Repository: kumahq/kuma
Pull request #3187 (2021-11-18 11:42:46)

docs(changelog) changelog for 1.4.0 RC2
Cherry-picked from release branch

codecov-commenter: # [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) Report
> Merging [#3187](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (cdceaef) into [master](https://codecov.io/gh/kumahq/kuma/commit/7f3938a7f1fdc2d58ace68207740ef3fbfa30b26?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (7f3938a) will **increase** coverage by `0.00%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kumahq/kuma/pull/3187/graphs/tree.svg?width=650&height=150&src=pr&token=D7Yvqs6rwV&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)

```diff
@@           Coverage Diff           @@
##           master    #3187   +/-   ##
=======================================
  Coverage   52.37%   52.37%           
=======================================
  Files         928      928           
  Lines       54043    54043           
=======================================
+ Hits        28303    28307    +4     
+ Misses      23523    23519    -4     
  Partials     2217     2217           
```


| [Impacted Files](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) | Coverage Δ | |
|---|---|---|
| [pkg/core/resources/model/rest/resource.go](https://codecov.io/gh/kumahq/kuma/pull/3187/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21vZGVsL3Jlc3QvcmVzb3VyY2UuZ28=) | `67.94% <0.00%> (-1.29%)` | :arrow_down: |
| [pkg/xds/generator/direct\_access\_proxy\_generator.go](https://codecov.io/gh/kumahq/kuma/pull/3187/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3hkcy9nZW5lcmF0b3IvZGlyZWN0X2FjY2Vzc19wcm94eV9nZW5lcmF0b3IuZ28=) | `82.75% <0.00%> (-1.15%)` | :arrow_down: |
| [pkg/plugins/runtime/gateway/route/sorter.go](https://codecov.io/gh/kumahq/kuma/pull/3187/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3BsdWdpbnMvcnVudGltZS9nYXRld2F5L3JvdXRlL3NvcnRlci5nbw==) | `66.66% <0.00%> (+5.12%)` | :arrow_up: |
| [pkg/core/resources/manager/cache.go](https://codecov.io/gh/kumahq/kuma/pull/3187/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21hbmFnZXIvY2FjaGUuZ28=) | `88.31% <0.00%> (+5.19%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Last update [7f3938a...cdceaef](https://codecov.io/gh/kumahq/kuma/pull/3187?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c180dfd9..00a18249c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # CHANGELOG
 
+## [1.4.0 RC2]
+
+Changes:
+* chore(*) scripts for build, publish and fetch Envoy binaries [#3110](https://github.com//kumahq/kuma/pull/3110) [#3182](https://github.com//kumahq/kuma/pull/3182)
+* chore(kuma-cp) upgrade gui to new version [#3178](https://github.com//kumahq/kuma/pull/3178) [#3179](https://github.com//kumahq/kuma/pull/3179)
+* chore(kuma-cp) Use go structs instead of gotemplate for bootstrap [#3156](https://github.com//kumahq/kuma/pull/3156) [#3173](https://github.com//kumahq/kuma/pull/3173)
+* chore(deps): bump github.com/slok/go-http-metrics from 0.9.0 to 0.10.0 [#3170](https://github.com//kumahq/kuma/pull/3170)
+
 ## [1.4.0 RC1]
 
 Changes:
diff --git a/app/kuma-dp/pkg/dataplane/envoy/envoy.go b/app/kuma-dp/pkg/dataplane/envoy/envoy.go
index 1dd29c402..e34414c58 100644
--- a/app/kuma-dp/pkg/dataplane/envoy/envoy.go
+++ b/app/kuma-dp/pkg/dataplane/envoy/envoy.go
@@ -226,10 +226,13 @@ func (e *Envoy) version() (*EnvoyVersion, error) {
 	build = regexp.MustCompile(`version:(.*)`).FindString(build)
 	build = strings.Trim(build, "version:")
 	build = strings.Trim(build, " ")
-	version := regexp.MustCompile(`/([0-9.]+)/`).FindString(build)
-	version = strings.Trim(version, "/")
+
+	parts := strings.Split(build, "/")
+	if len(parts) != 5 { // revision/build_version_number/revision_status/build_type/ssl_version
+		return nil, errors.Errorf("wrong Envoy build format: %s", build)
+	}
 	return &EnvoyVersion{
 		Build:   build,
-		Version: version,
+		Version: parts[1],
 	}, nil
 }


