This is a cache of https://docs.openshift.com/container-platform/4.5/serverless/networking/serverless-ossm.html. It is a snapshot of the page at 2024-11-23T00:58:12.778+0000.
Using <strong>service</strong> Mesh with OpenShift Serverless - Networking | Serverless | OpenShift Container Platform 4.5
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Using service Mesh with OpenShift Serverless

Using service Mesh with OpenShift Serverless enables developers to configure additional networking and routing options that are not supported when using OpenShift Serverless with the default Kourier implementation. These options include setting custom domains, using TLS certificates, and using JSON Web Token authentication.

Prerequisites

  1. Install the OpenShift Serverless Operator and Knative Serving.

  2. Install Red Hat OpenShift service Mesh.

Procedure

  1. Add the default namespace to the serviceMeshMemberRoll as a member:

    apiVersion: maistra.io/v1
kind: serviceMeshMemberRoll
metadata:
  name: default
  namespace: istio-system
spec:
  members:
    - default

    Adding sidecar injection to Pods in system namespaces such as knative-serving and knative-serving-ingress is not supported.

  2. Create a network policy that permits traffic flow from Knative system pods to Knative services:

    1. Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving namespace:

      $ oc label namespace knative-serving serving.knative.openshift.io/system-namespace=true

    2. Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving-ingress namespace:

      $ oc label namespace knative-serving-ingress serving.knative.openshift.io/system-namespace=true

    3. Copy the following NetworkPolicy resource into a YAML file:

      apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-serving-system-namespace
  namespace: default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          serving.knative.openshift.io/system-namespace: "true"
  podSelector: {}
  policyTypes:
  - Ingress

    4. Apply the NetworkPolicy resource:

      $ oc apply -f <filename>

Enabling sidecar injection for a Knative service

You can add an annotation to the service resource YAML file to enable sidecar injection for a Knative service.

Procedure

  1. Add the sidecar.istio.io/inject="true" annotation to the service resource:

    apiVersion: serving.knative.dev/v1
kind: service
metadata:
  name: hello-example-1
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true" (1)
    spec:
      containers:
      - image: docker.io/openshift/hello-openshift
        name: container
    1 Add the sidecar.istio.io/inject="true" annotation.

  2. Apply the service resource YAML file:

    $ oc apply -f <filename>

Additional resources