Skip to content

Commit a1becff

Browse files
author
Jijie Chen
committed
完成了基本版本的测试：能够自动安装 istio、各个扩展和 KeyCloak。辅以手动的 KeyCloak 配置，可以完成各个 istio 扩展组件的登录集成。
1 parent 9c6cf39 commit a1becff

11 files changed

+88
-35
lines changed

‎README.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
3+
4+
5+
6+
# On KeyCloak:
7+
8+
### create realm 'mesh'
9+
10+
### create keycloak client: kiali-client, grafana-client, jaeger-client
11+
# Access Type: confidential
12+
# Mappers: audiences/groups (required claim name: groups)
13+
### create user/group
14+
# user: basic
15+
# groups: kiali_users, jaeger_users, grafana_users/grafana_admins
16+
17+
18+
19+
20+
21+
### todo: to use different deployment to support kiali viewer/admin
22+
23+
24+
25+
26+
Keycloak warning:
27+
28+
the receive buffer of socket ManagedMulticastSocketBinding was set to 25.00MB, but the OS only allocated 16.78MB

‎addons/chart/values.yaml

+17-7
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,35 @@ switches:
1010
grafana:
1111
replicas: 1
1212
grafana.ini:
13+
server:
14+
root_url: http://grafana.WILDCARD_BASE_DOMAIN
15+
auth:
16+
disable_login_form: true
17+
oauth_auto_login: true
18+
auth.basic:
19+
enabled: false
20+
# azuread supports 'allowed_groups': https://grafana.com/docs/grafana/latest/auth/azuread/#configure-allowed-groups-and-domains
21+
# generic_oauth supports 'role_attribute_path': https://grafana.com/docs/grafana/latest/auth/generic-oauth/#role-mapping
1322
auth.generic_oauth:
23+
name: OpenId
1424
enabled: true
1525
client_id: grafana-client
16-
client_secret: AAAAAAAA
26+
client_secret: GGGGGGGG
1727
scopes: openid profile email
18-
auth_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/master/protocol/openid-connect/auth
19-
token_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/master/protocol/openid-connect/token
20-
api_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/master/protocol/openid-connect/userinfo
21-
allowed_domains: grafana.WILDCARD_BASE_DOMAIN
28+
auth_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/mesh/protocol/openid-connect/auth
29+
token_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/mesh/protocol/openid-connect/token
30+
api_url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/mesh/protocol/openid-connect/userinfo
2231
allow_sign_up: true
23-
team_ids: grafana_users
2432
tls_skip_verify_insecure: true
33+
role_attribute_path: contains(groups[*], 'grafana_admins') && 'Admin' || 'Viewer'
34+
# allowed_domains (valid email domain...)
2535
datasources:
2636
datasources.yaml:
2737
apiVersion: 1
2838
datasources:
2939
- name: Prometheus
3040
type: prometheus
31-
url: http://prometheus.istio-system.svc:9090
41+
url: http://addons-prometheus-server.istio-system.svc
3242
access: proxy
3343
isDefault: true
3444
dashboardProviders:

‎addons/gatekeeper/configmap/jaeger.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
redirection-url: http://jaeger.WILDCARD_BASE_DOMAIN
2-
discovery-url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/master
2+
discovery-url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/mesh
33
upstream-url: http://127.0.0.1:16686/
44
skip-openid-provider-tls-verify: true
55
client-id: jaeger-client
6-
client-secret: AAAAAAAA
6+
client-secret: JJJJJJJJ
77
enable-refresh-tokens: true
88
listen: :8000
99
secure-cookie: false

‎addons/gatekeeper/configmap/kiali.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
redirection-url: http://kiali.WILDCARD_BASE_DOMAIN
2-
discovery-url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/master
2+
discovery-url: https://keycloak.WILDCARD_BASE_DOMAIN/auth/realms/mesh
33
upstream-url: http://127.0.0.1:20001/
44
skip-openid-provider-tls-verify: true
55
client-id: kiali-client
6-
client-secret: AAAAAAAA
6+
client-secret: KKKKKKKK
77
enable-refresh-tokens: true
88
listen: :8000
99
secure-cookie: false

‎addons/mesh/grafana.gw.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ spec:
1111
port:
1212
name: http
1313
number: 80
14-
protocol: HTTP
14+
protocol: HTTP

‎addons/mesh/grafana.vs.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ spec:
1818
- destination:
1919
host: addons-grafana
2020
port:
21-
number: 8000
21+
number: 80
2222

‎addons/mesh/jaeger.gw.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ spec:
1111
port:
1212
name: http
1313
number: 80
14-
protocol: HTTP
14+
protocol: HTTP

‎addons/mesh/keycloak.vs.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@ spec:
1616
- destination:
1717
host: addons-keycloak-http
1818
port:
19-
number: 8443
19+
number: 8443

‎addons/mesh/kiali.gw.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ spec:
1111
port:
1212
name: http
1313
number: 80
14-
protocol: HTTP
14+
protocol: HTTP

