diff --git a/platform/README.md b/platform/README.md index 391afd667f..c8557c07b9 100644 --- a/platform/README.md +++ b/platform/README.md @@ -4,10 +4,102 @@ The purpose of this directory is to hold the manifest files for kubernetes deplo Before applying these please check out the README.md in each overlay to understand the individual configurations. -Assuming you have `kubectl` set to the proper context you can then run: -`kustomize build overlays/minikube | kubectl apply -f -` -or -`kustomize build overlays/minikube | kubectl delete -f -` +## Getting started -to provision or tear down a cluster. +In accordance with the [12Factor app](https://12factor.net) philosophy, all the services [draws their config from the environment](https://12factor.net/config). +To generate the config needed to run a copy of the app, we need to define some `.env` files, that will be used to create Kubernetes secrets, whose values are available to the various parts of the app. + +First, the secret for the result-queue to insert scan results into to the database. + +``` +cat <<'EOF' > platform/overlays/seed/minikube/scanners.env +DB_HOST=postgres +DB_USER=track_dmarc +DB_PASS=test +DB_NAME=track_dmarc +SA_USER_NAME=superuser@department.gc.ca +SA_PASSWORD=superadminpassword +SA_DISPLAY_NAME=superuser +EOF +``` +Next some default credentials so we can log in to the Kiali observability tool. + +``` +cat <<'EOF' > platform/overlays/seed/minikube/kiali.env +username=admin +passphrase=admin +EOF +``` +Then a password for our database. + +``` +cat <<'EOF' > platform/overlays/seed/minikube/postgres.env +POSTGRES_USER=track_dmarc +POSTGRES_PASSWORD=test +EOF +``` + +And finally the credentials needed for the API to talk to the database, and collaborative services like Notify. + +```bash +cat <<'EOF' > platform/overlays/seed/minikube/api.env +DB_USER=track_dmarc +DB_PASS=test +DB_HOST=postgres +DB_PORT=5432 +DB_NAME=track_dmarc +BASE32_SECRET=alongstring +SUPER_SECRET_KEY=alonghash +SUPER_SECRET_SALT=alonghash +NOTIFICATION_API_KEY=test_key-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +NOTIFICATION_API_URL=https://api.notification.alpha.canada.ca +SA_USER_NAME=superuser@department.gc.ca +SA_PASSWORD=superadminpassword +SA_DISPLAY_NAME=superuser +TOKEN_KEY=test_jwt_token +DMARC_REPORT_API_URL=https://dmarc-report-api-brpuw6ogca-nn.a.run.app +DMARC_REPORT_API_TOKEN=a.jwt.token +EOF +``` + +Next we can start minikube (throwing lots of resources at it). + +``` +minikube start --cpus 4 --memory 20480 +``` + +Last we use Kustomize to generate our config (creating Kubernetes secrets from the .env files we just created) and feed that config to `kubectl apply`. + +There are two steps here, first the config in `platform/overlays/seed/minikube` creates namespaces and secrets appropriate for minikube and installs istio. + +``` +kustomize build platform/overlays/seed/minikube | kubectl apply -f - +``` + +Watch the results with `watch kubectl get pods -n istio-system`. Once Istio is running (and ready to inject it's sidecar proxies), the config for our app can be applied. + +``` +kustomize build platform/overlays/minikube | kubectl apply -f - +``` + +Depending on the speed of your system you might need to run the kustomize/apply commands more than once. + +### Seeing the result: + +The app lets you connect to both ports 80 and 443 (which is using a self signed certificate). + +```bash +$ minikube service list +|-----------------|---------------------------|--------------|---------------------------| +| NAMESPACE | NAME | TARGET PORT | URL | +|-----------------|---------------------------|--------------|---------------------------| +| api | postgres | No node port | +| api | tracker-api | No node port | +| cert-manager | cert-manager | No node port | +| cert-manager | cert-manager-webhook | No node port | +| default | kubernetes | No node port | +| frontend | tracker-frontend | No node port | +| istio-system | istio-ingressgateway | http2/80 | http://192.168.49.2:32722 | +| | | https/443 | http://192.168.49.2:32114 | +``` diff --git a/platform/bases/kustomization.yaml b/platform/bases/kustomization.yaml index a6ae2c86a1..88e4429e02 100644 --- a/platform/bases/kustomization.yaml +++ b/platform/bases/kustomization.yaml @@ -35,7 +35,6 @@ resources: - tracker-frontend-deployment.yaml - tracker-frontend-service.yaml - tracker-frontend-virtual-service.yaml -- istio.yaml - envoy-filter.yaml - publicgateway.yaml - postgres-deployment.yaml @@ -45,8 +44,3 @@ resources: - cert-manager.yaml - cluster-admin-rolebinding.yaml - http-01-challenge-destination-rule.yaml -- api-namespace.yaml -- frontend-namespace.yaml -- istio-system-namespace.yaml -- knative-serving-namespace.yaml -- scanners-namespace.yaml diff --git a/platform/overlays/istio/bases/kustomization.yaml b/platform/overlays/istio/bases/kustomization.yaml deleted file mode 100644 index 3721bae3c9..0000000000 --- a/platform/overlays/istio/bases/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -resources: - - flux-ns.yaml - - memcache-svc.yaml - - memcache-dep.yaml - - flux-account.yaml - - flux-secret.yaml - - flux-deployment.yaml diff --git a/platform/overlays/istio/helloworld-deployment.yaml b/platform/overlays/istio/helloworld-deployment.yaml deleted file mode 100644 index bdfb0874a3..0000000000 --- a/platform/overlays/istio/helloworld-deployment.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiversion: apps/v1 -kind: deployment -metadata: - labels: - app: helloworld - name: helloworld -spec: - replicas: 1 - selector: - matchlabels: - app: helloworld - template: - metadata: - labels: - app: helloworld - spec: - containers: - - image: mikewilliamson/helloworld - name: helloworld diff --git a/platform/overlays/istio/helloworld-service.yaml b/platform/overlays/istio/helloworld-service.yaml deleted file mode 100644 index c114093e76..0000000000 --- a/platform/overlays/istio/helloworld-service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app: helloworld - name: helloworld -spec: - ports: - - name: http-helloworld - port: 80 - targetPort: 3000 - selector: - app: helloworld - type: LoadBalancer -status: - loadBalancer: {} diff --git a/platform/overlays/istio/helloworld-virtual-service.yaml b/platform/overlays/istio/helloworld-virtual-service.yaml deleted file mode 100644 index 1ed2474cb9..0000000000 --- a/platform/overlays/istio/helloworld-virtual-service.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: hello-world-virtual-service - namespace: istio-system -spec: - hosts: - - "*" - gateways: - - istio-system/publicgateway - http: - - name: gateway-to-helloworld - match: - - uri: - prefix: / - route: - - destination: - host: helloworld.default.svc.cluster.local diff --git a/platform/overlays/istio/publicgateway.yaml b/platform/overlays/istio/publicgateway.yaml deleted file mode 100644 index 0362cd0316..0000000000 --- a/platform/overlays/istio/publicgateway.