Feature gatekeeper

README.md

@@ -1,5 +1,9 @@
 # tfmod-kiali
 
+Kiali is a web console for the Istio Service Mesh. It is analogous to how the Kubernetes Dashboard is a web console for Kubernetes, ie. it is a web interface for viewing configurations and operations of the system. Additionally, the same as the Kubernetes Dashboard, we deploy Kiali in a read-only manner, given mesh objects should only be configured through code and pipelines, not modification through web or command line. Kiali provides a useful tool for reviewing configurations and topology, observing mesh health and performance, and tracing along with its associated details. Additional details about Kiali can be reviewed at the [Kiali website](https://kiali.io/).
+
+This module deploys and configures Kiali via its operator and integrates it with Istio and the other telemetry oriented tools of the cluster. 
+
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 

kiali-operator/Chart.yaml

@@ -1,20 +1,19 @@
 apiVersion: v2
-appVersion: v2.7.1
-description: Kiali is an open source project for service mesh observability, refer
-  to https://www.kiali.io for details.
+name: kiali-operator
+description: Kiali is an open source project for service mesh observability, refer to https://www.kiali.io for details.
+version: 0.0.0
+appVersion: 0.0.0
 home: https://github.com/kiali/kiali-operator
-icon: https://raw.githubusercontent.com/kiali/kiali.io/current/assets/icons/logo.svg
+maintainers:
+- name: Kiali
+  email: kiali-users@googlegroups.com
+  url: https://kiali.io
 keywords:
 - istio
 - kiali
 - operator
-maintainers:
-- email: kiali-users@googlegroups.com
-  name: Kiali
-  url: https://kiali.io
-name: kiali-operator
 sources:
 - https://github.com/kiali/kiali
 - https://github.com/kiali/kiali-operator
 - https://github.com/kiali/helm-charts
-version: 2.7.1
+icon: https://raw.githubusercontent.com/kiali/kiali.io/current/assets/icons/logo.svg

kiali-operator/templates/_helpers.tpl

@@ -52,3 +52,4 @@ Selector labels
 app.kubernetes.io/name: {{ include "kiali-operator.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
+

kiali-server/Chart.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: v2
+name: kiali
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

kiali-server/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kiali.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kiali.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kiali.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "kiali.labels" -}}
+helm.sh/chart: {{ include "kiali.chart" . }}
+{{ include "kiali.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "kiali.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "kiali.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kiali.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "kiali.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

kiali-server/templates/kiali.yaml

@@ -0,0 +1,38 @@
+apiVersion: kiali.io/v1alpha1
+kind: Kiali
+metadata:
+  name: {{ include "kiali.fullname" . }}
+  labels:
+    {{- include "kiali.labels" . | nindent 4 }}
+spec:
+  istio_namespace: {{ .Values.istioNamespace }}
+  auth:
+    strategy: {{ .Values.auth.strategy }}
+  deployment:
+    cluster_wide_access: true
+    view_only_mode: {{ .Values.deployment.view_only_mode }}
+  external_services:
+    prometheus:
+      enabled: true
+      auth:
+        insecure_skip_verify: true
+      url: {{ .Values.prometheus.url }}
+    grafana:
+      enabled: true
+      auth:
+        insecure_skip_verify: true
+      # auth:
+      #   type: basic
+      #   username: "admin"
+      #   password: secret:{{ .Values.grafana.secretName }}:{{ .Values.grafana.passwordKey }}
+      external_url: {{ .Values.grafana.externalUrl }}
+      internal_url: {{ .Values.grafana.internalUrl }}
+    tracing:
+      enabled: true
+      internal_url: {{ .Values.tracing.internalUrl }}
+      use_grpc: false
+      provider: "tempo"
+      tempo_config:
+        org_id: "1"
+        datasource_uid: {{ .Values.tracing.tempo_config.datasource_uid }}
+        url_format: "grafana"

kiali-server/values.yaml

@@ -0,0 +1,35 @@
+# Default values for kiali-server.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+istioNamespace: "istio-system"
+
+auth:
+  strategy:
+
+deployment:
+  view_only_mode:
+
+prometheus:
+  enabled: true
+  url:
+
+grafana:
+  enabled: true
+  auth:
+    type: basic
+    username: "admin"
+    secretName: 
+    passwordKey: 
+  externalUrl: 
+  internalUrl: 
+
+tracing:
+  enabled: true
+  internalUrl: 
+  use_grpc: false
+  provider: "tempo"
+  tempo_config:
+    org_id: "1"
+    datasource_uid: 
+    url_format: "grafana"

