first commit

.gitignore

@@ -0,0 +1,38 @@
+# Local .terraform directories
+**/.terraform/*
+
+# terraform lock file.
+**/.terraform.lock.hcl
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data,
+# such as password, private keys, and other secrets. These should not be
+# part of version control as they are data points which are potentially
+# sensitive and subject to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources
+# locally and so are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+

README.md

@@ -0,0 +1,2 @@
+# tfmod-istio-tools
+# tfmod-kiali

chart/kiali/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

chart/kiali/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: kiali
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

chart/kiali/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kiali.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kiali.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kiali.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "kiali.labels" -}}
+helm.sh/chart: {{ include "kiali.chart" . }}
+{{ include "kiali.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "kiali.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "kiali.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kiali.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "kiali.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

chart/kiali/templates/kiali.yaml

@@ -0,0 +1,32 @@
+apiVersion: kiali.io/v1alpha1
+kind: Kiali
+metadata:
+  name: {{ include "kiali.fullname" . }}
+  labels:
+    {{- include "kiali.labels" . | nindent 4 }}
+spec:
+  image_version: "operator_version"
+  istio_namespace: {{ .Values.istioNamespace | quote }}
+  deployment:
+    accessible_namespaces: "**"
+  external_services:
+    grafana:
+      auth:
+        type: "basic"
+        username: {{ .Values.grafanaUserName  | quote }}
+        password: "secret:{{ .Values.grafanaSecretName }}:{{ .Values.grafanaSecretPasswordKey }}"
+      in_cluster_url: {{ .Values.grafanaInClusterUrl | quote}}
+      url: {{ .Values.grafanaPublicUrl | quote }}
+    prometheus:
+      url: {{ .Values.prometheusInClusterUrl | quote }}
+    tracing:
+      in_cluster_url: {{ .Values.jaegerInClusterUrl | quote }}
+  auth:
+    strategy: {{ .Values.kialiAuthStrategy }}
+{{ if eq .Values.kialiAuthStrategy "openid" }}
+    openid:
+      client_id: {{ .Values.openid.clientId | quote }}
+      disable_rbac: {{ .Values.openid.disableRbac }}
+      issuer_uri: {{ .Values.openid.issuerUri | quote }}
+      username_claim: {{ .Values.openid.username_claim | quote }}
+{{- end }}

chart/kiali/templates/secret.yaml

@@ -0,0 +1,10 @@
+{{ if .Values.openid.secret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kiali
+  labels:
+    {{- include "kiali.labels" . | nindent 4 }}
+stringData:
+  oidc-secret: {{ .Values.openid.secret | quote }}
+{{- end }}

chart/kiali/values.yaml

@@ -0,0 +1,21 @@
+
+publicHostname: "kiali"
+publicDomain: "cluster.domain"
+
+istioNamespace: "istio-system"
+prometheusInClusterUrl: "http://loki-prometheus-server.logging.svc.cluster.local/"
+jaegerInClusterUrl: "http://istio-jaeger-query.istio-tools.svc.cluster.local:16686/"
+grafanaInClusterUrl: "http://loki-grafana.logging.svc.cluster.local/"
+grafanaPublicUrl: "https://grafana.cluster.domain/"
+grafanaUserName: "admin"
+grafanaSecretName: "kiali"
+grafanaSecretPasswordKey: "grafana_password"
+
+kialiAuthStrategy: openid
+openid:
+  clientId: "sso_admin_client_id"
+  secret: "sso_admin_client_secret"
+  disableRbac: true
+  issuerUri: "https://keycloak.cluster.domain/realms/sso_admin_realm"
+  usernameClaim: "username_claim"
+

copy_images.tf

@@ -0,0 +1,46 @@
+locals {
+  kiali_operator_key = format("%v#%v", "istio-tools/kiali-operator", var.kiali_application_version)
+  kiali_key          = format("%v#%v", "istio-tools/kiali", var.kiali_application_version)
+
+  image_config = [
+    ## Images for Kiali
+    {
+      enabled         = true
+      dest_path       = null
+      name            = "istio-tools/kiali-operator"
+      source_image    = "kiali/kiali-operator"
+      source_registry = "quay.io"
+      source_tag      = var.kiali_application_version
+      tag             = var.kiali_application_version
+    },
+    {
+      enabled         = true
+      dest_path       = null
+      name            = "istio-tools/kiali"
+      source_image    = "kiali/kiali"
+      source_registry = "quay.io"
+      source_tag      = var.kiali_application_version
+      tag             = var.kiali_application_version
+    },
+  ]
+}
+
+module "images" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=2.0.2"
+
+  profile          = var.profile
+  application_name = var.cluster_name
+  image_config     = local.image_config
+  tags             = {}
+
+  ### optional
+  ##  account_alias        = ""
+  ##  account_id           = ""
+  ##  destination_password = ""
+  ##  destination_username = ""
+  ##  override_prefixes    = {}
+  ##  region               = ""
+  ##  source_password      = ""
+  ##  source_username      = ""
+}
+