Set up Istio multi-cluster service mesh with cross-cluster communication

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Default values
CTX_CLUSTER1="${1:-cluster1}"
CTX_CLUSTER2="${2:-cluster2}"
DOMAIN="${3:-example.com}"
ORG="${4:-example Inc.}"

usage() {
    echo "Usage: $0 [cluster1_context] [cluster2_context] [domain] [organization]"
    echo "Example: $0 prod-east prod-west mycompany.com 'MyCompany Inc.'"
    exit 1
}

log() {
    echo -e "${GREEN}[$(date +'%Y-%m-%d %H:%M:%S')]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
    exit 1
}

cleanup() {
    if [[ -d "certs" ]]; then
        rm -rf certs
    fi
    if [[ -f "get_helm.sh" ]]; then
        rm -f get_helm.sh
    fi
}

trap cleanup ERR

check_prerequisites() {
    log "[1/8] Checking prerequisites..."
    
    if [[ $EUID -eq 0 ]]; then
        error "This script should not be run as root. Use sudo for individual commands."
    fi
    
    if ! command -v sudo &> /dev/null; then
        error "sudo is required but not installed"
    fi
    
    if ! sudo -n true 2>/dev/null; then
        error "This script requires passwordless sudo access"
    fi
}

detect_distro() {
    log "[2/8] Detecting distribution..."
    
    if [[ ! -f /etc/os-release ]]; then
        error "Cannot detect distribution - /etc/os-release not found"
    fi
    
    source /etc/os-release
    
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *)
            error "Unsupported distribution: $ID"
            ;;
    esac
    
    log "Detected: $PRETTY_NAME using $PKG_MGR"
}

install_dependencies() {
    log "[3/8] Installing system dependencies..."
    
    sudo $PKG_UPDATE
    
    case "$PKG_MGR" in
        apt)
            sudo $PKG_INSTALL curl wget gnupg2 software-properties-common apt-transport-https ca-certificates openssl
            ;;
        dnf|yum)
            sudo $PKG_INSTALL curl wget gnupg2 openssl which
            ;;
    esac
}

install_kubectl() {
    log "[4/8] Installing kubectl..."
    
    if command -v kubectl &> /dev/null; then
        warn "kubectl already installed, skipping..."
        return
    fi
    
    KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt)
    curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
    chmod 755 kubectl
    sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
    rm kubectl
    
    kubectl version --client &> /dev/null || error "kubectl installation failed"
}

install_istioctl() {
    log "[5/8] Installing istioctl..."
    
    if command -v istioctl &> /dev/null; then
        warn "istioctl already installed, skipping..."
        return
    fi
    
    curl -sL https://istio.io/downloadIstio | sh -
    ISTIO_DIR=$(find . -name "istio-*" -type d | head -1)
    if [[ -z "$ISTIO_DIR" ]]; then
        error "Failed to find Istio directory"
    fi
    
    sudo install -o root -g root -m 0755 "${ISTIO_DIR}/bin/istioctl" /usr/local/bin/istioctl
    rm -rf istio-*
    
    istioctl version --remote=false &> /dev/null || error "istioctl installation failed"
}

install_helm() {
    log "[6/8] Installing Helm..."
    
    if command -v helm &> /dev/null; then
        warn "Helm already installed, skipping..."
        return
    fi
    
    case "$PKG_MGR" in
        apt)
            curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
            echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
            sudo apt update
            sudo $PKG_INSTALL helm
            ;;
        dnf|yum)
            curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
            chmod 700 get_helm.sh
            ./get_helm.sh
            rm -f get_helm.sh
            ;;
    esac
    
    helm version &> /dev/null || error "Helm installation failed"
}

setup_cluster_contexts() {
    log "[7/8] Setting up cluster contexts..."
    
