Support Istio migration mode (#1116)

* Make mtls mode permissive for Istio migration * Apply to slim (cherry picked from commit 1b38177)
streamnative · Oct 31, 2023 · 6203426 · 6203426
1 parent a932c96
commit 6203426
Show file tree

Hide file tree

Showing 6 changed files with 18 additions and 0 deletions.
diff --git a/charts/sn-platform-slim/templates/broker/broker-cluster.yaml b/charts/sn-platform-slim/templates/broker/broker-cluster.yaml
@@ -167,6 +167,10 @@ spec:
   {{- if and .Values.istio.enabled .Values.ingress.broker.enabled }}
   istio:
     enabled: true
+    {{- if .Values.istio.migration }}
+    mtls:
+      mode: permissive
+    {{- end }}
     gateway:
       selector:
 {{- include "pulsar.istio.gateway.selector" . | indent 8 }}

diff --git a/charts/sn-platform-slim/templates/istio/default-peerauthentication.yaml b/charts/sn-platform-slim/templates/istio/default-peerauthentication.yaml
@@ -25,5 +25,9 @@ metadata:
   namespace: {{ template "pulsar.namespace" . }}
 spec:
   mtls:
+{{- if .Values.istio.migration }}
+    mode: PERMISSIVE
+{{- else }}
     mode: STRICT
 {{- end }}
+{{- end }}
diff --git a/charts/sn-platform-slim/values.yaml b/charts/sn-platform-slim/values.yaml
@@ -2092,6 +2092,7 @@ extraResources: []
 
 istio:
   enabled: false
+  migration: false
   # istio labels used to inject sidecars if it's not `sidecar.istio.io/inject: "true"`
   labels: {}
   # If you're using the prometheus in this chart, please keep mergeMetrics disabled.

diff --git a/charts/sn-platform/templates/broker/broker-cluster.yaml b/charts/sn-platform/templates/broker/broker-cluster.yaml
@@ -171,6 +171,10 @@ spec:
   {{- if and .Values.istio.enabled .Values.ingress.broker.enabled }}
   istio:
     enabled: true
+    {{- if .Values.istio.migration }}
+    mtls:
+      mode: permissive
+    {{- end }}
     gateway:
       selector:
 {{- include "pulsar.istio.gateway.selector" . | indent 8 }}

diff --git a/charts/sn-platform/templates/istio/default-peerauthentication.yaml b/charts/sn-platform/templates/istio/default-peerauthentication.yaml
@@ -25,5 +25,9 @@ metadata:
   namespace: {{ template "pulsar.namespace" . }}
 spec:
   mtls:
+{{- if .Values.istio.migration }}
+    mode: PERMISSIVE
+{{- else }}
     mode: STRICT
 {{- end }}
+{{- end }}
diff --git a/charts/sn-platform/values.yaml b/charts/sn-platform/values.yaml
@@ -2454,6 +2454,7 @@ custom_metric_server:
 
 istio:
   enabled: false
+  migration: false
   # istio labels used to inject sidecars if it's not `sidecar.istio.io/inject: "true"`
   labels: {}
   # If you're using the prometheus in this chart, please keep mergeMetrics disabled.