Skip to content

Commit fd353b2

Browse files
stefanprodanstefanprodan
authored
Merge pull request #69 from stefanprodan/kubecon-test
Move sidecars injection in Git
2 parents adecf6a + abcef3d commit fd353b2

File tree

10 files changed

+818
-9
lines changed

10 files changed

+818
-9
lines changed

‎.github/workflows/analyze.yaml

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,12 @@ jobs:
2323
echo "ISTIO_VERSION=$ISTIO_VERSION" >> $GITHUB_ENV
2424
- name: Get Istio CTL URL
2525
id: get-istioctl
26-
uses: istio/get-istioctl@e9b2b82bc1cecf150ec6aee77ceee8c256f4faf4
26+
uses: istio/get-istioctl@v0.3
2727
with:
2828
version: ${{ env.ISTIO_VERSION }}
29-
- name: Download Istio CTL
30-
run: |
31-
curl -o istioctl.tar.gz -fsLO ${{ steps.get-istioctl.outputs.istioctl-url }}
32-
tar -xzf istioctl.tar.gz
33-
./istioctl version --remote=false
3429
- name: Analyze manifests
3530
run: |
36-
./istioctl analyze -A --use-kube=false \
31+
istioctl analyze -A --use-kube=false \
3732
--failure-threshold ERROR \
38-
$(find . -not -path "*/.git*/*" -not -path "*/clusters/*" -name "*.yaml" -type f)
33+
$(find . -not -path "*/.git*/*" -not -path "*/clusters/*" \
34+
-not -name "*.patch.yaml" -not -name "kustomization.yaml" -name "*.yaml" -type f)

‎.github/workflows/inject-sidecar.yaml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: inject-sidecar
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
inject-istio:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v2
15+
- uses: chrisdickinson/setup-yq@latest
16+
with:
17+
yq-version: v4.25.1
18+
- name: get istio controlplane version
19+
id: get-istio-version
20+
run: |
21+
ISTIO_VERSION=$(yq eval '.data.version' ./clusters/my-cluster/istio-version.yaml)
22+
echo "ISTIO_VERSION=$ISTIO_VERSION" >> $GITHUB_ENV
23+
- name: get istioctl uri
24+
id: get-istioctl
25+
uses: istio/[email protected]
26+
with:
27+
version: ${{ env.ISTIO_VERSION }}
28+
- uses: azure/setup-helm@v1
29+
id: install
30+
- name: Get Istioctl
31+
run: |
32+
istioctl version --remote=false
33+
34+
- uses: "actions/setup-python@v2"
35+
with:
36+
python-version: "3.8"
37+
- name: Inject Sidecar
38+
id: inject
39+
run: |
40+
# hydrate isto manifest into configmap files
41+
42+
URI=$(cat istio/system/istio.yaml | yq e '. | select(.kind == "HelmRepository" and .metadata.name =="istio") | .spec.url' -)
43+
cat istio/system/istio.yaml | yq e '. | select(.kind == "HelmRelease" and .metadata.name =="istiod") | .spec.values' - > values.yaml
44+
VERSION=$(cat clusters/my-cluster/istio-version.yaml | yq e '.data.version' -)
45+
helm repo add istio $URI
46+
helm template -f values.yaml --version $VERSION istiod istio/istiod | yq e '.| select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector") | .data.config' - > injector.yaml
47+
helm template -f values.yaml --version $VERSION istiod istio/istiod | yq e '.| select(.kind == "ConfigMap" and .metadata.name == "istio") | .data.mesh' - > mesh.yaml
48+
helm template -f values.yaml --version $VERSION istiod istio/istiod | yq e '.| select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector") | .data.values' - > inj-values.yaml
49+
50+
python -m pip install jsonpatch
51+
52+
inject() {
53+
NAME="${1%.*}"
54+
echo "name =$NAME"
55+
EXTENSION="${1##*.}"
56+
echo "ext =$EXTENSION"
57+
istioctl kube-inject \
58+
--injectConfigFile injector.yaml \
59+
--meshConfigFile mesh.yaml \
60+
--valuesFile inj-values.yaml \
61+
-f $1 -o $NAME.gen.$EXTENSION
62+
63+
# injected yaml ends with '---', so remove before converting to json
64+
yq -N eval '.' $NAME.gen.$EXTENSION | yq -N -o json eval > $NAME.gen.json
65+
yq eval -o=json $NAME.$EXTENSION > $NAME.json
66+
67+
python ./.github/workflows/jsondiff.py "$(pwd)""${NAME#.}".json "$(pwd)"/$NAME.gen.json > $NAME.patch.json
68+
yq eval -P $NAME.patch.json > $NAME.patch.$EXTENSION
69+
rm $NAME.gen.$EXTENSION
70+
rm $NAME.json
71+
rm $NAME.gen.json
72+
rm $NAME.patch.json
73+
}
74+
75+
export -f inject
76+
77+
find . -not -path "*/istio-$ISTIO_VERSION/*" \
78+
-not -path "*/.git*/*" -not -path "*/clusters/*" -name "*.yaml" \
79+
-not -path "*/istio/operator/manifests.yaml" -name "*deployment.yaml" \
80+
-print0 | xargs -0 -I{} bash -c "inject {}"
81+
82+
rm manifests.yaml injector.yaml values.yaml mesh.yaml
83+
if [[ $(git diff --stat) != '' ]]; then
84+
echo ::set-output name=version::${ISTIO_VERSION}
85+
fi
86+
- name: Create Pull Request
87+
uses: peter-evans/create-pull-request@v3
88+
if: steps.inject.outputs.version
89+
with:
90+
token: ${{ secrets.GH_ADMIN_TOKEN }}
91+
committer: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
92+
author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
93+
commit-message: Update Sidecars to ${{ env.ISTIO_VERSION }}
94+
title: Update Istio sidecar ${{ env.ISTIO_VERSION }}
95+
body: |
96+
Istio sidecar v${{ env.ISTIO_VERSION }}
97+
branch: update-sidecar-${{ env.ISTIO_VERSION }}

