Linkerd的部署与入门-高可用模式

--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: authorizationpolicies.policy.linkerd.io annotations: linkerd.io/created-by: linkerd/cli stable-2.14.0 labels: helm.sh/chart: linkerd-crds-1.8.0 linkerd.io/control-plane-ns: linkerd spec: group: policy.linkerd.io scope: Namespaced names: kind: AuthorizationPolicy plural: authorizationpolicies singular: authorizationpolicy shortNames: [authzpolicy] versions: - name: v1alpha1 served: true storage: true schema: openAPIV3Schema: type: object required: [spec] properties: spec: description: >- Authorizes clients to communicate with Linkerd-proxied server resources. type: object required: [targetRef, requiredAuthenticationRefs] properties: targetRef: description: >- TargetRef references a resource to which the authorization policy applies. type: object required: [kind, name] # Modified from the gateway API. # Copyright 2020 The Kubernetes Authors properties: group: description: >- Group is the group of the referent. When empty, the Kubernetes core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: >- Kind is the kind of the referent. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string requiredAuthenticationRefs: description: >- RequiredAuthenticationRefs enumerates a set of required authentications. ALL authentications must be satisfied for the authorization to apply. If any of the referred objects cannot be found, the authorization will be ignored. type: array items: type: object required: [kind, name] properties: group: description: >- Group is the group of the referent. When empty, the Kubernetes core API group is inferred." maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: >- Kind is the kind of the referent. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: >- Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: >- Name is the name of the referent. When unspecified, this authentication refers to the local namespace. maxLength: 253 type: string --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: httproutes.policy.linkerd.io annotations: linkerd.io/created-by: linkerd/cli stable-2.14.0 labels: helm.sh/chart: linkerd-crds-1.8.0 linkerd.io/control-plane-ns: linkerd spec: group: policy.linkerd.io names: kind: HTTPRoute listKind: HTTPRouteList plural: httproutes singular: httproute scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.hostnames name: Hostnames type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: HTTPRoute provides a way to route HTTP requests. This includes the capability to match requests by hostname, path, header, or query param. Filters can be used to specify additional processing steps. Backends specify where matching requests should be routed. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of HTTPRoute. properties: hostnames: description: "Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. \n If a hostname is specified by both the Listener and HTTPRoute, there must be at least one intersecting hostname for the HTTPRoute to be attached to the Listener. For example: \n * A Listener with `test.example.com` as the hostname matches HTTPRoutes that have either not specified any hostnames, or have specified at least one of `test.example.com` or `*.example.com`. * A Listener with `*.example.com` as the hostname matches HTTPRoutes \ that have either not specified any hostnames or have specified at least one hostname that matches the Listener hostname. For example, `*.example.com`, `test.example.com`, and `foo.test.example.com` would all match. On the other hand, `example.com` and `test.example.net` would not match. \n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. \n If both the Listener and HTTPRoute have specified hostnames, any HTTPRoute hostnames that do not match the Listener hostname MUST be ignored. For example, if a Listener specified `*.example.com`, and the HTTPRoute specified `test.example.com` and `test.example.net`, `test.e