---
# These are current chart keys. The legacy pilot.* overrides are not copied.
istio_components:
  - name: istio-base
    chart: base
    values:
      defaultRevision: default
  - name: istiod
    chart: istiod
    values:
      image: '{{ istio_pins.images.pilot }}'
      global:
        hub: docker.io/istio
        tag: '{{ istio_pins.version }}'
        proxy: {image: '{{ istio_pins.images.proxy }}'}
        proxy_init: {image: '{{ istio_pins.images.proxy }}'}
      replicaCount: 1
      autoscaleEnabled: false
      cni: {enabled: true}
      env: {ENABLE_NATIVE_SIDECARS: 'true'}
      # The label that turns injection on for a Notebook is written by Kubeflow's PodDefaults webhook, which the
      # composition delivers under a name that sorts before `istio-sidecar-injector`, so the label is on the Pod when
      # the injector's selectors are evaluated (DD-0067 §3). `IfNeeded` is the second line of defence: admission calls
      # a webhook skipped in the first round only if its selectors matched then, so any webhook that adds the label
      # after the injector was matched would otherwise be lost — the chart's default is `Never`.
      sidecarInjectorWebhook:
        reinvocationPolicy: IfNeeded
      resources:
        requests: {cpu: 200m, memory: 256Mi}
        limits: {cpu: '1', memory: 1Gi}
      seccompProfile: {type: RuntimeDefault}
      meshConfig:
        accessLogFile: /dev/stdout
        # Keep OAuth authorisation codes and every query parameter out of logs.
        accessLogFormat: |
          %START_TIME% %REQ(:METHOD)% %PATH(NQ:PATH)% %RESPONSE_CODE% %RESPONSE_FLAGS% %UPSTREAM_HOST%
        enablePrometheusMerge: true
        # The Kubeflow front door (DD-0067 §4), one block: `meshConfig` is a mapping, so a second
        # `extensionProviders` key would silently replace this one under both YAML loaders.
        # oauth2-proxy answers the gateway's ext_authz check and returns the member's
        # `kubeflow-userid`, which Istio both copies upstream and replaces when a client sends its
        # own value. A deny carries the proxy's redirect to the login page back to the browser, so
        # `location` stays on the downstream headers. Requests that skip the check are denied by the
        # policy in `kubeflow-core`. An adopted foundation never re-runs this chart, so
        # `platform_deploy.mesh` merges these same values into the installed `istio-system/istio`
        # ConfigMap.
        extensionProviders:
          - name: oauth2-proxy
            envoyExtAuthzHttp:
              service: oauth2-proxy.oauth2-proxy.svc.cluster.local
              port: 4180
              includeRequestHeadersInCheck: [authorization, cookie]
              headersToUpstreamOnAllow: [authorization, path, kubeflow-userid,
                                         x-auth-request-email, x-auth-request-groups,
                                         x-auth-request-user]
              headersToDownstreamOnDeny: [content-type, set-cookie, location]
        defaultConfig:
          gatewayTopology: {numTrustedProxies: 1}
  - name: istio-cni
    chart: cni
    values:
      image: '{{ istio_pins.images.cni }}'
      cniBinDir: '{{ istio_cni_bin_dir | default("/var/lib/pharos-metallo/k3s/data/cni") }}'
      cniConfDir: '{{ istio_cni_conf_dir | default("/var/lib/pharos-metallo/k3s/agent/etc/cni/net.d") }}'
      cniConfFileName: '{{ istio_cni_conf_file | default("10-flannel.conflist") }}'
      chained: true
      excludeNamespaces: [kube-system, istio-system]
      ambient: {enabled: false}
      seLinuxOptions: '{{ istio_cni_selinux_options | default({}) }}'
      resources:
        requests: {cpu: 100m, memory: 100Mi}
        limits: {cpu: 500m, memory: 512Mi}
  - name: istio-ingressgateway
    chart: gateway
    values:
      replicaCount: 1
      autoscaling: {enabled: false}
      labels: {istio: ingressgateway, app: istio-ingressgateway}
      podAnnotations:
        sidecar.istio.io/proxyImage: '{{ istio_pins.images.proxy }}'
        proxy.istio.io/config: '{"gatewayTopology":{"numTrustedProxies":1}}'
      env: {ISTIO_META_UNPRIVILEGED_POD: 'true'}
      service:
        type: '{{ istio_gateway_service_type | default("NodePort") }}'
        ports: '{{ [{"name": "http2", "port": 80, "targetPort": 8080, "protocol": "TCP"} | combine({"nodePort": 30088} if istio_gateway_service_type | default("NodePort") == "NodePort" else {})] }}'
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      containerSecurityContext:
        allowPrivilegeEscalation: false
        capabilities: {drop: [ALL]}
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1337
        runAsGroup: 1337
      resources:
        requests: {cpu: 100m, memory: 128Mi}
        limits: {cpu: '1', memory: 512Mi}