Using Service Mesh with OpenShift Serverless - Networking | Serverless

Enabling sidecar injection for a Knative service
Additional resources

Using Service Mesh with OpenShift Serverless enables developers to configure additional networking and routing options that are not supported when using OpenShift Serverless with the default Kourier implementation. These options include setting custom domains, using TLS certificates, and using JSON Web Token authentication.

Prerequisites

Install the OpenShift Serverless Operator and Knative Serving.
Install Red Hat OpenShift Service Mesh.

Procedure

Add the default namespace to the ServiceMeshMemberRoll as a member:
```
apiVersion: maistra.io/v1
kind: ServiceMeshMemberRoll
metadata:
  name: default
  namespace: istio-system
spec:
  members:
    - default
```
Adding sidecar injection to Pods in system namespaces such as knative-serving and knative-serving-ingress is not supported.

Create a network policy that permits traffic flow from Knative system pods to Knative services:

Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving namespace:
```
$ oc label namespace knative-serving serving.knative.openshift.io/system-namespace=true
```
Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving-ingress namespace:
```
$ oc label namespace knative-serving-ingress serving.knative.openshift.io/system-namespace=true
```

Copy the following NetworkPolicy resource into a YAML file:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-serving-system-namespace
  namespace: default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          serving.knative.openshift.io/system-namespace: "true"
  podSelector: {}
  policyTypes:
  - ingress

Apply the NetworkPolicy resource:
```
$ oc apply -f <filename>
```

Enabling sidecar injection for a Knative service

You can add an annotation to the Service resource YAML file to enable sidecar injection for a Knative service.

Procedure

Add the sidecar.istio.io/inject="true" annotation to the Service resource:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: hello-example-1
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true" (1)
    spec:
      containers:
      - image: docker.io/openshift/hello-openshift
        name: container

1	Add the `sidecar.istio.io/inject="true"` annotation.

Apply the Service resource YAML file:
```
$ oc apply -f <filename>
```

Additional resources

For more information about Red Hat OpenShift Service Mesh, see Red Hat OpenShift Service Mesh architecture.