager-11
+        image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        volumeMounts:
+        - name: crd-certmanager-11
+          mountPath: /etc/istio/crd-certmanager-11
+          readOnly: true
+        command: ["kubectl",  "apply", "-f", "/etc/istio/crd-certmanager-11/crd-certmanager-11.yaml"]
+      volumes:
+      - name: crd-certmanager-11
+        configMap:
+          name: istio-crd-certmanager-11
+      restartPolicy: OnFailure
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/templates/serviceaccount.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/templates/serviceaccount.yaml
@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: istio-init-service-account
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istio-init
+    istio: init
+
--- a/istio-1.3.5/install/kubernetes/helm/istio-init/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio-init/values.yaml
@ -0,0 +1,16 @@
+global:
+  # Default hub for Istio images.
+  # Releases are published to docker hub under 'istio' project.
+  # Daily builds from prow are on gcr.io
+  hub: docker.io/istio
+
+  # Default tag for Istio images.
+  tag: 1.3.5
+
+  # imagePullPolicy is applied to istio control plane components.
+  # local tests require IfNotPresent, to avoid uploading to dockerhub.
+  # TODO: Switch to Always as default, and override in the local tests.
+  imagePullPolicy: IfNotPresent
+
+certmanager:
+  enabled: false
--- a/istio-1.3.5/install/kubernetes/helm/istio/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/Chart.yaml
@ -0,0 +1,17 @@
+apiVersion: v1
+name: istio
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2-0"
+description: Helm chart for all istio components
+keywords:
+  - istio
+  - security
+  - sidecarInjectorWebhook
+  - mixer
+  - pilot
+  - galley
+sources:
+  - http://github.com/istio/istio
+engine: gotpl
+icon: https://istio.io/favicons/android-192x192.png
--- a/istio-1.3.5/install/kubernetes/helm/istio/README.md
+++ b/istio-1.3.5/install/kubernetes/helm/istio/README.md
@ -0,0 +1,140 @@
+# Istio
+
+[Istio](https://istio.io/) is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
+
+
+
+The documentation here is for developers only, please follow the installation instructions from [istio.io](https://istio.io/docs/setup/kubernetes/install/helm/) for all other uses.
+
+## Introduction
+
+This chart bootstraps all Istio [components](https://istio.io/docs/concepts/what-is-istio/) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Chart Details
+
+This chart can install multiple Istio components as subcharts:
+- ingressgateway
+- egressgateway
+- sidecarInjectorWebhook
+- galley
+- mixer
+- pilot
+- security(citadel)
+- grafana
+- prometheus
+- tracing(jaeger)
+- kiali
+
+To enable or disable each component, change the corresponding `enabled` flag.
+
+## Prerequisites
+
+- Kubernetes 1.9 or newer cluster with RBAC (Role-Based Access Control) enabled is required
+- Helm 2.7.2 or newer or alternately the ability to modify RBAC rules is also required
+- If you want to enable automatic sidecar injection, Kubernetes 1.9+ with `admissionregistration` API is required, and `kube-apiserver` process must have the `admission-control` flag set with the `MutatingAdmissionWebhook` and `ValidatingAdmissionWebhook` admission controllers added and listed in the correct order.
+- The `istio-init` chart must be run to completion prior to install the `istio` chart.
+
+## Resources Required
+
+The chart deploys pods that consume minimum resources as specified in the resources configuration parameter.
+
+## Installing the Chart
+
+1. If a service account has not already been installed for Tiller, install one:
+    ```
+    $ kubectl apply -f install/kubernetes/helm/helm-service-account.yaml
+    ```
+
+1. Install Tiller on your cluster with the service account:
+    ```
+    $ helm init --service-account tiller
+    ```
+
+1. Set and create the namespace where Istio was installed:
+    ```
+    $ NAMESPACE=istio-system
+    $ kubectl create ns $NAMESPACE
+    ```
+
+1. If you are enabling `kiali`, you need to create the secret that contains the username and passphrase for `kiali` dashboard:
+    ```
+    $ echo -n 'admin' | base64
+    YWRtaW4=
+    $ echo -n '1f2d1e2e67df' | base64
+    MWYyZDFlMmU2N2Rm
+    $ cat <<EOF | kubectl apply -f -
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: kiali
+      namespace: $NAMESPACE
+      labels:
+        app: kiali
+    type: Opaque
+    data:
+      username: YWRtaW4=
+      passphrase: MWYyZDFlMmU2N2Rm
+    EOF
+    ```
+
+1. If you are using security mode for Grafana, create the secret first as follows:
+
+    - Encode username, you can change the username to the name as you want:
+    ```
+    $ echo -n 'admin' | base64
+    YWRtaW4=
+    ```
+
+    - Encode passphrase, you can change the passphrase to the passphrase as you want:
+    ```
+    $ echo -n '1f2d1e2e67df' | base64
+    MWYyZDFlMmU2N2Rm
+    ```
+
+    - Create secret for Grafana:
+    ```
+    $ cat <<EOF | kubectl apply -f -
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: grafana
+      namespace: $NAMESPACE
+      labels:
+        app: grafana
+    type: Opaque
+    data:
+      username: YWRtaW4=
+      passphrase: MWYyZDFlMmU2N2Rm
+    EOF
+    ```
+
+1. To install the chart with the release name `istio` in namespace $NAMESPACE you defined above:
+
+    - With [automatic sidecar injection](https://istio.io/docs/setup/kubernetes/sidecar-injection/#automatic-sidecar-injection) (requires Kubernetes >=1.9.0):
+    ```
+    $ helm install istio --name istio --namespace $NAMESPACE
+    ```
+
+    - Without the sidecar injection webhook:
+    ```
+    $ helm install istio --name istio --namespace $NAMESPACE --set sidecarInjectorWebhook.enabled=false
+    ```
+
+## Configuration
+
+The Helm chart ships with reasonable defaults.  There may be circumstances in which defaults require overrides.
+To override Helm values, use `--set key=value` argument during the `helm install` command.  Multiple `--set` operations may be used in the same Helm operation.
+
+Helm charts expose configuration options which are currently in alpha.  The currently exposed options can be found [here](https://istio.io/docs/reference/config/installation-options/).
+
+## Uninstalling the Chart
+
+To uninstall/delete the `istio` release but continue to track the release:
+    ```
+    $ helm delete istio
+    ```
+
+To uninstall/delete the `istio` release completely and make its name free for later use:
+    ```
+    $ helm delete --purge istio
+    ```
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/Chart.yaml
@ -0,0 +1,6 @@
+apiVersion: v1
+description: A Helm chart for Kubernetes
+name: certmanager
+version: 1.3.5
+appVersion: 0.6.2
+tillerVersion: ">=2.7.2"
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/NOTES.txt
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/NOTES.txt
@ -0,0 +1,6 @@
+certmanager has been deployed successfully!
