apiVersion: v1
kind: Pod
metadata:
  annotations:
    linkerd.io/inject: disabled
    prometheus.io/path: /stats/prometheus
    prometheus.io/port: "15020"
    prometheus.io/scrape: "true"
    sidecar.istio.io/inject: "true"
    sidecar.istio.io/interceptionMode: REDIRECT
    sidecar.istio.io/proxyCPU: 1000m
    sidecar.istio.io/proxyMemory: 512Mi
    sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null}'
    traffic.sidecar.istio.io/excludeInboundPorts: 8076,8077,8078,8081,9999
    traffic.sidecar.istio.io/excludeOutboundPorts: 80,8076,8077,8078, 8081
    traffic.sidecar.istio.io/includeOutboundIPRanges: 10.222.0.0/16
  creationTimestamp: "2021-08-03T07:26:21Z"
  generateName: fortioclient-54894c5758-
  labels:
    app: fortioclient
    istio.io/rev: default
    pod-template-hash: 54894c5758
    security.istio.io/tlsMode: istio
    service.istio.io/canonical-name: fortioclient
    service.istio.io/canonical-revision: latest
  name: fortioclient-54894c5758-htdgl
  namespace: twopods-istio
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: fortioclient-54894c5758
    uid: 0d70454f-6f49-4192-b7a2-c49e09c53871
  resourceVersion: "534432954"
  selfLink: /api/v1/namespaces/twopods-istio/pods/fortioclient-54894c5758-htdgl
  uid: 291070dd-a3a2-4df8-ae22-a6845b9d17f2
spec:
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: app
            operator: In
            values:
            - fortioserver
        topologyKey: kubernetes.io/hostname
  containers:
  - args:
    - nighthawk_service
    - --listen
    - 0.0.0.0:9999
    image: registry.io/wanaka/nighthawk-dev:59683b759eb8f8bd8cce282795c08f9e2b3313d4
    imagePullPolicy: IfNotPresent
    name: captured
    ports:
    - containerPort: 9999
      protocol: TCP
    resources:
      requests:
        cpu: 1500m
        memory: 1000Mi
    securityContext:
      runAsUser: 1
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/lib/fortio
      name: shared-data
    - mountPath: /var/lib/nighthawk
      name: nighthawk-test-server-config
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-d59c7
      readOnly: true
  - args:
    - /bin/sleep
    - 3650d
    image: registry.io/wanaka/alpine-bash-curl-jq:latest
    imagePullPolicy: Always
    name: shell
    resources: {}
    securityContext:
      runAsUser: 1
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/lib/fortio
      name: shared-data
    - mountPath: /var/lib/nighthawk
      name: nighthawk-test-server-config
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-d59c7
      readOnly: true
  - args:
    - report
    - -http-port
    - "9076"
    - -grpc-port
    - disabled
    - -redirect-port
    - disabled
    - -data-dir
    - /var/lib/fortio/
    image: registry.io/wanaka/fortio:latest_release
    imagePullPolicy: IfNotPresent
    name: uncaptured
    resources:
      requests:
        cpu: 1500m
        memory: 1000Mi
    securityContext:
      runAsUser: 1
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/lib/fortio
      name: shared-data
    - mountPath: /var/lib/nighthawk
      name: nighthawk-test-server-config
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-d59c7
      readOnly: true
  - args:
    - proxy
    - sidecar
    - --domain
    - $(POD_NAMESPACE).svc.cluster.local
    - --serviceCluster
    - fortioclient.$(POD_NAMESPACE)
    - --proxyLogLevel=warning
    - --proxyComponentLogLevel=misc:error
    - --log_output_level=default:info
    - --concurrency
    - "2"
    env:
    - name: JWT_POLICY
      value: third-party-jwt
    - name: PILOT_CERT_PROVIDER
      value: istiod
    - name: CA_ADDR
      value: istiod.istio-system.svc:15012
    - name: POD_NAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.namespace
    - name: INSTANCE_IP
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: status.podIP
    - name: SERVICE_ACCOUNT
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: spec.serviceAccountName
    - name: HOST_IP
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: status.hostIP
    - name: CANONICAL_SERVICE
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.labels['service.istio.io/canonical-name']
    - name: CANONICAL_REVISION
