$ oc create configmap --from-file=<templates-directory> smcp-templates -n openshift-operators
When you deploy an application into the Service Mesh, there are several differences between the behavior of applications in the upstream community version of Istio and the behavior of applications within a Red Hat OpenShift Service Mesh installation.
You can create reusable configurations with ServiceMeshControlPlane
templates. Individual users can extend the templates they create with their own configurations. Templates can also inherit configuration information from other templates. For example, you can create an accounting control plane for the accounting team and a marketing control plane for the marketing team. If you create a development template and a production template, members of the marketing team and the accounting team can extend the development and production templates with team specific customization.
When you configure control plane templates, which follow the same syntax as the ServiceMeshControlPlane
, users inherit settings in a hierarchical fashion. The Operator is delivered with a default
template with default settings for Red Hat OpenShift Service Mesh. To add custom templates you must create a ConfigMap named smcp-templates
in the openshift-operators
project and mount the ConfigMap in the Operator container at /usr/local/share/istio-operator/templates
.
Follow this procedure to create the ConfigMap.
An installed, verified Service Mesh Operator.
An account with the cluster-admin
role.
Location of the Operator deployment.
Access to the OpenShift Container Platform Command-line Interface (cli) also known as oc
.
Log in to the OpenShift Container Platform cli as a cluster administrator.
From the cli, run this command to create the ConfigMap named smcp-templates
in the openshift-operators
project and replace <templates-directory>
with the location of the ServiceMeshControlPlane
files on your local disk:
$ oc create configmap --from-file=<templates-directory> smcp-templates -n openshift-operators
Locate the Operator ClusterServiceVersion name.
$ oc get clusterserviceversion -n openshift-operators | grep 'Service Mesh' maistra.v1.0.0 Red Hat OpenShift Service Mesh 1.0.0 Succeeded
Edit the Operator cluster service version to instruct the Operator to use the smcp-templates
ConfigMap.
$ oc edit clusterserviceversion -n openshift-operators maistra.v1.0.0
Add a volume mount and volume to the Operator deployment.
deployments:
- name: istio-operator
spec:
template:
spec:
containers:
volumeMounts:
- name: discovery-cache
mountPath: /home/istio-operator/.kube/cache/discovery
- name: smcp-templates
mountPath: /usr/local/share/istio-operator/templates/
volumes:
- name: discovery-cache
emptyDir:
medium: Memory
- name: smcp-templates
configMap:
name: smcp-templates
...
Save your changes and exit the editor.
You can now use the template
parameter in the ServiceMeshControlPlane
to specify a template.
apiVersion: maistra.io/v1
kind: ServiceMeshControlPlane
metadata:
name: minimal-install
spec:
template: default
Red Hat OpenShift Service Mesh relies on a proxy sidecar within the application’s pod to provide Service Mesh capabilities to the application. You can enable automatic sidecar injection or manage it manually. Red Hat recommends automatic injection using the annotation with no need to label projects. This ensures that your application contains the appropriate configuration for the Service Mesh upon deployment. This method requires fewer privileges and does not conflict with other OpenShift capabilities such as builder pods.
The upstream version of Istio injects the sidecar by default if you have labeled the project. Red Hat OpenShift Service Mesh requires you to opt in to having the sidecar automatically injected to a deployment, so you are not required to label the project. This avoids injecting a sidecar if it is not wanted (for example, in build or deploy pods). The webhook checks the configuration of pods deploying into all projects to see if they are opting in to injection with the appropriate annotation. |
When deploying an application into the Red Hat OpenShift Service Mesh you must opt in to injection by specifying the sidecar.istio.io/inject
annotation with a value of "true"
. Opting in ensures that the sidecar injection does not interfere with other OpenShift features such as builder pods used by numerous frameworks within the OpenShift ecosystem.
Identify the deployments for which you want to enable automatic sidecar injection.
Locate the application’s YAML configuration file.
Open the application’s configuration YAML file in an editor.
Add sidecar.istio.io/inject
to the configuration YAML with a value of "true"
as illustrated here:
apiVersion: extensions/v1
kind: Deployment
metadata:
name: sleep
spec:
replicas: 1
template:
metadata:
annotations:
sidecar.istio.io/inject: "true"
labels:
app: sleep
spec:
containers:
- name: sleep
image: tutum/curl
command: ["/bin/sleep","infinity"]
imagePullPolicy: IfNotPresent
Save the configuration file.
In previous versions of Red Hat OpenShift Service Mesh, Mixer’s policy enforcement was enabled by default. Mixer policy enforcement is now disabled by default. You must enable it before running policy tasks.
Access to the OpenShift Container Platform Command-line Interface (cli) also known as oc
.
Log in to the OpenShift Container Platform cli.
Run this command to check the current Mixer policy enforcement status:
$ oc get cm -n istio-system istio -o jsonpath='{.data.mesh}' | grep disablePolicyChecks
If disablePolicyChecks: true
, edit the Service Mesh ConfigMap:
$ oc edit cm -n istio-system istio
Locate disablePolicyChecks: true
within the ConfigMap and change the value to false
.
Save the configuration and exit the editor.
Re-check the Mixer policy enforcement status to ensure it is set to false
.
Service Mesh creates network policies in the control plane and member namespaces to whitelist traffic between them. Before you deploy, consider the following conditions to ensure the services in your mesh that were previously exposed through an OpenShift Container Platform route.
Traffic into the mesh must always go through the ingress-gateway for Istio to work properly.
Deploy services external to the mesh in separate namespaces that are not in any mesh.
Non-mesh services that need to be deployed within a service mesh enlisted namespace should label their deployments maistra.io/expose-route: "true"
, which ensures OpenShift Container Platform routes to these services still work.
Deploy Bookinfo on Red Hat OpenShift Service Mesh.