+
+More information on the different types of issuers and how to configure them
+can be found in our documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/issuers.html
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/_helpers.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/_helpers.tpl
@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "certmanager.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "certmanager.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "certmanager.chart" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/deployment.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/deployment.yaml
@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: certmanager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: certmanager
+  template:
+    metadata:
+      labels:
+        app: certmanager
+        chart: {{ template "certmanager.chart" . }}
+        heritage: {{ .Release.Service }}
+        release: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+        {{- end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: certmanager
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+      containers:
+      - name: certmanager
+        image: "{{ .Values.hub }}/{{ .Values.image }}:{{ .Values.tag }}"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        args:
+        - --cluster-resource-namespace=$(POD_NAMESPACE)
+        - --leader-election-namespace=$(POD_NAMESPACE)
+      {{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 8 }}
+      {{- end }}
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        resources:
+{{ toYaml .Values.resources | indent 10 }}
+      {{- if .Values.podDnsPolicy }}
+      dnsPolicy: {{ .Values.podDnsPolicy }}
+      {{- end }}
+      {{- if .Values.podDnsConfig }}
+      dnsConfig:
+{{ toYaml .Values.podDnsConfig | indent 8 }}
+      {{- end }}
+      affinity:
+      {{- include "nodeaffinity" . | indent 6 }}
+      {{- include "podAntiAffinity" . | indent 6 }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 6 }}
+      {{- else if .Values.global.defaultTolerations }}
+      tolerations:
+{{ toYaml .Values.global.defaultTolerations | indent 6 }}
+      {{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/issuer.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/issuer.yaml
@ -0,0 +1,37 @@
+---
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: {{ .Values.email }}
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    http01: {}
+---
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: {{ .Values.email }}
+    privateKeySecretRef:
+      name: letsencrypt
+    http01: {}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/poddisruptionbudget.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/poddisruptionbudget.yaml
@ -0,0 +1,24 @@
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: certmanager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    version: {{ .Chart.Version }}
+    {{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 4 }}
+    {{- end }}
+spec:
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+{{ include "podDisruptionBudget.spec" .Values.global.defaultPodDisruptionBudget }}
+{{- end }}
+  selector:
+    matchLabels:
+      app: certmanager
+      release: {{ .Release.Name }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/rbac.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/rbac.yaml
@ -0,0 +1,37 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: certmanager
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+  - apiGroups: ["certmanager.k8s.io"]
+    resources: ["certificates", "certificates/finalizers", "issuers", "clusterissuers", "orders", "orders/finalizers", "challenges"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets", "events", "services", "pods"]
+    verbs: ["*"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: certmanager
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: certmanager
+subjects:
+  - name: certmanager
+    namespace: {{ .Release.Namespace }}
+    kind: ServiceAccount
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/serviceaccount.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/templates/serviceaccount.yaml
@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: certmanager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: certmanager
+    chart: {{ template "certmanager.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/certmanager/values.yaml
@ -0,0 +1,34 @@
+# Certmanager uses ACME to sign certificates. Since Istio gateways are
+# mounting the TLS secrets the Certificate CRDs must be created in the
+# istio-system namespace. Once the certificate has been created, the
+# gateway must be updated by adding 'secretVolumes'. After the gateway
+# restart, DestinationRules can be created using the ACME-signed certificates.
+enabled: false
+replicaCount: 1
+hub: quay.io/jetstack
+image: cert-manager-controller
+tag: v0.6.2
+resources: {}
+nodeSelector: {}
+tolerations: []
+
+# Specify the pod anti-affinity that allows you to constrain which nodes
+# your pod is eligible to be scheduled based on labels on pods that are
+# already running on the node rather than based on labels on nodes.
+# There are currently two types of anti-affinity:
+#    "requiredDuringSchedulingIgnoredDuringExecution"
+#    "preferredDuringSchedulingIgnoredDuringExecution"
+# which denote "hard" vs. "soft" requirements, you can define your values
+# in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
+# correspondingly.
+# For example:
+# podAntiAffinityLabelSelector:
+# - key: security
+#   operator: In
+#   values: S1,S2
+#   topologyKey: "kubernetes.io/hostname"
+# This pod anti-affinity rule says that the pod requires not to be scheduled
+# onto a node if that node is already running a pod with label having key
+# "security" and value "S1".
+podAntiAffinityLabelSelector: []
+podAntiAffinityTermLabelSelector: []
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/Chart.yaml
@ -0,0 +1,13 @@
+apiVersion: v1
+name: galley
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2"
+description: Helm chart for galley deployment
+keywords:
+  - istio
+  - galley
+sources:
+  - http://github.com/istio/istio
+engine: gotpl
+icon: https://istio.io/favicons/android-192x192.png
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/_helpers.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/_helpers.tpl
@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "galley.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "galley.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "galley.chart" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/clusterrole.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/clusterrole.yaml
@ -0,0 +1,42 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-galley-{{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["validatingwebhookconfigurations"]
+  verbs: ["*"]
+- apiGroups: ["config.istio.io"] # istio mixer CRD watcher
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["networking.istio.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["authentication.istio.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["rbac.istio.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["extensions","apps"]
+  resources: ["deployments"]
+  resourceNames: ["istio-galley"]
+  verbs: ["get"]
+- apiGroups: [""]
+  resources: ["pods", "nodes", "services", "endpoints", "namespaces"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["extensions"]
+  resources: ["ingresses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["extensions"]
+  resources: ["deployments/finalizers"]
+  resourceNames: ["istio-galley"]
+  verbs: ["update"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["get", "list", "watch"]
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/clusterrolebinding.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/clusterrolebinding.yaml
@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-galley-admin-role-binding-{{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-galley-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istio-galley-service-account
+    namespace: {{ .Release.Namespace }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/configmap.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/configmap.yaml
@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-galley-configuration
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: galley
+data:
+{{- if .Values.global.configValidation }}
+  validatingwebhookconfiguration.yaml: |-
+    {{- include "validatingwebhookconfiguration.yaml.tpl" . | indent 4}}
+{{- end}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/deployment.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/deployment.yaml
@ -0,0 +1,127 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istio-galley
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: galley
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      istio: galley
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "galley.name" . }}
+        chart: {{ template "galley.chart" . }}
+        heritage: {{ .Release.Service }}
+        release: {{ .Release.Name }}      
+        istio: galley
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-galley-service-account
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: galley
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
+{{- end }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+          - containerPort: 443
+          - containerPort: {{ .Values.global.monitoringPort }}
+          - containerPort: 9901
+          command:
+          - /usr/local/bin/galley
+          - server
+          - --meshConfigFile=/etc/mesh-config/mesh
+          - --livenessProbeInterval=1s
+          - --livenessProbePath=/healthliveness
+          - --readinessProbePath=/healthready
+          - --readinessProbeInterval=1s
+          - --deployment-namespace={{ .Release.Namespace }}
+{{- if $.Values.global.controlPlaneSecurityEnabled}}
+          - --insecure=false
+{{- else }}
+          - --insecure=true
+{{- end }}
+{{- if not $.Values.global.useMCP }}
+          - --enable-server=false
+{{- end }}
