Install and configure Istio service mesh for Kubernetes with security policies and observability

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Configuration
ISTIO_VERSION="${ISTIO_VERSION:-}"
NAMESPACE="${NAMESPACE:-default}"
CLEANUP_ON_EXIT=false

# Functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

show_usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Install and configure Istio service mesh for Kubernetes

OPTIONS:
    -n, --namespace NAMESPACE    Target namespace for sample app (default: default)
    -v, --version VERSION       Specific Istio version to install (default: latest)
    -c, --cleanup-on-error      Enable cleanup on installation failure
    -h, --help                  Show this help message

EXAMPLES:
    $0                          # Install with defaults
    $0 -n production -v 1.20.0  # Install specific version in production namespace
    $0 --cleanup-on-error       # Enable automatic cleanup on failure
EOF
}

cleanup_on_error() {
    if [ "$CLEANUP_ON_EXIT" = true ]; then
        log_warn "Installation failed, cleaning up..."
        kubectl delete namespace istio-system --ignore-not-found=true 2>/dev/null || true
        rm -rf istio-* /tmp/istio-configs 2>/dev/null || true
    fi
}

check_prerequisites() {
    log_info "Checking prerequisites..."
    
    if [[ $EUID -eq 0 ]]; then
        log_error "Do not run this script as root. Run as user with sudo privileges."
        exit 1
    fi
    
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl is required but not installed"
        exit 1
    fi
    
    if ! kubectl cluster-info &> /dev/null; then
        log_error "Cannot connect to Kubernetes cluster. Check kubectl configuration."
        exit 1
    fi
    
    # Check cluster resources
    local nodes_ready=$(kubectl get nodes --no-headers | grep -c Ready || true)
    if [ "$nodes_ready" -eq 0 ]; then
        log_error "No ready nodes found in cluster"
        exit 1
    fi
    
    log_success "Prerequisites check passed"
}

detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                ;;
            *) 
                log_error "Unsupported distro: $ID"
                exit 1 
                ;;
        esac
    else
        log_error "Cannot detect OS distribution"
        exit 1
    fi
    log_info "Detected distro: $ID using $PKG_MGR"
}

install_dependencies() {
    log_info "Installing required packages..."
    
    sudo $PKG_UPDATE
    sudo $PKG_INSTALL curl wget jq
    
    log_success "Dependencies installed"
}

install_istio() {
    echo "[1/8] Downloading and installing Istio CLI..."
    
    cd /tmp
    if [ -n "$ISTIO_VERSION" ]; then
        curl -L "https://github.com/istio/istio/releases/download/${ISTIO_VERSION}/istio-${ISTIO_VERSION}-linux-amd64.tar.gz" -o istio.tar.gz
        tar -xzf istio.tar.gz
        cd istio-${ISTIO_VERSION}
    else
        curl -L https://istio.io/downloadIstio | sh -
        cd istio-*
    fi
    
    sudo cp bin/istioctl /usr/local/bin/
    sudo chmod 755 /usr/local/bin/istioctl
    
    istioctl version --remote=false
    log_success "Istio CLI installed"
}

install_control_plane() {
    echo "[2/8] Installing Istio control plane..."
    
    istioctl install --set values.defaultRevision=default -y
    
    # Wait for control plane to be ready
    kubectl wait --for=condition=ready pod -l app=istiod -n istio-system --timeout=300s
    
    log_success "Istio control plane installed"
}

enable_sidecar_injection() {
    echo "[3/8] Enabling automatic sidecar injection..."
    
    kubectl label namespace "$NAMESPACE" istio-injection=enabled --overwrite
    
    kubectl get namespace "$NAMESPACE" -o jsonpath='{.metadata.labels.istio-injection}'
    echo
    
    log_success "Sidecar injection enabled for namespace: $NAMESPACE"
}

install_observability() {
    echo "[4/8] Installing observability addons..."
    
    # Apply observability addons
    kubectl apply -f samples/addons/prometheus.yaml
    kubectl apply -f samples/addons/grafana.yaml
    kubectl apply -f samples/addons/jaeger.yaml
    kubectl apply -f samples/addons/kiali.yaml
    
    echo "[5/8] Waiting for observability components to be ready..."
    