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.labels['service.istio.io/canonical-revision']
    - name: PROXY_CONFIG
      value: |
        {}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
            {"containerPort":9999,"protocol":"TCP"}
        ]
    - name: ISTIO_META_APP_CONTAINERS
      value: captured,shell,uncaptured
    - name: ISTIO_META_CLUSTER_ID
      value: Kubernetes
    - name: ISTIO_META_INTERCEPTION_MODE
      value: REDIRECT
    - name: ISTIO_METAJSON_ANNOTATIONS
      value: |
        {"linkerd.io/inject":"disabled","sidecar.istio.io/inject":"true","sidecar.istio.io/interceptionMode":"REDIRECT","sidecar.istio.io/proxyCPU":"1000m","sidecar.istio.io/proxyMemory":"512Mi","traffic.sidecar.istio.io/excludeInboundPorts":"8076,8077,8078,8081,9999","traffic.sidecar.istio.io/excludeOutboundPorts":"80,8076,8077,8078, 8081","traffic.sidecar.istio.io/includeOutboundIPRanges":"10.222.0.0/16"}
    - name: ISTIO_META_WORKLOAD_NAME
      value: fortioclient
    - name: ISTIO_META_OWNER
      value: kubernetes://apis/apps/v1/namespaces/twopods-istio/deployments/fortioclient
    - name: ISTIO_META_MESH_ID
      value: cluster.local
    - name: TRUST_DOMAIN
      value: cluster.local
    image: registry.io/wanaka/proxyv2:1.10.3
    imagePullPolicy: IfNotPresent
    name: istio-proxy
    ports:
    - containerPort: 15090
      name: http-envoy-prom
      protocol: TCP
    readinessProbe:
      failureThreshold: 30
      httpGet:
        path: /healthz/ready
        port: 15021
        scheme: HTTP
      initialDelaySeconds: 1
      periodSeconds: 2
      successThreshold: 1
      timeoutSeconds: 3
    resources:
      requests:
        cpu: "1"
        memory: 512Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsGroup: 1337
      runAsNonRoot: true
      runAsUser: 1337
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    - mountPath: /var/lib/istio/data
      name: istio-data
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    - mountPath: /etc/istio/pod
      name: istio-podinfo
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-d59c7
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  initContainers:
  - args:
    - istio-iptables
    - -p
    - "15001"
    - -z
    - "15006"
    - -u
    - "1337"
    - -m
    - REDIRECT
    - -i
    - 10.222.0.0/16
    - -x
    - ""
    - -b
    - '*'
    - -d
    - 15090,15021,8076,8077,8078,8081,9999,15020
    - -o
    - 80,8076,8077,8078, 8081
    image: registry.io/wanaka/proxyv2:1.10.3
    imagePullPolicy: IfNotPresent
    name: istio-init
    resources:
      requests:
        cpu: "1"
        memory: 512Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        add:
        - NET_ADMIN
        - NET_RAW
        drop:
        - ALL
      privileged: false
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-d59c7
      readOnly: true
  nodeName: yz-10-222-94-1.h.chinabank.com.cn
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1337
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - emptyDir:
      medium: Memory
    name: istio-envoy
  - emptyDir: {}
    name: istio-data
  - downwardAPI:
      defaultMode: 420
      items:
      - fieldRef:
          apiVersion: v1
          fieldPath: metadata.labels
        path: labels
      - fieldRef:
          apiVersion: v1
          fieldPath: metadata.annotations
        path: annotations
      - path: cpu-limit
        resourceFieldRef:
          containerName: istio-proxy
          divisor: 1m
          resource: limits.cpu
      - path: cpu-request
        resourceFieldRef:
          containerName: istio-proxy
          divisor: 1m
          resource: requests.cpu
    name: istio-podinfo
  - name: istio-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: istio-ca
          expirationSeconds: 43200
          path: istio-token
  - configMap:
      defaultMode: 420
      name: istio-ca-root-cert
    name: istiod-ca-cert
  - emptyDir: {}
    name: shared-data
  - configMap:
      defaultMode: 420
      name: nighthawk-test-server-config
    name: nighthawk-test-server-config
  - name: default-token-d59c7
    secret:
      defaultMode: 420
      secretName: default-token-d59c7