+{{- if not $.Values.global.configValidation }}
+          - --enable-validation=false
+{{- end }}
+          - --validation-webhook-config-file
+          - /etc/config/validatingwebhookconfiguration.yaml
+          - --monitoringPort={{ .Values.global.monitoringPort }}
+{{- if $.Values.global.logging.level }}
+          - --log_output_level={{ $.Values.global.logging.level }}
+{{- end}}
+          volumeMounts:
+          - name: certs
+            mountPath: /etc/certs
+            readOnly: true
+          - name: config
+            mountPath: /etc/config
+            readOnly: true
+          - name: mesh-config
+            mountPath: /etc/mesh-config
+            readOnly: true
+          livenessProbe:
+            exec:
+              command:
+                - /usr/local/bin/galley
+                - probe
+                - --probe-path=/healthliveness
+                - --interval=10s
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - /usr/local/bin/galley
+                - probe
+                - --probe-path=/healthready
+                - --interval=10s
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | indent 12 }}
+{{- end }}
+      volumes:
+      - name: certs
+        secret:
+          secretName: istio.istio-galley-service-account
+      - name: config
+        configMap:
+          name: istio-galley-configuration
+      - name: mesh-config
+        configMap:
+          name: istio
+      affinity:
+      {{- include "nodeaffinity" . | indent 6 }}
+      {{- include "podAntiAffinity" . | indent 6 }}
+      {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 6 }}
+      {{- else if .Values.global.defaultTolerations }}
+      tolerations:
+{{ toYaml .Values.global.defaultTolerations | indent 6 }}
+      {{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/poddisruptionbudget.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/poddisruptionbudget.yaml
@ -0,0 +1,22 @@
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: istio-galley
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: galley
+spec:
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+{{ include "podDisruptionBudget.spec" .Values.global.defaultPodDisruptionBudget }}
+{{- end }}
+  selector:
+    matchLabels:
+      app: {{ template "galley.name" . }}
+      release: {{ .Release.Name }}
+      istio: galley
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/service.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/service.yaml
@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: istio-galley
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: galley
+spec:
+  ports:
+  - port: 443
+    name: https-validation
+  - port: {{ .Values.global.monitoringPort }}
+    name: http-monitoring
+  - port: 9901
+    name: grpc-mcp
+  selector:
+    istio: galley
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/serviceaccount.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/serviceaccount.yaml
@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: istio-galley-service-account
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/validatingwebhookconfiguration.yaml.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/templates/validatingwebhookconfiguration.yaml.tpl
@ -0,0 +1,118 @@
+{{ define "validatingwebhookconfiguration.yaml.tpl" }}
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istio-galley
+  labels:
+    app: {{ template "galley.name" . }}
+    chart: {{ template "galley.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: galley
+webhooks:
+  - name: pilot.validation.istio.io
+    clientConfig:
+      service:
+        name: istio-galley
+        namespace: {{ .Release.Namespace }}
+        path: "/admitpilot"
+      caBundle: ""
+    rules:
+      - operations:
+        - CREATE
+        - UPDATE
+        apiGroups:
+        - config.istio.io
+        apiVersions:
+        - v1alpha2
+        resources:
+        - httpapispecs
+        - httpapispecbindings
+        - quotaspecs
+        - quotaspecbindings
+      - operations:
+        - CREATE
+        - UPDATE
+        apiGroups:
+        - rbac.istio.io
+        apiVersions:
+        - "*"
+        resources:
+        - "*"
+      - operations:
+        - CREATE
+        - UPDATE
+        apiGroups:
+        - authentication.istio.io
+        apiVersions:
+        - "*"
+        resources:
+        - "*"
+      - operations:
+        - CREATE
+        - UPDATE
+        apiGroups:
+        - networking.istio.io
+        apiVersions:
+        - "*"
+        resources:
+        - destinationrules
+        - envoyfilters
+        - gateways
+        - serviceentries
+        - sidecars
+        - virtualservices
+    failurePolicy: Fail
+    sideEffects: None
+  - name: mixer.validation.istio.io
+    clientConfig:
+      service:
+        name: istio-galley
+        namespace: {{ .Release.Namespace }}
+        path: "/admitmixer"
+      caBundle: ""
+    rules:
+      - operations:
+        - CREATE
+        - UPDATE
+        apiGroups:
+        - config.istio.io
+        apiVersions:
+        - v1alpha2
+        resources:
+        - rules
+        - attributemanifests
+        - circonuses
+        - deniers
+        - fluentds
+        - kubernetesenvs
+        - listcheckers
+        - memquotas
+        - noops
+        - opas
+        - prometheuses
+        - rbacs
+        - solarwindses
+        - stackdrivers
+        - cloudwatches
+        - dogstatsds
+        - statsds
+        - stdios
+        - apikeys
+        - authorizations
+        - checknothings
+        # - kuberneteses
+        - listentries
+        - logentries
+        - metrics
+        - quotas
+        - reportnothings
+        - tracespans
+        - adapters
+        - handlers
+        - instances
+        - templates
+        - zipkins
+    failurePolicy: Fail
+    sideEffects: None
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/galley/values.yaml
@ -0,0 +1,31 @@
+#
+# galley configuration
+#
+enabled: true
+replicaCount: 1
+rollingMaxSurge: 100%
+rollingMaxUnavailable: 25%
+image: galley
+nodeSelector: {}
+tolerations: []
+
+# Specify the pod anti-affinity that allows you to constrain which nodes
+# your pod is eligible to be scheduled based on labels on pods that are
+# already running on the node rather than based on labels on nodes.
+# There are currently two types of anti-affinity:
+#    "requiredDuringSchedulingIgnoredDuringExecution"
+#    "preferredDuringSchedulingIgnoredDuringExecution"
+# which denote "hard" vs. "soft" requirements, you can define your values
+# in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
+# correspondingly.
+# For example:
+# podAntiAffinityLabelSelector:
+# - key: security
+#   operator: In
+#   values: S1,S2
+#   topologyKey: "kubernetes.io/hostname"
+# This pod anti-affinity rule says that the pod requires not to be scheduled
+# onto a node if that node is already running a pod with label having key
+# "security" and value "S1".
+podAntiAffinityLabelSelector: []
+podAntiAffinityTermLabelSelector: []
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/Chart.yaml
@ -0,0 +1,15 @@
+apiVersion: v1
+name: gateways
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2"
+description: Helm chart for deploying Istio gateways
+keywords:
+  - istio
+  - ingressgateway
+  - egressgateway
+  - gateways
+sources:
+  - http://github.com/istio/istio
+engine: gotpl
+icon: https://istio.io/favicons/android-192x192.png
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/_affinity.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/_affinity.tpl
@ -0,0 +1,93 @@
+{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}
+
+{{- define "gatewaynodeaffinity" }}
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+    {{- include "gatewayNodeAffinityRequiredDuringScheduling" . }}
+    preferredDuringSchedulingIgnoredDuringExecution:
+    {{- include "gatewayNodeAffinityPreferredDuringScheduling" . }}
+{{- end }}
+
+{{- define "gatewayNodeAffinityRequiredDuringScheduling" }}
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: beta.kubernetes.io/arch
+          operator: In
+          values:
+        {{- range $key, $val := .root.Values.global.arch }}
+          {{- if gt ($val | int) 0 }}
+          - {{ $key | quote }}
+          {{- end }}
+        {{- end }}
+        {{- $nodeSelector := default .root.Values.global.defaultNodeSelector .nodeSelector -}}
+        {{- range $key, $val := $nodeSelector }}
+        - key: {{ $key }}
+          operator: In
+          values:
+          - {{ $val | quote }}
+        {{- end }}
+{{- end }}
+
+{{- define "gatewayNodeAffinityPreferredDuringScheduling" }}
+  {{- range $key, $val := .root.Values.global.arch }}
+    {{- if gt ($val | int) 0 }}
+    - weight: {{ $val | int }}
+      preference:
+        matchExpressions:
+        - key: beta.kubernetes.io/arch
+          operator: In
+          values:
+          - {{ $key | quote }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+
+{{- define "gatewaypodAntiAffinity" }}
+{{- if or .podAntiAffinityLabelSelector .podAntiAffinityTermLabelSelector}}
+  podAntiAffinity:
+    {{- if .podAntiAffinityLabelSelector }}
+    requiredDuringSchedulingIgnoredDuringExecution:
+    {{- include "gatewaypodAntiAffinityRequiredDuringScheduling" . }}
+    {{- end }}
+    {{- if .podAntiAffinityTermLabelSelector }}
+    preferredDuringSchedulingIgnoredDuringExecution:
+    {{- include "gatewaypodAntiAffinityPreferredDuringScheduling" . }}
+    {{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "gatewaypodAntiAffinityRequiredDuringScheduling" }}
+    {{- range $index, $item := .podAntiAffinityLabelSelector }}
+    - labelSelector:
+        matchExpressions:
+        - key: {{ $item.key }}
+          operator: {{ $item.operator }}
+          {{- if $item.values }}
+          values:
+          {{- $vals := split "," $item.values }}
+          {{- range $i, $v := $vals }}
+          - {{ $v | quote }}
+          {{- end }}
+          {{- end }}
+      topologyKey: {{ $item.topologyKey }}
+    {{- end }}
+{{- end }}
+
+{{- define "gatewaypodAntiAffinityPreferredDuringScheduling" }}
