Chapter 3. Service Mesh 1.x

Procedure

1. To collect Red Hat OpenShift Service Mesh data with must-gather, you must specify the Red Hat OpenShift Service Mesh image.

   $ oc adm must-gather --image=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel8:2.6

2. To collect Red Hat OpenShift Service Mesh data for a specific Service Mesh control plane namespace with must-gather, you must specify the Red Hat OpenShift Service Mesh image and namespace. In this example, after gather, replace <namespace> with your Service Mesh control plane namespace, such as istio-system.

   $ oc adm must-gather --image=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel8:2.6 gather <namespace>

   This creates a local directory that contains the following items:

   • The Istio Operator namespace and its child objects
   • All control plane namespaces and their children objects
   • All namespaces and their children objects that belong to any service mesh
   • All Istio custom resource definitions (CRD)
   • All Istio CRD objects, such as VirtualServices, in a given namespace
   • All Istio webhooks

Procedure

1. Log in to the OpenShift Container Platform web console as a user with the cluster-admin role.

2. Create a project named istio-system.

   1. Navigate to Home Projects.
   2. Click Create Project.
   3. Enter istio-system in the Name field.
   4. Click Create.
3. Navigate to Operators Installed Operators.
4. If necessary, select istio-system from the Project menu. You may have to wait a few moments for the Operators to be copied to the new project.

5. Click the Red Hat OpenShift Service Mesh Operator. Under Provided APIs, the Operator provides links to create two resource types:

   • A ServiceMeshControlPlane resource
   • A ServiceMeshMemberRoll resource
6. Under Istio Service Mesh Control Plane click Create ServiceMeshControlPlane.

7. On the Create Service Mesh Control Plane page, modify the YAML for the default ServiceMeshControlPlane template as needed.

   Note

   For additional information about customizing the control plane, see customizing the Red Hat OpenShift Service Mesh installation. For production, you must change the default Jaeger template.

8. Click Create to create the control plane. The Operator creates pods, services, and Service Mesh control plane components based on your configuration parameters.
9. Click the Istio Service Mesh Control Plane tab.
10. Click the name of the new control plane.
11. Click the Resources tab to see the Red Hat OpenShift Service Mesh control plane resources the Operator created and configured.

Procedure

1. Log in to the OpenShift Container Platform CLI as a user with the cluster-admin role.

   $ oc login --username=<NAMEOFUSER> https://<HOSTNAME>:6443

2. Create a project named istio-system.

   $ oc new-project istio-system

3. Create a ServiceMeshControlPlane file named istio-installation.yaml using the example found in "Customize the Red Hat OpenShift Service Mesh installation". You can customize the values as needed to match your use case. For production deployments you must change the default Jaeger template.

4. Run the following command to deploy the control plane:

   $ oc create -n istio-system -f istio-installation.yaml

5. Execute the following command to see the status of the control plane installation.

   $ oc get smcp -n istio-system

   The installation has finished successfully when the STATUS column is ComponentsReady.

   NAME            READY   STATUS            PROFILES      VERSION   AGE
   basic-install   11/11   ComponentsReady   ["default"]   v1.1.18   4m25s

6. Run the following command to watch the progress of the Pods during the installation process:

   $ oc get pods -n istio-system -w

   You should see output similar to the following:

   Example output

   NAME                                     READY   STATUS             RESTARTS   AGE
   grafana-7bf5764d9d-2b2f6                 2/2     Running            0          28h
   istio-citadel-576b9c5bbd-z84z4           1/1     Running            0          28h
   istio-egressgateway-5476bc4656-r4zdv     1/1     Running            0          28h
   istio-galley-7d57b47bb7-lqdxv            1/1     Running            0          28h
   istio-ingressgateway-dbb8f7f46-ct6n5     1/1     Running            0          28h
   istio-pilot-546bf69578-ccg5x             2/2     Running            0          28h
   istio-policy-77fd498655-7pvjw            2/2     Running            0          28h
   istio-sidecar-injector-df45bd899-ctxdt   1/1     Running            0          28h
   istio-telemetry-66f697d6d5-cj28l         2/2     Running            0          28h
   jaeger-896945cbc-7lqrr                   2/2     Running            0          11h
   kiali-78d9c5b87c-snjzh                   1/1     Running            0          22h
   prometheus-6dff867c97-gr2n5              2/2     Running            0          28h

Procedure

1. Log in to the OpenShift Container Platform web console.

2. If you do not already have services for your mesh, or you are starting from scratch, create a project for your applications. It must be different from the project where you installed the Service Mesh control plane.

