service Mesh Release Notes

The Kiali observability console is only supported on the two most recent releases of the Chrome, Edge, Firefox, or Safari browsers.

This release only supports the following Mixer adapter:

Traffic Management - Control the flow of traffic and API calls between services, make calls more reliable, and make the network more robust in the face of adverse conditions.

service Identity and Security - Provide services in the mesh with a verifiable identity and provide the ability to protect service traffic as it flows over networks of varying degrees of trustworthiness.

Policy Enforcement - Apply organizational policy to the interaction between services, ensure access policies are enforced and resources are fairly distributed among consumers. Policy changes are made by configuring the mesh, not by changing application code.

Telemetry - Gain understanding of the dependencies between services and the nature and flow of traffic between them, providing the ability to quickly identify issues.

The Kubernetes Container Network Interface (CNI) plug-in is always on.

The control plane is configured for multitenancy by default. Single tenant, cluster-wide control plane configurations are deprecated.

The Elasticsearch, Jaeger, Kiali, and service Mesh Operators are installed from OperatorHub.

You can create and specify control plane templates.

Automatic route creation was removed from this release.

Maistra-1502 As a result of CVEs fixes in version 1.0.10, the Istio dashboards are not available from the Home Dashboard menu in Grafana. The Istio dashboards still exist. To access them, click the Dashboard menu in the navigation panel and select the Manage tab.

Bug 1821432 Toggle controls in OpenShift Container Platform Control Resource details page do not update the CR correctly. UI Toggle controls in the service Mesh Control Plane (SMCP) Overview page in the OpenShift Container Platform web console sometimes update the wrong field in the resource. To update a SMCP, edit the YAML content directly or update the resource from the command line instead of clicking the toggle controls.

Jaeger/Kiali Operator upgrade blocked with operator pending When upgrading the Jaeger or Kiali Operators with service Mesh 1.0.x installed, the operator status shows as Pending. There is a solution in progress and a workaround. See the linked Knowledge Base article for more information.

Istio-14743 Due to limitations in the version of Istio that this release of Red Hat OpenShift service Mesh is based on, there are several applications that are currently incompatible with service Mesh. See the linked community issue for details.

MAISTRA-858 The following Envoy log messages describing deprecated options and configurations associated with Istio 1.1.x are expected:

MAISTRA-806 Evicted Istio Operator Pod causes mesh and CNI not to deploy.

MAISTRA-681 When the control plane has many namespaces, it can lead to performance issues.

MAISTRA-465 The Maistra Operator fails to create a service for operator metrics.

MAISTRA-453 If you create a new project and deploy pods immediately, sidecar injection does not occur. The operator fails to add the maistra.io/member-of before the pods are created, therefore the pods must be deleted and recreated for sidecar injection to occur.

MAISTRA-193 Unexpected console info messages are visible when health checking is enabled for citadel.

MAISTRA-158 Applying multiple gateways referencing the same hostname will cause all gateways to stop functioning.

KIALI-2206 When you are accessing the Kiali console for the first time, and there is no cached browser data for Kiali, the “View in Grafana” link on the Metrics tab of the Kiali service Details page redirects to the wrong location. The only way you would encounter this issue is if you are accessing Kiali for the first time.

KIALI-507 Kiali does not support Internet Explorer 11. This is because the underlying frameworks do not support Internet Explorer. To access the Kiali console, use one of the two most recent versions of the Chrome, Edge, Firefox or Safari browser.

MAISTRA-1352 Cert-manager Custom Resource Definitions (CRD) from the control plane installation have been removed for this release and future releases. If you have already installed Red Hat OpenShift service Mesh, the CRDs must be removed manually if cert-manager is not being used.

$ oc delete crd clusterissuers.certmanager.k8s.io
$ oc delete crd issuers.certmanager.k8s.io
$ oc delete crd certificates.certmanager.k8s.io
$ oc delete crd orders.certmanager.k8s.io
$ oc delete crd challenges.certmanager.k8s.io

TRACING-1208 Authentication "500 Internal Error" when accessing Jaeger UI. When trying to authenticate to the UI using OAuth, I get a 500 error because oauth-proxy sidecar doesn’t trust the custom CA bundle defined at installation time with the additionalTrustBundle.

OSSM-99 Workloads generated from direct Pod without labels may crash Kiali.

OSSM-93 IstioConfigList can’t filter by two or more names.

OSSM-92 Cancelling unsaved changes on the VS/DR YAML edit page does not cancel the changes.

OSSM-90 Traces not available on the service details page.

MAISTRA-1001 Closing HTTP/2 connections could lead to segmentation faults in istio-proxy.

MAISTRA-932 Added the requires metadata to add dependency relationship between Jaeger operator and Elasticsearch operator. Ensures that when the Jaeger operator is installed, it automatically deploys the Elasticsearch operator if it is not available.

MAISTRA-862 Galley dropped watches and stopped providing configuration to other components after many namespace deletions and re-creations.

MAISTRA-833 Pilot stopped delivering configuration after many namespace deletions and re-creations.

MAISTRA-684 The default Jaeger version in the istio-operator is 1.12.0, which does not match Jaeger version 1.13.1 that shipped in Red Hat OpenShift service Mesh 0.12.TechPreview.

MAISTRA-622 In Maistra 0.12.0/TP12, permissive mode does not work. The user has the option to use Plain text mode or Mutual TLS mode, but not permissive.

MAISTRA-572 Jaeger cannot be used with Kiali. In this release Jaeger is configured to use the OAuth proxy, but is also only configured to work through a browser and does not allow service access. Kiali cannot properly communicate with the Jaeger endpoint and it considers Jaeger to be disabled. See also TRACING-591.

MAISTRA-357 In OpenShift 4 Beta on AWS, it is not possible, by default, to access a TCP or HTTPS service through the ingress gateway on a port other than port 80. The AWS load balancer has a health check that verifies if port 80 on the service endpoint is active. Without a service running on port 80, the load balancer health check fails.

MAISTRA-348 OpenShift 4 Beta on AWS does not support ingress gateway traffic on ports other than 80 or 443. If you configure your ingress gateway to handle TCP traffic with a port number other than 80 or 443, you have to use the service hostname provided by the AWS load balancer rather than the OpenShift router as a workaround.

KIALI-3239 If a Kiali Operator pod has failed with a status of “Evicted” it blocks the Kiali operator from deploying. The workaround is to delete the Evicted pod and redeploy the Kiali operator.

KIALI-3118 After changes to the serviceMeshMemberRoll, for example adding or removing projects, the Kiali pod restarts and then displays errors on the Graph page while the Kiali pod is restarting.

KIALI-3096 Runtime metrics fail in service Mesh. There is an OAuth filter between the service Mesh and Prometheus, requiring a bearer token to be passed to Prometheus before access is granted. Kiali has been updated to use this token when communicating to the Prometheus server, but the application metrics are currently failing with 403 errors.

KIALI-3070 This bug only affects custom dashboards, not the default dashboards. When you select labels in metrics settings and refresh the page, your selections are retained in the menu but your selections are not displayed on the charts.

KIALI-2686 When the control plane has many namespaces, it can lead to performance issues.