+    {{- range $index, $item := .podAntiAffinityTermLabelSelector }}
+    - podAffinityTerm:
+        labelSelector:
+          matchExpressions:
+          - key: {{ $item.key }}
+            operator: {{ $item.operator }}
+            {{- if $item.values }}
+            values:
+            {{- $vals := split "," $item.values }}
+            {{- range $i, $v := $vals }}
+            - {{ $v | quote }}
+            {{- end }}
+            {{- end }}
+        topologyKey: {{ $item.topologyKey }}
+      weight: 100
+    {{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/_helpers.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/_helpers.tpl
@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "gateway.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "gateway.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "gateway.chart" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/autoscale.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/autoscale.yaml
@ -0,0 +1,31 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if and $spec.enabled $spec.autoscaleEnabled $spec.autoscaleMin $spec.autoscaleMax }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $key }}
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+  labels:
+    chart: {{ template "gateway.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+spec:
+  maxReplicas: {{ $spec.autoscaleMax }}
+  minReplicas: {{ $spec.autoscaleMin }}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $key }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ $spec.cpu.targetAverageUtilization }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/deployment.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/deployment.yaml
@ -0,0 +1,330 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if $spec.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $key }}
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+  labels:
+    chart: {{ template "gateway.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+spec:
+{{- if not $spec.autoscaleEnabled }}
+{{- if $spec.replicaCount }}
+  replicas: {{ $spec.replicaCount }}
+{{- else }}
+  replicas: 1
+{{- end }}
+{{- end }}
+  selector:
+    matchLabels:
+      {{- range $key, $val := $spec.labels }}
+      {{ $key }}: {{ $val }}
+      {{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ $spec.rollingMaxSurge }}
+      maxUnavailable: {{ $spec.rollingMaxUnavailable }}
+  template:
+    metadata:
+      labels:
+        chart: {{ template "gateway.chart" $ }}
+        heritage: {{ $.Release.Service }}
+        release: {{ $.Release.Name }}
+        {{- range $key, $val := $spec.labels }}
+        {{ $key }}: {{ $val }}
+        {{- end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if $spec.podAnnotations }}
+{{ toYaml $spec.podAnnotations | indent 8 }}
+{{ end }}
+    spec:
+      serviceAccountName: {{ $key }}-service-account
+{{- if $.Values.global.priorityClassName }}
+      priorityClassName: "{{ $.Values.global.priorityClassName }}"
+{{- end }}
+{{- if $.Values.global.proxy.enableCoreDump }}
+      initContainers:
+        - name: enable-core-dump
+          image: {{ $.Values.global.proxy.enableCoreDumpImage }}
+          imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
+          command:
+            - /bin/sh
+          args:
+            - -c
+            - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
+          securityContext:
+            privileged: true
+{{- end }}
+      containers:
+{{- if $spec.sds }}
+{{- if $spec.sds.enabled }}
+        - name: ingress-sds
+{{- if contains "/" $spec.sds.image }}
+          image: "{{ $spec.sds.image }}"
+{{- else }}
+          image: "{{ $.Values.global.hub }}/{{ $spec.sds.image }}:{{ $.Values.global.tag }}"
+{{- end }}
+          imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
+          resources:
+{{- if $spec.sds.resources }}
+{{ toYaml $spec.sds.resources | indent 12 }}
+{{- else }}
+{{ toYaml $.Values.global.defaultResources | indent 12 }}
+{{- end }}
+          env:
+          - name: "ENABLE_WORKLOAD_SDS"
+            value: "false"
+          - name: "ENABLE_INGRESS_GATEWAY_SDS"
+            value: "true"
+          - name: "INGRESS_GATEWAY_NAMESPACE"
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          volumeMounts:
+          - name: ingressgatewaysdsudspath
+            mountPath: /var/run/ingress_gateway
+{{- end }}
+{{- end }}
+        - name: istio-proxy
+{{- if contains "/" $.Values.global.proxy.image }}
+          image: "{{ $.Values.global.proxy.image }}"
+{{- else }}
+          image: "{{ $.Values.global.hub }}/{{ $.Values.global.proxy.image }}:{{ $.Values.global.tag }}"
+{{- end }}
+          imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
+          ports:
+            {{- range $key, $val := $spec.ports }}
+            - containerPort: {{ $val.port }}
+            {{- end }}
+            - containerPort: 15090
+              protocol: TCP
+              name: http-envoy-prom
+          args:
+          - proxy
+          - router
+          - --domain
+          - $(POD_NAMESPACE).svc.{{ $.Values.global.proxy.clusterDomain }}
+        {{- if $.Values.global.proxy.logLevel }}
+          - --proxyLogLevel={{ $.Values.global.proxy.logLevel }}
+        {{- end}}
+        {{- if $.Values.global.proxy.componentLogLevel }}
+          - --proxyComponentLogLevel={{ $.Values.global.proxy.componentLogLevel }}
+        {{- end}}
+        {{- if $.Values.global.logging.level }}
+          - --log_output_level={{ $.Values.global.logging.level }}
+        {{- end}}
+          - --drainDuration
+          - '45s' #drainDuration
+          - --parentShutdownDuration
+          - '1m0s' #parentShutdownDuration
+          - --connectTimeout
+          - '10s' #connectTimeout
+          - --serviceCluster
+          - {{ $key }}
+          - --zipkinAddress
+        {{- if $.Values.global.tracer.zipkin.address }}
+          - {{ $.Values.global.tracer.zipkin.address }}
+        {{- else if $.Values.global.istioNamespace }}
+          - zipkin.{{ $.Values.global.istioNamespace }}:9411
+        {{- else }}
+          - zipkin:9411
+        {{- end }}
+        {{- if $.Values.global.proxy.envoyStatsd.enabled }}
+          - --statsdUdpAddress
+          - {{ $.Values.global.proxy.envoyStatsd.host }}:{{ $.Values.global.proxy.envoyStatsd.port }}
+        {{- end }}
+        {{- if $.Values.global.proxy.envoyMetricsService.enabled }}
+          - --envoyMetricsServiceAddress
+          - {{ $.Values.global.proxy.envoyMetricsService.host }}:{{ $.Values.global.proxy.envoyMetricsService.port }}
+        {{- end }}
+        {{- if $.Values.global.proxy.envoyAccessLogService.enabled }}
+          - --envoyAccessLogService
+          {{- with  $.Values.global.proxy.envoyAccessLogService }}
+          - '{"address":"{{ .host }}:{{.port }}"{{ if .tlsSettings }},"tlsSettings":{{ .tlsSettings | toJson }}{{- end }}{{ if .tcpKeepalive }},"tcpKeepalive":{{ .tcpKeepalive | toJson }}{{- end }}}'
+          {{- end }}
+        {{- end }}
+          - --proxyAdminPort
+          - "15000"
+          - --statusPort
+          - "15020"
+        {{- if $.Values.global.controlPlaneSecurityEnabled }}
+          - --controlPlaneAuthPolicy
+          - MUTUAL_TLS
+          - --discoveryAddress
+          {{- if $.Values.global.istioNamespace }}
+          - istio-pilot.{{ $.Values.global.istioNamespace }}:15011
+          {{- else }}
+          - istio-pilot:15011
+          {{- end }}
+        {{- else }}
+          - --controlPlaneAuthPolicy
+          - NONE
+          - --discoveryAddress
+          {{- if $.Values.global.istioNamespace }}
+          - istio-pilot.{{ $.Values.global.istioNamespace }}:15010
+          {{- else }}
+          - istio-pilot:15010
+          {{- end }}
+          {{- if $spec.applicationPorts }}
+          - --applicationPorts
+          - "{{ $spec.applicationPorts }}"
+          {{- end }}
+        {{- end }}
+        {{- if $.Values.global.trustDomain }}
+          - --trust-domain={{ $.Values.global.trustDomain }}
+        {{- end }}
+          readinessProbe:
+            failureThreshold: 30
+            httpGet:
+              path: /healthz/ready
+              port: 15020
+              scheme: HTTP
+            initialDelaySeconds: 1
+            periodSeconds: 2
+            successThreshold: 1
+            timeoutSeconds: 1
+          resources:
+{{- if $spec.resources }}
+{{ toYaml $spec.resources | indent 12 }}
+{{- else }}
+{{ toYaml $.Values.global.defaultResources | indent 12 }}
+{{- end }}
+          env:
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: INSTANCE_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.podIP
+          - name: HOST_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.hostIP
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.serviceAccountName
+          - name: ISTIO_META_POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: ISTIO_META_CONFIG_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          - name: SDS_ENABLED
+            value: "{{ $.Values.global.sds.enabled }}"
+          - name: ISTIO_META_WORKLOAD_NAME
+            value: {{ $key }}
+          - name: ISTIO_META_OWNER
+            value: kubernetes://api/apps/v1/namespaces/{{ $spec.namespace | default $.Release.Namespace }}/deployments/{{ $key }}
+          {{- if $spec.sds }}
+          {{- if $spec.sds.enabled }}
+          - name: ISTIO_META_USER_SDS
+            value: "true"
+          {{- end }}
+          {{- end }}
+          {{- if $spec.env }}
+          {{- range $key, $val := $spec.env }}
+          - name: {{ $key }}
+            value: {{ $val }}
+          {{- end }}
+          {{- end }}
+          volumeMounts:
+          {{- if $.Values.global.sds.enabled }}
+          - name: sdsudspath
+            mountPath: /var/run/sds
+            readOnly: true
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+          {{- end }}
+          {{- if $spec.sds }}
+          {{- if $spec.sds.enabled }}
+          - name: ingressgatewaysdsudspath
+            mountPath: /var/run/ingress_gateway
+          {{- end }}
+          {{- end }}
+          - name: istio-certs