   1. Navigate to Home Projects.
   2. Enter a name in the Name field.
   3. Click Create.
3. Navigate to Operators Installed Operators.
4. Click the Project menu and choose the project where your ServiceMeshControlPlane resource is deployed from the list, for example istio-system.
5. Click the Red Hat OpenShift Service Mesh Operator.
6. Click the Istio Service Mesh Member Roll tab.
7. Click Create ServiceMeshMemberRoll
8. Click Members, then enter the name of your project in the Value field. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.
9. Click Create.

Procedure

1. Log in to the OpenShift Container Platform CLI.

   $ oc login --username=<NAMEOFUSER> https://<HOSTNAME>:6443

2. If you do not already have services for your mesh, or you are starting from scratch, create a project for your applications. It must be different from the project where you installed the Service Mesh control plane.

   $ oc new-project <your-project>

3. To add your projects as members, modify the following example YAML. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource. In this example, istio-system is the name of the Service Mesh control plane project.

   Example servicemeshmemberroll-default.yaml

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system
   spec:
     members:
       # a list of projects joined into the service mesh
       - your-project-name
       - another-project-name

4. Run the following command to upload and create the ServiceMeshMemberRoll resource in the istio-system namespace.

   $ oc create -n istio-system -f servicemeshmemberroll-default.yaml

5. Run the following command to verify the ServiceMeshMemberRoll was created successfully.

   $ oc get smmr -n istio-system default

   The installation has finished successfully when the STATUS column is Configured.

Procedure

1. Log in to the OpenShift Container Platform web console.
2. Navigate to Operators Installed Operators.
3. Click the Project menu and choose the project where your ServiceMeshControlPlane resource is deployed from the list, for example istio-system.
4. Click the Red Hat OpenShift Service Mesh Operator.
5. Click the Istio Service Mesh Member Roll tab.
6. Click the default link.
7. Click the YAML tab.
8. Modify the YAML to add or remove projects as members. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.
9. Click Save.
10. Click Reload.

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Edit the ServiceMeshMemberRoll resource.

   $ oc edit smmr -n <controlplane-namespace>

3. Modify the YAML to add or remove projects as members. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.

   Example servicemeshmemberroll-default.yaml

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system #control plane project
   spec:
     members:
       # a list of projects joined into the service mesh
       - your-project-name
       - another-project-name

1. Create a secret cacert that includes the input files ca-cert.pem, ca-key.pem, root-cert.pem and cert-chain.pem.

   $ oc create secret generic cacerts -n istio-system --from-file=<path>/ca-cert.pem \
       --from-file=<path>/ca-key.pem --from-file=<path>/root-cert.pem \
       --from-file=<path>/cert-chain.pem

2. In the ServiceMeshControlPlane resource set global.mtls.enabled to true and security.selfSigned set to false. Service Mesh reads the certificates and key from the secret-mount files.

   apiVersion: maistra.io/v1
   kind: ServiceMeshControlPlane
   spec:
     istio:
       global:
         mtls:
           enabled: true
       security:
         selfSigned: false

3. To make sure the workloads add the new certificates promptly, delete the secrets generated by Service Mesh, named istio.*. In this example, istio.default. Service Mesh issues new certificates for the workloads.

   $ oc delete secret istio.default

1. Store the pod name in the variable RATINGSPOD.

   $ RATINGSPOD=`oc get pods -l app=ratings -o jsonpath='{.items[0].metadata.name}'`

2. Run the following commands to retrieve the certificates mounted on the proxy.

   $ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/root-cert.pem > /tmp/pod-root-cert.pem

   The file /tmp/pod-root-cert.pem contains the root certificate propagated to the pod.

   $ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/cert-chain.pem > /tmp/pod-cert-chain.pem

   The file /tmp/pod-cert-chain.pem contains the workload certificate and the CA certificate propagated to the pod.

3. Verify the root certificate is the same as the one specified by the Operator. Replace <path> with the path to your certificates.

   $ openssl x509 -in <path>/root-cert.pem -text -noout > /tmp/root-cert.crt.txt

   $ openssl x509 -in /tmp/pod-root-cert.pem -text -noout > /tmp/pod-root-cert.crt.txt

   $ diff /tmp/root-cert.crt.txt /tmp/pod-root-cert.crt.txt

   Expect the output to be empty.