‎.github/workflows/jsondiff.py

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
4+
from __future__ import print_function
5+
6+
import sys
7+
import json
8+
import jsonpatch
9+
import argparse
10+
11+
12+
parser = argparse.ArgumentParser(description='Diff two JSON files')
13+
parser.add_argument('FILE1', type=argparse.FileType('r'))
14+
parser.add_argument('FILE2', type=argparse.FileType('r'))
15+
parser.add_argument('--indent', type=int, default=None,
16+
help='Indent output by n spaces')
17+
parser.add_argument('-v', '--version', action='version',
18+
version='%(prog)s ' + jsonpatch.__version__)
19+
20+
21+
def main():
22+
try:
23+
diff_files()
24+
except KeyboardInterrupt:
25+
sys.exit(1)
26+
27+
28+
def diff_files():
29+
""" Diffs two JSON files and prints a patch """
30+
args = parser.parse_args()
31+
doc1 = json.load(args.FILE1)
32+
doc2 = json.load(args.FILE2)
33+
patch = jsonpatch.make_patch(doc1, doc2)
34+
if patch.patch:
35+
print(json.dumps(patch.patch, indent=args.indent))
36+
sys.exit(1)
37+
38+
if __name__ == "__main__":
39+
main()

‎apps/backend/deployment.patch.yaml

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
- op: add
2+
path: /status
3+
value: {}
4+
- op: add
5+
path: /spec/template/spec/volumes
6+
value:
7+
- emptyDir:
8+
medium: Memory
9+
name: istio-envoy
10+
- emptyDir: {}
11+
name: istio-data
12+
- downwardAPI:
13+
items:
14+
- fieldRef:
15+
fieldPath: metadata.labels
16+
path: labels
17+
- fieldRef:
18+
fieldPath: metadata.annotations
19+
path: annotations
20+
name: istio-podinfo
21+
- name: istio-token
22+
projected:
23+
sources:
24+
- serviceAccountToken:
25+
audience: istio-ca
26+
expirationSeconds: 43200
27+
path: istio-token
28+
- configMap:
29+
name: istio-ca-root-cert
30+
name: istiod-ca-cert
31+
- op: add
32+
path: /spec/template/spec/securityContext
33+
value:
34+
fsGroup: 1337
35+
- op: add
36+
path: /spec/template/spec/initContainers
37+
value:
38+
- args:
39+
- istio-iptables
40+
- -p
41+
- "15001"
42+
- -z
43+
- "15006"
44+
- -u
45+
- "1337"
46+
- -m
47+
- REDIRECT
48+
- -i
49+
- '*'
50+
- -x
51+
- ""
52+
- -b
53+
- '*'
54+
- -d
55+
- 15090,15021,15020
56+
image: docker.io/istio/proxyv2:1.13.2
57+
name: istio-init
58+
resources:
59+
limits:
60+
cpu: "2"
61+
memory: 1Gi
62+
requests:
63+
cpu: 10m
64+
memory: 40Mi
65+
securityContext:
66+
allowPrivilegeEscalation: false
67+
capabilities:
68+
add:
69+
- NET_ADMIN
70+
- NET_RAW
71+
drop:
72+
- ALL
73+
privileged: false
74+
readOnlyRootFilesystem: false
75+
runAsGroup: 0
76+
runAsNonRoot: false
77+
runAsUser: 0
78+
- op: replace
79+
path: /spec/template/spec/containers/0/resources/limits/cpu
80+
value: "2"
81+
- op: add
82+
path: /spec/template/spec/containers/1
83+
value:
84+
args:
85+
- proxy
86+
- sidecar
87+
- --domain
88+
- $(POD_NAMESPACE).svc.cluster.local
89+
- --proxyLogLevel=warning
90+
- --proxyComponentLogLevel=misc:error
91+
- --log_output_level=default:info
92+
- --concurrency
93+
- "2"
94+
env:
95+
- name: JWT_POLICY
96+
value: third-party-jwt
97+
- name: PILOT_CERT_PROVIDER
98+
value: istiod
99+
- name: CA_ADDR
100+
value: istiod.istio-system.svc:15012
101+
- name: POD_NAME
102+
valueFrom:
103+
fieldRef:
104+
fieldPath: metadata.name
105+
- name: POD_NAMESPACE
106+
valueFrom:
107+
fieldRef:
108+
fieldPath: metadata.namespace
109+
- name: INSTANCE_IP
110+
valueFrom:
111+
fieldRef:
112+