+            mountPath: /etc/certs
+            readOnly: true
+          {{- range $spec.secretVolumes }}
+          - name: {{ .name }}
+            mountPath: {{ .mountPath | quote }}
+            readOnly: true
+          {{- end }}
+{{- if $spec.additionalContainers }}
+{{ toYaml $spec.additionalContainers | indent 8 }}
+{{- end }}
+      volumes:
+      {{- if $spec.sds }}
+      {{- if $spec.sds.enabled }}
+      - name: ingressgatewaysdsudspath
+        emptyDir: {}
+      {{- end }}
+      {{- end }}
+      {{- if $.Values.global.sds.enabled }}
+      - name: sdsudspath
+        hostPath:
+          path: /var/run/sds
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ $.Values.global.sds.token.aud }}
+      {{- end }}
+      - name: istio-certs
+        secret:
+          secretName: istio.{{ $key }}-service-account
+          optional: true
+      {{- range $spec.secretVolumes }}
+      - name: {{ .name }}
+        secret:
+          secretName: {{ .secretName | quote }}
+          optional: true
+      {{- end }}
+      {{- range $spec.configVolumes }}
+      - name: {{ .name }}
+        configMap:
+          name: {{ .configMapName | quote }}
+          optional: true
+      {{- end }}
+      affinity:
+      {{- include "gatewaynodeaffinity" (dict "root" $ "nodeSelector" $spec.nodeSelector) | indent 6 }}
+      {{- include "gatewaypodAntiAffinity" (dict "podAntiAffinityLabelSelector" $spec.podAntiAffinityLabelSelector "podAntiAffinityTermLabelSelector" $spec.podAntiAffinityTermLabelSelector) | indent 6 }}
+      {{- if $spec.tolerations }}
+      tolerations:
+{{ toYaml $spec.tolerations | indent 6 }}
+      {{- else if $.Values.global.defaultTolerations }}
+      tolerations:
+{{ toYaml $.Values.global.defaultTolerations | indent 6 }}
+      {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/poddisruptionbudget.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/poddisruptionbudget.yaml
@ -0,0 +1,31 @@
+{{- range $key, $spec := .Values }}
+{{- if and (ne $key "enabled") }}
+{{- if $spec.enabled }}
+{{- if $.Values.global.defaultPodDisruptionBudget.enabled }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $key }}
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+  labels:
+    chart: {{ template "gateway.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+spec:
+{{- if $.Values.global.defaultPodDisruptionBudget.enabled }}
+{{ include "podDisruptionBudget.spec" $.Values.global.defaultPodDisruptionBudget }}
+{{- end }}
+  selector:
+    matchLabels:
+      release: {{ $.Release.Name }}
+      {{- range $key, $val := $spec.labels }}
+      {{ $key }}: {{ $val }}
+      {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/preconfigured.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/preconfigured.yaml
@ -0,0 +1,239 @@
+{{- if .Values.global.k8sIngress.enabled }}
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: istio-autogenerated-k8s-ingress
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  selector:
+    istio: {{ .Values.global.k8sIngress.gatewayName }}
+  servers:
+  - port:
+      number: 80
+      protocol: HTTP2
+      name: http
+    hosts:
+    - "*"
+{{ if .Values.global.k8sIngress.enableHttps }}
+  - port:
+      number: 443
+      protocol: HTTPS
+      name: https-default
+    tls:
+      mode: SIMPLE
+      serverCertificate: /etc/istio/ingress-certs/tls.crt
+      privateKey: /etc/istio/ingress-certs/tls.key
+    hosts:
+    - "*"
+{{ end }}    
+---    
+{{ end }}
+
+{{- if .Values.global.meshExpansion.enabled }}
+{{- if .Values.global.meshExpansion.useILB }}
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: meshexpansion-ilb-gateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  selector:
+    istio: ilbgateway
+  servers:
+  - port:
+      number: 15011
+      protocol: TCP
+      name: tcp-pilot
+    hosts:
+    - "*"
+  - port:
+      number: 8060
+      protocol: TCP
+      name: tcp-citadel
+    hosts:
+    - "*"
+  - port:
+      number: 15004
+      name: tls-mixer
+      protocol: TLS
+    tls:
+      mode: AUTO_PASSTHROUGH
+    hosts:
+    - "*"
+---
+{{- else }}
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: meshexpansion-gateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  selector:
+  {{- range $key, $spec := .Values }}
+  {{- if eq $key "istio-ingressgateway" }}
+  {{- if $spec.enabled }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  servers:
+  - port:
+      number: 15011
+      protocol: TCP
+      name: tcp-pilot
+    hosts:
+    - "*"
+  - port:
+      number: 8060
+      protocol: TCP
+      name: tcp-citadel
+    hosts:
+    - "*"
+  - port:
+      number: 15004
+      name: tls-mixer
+      protocol: TLS
+    tls:
+      mode: AUTO_PASSTHROUGH
+    hosts:
+    - "*"
+---
+{{- end }}
+{{- end }}
+
+{{- if .Values.global.multiCluster.enabled }}
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: istio-multicluster-egressgateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  selector:
+  {{- range $key, $spec := .Values }}
+  {{- if eq $key "istio-egressgateway" }}
+  {{- if $spec.enabled }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  servers:
+  - hosts:
+    - "*.global"
+    port:
+      name: tls
+      number: 15443
+      protocol: TLS
+    tls:
+      mode: AUTO_PASSTHROUGH
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: istio-multicluster-ingressgateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  selector:
+  {{- range $key, $spec := .Values }}
+  {{- if eq $key "istio-ingressgateway" }}
+  {{- if $spec.enabled }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  servers:
+  - hosts:
+    - "*.global"
+    port:
+      name: tls
+      number: 15443
+      protocol: TLS
+    tls:
+      mode: AUTO_PASSTHROUGH
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: istio-multicluster-ingressgateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  workloadLabels:
+  {{- range $key, $spec := .Values }}
+  {{- if eq $key "istio-ingressgateway" }}
+  {{- if $spec.enabled }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  filters:
+  - listenerMatch:
+      portNumber: 15443
+      listenerType: GATEWAY
+    insertPosition:
+      index: AFTER
+      relativeTo: envoy.filters.network.sni_cluster
+    filterName: envoy.filters.network.tcp_cluster_rewrite
+    filterType: NETWORK
+    filterConfig:
+      cluster_pattern: "\\.global$"
+      cluster_replacement: ".svc.{{ .Values.global.proxy.clusterDomain }}"
+---
+## To ensure all traffic to *.global is using mTLS
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: istio-multicluster-destinationrule
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "gateway.name" . }}
+    chart: {{ template "gateway.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  host: "*.global"
+  {{- if .Values.global.defaultConfigVisibilitySettings }}
+  exportTo:
+  - '*'
+  {{- end }}
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/role.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/role.yaml
@ -0,0 +1,18 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if $spec.enabled }}
+{{- if ($spec.sds) and (eq $spec.sds.enabled true) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $key }}-sds
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list"]
+---
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/rolebindings.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/rolebindings.yaml
@ -0,0 +1,21 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if $spec.enabled }}
+{{- if ($spec.sds) and (eq $spec.sds.enabled true) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $key }}-sds
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $key }}-sds
+subjects:
+- kind: ServiceAccount
+  name: {{ $key }}-service-account
+---
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/service.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/service.yaml
@ -0,0 +1,59 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if $spec.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $key }}
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+  annotations:
+    {{- range $key, $val := $spec.serviceAnnotations }}
+    {{ $key }}: {{ $val | quote }}
+    {{- end }}
+  labels:
+    chart: {{ template "gateway.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+spec:
+{{- if $spec.loadBalancerIP }}
+  loadBalancerIP: "{{ $spec.loadBalancerIP }}"
+{{- end }}
+{{- if $spec.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml $spec.loadBalancerSourceRanges | indent 4 }}
+{{- end }}
+{{- if $spec.externalTrafficPolicy }}
+  externalTrafficPolicy: {{$spec.externalTrafficPolicy }}
+{{- end }}
+{{- if $spec.externalIPs }}
+  externalIPs:
+{{ toYaml $spec.externalIPs | indent 4 }}
+{{- end }}
+  type: {{ .type }}
+  selector:
+    release: {{ $.Release.Name }}
+    {{- range $key, $val := $spec.labels }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+  ports:
+    {{- range $key, $val := $spec.ports }}
+    -
+      {{- range $pkey, $pval := $val }}
+      {{ $pkey}}: {{ $pval }}
+      {{- end }}
+    {{- end }}
+    {{- if $.Values.global.meshExpansion.enabled }}
+    {{- range $key, $val := $spec.meshExpansionPorts }}
+    -
+      {{- range $pkey, $pval := $val }}
+      {{ $pkey}}: {{ $pval }}
+      {{- end }}
+    {{- end }}
+    {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/serviceaccount.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/templates/serviceaccount.yaml
@ -0,0 +1,24 @@
+{{- range $key, $spec := .Values }}
+{{- if ne $key "enabled" }}
+{{- if $spec.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+{{- if $.Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range $.Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: {{ $key }}-service-account
+  namespace: {{ $spec.namespace | default $.Release.Namespace }}
+  labels:
+    app: {{ $spec.labels.app }}
+    chart: {{ template "gateway.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
+
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/gateways/values.yaml
@ -0,0 +1,287 @@
+#
+# Gateways Configuration
+# By default (if enabled) a pair of Ingress and Egress Gateways will be created for the mesh.
