Skip to content

Commit ad89a41

Browse files
upodroidupodroid
authored
Deploy Istio to the utility cluster (#7341)
* deploy istio to utility cluster * tweak gateway addresses * fix linting errors --------- Co-authored-by: upodroid <upodroid@users.noreply.github.com>
1 parent 4ef41d1 commit ad89a41

13 files changed

+328
-22
lines changed

‎kubernetes/apps/istio.yaml

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: istio-base
5+
annotations:
6+
argocd.argoproj.io/sync-wave: "-3"
7+
spec:
8+
destination:
9+
name: gke-utility
10+
namespace: istio-system
11+
project: default
12+
sources:
13+
- chart: base
14+
repoURL: https://istio-release.storage.googleapis.com/charts
15+
targetRevision: 1.23.2
16+
- path: config/crd/experimental
17+
repoURL: https://github.com/kubernetes-sigs/gateway-api
18+
targetRevision: v1.1.0
19+
ignoreDifferences:
20+
- group: admissionregistration.k8s.io
21+
kind: ValidatingWebhookConfiguration
22+
jsonPointers:
23+
- /webhooks/0/failurePolicy
24+
syncPolicy:
25+
automated:
26+
prune: true
27+
selfHeal: true
28+
syncOptions:
29+
- CreateNamespace=true
30+
---
31+
apiVersion: argoproj.io/v1alpha1
32+
kind: Application
33+
metadata:
34+
name: istio
35+
spec:
36+
destination:
37+
name: gke-utility
38+
namespace: istio-system
39+
project: default
40+
sources:
41+
- chart: istiod
42+
repoURL: https://istio-release.storage.googleapis.com/charts
43+
targetRevision: 1.23.2
44+
helm:
45+
values: |
46+
global:
47+
hub: gcr.io/istio-release
48+
istiod:
49+
enableAnalysis: true
50+
meshConfig:
51+
accessLogFile: /dev/stdout
52+
enablePrometheusMerge: true
53+
protocolDetectionTimeout: 5s
54+
enableTracing: true
55+
defaultConfig:
56+
tracing:
57+
extensionProviders:
58+
- name: stackdriver
59+
stackdriver:
60+
- name: "oauth2-proxy"
61+
envoyExtAuthzHttp:
62+
service: "oauth2-proxy.oauth2-proxy.svc.cluster.local"
63+
port: "80"
64+
headersToDownstreamOnDeny:
65+
- content-type
66+
- set-cookie
67+
headersToUpstreamOnAllow:
68+
- authorization
69+
- cookie
70+
- path
71+
- x-*
72+
includeHeadersInCheck:
73+
- authorization
74+
- cookie
75+
- user-agent
76+
includeAdditionalHeadersInCheck:
77+
X-Auth-Request-Redirect: https://%REQ(Host)%%REQ(:PATH)%
78+
defaultConfig:
79+
gatewayTopology:
80+
numTrustedProxies: 2
81+
telemetry:
82+
enabled: true
83+
v2:
84+
prometheus:
85+
enabled: true
86+
wasmEnabled: false
87+
- path: kubernetes/gke-utility/istio-system
88+
repoURL: https://github.com/kubernetes/k8s.io
89+
targetRevision: main
90+
ignoreDifferences:
91+
- group: admissionregistration.k8s.io
92+
kind: ValidatingWebhookConfiguration
93+
jsonPointers:
94+
- /webhooks/0/failurePolicy
95+
syncPolicy:
96+
automated:
97+
prune: true
98+
selfHeal: true

‎kubernetes/apps/kustomization.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,5 @@ resources:
66
- cert-manager.yaml
77
# - ingress-nginx.yaml
88
- prow.yaml
9+
- istio.yaml
10+
- oauth2-proxy.yaml

‎kubernetes/apps/oauth2-proxy.yaml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ApplicationSet
3+
metadata:
4+
name: oauth2-proxy
5+
spec:
6+
goTemplate: true
7+
generators:
8+
- clusters:
9+
selector:
10+
matchLabels:
11+
clusterType: 'utility'
12+
template:
13+
metadata:
14+
name: 'oauth2-proxy-{{ .name }}'
15+
spec:
16+
destination:
17+
namespace: oauth2-proxy
18+
server: "{{ .server }}"
19+
project: default
20+
sources:
21+
- chart: oauth2-proxy
22+
repoURL: 'https://oauth2-proxy.github.io/manifests'
23+
targetRevision: 7.7.19
24+
helm:
25+
releaseName: oauth2-proxy
26+
valueFiles:
27+
- $values/kubernetes/{{ .name }}/helm/oauth2-proxy.yaml
28+
- repoURL: 'https://github.com/kubernetes/k8s.io.git'
29+
targetRevision: main
30+
ref: values
31+
syncPolicy:
32+
automated:
33+
prune: true
34+
selfHeal: true
35+
syncOptions:
36+
- CreateNamespace=true
37+
managedNamespaceMetadata:
38+
labels:
39+
istio-injection: enabled

