Add values to enable Istio and SPIRE #1

mattbates · 2025-10-01T21:42:20Z

Adds extra values to enable Istio and SPIRE, and a helper function used in the deployment templates to embed labels and annotations.

gemini-code-assist · 2025-10-01T21:42:37Z

Summary of Changes

Hello @mattbates, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the Helm chart for the Online Boutique application by introducing robust support for Istio and SPIRE. It provides a streamlined way to enable Istio sidecar injection and configure proxy metadata, with an optional integration for SPIRE to manage service identities. These changes allow for greater control over the application's network policies, security, and observability within an Istio-enabled Kubernetes environment.

Highlights

New Helm Helper Templates: Introduced onlineboutique.istio.injectLabel and onlineboutline.istio.annotations helper templates in _helpers.tpl to encapsulate Istio sidecar injection labels and proxy metadata annotations, including conditional SPIRE integration.
Istio Integration into Services: Integrated the new Istio helper templates into the deployment metadata of various services (adservice, cartservice, checkoutservice, currencyservice, emailservice, paymentservice, productcatalogservice, recommendationservice, shippingservice) to enable automatic Istio sidecar injection and configuration.
Configurable Istio and SPIRE Options: Added new istio and istio.spire sections to values.yaml with enable flags, allowing users to easily enable or disable Istio sidecar injection and SPIRE integration through Helm chart values.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds support for enabling Istio and SPIRE by introducing new values in values.yaml and a helper template to inject labels and annotations into the service deployments. While the intention is good, the implementation has a critical flaw that can lead to invalid YAML and failed deployments. The new helper template for annotations (onlineboutline.istio.annotations) creates a new annotations: block, which conflicts with existing annotations in cartservice.yaml, resulting in a duplicate key. My review includes suggestions to refactor the helper template to only return annotation content, and provides guidance on how to correctly integrate these annotations in the deployment templates. I've also pointed out a typo in the helper template's name. Addressing these issues is critical for the stability of the Helm chart.

gemini-code-assist · 2025-10-01T21:45:06Z

helm-chart/templates/_helpers.tpl

+{{- define "onlineboutline.istio.annotations" -}}
+{{- if .Values.istio.enable }}
+annotations:
+  proxy.istio.io/config: |
+    proxyMetadata:
+      ISTIO_META_DNS_CAPTURE: "true"
+      ISTIO_META_DNS_AUTO_ALLOCATE: "true"
+  {{- if .Values.istio.spire.enable }}
+  inject.istio.io/templates: "sidecar,spire"
+  {{- else }}
+  inject.istio.io/templates: "sidecar"
+  {{- end }}
+{{- end }}
+{{- end -}}


This helper template produces a full annotations: block. This will cause invalid YAML for services that already have an annotations block, such as cartservice.yaml, due to a duplicate key. To resolve this, the helper should only generate the annotation key-value pairs, not the annotations: key itself. This allows callers to safely include the output within a single annotations: block. Additionally, there is a typo in the template name (onlineboutline should be onlineboutique). I recommend refactoring this helper as follows. Please note that all call sites will need to be updated to correctly use this refactored helper.

{{- define "onlineboutique.istio.annotations" -}} {{- if .Values.istio.enable }} proxy.istio.io/config: | proxyMetadata: ISTIO_META_DNS_CAPTURE: "true" ISTIO_META_DNS_AUTO_ALLOCATE: "true" {{- if .Values.istio.spire.enable }} inject.istio.io/templates: "sidecar,spire" {{- else }} inject.istio.io/templates: "sidecar" {{- end }} {{- end }} {{- end -}}

gemini-code-assist · 2025-10-01T21:45:06Z

helm-chart/templates/adservice.yaml

      labels:
        app: {{ .Values.adService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:07Z

helm-chart/templates/cartservice.yaml

      labels:
        app: {{ .Values.cartService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


This line introduces a critical issue. It adds a new annotations block to the pod metadata. However, cartservice.yaml already defines an annotations block on lines 42-45 when .Values.cartDatabase.externalRedisTlsOrigination.enable is true. This will result in a duplicate annotations key, making the generated YAML invalid. The Istio annotations must be merged into a single annotations block. Furthermore, both the existing annotations and the new Istio annotations define a proxy.istio.io/config key with different values. These configurations need to be manually merged into a single valid value for this annotation to avoid one overwriting the other. This change depends on the suggested refactoring of the helper in _helpers.tpl.

gemini-code-assist · 2025-10-01T21:45:07Z

helm-chart/templates/checkoutservice.yaml

      labels:
        app: {{ .Values.checkoutService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:07Z

helm-chart/templates/currencyservice.yaml

      labels:
        app: {{ .Values.currencyService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:07Z

helm-chart/templates/emailservice.yaml

      labels:
        app: {{ .Values.emailService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:07Z

helm-chart/templates/paymentservice.yaml

      labels:
        app: {{ .Values.paymentService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:08Z

helm-chart/templates/productcatalogservice.yaml

      labels:
        app: {{ .Values.productCatalogService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:08Z

helm-chart/templates/recommendationservice.yaml

      labels:
        app: {{ .Values.recommendationService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

gemini-code-assist · 2025-10-01T21:45:08Z

helm-chart/templates/shippingservice.yaml

      labels:
        app: {{ .Values.shippingService.name }}
+        {{- include "onlineboutique.istio.injectLabel" . | nindent 8 }}
+      {{- include "onlineboutline.istio.annotations" . | nindent 6 }}


To fix a potential invalid YAML issue found in other parts of the chart and a typo, the Istio annotations should be added within a new annotations block only when needed. This change is dependent on the suggested refactoring of the onlineboutline.istio.annotations helper in _helpers.tpl. The helper should be renamed and modified to only return annotation content.

{{- $istioAnnotations := include "onlineboutique.istio.annotations" . }} {{- if $istioAnnotations }} annotations: {{- $istioAnnotations | nindent 8 }} {{- end }}

add values for Istio + SPIRE enablement and use a helper function

0bb5e49

gemini-code-assist bot reviewed Oct 1, 2025

View reviewed changes

add spiffe-enable value

464144e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add values to enable Istio and SPIRE #1

Add values to enable Istio and SPIRE #1

Uh oh!

mattbates commented Oct 1, 2025

Uh oh!

gemini-code-assist bot commented Oct 1, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

gemini-code-assist bot Oct 1, 2025

Uh oh!

Uh oh!

Add values to enable Istio and SPIRE #1

Are you sure you want to change the base?

Add values to enable Istio and SPIRE #1

Uh oh!

Conversation

mattbates commented Oct 1, 2025

Uh oh!

gemini-code-assist bot commented Oct 1, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!