istio-control-plane-cni.yaml

apiVersion: install.istio.io/v1alpha2
kind: IstioControlPlane
spec:
  autoInjection:
    enabled: true
    components:
      injector:
        enabled: true
  cni:
    enabled: true
    components:
      cni:
        enabled: true
        k8s:
          affinity:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                    - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                    - amd64
                  - key: eks.amazonaws.com/compute-type
                    operator: NotIn
                    values:
                    - fargate
      namespace: kube-system
  defaultNamespace: istio-system
  gateways:
    enabled: true
    components:
      ingressGateway:
        enabled: true
      egressGateway:
        enabled: true
  values:
    gateways:
      istio-ingressgateway:
        serviceAnnotations:
          service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
          service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
    tracing:
      enabled: true
    pilot:
      traceSampling: "5.0"
    prometheus:
      enabled: true
    sidecarInjectorWebhook:
      enableNamespacesByDefault: true
      rewriteAppHTTPProbe: true
    kiali:
      enabled: true
      createDemoSecret: true
    global:
      mtls:
        auto: false
        enabled: false
      proxy:
        accessLogFile: "/dev/stdout"
      outboundTrafficPolicy:
        mode: REGISTRY_ONLY
      disablePolicyChecks: false
    cni:
      excludeNamespaces:
        - istio-system
        - kube-system