‎kubernetes/gke-utility/argocd/argocd-cm-rbac.yaml

-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,3 @@ metadata:
44
name: argocd-rbac-cm
55
data:
66
policy.default: role:readonly
7-
policy.csv: |
8-
g, kubernetes:sig-k8s-infra-leads, role:admin
9-
scopes: '[groups, email]'

‎kubernetes/gke-utility/argocd/argocd-cm.yaml

+7-13
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,11 @@ data:
1212
ignoreDifferences: |
1313
jqPathExpressions:
1414
- '.webhooks[]?.clientConfig.caBundle'
15+
resource.exclusions: |
16+
- apiGroups:
17+
- cilium.io
18+
kinds:
19+
- CiliumIdentity
20+
clusters:
21+
- "*"
1522
kustomize.buildOptions: --load-restrictor LoadRestrictionsNone --enable-alpha-plugins
16-
dex.config: |
17-
connectors:
18-
- type: github
19-
id: github
20-
name: GitHub
21-
config:
22-
clientID: $dex.github.clientId
23-
clientSecret: $dex.github.clientSecret
24-
orgs:
25-
- name: kubernetes
26-
useLoginAsID: true
27-
loadAllGroups: true
28-
teamNameField: slug

‎kubernetes/gke-utility/argocd/argocd-cmd-params-cm.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: argocd-cmd-params-cm
5+
data:
6+
server.insecure: "true" # Safe as we are using Istio Mesh

‎kubernetes/gke-utility/argocd/extras.yaml

+39-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ metadata:
66
labels:
77
argocd.argoproj.io/secret-type: repository
88
stringData:
9-
url: https://github.com/kubernetes
9+
url: https://github.com/kubernetes/k8s.io
1010
name: kubernetes
1111
type: git
1212
---
@@ -27,3 +27,41 @@ spec:
2727
automated:
2828
prune: false
2929
selfHeal: true
30+
---
31+
apiVersion: gateway.networking.k8s.io/v1
32+
kind: HTTPRoute
33+
metadata:
34+
name: argocd
35+
spec:
36+
hostnames:
37+
- argo.k8s.io
38+
parentRefs:
39+
- name: istio-ingressgateway
40+
namespace: istio-system
41+
sectionName: https
42+
rules:
43+
- backendRefs:
44+
- name: argocd-server
45+
port: 80
46+
---
47+
apiVersion: security.istio.io/v1
48+
kind: AuthorizationPolicy
49+
metadata:
50+
name: argocd
51+
spec:
52+
selector:
53+
matchLabels:
54+
app.kubernetes.io/name: argocd-server
55+
action: ALLOW
56+
rules:
57+
- from:
58+
- source:
59+
namespaces:
60+
- istio-system
61+
when:
62+
- key: request.headers[X-Auth-Request-User]
63+
values:
64+
- dims
65+
- upodroid
66+
- ameukam
67+
- BenTheElder

‎kubernetes/gke-utility/argocd/kustomization.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ resources:
88
- clusters.yaml
99

1010
patches:
11+
- path: argocd-cmd-params-cm.yaml
1112
- path: argocd-cm.yaml
1213
- path: argocd-cm-rbac.yaml
1314
- path: argocd-sa.yaml

‎kubernetes/gke-utility/helm/cert-manager.yaml

+6-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
installCRDs: true
1+
crds:
2+
enabled: true
23
extraObjects:
3-
- apiVersion: cert-manager.io/v1
4+
- |
5+
apiVersion: cert-manager.io/v1
46
kind: ClusterIssuer
57
metadata:
68
name: letsencrypt-prod
@@ -11,6 +13,5 @@ extraObjects:
1113
privateKeySecretRef:
1214
name: letsencrypt-prod
1315
solvers:
14-
- http01:
15-
ingress:
16-
ingressClassName: nginx
16+
- cloudDNS:
17+
project: kubernetes-public

