apiVersion: v1
data:
  mesh: "# Set the following variable to true to disable policy checks by the Mixer.\n#
    Note that metrics will still be reported to the Mixer.\ndisablePolicyChecks: true\n\n#
    Set enableTracing to false to disable request tracing.\nenableTracing: true\n\n#
    Set accessLogFile to empty string to disable access log.\naccessLogFile: \"/dev/stdout\"\n\n#
    If accessLogEncoding is TEXT, value will be used directly as the log format\n#
    example: \"[%START_TIME%] %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\\n\"\n#
    If AccessLogEncoding is JSON, value will be parsed as map[string]string\n# example:
    '{\"start_time\": \"%START_TIME%\", \"req_method\": \"%REQ(:METHOD)%\"}'\n# Leave
    empty to use default log format\naccessLogFormat: \"\"\n\n# Set accessLogEncoding
    to JSON or TEXT to configure sidecar access log\naccessLogEncoding: 'TEXT'\nmixerCheckServer:
    istio-policy.istio-system.svc.cluster.local:15004\nmixerReportServer: istio-telemetry.istio-system.svc.cluster.local:15004\n#
    policyCheckFailOpen allows traffic in cases when the mixer policy service cannot
    be reached.\n# Default is false which means the traffic is denied when the client
    is unable to connect to Mixer.\npolicyCheckFailOpen: false\n# Let Pilot give ingresses
    the public IP of the Istio ingressgateway\ningressService: istio-ingressgateway\n\n#
    DNS refresh rate for Envoy clusters of type STRICT_DNS\ndnsRefreshRate: 5s\n\n#
    Unix Domain Socket through which envoy communicates with NodeAgent SDS to get\n#
    key/cert for mTLS. Use secret-mount files instead of SDS if set to empty. \nsdsUdsPath:
    \n\n# This flag is used by secret discovery service(SDS). \n# If set to true(prerequisite:
    https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject
    volumes mount \n# for k8s service account JWT, so that K8s API server mounts k8s
    service account JWT to envoy container, which \n# will be used to generate key/cert
    eventually. This isn't supported for non-k8s case.\nenableSdsTokenMount: false\n\n#
    This flag is used by secret discovery service(SDS). \n# If set to true, envoy
    will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token'
    \n# (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod)
    \n# and pass to sds server, which will be used to request key/cert eventually.
    \n# this flag is ignored if enableSdsTokenMount is set.\n# This isn't supported
    for non-k8s case.\nsdsUseK8sSaJwt: false\n\n# The trust domain corresponds to
    the trust root of a system.\n# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain\ntrustDomain:
    \n\n# Set the default behavior of the sidecar for handling outbound traffic from
    the application:\n# ALLOW_ANY - outbound traffic to unknown destinations will
    be allowed, in case there are no\n#   services or ServiceEntries for the destination
    port\n# REGISTRY_ONLY - restrict outbound traffic to services defined in the service
    registry as well\n#   as those defined through ServiceEntries  \noutboundTrafficPolicy:\n
    \ mode: REGISTRY_ONLY\n\n# The namespace to treat as the administrative root namespace
    for istio\n# configuration.    \nrootNamespace: istio-system\nconfigSources:\n-
    address: istio-galley.istio-system.svc:9901\n  tlsSettings:\n    mode: ISTIO_MUTUAL\n\ndefaultConfig:\n
    \ #\n  # TCP connection timeout between Envoy & the application, and between Envoys.\n
    \ connectTimeout: 10s\n  #\n  ### ADVANCED SETTINGS #############\n  # Where should
    envoy's configuration be stored in the istio-proxy container\n  configPath: \"/etc/istio/proxy\"\n
    \ binaryPath: \"/usr/local/bin/envoy\"\n  # The pseudo service name used for Envoy.\n
    \ serviceCluster: istio-proxy\n  # These settings that determine how long an old
