refactor: deploy Istio in ambient mode (#385)

---------

Signed-off-by: Gerard Vanloo <[email protected]>

Author: Red-GV

sre/dev/remote_cluster/roles/kops/tasks/create_cluster.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Create cluster ({{ cluster_name }})
+- name: Create cluster configuration ({{ cluster_name }})
   ansible.builtin.command:
     argv:
       - kops
@@ -31,6 +31,21 @@
   register: kops_create_output
   changed_when: kops_create_output.rc == 0
 
+- name: Apply Cilium changes to configuration
+  ansible.builtin.command:
+    argv:
+      - kops
+      - edit
+      - cluster
+      - --name
+      - "{{ cluster_name }}"
+      - --state
+      - "{{ kops_state_store }}"
+      - --set
+      - spec.networking.cilium.cniExclusive=false
+  register: kops_edit_output
+  changed_when: kops_edit_output.rc == 0
+
 - name: Build cluster ({{ cluster_name }})
   ansible.builtin.command:
     argv:

sre/dev/remote_cluster/roles/kops/tasks/create_stack_async.yaml

@@ -170,6 +170,38 @@
     jid: "{{ item.ansible_job_id }}"
   loop: "{{ kops_async_create_results.results }}"
 
+- name: Apply Cilium changes to configuration
+  ansible.builtin.command:
+    argv:
+      - kops
+      - edit
+      - cluster
+      - --name
+      - "{{ item }}"
+      - --state
+      - "{{ kops_state_store }}"
+      - --set
+      - spec.networking.cilium.cniExclusive=false
+  async: 600
+  loop: "{{ stack_cluster_names }}"
+  poll: 0
+  register: kops_async_edit_results
+
+- name: Wait for asynchronous operations to complete
+  ansible.builtin.async_status:
+    jid: "{{ item.ansible_job_id }}"
+  loop: "{{ kops_async_edit_results.results }}"
+  register: kops_async_edit_poll_results
+  until: kops_async_edit_poll_results.finished
+  delay: 60
+  retries: 10
+
+- name: Clean up ansychronous operations
+  ansible.builtin.async_status:
+    mode: cleanup
+    jid: "{{ item.ansible_job_id }}"
+  loop: "{{ kops_async_edit_poll_results.results }}"
+
 - name: Asynchronously build kOps clusters
   ansible.builtin.command:
     argv:

sre/requirements.yaml

@@ -10,6 +10,6 @@ collections:
   - name: community.aws
     version: 10.0.0
   - name: community.general
-    version: 11.4.0
+    version: 11.4.1
   - name: kubernetes.core
-    version: 6.1.0
+    version: 6.2.0

sre/roles/applications/tasks/install_otel_demo.yaml

@@ -23,7 +23,7 @@
           openshift.io/sa.scc.uid-range: 1/2000
           openshift.io/sa.scc.supplemental-groups: 1/1000
         labels:
-          istio-injection: enabled
+          istio.io/dataplane-mode: ambient
           it-bench/monitoring: "true"
     state: present
 