+# You can add more gateways in addition to the defaults but make sure those are uniquely named
+# and that NodePorts are not conflicting.
+# Disable specifc gateway by setting the `enabled` to false.
+#
+enabled: true
+
+istio-ingressgateway:
+  enabled: true
+  #
+  # Secret Discovery Service (SDS) configuration for ingress gateway.
+  #
+  sds:
+    # If true, ingress gateway fetches credentials from SDS server to handle TLS connections.
+    enabled: false
+    # SDS server that watches kubernetes secrets and provisions credentials to ingress gateway.
+    # This server runs in the same pod as ingress gateway.
+    image: node-agent-k8s
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        cpu: 2000m
+        memory: 1024Mi
+
+  labels:
+    app: istio-ingressgateway
+    istio: ingressgateway
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  # specify replicaCount when autoscaleEnabled: false
+  # replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+  cpu:
+    targetAverageUtilization: 80
+  loadBalancerIP: ""
+  loadBalancerSourceRanges: []
+  externalIPs: []
+  serviceAnnotations: {}
+  podAnnotations: {}
+  type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be
+  #externalTrafficPolicy: Local #change to Local to preserve source IP or Cluster for default behaviour or leave commented out
+  ports:
+    ## You can add custom gateway ports
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+  - port: 15020
+    targetPort: 15020
+    name: status-port
+  - port: 80
+    targetPort: 80
+    name: http2
+    nodePort: 31380
+  - port: 443
+    name: https
+    nodePort: 31390
+  # Example of a port to add. Remove if not needed
+  - port: 31400
+    name: tcp
+    nodePort: 31400
+  ### PORTS FOR UI/metrics #####
+  ## Disable if not needed
+  - port: 15029
+    targetPort: 15029
+    name: https-kiali
+  - port: 15030
+    targetPort: 15030
+    name: https-prometheus
+  - port: 15031
+    targetPort: 15031
+    name: https-grafana
+  - port: 15032
+    targetPort: 15032
+    name: https-tracing
+    # This is the port where sni routing happens
+  - port: 15443
+    targetPort: 15443
+    name: tls
+  #### MESH EXPANSION PORTS  ########
+  # Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
+  # to pilot/citadel if global.meshExpansion settings are enabled.
+  # Delete these ports if mesh expansion is not enabled, to avoid
+  # exposing unnecessary ports on the web.
+  # You can remove these ports if you are not using mesh expansion
+  meshExpansionPorts:
+  - port: 15011
+    targetPort: 15011
+    name: tcp-pilot-grpc-tls
+  - port: 15004
+    targetPort: 15004
+    name: tcp-mixer-grpc-tls
+  - port: 8060
+    targetPort: 8060
+    name: tcp-citadel-grpc-tls
+  - port: 853
+    targetPort: 853
+    name: tcp-dns-tls
+  ####### end MESH EXPANSION PORTS ######
+  ##############
+  secretVolumes:
+  - name: ingressgateway-certs
+    secretName: istio-ingressgateway-certs
+    mountPath: /etc/istio/ingressgateway-certs
+  - name: ingressgateway-ca-certs
+    secretName: istio-ingressgateway-ca-certs
+    mountPath: /etc/istio/ingressgateway-ca-certs
+  ### Advanced options ############
+
+  # Ports to explicitly check for readiness. If configured, the readiness check will expect a
+  # listener on these ports. A comma separated list is expected, such as "80,443".
+  #
+  # Warning: If you do not have a gateway configured for the ports provided, this check will always
+  # fail. This is intended for use cases where you always expect to have a listener on the port,
+  # such as 80 or 443 in typical setups.
+  applicationPorts: ""
+
+  env:
+    # A gateway with this mode ensures that pilot generates an additional
+    # set of clusters for internal services but without Istio mTLS, to
+    # enable cross cluster routing.
+    ISTIO_META_ROUTER_MODE: "sni-dnat"
+  nodeSelector: {}
+  tolerations: []
+
+  # Specify the pod anti-affinity that allows you to constrain which nodes
+  # your pod is eligible to be scheduled based on labels on pods that are
+  # already running on the node rather than based on labels on nodes.
+  # There are currently two types of anti-affinity:
+  #    "requiredDuringSchedulingIgnoredDuringExecution"
+  #    "preferredDuringSchedulingIgnoredDuringExecution"
+  # which denote "hard" vs. "soft" requirements, you can define your values
+  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
+  # correspondingly.
+  # For example:
+  # podAntiAffinityLabelSelector:
+  # - key: security
+  #   operator: In
+  #   values: S1,S2
+  #   topologyKey: "kubernetes.io/hostname"
+  # This pod anti-affinity rule says that the pod requires not to be scheduled
+  # onto a node if that node is already running a pod with label having key
+  # "security" and value "S1".
+  podAntiAffinityLabelSelector: []
+  podAntiAffinityTermLabelSelector: []
+
+istio-egressgateway:
+  enabled: false
+  labels:
+    app: istio-egressgateway
+    istio: egressgateway
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  # specify replicaCount when autoscaleEnabled: false
+  # replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+  cpu:
+    targetAverageUtilization: 80
+  serviceAnnotations: {}
+  podAnnotations: {}
+  type: ClusterIP #change to NodePort or LoadBalancer if need be
+  ports:
+  - port: 80
+    name: http2
+  - port: 443
+    name: https
+    # This is the port where sni routing happens
+  - port: 15443
+    targetPort: 15443
+    name: tls
+  secretVolumes:
+  - name: egressgateway-certs
+    secretName: istio-egressgateway-certs
+    mountPath: /etc/istio/egressgateway-certs
+  - name: egressgateway-ca-certs
+    secretName: istio-egressgateway-ca-certs
+    mountPath: /etc/istio/egressgateway-ca-certs
+  #### Advanced options ########
+  env:
+    # Set this to "external" if and only if you want the egress gateway to
+    # act as a transparent SNI gateway that routes mTLS/TLS traffic to
+    # external services defined using service entries, where the service
+    # entry has resolution set to DNS, has one or more endpoints with
+    # network field set to "external". By default its set to "" so that
+    # the egress gateway sees the same set of endpoints as the sidecars
+    # preserving backward compatibility
+    # ISTIO_META_REQUESTED_NETWORK_VIEW: ""
+    # A gateway with this mode ensures that pilot generates an additional
+    # set of clusters for internal services but without Istio mTLS, to
+    # enable cross cluster routing.
+    ISTIO_META_ROUTER_MODE: "sni-dnat"
+  nodeSelector: {}
+  tolerations: []
+  
+  # Specify the pod anti-affinity that allows you to constrain which nodes
+  # your pod is eligible to be scheduled based on labels on pods that are
+  # already running on the node rather than based on labels on nodes.
+  # There are currently two types of anti-affinity:
+  #    "requiredDuringSchedulingIgnoredDuringExecution"
+  #    "preferredDuringSchedulingIgnoredDuringExecution"
+  # which denote "hard" vs. "soft" requirements, you can define your values
+  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
+  # correspondingly.
