opta sets up istio with ingress and dmeo service (#10)

still trying to debug grpc demo

aws-acm-cert/certs.tf

@@ -0,0 +1,31 @@
+# Following example https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-3-upgrade#resource-aws_acm_certificate
+# which should have addressed the issue https://github.com/terraform-providers/terraform-provider-aws/issues/8531
+resource "aws_acm_certificate" "certificate" {
+  domain_name               = var.primary_domain
+  subject_alternative_names = var.secondary_domains
+  validation_method         = "DNS"
+  tags = {
+    terraform = "true"
+  }
+}
+
+resource "aws_route53_record" "validation_record" {
+  for_each = {
+    for dvo in aws_acm_certificate.certificate.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = var.hosted_zone_id
+}
+
+resource "aws_acm_certificate_validation" "example_com" {
+  certificate_arn         = aws_acm_certificate.certificate.arn
+  validation_record_fqdns = [for record in aws_route53_record.validation_record : record.fqdn]
+}

aws-acm-cert/outputs.tf

@@ -0,0 +1,3 @@
+output "cert_arn" {
+  value = aws_acm_certificate.certificate.arn
+}

aws-acm-cert/variables.tf

@@ -0,0 +1,15 @@
+variable "primary_domain" {
+  description = "Primary domain for the certs"
+  type        = string
+}
+
+variable "secondary_domains" {
+  description = "Secondary domains to add to the cert"
+  default     = []
+  type        = list(string)
+}
+
+variable "hosted_zone_id" {
+  description = "Hosted zone to make verfications for"
+  type        = string
+}

aws-dns/main.tf

@@ -0,0 +1,12 @@
+resource "aws_route53_zone" "public" {
+  count = var.is_private ? 0 : 1
+  name = var.domain_name
+}
+
+resource "aws_route53_zone" "private" {
+  count = var.is_private ? 1 : 0
+  name = var.domain_name
+  vpc {
+    vpc_id = var.vpc_id
+  }
+}

aws-dns/outputs.tf

@@ -0,0 +1,7 @@
+output "zone_id" {
+  value = var.is_private ? aws_route53_zone.private[0].zone_id : aws_route53_zone.public[0].zone_id
+}
+
+output "name_servers" {
+  value = var.is_private ? aws_route53_zone.private[0].name_servers : aws_route53_zone.public[0].name_servers
+}

aws-dns/variables.tf

@@ -0,0 +1,13 @@
+variable "domain_name" {
+  type = string
+}
+
+variable "is_private" {
+  type = bool
+  default = false
+}
+
+variable "vpc_id" {
+  type = string
+  default = ""
+}

istio-init/istio-extras/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

istio-init/istio-extras/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: istio-extras
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application.
+appVersion: 1.16.0

istio-init/istio-extras/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "istio-extras.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "istio-extras.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "istio-extras.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "istio-extras.labels" -}}
+app.kubernetes.io/name: {{ include "istio-extras.name" . }}
+helm.sh/chart: {{ include "istio-extras.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}

istio-init/istio-extras/templates/gateways.yaml

@@ -0,0 +1,35 @@
+# https://istio.io/latest/docs/reference/config/networking/gateway/
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: main-gateway
+spec:
+  selector:
+    istio: ingressgateway # use Istio default gateway implementation
+  servers:
+    - port:
+        number: 80
+        name: http
+        protocol: HTTP
+      hosts:
+      {{- range .Values.main_gateway.domain_names }}
+      - "{{ . }}"
+      {{ end -}}
+      tls:
+        httpsRedirect: true
+    - port:
+        number: 443
+        name: https
+        protocol: HTTP
+      hosts:
+        {{- range .Values.main_gateway.domain_names }}
+        - "{{ . }}"
+        {{ end -}}
+    - port:
+        number: 50051
+        name: grpc
+        protocol: GRPC
+      hosts:
+        {{- range .Values.main_gateway.domain_names }}
+        - "{{ . }}"
+        {{ end -}}

istio-init/istio-extras/templates/mtls.yaml

@@ -0,0 +1,9 @@
+# Strictly enforce it everywhere
+apiVersion: "security.istio.io/v1beta1"
+kind: "PeerAuthentication"
+metadata:
+  name: "default"
+  namespace: "istio-system"
+spec:
+  mtls:
+    mode: STRICT

istio-init/istio-extras/values.yaml

@@ -0,0 +1,2 @@
+main_gateway:
+  domain_names: []