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: networking.istio.io/v1alpha3 -kind: Gateway -metadata: - name: publicgateway - namespace: istio-system - labels: - istio: publicgateway -spec: - selector: - istio: ingressgateway - servers: - - port: - number: 80 - name: http - protocol: HTTP - hosts: - - "*" diff --git a/platform/overlays/minikube/kustomization.yaml b/platform/overlays/minikube/kustomization.yaml index aff2b153fe..4aeeac72da 100644 --- a/platform/overlays/minikube/kustomization.yaml +++ b/platform/overlays/minikube/kustomization.yaml @@ -5,22 +5,3 @@ resources: - knative-istio-networking.yaml - knative-serving-core.yaml - selfsigned-issuer.yaml -secretGenerator: -- envs: - - postgres.env - name: postgres - namespace: api -- envs: - - api.env - name: api - namespace: api -- envs: - - kiali.env - name: kiali - namespace: istio-system -- envs: - - scanners.env - name: scanners - namespace: scanners -generatorOptions: - disableNameSuffixHash: true diff --git a/platform/overlays/istio/README.md b/platform/overlays/seed/README.md similarity index 100% rename from platform/overlays/istio/README.md rename to platform/overlays/seed/README.md diff --git a/platform/bases/api-namespace.yaml b/platform/overlays/seed/base/api-namespace.yaml similarity index 100% rename from platform/bases/api-namespace.yaml rename to platform/overlays/seed/base/api-namespace.yaml diff --git a/platform/bases/frontend-namespace.yaml b/platform/overlays/seed/base/frontend-namespace.yaml similarity index 100% rename from platform/bases/frontend-namespace.yaml rename to platform/overlays/seed/base/frontend-namespace.yaml diff --git a/platform/bases/istio-system-namespace.yaml b/platform/overlays/seed/base/istio-system-namespace.yaml similarity index 100% rename from platform/bases/istio-system-namespace.yaml rename to platform/overlays/seed/base/istio-system-namespace.yaml diff --git a/platform/overlays/istio/bases/istio.yaml b/platform/overlays/seed/base/istio.yaml similarity index 99% rename from platform/overlays/istio/bases/istio.yaml rename to platform/overlays/seed/base/istio.yaml index 0e0eea9c5f..3ab0946eae 100644 --- a/platform/overlays/istio/bases/istio.yaml +++ b/platform/overlays/seed/base/istio.yaml @@ -52,7 +52,7 @@ rules: - get - list - watch - - apiGroups: + - apiGroups: - config.istio.io - networking.istio.io - authentication.istio.io @@ -121,7 +121,7 @@ rules: - get - list - watch - - apiGroups: + - apiGroups: - config.istio.io - networking.istio.io - authentication.istio.io @@ -180,7 +180,7 @@ data: deployment: accessible_namespaces: ['**'] login_token: - signing_key: "ezBRyoIB8f" + signing_key: "Uo5mhKltAY" server: port: 20001 web_root: /kiali @@ -188,10 +188,10 @@ data: istio: url_service_version: http://istiod.istio-system:15014/version tracing: - url: + url: in_cluster_url: http://tracing/jaeger grafana: - url: + url: in_cluster_url: http://grafana:3000 prometheus: url: http://prometheus.istio-system:9090 @@ -940,7 +940,7 @@ spec: - name: MEMORY_MAX_TRACES value: "50000" - name: QUERY_BASE_PATH - value: /jaeger + value: /jaeger livenessProbe: httpGet: path: / @@ -955,7 +955,7 @@ spec: resources: requests: cpu: 10m - affinity: + affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: @@ -987,7 +987,7 @@ spec: - key: beta.kubernetes.io/arch operator: In values: - - "s390x" + - "s390x" volumes: - name: data emptyDir: {} @@ -1350,68 +1350,6 @@ webhooks: --- -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: istiooperators.install.istio.io - labels: - release: istio -spec: - additionalPrinterColumns: - - JSONPath: .spec.revision - description: Istio control plane revision - name: Revision - type: string - - JSONPath: .metadata.creationTimestamp - description: 'CreationTimestamp is a timestamp representing the server time when - this object was created. It is not guaranteed to be set in happens-before order - across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - name: Age - type: date - group: install.istio.io - names: - kind: IstioOperator - plural: istiooperators - singular: istiooperator - shortNames: - - iop - scope: Namespaced - subresources: - status: {} - validation: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - spec: - description: 'Specification of the desired state of the istio control plane resource. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' - type: object - status: - description: 'Status describes each of istio control plane component status at the current time. - 0 means NONE, 1 means UPDATING, 2 means HEALTHY, 3 means ERROR, 4 means RECONCILING. - More info: https://github.com/istio/api/blob/master/operator/v1alpha1/istio.operator.v1alpha1.pb.html & - https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' - type: object - versions: - - name: v1alpha1 - served: true - storage: true ---- - - apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: @@ -6405,6 +6343,68 @@ spec: storage: true --- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: istiooperators.install.istio.io + labels: + release: istio +spec: + additionalPrinterColumns: + - JSONPath: .spec.revision + description: Istio control plane revision + name: Revision + type: string + - JSONPath: .metadata.creationTimestamp + description: 'CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before order + across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + name: Age + type: date + group: install.istio.io + names: + kind: IstioOperator + plural: istiooperators + singular: istiooperator + shortNames: + - iop + scope: Namespaced + subresources: + status: {} + validation: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + spec: + description: 'Specification of the desired state of the istio control plane resource. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + type: object + status: + description: 'Status describes each of istio control plane component status at the current time. + 0 means NONE, 1 means UPDATING, 2 means HEALTHY, 3 means ERROR, 4 means RECONCILING. + More info: https://github.com/istio/api/blob/master/operator/v1alpha1/istio.operator.v1alpha1.pb.html & + https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + type: object + versions: + - name: v1alpha1 + served: true + storage: true +--- + # Cni component is disabled. # EgressGateways istio-egressgateway component is disabled. @@ -6710,18 +6710,12 @@ metadata: namespace: istio-system spec: ports: - - name: status-port - port: 15021 - targetPort: 15021 - name: http2 port: 80 targetPort: 8080 - name: https port: 443 targetPort: 8443 - - name: tls - port: 15443 - targetPort: 15443 selector: app: istio-ingressgateway istio: ingressgateway diff --git a/platform/bases/knative-serving-namespace.yaml b/platform/overlays/seed/base/knative-serving-namespace.yaml similarity index 