@@ -75,7 +75,7 @@
               cpu: 15m
               memory: 80Mi
             limits:
-              cpu: 30m
+              cpu: 50m
               memory: 150Mi
         ad:
           podAnnotations:
@@ -94,64 +94,64 @@
           replicas: "{{ configuration.cart.replicas }}"
           resources:
             requests:
-              cpu: 15m
+              cpu: 20m
               memory: 55Mi
             limits:
-              cpu: 30m
+              cpu: 50m
               memory: 110Mi
         checkout:
           podAnnotations:
             openshift.io/required-scc: restricted-v2
           replicas: "{{ configuration.checkout.replicas }}"
           resources:
             requests:
-              cpu: 7m
+              cpu: 20m
               memory: 17Mi
             limits:
-              cpu: 15m
+              cpu: 50m
               memory: 40Mi
         currency:
           podAnnotations:
             openshift.io/required-scc: restricted-v2
           replicas: "{{ configuration.currency.replicas }}"
           resources:
             requests:
-              cpu: 4m
+              cpu: 10m
               memory: 4Mi
             limits:
-              cpu: 10m
+              cpu: 20m
               memory: 10Mi
         email:
           podAnnotations:
             openshift.io/required-scc: restricted-v2
           replicas: "{{ configuration.email.replicas }}"
           resources:
             requests:
-              cpu: 4m
+              cpu: 10m
               memory: 50Mi
             limits:
-              cpu: 10m
+              cpu: 30m
               memory: 100Mi
         flagd:
           podAnnotations:
             openshift.io/required-scc: restricted-v2
           resources:
             requests:
-              cpu: 2m
+              cpu: 10m
               memory: 30Mi
             limits:
-              cpu: 10m
+              cpu: 20m
               memory: 60Mi
         fraud-detection:
           podAnnotations:
             openshift.io/required-scc: restricted-v2
           replicas: "{{ configuration.fraud_detection.replicas }}"
           resources:
             requests:
-              cpu: 15m
+              cpu: 20m
               memory: 200Mi
             limits:
-              cpu: 50m
+              cpu: 75m
               memory: 400Mi
         frontend:
           podAnnotations:
@@ -195,7 +195,7 @@
           replicas: "{{ configuration.kafka.replicas }}"
           resources:
             requests:
-              cpu: 25m
+              cpu: 50m
               memory: 300Mi
             limits:
               cpu: 400m
@@ -234,7 +234,7 @@
           replicas: "{{ configuration.postgres.replicas }}"
           resources:
             requests:
-              cpu: 25m
+              cpu: 10m
               memory: 50Mi
             limits:
               cpu: 50m
@@ -245,10 +245,10 @@
           replicas: "{{ configuration.product_catalog.replicas }}"
           resources:
             requests:
-              cpu: 7m
+              cpu: 15m
               memory: 15Mi
             limits:
-              cpu: 15m
+              cpu: 50m
               memory: 30Mi
         quote:
           podAnnotations:
@@ -270,7 +270,7 @@
               cpu: 15m
               memory: 40Mi
             limits:
-              cpu: 30m
+              cpu: 50m
               memory: 80Mi
         shipping:
           podAnnotations:
@@ -289,7 +289,7 @@
           replicas: "{{ configuration.valkey_cart.replicas }}"
           resources:
             requests:
-              cpu: 2m
+              cpu: 5m
               memory: 4Mi
             limits:
               cpu: 10m
@@ -354,10 +354,10 @@
             protocol: TCP
         resources:
           requests:
-            cpu: 50m
+            cpu: 75m
             memory: 150Mi
           limits:
-            cpu: 100m
+            cpu: 150m
             memory: 300Mi
       prometheus:
         enabled: false

sre/roles/tools/defaults/main/helm_releases.yaml

@@ -12,15 +12,16 @@ tools_helm_releases:
   ingress:
     name: ingress-nginx
     namespace: ingress-nginx
-  istio_base:
-    name: istio-base
-    namespace: istio-base
-  istio_control_plane:
-    name: istio-control
-    namespace: istio-control
+  istio:
+    components:
+      base: istio-base
+      cni_node_agent: istio-cni
+      istiod_control_plane: istiod
+      ztunnel: ztunnel
+    namespace: istio-system
   istio_gateway:
-    name: istio-gateway
-    namespace: istio-gateway
+    name: istio-ingress
+    namespace: istio-ingress
   kubernetes_metrics_server:
     name: metrics-server
     namespace: metrics-server

sre/roles/tools/defaults/main/instances.yaml

@@ -5,6 +5,7 @@ tools_instances:
     namespace: clickhouse
   opentelemetry_collectors:
     names:
+      istio: istio
       jaeger: jaeger
       kubernetes_events: kubenetes-events
     namespace: opentelemetry-collectors

sre/roles/tools/files/opentelemetry/collectors/istio.yaml

@@ -0,0 +1,11 @@
+---
+# This definition has been left purposely incomplete. This allows
+# Dependabot to track the image. The full definition is provided in the
+# template version of this object.
+
+apiVersion: opentelemetry.io/v1beta1
+kind: OpenTelemetryCollector
+metadata:
+  name: istio
+spec:
+  image: quay.io/it-bench/opentelemetry-collector:1.0.0

sre/roles/tools/tasks/install.yaml

@@ -24,7 +24,7 @@
     helm_release: "{{ tools_helm_releases.clickhouse_operator }}"
     instance: "{{ tools_instances.clickhouse }}"
   when:
-    - tools_required.clickhouse or tools_required.opentelemetry
+    - tools_required.clickhouse or tools_required.opentelemetry or tools_required.istio
 
 - name: Import OpenSearch installation tasks
   ansible.builtin.import_tasks:
@@ -38,7 +38,7 @@
   ansible.builtin.import_tasks:
     file: install_opentelemetry.yaml
   when:
-    - tools_required.opentelemetry or tools_required.jaeger
+    - tools_required.opentelemetry or tools_required.jaeger or tools_required.istio
 
 - name: Import OpenCost installation tasks
   ansible.builtin.import_tasks: