在生產中執行kubernetes上的Istio

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio
  namespace: istio-system
  labels:
    app: istio
    service: istio
data:
  mesh: |-
# disable tracing mechanism for now
    enableTracing: false
# do not specify mixer endpoints, so that sidecar containers do not send the information
    mixerCheckServer: istio-policy.istio-system:15004
    mixerReportServer: istio-telemetry.istio-system:15004
# interval for envoy to check Pilot
    rdsRefreshDelay: 5s
# default config for envoy sidecar
    defaultConfig:
      # like rdsRefreshDelay
      discoveryRefreshDelay: 5s
# path to envoy executable
      configPath: "/etc/istio/proxy"
      binaryPath: "/usr/local/bin/envoy"
# default name for sidecar container
      serviceCluster: istio-proxy
# time for envoy to wait before it shuts down all existing connections
      drainDuration: 45s
      parentShutdownDuration: 1m0s
# by default, REDIRECT rule for iptables is used. TPROXY can be used as well.
      interceptionMode: REDIRECT
# port for sidecar container admin panel
      proxyAdminPort: 15000
# address for sending traces using zipkin protocol (not used as turned off in enableTracing option)
      zipkinAddress: tracing-collector.tracing:9411
# statsd address for envoy containers metrics
      # statsdUdpAddress: aggregator:8126
# turn off Mutual TLS
      controlPlaneAuthPolicy: NONE
# istio-pilot listen port to report service discovery information to sidecars
      discoveryAddress: istio-pilot.istio-system:15007

initContainers:
 - name: istio-init
   args:
   - -p
   - "15001"
   - -u
   - "1337"
   - -m
   - REDIRECT
   - -i
   - '*'
   - -b
   - '*'
   - -d
   - ""
   image: istio/proxy_init:1.0.0
   imagePullPolicy: IfNotPresent
   resources:
     limits:
       memory: 128Mi
   securityContext:
     capabilities:
       add:
       - NET_ADMIN

- name: istio-proxy
         command:
         - "bash"
         - "-c"
         - |
           exec /usr/local/bin/pilot-agent proxy sidecar \
           --configPath \
           /etc/istio/proxy \
           --binaryPath \
           /usr/local/bin/envoy \
           --serviceCluster \
           service-name \
           --drainDuration \
           45s \
           --parentShutdownDuration \
           1m0s \
           --discoveryAddress \
           istio-pilot.istio-system:15007 \
           --discoveryRefreshDelay \
           1s \
           --connectTimeout \
           10s \
           --proxyAdminPort \
           "15000" \
           --controlPlaneAuthPolicy \
           NONE
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         - name: INSTANCE_IP
           valueFrom:
             fieldRef:
               fieldPath: status.podIP
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: ISTIO_META_INTERCEPTION_MODE
           value: REDIRECT
         image: istio/proxyv2:1.0.0
         imagePullPolicy: IfNotPresent
         resources:
           requests:
             cpu: 100m
             memory: 128Mi
           limits:
             memory: 2048Mi
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsUser: 1337
         volumeMounts:
         - mountPath: /etc/istio/proxy
           name: istio-envoy