Add mechnism to create permissive peerauthenticaion for koperator's default alert manager

charts/kafka-operator/README.md

@@ -71,6 +71,7 @@ Parameter | Description | Default
 `imagePullSecrets` | Image pull secrets can be set | `[]`
 `replicaCount` | Operator replica count can be set | `1`
 `alertManager.enable` | AlertManager can be enabled | `true`
+`alertManager.permissivePeerAuthentication.create` | Permissive PeerAuthentication (Istio resource) for AlertManager can be created | `true`
 `nodeSelector` | Operator pod node selector can be set | `{}`
 `tolerations` | Operator pod tolerations can be set | `[]`
 `affinity` | Operator pod affinity can be set | `{}`

charts/kafka-operator/templates/alertmanager-peerauthentication.yaml

@@ -0,0 +1,24 @@
+{{- if and (.Values.alertManager.enable) (.Values.alertManager.permissivePeerAuthentication.create) (.Capabilities.APIVersions.Has "security.istio.io/v1beta1") -}}
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: "{{ include "kafka-operator.fullname" . }}-alertmanager-peerauthenticaiton"
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+    app.kubernetes.io/name: {{ include "kafka-operator.name" . }}
+    helm.sh/chart: {{ include "kafka-operator.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: alertmanager
+spec:
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+      component: alertmanager
+  portLevelMtls:
+    {{ .Values.alertManager.port | quote }}:
+      mode: PERMISSIVE
+{{- end -}}

charts/kafka-operator/templates/alertmanager-service.yaml

@@ -25,5 +25,5 @@ spec:
     app.kubernetes.io/component: operator
   ports:
   - name: http-alerts
-    port: 9001
+    port: {{ .Values.alertManager.port }}
 {{- end -}}

charts/kafka-operator/templates/operator-deployment-with-webhook.yaml

@@ -215,7 +215,7 @@ spec:
             - containerPort: {{ (.Values.metricEndpoint).port | default 8080 }}
               name: metrics
               protocol: TCP
-            - containerPort: 9001
+            - containerPort: {{ .Values.alertManager.port }}
               name: alerts
               protocol: TCP
           volumeMounts:

charts/kafka-operator/values.yaml

@@ -46,6 +46,9 @@ certSigning:
 
 alertManager:
   enable: true
+  port: 9001
+  permissivePeerAuthentication:
+    create: false
 
 prometheusMetrics:
   enabled: true