feat: Add Istio service mesh installation with ingress gateway, traffic management, and mTLS configuration

- Add IstioOperator with default profile, pilot with 100% trace sampling, istio-system namespace
- Add ingress gateway with LoadBalancer type, HTTP (80) and HTTPS (443) ports, 100m-500m CPU, 128Mi-512Mi memory, 1-5 autoscale replicas
- Add egress gateway with 50m-200m CPU, 64Mi-256Mi memory
- Add mesh config with ROUND_ROBIN load balancing, 100 max TCP connections, 50 HTTP pending requests, JSON

deployments/istio/istio-install.yaml

@@ -0,0 +1,91 @@
+apiVersion: install.istio.io/v1alpha1
+kind: IstioOperator
+metadata:
+  name: telecom-platform-istio
+  namespace: istio-system
+spec:
+  profile: default
+  components:
+    base:
+      enabled: true
+    pilot:
+      enabled: true
+      k8s:
+        env:
+          PILOT_TRACE_SAMPLING: "100"
+    ingressGateways:
+    - name: istio-ingressgateway
+      enabled: true
+      k8s:
+        service:
+          type: LoadBalancer
+          ports:
+          - name: http2
+            port: 80
+            targetPort: 8080
+          - name: https
+            port: 443
+            targetPort: 8443
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+    egressGateways:
+    - name: istio-egressgateway
+      enabled: true
+      k8s:
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            cpu: 200m
+            memory: 256Mi
+  meshConfig:
+    defaultConfig:
+      trafficPolicy:
+        connectionPool:
+          tcp:
+            maxConnections: 100
+          http:
+            http1MaxPendingRequests: 50
+            maxRequestsPerConnection: 10
+        loadBalancer:
+          simple: ROUND_ROBIN
+      accessLogFile: /dev/stdout
+      accessLogEncoding: JSON
+      accessLogFormat: '{"source":"%SOURCE_WORKLOAD%","destination":"%DESTINATION_WORKLOAD%","protocol":"%REQ(:)%","method":"%REQ(:METHOD)%","path":"%REQ(:PATH)%","code":"%RESPONSE_CODE%","duration":"%DURATION%","bytesSent":"%BYTES_SENT%","bytesReceived":"%BYTES_RECEIVED%"}'
+      tracing:
+        sampling: 100.0
+        zipkin:
+          address: zipkin.istio-system:9411
+  values:
+    global:
+      controlPlaneSecurityEnabled: true
+      mtls:
+        enabled: true
+    gateways:
+      istio-ingressgateway:
+        type: LoadBalancer
+        autoscaleMin: 1
+        autoscaleMax: 5
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+    pilot:
+      autoscaleMin: 1
+      autoscaleMax: 3
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi

deployments/istio/telecom-platform-gateway.yaml

@@ -0,0 +1,126 @@
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: telecom-platform-gateway
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-gateway
+    app.kubernetes.io/component: istio
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+  - port:
+      number: 80
+      name: http
+      protocol: HTTP
+    hosts:
+    - api.telecom.local
+    - dashboard.telecom.local
+    - grafana.telecom.local
+    - prometheus.telecom.local
+    - kibana.telecom.local
+    tls:
+      httpsRedirect: true
+  - port:
+      number: 443
+      name: https
+      protocol: HTTPS
+    hosts:
+    - api.telecom.local
+    - dashboard.telecom.local
+    - grafana.telecom.local
+    - prometheus.telecom.local
+    - kibana.telecom.local
+    tls:
+      mode: SIMPLE
+      credentialName: telecom-platform-tls
+      minProtocolVersion: TLSV1_2
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: telecom-platform-api
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-api
+    app.kubernetes.io/component: istio
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  hosts:
+  - api.telecom.local
+  gateways:
+  - telecom-platform-gateway
+  http:
+  - match:
+    - uri:
+        prefix: /
+    route:
+    - destination:
+        host: api-server
+        port:
+          number: 8000
+    timeout: 30s
+    retries:
+      attempts: 3
+      perTryTimeout: 10s
+      retryOn: 5xx,connect-failure,refused-stream
+    fault:
+      delay:
+        percentage:
+          value: 0.1
+        fixedDelay: 5s
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: telecom-platform-dashboard
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-dashboard
+    app.kubernetes.io/component: istio
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  hosts:
+  - dashboard.telecom.local
+  gateways:
+  - telecom-platform-gateway
+  http:
+  - match:
+    - uri:
+        prefix: /
+    route:
+    - destination:
+        host: web-dashboard
+        port:
+          number: 3000
+    timeout: 30s
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: telecom-platform-api
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-api
+    app.kubernetes.io/component: istio
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  host: api-server
+  trafficPolicy:
+    loadBalancer:
+      simple: ROUND_ROBIN
+    connectionPool:
+      tcp:
+        maxConnections: 100
+      http:
+        http1MaxPendingRequests: 50
+        maxRequestsPerConnection: 10
+    outlierDetection:
+      consecutiveErrors: 3
+      interval: 30s
+      baseEjectionTime: 30s
+      maxEjectionPercent: 50
+    tls:
+      mode: ISTIO_MUTUAL