100% rename from platform/bases/knative-serving-namespace.yaml rename to platform/overlays/seed/base/knative-serving-namespace.yaml diff --git a/platform/overlays/seed/base/kustomization.yaml b/platform/overlays/seed/base/kustomization.yaml new file mode 100644 index 0000000000..1acae2a0d7 --- /dev/null +++ b/platform/overlays/seed/base/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- istio.yaml +- api-namespace.yaml +- frontend-namespace.yaml +- istio-system-namespace.yaml +- knative-serving-namespace.yaml +- scanners-namespace.yaml diff --git a/platform/bases/scanners-namespace.yaml b/platform/overlays/seed/base/scanners-namespace.yaml similarity index 100% rename from platform/bases/scanners-namespace.yaml rename to platform/overlays/seed/base/scanners-namespace.yaml diff --git a/platform/overlays/istio/istio-ingressgateway-service.yaml b/platform/overlays/seed/gke/istio-ingressgateway-service.yaml similarity index 100% rename from platform/overlays/istio/istio-ingressgateway-service.yaml rename to platform/overlays/seed/gke/istio-ingressgateway-service.yaml diff --git a/platform/overlays/seed/gke/kustomization.yaml b/platform/overlays/seed/gke/kustomization.yaml new file mode 100644 index 0000000000..c18b6dd927 --- /dev/null +++ b/platform/overlays/seed/gke/kustomization.yaml @@ -0,0 +1,25 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../base +patchesStrategicMerge: +- istio-ingressgateway-service.yaml +secretGenerator: +- envs: + - postgres.env + name: postgres + namespace: api +- envs: + - api.env + name: api + namespace: api +- envs: + - kiali.env + name: kiali + namespace: istio-system +- envs: + - scanners.env + name: scanners + namespace: scanners +generatorOptions: + disableNameSuffixHash: true diff --git a/platform/overlays/seed/minikube/README.md b/platform/overlays/seed/minikube/README.md new file mode 100644 index 0000000000..f6a1d31b34 --- /dev/null +++ b/platform/overlays/seed/minikube/README.md @@ -0,0 +1,3 @@ +# Seeding Minikube + +This directory contains the config needed to get the app running in developer mode inside minikube. diff --git a/platform/overlays/seed/minikube/kustomization.yaml b/platform/overlays/seed/minikube/kustomization.yaml new file mode 100644 index 0000000000..d1a58f8c0f --- /dev/null +++ b/platform/overlays/seed/minikube/kustomization.yaml @@ -0,0 +1,23 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../base +secretGenerator: +- envs: + - postgres.env + name: postgres + namespace: api +- envs: + - api.env + name: api + namespace: api +- envs: + - kiali.env + name: kiali + namespace: istio-system +- envs: + - scanners.env + name: scanners + namespace: scanners +generatorOptions: + disableNameSuffixHash: true diff --git a/platform/overlays/seed/test/kustomization.yaml b/platform/overlays/seed/test/kustomization.yaml new file mode 100644 index 0000000000..d1a58f8c0f --- /dev/null +++ b/platform/overlays/seed/test/kustomization.yaml @@ -0,0 +1,23 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../base +secretGenerator: +- envs: + - postgres.env + name: postgres + namespace: api +- envs: + - api.env + name: api + namespace: api +- envs: + - kiali.env + name: kiali + namespace: istio-system +- envs: + - scanners.env + name: scanners + namespace: scanners +generatorOptions: + disableNameSuffixHash: true diff --git a/platform/overlays/test/README.md b/platform/overlays/test/README.md new file mode 100644 index 0000000000..938b6ed30b --- /dev/null +++ b/platform/overlays/test/README.md @@ -0,0 +1,57 @@ +# Test + +The purpose of this overlay is to bring up a "non-prod" copy of the full application, for... you guessed it, testing purposes! This configuration will come up using a self signed certificate, but other than that it should be almost identical to production. + + +## Bringing up a cluster + +Currently we are just creating the cluster with the following command. + +```sh +gcloud beta container --project "track-compliance" clusters create "testing" \ + --region "northamerica-northeast1" --no-enable-basic-auth \ + --cluster-version "1.18.9-gke.801" --release-channel "rapid" \ + --machine-type "e2-standard-4" --image-type "COS_CONTAINERD" \ + --disk-type "pd-standard" --disk-size "100" \ + --metadata disable-legacy-endpoints=true \ + --service-account "gke-node-service-account@track-compliance.iam.gserviceaccount.com" \ + --num-nodes "1" --enable-stackdriver-kubernetes --enable-ip-alias \ + --network "projects/track-compliance/global/networks/default" \ + --subnetwork "projects/track-compliance/regions/northamerica-northeast1/subnetworks/default" \ + --default-max-pods-per-node "110" --no-enable-master-authorized-networks \ + --addons HorizontalPodAutoscaling,HttpLoadBalancing,CloudRun --enable-autoupgrade \ + --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 \ +--workload-pool "track-compliance.svc.id.goog" \ + --enable-shielded-nodes --shielded-secure-boot --enable-dataplane-v2 +``` + +The number of options here testify to our increasingly opinionated take on +cluster creation, as well as our attention to the [hardening guidelines for +GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster). +This will soon be captured in real code in a proper Infrastructure as Code type +of way. + +With the cluster up and running, you will need to provide the env files as +described in the minikube setup: + +```sh +api.env +kiali.env +kiali.yaml +postgres.env +scanners.env +``` +With those in place, the config can now be generated. + +```sh +# Create namespaces and secrets, and install Istio +kustomize build overlays/seed/test | kubectl apply -f - +# Watch until istio is ready +watch kubectl get po -A +# Deploy the app +kustomize build overlays/test | kubectl apply -f - +# Watch until everything is running +watch kubectl get po -A +# Get the IP of the app +kubectl get svc -n istio-system istio-ingressgateway -o json | jq '.status.loadBalancer.ingress' +``` diff --git a/platform/overlays/test/envoy-filter.yaml b/platform/overlays/test/envoy-filter.yaml new file mode 100644 index 0000000000..f9c0f8f1ef --- /dev/null +++ b/platform/overlays/test/envoy-filter.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: EnvoyFilter +metadata: + name: gateway-gzip + namespace: istio-system +spec: + workloadSelector: + labels: + istio: ingressgateway + filters: + - listenerMatch: + listenerType: GATEWAY + filterType: HTTP + filterName: envoy.lua + filterConfig: + inlineCode: | + function envoy_on_response(response_handle) + if not response_handle:headers():get("X-Frame-Options") then + response_handle:headers():add("X-Frame-Options", "deny"); + end + if not response_handle:headers():get("Strict-Transport-Security") then + response_handle:headers():add("Strict-Transport-Security", "max-age=31536000; includeSubDomains"); + end + end diff --git a/platform/overlays/test/istio-ingressgateway-service.yaml b/platform/overlays/test/istio-ingressgateway-service.yaml new file mode 100644 index 0000000000..43583bce5f --- /dev/null +++ b/platform/overlays/test/istio-ingressgateway-service.