Test patch:
diff --git a/app/kuma-dp/cmd/testdata/envoy-mock.sleep.sh b/app/kuma-dp/cmd/testdata/envoy-mock.sleep.sh
index 208bf00b7..a11aa7248 100755
--- a/app/kuma-dp/cmd/testdata/envoy-mock.sleep.sh
+++ b/app/kuma-dp/cmd/testdata/envoy-mock.sleep.sh
@@ -7,7 +7,7 @@ fi
 if [ "$1" = "--version" ];
 then
     echo $1 >> ${ENVOY_MOCK_CMDLINE_FILE}
-    printf "\n50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd/1.15.0/clean-getenvoy-2aa564b-envoy/RELEASE/BoringSSL\n"
+    printf "\nversion: 50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd/1.15.0/clean-getenvoy-2aa564b-envoy/RELEASE/BoringSSL\n"
     exit 0
 else
     for arg in "$@"; do
diff --git a/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go b/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
index d2be8b4a5..0da9e15ca 100644
--- a/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
+++ b/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
@@ -279,6 +279,30 @@ var _ = Describe("Envoy", func() {
 			Expect(version.Build).To(Equal("50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd/1.15.0/clean-getenvoy-2aa564b-envoy/RELEASE/BoringSSL"))
 		})
 
+		It("should properly read envoy version with label for unix-based systems", func() {
+			// given
+			cfg := kuma_dp.Config{
+				DataplaneRuntime: kuma_dp.DataplaneRuntime{
+					BinaryPath: filepath.Join("testdata", "envoy-mock.with-label.sh"),
+					ConfigDir:  configDir,
+				},
+			}
+
+			// when
+			dataplane, err := New(Opts{
+				Config: cfg,
+				Stdout: &bytes.Buffer{},
+				Stderr: &bytes.Buffer{},
+			})
+			Expect(err).ToNot(HaveOccurred())
+			version, err := dataplane.version()
+
+			// then
+			Expect(err).ToNot(HaveOccurred())
+			Expect(version.Version).To(Equal("1.20.0-dev"))
+			Expect(version.Build).To(Equal("50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd/1.20.0-dev/clean-getenvoy-2aa564b-envoy/RELEASE/BoringSSL"))
+		})
+
 		It("should properly read envoy version for windows", func() {
 			// given
 			cfg := kuma_dp.Config{
diff --git a/app/kuma-dp/pkg/dataplane/envoy/testdata/envoy-mock.with-label.sh b/app/kuma-dp/pkg/dataplane/envoy/testdata/envoy-mock.with-label.sh
new file mode 100755
index 000000000..7299e9974
--- /dev/null
+++ b/app/kuma-dp/pkg/dataplane/envoy/testdata/envoy-mock.with-label.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+if [ "$1" = "--version" ];
+then
+  printf "\nenvoy  version: 50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd/1.20.0-dev/clean-getenvoy-2aa564b-envoy/RELEASE/BoringSSL\n\n"
+  exit 0
+fi
+
+# print arguments to verify in the test
+echo $@
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.remote.zone.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.remote.zone.yaml
deleted file mode 100644
index d2b5daeec..000000000
--- a/app/kumactl/cmd/install/testdata/install-control-plane.remote.zone.yaml
+++ /dev/null
@@ -1,1003 +0,0 @@
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kuma-system
-  labels:
-    kuma.io/system-namespace: "true"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kuma-control-plane-config
-  namespace: kuma-system
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  config.yaml: |
-    # use this file to override default configuration of `kuma-cp`
-    #
-    # see conf/kuma-cp.conf.yml for available settings
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: circuitbreakers.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: CircuitBreaker
-    plural: circuitbreakers
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: CircuitBreaker is the Schema for the circuitbreaker API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: dataplanes.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: Dataplane
-    plural: dataplanes
-  scope: Namespaced
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: Dataplane is the Schema for the dataplanes API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: retries.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: Retry
-    plural: retries
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: Retry is the Schema for the retries API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: serviceinsights.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: ServiceInsight
-    plural: serviceinsights
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: ServiceInsight is the Schema for the services insights API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: timeouts.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: Timeout
-    plural: timeouts
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: Timeout is the Schema for the timeout API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: trafficlogs.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: TrafficLog
-    plural: trafficlogs
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: TrafficLog is the Schema for the trafficlogs API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: trafficpermissions.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: TrafficPermission
-    plural: trafficpermissions
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: TrafficPermission is the Schema for the trafficpermissions API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: trafficroutes.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: TrafficRoute
-    plural: trafficroutes
