istio-ecosystem/coddiwomple

Coddiwomple: a Multi-Cluster-Config Generator

coddiwomple's Issues

"cw version" command

It would be really useful for customers to see a cute version number, to excite them about keeping up with releases.

It would also help us from a packaging & PR PoV

Should also include git SHA for debugging.

FR: use egress gateway for service-service calls

See #2 for service -> external

By routing traffic through the egress gateway we can

• translate ports down to 80 and back up?
• LB between remote and local equally
• retry

Implement with caller-side VS

Should be optional becuase we don't want

• to force a middle-box for cluster-local calls
• force adding latency to cross-cluster calls when there is connectivity from Pod -> ingress

Move to golang 1.11

and go modules. Requires moving from operator-sdk to controller

FR: `cw gen services`

e.g. cw gen services —clusters-file= —out services.json

Command that connects to a kube cluster, creates GlobalService configs for all of them, merging them if they already exist in the output file

Set up golang-cilinter

FR: mTLS inter-cluster

The current config we generate exposes internal services (i.e. those expecting to protected in the old-fashioned way by a non-routable L3 address) to the internet, with no TLS, not even simple.

We should generate config which sets up mTLS for mesh-to-mesh calls, and instructions for configuring the certs.

Ingest K8s Cluster registries

In addition to our own clusters.json format

Move from operator-sdk to controller-runtime

https://github.com/kubernetes-sigs/controller-runtime

FR: `cw gen clusters`

E.g. cw gen clusters —kube-config=foo —kube-config=bar —out clusters.json

Should take a list of kubeconfigs and emit a clusters.json file, merging with any existing one provided.
This code already exists as shell.

FR: generate Gateway+ServiceEntry from k8s ingress resource

There used to be a tool in istioctl to do this (that was removed before 1.0), I think it'd be worth resurrecting here as it's still a common stumbling block for people moving from k8s. We can definitely cover transforming a basic ingress into a Gateway+VS easily, which covers the 80% use case. There's likely a subset of annotations that it would be worthwhile to handle as well.

rename `cw gen` to `cw gen configs`

To fit with cw gen [clusters|services|externals]

FR: Generate config for shared root of trust between clusters

In order for services to use mTLS across clusters, Citadel instances in each cluster need to be configured to sign with keys in a common trust domain. The set up required today is rather involved. It would be nice to package up the cert creation and per-cluster config generation into a single tool.

`cw version` command

Cute versions for users
Makes packaging and PR easier for us
should include git SHA for debugging

FR: Generate config to use egress proxies (for mesh-to-mesh and general egress)

If you're going to route to an external name, you need a combination of service entries and gateway config to route the external name to an egress gateway then out to the final destination. It's tedious to set up but easy to automate. We should add this as a subcommand, e.g. cw external-service https://wikipedia.org, which would spit out the required config.

I'll post example config setup for wikipedia.org shortly.