    # Wait for deployments to be available
    kubectl rollout status deployment/prometheus -n istio-system --timeout=300s
    kubectl rollout status deployment/grafana -n istio-system --timeout=300s
    kubectl rollout status deployment/jaeger -n istio-system --timeout=300s
    kubectl rollout status deployment/kiali -n istio-system --timeout=300s
    
    log_success "Observability addons installed and ready"
}

deploy_sample_app() {
    echo "[6/8] Deploying Bookinfo sample application..."
    
    kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n "$NAMESPACE"
    
    # Wait for all services to be ready
    kubectl wait --for=condition=ready pod -l app=productpage -n "$NAMESPACE" --timeout=300s
    kubectl wait --for=condition=ready pod -l app=details -n "$NAMESPACE" --timeout=300s
    kubectl wait --for=condition=ready pod -l app=reviews -n "$NAMESPACE" --timeout=300s
    kubectl wait --for=condition=ready pod -l app=ratings -n "$NAMESPACE" --timeout=300s
    
    log_success "Sample application deployed"
}

configure_gateway() {
    echo "[7/8] Configuring Istio Gateway and VirtualService..."
    
    mkdir -p /tmp/istio-configs
    
    cat > /tmp/istio-configs/bookinfo-gateway.yaml << 'EOF'
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080
EOF
    
    chmod 644 /tmp/istio-configs/bookinfo-gateway.yaml
    kubectl apply -f /tmp/istio-configs/bookinfo-gateway.yaml -n "$NAMESPACE"
    
    # Create destination rules
    cat > /tmp/istio-configs/destination-rules.yaml << 'EOF'
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3
    labels:
      version: v3
EOF
    
    chmod 644 /tmp/istio-configs/destination-rules.yaml
    kubectl apply -f /tmp/istio-configs/destination-rules.yaml -n "$NAMESPACE"
    
    log_success "Gateway and traffic rules configured"
}

verify_installation() {
    echo "[8/8] Verifying installation..."
    
    # Check Istio system pods
    local failed_pods=$(kubectl get pods -n istio-system --no-headers | grep -v Running | grep -v Completed | wc -l)
    if [ "$failed_pods" -gt 0 ]; then
        log_error "Some Istio system pods are not running properly"
        kubectl get pods -n istio-system
        exit 1
    fi
    
    # Check sample app pods
    local app_failed_pods=$(kubectl get pods -n "$NAMESPACE" --no-headers | grep -v Running | grep -v Completed | wc -l)
    if [ "$app_failed_pods" -gt 0 ]; then
        log_error "Some application pods are not running properly"
        kubectl get pods -n "$NAMESPACE"
        exit 1
    fi
    
    # Get ingress gateway external IP/port
    local ingress_port=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
    local ingress_host=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="ExternalIP")].address}')
    
    if [ -z "$ingress_host" ]; then
        ingress_host=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
    fi
    
    log_success "Istio service mesh installation completed successfully!"
    echo
    log_info "Access points:"
    echo "  Bookinfo app: http://${ingress_host}:${ingress_port}/productpage"
    echo "  Kiali dashboard: kubectl port-forward svc/kiali 20001:20001 -n istio-system"
    echo "  Jaeger UI: kubectl port-forward svc/jaeger 16686:16686 -n istio-system"
    echo "  Grafana: kubectl port-forward svc/grafana 3000:3000 -n istio-system"
    echo
    log_info "Cleanup temporary files..."
    rm -rf /tmp/istio-configs istio.tar.gz 2>/dev/null || true
}

# Main execution
main() {
    # Parse arguments
    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--namespace)
                NAMESPACE="$2"
                shift 2
                ;;
            -v|--version)
                ISTIO_VERSION="$2"
                shift 2
                ;;
            -c|--cleanup-on-error)
                CLEANUP_ON_EXIT=true
                shift
                ;;
            -h|--help)
                show_usage
                exit 0
                ;;
            *)
                log_error "Unknown option: $1"
                show_usage
                exit 1
                ;;
        esac
    done
    
    # Set trap for cleanup on error
    trap cleanup_on_error ERR
    
    log_info "Starting Istio service mesh installation..."
    
    check_prerequisites
    detect_distro
    install_dependencies
    install_istio
    install_control_plane
    enable_sidecar_injection
    install_observability
    deploy_sample_app
    configure_gateway
    verify_installation
}

main "$@"