Common Configuration Objects

The differences between TSB and TSE API

Tetrate Service Express (TSE) utilizes many of the same components as the Tetrate Service Bridge(TSB) product but has the several distinctions. Go to Comparing TSE and TSB for more details.

Common configuration objects shared by the different install APIs.

CertManagerSettings

CertManagerSettings represents the settings used for the cert-manager installation. TSE supports installing and managing the lifecycle of the cert-manager installation.

Field	Description	Validation Rule
managed	tetrateio.api.install.common.CertManagerSettings.Managed Managed specifies whether TSB should manage the lifecycle of cert-manager.	–
certManagerSpec	tetrateio.api.install.common.CertManagerSettings.CertManagerSpec Configure kubernetes specific settings for cert-manager.	–
certManagerWebhookSpec	tetrateio.api.install.common.CertManagerSettings.CertManagerWebhookSpec Configure kubernetes specific settings for cert-manager-webhook.	–
certManagerCaInjector	tetrateio.api.install.common.CertManagerSettings.CertManagerCAInjector Configure kubernetes specific settings for cert-manager-cainjector.	–
certManagerStartupapicheck	tetrateio.api.install.common.CertManagerSettings.CertManagerStartupAPICheck Configure kubernetes specific settings for cert-manager-startupapicheck. DEPRECATED. Startup API Check is disabled.	–

CertManagerCAInjector

CertManagerCAInjector represents the settings used for cert-manager CAInjector installation in the clusters.

Field	Description	Validation Rule
kubeSpec	tetrateio.api.install.kubernetes.KubernetesComponentSpec Configure kubernetes specific settings for cert-manager-cainjector.	–

CertManagerSpec

CertManagerSpec represents the settings used for cert-manager controller installation in the clusters.

Field	Description	Validation Rule
kubeSpec	tetrateio.api.install.kubernetes.KubernetesComponentSpec Configure kubernetes specific settings for cert-manager.	–

CertManagerStartupAPICheck

CertManagerStartupAPICheck represents the settings used for cert-manager startup API check job installation in the clusters. DEPRECATED. StartupAPICheck is disabled.

Field	Description	Validation Rule
kubeSpec	tetrateio.api.install.kubernetes.KubernetesJobComponentSpec Configure kubernetes specific settings for cert-manager-startupapicheck.	–

CertManagerWebhookSpec

CertManagerWebhookSpec represents the settings used for cert-manager Webhook installation in the clusters.

Field	Description	Validation Rule
kubeSpec	tetrateio.api.install.kubernetes.KubernetesComponentSpec Configure kubernetes specific settings for cert-manager-webhook.	–

ConfigProtection

ConfigProtection contains settings for enabling/disabling config protection over XCP created resources. Config protections are disabled by default. Example:

configProtection:
  enableAuthorizedUpdateDeleteOnXcpConfigs: true
  enableAuthorizedCreateUpdateDeleteOnXcpConfigs: true
  authorizedUsers:
    - user1
    - system:serviceaccount:ns1:serviceaccount-1

Field	Description	Validation Rule
enableAuthorizedUpdateDeleteOnXcpConfigs	bool When enabled, no other user or svc account except AuthorizedUsers would be allowed to delete or update the XCP/Istio API resources created by XCP.	–
enableAuthorizedCreateUpdateDeleteOnXcpConfigs	bool When enabled, no other user or svc account except AuthorizedUsers would be allowed to create, delete or update the XCP/Istio API resources. This acts as a superset of the enableAuthorizedUpdateDeleteOnXcpConfigs.	–
authorizedUsers	List of string List of usernames of authorized users or svc accounts to create/update/delete XCP configs when config protection is enabled.	–

CustomCertProviderSettings

CustomCertProviderSettings represents the settings used for the custom certificate provider. Users can configure the CSR signer required for certificate signing and point to the CA bundle to be used to validate the certificates.

Field	Description	Validation Rule
csrSignerName	string REQUIRED Name of Kubernetes CSR signer to be used to sign the CSR request by different TSB components for internal purposes.	string = {   min_len: 1 }
caBundleSecretName	string REQUIRED Configure the CABundleSecretName to be used to verify the signed CSR request by different TSB components. If not specified, TSB would use the secret with the name ca-bundle-management-plane in the management plane namespace or ca-bundle-control-plane in the control plane namespace. The secret should contain the file ca.crt with the cert data.	string = {   min_len: 1 }

GitOps

The GitOps component configures the features that allow integrating the Management Plane and/or the Control Plane cluster with Continuous Deployment pipelines.

