Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(istio): re-onboard + upgrade + split #843

Merged
merged 18 commits into from
Sep 12, 2023
Merged

feat(istio): re-onboard + upgrade + split #843

merged 18 commits into from
Sep 12, 2023

Conversation

davidspek
Copy link
Contributor

@davidspek davidspek commented Sep 11, 2023 •
edited
Loading

Summary

This PR upgrades our Istio installation and migrates it from the Operator installation mechanism to the (new) Helm charts. It also splits the installation of the control plane (istio discovery), ingress (istio-ingress) and optional CNI plugin (istio-cni) into separate applications to follow security best practices. Similarly and to improve user clarity and maintainability the Kiali installation is split into a separate application.

Test Plan

Checklist

  • No images hosted from dockerhub
  • Are dashboards present to understand the health of the application. There must be at least 1 of these
    • all databases should have dashboards
    • ideally also have at least cpu/mem utilization dashboards for webserver tier of the app
    • you can use plural from-grafana to convert a grafana dashboard found via google to our CRD
  • Are scaling runbooks present
    • all databases must have scaling runbooks
    • you can use the charts in pluralsh/module-library to accelerate this
  • do you need to add config overlays?
    • inputing secrets
    • configuring autoscaling
  • If there’s a web-facing component to the app, we need to support OIDC authentication and setting up private networks if no authentication option is viable
  • All major clouds must be supported
    • Azure
    • AWS
    • GCP

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@davidspek
fix template
276b8d1 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
some fixes after pushing
008dd4a 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
some initial kiali fixes
ea5ca1a 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
add default istio gateway to ingress chart
2a1e02d 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
some fixes for aws nlb ingress + kiali vs
eff2f5e 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
fix(kiali): allow for oidc login
e3bebab 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
fix(kiali): allow it to work with sidecar
4c39f3e 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
fix(kiali): grafana integration
d0814b1 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
some more kiali templating cleanup
4bd5986 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
set gateway to 2 replicas + kiali labels
a54a0df 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
deps and template fixes
f0986f9 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
fix(kiali): enable support for mimir
44c7006 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
enable tracing
632c386 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
update istio dashboards
5c3cfd3 
Signed-off-by: David van der Spek <[email protected]>
@davidspek
bump chart versions
96c6779 
Signed-off-by: David van der Spek <[email protected]>
@davidspek davidspek marked this pull request as ready for review September 12, 2023 12:09
@davidspek
remove breaking flag
020cdc0 
Signed-off-by: David van der Spek <[email protected]>
rauerhans
rauerhans approved these changes Sep 12, 2023
View reviewed changes
Copy link
Collaborator

@rauerhans rauerhans left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, mostly, see the ref incorrect providers in desc.
Other than that, is there nothing in one of these apps, that is dependent on one of the others, or is it all completely independent, yet they work seemlessly together?

istio-cni/plural/recipes/istio-cni-gcp.yaml Outdated
@@ -0,0 +1,17 @@
name: istio-cni-gcp
description: Installs istio-cni on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gcp gke

istio-cni/plural/recipes/istio-cni-azure.yaml Outdated
@@ -0,0 +1,17 @@
name: istio-cni-azure
description: Installs istio-cni on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azure aks

istio-ingress/plural/recipes/istio-ingress-azure.yaml Outdated
@@ -0,0 +1,15 @@
name: istio-ingress-azure
description: Installs istio-ingress on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

istio-ingress/plural/recipes/istio-ingress-gcp.yaml Outdated
@@ -0,0 +1,15 @@
name: istio-ingress-gcp
description: Installs istio-ingress on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

kiali/plural/recipes/kiali-azure.yaml Outdated
@@ -0,0 +1,28 @@
name: kiali-azure
description: Installs kiali on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

kiali/plural/recipes/kiali-gcp.yaml Outdated
@@ -0,0 +1,28 @@
name: kiali-gcp
description: Installs kiali on an aws eks cluster
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@davidspek
fix recipes
dbc39cd 
Signed-off-by: David van der Spek <[email protected]>
@davidspek davidspek merged commit 7bbc2f3 into main Sep 12, 2023
@davidspek davidspek deleted the istio-refresh branch September 12, 2023 13:09
@plural-bot
Copy link
Contributor

🎉 This PR is included in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@plural-bot
Copy link
Contributor

🎉 This PR is included in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@plural-bot
Copy link
Contributor

🎉 This PR is included in version 1.14.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@davidspek davidspek restored the istio-refresh branch December 19, 2023 14:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rauerhans rauerhans rauerhans approved these changes

@michaeljguarino michaeljguarino Awaiting requested review from michaeljguarino michaeljguarino is a code owner

Assignees
No one assigned
Labels
released
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@davidspek @plural-bot @rauerhans