fieldPath: status.podIP
113+
- name: SERVICE_ACCOUNT
114+
valueFrom:
115+
fieldRef:
116+
fieldPath: spec.serviceAccountName
117+
- name: HOST_IP
118+
valueFrom:
119+
fieldRef:
120+
fieldPath: status.hostIP
121+
- name: PROXY_CONFIG
122+
value: |
123+
{}
124+
- name: ISTIO_META_POD_PORTS
125+
value: |-
126+
[
127+
{"name":"http","containerPort":9898,"protocol":"TCP"}
128+
]
129+
- name: ISTIO_META_APP_CONTAINERS
130+
value: backend
131+
- name: ISTIO_META_CLUSTER_ID
132+
value: Kubernetes
133+
- name: ISTIO_META_INTERCEPTION_MODE
134+
value: REDIRECT
135+
- name: ISTIO_META_WORKLOAD_NAME
136+
value: backend
137+
- name: ISTIO_META_OWNER
138+
value: kubernetes://apis/apps/v1/namespaces/prod/deployments/backend
139+
- name: ISTIO_META_MESH_ID
140+
value: cluster.local
141+
- name: TRUST_DOMAIN
142+
value: cluster.local
143+
- name: ISTIO_PROMETHEUS_ANNOTATIONS
144+
value: '{"scrape":"true","path":"","port":""}'
145+
image: docker.io/istio/proxyv2:1.13.2
146+
name: istio-proxy
147+
ports:
148+
- containerPort: 15090
149+
name: http-envoy-prom
150+
protocol: TCP
151+
readinessProbe:
152+
failureThreshold: 30
153+
httpGet:
154+
path: /healthz/ready
155+
port: 15021
156+
initialDelaySeconds: 1
157+
periodSeconds: 2
158+
timeoutSeconds: 3
159+
resources:
160+
limits:
161+
cpu: "2"
162+
memory: 1Gi
163+
requests:
164+
cpu: 10m
165+
memory: 40Mi
166+
securityContext:
167+
allowPrivilegeEscalation: false
168+
capabilities:
169+
drop:
170+
- ALL
171+
privileged: false
172+
readOnlyRootFilesystem: true
173+
runAsGroup: 1337
174+
runAsNonRoot: true
175+
runAsUser: 1337
176+
volumeMounts:
177+
- mountPath: /var/run/secrets/istio
178+
name: istiod-ca-cert
179+
- mountPath: /var/lib/istio/data
180+
name: istio-data
181+
- mountPath: /etc/istio/proxy
182+
name: istio-envoy
183+
- mountPath: /var/run/secrets/tokens
184+
name: istio-token
185+
- mountPath: /etc/istio/pod
186+
name: istio-podinfo
187+
- op: add
188+
path: /spec/template/metadata/creationTimestamp
189+
value: null
190+
- op: add
191+
path: /spec/template/metadata/labels/security.istio.io~1tlsMode
192+
value: istio
193+
- op: add
194+
path: /spec/template/metadata/labels/service.istio.io~1canonical-revision
195+
value: latest
196+
- op: add
197+
path: /spec/template/metadata/labels/service.istio.io~1canonical-name
198+
value: backend
199+
- op: add
200+
path: /spec/template/metadata/annotations/sidecar.istio.io~1status
201+
value: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
202+
- op: add
203+
path: /spec/template/metadata/annotations/kubectl.kubernetes.io~1default-logs-container
204+
value: backend
205+
- op: add
206+
path: /spec/template/metadata/annotations/kubectl.kubernetes.io~1default-container
207+
value: backend
208+
- op: add
209+
path: /spec/template/metadata/annotations/prometheus.io~1path
210+
value: /stats/prometheus
211+
- op: add
212+
path: /spec/template/metadata/annotations/prometheus.io~1port
213+
value: "15020"
214+
- op: add
215+
path: /metadata/creationTimestamp
216+
value: null

‎apps/backend/kustomization.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,10 @@ images:
88
- name: ghcr.io/stefanprodan/podinfo
99
newName: ghcr.io/stefanprodan/podinfo
1010
newTag: 6.1.0
11+
patchesJson6902:
12+
- path: deployment.patch.yaml
13+
target:
14+
group: apps
15+
kind: Deployment
16+
name: backend
17+
version: v1

0 commit comments

Comments
 (0)