4. Verify the CA certificate is the same as the one specified by Operator. Replace <path> with the path to your certificates.

   $ sed '0,/^-----END CERTIFICATE-----/d' /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-ca.pem

   $ openssl x509 -in <path>/ca-cert.pem -text -noout > /tmp/ca-cert.crt.txt

   $ openssl x509 -in /tmp/pod-cert-chain-ca.pem -text -noout > /tmp/pod-cert-chain-ca.crt.txt

   $ diff /tmp/ca-cert.crt.txt /tmp/pod-cert-chain-ca.crt.txt

   Expect the output to be empty.

5. Verify the certificate chain from the root certificate to the workload certificate. Replace <path> with the path to your certificates.

   $ head -n 21 /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-workload.pem

   $ openssl verify -CAfile <(cat <path>/ca-cert.pem <path>/root-cert.pem) /tmp/pod-cert-chain-workload.pem

   Example output

   /tmp/pod-cert-chain-workload.pem: OK

1. Remove the secret cacerts.

   $ oc delete secret cacerts -n istio-system

2. Redeploy Service Mesh with a self-signed root certificate in the ServiceMeshControlPlane resource.

   apiVersion: maistra.io/v1
   kind: ServiceMeshControlPlane
   spec:
     istio:
       global:
         mtls:
           enabled: true
       security:
         selfSigned: true

1. In the ServiceMeshControlPlane resource, add the ior_enabled parameter and set it to true. For example, see the following resource snippet:

Procedure

1. Create a YAML file using the following example to route requests to different versions of the Bookinfo sample application service depending on which user connects to the application.

   Example VirtualService.yaml

   apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
     name: reviews
   spec:
     hosts:
     - reviews
     http:
     - match:
       - headers:
           end-user:
             exact: jason
       route:
       - destination:
           host: reviews
           subset: v2
     - route:
       - destination:
           host: reviews
           subset: v3

2. Run the following command to apply VirtualService.yaml, where VirtualService.yaml is the path to the file.

   $ oc apply -f <VirtualService.yaml>

Procedure

1. Apply the virtual services.

   $ oc apply -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/virtual-service-all-v1.yaml

2. To verify that you applied the virtual services, display the defined routes with the following command:

   $ oc get virtualservices -o yaml

   That command returns a resource of kind: VirtualService in YAML format.

Procedure

1. Set the value for the GATEWAY_URL parameter. You can use this variable to find the URL for your Bookinfo product page later. In this example, istio-system is the name of the control plane project.

   export GATEWAY_URL=$(oc -n istio-system get route istio-ingressgateway -o jsonpath='{.spec.host}')

2. Run the following command to retrieve the URL for the product page.

   echo "http://$GATEWAY_URL/productpage"

3. Open the Bookinfo site in your browser.

Procedure

1. Run the following command to enable user-based routing in the Bookinfo sample application.

   $ oc apply -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/virtual-service-reviews-test-v2.yaml

2. Run the following command to confirm the rule is created. This command returns all resources of kind: VirtualService in YAML format.

   $ oc get virtualservice reviews -o yaml

3. On the /productpage of the Bookinfo app, log in as user jason with no password.
4. Refresh the browser. The star ratings appear next to each review.
5. Log in as another user (pick any name you want). Refresh the browser. Now the stars are gone. Traffic is now routed to reviews:v1 for all users except Jason.

Procedure

1. Log in to the OpenShift Container Platform CLI as a cluster administrator.

2. From the CLI, run this command to create the ConfigMap named smcp-templates in the openshift-operators project and replace <templates-directory> with the location of the ServiceMeshControlPlane files on your local disk:

   $ oc create configmap --from-file=<templates-directory> smcp-templates -n openshift-operators

3. Locate the Operator ClusterServiceVersion name.

   $ oc get clusterserviceversion -n openshift-operators | grep 'Service Mesh'

   Example output

   maistra.v1.0.0            Red Hat OpenShift Service Mesh   1.0.0                Succeeded

4. Edit the Operator cluster service version to instruct the Operator to use the smcp-templates ConfigMap.

   $ oc edit clusterserviceversion -n openshift-operators maistra.v1.0.0

5. Add a volume mount and volume to the Operator deployment.

   deployments:
     - name: istio-operator
       spec:
         template:
           spec:
             containers:
               volumeMounts:
                 - name: discovery-cache
                   mountPath: /home/istio-operator/.kube/cache/discovery
                 - name: smcp-templates
                   mountPath: /usr/local/share/istio-operator/templates/
             volumes:
               - name: discovery-cache
                 emptyDir:
                   medium: Memory
               - name: smcp-templates
                 configMap:
                   name: smcp-templates
   ...