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Service +metadata: + name: istio-ingressgateway + namespace: istio-system +spec: + loadBalancerIP: "34.95.5.243" diff --git a/platform/overlays/test/jaeger.yaml b/platform/overlays/test/jaeger.yaml new file mode 100644 index 0000000000..05b8318e24 --- /dev/null +++ b/platform/overlays/test/jaeger.yaml @@ -0,0 +1,88 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: jaeger + namespace: istio-system + labels: + app: jaeger +spec: + selector: + matchLabels: + app: jaeger + template: + metadata: + labels: + app: jaeger + annotations: + sidecar.istio.io/inject: "false" + prometheus.io/scrape: "true" + prometheus.io/port: "14269" + spec: + containers: + - name: jaeger + image: "docker.io/jaegertracing/all-in-one:1.18" + env: + - name: BADGER_EPHEMERAL + value: "false" + - name: SPAN_STORAGE_TYPE + value: "badger" + - name: BADGER_DIRECTORY_VALUE + value: "/badger/data" + - name: BADGER_DIRECTORY_KEY + value: "/badger/key" + - name: COLLECTOR_ZIPKIN_HTTP_PORT + value: "9411" + - name: MEMORY_MAX_TRACES + value: "50000" + - name: QUERY_BASE_PATH + value: /jaeger + livenessProbe: + httpGet: + path: / + port: 14269 + readinessProbe: + httpGet: + path: / + port: 14269 + volumeMounts: + - name: data + mountPath: /badger + resources: + requests: + cpu: 10m + volumes: + - name: data + emptyDir: {} +--- +apiVersion: v1 +kind: Service +metadata: + name: tracing + namespace: istio-system + labels: + app: jaeger +spec: + type: ClusterIP + ports: + - name: http-query + port: 80 + protocol: TCP + targetPort: 16686 + selector: + app: jaeger +--- +# Jaeger implements the Zipkin API. To support swapping out the tracing backend, we use a Service named Zipkin. +apiVersion: v1 +kind: Service +metadata: + labels: + name: zipkin + name: zipkin + namespace: istio-system +spec: + ports: + - port: 9411 + targetPort: 9411 + name: http-query + selector: + app: jaeger diff --git a/platform/overlays/test/kiali.yaml b/platform/overlays/test/kiali.yaml new file mode 100644 index 0000000000..a9601cc27e --- /dev/null +++ b/platform/overlays/test/kiali.yaml @@ -0,0 +1,1615 @@ +--- +# Source: crds/crds.yaml +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: monitoringdashboards.monitoring.kiali.io +spec: + group: monitoring.kiali.io + names: + kind: MonitoringDashboard + listKind: MonitoringDashboardList + plural: monitoringdashboards + singular: monitoringdashboard + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true +... + +--- +# Source: kiali-server/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kiali + namespace: istio-system + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +... +--- +# Source: kiali-server/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: kiali + namespace: istio-system + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +data: + config.yaml: | + additional_display_details: + - annotation: kiali.io/api-spec + icon_annotation: kiali.io/api-type + title: API Documentation + api: + namespaces: + exclude: + - istio-operator + - kube.* + - openshift.* + - ibm.* + - kiali-operator + auth: + openid: + authentication_timeout: 300 + authorization_endpoint: "" + client_id: "" + insecure_skip_verify_tls: false + issuer_uri: "" + scopes: + - openid + - profile + - email + username_claim: sub + openshift: + client_id_prefix: kiali + strategy: anonymous + deployment: + accessible_namespaces: + - '**' + additional_service_yaml: {} + affinity: + node: {} + pod: {} + pod_anti: {} + custom_dashboards: + excludes: + - "" + includes: + - '*' + image_name: quay.io/kiali/kiali + image_pull_policy: Always + image_pull_secrets: [] + image_version: v1.22 + ingress_enabled: false + namespace: istio-system + node_selector: {} + override_ingress_yaml: + metadata: {} + pod_annotations: {} + priority_class_name: "" + replicas: 1 + resources: {} + secret_name: kiali + service_annotations: {} + service_type: "" + tolerations: [] + verbose_mode: "3" + version_label: v1.22.0 + view_only_mode: false + extensions: + iter_8: + enabled: false + threescale: + adapter_name: threescale + adapter_port: "3333" + adapter_service: threescale-istio-adapter + enabled: false + template_name: threescale-authorization + external_services: + grafana: + auth: + ca_file: "" + insecure_skip_verify: false + password: "" + token: "" + type: none + use_kiali_token: false + username: "" + dashboards: + - name: Istio Service Dashboard + variables: + namespace: var-namespace + service: var-service + - name: Istio Workload Dashboard + variables: + namespace: var-namespace + workload: var-workload + enabled: true + in_cluster_url: http://grafana:3000 + url: "" + istio: + istio_identity_domain: svc.cluster.local + istio_sidecar_annotation: sidecar.istio.io/status + istio_status_enabled: true + url_service_version: http://istiod:15014/version + prometheus: + auth: + ca_file: "" + insecure_skip_verify: false + password: "" + token: "" + type: none + use_kiali_token: false + username: "" + custom_metrics_url: http://prometheus:9090 + url: http://prometheus:9090 + tracing: + auth: + ca_file: "" + insecure_skip_verify: false + password: "" + token: "" + type: none + use_kiali_token: false + username: "" + enabled: true + in_cluster_url: http://tracing/jaeger + namespace_selector: true + url: "" + whitelist_istio_system: + - jaeger-query + - istio-ingressgateway + identity: + cert_file: "" + private_key_file: "" + installation_tag: "" + istio_labels: + app_label_name: app + version_label_name: version + istio_namespace: istio-system + kubernetes_config: + burst: 200 + cache_duration: 300 + cache_enabled: true + cache_istio_types: + - DestinationRule + - Gateway + - ServiceEntry + - VirtualService + cache_namespaces: + - .* + cache_token_namespace_duration: 10 + excluded_workloads: + - CronJob + - DeploymentConfig + - Job + - ReplicationController + qps: 175 + login_token: + expiration_seconds: 86400 + signing_key: CHANGEME + server: + address: "" + audit_log: true + cors_allow_all: false + gzip_enabled: true + metrics_enabled: true + metrics_port: 9090 + port: 20001 + web_fqdn: "" + web_root: /kiali + web_schema: "" +... +--- +# Source: kiali-server/templates/role-viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kiali-viewer + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: [""] + resources: + - configmaps + - endpoints + - namespaces + - nodes + - pods + - pods/log + - replicationcontrollers + - services + verbs: + - get + - list + - watch +- apiGroups: ["extensions", "apps"] + resources: + - deployments + - replicasets + - statefulsets + verbs: + - get + - list + - watch +- apiGroups: ["autoscaling"] + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch +- apiGroups: ["batch"] + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch +- apiGroups: + - config.