tree e00763fd98928102cc80afb0d6405bcfece98232
parent c990d0e8536efbd959d3da01944ad65c73c91373
author Thomas Draebing <thomas.draebing@sap.com> 1592916373 +0200
committer Thomas Dräbing <thomas.draebing@sap.com> 1724661668 +0000

Enable the use of istio for the monitoring setup

The monitoring setup was only usable with an ingress controller like
Nginx. However, if being used in a cluster running one or multiple
Gerrit instances, it might be worth considering a service mesh to have
better control of the network traffic. In this case, it would be worth
considering also integrating the monitoring setup with the service
mesh to avoid multiple load balancers.

This change adds the resources to configure the setup to run in an
istio service mesh. Istio is already expected to be installed.
The ports 80 and 443 have to be enabled in the istio-ingressgateway.

If configured the setup will then set up a gateway, which allows
access to Grafana. The access to Prometheus and Loki is only possible
with a JWT-token. This was done, since istio does not provide basic
authentication like the NGINX ingress controller and neither do
Prometheus or Loki.

The installer will automatically put a bearer token into the Promtail
configurations.

If a key is required, the gerrit-monitoring.py -c <config> jwt command
can be used to get one.

At the moment JWT tokens do not expire, since there is currently no
mechanism supported to automatically cycle the tokens. This may be
added in a later step.

Change-Id: Ic6542a3bdfdbcaa63552d0e049d62e12d1f8acaf