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: TrafficRoute is the Schema for the trafficroutes API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: traffictraces.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: TrafficTrace
-    plural: traffictraces
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: TrafficTrace is the Schema for the traffictraces API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: zoneinsights.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: ZoneInsight
-    plural: zoneinsights
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: ZoneInsight is the Schema for the zone insight API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: zones.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: Zone
-    plural: zones
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: Zone is the Schema for the zone API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: dataplaneinsights.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: DataplaneInsight
-    plural: dataplaneinsights
-  scope: Namespaced
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: DataplaneInsight is the Schema for the dataplane insights API
-          properties:
-            mesh:
-              type: string
-            status:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: externalservices.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: ExternalService
-    plural: externalservices
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: faultinjections.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: FaultInjection
-    plural: faultinjections
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: FaultInjection is the Schema for the faultinjections API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: healthchecks.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: HealthCheck
-    plural: healthchecks
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: HealthCheck is the Schema for the healthchecks API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: meshinsights.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: MeshInsight
-    plural: meshinsights
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: MeshInsight is the Schema for the meshes insights API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: meshes.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: Mesh
-    plural: meshes
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: Mesh is the Schema for the meshes API
-          properties:
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: proxytemplates.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: ProxyTemplate
-    plural: proxytemplates
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: ProxyTemplate is the Schema for the proxytemplates API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  creationTimestamp: null
-  name: ratelimits.kuma.io
-spec:
-  group: kuma.io
-  names:
-    kind: RateLimit
-    plural: ratelimits
-  scope: Cluster
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          description: RateLimit is the Schema for the ratelimits API
-          properties:
-            mesh:
-              type: string
-            spec:
-              x-kubernetes-preserve-unknown-fields: true
-              type: object
-          type: object
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kuma-control-plane
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-      - pods
-      - configmaps
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - kuma.io
-    resources:
-      - dataplanes
-      - dataplaneinsights
-      - meshes
-      - zones
-      - zoneinsights
-      - meshinsights
-      - serviceinsights
-      - proxytemplates
-      - ratelimits
-      - trafficpermissions
-      - trafficroutes
-      - timeouts
-      - retries
-      - circuitbreakers
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - kuma.io
-    resources:
-      - externalservices
-      - faultinjections
-      - healthchecks
-      - trafficlogs
-      - traffictraces
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - pods/finalizers
-    verbs:
-      - "*"
-  - apiGroups:
-      - kuma.io
-    resources:
-      - meshes/finalizers
-    verbs:
-      - "*"
-  - apiGroups:
-      - kuma.io
-    resources:
-      - dataplanes/finalizers
-    verbs:
-      - "*"
-  # validate k8s token before issuing mTLS cert
-  - apiGroups:
-      - authentication.k8s.io
-    resources:
-      - tokenreviews
-    verbs:
-      - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kuma-control-plane
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "5680"
-spec:
-  type: ClusterIP
-  ports:
-    - port: 5681
-      name: http-api-server
-    - port: 5682
-      name: https-api-server
-    - port: 443
-      name: https-admission-server
-      targetPort: 5443
-    - port: 5676
-      name: mads-server
-    - port: 5678
-      name: dp-server
-    - port: 5653
-      name: dns-server
-      protocol: UDP
-  selector:
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels:
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-    app: kuma-control-plane
-spec:
-  replicas: 1
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kuma
-      app.kubernetes.io/instance: kuma
-      app: kuma-control-plane
-  template:
-    metadata:
-      annotations:
-        checksum/config: 737d1358e24137cdf1b4c543251d5cf58dcec1cb9b8e796fcbf73aa46e3bc857