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - security.istio.io + resources: ["*"] + verbs: + - get + - list + - watch +- apiGroups: ["authentication.maistra.io"] + resources: + - servicemeshpolicies + verbs: + - get + - list + - watch +- apiGroups: ["rbac.maistra.io"] + resources: + - servicemeshrbacconfigs + verbs: + - get + - list + - watch +- apiGroups: ["apps.openshift.io"] + resources: + - deploymentconfigs + verbs: + - get + - list + - watch +- apiGroups: ["project.openshift.io"] + resources: + - projects + verbs: + - get +- apiGroups: ["route.openshift.io"] + resources: + - routes + verbs: + - get +- apiGroups: ["monitoring.kiali.io"] + resources: + - monitoringdashboards + verbs: + - get + - list +- apiGroups: ["iter8.tools"] + resources: + - experiments + verbs: + - get + - list +... +--- +# Source: kiali-server/templates/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kiali + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: [""] + resources: + - configmaps + - endpoints + - namespaces + - nodes + - pods + - pods/log + - replicationcontrollers + - services + verbs: + - get + - list + - patch + - watch +- apiGroups: ["extensions", "apps"] + resources: + - deployments + - replicasets + - statefulsets + verbs: + - get + - list + - patch + - watch +- apiGroups: ["autoscaling"] + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch +- apiGroups: ["batch"] + resources: + - cronjobs + - jobs + verbs: + - get + - list + - patch + - watch +- apiGroups: + - config.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - security.istio.io + resources: ["*"] + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["authentication.maistra.io"] + resources: + - servicemeshpolicies + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["rbac.maistra.io"] + resources: + - servicemeshrbacconfigs + verbs: + - create + - delete + - get + - list + - patch + - watch +- apiGroups: ["apps.openshift.io"] + resources: + - deploymentconfigs + verbs: + - get + - list + - patch + - watch +- apiGroups: ["project.openshift.io"] + resources: + - projects + verbs: + - get +- apiGroups: ["route.openshift.io"] + resources: + - routes + verbs: + - get +- apiGroups: ["monitoring.kiali.io"] + resources: + - monitoringdashboards + verbs: + - get + - list +- apiGroups: ["iter8.tools"] + resources: + - experiments + verbs: + - create + - delete + - get + - list + - patch + - watch +... +--- +# Source: kiali-server/templates/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kiali + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kiali +subjects: +- kind: ServiceAccount + name: kiali + namespace: istio-system +... +--- +# Source: kiali-server/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: kiali + namespace: istio-system + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm + annotations: + kiali.io/api-spec: https://kiali.io/api + kiali.io/api-type: rest +spec: + ports: + - name: http + protocol: TCP + port: 20001 + - name: http-metrics + protocol: TCP + port: 9090 + selector: + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server +... +--- +# Source: kiali-server/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: kiali + namespace: istio-system + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + name: kiali + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + kiali.io/runtimes: go,kiali + spec: + serviceAccountName: kiali + containers: + - image: "quay.io/kiali/kiali:v1.22" + imagePullPolicy: Always + name: kiali + command: + - "/opt/kiali/kiali" + - "-config" + - "/kiali-configuration/config.yaml" + - "-v" + - "3" + ports: + - name: api-port + containerPort: 20001 + - name: http-metrics + containerPort: 9090 + readinessProbe: + httpGet: + path: /kiali/healthz + port: api-port + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 30 + livenessProbe: + httpGet: + path: /kiali/healthz + port: api-port + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 30 + env: + - name: ACTIVE_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - name: kiali-configuration + mountPath: "/kiali-configuration" + - name: kiali-cert + mountPath: "/kiali-cert" + - name: kiali-secret + mountPath: "/kiali-secret" + volumes: + - name: kiali-configuration + configMap: + name: kiali + - name: kiali-cert + secret: + secretName: istio.kiali-service-account + optional: true + - name: kiali-secret + secret: + secretName: kiali + optional: true +... +--- +# Source: kiali-server/templates/dashboards/envoy.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: envoy + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: Envoy Metrics +# discoverOn: "envoy_server_uptime" + items: + - chart: + name: "Pods uptime" + spans: 4 + metricName: "envoy_server_uptime" + dataType: "raw" + - chart: + name: "Allocated memory" + unit: "bytes" + spans: 4 + metricName: "envoy_server_memory_allocated" + dataType: "raw" + min: 0 + - chart: + name: "Heap size" + unit: "bytes" + spans: 4 + metricName: "envoy_server_memory_heap_size" + dataType: "raw" + min: 0 + - chart: + name: "Upstream active connections" + spans: 6 + metricName: "envoy_cluster_upstream_cx_active" + dataType: "raw" + - chart: + name: "Upstream total requests" + spans: 6 + metricName: "envoy_cluster_upstream_rq_total" + unit: "rps" + dataType: "rate" + - chart: + name: "Downstream active connections" + spans: 6 + metricName: "envoy_listener_downstream_cx_active" + dataType: "raw" + - chart: + name: "Downstream HTTP requests" + spans: 6 + metricName: "envoy_listener_http_downstream_rq" + unit: "rps" + dataType: "rate" +... +--- +# Source: kiali-server/templates/dashboards/go.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: go + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: Go Metrics + runtime: Go + discoverOn: "go_info" + items: + - chart: + name: "CPU ratio" + spans: 6 + metricName: "process_cpu_seconds_total" + dataType: "rate" + aggregations: + - label: "pod_name" + displayName: "Pod" + - chart: + name: "RSS Memory" + unit: "bytes" + spans: 6 + metricName: "process_resident_memory_bytes" + dataType: "raw" + aggregations: + - label: "pod_name" + displayName: "Pod" + - chart: + name: "Goroutines" + spans: 6 + metricName: "go_goroutines" + dataType: "raw" + aggregations: + - label: "pod_name" + displayName: "Pod" + - chart: + name: "Heap allocation rate" + unit: "bytes/s" + spans: 6 + metricName: "go_memstats_alloc_bytes_total" + dataType: "rate" + aggregations: + - label: "pod_name" + displayName: "Pod" + - chart: + name: "GC rate" + spans: 6 + metricName: "go_gc_duration_seconds_count" + dataType: "rate" + aggregations: + - label: "pod_name" + displayName: "Pod" + - chart: + name: "Next GC" + unit: "bytes" + spans: 6 + metricName: "go_memstats_next_gc_bytes" + dataType: "raw" + aggregations: + - label: "pod_name" + displayName: "Pod" +... +--- +# Source: kiali-server/templates/dashboards/kiali.