    export CTX_CLUSTER1
    export CTX_CLUSTER2
    
    log "Verifying cluster access for $CTX_CLUSTER1..."
    if ! kubectl --context="${CTX_CLUSTER1}" get nodes &> /dev/null; then
        error "Cannot access cluster context: $CTX_CLUSTER1"
    fi
    
    log "Verifying cluster access for $CTX_CLUSTER2..."
    if ! kubectl --context="${CTX_CLUSTER2}" get nodes &> /dev/null; then
        error "Cannot access cluster context: $CTX_CLUSTER2"
    fi
    
    log "Creating istio-system namespaces..."
    kubectl --context="${CTX_CLUSTER1}" create namespace istio-system --dry-run=client -o yaml | kubectl --context="${CTX_CLUSTER1}" apply -f -
    kubectl --context="${CTX_CLUSTER2}" create namespace istio-system --dry-run=client -o yaml | kubectl --context="${CTX_CLUSTER2}" apply -f -
    
    log "Labeling clusters with network identifiers..."
    kubectl --context="${CTX_CLUSTER1}" label namespace istio-system topology.istio.io/network=network1 --overwrite
    kubectl --context="${CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2 --overwrite
}

generate_certificates() {
    log "[8/8] Generating certificates..."
    
    mkdir -p certs
    cd certs
    
    log "Creating root CA certificate..."
    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
        -subj "/O=${ORG}/CN=${DOMAIN}" \
        -keyout root-key.pem -out root-cert.pem
    
    log "Creating intermediate CA for cluster1..."
    openssl req -newkey rsa:2048 -nodes -keyout cluster1-key.pem \
        -subj "/O=${ORG}/CN=cluster1.${DOMAIN}" \
        -out cluster1.csr
    openssl x509 -req -days 365 -CA root-cert.pem -CAkey root-key.pem \
        -set_serial 0 -in cluster1.csr -out cluster1-cert.pem
    
    log "Creating intermediate CA for cluster2..."
    openssl req -newkey rsa:2048 -nodes -keyout cluster2-key.pem \
        -subj "/O=${ORG}/CN=cluster2.${DOMAIN}" \
        -out cluster2.csr
    openssl x509 -req -days 365 -CA root-cert.pem -CAkey root-key.pem \
        -set_serial 1 -in cluster2.csr -out cluster2-cert.pem
    
    chmod 600 *.pem *.key
    
    log "Installing certificates in cluster1..."
    kubectl --context="${CTX_CLUSTER1}" create secret generic cacerts -n istio-system \
        --from-file=root-cert.pem \
        --from-file=cert-chain.pem=cluster1-cert.pem \
        --from-file=ca-cert.pem=cluster1-cert.pem \
        --from-file=ca-key.pem=cluster1-key.pem \
        --dry-run=client -o yaml | kubectl --context="${CTX_CLUSTER1}" apply -f -
    
    log "Installing certificates in cluster2..."
    kubectl --context="${CTX_CLUSTER2}" create secret generic cacerts -n istio-system \
        --from-file=root-cert.pem \
        --from-file=cert-chain.pem=cluster2-cert.pem \
        --from-file=ca-cert.pem=cluster2-cert.pem \
        --from-file=ca-key.pem=cluster2-key.pem \
        --dry-run=client -o yaml | kubectl --context="${CTX_CLUSTER2}" apply -f -
    
    cd ..
}

verify_installation() {
    log "Verifying installation..."
    
    echo -e "${BLUE}Installed tools:${NC}"
    kubectl version --client --short 2>/dev/null || echo "kubectl: installed"
    istioctl version --remote=false 2>/dev/null | head -1 || echo "istioctl: installed"
    helm version --short 2>/dev/null || echo "helm: installed"
    
    echo -e "${BLUE}Cluster contexts:${NC}"
    echo "Cluster 1: $CTX_CLUSTER1"
    echo "Cluster 2: $CTX_CLUSTER2"
    
    echo -e "${BLUE}Certificates:${NC}"
    if [[ -f "certs/root-cert.pem" ]]; then
        echo "✓ Root CA certificate generated"
    fi
    
    echo -e "${BLUE}Next steps:${NC}"
    echo "1. Install Istio control plane: istioctl install --context=\$CTX_CLUSTER1 --set values.pilot.env.EXTERNAL_ISTIOD=true"
    echo "2. Install Istio control plane: istioctl install --context=\$CTX_CLUSTER2 --set values.pilot.env.EXTERNAL_ISTIOD=true"
    echo "3. Configure cross-network endpoint discovery"
    echo "4. Set up cross-cluster service exposure"
}

main() {
    if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
        usage
    fi
    
    check_prerequisites
    detect_distro
    install_dependencies
    install_kubectl
    install_istioctl
    install_helm
    setup_cluster_contexts
    generate_certificates
    verify_installation
    
    log "Istio multi-cluster setup completed successfully!"
}

main "$@"