example.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: gke-hubble-export
  labels:
    name: gke-hubble-export
spec:
  selector:
    matchLabels:
      name: gke-hubble-export
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10
  template:
    metadata:
      labels:
        name: gke-hubble-export
    spec:
      hostNetwork: true
      tolerations:
        - operator: Exists
        - key: components.gke.io/gke-managed-components
          operator: Exists
      containers:
        - name: gke-hubble-export
          image: docker.io/rueian/gke-hubble-export:latest
          imagePullPolicy: Always
          env:
            - name: GKE_HUBBLE_EXPORT_ADDR
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: status.hostIP
          volumeMounts:
            - mountPath: /var/run/cilium
              name: cilium-run
      terminationGracePeriodSeconds: 30
      volumes:
        - hostPath:
            path: /var/run/cilium
            type: DirectoryOrCreate
          name: cilium-run


---
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-relay-config
data:
  config.yaml: |
    peer-service: unix:///var/run/cilium/gke-hubble-export.sock
    listen-address: :4245
    disable-client-tls: true
    disable-server-tls: true

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hubble-relay
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hubble-relay
  labels:
    k8s-app: hubble-relay
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-relay
  template:
    metadata:
      labels:
        k8s-app: hubble-relay
    spec:
      containers:
        - name: hubble-relay
          image: quay.io/cilium/hubble-relay:v1.11.0
          command:
            - hubble-relay
          args:
            - serve
          ports:
            - name: grpc
              containerPort: 4245
          readinessProbe:
            tcpSocket:
              port: grpc
          livenessProbe:
            tcpSocket:
              port: grpc
          volumeMounts:
            - name: hubble-sock-dir
              mountPath: /var/run/cilium
              readOnly: true
            - name: config
              mountPath: /etc/hubble-relay
              readOnly: true
      restartPolicy: Always
      serviceAccount: hubble-relay
      serviceAccountName: hubble-relay
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 0
      volumes:
        - name: config
          configMap:
            name: hubble-relay-config
            items:
              - key: config.yaml
                path: config.yaml
        - name: hubble-sock-dir
          hostPath:
            path: /var/run/cilium
            type: Directory

---
kind: Service
apiVersion: v1
metadata:
  name: hubble-relay
  labels:
    k8s-app: hubble-relay
spec:
  type: ClusterIP
  selector:
    k8s-app: hubble-relay
  ports:
    - protocol: TCP
      port: 80
      targetPort: 4245
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hubble-ui
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hubble-ui
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - componentstatuses
      - endpoints
      - namespaces
      - nodes
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - "*"
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hubble-ui
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: hubble-ui
subjects:
  - kind: ServiceAccount
    name: hubble-ui
    namespace: default
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-ui-envoy
data:
  envoy.yaml: |
    static_resources:
      listeners:
        - name: listener_hubble_ui
          address:
            socket_address:
              address: 0.0.0.0
              port_value: 8081
          filter_chains:
            - filters:
                - name: envoy.filters.network.http_connection_manager
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                    codec_type: auto
                    stat_prefix: ingress_http
                    route_config:
                      name: local_route
                      virtual_hosts:
                        - name: local_service
                          domains: ["*"]
                          routes:
                            - match:
                                prefix: "/api/"
                              route:
                                cluster: backend
                                prefix_rewrite: "/"
                                timeout: 0s
                                max_stream_duration:
                                  grpc_timeout_header_max: 0s
                            - match:
                                prefix: "/"
                              route:
                                cluster: frontend
                          cors:
                            allow_origin_string_match:
                              - prefix: "*"
                            allow_methods: GET, PUT, DELETE, POST, OPTIONS
                            allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
                            max_age: "1728000"
                            expose_headers: grpc-status,grpc-message
                    http_filters:
                      - name: envoy.filters.http.grpc_web
                      - name: envoy.filters.http.cors
                      - name: envoy.filters.http.router
      clusters:
        - name: frontend
          connect_timeout: 0.25s
          type: strict_dns
          lb_policy: round_robin
          load_assignment:
            cluster_name: frontend
            endpoints:
              - lb_endpoints:
                  - endpoint:
                      address:
                        socket_address:
                          address: 127.0.0.1
                          port_value: 8080
        - name: backend
          connect_timeout: 0.25s
          type: logical_dns
          lb_policy: round_robin
          http2_protocol_options: {}
          load_assignment:
            cluster_name: backend
            endpoints:
              - lb_endpoints:
                  - endpoint:
                      address:
                        socket_address:
                          address: 127.0.0.1
                          port_value: 8090


---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: hubble-ui
  labels:
    k8s-app: hubble-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-ui
  template:
    metadata:
      labels:
        k8s-app: hubble-ui
    spec:
      serviceAccount: hubble-ui
      serviceAccountName: hubble-ui
      containers:
        - name: frontend
          image: quay.io/cilium/hubble-ui:v0.8.4
          ports:
            - name: http
              containerPort: 8080
        - name: backend
          image: quay.io/cilium/hubble-ui-backend:v0.8.4
          env:
            - name: EVENTS_SERVER_PORT
              value: "8090"
            - name: FLOWS_API_ADDR
              value: "hubble-relay:80"

          ports:
            - name: grpc
              containerPort: 8090
        - name: proxy
          image: docker.io/envoyproxy/envoy:v1.18.4
          ports:
            - name: http
              containerPort: 8081
          command: [envoy]
          args:
            - -c
            - /etc/envoy.yaml
            - -l
            - info
          volumeMounts:
            - name: hubble-ui-envoy-yaml
              mountPath: /etc/envoy.yaml
              subPath: envoy.yaml
      volumes:
        - name: hubble-ui-envoy-yaml
          configMap:
            name: hubble-ui-envoy

---
kind: Service
apiVersion: v1
metadata:
  name: hubble-ui
  labels:
    k8s-app: hubble-ui
spec:
  type: ClusterIP
  selector:
    k8s-app: hubble-ui
  ports:
    - name: http
      port: 80
      targetPort: 8081