-        checksum/tls-secrets: 044c1b83f7caa353976a6e3e81a069cf3a430b54d2df45bdecd432382b98b6ff
-      labels:
-        app.kubernetes.io/name: kuma
-        app.kubernetes.io/instance: kuma
-        app: kuma-control-plane
-    spec:
-      serviceAccountName: kuma-control-plane
-      nodeSelector:
-        
-        kubernetes.io/arch: amd64
-        kubernetes.io/os: linux
-      containers:
-        - name: control-plane
-          image: "docker.io/kumahq/kuma-cp:0.0.1"
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: KUMA_API_SERVER_READ_ONLY
-              value: "true"
-            - name: KUMA_DEFAULTS_SKIP_MESH_CREATION
-              value: "false"
-            - name: KUMA_DP_SERVER_HDS_ENABLED
-              value: "false"
-            - name: KUMA_ENVIRONMENT
-              value: "kubernetes"
-            - name: KUMA_GENERAL_TLS_CERT_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.crt"
-            - name: KUMA_GENERAL_TLS_KEY_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.key"
-            - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-init:0.0.1"
-            - name: KUMA_MODE
-              value: "zone"
-            - name: KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
-              value: "grpcs://192.168.0.1:5685"
-            - name: KUMA_MULTIZONE_ZONE_NAME
-              value: "zone-1"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
-              value: "/var/run/secrets/kuma.io/tls-cert"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
-              value: "5443"
-            - name: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
-              value: "kuma-control-plane"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/ca.crt"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
-              value: "false"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-dp:0.0.1"
-            - name: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
-              value: "kuma-system"
-            - name: KUMA_STORE_TYPE
-              value: "kubernetes"
-          args:
-            - run
-            - --log-level=info
-            - --config-file=/etc/kuma.io/kuma-control-plane/config.yaml
-          ports:
-            - containerPort: 5681
-            - containerPort: 5682
-            - containerPort: 5443
-            - containerPort: 5678
-            - containerPort: 5653
-              protocol: UDP
-          livenessProbe:
-            httpGet:
-              path: /healthy
-              port: 5680
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 5680
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-          volumeMounts:
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
-              readOnly: true
-            - name: kuma-control-plane-config
-              mountPath: /etc/kuma.io/kuma-control-plane
-              readOnly: true
-      volumes:
-        - name: general-tls-cert
-          secret:
-            secretName: general-tls-secret
-        - name: kuma-control-plane-config
-          configMap:
-            name: kuma-control-plane-config
----
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: kuma-admission-mutating-webhook-configuration
-  namespace: kuma-system
-  labels:
-  
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: mesh.defaulter.kuma-admission.kuma.io
-    failurePolicy: Fail
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /default-kuma-io-v1alpha1-mesh
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - meshes
-    sideEffects: None
-  - name: owner-reference.kuma-admission.kuma.io
-    failurePolicy: Fail
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /owner-reference-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-        resources:
-          - circuitbreakers
-          - externalservices
-          - faultinjections
-          - healthchecks
-          - retries
-          - proxytemplates
-          - ratelimits
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-    
-      
-    sideEffects: None
-  - name: kuma-injector.kuma.io
-    failurePolicy: Ignore
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /inject-sidecar
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-    sideEffects: None
----
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: kuma-validating-webhook-configuration
-  namespace: kuma-system
-  labels:
-  
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: validator.kuma-admission.kuma.io
-    failurePolicy: Fail
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - circuitbreakers
-          - dataplanes
-          - externalservices
-          - faultinjections
-          - healthchecks
-          - retries
-          - meshes
-          - proxytemplates
-          - ratelimits
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-          - zones
-    
-      
-    sideEffects: None
-  - name: service.validator.kuma-admission.kuma.io
-    failurePolicy: Ignore
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-service
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - services
-    sideEffects: None
-  - name: secret.validator.kuma-admission.kuma.io
-    namespaceSelector:
-      matchLabels:
-        kuma.io/system-namespace: "true"
-    failurePolicy: Ignore
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-secret
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - secrets
-    sideEffects: None