Create new and improved seed and test overlays (canada-ca#1182)

For sidecar injection to happen Istio needs to be running before our app is. To make this happen, this commit splits the config into a seed config that creates namespaces, secrets and installs Istio, and then an normal overlay that installs the app.

Also included here is an overlay called test, that is very close to prod, but uses a self signed cert.

The process to bring up a cluster (using test as an example) is now the following:

```sh
kustomize build overlays/seed/test | kubectl apply -f -
watch kubectl get po -A
kustomize build overlays/test | kubectl apply -f -
watch kubectl get po -A
kubectl get svc -n istio-system istio-ingressgateway -o json | jq '.status.loadBalancer.ingress'
```

Author: sleepycat

platform/README.md

@@ -4,10 +4,102 @@ The purpose of this directory is to hold the manifest files for kubernetes deplo
 
 Before applying these please check out the README.md in each overlay to understand the individual configurations.
 
-Assuming you have `kubectl` set to the proper context you can then run:
 
-`kustomize build overlays/minikube | kubectl apply -f -`
-or 
-`kustomize build overlays/minikube | kubectl delete -f -`
+## Getting started
 
-to provision or tear down a cluster.
+In accordance with the [12Factor app](https://12factor.net) philosophy, all the services [draws their config from the environment](https://12factor.net/config). 
+To generate the config needed to run a copy of the app, we need to define some `.env` files, that will be used to create Kubernetes secrets, whose values are available to the various parts of the app.
+
+First, the secret for the result-queue to insert scan results into to the database.
+
+```
+cat <<'EOF' > platform/overlays/seed/minikube/scanners.env
+DB_HOST=postgres
+DB_USER=track_dmarc
+DB_PASS=test
+DB_NAME=track_dmarc
+SA_USER_NAME=superuser@department.gc.ca
+SA_PASSWORD=superadminpassword
+SA_DISPLAY_NAME=superuser
+EOF
+```
+Next some default credentials so we can log in to the Kiali observability tool.
+
+```
+cat <<'EOF' > platform/overlays/seed/minikube/kiali.env
+username=admin
+passphrase=admin
+EOF
+```
+Then a password for our database.
+
+```
+cat <<'EOF' > platform/overlays/seed/minikube/postgres.env
+POSTGRES_USER=track_dmarc
+POSTGRES_PASSWORD=test
+EOF
+```
+
+And finally the credentials needed for the API to talk to the database, and collaborative services like Notify.
+
+```bash
+cat <<'EOF' > platform/overlays/seed/minikube/api.env
+DB_USER=track_dmarc
+DB_PASS=test
+DB_HOST=postgres
+DB_PORT=5432
+DB_NAME=track_dmarc
+BASE32_SECRET=alongstring
+SUPER_SECRET_KEY=alonghash
+SUPER_SECRET_SALT=alonghash
+NOTIFICATION_API_KEY=test_key-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+NOTIFICATION_API_URL=https://api.notification.alpha.canada.ca
+SA_USER_NAME=superuser@department.gc.ca
+SA_PASSWORD=superadminpassword
+SA_DISPLAY_NAME=superuser
+TOKEN_KEY=test_jwt_token
+DMARC_REPORT_API_URL=https://dmarc-report-api-brpuw6ogca-nn.a.run.app
+DMARC_REPORT_API_TOKEN=a.jwt.token
+EOF
+```
+
+Next we can start minikube (throwing lots of resources at it).
+
+```
+minikube start --cpus 4 --memory 20480
+```
+
+Last we use Kustomize to generate our config (creating Kubernetes secrets from the .env files we just created) and feed that config to `kubectl apply`.
+
+There are two steps here, first the config in `platform/overlays/seed/minikube` creates namespaces and secrets appropriate for minikube and installs istio.
+
+```
+kustomize build platform/overlays/seed/minikube | kubectl apply -f -
+```
+
+Watch the results with `watch kubectl get pods -n istio-system`. Once Istio is running (and ready to inject it's sidecar proxies), the config for our app can be applied.
+
+```
+kustomize build platform/overlays/minikube | kubectl apply -f -
+```
+
+Depending on the speed of your system you might need to run the kustomize/apply commands more than once.
+
+### Seeing the  result:
+
+The app lets you connect to both ports 80 and 443 (which is using a self signed certificate).
+
+```bash
+$ minikube service list
+|-----------------|---------------------------|--------------|---------------------------|
+|    NAMESPACE    |           NAME            | TARGET PORT  |            URL            |
+|-----------------|---------------------------|--------------|---------------------------|
+| api             | postgres                  | No node port |
+| api             | tracker-api               | No node port |
+| cert-manager    | cert-manager              | No node port |
+| cert-manager    | cert-manager-webhook      | No node port |
+| default         | kubernetes                | No node port |
+| frontend        | tracker-frontend          | No node port |
+| istio-system    | istio-ingressgateway      | http2/80     | http://192.168.49.2:32722 |
+|                 |                           | https/443    | http://192.168.49.2:32114 |
+```

platform/bases/kustomization.yaml

@@ -35,7 +35,6 @@ resources:
 - tracker-frontend-deployment.yaml
 - tracker-frontend-service.yaml
 - tracker-frontend-virtual-service.yaml
-- istio.yaml
 - envoy-filter.yaml
 - publicgateway.yaml
 - postgres-deployment.yaml
@@ -45,8 +44,3 @@ resources:
 - cert-manager.yaml
 - cluster-admin-rolebinding.yaml
 - http-01-challenge-destination-rule.yaml
-- api-namespace.yaml
-- frontend-namespace.yaml
-- istio-system-namespace.yaml
-- knative-serving-namespace.yaml
-- scanners-namespace.yaml

platform/overlays/istio/bases/kustomization.yaml

@@ -5,22 +5,3 @@ resources:
 - knative-istio-networking.yaml
 - knative-serving-core.yaml
 - selfsigned-issuer.yaml
-secretGenerator:
-- envs:
-  - postgres.env
-  name: postgres
-  namespace: api
-- envs:
-  - api.env
-  name: api
-  namespace: api
-- envs:
-  - kiali.env
-  name: kiali
-  namespace: istio-system
-- envs:
-  - scanners.env
-  name: scanners
-  namespace: scanners
-generatorOptions:
-  disableNameSuffixHash: true