Field	Description	Validation Rule
enabled	bool The GitOps component is in beta and disabled by default. If Management and Control Planes are installed in the same cluster, Continuous Deployment Integration should only be enabled in one of both planes. However, if the GitOps component is enabled in both planes, only the Control Plane GitOps component will remain enabled. The Management Plane GitOps component will not be enabled, even though it is explicitly enabled.	–
reconcileInterval	google.protobuf.Duration Interval at which the reconcile process will run. The reconcile process will read all TSB CRs that exist in the cluster and reapply them to the management plane, to make sure the cluster CRs remain as the source of truth. Format: 1h/1m/1s/1ms. A value of 0 disables the reconcile loop. Default: 10m.	–
batchWindow	google.protobuf.Duration When configured, all admission requests will be paused for the configured duration. Once the window interval is closed, all paused admission requests will be sent together to the Management Plane as a single request. Batching of requests is disabled by default and should be enabled only if there is high concurrency and ordering of resources could be an issue. By configuring a batch window the concurrency and ordering issues may be mitigated, although it will introduce a constant latency to all requests of the configured time window. When enabled, it is recommended to use a small value, for example 1 second.	–
managementplaneRequestTimeout	google.protobuf.Duration The GitOps component performs operations against the management plane through the k8s webhook. This allows configuring the duration of each operation in order to fail early if it takes too much. This value cannot be lower than webhook_timeout due to the request being tied to the ones received by the k8s webhook. Format: 1h/1m/1s/1m. Any value <= 0 will be reset to the default value. Default: 25s.	–
reconcileRequestTimeout	google.protobuf.Duration The GitOps component performs operations against the management plane internal reconcile loop. This allows configuring the duration of each operation to fail early if it takes too long. Format: 1h/1m/1s/1m. Any value <= 0 will be reset to the default value. Default: 2m.	–
webhookTimeout	google.protobuf.Duration Timeout that will be set in the k8s gitops webhook resource. Format: 1h/1m/1s/1m. Default: 30s. Allowed values must be between 0s and 30s.	–

InternalCertProvider

InternalCertProvider describes the certificate provider configuration for TSE internal purposes like kubernetes webhook certificate. TSE supports cert-manager out of the box.

Field	Description	Validation Rule
certManager	tetrateio.api.install.common.CertManagerSettings oneof _internal_cert_provider Use cert-manager as the internal certificate provider	–
custom	tetrateio.api.install.common.CustomCertProviderSettings oneof _internal_cert_provider Use a custom certificate provider that accepts Kubernetes CSR	–

MeshObservabilitySettings

Configure mesh observability. The following examples enable the analysis and generation of RED metrics for each endpoint of your registered services.

Notice that both, ManagementPlane and ControlPlane, need to be aligned with this configuration.

apiVersion: install.tetrate.io/v1alpha1
kind: ManagementPlane
metadata:
  name: managementplane
spec:
  meshObservability:
    settings:
      apiEndpointMetricsEnabled: true

apiVersion: install.tetrate.io/v1alpha1
kind: ControlPlane
metadata:
  name: controlplane
  namespace: istio-system
spec:
  meshObservability:
    settings:
      apiEndpointMetricsEnabled: true

Field	Description	Validation Rule
apiEndpointMetricsEnabled	bool Toggle to process, analyze, and generate api endpoints RED metrics. By default false which means disabled. If you want to analyze all your request and generate RED metrics for each endpoint of your registered services in the mesh, set it to true.	–

Managed

If INTERNAL, TSB will install and manage cert-manager. In case a pre-existing installation is found, the operator will not install cert-manager and fail. If EXTERNAL, TSB would rely on a pre installed cert-manager for use. Pre installed cert-manager should support signing requests raised through Kubernetes CSR

Field	Number	Description
AUTO	0	TSB will check if a pre-existing cert-manager installation is found in the cluster and only install and manage cert-manager if it is not found. The pre-installed cert-manager should support signing requests raised through Kubernetes CSR
EXTERNAL	1	EXTERNAL represents that TSB will rely on a pre installed cert-manager for use. Pre installed cert-manager should support signing requests raised through Kubernetes CSR
INTERNAL	2	INTERNAL represents that TSB will install and manage cert-manager in the cluster. In case a pre-existing installation is found, the operator will not install cert-manager and fail.