+  # For example:
+  # podAntiAffinityLabelSelector:
+  # - key: security
+  #   operator: In
+  #   values: S1,S2
+  #   topologyKey: "kubernetes.io/hostname"
+  # This pod anti-affinity rule says that the pod requires not to be scheduled
+  # onto a node if that node is already running a pod with label having key
+  # "security" and value "S1".
+  podAntiAffinityLabelSelector: []
+  podAntiAffinityTermLabelSelector: []
+
+# Mesh ILB gateway creates a gateway of type InternalLoadBalancer,
+# for mesh expansion. It exposes the mtls ports for Pilot,CA as well
+# as non-mtls ports to support upgrades and gradual transition.
+istio-ilbgateway:
+  enabled: false
+  labels:
+    app: istio-ilbgateway
+    istio: ilbgateway
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  # specify replicaCount when autoscaleEnabled: false
+  # replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+  cpu:
+    targetAverageUtilization: 80
+  resources:
+    requests:
+      cpu: 800m
+      memory: 512Mi
+    #limits:
+    #  cpu: 1800m
+    #  memory: 256Mi
+  loadBalancerIP: ""
+  serviceAnnotations:
+    cloud.google.com/load-balancer-type: "internal"
+  podAnnotations: {}
+  type: LoadBalancer
+  ports:
+  ## You can add custom gateway ports - google ILB default quota is 5 ports,
+  - port: 15011
+    name: grpc-pilot-mtls
+  # Insecure port - only for migration from 0.8. Will be removed in 1.1
+  - port: 15010
+    name: grpc-pilot
+  - port: 8060
+    targetPort: 8060
+    name: tcp-citadel-grpc-tls
+  # Port 5353 is forwarded to kube-dns
+  - port: 5353
+    name: tcp-dns
+  secretVolumes:
+  - name: ilbgateway-certs
+    secretName: istio-ilbgateway-certs
+    mountPath: /etc/istio/ilbgateway-certs
+  - name: ilbgateway-ca-certs
+    secretName: istio-ilbgateway-ca-certs
+    mountPath: /etc/istio/ilbgateway-ca-certs
+  nodeSelector: {}
+  tolerations: []
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/Chart.yaml
@ -0,0 +1,6 @@
+apiVersion: v1
+description: A Helm chart for Kubernetes
+name: grafana
+version: 1.3.5
+appVersion: 1.3.5
+tillerVersion: ">=2.7.2"
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/citadel-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/citadel-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/galley-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/galley-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-mesh-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-mesh-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-performance-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-performance-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-service-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-service-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-workload-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/istio-workload-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/mixer-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/mixer-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/pilot-dashboard.json
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/dashboards/pilot-dashboard.json
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/_helpers.tpl
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/_helpers.tpl
@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "grafana.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "grafana.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "grafana.chart" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap-custom-resources.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap-custom-resources.yaml
@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-grafana-custom-resources
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: grafana
+data:
+  custom-resources.yaml: |-
+    {{- include "grafana-default.yaml.tpl" . | indent 4}}
+  run.sh: |-
+    {{- include "install-custom-resources.sh.tpl" . | indent 4}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap-dashboards.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap-dashboards.yaml
@ -0,0 +1,18 @@
+{{- $files := .Files }}
+{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
+{{- $filename := trimSuffix (ext $path) (base $path) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-grafana-configuration-dashboards-{{ $filename }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" $ }}
+    chart: {{ template "grafana.chart" $ }}
+    heritage: {{ $.Release.Service }}
+    release: {{ $.Release.Name }}
+    istio: grafana
+data:
+  {{ base $path }}: '{{ $files.Get $path }}'
+---
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/configmap.yaml
@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-grafana
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    istio: grafana
+data:
+{{- if .Values.datasources }}
+  {{- range $key, $value := .Values.datasources }}
+  {{ $key }}: |
+{{ toYaml $value | indent 4 }}
+  {{- end -}}
+{{- end -}}
+
+{{- if .Values.dashboardProviders }}
+  {{- range $key, $value := .Values.dashboardProviders }}
+  {{ $key }}: |
+{{ toYaml $value | indent 4 }}
+  {{- end -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/create-custom-resources-job.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/create-custom-resources-job.yaml
@ -0,0 +1,101 @@
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: istio-grafana-post-install-account
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-grafana-post-install-{{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: ["authentication.istio.io"] # needed to create default authn policy
+  resources: ["*"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-grafana-post-install-role-binding-{{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-grafana-post-install-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istio-grafana-post-install-account
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: istio-grafana-post-install-{{ .Values.global.tag | printf "%v" | trunc 32 }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  template:
+    metadata:
+      name: istio-grafana-post-install
+      labels:
+        app: istio-grafana
+        chart: {{ template "grafana.chart" . }}
+        heritage: {{ .Release.Service }}
+        release: {{ .Release.Name }}
+    spec:
+      serviceAccountName: istio-grafana-post-install-account
+      containers:
+        - name: kubectl
+          image: "{{ .Values.global.hub }}/kubectl:{{ .Values.global.tag }}"
+          command: [ "/bin/bash", "/tmp/grafana/run.sh", "/tmp/grafana/custom-resources.yaml" ]
+          volumeMounts:
+            - mountPath: "/tmp/grafana"
+              name: tmp-configmap-grafana
+      volumes:
+        - name: tmp-configmap-grafana
+          configMap:
+            name: istio-grafana-custom-resources
+      restartPolicy: OnFailure
+      affinity:
+      {{- include "nodeaffinity" . | indent 6 }}
+      {{- include "podAntiAffinity" . | indent 6 }}
+      {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 6 }}
+      {{- else if .Values.global.defaultTolerations }}
+      tolerations:
+{{ toYaml .Values.global.defaultTolerations | indent 6 }}
+      {{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/deployment.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/deployment.yaml
@ -0,0 +1,138 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: grafana
+  template:
+    metadata:
+      labels:
+        app: grafana
+        chart: {{ template "grafana.chart" . }}
+        heritage: {{ .Release.Service }}
+        release: {{ .Release.Name }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        prometheus.io/scrape: "true"
+    spec:
+      securityContext:
+        runAsUser: 472
+        fsGroup: 472
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+{{- end }}
+{{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+          - containerPort: 3000
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+          env:
+          - name: GRAFANA_PORT
+            value: "3000"
+{{- if .Values.security.enabled }}
+          - name: GF_SECURITY_ADMIN_USER
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.security.secretName }}
+                key: {{ .Values.security.usernameKey }}
+          - name: GF_SECURITY_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.security.secretName }}
+                key: {{ .Values.security.passphraseKey }}
+          - name: GF_AUTH_BASIC_ENABLED
+            value: "true"
+          - name: GF_AUTH_ANONYMOUS_ENABLED
+            value: "false"
+          - name: GF_AUTH_DISABLE_LOGIN_FORM
+            value: "false"
+{{- else }}
+          - name: GF_AUTH_BASIC_ENABLED
+            value: "false"
+          - name: GF_AUTH_ANONYMOUS_ENABLED
+            value: "true"
+          - name: GF_AUTH_ANONYMOUS_ORG_ROLE
+            value: Admin
+{{- end }}
+          - name: GF_PATHS_DATA
+            value: /data/grafana
+          {{- range $key, $value := $.Values.env }}
+          - name: {{ $key }}
+            value: {{ $value | quote }}
+          {{- end }}
+          {{- range $key, $secret := $.Values.envSecrets }}
+          - name: {{ $key }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ $secret }}
+                key: {{ $key | quote }}
+          {{- end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | indent 12 }}
+{{- end }}