    Envoy\n  # process should be kept alive after an occasional reload.\n  drainDuration:
    45s\n  parentShutdownDuration: 1m0s\n  #\n  # The mode used to redirect inbound
    connections to Envoy. This setting\n  # has no effect on outbound traffic: iptables
    REDIRECT is always used for\n  # outbound connections.\n  # If \"REDIRECT\", use
    iptables REDIRECT to NAT and redirect to Envoy.\n  # The \"REDIRECT\" mode loses
    source addresses during redirection.\n  # If \"TPROXY\", use iptables TPROXY to
    redirect to Envoy.\n  # The \"TPROXY\" mode preserves both the source and destination
    IP\n  # addresses and ports, so that they can be used for advanced filtering\n
    \ # and manipulation.\n  # The \"TPROXY\" mode also configures the sidecar to
    run with the\n  # CAP_NET_ADMIN capability, which is required to use TPROXY.\n
    \ #interceptionMode: REDIRECT\n  #\n  # Port where Envoy listens (on local host)
    for admin commands\n  # You can exec into the istio-proxy container in a pod and\n
    \ # curl the admin port (curl http://localhost:15000/) to obtain\n  # diagnostic
    information from Envoy. See\n  # https://lyft.github.io/envoy/docs/operations/admin.html\n
    \ # for more details\n  proxyAdminPort: 15000\n  #\n  # Set concurrency to a specific
    number to control the number of Proxy worker threads.\n  # If set to 0 (default),
    then start worker thread for each CPU thread/core.\n  concurrency: 2\n  #\n  tracing:\n
    \   zipkin:\n      # Address of the Zipkin collector\n      address: zipkin.istio-system:9411\n
    \ #\n  # Mutual TLS authentication between sidecars and istio control plane.\n
    \ controlPlaneAuthPolicy: MUTUAL_TLS\n  #\n  # Address where istio Pilot service
    is running\n  discoveryAddress: istio-pilot.istio-system:15011"
  meshNetworks: 'networks: {}'
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"mesh":"# Set the following variable to true to disable policy checks by the Mixer.\n# Note that metrics will still be reported to the Mixer.\ndisablePolicyChecks: true\n\n# Set enableTracing to false to disable request tracing.\nenableTracing: true\n\n# Set accessLogFile to empty string to disable access log.\naccessLogFile: \"/dev/stdout\"\n\n# If accessLogEncoding is TEXT, value will be used directly as the log format\n# example: \"[%START_TIME%] %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\\n\"\n# If AccessLogEncoding is JSON, value will be parsed as map[string]string\n# example: '{\"start_time\": \"%START_TIME%\", \"req_method\": \"%REQ(:METHOD)%\"}'\n# Leave empty to use default log format\naccessLogFormat: \"\"\n\n# Set accessLogEncoding to JSON or TEXT to configure sidecar access log\naccessLogEncoding: 'TEXT'\nmixerCheckServer: istio-policy.istio-system.svc.cluster.local:15004\nmixerReportServer: istio-telemetry.istio-system.svc.cluster.local:15004\n# policyCheckFailOpen allows traffic in cases when the mixer policy service cannot be reached.\n# Default is false which means the traffic is denied when the client is unable to connect to Mixer.\npolicyCheckFailOpen: false\n# Let Pilot give ingresses the public IP of the Istio ingressgateway\ningressService: istio-ingressgateway\n\n# DNS refresh rate for Envoy clusters of type STRICT_DNS\ndnsRefreshRate: 5s\n\n# Unix Domain Socket through which envoy communicates with NodeAgent SDS to get\n# key/cert for mTLS. Use secret-mount files instead of SDS if set to empty. \nsdsUdsPath: \n\n# This flag is used by secret discovery service(SDS). \n# If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount \n# for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which \n# will be used to generate key/cert eventually. This isn't supported for non-k8s case.