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: kiali + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: Kiali Internal Metrics + items: + - chart: + name: "API processing duration" + unit: "seconds" + spans: 6 + metricName: "kiali_api_processing_duration_seconds" + dataType: "histogram" + aggregations: + - label: "route" + displayName: "Route" + - chart: + name: "Functions processing duration" + unit: "seconds" + spans: 6 + metricName: "kiali_go_function_processing_duration_seconds" + dataType: "histogram" + aggregations: + - label: "function" + displayName: "Function" + - label: "package" + displayName: "Package" + - chart: + name: "Failures" + spans: 12 + metricName: "kiali_go_function_failures_total" + dataType: "raw" + aggregations: + - label: "function" + displayName: "Function" + - label: "package" + displayName: "Package" +... +--- +# Source: kiali-server/templates/dashboards/micrometer-1.0.6-jvm-pool.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: micrometer-1.0.6-jvm-pool + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: JVM + title: JVM Pool Metrics + discoverOn: "jvm_buffer_total_capacity_bytes" + items: + - chart: + name: "Pool buffer memory used" + unit: "bytes" + spans: 4 + metricName: "jvm_buffer_memory_used_bytes" + dataType: "raw" + aggregations: + - label: "id" + displayName: "Pool" + - chart: + name: "Pool buffer capacity" + unit: "bytes" + spans: 4 + metricName: "jvm_buffer_total_capacity_bytes" + dataType: "raw" + aggregations: + - label: "id" + displayName: "Pool" + - chart: + name: "Pool buffer count" + unit: "bytes" + spans: 4 + metricName: "jvm_buffer_count" + dataType: "raw" + aggregations: + - label: "id" + displayName: "Pool" +... +--- +# Source: kiali-server/templates/dashboards/micrometer-1.0.6-jvm.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: micrometer-1.0.6-jvm + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: JVM + title: JVM Metrics + discoverOn: "jvm_threads_live" + items: + - chart: + name: "Total live threads" + spans: 4 + metricName: "jvm_threads_live" + dataType: "raw" + - chart: + name: "Daemon threads" + spans: 4 + metricName: "jvm_threads_daemon" + dataType: "raw" + - chart: + name: "Loaded classes" + spans: 4 + metricName: "jvm_classes_loaded" + dataType: "raw" + + - chart: + name: "Memory used" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_used_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" + - chart: + name: "Memory commited" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_committed_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" + - chart: + name: "Memory max" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_max_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" +... +--- +# Source: kiali-server/templates/dashboards/micrometer-1.1-jvm.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: micrometer-1.1-jvm + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: JVM + title: JVM Metrics + discoverOn: "jvm_threads_live_threads" + items: + - chart: + name: "Memory used" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_used_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" + - chart: + name: "Memory commited" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_committed_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" + - chart: + name: "Memory max" + unit: "bytes" + spans: 4 + metricName: "jvm_memory_max_bytes" + dataType: "raw" + aggregations: + - label: "area" + displayName: "Area" + - label: "id" + displayName: "Space" + + - chart: + name: "Total live threads" + spans: 4 + metricName: "jvm_threads_live_threads" + dataType: "raw" + - chart: + name: "Daemon threads" + spans: 4 + metricName: "jvm_threads_daemon_threads" + dataType: "raw" + - chart: + name: "Threads states" + spans: 4 + metricName: "jvm_threads_states_threads" + dataType: "raw" + aggregations: + - label: "state" + displayName: "State" +... +--- +# Source: kiali-server/templates/dashboards/microprofile-1.1.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: microprofile-1.1 + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: MicroProfile Metrics + runtime: MicroProfile + discoverOn: "base:thread_count" + items: + - chart: + name: "Current loaded classes" + spans: 6 + metricName: "base:classloader_current_loaded_class_count" + dataType: "raw" + - chart: + name: "Unloaded classes" + spans: 6 + metricName: "base:classloader_total_unloaded_class_count" + dataType: "raw" + - chart: + name: "Thread count" + spans: 4 + metricName: "base:thread_count" + dataType: "raw" + - chart: + name: "Thread max count" + spans: 4 + metricName: "base:thread_max_count" + dataType: "raw" + - chart: + name: "Thread daemon count" + spans: 4 + metricName: "base:thread_daemon_count" + dataType: "raw" + - chart: + name: "Committed heap" + unit: "bytes" + spans: 4 + metricName: "base:memory_committed_heap_bytes" + dataType: "raw" + - chart: + name: "Max heap" + unit: "bytes" + spans: 4 + metricName: "base:memory_max_heap_bytes" + dataType: "raw" + - chart: + name: "Used heap" + unit: "bytes" + spans: 4 + metricName: "base:memory_used_heap_bytes" + dataType: "raw" +... +--- +# Source: kiali-server/templates/dashboards/microprofile-x.y.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: microprofile-x.y + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: MicroProfile Metrics + runtime: MicroProfile + discoverOn: "base:gc_complete_scavenger_count" + items: + - chart: + name: "Young GC time" + unit: "seconds" + spans: 3 + metricName: "base:gc_young_generation_scavenger_time_seconds" + dataType: "raw" + - chart: + name: "Young GC count" + spans: 3 + metricName: "base:gc_young_generation_scavenger_count" + dataType: "raw" + - chart: + name: "Total GC time" + unit: "seconds" + spans: 3 + metricName: "base:gc_complete_scavenger_time_seconds" + dataType: "raw" + - chart: + name: "Total GC count" + spans: 3 + metricName: "base:gc_complete_scavenger_count" + dataType: "raw" +... +--- +# Source: kiali-server/templates/dashboards/nodejs.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: nodejs + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Node.js + title: Node.js Metrics + discoverOn: "nodejs_active_handles_total" + items: + - chart: + name: "Active handles" + spans: 4 + metricName: "nodejs_active_handles_total" + dataType: "raw" + - chart: + name: "Active requests" + spans: 4 + metricName: "nodejs_active_requests_total" + dataType: "raw" + - chart: + name: "Event loop lag" + unit: "seconds" + spans: 4 + metricName: "nodejs_eventloop_lag_seconds" + dataType: "raw" + - chart: + name: "Total heap size" + unit: "bytes" + spans: 12 + metricName: "nodejs_heap_space_size_total_bytes" + dataType: "raw" + aggregations: + - label: "space" + displayName: "Space" + - chart: + name: "Used heap size" + unit: "bytes" + spans: 6 + metricName: "nodejs_heap_space_size_used_bytes" + dataType: "raw" + aggregations: + - label: "space" + displayName: "Space" + - chart: + name: "Available heap size" + unit: "bytes" + spans: 6 + metricName: "nodejs_heap_space_size_available_bytes" + dataType: "raw" + aggregations: + - label: "space" + displayName: "Space" +... +--- +# Source: kiali-server/templates/dashboards/quarkus.