Configure Istio ingress gateway with SSL certificates and custom domains for Kubernetes service mesh

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
DOMAIN=""
EMAIL=""
NAMESPACE="default"

# Usage message
usage() {
    echo "Usage: $0 -d DOMAIN -e EMAIL [-n NAMESPACE]"
    echo "  -d DOMAIN     Custom domain (e.g., example.com)"
    echo "  -e EMAIL      Email for Let's Encrypt certificates"
    echo "  -n NAMESPACE  Target namespace for sample app (default: default)"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup on failure
cleanup() {
    log_error "Script failed. Cleaning up..."
    kubectl delete certificate example-com-tls -n istio-system 2>/dev/null || true
    kubectl delete clusterissuer letsencrypt-prod 2>/dev/null || true
    kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml 2>/dev/null || true
}

trap cleanup ERR

# Parse arguments
while getopts "d:e:n:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        n) NAMESPACE="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
    usage
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            ;;
        *) 
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

# Check prerequisites
if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
    log_error "This script requires root privileges or sudo access"
    exit 1
fi

# Check for kubectl
if ! command -v kubectl &> /dev/null; then
    log_error "kubectl is not installed or not in PATH"
    exit 1
fi

# Main installation steps
echo "[1/8] Updating system packages..."
sudo $PKG_UPDATE
log_info "System packages updated"

echo "[2/8] Verifying Istio installation..."
if ! kubectl get pods -n istio-system | grep -q "istio"; then
    log_error "Istio is not installed. Please install Istio first."
    exit 1
fi

if ! kubectl get svc -n istio-system istio-ingressgateway &>/dev/null; then
    log_error "Istio ingress gateway not found"
    exit 1
fi
log_info "Istio installation verified"

echo "[3/8] Installing cert-manager..."
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
kubectl wait --for=condition=Available --timeout=300s deployment/cert-manager -n cert-manager
log_info "cert-manager installed successfully"

echo "[4/8] Creating ClusterIssuer for Let's Encrypt..."
cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: $EMAIL
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: istio
EOF
log_info "ClusterIssuer created"

echo "[5/8] Creating SSL certificate..."
cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com-tls
  namespace: istio-system
spec:
  secretName: example-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - $DOMAIN
  - www.$DOMAIN
  - api.$DOMAIN
EOF
log_info "SSL certificate requested"

echo "[6/8] Configuring Istio Gateway with TLS..."
cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - $DOMAIN
    - www.$DOMAIN
    - api.$DOMAIN
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: example-com-tls
    hosts:
    - $DOMAIN
    - www.$DOMAIN
    - api.$DOMAIN
EOF
log_info "Istio Gateway configured"

echo "[7/8] Deploying sample application..."
kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace "$NAMESPACE" istio-injection=enabled --overwrite

cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
  namespace: $NAMESPACE
spec:
  replicas: 2
  selector:
    matchLabels:
      app: httpbin
  template:
    metadata:
      labels:
        app: httpbin
    spec:
      containers:
      - name: httpbin
        image: kennethreitz/httpbin
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  namespace: $NAMESPACE
  labels:
    app: httpbin
spec:
  ports:
  - port: 8080
    targetPort: 80
    name: http
  selector:
    app: httpbin
EOF

cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: example-vs
  namespace: $NAMESPACE
spec:
  hosts:
  - $DOMAIN
  - www.$DOMAIN
  gateways:
  - istio-system/example-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: httpbin
        port:
          number: 8080
EOF
log_info "Sample application deployed"

echo "[8/8] Verifying installation..."
sleep 10

# Check cert-manager pods
if kubectl get pods -n cert-manager | grep -q "Running"; then
    log_info "✓ cert-manager pods are running"
else
    log_warn "⚠ Some cert-manager pods may not be ready yet"
fi

# Check certificate status
if kubectl get certificate example-com-tls -n istio-system &>/dev/null; then
    log_info "✓ SSL certificate created"
else
    log_warn "⚠ SSL certificate not found"
fi

# Check gateway
if kubectl get gateway example-gateway -n istio-system &>/dev/null; then
    log_info "✓ Istio Gateway configured"
else
    log_warn "⚠ Istio Gateway not found"
fi

# Check sample app
if kubectl get deployment httpbin -n "$NAMESPACE" &>/dev/null; then
    log_info "✓ Sample application deployed"
else
    log_warn "⚠ Sample application not found"
fi

# Get ingress IP
INGRESS_IP=$(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "")
if [[ -z "$INGRESS_IP" ]]; then
    INGRESS_IP=$(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.spec.externalIPs[0]}' 2>/dev/null || echo "pending")
fi

echo
log_info "Installation completed successfully!"
echo "Next steps:"
echo "1. Point your DNS records for $DOMAIN to: $INGRESS_IP"
echo "2. Wait for Let's Encrypt certificate to be issued (may take a few minutes)"
echo "3. Test your setup: curl -k https://$DOMAIN"
echo
echo "To check certificate status: kubectl describe certificate example-com-tls -n istio-system"
echo "To view gateway status: kubectl get gateway example-gateway -n istio-system"