main.tf

@@ -1,16 +1,18 @@
 locals {
   internal_hostname    = format("%v.%v.svc.cluster.local", var.service_name, var.namespace)
   internal_port_number = "20001"
-  internal_url         = format("https://%s:%s/", local.internal_hostname, local.internal_port_number)
+  internal_url         = format("http://%s:%s/", local.internal_hostname, local.internal_port_number)
+  # This may seem unusual, but we cannot input/pass the grafana ingress url, since kiali is a dependency of gatekeeper 
+  # that creates the ingress (circular dep). So, we build the ingress url here using the same variables as gatekeeper.
+  grafana_public_url   = format("https://%s.%s", var.grafana_service_name, var.cluster_domain)
 }
 
 resource "helm_release" "kiali_operator" {
-  depends_on = [module.images]
-  chart      = "kiali-operator"
+
+  chart      = "./kiali-operator"
   version    = var.kiali_operator_version
   name       = "kiali-operator"
   namespace  = var.namespace
-  repository = "./"
 
   set {
     name = "image.repo"
@@ -58,7 +60,7 @@ resource "helm_release" "kiali_operator" {
   }
   set {
     name  = "grafana.externalUrl"
-    value = var.grafana_public_url
+    value = local.grafana_public_url
   }
   set {
     name  = "grafana.internalUrl"
@@ -70,13 +72,45 @@ resource "helm_release" "kiali_operator" {
   }
 }
 
-module "ingress_resources" {
-  depends_on = [helm_release.kiali_operator]
-  # tflint-ignore: terraform_module_pinned_source
-  source            = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git?ref=main"
-  public_hostname   = var.service_name
-  public_domain     = var.cluster_domain
-  service_name      = var.service_name
-  service_namespace = var.namespace
-  service_port      = local.internal_port_number
+resource "helm_release" "kiali" {
+  depends_on = [
+    helm_release.kiali_operator,
+  ]
+
+  chart      = "./kiali-server"
+  name       = "kiali"
+  namespace  = var.namespace
+
+  set {
+    name  = "auth.strategy"
+    value = "anonymous"
+  }
+  set {
+    name  = "deployment.view_only_mode"
+    value = true
+  }
+  set {
+    name  = "istioNamespace"
+    value = var.istio_namespace
+  }
+  set {
+    name  = "prometheus.url"
+    value = var.prometheus_internal_url
+  }
+  set {
+    name  = "grafana.externalUrl"
+    value = local.grafana_public_url
+  }
+  set {
+    name  = "grafana.internalUrl"
+    value = var.grafana_internal_url
+  }
+  set {
+    name  = "tracing.internalUrl"
+    value = var.tempo_internal_url
+  }
+  set {
+    name  = "tracing.tempo_config.datasource_uid"
+    value = var.tempo_datasource_id
+  }
 }

outputs.tf

@@ -1,7 +1,7 @@
-output "public_endpoint" {
-  description = "The endpoint at which keycloak can be reached from outside the cluster."
-  value       = module.ingress_resources.service_url
-}
+# output "public_endpoint" {
+#   description = "The endpoint at which keycloak can be reached from outside the cluster."
+#   value       = module.ingress_resources.service_url
+# }
 
 output "internal_endpoint" {
   description = "The internal endpoint to use to access kiali"
@@ -12,6 +12,11 @@ output "internal_endpoint" {
   }
 }
 
+output "namespace" {
+  description = "The namespace in which kiali gets installed in."
+  value       = var.namespace
+}
+
 ################################################################################
 # Module information
 ################################################################################

variables.tf

@@ -31,31 +31,31 @@ variable "grafana_secret_name" {
   type        = string
 }
 
-variable "grafana_public_url" {
-  description = "The URL incoming traffic from outisde the cluster uses to access grafana."
+variable "grafana_internal_url" {
+  description = "The url within the cluster to use to access grafana."
   type        = string
 }
 
-variable "grafana_internal_url" {
-  description = "The url within the cluster to use to access grafana."
+variable "grafana_service_name" {
+  description = "The name of the service used for grafana."
   type        = string
+  default     = "grafana"
 }
 
 variable "prometheus_internal_url" {
   description = "The url within the cluster to use to query the prometheus server."
   type        = string
 }
 
-# variable "jaeger_internal_url" {
-#   description = "The url within the cluster to use to query the jaegertracing."
-#   type        = string
-# }
+variable "tempo_internal_url" {
+  description = "The url within the cluster to use to query tempo tracing."
+  type        = string
+}
 
-# variable "public_hostname" {
-#   description = "The hostname to use for kiali that will be publicly available"
-#   type        = string
-#   default     = "kiali"
-# }
+variable "tempo_datasource_id" {
+  description = "The UID of the created Tempo datasource"
+  type        = string
+}
 
 # helm repo add kiali https://kiali.org/helm-charts
 # helm search repo kiali/kiali-operator