autocommit

apps/istio-base-crd.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: istio-base-crds
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: istio-system
+  source:
+    chart: base
+    repoURL: https://istio-release.storage.googleapis.com/charts
+    targetRevision: 1.30.2
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+    - group: admissionregistration.k8s.io
+      kind: ValidateingWebhookConfiguration
+      name: istiod-default-validator
+      jqPathExpressions:
+        - .webhooks[] | select(.name == "validation.istio.io") | .failurePolicy

apps/istio.yaml

@@ -1,17 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: istio-system
-  labels:
-    istio-injection: enabled
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: istio-ingress
-  labels:
-    istio-injection: enabled
----
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -29,6 +15,9 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: istio-ingress
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -47,21 +36,6 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: istio-system
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: istio-base
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.linvogel.ch/linus/gitops.git
-    targetRevision: HEAD
-    path: helm/istio-base
-    helm:
-      valueFiles:
-        - values.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: istio-system
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

helm/istio-base/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: istio-base
-version: 0.1.0
-dependencies:
-  - name: base
-    version: 1.30.2
-    repository: https://istio-release.storage.googleapis.com/charts
-

helm/istio-base/values.yaml

@@ -1,49 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # resourceScope controls what resources will be processed by helm.
-    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
-    # It can be one of:
-    # - all: all resources are processed
-    # - cluster: only cluster-scoped resources are processed
-    # - namespace: only namespace-scoped resources are processed
-    resourceScope: all
-
-    # If true, install the istio-reader ServiceAccount and associated ClusterRole/ClusterRoleBinding.
-    # These are only needed for multicluster remote-secret workflows.
-    enableReaderRBAC: true
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "1.30.2"
-  experimental:
-    stableValidationPolicy: false