################################
# Pilot
################################
# Pilot CRDs
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: destinationpolicies.config.istio.io
spec:
  group: config.istio.io
  names:
    kind: DestinationPolicy
    listKind: DestinationPolicyList
    plural: destinationpolicies
    singular: destinationpolicy
  scope: Namespaced
  version: v1alpha2
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: egressrules.config.istio.io
spec:
  group: config.istio.io
  names:
    kind: EgressRule
    listKind: EgressRuleList
    plural: egressrules
    singular: egressrule
  scope: Namespaced
  version: v1alpha2
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: routerules.config.istio.io
spec:
  group: config.istio.io
  names:
    kind: RouteRule
    listKind: RouteRuleList
    plural: routerules
    singular: routerule
  scope: Namespaced
  version: v1alpha2
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: virtualservices.networking.istio.io
spec:
  group: networking.istio.io
  names:
    kind: VirtualService
    listKind: VirtualServiceList
    plural: virtualservices
    singular: virtualservice
  scope: Namespaced
  version: v1alpha3
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: destinationrules.networking.istio.io
spec:
  group: networking.istio.io
  names:
    kind: DestinationRule
    listKind: DestinationRuleList
    plural: destinationrules
    singular: destinationrule
  scope: Namespaced
  version: v1alpha3
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: externalservices.networking.istio.io
spec:
  group: networking.istio.io
  names:
    kind: ExternalService
    listKind: ExternalServiceList
    plural: externalservices
    singular: externalservice
  scope: Namespaced
  version: v1alpha3
---
# Pilot service for discovery
apiVersion: v1
kind: Service
metadata:
  name: istio-pilot
  namespace: {ISTIO_NAMESPACE}
  labels:
    istio: pilot
spec:
  ports:
  - port: 15003
    name: discovery
  - port: 15005
    name: https-discovery
  - port: 15007
    name: http-discovery
  - port: 15010
    name: grpc-discovery
  - port: 8080
    name: http-legacy-discovery
  - port: 9093
    name: http-monitoring
  - port: 443
    name: admission-webhook
  selector:
    istio: pilot
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-pilot-service-account
  namespace: {ISTIO_NAMESPACE}
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: istio-pilot
  namespace: {ISTIO_NAMESPACE}
spec:
  replicas: 1
  template:
    metadata:
      labels:
        istio: pilot
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: istio-pilot-service-account
      containers:
      - name: discovery
        image: {PILOT_HUB}/pilot:{PILOT_TAG}
        imagePullPolicy: IfNotPresent
        args: ["discovery", "--admission-service", "istio-pilot"]
        ports:
        - containerPort: 8080
        - containerPort: 443
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: PILOT_THROTTLE
          value: "200"
        volumeMounts:
        - name: config-volume
          mountPath: /etc/istio/config
      - name: istio-proxy
        image: {PROXY_HUB}/{PROXY_IMAGE}:{PROXY_TAG}
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 15003
        - containerPort: 15005
        - containerPort: 15007
        args:
        - proxy
        - pilot
        - --discoveryAddress
        - istio-pilot:15007
        - --controlPlaneAuthPolicy
        - NONE #--controlPlaneAuthPolicy
        - --customConfigFile
        - /etc/istio/proxy/envoy_pilot.json
        volumeMounts:
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
      volumes:
      - name: config-volume
        configMap:
          name: istio
      - name: istio-certs
        secret:
          secretName: istio.istio-pilot-service-account
          optional: true
---