istio-init/istio-vanilla-profile/templates/istio_profile.yaml

@@ -2,8 +2,54 @@ apiVersion: install.istio.io/v1alpha1
 kind: IstioOperator
 metadata:
   namespace: istio-system
-  name: example-istiocontrolplane
+  name: istiocontrolplane
   labels:
   {{- include "istio-vanilla-profile.labels" . | nindent 4 }}
 spec:
-  profile: demo
+  profile: demo
+  components:
+    ingressGateways:
+      - name: istio-ingressgateway
+        enabled: true
+        k8s:
+          service:
+            externalTrafficPolicy: Local
+            ports:
+            - name: status-port
+              port: 15021
+              protocol: TCP
+              targetPort: 15021
+            - name: http2
+              port: 80
+              protocol: TCP
+              targetPort: 8080
+            - name: https
+              port: 443
+              protocol: TCP
+              targetPort: 8443
+            - name: tcp
+              port: 31400
+              protocol: TCP
+              targetPort: 31400
+            - name: grpc
+              port: 50051
+              protocol: TCP
+              targetPort: 50051
+            - name: tls
+              port: 15443
+              protocol: TCP
+              targetPort: 15443
+  values:
+    gateways:
+      istio-ingressgateway:
+        loadBalancerSourceRanges:
+          - 0.0.0.0/0
+        serviceAnnotations:
+          service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+          service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https,grpc"
+          {{- if .Values.ssl_cert_arn }}
+          service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Values.ssl_cert_arn }}
+          {{- end }}
+          {{- if .Values.domain_names }}
+          external-dns.alpha.kubernetes.io/hostname: {{ join "," .Values.domain_names }}
+          {{- end }}

istio-init/istio-vanilla-profile/values.yaml

@@ -1 +1,2 @@
-
+domain_names: []
+ssl_cert_arn: ""

istio-init/main.tf

@@ -27,4 +27,26 @@ resource "helm_release" "istio-vanilla-profile" {
   atomic = true
   depends_on = [helm_release.istio-operator]
   create_namespace = true
+  values = [
+    yamlencode({
+      domain_names: var.domain_names
+      ssl_cert_arn: var.acm_cert_arn
+    })
+  ]
+}
+
+resource "helm_release" "istio-extras" {
+  chart = "${path.module}/istio-extras"
+  name = "istio-extras"
+  namespace = "istio-system"
+  cleanup_on_fail = true
+  atomic = true
+  values = [
+    yamlencode({
+      main_gateway: {
+        domain_names: var.domain_names
+      }
+    })
+  ]
+  depends_on = [helm_release.istio-vanilla-profile]
 }

istio-init/variables.tf

@@ -0,0 +1,9 @@
+variable "domain_names" {
+  type = list(string)
+  default = []
+}
+
+variable "acm_cert_arn" {
+  type = string
+  default = ""
+}

k8s-external-dns/iam.tf

@@ -0,0 +1,45 @@
+data "aws_iam_policy_document" "external_dns" {
+  statement {
+    sid = "ChangeResourceRecordSets"
+    resources = ["arn:aws:route53:::hostedzone/*"]
+    actions = ["route53:ChangeResourceRecordSets"]
+  }
+  statement {
+    sid = "DescribeRoute53"
+    resources = ["*"]
+    actions = [
+      "route53:ListHostedZones",
+      "route53:ListResourceRecordSets"
+    ]
+  }
+}
+
+resource "aws_iam_policy" "external_dns" {
+  name = "external-dns"
+  policy = data.aws_iam_policy_document.external_dns.json
+}
+
+data "aws_iam_policy_document" "external_dns_trust" {
+  statement {
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+    condition {
+      test = "StringEquals"
+      values = ["system:serviceaccount:external-dns:external-dns"]
+      variable = "${replace(var.openid_provider_url, "https://", "")}:sub"
+    }
+    principals {
+      identifiers = [var.openid_provider_arn]
+      type = "Federated"
+    }
+  }
+}
+
+resource "aws_iam_role" "external_dns" {
+  name = "external-dns"
+  assume_role_policy = data.aws_iam_policy_document.external_dns_trust.json
+}
+
+resource "aws_iam_role_policy_attachment" "external_dns" {
+  policy_arn = aws_iam_policy.external_dns.arn
+  role = aws_iam_role.external_dns.name
+}