\nenableSdsTokenMount: false\n\n# This flag is used by secret discovery service(SDS). \n# If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token' \n# (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod) \n# and pass to sds server, which will be used to request key/cert eventually. \n# this flag is ignored if enableSdsTokenMount is set.\n# This isn't supported for non-k8s case.\nsdsUseK8sSaJwt: false\n\n# The trust domain corresponds to the trust root of a system.\n# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain\ntrustDomain: \n\n# Set the default behavior of the sidecar for handling outbound traffic from the application:\n# ALLOW_ANY - outbound traffic to unknown destinations will be allowed, in case there are no\n#   services or ServiceEntries for the destination port\n# REGISTRY_ONLY - restrict outbound traffic to services defined in the service registry as well\n#   as those defined through ServiceEntries  \noutboundTrafficPolicy:\n  mode: REGISTRY_ONLY\n\n# The namespace to treat as the administrative root namespace for istio\n# configuration.    \nrootNamespace: istio-system\nconfigSources:\n- address: istio-galley.istio-system.svc:9901\n  tlsSettings:\n    mode: ISTIO_MUTUAL\n\ndefaultConfig:\n  #\n  # TCP connection timeout between Envoy \u0026 the application, and between Envoys.\n  connectTimeout: 10s\n  #\n  ### ADVANCED SETTINGS #############\n  # Where should envoy's configuration be stored in the istio-proxy container\n  configPath: \"/etc/istio/proxy\"\n  binaryPath: \"/usr/local/bin/envoy\"\n  # The pseudo service name used for Envoy.\n  serviceCluster: istio-proxy\n  # These settings that determine how long an old Envoy\n  # process should be kept alive after an occasional reload.\n  drainDuration: 45s\n  parentShutdownDuration: 1m0s\n  #\n  # The mode used to redirect inbound connections to Envoy. This setting\n  # has no effect on outbound traffic: iptables REDIRECT is always used for\n  # outbound connections.\n  # If \"REDIRECT\", use iptables REDIRECT to NAT and redirect to Envoy.\n  # The \"REDIRECT\" mode loses source addresses during redirection.\n  # If \"TPROXY\", use iptables TPROXY to redirect to Envoy.\n  # The \"TPROXY\" mode preserves both the source and destination IP\n  # addresses and ports, so that they can be used for advanced filtering\n  # and manipulation.\n  # The \"TPROXY\" mode also configures the sidecar to run with the\n  # CAP_NET_ADMIN capability, which is required to use TPROXY.\n  #interceptionMode: REDIRECT\n  #\n  # Port where Envoy listens (on local host) for admin commands\n  # You can exec into the istio-proxy container in a pod and\n  # curl the admin port (curl http://localhost:15000/) to obtain\n  # diagnostic information from Envoy. See\n  # https://lyft.github.io/envoy/docs/operations/admin.html\n  # for more details\n  proxyAdminPort: 15000\n  #\n  # Set concurrency to a specific number to control the number of Proxy worker threads.\n  # If set to 0 (default), then start worker thread for each CPU thread/core.\n  concurrency: 2\n  #\n  tracing:\n    zipkin:\n      # Address of the Zipkin collector\n      address: zipkin.istio-system:9411\n  #\n  # Mutual TLS authentication between sidecars and istio control plane.\n  controlPlaneAuthPolicy: MUTUAL_TLS\n  #\n  # Address where istio Pilot service is running\n  discoveryAddress: istio-pilot.istio-system:15011","meshNetworks":"networks: {}"},"kind":"ConfigMap","metadata":{"annotations":{},"labels":{"app":"istio","chart":"istio-1.1.0","heritage":"Tiller","release":"aspenmesh-auth-1.1.2-am1"},"name":"istio","namespace":"istio-system"}}
  creationTimestamp: "2019-04-12T05:45:23Z"
  labels:
    app: istio
    chart: istio-1.1.0
    heritage: Tiller
    release: aspenmesh-auth-1.1.2-am1
  name: istio
  namespace: istio-system
  resourceVersion: "855014"
  selfLink: /api/v1/namespaces/istio-system/configmaps/istio
  uid: 2a8a5d35-5ce6-11e9-9153-06771750dae0