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: quarkus + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + title: Quarkus Metrics + runtime: Quarkus + items: + - chart: + name: "Thread count" + spans: 4 + metricName: "vendor:thread_count" + dataType: "raw" + - chart: + name: "Used heap" + unit: "bytes" + spans: 4 + metricName: "vendor:memory_heap_usage_bytes" + dataType: "raw" + - chart: + name: "Used non-heap" + unit: "bytes" + spans: 4 + metricName: "vendor:memory_non_heap_usage_bytes" + dataType: "raw" + - include: "microprofile-x.y" +... +--- +# Source: kiali-server/templates/dashboards/springboot-jvm-pool.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: springboot-jvm-pool + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Spring Boot + title: JVM Pool Metrics + items: + - include: "micrometer-1.0.6-jvm-pool" +... +--- +# Source: kiali-server/templates/dashboards/springboot-jvm.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: springboot-jvm + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Spring Boot + title: JVM Metrics + items: + - include: "micrometer-1.0.6-jvm" +... +--- +# Source: kiali-server/templates/dashboards/springboot-tomcat.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: springboot-tomcat + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Spring Boot + title: Tomcat Metrics + items: + - include: "tomcat" +... +--- +# Source: kiali-server/templates/dashboards/thorntail.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: thorntail + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Thorntail + title: Thorntail Metrics + discoverOn: "vendor:loaded_modules" + items: + - include: "microprofile-1.1" + - chart: + name: "Loaded modules" + spans: 6 + metricName: "vendor:loaded_modules" + dataType: "raw" +... +--- +# Source: kiali-server/templates/dashboards/tomcat.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: tomcat + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Tomcat + title: Tomcat Metrics + discoverOn: "tomcat_sessions_created_total" + items: + - chart: + name: "Sessions created" + spans: 4 + metricName: "tomcat_sessions_created_total" + dataType: "raw" + - chart: + name: "Active sessions" + spans: 4 + metricName: "tomcat_sessions_active_current" + dataType: "raw" + - chart: + name: "Sessions rejected" + spans: 4 + metricName: "tomcat_sessions_rejected_total" + dataType: "raw" + + - chart: + name: "Bytes sent" + unit: "bitrate" + spans: 6 + metricName: "tomcat_global_sent_bytes_total" + dataType: "rate" + aggregations: + - label: "name" + displayName: "Name" + - chart: + name: "Bytes received" + unit: "bitrate" + spans: 6 + metricName: "tomcat_global_received_bytes_total" + dataType: "rate" + aggregations: + - label: "name" + displayName: "Name" + + - chart: + name: "Global errors" + spans: 6 + metricName: "tomcat_global_error_total" + dataType: "raw" + aggregations: + - label: "name" + displayName: "Name" + - chart: + name: "Servlet errors" + spans: 6 + metricName: "tomcat_servlet_error_total" + dataType: "raw" + aggregations: + - label: "name" + displayName: "Name" +... +--- +# Source: kiali-server/templates/dashboards/vertx-client.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: vertx-client + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Vert.x + title: Vert.x Client Metrics + discoverOn: "vertx_http_client_connections" + items: + - chart: + name: "Client response time" + unit: "seconds" + spans: 6 + metricName: "vertx_http_client_responseTime_seconds" + dataType: "histogram" + aggregations: + - label: "path" + displayName: "Path" + - label: "method" + displayName: "Method" + - chart: + name: "Client request count rate" + unit: "ops" + spans: 6 + metricName: "vertx_http_client_requestCount_total" + dataType: "rate" + aggregations: + - label: "path" + displayName: "Path" + - label: "method" + displayName: "Method" + - chart: + name: "Client active connections" + spans: 6 + metricName: "vertx_http_client_connections" + dataType: "raw" + - chart: + name: "Client active websockets" + spans: 6 + metricName: "vertx_http_client_wsConnections" + dataType: "raw" + - chart: + name: "Client bytes sent" + unit: "bytes" + spans: 6 + metricName: "vertx_http_client_bytesSent" + dataType: "histogram" + - chart: + name: "Client bytes received" + unit: "bytes" + spans: 6 + metricName: "vertx_http_client_bytesReceived" + dataType: "histogram" +... +--- +# Source: kiali-server/templates/dashboards/vertx-eventbus.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: vertx-eventbus + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Vert.x + title: Vert.x Eventbus Metrics + discoverOn: "vertx_eventbus_handlers" + items: + - chart: + name: "Event bus handlers" + spans: 6 + metricName: "vertx_eventbus_handlers" + dataType: "raw" + aggregations: + - label: "address" + displayName: "Eventbus address" + - chart: + name: "Event bus pending messages" + spans: 6 + metricName: "vertx_eventbus_pending" + dataType: "raw" + aggregations: + - label: "address" + displayName: "Eventbus address" + - chart: + name: "Event bus processing time" + unit: "seconds" + spans: 6 + metricName: "vertx_eventbus_processingTime_seconds" + dataType: "histogram" + aggregations: + - label: "address" + displayName: "Eventbus address" + - chart: + name: "Event bus bytes read" + unit: "bytes" + spans: 6 + metricName: "vertx_eventbus_bytesRead" + dataType: "histogram" + aggregations: + - label: "address" + displayName: "Eventbus address" + - chart: + name: "Event bus bytes written" + unit: "bytes" + spans: 6 + metricName: "vertx_eventbus_bytesWritten" + dataType: "histogram" + aggregations: + - label: "address" + displayName: "Eventbus address" +... +--- +# Source: kiali-server/templates/dashboards/vertx-jvm.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: vertx-jvm + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Vert.x + title: JVM Metrics + items: + - include: "micrometer-1.1-jvm" +... +--- +# Source: kiali-server/templates/dashboards/vertx-pool.