‎install.sh

+8-11
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,6 @@ sed -i '' "s/WILDCARD_BASE_DOMAIN/$WILDCARD_BASE_DOMAIN/" ./addons/chart/values.
4646
echo "Installing Istiod..."
4747
istioctl install -f ./istio-operator.yaml -n istio-system
4848

49-
sleep 5
50-
INGRESS_IP=$(kubectl get svc/istio-ingressgateway -o 'jsonpath={.status.loadBalancer.ingress[0].ip}')
51-
echo "Ingress gateway IP is $INGRESS_IP"
52-
echo ""
53-
54-
55-
5649

5750
echo "Installing KeyCloak..."
5851
kubectl create secret tls addons-certificates --key certs/server/server.key --cert certs/server/server.pem -n istio-system
@@ -62,7 +55,10 @@ helm install addons-keycloak -n istio-system ./addons/chart \
6255
kubectl apply -f ./addons/mesh/keycloak.gw.yaml -n istio-system
6356
kubectl apply -f ./addons/mesh/keycloak.vs.yaml -n istio-system
6457

58+
sleep 5
6559
echo ""
60+
INGRESS_IP=$(kubectl get svc/istio-ingressgateway -o 'jsonpath={.status.loadBalancer.ingress[0].ip}')
61+
echo "Ingress gateway IP is $INGRESS_IP"
6662
echo "Keycloak hostname: keycloak.$WILDCARD_BASE_DOMAIN"
6763
echo "Please update DNS and create oidc clients in KeyCloak:"
6864
echo "DNS: *.$WILDCARD_BASE_DOMAIN"
@@ -85,11 +81,12 @@ helm template addons -n istio-system ./addons/chart \
8581
--set-string 'switches.prometheus-enabled=true,switches.grafana-enabled=true,switches.kiali-enabled=true,switches.jaeger-enabled=true' \
8682
> ./addons/gatekeeper/.addons-install-pre.yaml
8783
kubectl kustomize ./addons/gatekeeper > ./addons/gatekeeper/.addons-install-post.yaml
88-
8984
kubectl apply -n istio-system -f ./addons/gatekeeper/.addons-install-post.yaml
90-
kubectl rollout status addons-kiali -n istio-system
91-
kubectl rollout status addons-grafana -n istio-system
92-
kubectl rollout status addons-jaeger-query -n istio-system
85+
86+
sleep 3
87+
kubectl rollout status deploy/addons-kiali -n istio-system
88+
kubectl rollout status deploy/addons-grafana -n istio-system
89+
kubectl rollout status deploy/addons-jaeger-query -n istio-system
9390

9491

9592
for SVC in grafana kiali jaeger ; do

‎update-oidc-client-secret.sh

+26-8
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,35 @@
22

33
set -e
44

5-
# create keycloak client: kiali-client, grafana-client, jaeger-client
6-
# Access Type: confidential
7-
# Mappers: audiences/groups (required claim name: groups)
8-
# create user/group
9-
# user: basic
10-
# groups: kiali_users, grafana_users, jaeger_users
115

126

7+
# export GRAFANA_OIDC_CLIENT_SECRET=''
8+
# export KIALI_OIDC_CLIENT_SECRET=''
9+
# export JAEGER_OIDC_CLIENT_SECRET=''
1310

1411

12+
if [ -z "$GRAFANA_OIDC_CLIENT_SECRET" ]; then
13+
echo "GRAFANA_OIDC_CLIENT_SECRET is not set."
14+
exit 1
15+
fi
16+
if [ -z "$KIALI_OIDC_CLIENT_SECRET" ]; then
17+
echo "KIALI_OIDC_CLIENT_SECRET is not set."
18+
exit 1
19+
fi
20+
if [ -z "$JAEGER_OIDC_CLIENT_SECRET" ]; then
21+
echo "JAEGER_OIDC_CLIENT_SECRET is not set."
22+
exit 1
23+
fi
1524

16-
# patch config AAAAAAAA, use oidc secret!
17-
# restart deployments
1825

26+
k get cm/addons-grafana -o yaml | sed "s/GGGGGGGG/$GRAFANA_OIDC_CLIENT_SECRET/" | k apply -f -
27+
k get cm/addons-oidc-gatekeeper-config -o yaml | \
28+
sed 's/JJJJJJJJ/$JAEGER_OIDC_CLIENT_SECRET/' | \
29+
sed 's/KKKKKKKK/$KIALI_OIDC_CLIENT_SECRET/' | \
30+
k apply -f -
31+
32+
33+
PATCH="{\"spec\":{\"template\":{\"metadata\":{\"labels\":{\"date\":\"`date +'%s'`\"}}}}}"
34+
kubectl patch deployment addons-grafana -p $PATCH
35+
kubectl patch deployment addons-jaeger-query -p $PATCH
36+
kubectl patch deployment addons-kiali -p $PATCH

0 commit comments

Comments
 (0)