+          volumeMounts:
+          - name: data
+            mountPath: /data/grafana
+          {{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
+          {{- $filename := trimSuffix (ext $path) (base $path) }}
+          - name: dashboards-istio-{{ $filename }}
+            mountPath: "/var/lib/grafana/dashboards/istio/{{ base $path }}"
+            subPath: {{ base $path }}
+            readOnly: true
+          {{- end }}
+          - name: config
+            mountPath: "/etc/grafana/provisioning/datasources/datasources.yaml"
+            subPath: datasources.yaml
+          - name: config
+            mountPath: "/etc/grafana/provisioning/dashboards/dashboardproviders.yaml"
+            subPath: dashboardproviders.yaml
+      affinity:
+      {{- include "nodeaffinity" . | indent 6 }}
+      {{- include "podAntiAffinity" . | indent 6 }}
+      {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 6 }}
+      {{- else if .Values.global.defaultTolerations }}
+      tolerations:
+{{ toYaml .Values.global.defaultTolerations | indent 6 }}
+      {{- end }}
+      volumes:
+      - name: config
+        configMap:
+          name: istio-grafana
+      - name: data
+{{- if .Values.persist }}
+        persistentVolumeClaim:
+          claimName: istio-grafana-pvc
+{{- else }}
+        emptyDir: {}
+{{- end }}
+{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
+{{- $filename := trimSuffix (ext $path) (base $path) }}
+      - name: dashboards-istio-{{ $filename }}
+        configMap:
+          name:  istio-grafana-configuration-dashboards-{{ $filename }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/grafana-ports-mtls.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/grafana-ports-mtls.yaml
@ -0,0 +1,17 @@
+{{ define "grafana-default.yaml.tpl" }}
+apiVersion: authentication.istio.io/v1alpha1
+kind: Policy
+metadata:
+  name: grafana-ports-mtls-disabled
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  targets:
+  - name: grafana
+    ports:
+    - number: {{ .Values.service.externalPort }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/ingress.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/ingress.yaml
@ -0,0 +1,40 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  annotations:
+    {{- range $key, $value := .Values.ingress.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
+spec:
+  rules:
+{{- if .Values.ingress.hosts }}
+    {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: {{ if $.Values.contextPath }} {{ $.Values.contextPath }} {{ else }} / {{ end }}
+            backend:
+              serviceName: grafana
+              servicePort: 3000
+    {{- end -}}
+{{- else }}
+    - http:
+        paths:
+          - path: {{ if .Values.contextPath }} {{ .Values.contextPath }} {{ else }} / {{ end }}
+            backend:
+              serviceName: grafana
+              servicePort: 3000
+{{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+{{ toYaml .Values.ingress.tls | indent 4 }}
+  {{- end -}}
+{{- end -}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/pvc.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/pvc.yaml
@ -0,0 +1,19 @@
+{{- if .Values.persist }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: istio-grafana-pvc
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  storageClassName: {{ .Values.storageClassName }}
+  accessModes:
+    - {{ .Values.accessMode }}
+  resources:
+    requests:
+      storage: 5Gi
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/service.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/service.yaml
@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- range $key, $val := .Values.service.annotations }}
+    {{ $key }}: {{ $val | quote }}
+    {{- end }}
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ template "grafana.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.externalPort }}
+      targetPort: 3000
+      protocol: TCP
+      name: {{ .Values.service.name }}
+  selector:
+    app: grafana
+{{- if .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
+{{- end }}
+  {{if .Values.service.loadBalancerSourceRanges}}
+  loadBalancerSourceRanges:
+    {{range $rangeList := .Values.service.loadBalancerSourceRanges}}
+    - {{ $rangeList }}
+    {{end}}
+  {{end}}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/tests/test-grafana-connection.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/templates/tests/test-grafana-connection.yaml
@ -0,0 +1,37 @@
+{{- if .Values.global.enableHelmTest }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ template "grafana.fullname" . }}-test
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: grafana-test
+    chart: {{ template "grafana.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    istio: grafana
+  annotations:
+    sidecar.istio.io/inject: "false"
+    helm.sh/hook: test-success
+spec:
+{{- if .Values.global.priorityClassName }}
+  priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+  containers:
+    - name: "{{ template "grafana.fullname" . }}-test"
+      image: pstauffer/curl:v1.0.3
+      imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
+      command: ['curl']
+      args: ['http://grafana:{{ .Values.grafana.service.externalPort }}']
+  restartPolicy: Never
+  affinity:
+    {{- include "nodeaffinity" . | indent 4 }}
+    {{- include "podAntiAffinity" . | indent 4 }}
+  {{- if .Values.tolerations }}
+  tolerations:
+{{ toYaml .Values.tolerations | indent 2 }}
+  {{- else if .Values.global.defaultTolerations }}
+  tolerations:
+{{ toYaml .Values.global.defaultTolerations | indent 2 }}
+  {{- end }}
+{{- end }}
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/values.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/grafana/values.yaml
@ -0,0 +1,117 @@
+#
+# addon grafana configuration
+#
+enabled: false
+replicaCount: 1
+image:
+  repository: grafana/grafana
+  tag: 6.1.6
+ingress:
+  enabled: false
+  ## Used to create an Ingress record.
+  hosts:
+    - grafana.local
+  annotations:
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  tls:
+    # Secrets must be manually created in the namespace.
+    # - secretName: grafana-tls
+    #   hosts:
+    #     - grafana.local
+persist: false
+storageClassName: ""
+accessMode: ReadWriteMany
+security:
+  enabled: false
+  secretName: grafana
+  usernameKey: username
+  passphraseKey: passphrase
+nodeSelector: {}
+tolerations: []
+
+env: {}
+  # Define additional environment variables for configuring grafana.
+  # @see https://grafana.com/docs/installation/configuration/#using-environment-variables
+  # Format: env_variable_name: value
+  # For example:
+  # GF_SMTP_ENABLED: true
+  # GF_SMTP_HOST: email-smtp.eu-west-1.amazonaws.com:2587
+  # GF_SMTP_FROM_ADDRESS: alerts@mydomain.com
+  # GF_SMTP_FROM_NAME: Grafana
+
+envSecrets: {}
+  # The key name and ENV name must match in the secrets file.
+  # @see https://grafana.com/docs/installation/configuration/#using-environment-variables
+  # For example:
+  # ---
+  # apiVersion: v1
+  # kind: Secret
+  # metadata:
+  #   name: grafana-secrets
+  #   namespace: istio-system
+  # data:
+  #   GF_SMTP_USER: bXl1c2Vy
+  #   GF_SMTP_PASSWORD: bXlwYXNzd29yZA==
+  # type: Opaque
+  # ---
+  # env_variable_key_name: secretsName
+  # ---
+  # GF_SMTP_USER: grafana-secrets
+  # GF_SMTP_PASSWORD: grafana-secrets
+
+# Specify the pod anti-affinity that allows you to constrain which nodes
+# your pod is eligible to be scheduled based on labels on pods that are
+# already running on the node rather than based on labels on nodes.
+# There are currently two types of anti-affinity:
+#    "requiredDuringSchedulingIgnoredDuringExecution"
+#    "preferredDuringSchedulingIgnoredDuringExecution"
+# which denote "hard" vs. "soft" requirements, you can define your values
+# in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
+# correspondingly.
+# For example:
+# podAntiAffinityLabelSelector:
+# - key: security
+#   operator: In
+#   values: S1,S2
+#   topologyKey: "kubernetes.io/hostname"
+# This pod anti-affinity rule says that the pod requires not to be scheduled
+# onto a node if that node is already running a pod with label having key
+# "security" and value "S1".
+podAntiAffinityLabelSelector: []
+podAntiAffinityTermLabelSelector: []
+
+contextPath: /grafana
+service:
+  annotations: {}
+  name: http
+  type: ClusterIP
+  externalPort: 3000
+  loadBalancerIP:
+  loadBalancerSourceRanges:
+
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Prometheus
+        type: prometheus
+        orgId: 1
+        url: http://prometheus:9090
+        access: proxy
+        isDefault: true
+        jsonData:
+          timeInterval: 5s
+        editable: true
+
+dashboardProviders:
+  dashboardproviders.yaml:
+    apiVersion: 1
+    providers:
+      - name: 'istio'
+        orgId: 1
+        folder: 'istio'
+        type: file
+        disableDeletion: false
+        options:
+          path: /var/lib/grafana/dashboards/istio
--- a/istio-1.3.5/install/kubernetes/helm/istio/charts/istiocoredns/Chart.yaml
+++ b/istio-1.3.5/install/kubernetes/helm/istio/charts/istiocoredns/Chart.yaml
@ -0,0 +1,6 @@
+apiVersion: v1
+description: Istio CoreDNS provides DNS resolution for services in multicluster setups.
+name: istiocoredns
+version: 1.3.5
+appVersion: 0.1
+tillerVersion: ">=2.7.2"
--- a/Show more
+++ b/Show more