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: vertx-pool + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Vert.x + title: Vert.x Pools Metrics + discoverOn: "vertx_pool_ratio" + items: + - chart: + name: "Usage duration" + unit: "seconds" + spans: 6 + metricName: "vertx_pool_usage_seconds" + dataType: "histogram" + aggregations: + - label: "pool_name" + displayName: "Name" + - label: "pool_type" + displayName: "Type" + - chart: + name: "Usage ratio" + spans: 6 + metricName: "vertx_pool_ratio" + dataType: "raw" + aggregations: + - label: "pool_name" + displayName: "Name" + - label: "pool_type" + displayName: "Type" + - chart: + name: "Queue size" + spans: 6 + metricName: "vertx_pool_queue_size" + dataType: "raw" + aggregations: + - label: "pool_name" + displayName: "Name" + - label: "pool_type" + displayName: "Type" + - chart: + name: "Time in queue" + unit: "seconds" + spans: 6 + metricName: "vertx_pool_queue_delay_seconds" + dataType: "histogram" + aggregations: + - label: "pool_name" + displayName: "Name" + - label: "pool_type" + displayName: "Type" + - chart: + name: "Resources used" + spans: 6 + metricName: "vertx_pool_inUse" + dataType: "raw" + aggregations: + - label: "pool_name" + displayName: "Name" + - label: "pool_type" + displayName: "Type" +... +--- +# Source: kiali-server/templates/dashboards/vertx-server.yaml +apiVersion: "monitoring.kiali.io/v1alpha1" +kind: MonitoringDashboard +metadata: + name: vertx-server + labels: + helm.sh/chart: kiali-server-1.22.0 + app: kiali + app.kubernetes.io/name: kiali + app.kubernetes.io/instance: kiali-server + version: "v1.22.0" + app.kubernetes.io/version: "v1.22.0" + app.kubernetes.io/managed-by: Helm +spec: + runtime: Vert.x + title: Vert.x Server Metrics + discoverOn: "vertx_http_server_connections" + items: + - chart: + name: "Server response time" + unit: "seconds" + spans: 6 + metricName: "vertx_http_server_responseTime_seconds" + dataType: "histogram" + aggregations: + - label: "path" + displayName: "Path" + - label: "method" + displayName: "Method" + - chart: + name: "Server request count rate" + unit: "ops" + spans: 6 + metricName: "vertx_http_server_requestCount_total" + dataType: "rate" + aggregations: + - label: "code" + displayName: "Error code" + - label: "path" + displayName: "Path" + - label: "method" + displayName: "Method" + - chart: + name: "Server active connections" + spans: 6 + metricName: "vertx_http_server_connections" + dataType: "raw" + - chart: + name: "Server active websockets" + spans: 6 + metricName: "vertx_http_server_wsConnections" + dataType: "raw" + - chart: + name: "Server bytes sent" + unit: "bytes" + spans: 6 + metricName: "vertx_http_server_bytesSent" + dataType: "histogram" + - chart: + name: "Server bytes received" + unit: "bytes" + spans: 6 + metricName: "vertx_http_server_bytesReceived" + dataType: "histogram" +... diff --git a/platform/overlays/test/knative/config/queues.yaml b/platform/overlays/test/knative/config/queues.yaml new file mode 100644 index 0000000000..09b6f9fd0b --- /dev/null +++ b/platform/overlays/test/knative/config/queues.yaml @@ -0,0 +1,49 @@ +apiVersion: serving.knative.dev/v1 # Current version of Knative +kind: Service +metadata: + name: scan-queue + namespace: scanners + labels: + app: scanners +spec: + template: + metadata: + annotations: + prometheus.io/scrape: 'true' + prometheus.io/port: '9090' + # Knative concurrency-based autoscaling (default). + autoscaling.knative.dev/class: kpa.autoscaling.knative.dev + autoscaling.knative.dev/metric: concurrency + autoscaling.knative.dev/minScale: "4" + autoscaling.knative.dev/maxScale: "4" + spec: + timeoutSeconds: 900 + containers: + - name: scan-queue + image: gcr.io/track-compliance/services/scan-queue + +--- + +apiVersion: serving.knative.dev/v1 # Current version of Knative +kind: Service +metadata: + name: result-queue + namespace: scanners + labels: + app: scanners +spec: + template: + metadata: + annotations: + prometheus.io/scrape: 'true' + prometheus.io/port: '9090' + # Knative concurrency-based autoscaling (default). + autoscaling.knative.dev/class: kpa.autoscaling.knative.dev + autoscaling.knative.dev/metric: concurrency + autoscaling.knative.dev/minScale: "4" + autoscaling.knative.dev/maxScale: "4" + spec: + timeoutSeconds: 900 + containers: + - name: result-queue + image: gcr.io/track-compliance/services/result-queue diff --git a/platform/overlays/istio/kustomization.yaml b/platform/overlays/test/kustomization.yaml similarity index 63% rename from platform/overlays/istio/kustomization.yaml rename to platform/overlays/test/kustomization.yaml index c0579a9c58..e8fdbb934d 100644 --- a/platform/overlays/istio/kustomization.yaml +++ b/platform/overlays/test/kustomization.yaml @@ -1,7 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ./bases/istio.yaml -- publicgateway.yaml +- ../../bases +- selfsigned-issuer.yaml patchesStrategicMerge: -- istio-ingressgateway-service.yaml +- publicgateway.yaml +- knative/config/queues.yaml diff --git a/platform/overlays/test/publicgateway.yaml b/platform/overlays/test/publicgateway.yaml new file mode 100644 index 0000000000..1aa2ebb443 --- /dev/null +++ b/platform/overlays/test/publicgateway.yaml @@ -0,0 +1,38 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: publicgateway + namespace: istio-system + labels: + istio: publicgateway +spec: + selector: + istio: ingressgateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" + tls: + httpsRedirect: true + - port: + number: 443 + name: https + protocol: HTTPS + hosts: + - "*" + tls: + mode: SIMPLE + credentialName: tracker-credential + privateKey: sds + serverCertificate: sds + minProtocolVersion: TLSV1_2 + cipherSuites: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 diff --git a/platform/overlays/test/selfsigned-issuer.yaml b/platform/overlays/test/selfsigned-issuer.yaml new file mode 100644 index 0000000000..189b00915d --- /dev/null +++ b/platform/overlays/test/selfsigned-issuer.yaml @@ -0,0 +1,7 @@ +apiVersion: cert-manager.io/v1alpha2 +kind: Issuer +metadata: + name: selfsigned + namespace: istio-system +spec: + selfSigned: {} diff --git a/platform/overlays/test/tracker-api-deployment.yaml b/platform/overlays/test/tracker-api-deployment.yaml new file mode 100644 index 0000000000..dd05df0a61 --- /dev/null +++ b/platform/overlays/test/tracker-api-deployment.yaml @@ -0,0 +1,10 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: null + labels: + app: tracker-api + name: tracker-api + namespace: api + annotations: + fluxcd.io/automated: "true" diff --git a/platform/overlays/test/tracker-frontend-deployment.yaml b/platform/overlays/test/tracker-frontend-deployment.yaml new file mode 100644 index 0000000000..69ce2f6995 --- /dev/null +++ b/platform/overlays/test/tracker-frontend-deployment.yaml @@ -0,0 +1,21 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: null + labels: + app: tracker-frontend + name: tracker-frontend + namespace: frontend + annotations: + fluxcd.io/automated: "true" +spec: + replicas: 2 + selector: + matchLabels: + app: tracker-frontend + strategy: + rollingUpdate: + maxSurge: 50% + maxUnavailable: 50% + type: RollingUpdate +