‎kubernetes/gke-utility/helm/oauth2-proxy.yaml

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
config:
2+
existingSecret: oauth2-proxy-creds
3+
4+
extraArgs:
5+
provider: github
6+
github-org: kubernetes
7+
redirect-url: https://oauth2-proxy.k8s.io/oauth2/callback
8+
reverse-proxy: true
9+
pass-access-token: true
10+
pass-user-headers: true
11+
pass-authorization-header: true
12+
cookie-samesite: lax
13+
cookie-domain: .k8s.io
14+
set-xauthrequest: true
15+
whitelist-domain: "*.k8s.io"
16+
skip-provider-button: true
17+
skip-jwt-bearer-tokens: true
18+
upstream: static://200
19+
silence-ping-logging: true
20+
show-debug-on-error: true
21+
22+
metrics:
23+
serviceMonitor:
24+
enabled: false #enable when observability stack is ready
25+
26+
extraObjects:
27+
- apiVersion: external-secrets.io/v1beta1
28+
kind: ExternalSecret
29+
metadata:
30+
name: oauth2-proxy-creds
31+
namespace: "{{ .Release.Namespace }}"
32+
spec:
33+
dataFrom:
34+
- extract:
35+
key: oauth2-proxy-creds
36+
secretStoreRef:
37+
kind: ClusterSecretStore
38+
name: k8s-infra-prow
39+
- apiVersion: gateway.networking.k8s.io/v1
40+
kind: HTTPRoute
41+
metadata:
42+
name: oauth2-proxy
43+
namespace: "{{ .Release.Namespace }}"
44+
spec:
45+
hostnames:
46+
- oauth2-proxy.k8s.io
47+
parentRefs:
48+
- name: istio-ingressgateway
49+
namespace: istio-system
50+
sectionName: https
51+
rules:
52+
- backendRefs:
53+
- name: oauth2-proxy
54+
port: 80

‎kubernetes/gke-utility/istio-system/auth-policy.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: security.istio.io/v1
2+
kind: AuthorizationPolicy
3+
metadata:
4+
name: oauth-policy
5+
spec:
6+
targetRefs:
7+
- name: istio-ingressgateway
8+
kind: Gateway
9+
group: gateway.networking.k8s.io
10+
action: CUSTOM
11+
provider:
12+
name: oauth2-proxy
13+
rules:
14+
- to:
15+
- operation:
16+
hosts:
17+
- argo.k8s.io

‎kubernetes/gke-utility/istio-system/gateway.yaml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: Gateway
3+
metadata:
4+
name: istio-ingressgateway
5+
annotations:
6+
cloud.google.com/l4-rbs: enabled
7+
networking.gke.io/load-balancer-ip-addresses: utility-ingress-v4,utility-ingress-v6
8+
spec:
9+
gatewayClassName: istio
10+
listeners:
11+
- name: http
12+
port: 80
13+
protocol: HTTP
14+
- name: https
15+
port: 443
16+
protocol: HTTPS
17+
allowedRoutes:
18+
namespaces:
19+
from: All
20+
tls:
21+
mode: Terminate
22+
certificateRefs:
23+
- name: k8s-io-wild-cert
24+
---
25+
apiVersion: gateway.networking.k8s.io/v1
26+
kind: HTTPRoute
27+
metadata:
28+
name: https-gateway-redirect
29+
spec:
30+
parentRefs:
31+
- name: istio-ingressgateway
32+
sectionName: http
33+
hostnames:
34+
- '*.k8s.io'
35+
rules:
36+
- filters:
37+
- type: RequestRedirect
38+
requestRedirect:
39+
scheme: https
40+
statusCode: 302
41+
---
42+
apiVersion: cert-manager.io/v1
43+
kind: Certificate
44+
metadata:
45+
name: k8s-io-wild
46+
spec:
47+
secretName: k8s-io-wild-cert
48+
issuerRef:
49+
name: letsencrypt-prod
50+
kind: ClusterIssuer
51+
commonName: '*.k8s.io'
52+
dnsNames:
53+
- '*.k8s.io'

‎kubernetes/gke-utility/istio-system/kustomization.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: istio-system
4+
resources:
5+
- auth-policy.yaml
6+
- gateway.yaml

0 commit comments

Comments
 (0)