Add monitoring controller for metrics

api/v1/istio_types.go

@@ -63,6 +63,24 @@ type IstioSpec struct {
 	// Defines the values to be passed to the Helm charts when installing Istio.
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Helm Values"
 	Values *Values `json:"values,omitempty"`
+
+	// Defines the configuration for Prometheus monitoring integration.
+	// When enabled, the operator creates ServiceMonitor and PodMonitor resources
+	// for scraping Istio metrics using the Cluster Observability Operator (COO).
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Monitoring"
+	// +optional
+	Monitoring *MonitoringConfig `json:"monitoring,omitempty"`
+}
+
+// MonitoringConfig defines the configuration for Prometheus monitoring integration
+type MonitoringConfig struct {
+	// When enabled, the operator creates ServiceMonitor resources for istiod
+	// and PodMonitor resources for Envoy sidecars in namespaces with
+	// istio-injection=enabled label.
+	// Defaults to false.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Enable Monitoring",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
+	// +kubebuilder:default=false
+	Enabled bool `json:"enabled,omitempty"`
 }
 
 // IstioUpdateStrategy defines how the control plane should be updated when the version in

bundle/manifests/sailoperator.clusterserviceversion.yaml

@@ -320,6 +320,21 @@ spec:
             path: updateStrategy.updateWorkloads
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
+          - description: |-
+              Defines the configuration for Prometheus monitoring integration.
+              When enabled, the operator creates ServiceMonitor and PodMonitor resources
+              for scraping Istio metrics using the Cluster Observability Operator (COO).
+            displayName: Monitoring
+            path: monitoring
+          - description: |-
+              When enabled, the operator creates ServiceMonitor resources for istiod
+              and PodMonitor resources for Envoy sidecars in namespaces with
+              istio-injection=enabled label.
+              Defaults to false.
+            displayName: Enable Monitoring
+            path: monitoring.enabled
+            x-descriptors:
+              - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
           - description: Namespace to which the Istio components should be installed. Note that this field is immutable.
             displayName: Namespace
             path: namespace
@@ -741,6 +756,32 @@ spec:
                 - get
                 - patch
                 - update
+            - apiGroups:
+                - monitoring.coreos.com
+              resources:
+                - servicemonitors
+                - podmonitors
+              verbs:
+                - create
+                - delete
+                - get
+                - list
+                - patch
+                - update
+                - watch
+            - apiGroups:
+                - monitoring.rhobs
+              resources:
+                - servicemonitors
+                - podmonitors
+              verbs:
+                - create
+                - delete
+                - get
+                - list
+                - patch
+                - update
+                - watch
           serviceAccountName: sail-operator
       deployments:
         - label:

bundle/manifests/sailoperator.io_istios.yaml

@@ -91,6 +91,21 @@ spec:
               version: v1.30.1
             description: IstioSpec defines the desired state of Istio
             properties:
+              monitoring:
+                description: |-
+                  Defines the configuration for Prometheus monitoring integration.
+                  When enabled, the operator creates ServiceMonitor and PodMonitor resources
+                  for scraping Istio metrics using the Cluster Observability Operator (COO).
+                properties:
+                  enabled:
+                    default: false
+                    description: |-
+                      When enabled, the operator creates ServiceMonitor resources for istiod
+                      and PodMonitor resources for Envoy sidecars in namespaces with
+                      istio-injection=enabled label.
+                      Defaults to false.
+                    type: boolean
+                type: object
               namespace:
                 default: istio-system
                 description: Namespace to which the Istio components should be installed.

chart/crds/sailoperator.io_istios.yaml

@@ -91,6 +91,21 @@ spec:
               version: v1.30.1
             description: IstioSpec defines the desired state of Istio
             properties:
+              monitoring:
+                description: |-
+                  Defines the configuration for Prometheus monitoring integration.
+                  When enabled, the operator creates ServiceMonitor and PodMonitor resources
+                  for scraping Istio metrics using the Cluster Observability Operator (COO).
+                properties:
+                  enabled:
+                    default: false
+                    description: |-
+                      When enabled, the operator creates ServiceMonitor resources for istiod
+                      and PodMonitor resources for Envoy sidecars in namespaces with
+                      istio-injection=enabled label.
+                      Defaults to false.
+                    type: boolean
+                type: object
               namespace:
                 default: istio-system
                 description: Namespace to which the Istio components should be installed.

chart/templates/rbac/role.yaml

@@ -324,3 +324,29 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  - podmonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.rhobs
+  resources:
+  - servicemonitors
+  - podmonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch

cmd/main.go

@@ -26,6 +26,7 @@ import (
 	"github.com/istio-ecosystem/sail-operator/controllers/istiocni"
 	"github.com/istio-ecosystem/sail-operator/controllers/istiorevision"
 	"github.com/istio-ecosystem/sail-operator/controllers/istiorevisiontag"
+	"github.com/istio-ecosystem/sail-operator/controllers/monitoring"
 	"github.com/istio-ecosystem/sail-operator/controllers/webhook"
 	"github.com/istio-ecosystem/sail-operator/controllers/ztunnel"
 	"github.com/istio-ecosystem/sail-operator/pkg/config"
@@ -245,6 +246,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	err = monitoring.NewReconciler(reconcilerCfg, mgr.GetClient(), mgr.GetScheme()).
+		SetupWithManager(mgr)
+	if err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Monitoring")
+		os.Exit(1)
+	}
+
 	if reconcilerCfg.TLSConfig != nil && reconcilerCfg.TLSConfig.OpenShift != nil {
 		tlsWatcher := &openshifttls.SecurityProfileWatcher{
 			Client:                    mgr.GetClient(),