6. Save your changes and exit the editor.

7. You can now use the template parameter in the ServiceMeshControlPlane to specify a template.

   apiVersion: maistra.io/v1
   kind: ServiceMeshControlPlane
   metadata:
     name: minimal-install
   spec:
     template: default

Procedure

1. Click Home Projects.
2. Click Create Project.

3. Enter bookinfo as the Project Name, enter a Display Name, and enter a Description, then click Create.

   • Alternatively, you can run this command from the CLI to create the bookinfo project.

     $ oc new-project bookinfo

4. Click Operators Installed Operators.
5. Click the Project menu and use the Service Mesh control plane namespace. In this example, use istio-system.
6. Click the Red Hat OpenShift Service Mesh Operator.

7. Click the Istio Service Mesh Member Roll tab.

   1. If you have already created a Istio Service Mesh Member Roll, click the name, then click the YAML tab to open the YAML editor.
   2. If you have not created a ServiceMeshMemberRoll, click Create ServiceMeshMemberRoll.
8. Click Members, then enter the name of your project in the Value field.

9. Click Create to save the updated Service Mesh Member Roll.

   1. Or, save the following example to a YAML file.

      Bookinfo ServiceMeshMemberRoll example servicemeshmemberroll-default.yaml

      apiVersion: maistra.io/v1
      kind: ServiceMeshMemberRoll
      metadata:
        name: default
      spec:
        members:
        - bookinfo

   2. Run the following command to upload that file and create the ServiceMeshMemberRoll resource in the istio-system namespace. In this example, istio-system is the name of the Service Mesh control plane project.

      $ oc create -n istio-system -f servicemeshmemberroll-default.yaml

10. Run the following command to verify the ServiceMeshMemberRoll was created successfully.

    $ oc get smmr -n istio-system -o wide

    The installation has finished successfully when the STATUS column is Configured.

    NAME      READY   STATUS       AGE   MEMBERS
    default   1/1     Configured   70s   ["bookinfo"]

11. From the CLI, deploy the Bookinfo application in the `bookinfo` project by applying the bookinfo.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/platform/kube/bookinfo.yaml

    You should see output similar to the following:

    service/details created
    serviceaccount/bookinfo-details created
    deployment.apps/details-v1 created
    service/ratings created
    serviceaccount/bookinfo-ratings created
    deployment.apps/ratings-v1 created
    service/reviews created
    serviceaccount/bookinfo-reviews created
    deployment.apps/reviews-v1 created
    deployment.apps/reviews-v2 created
    deployment.apps/reviews-v3 created
    service/productpage created
    serviceaccount/bookinfo-productpage created
    deployment.apps/productpage-v1 created

12. Create the ingress gateway by applying the bookinfo-gateway.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/bookinfo-gateway.yaml

    You should see output similar to the following:

    gateway.networking.istio.io/bookinfo-gateway created
    virtualservice.networking.istio.io/bookinfo created

13. Set the value for the GATEWAY_URL parameter:

    $ export GATEWAY_URL=$(oc -n istio-system get route istio-ingressgateway -o jsonpath='{.spec.host}')

Procedure

1. To add destination rules, run one of the following commands:

   • If you did not enable mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/destination-rule-all.yaml

   • If you enabled mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/destination-rule-all-mtls.yaml

     You should see output similar to the following:

     destinationrule.networking.istio.io/productpage created
     destinationrule.networking.istio.io/reviews created
     destinationrule.networking.istio.io/ratings created
     destinationrule.networking.istio.io/details created

Procedure from CLI

1. Verify that all pods are ready with this command:

   $ oc get pods -n bookinfo

   All pods should have a status of Running. You should see output similar to the following:

   NAME                              READY   STATUS    RESTARTS   AGE
   details-v1-55b869668-jh7hb        2/2     Running   0          12m
   productpage-v1-6fc77ff794-nsl8r   2/2     Running   0          12m
   ratings-v1-7d7d8d8b56-55scn       2/2     Running   0          12m
   reviews-v1-868597db96-bdxgq       2/2     Running   0          12m
   reviews-v2-5b64f47978-cvssp       2/2     Running   0          12m
   reviews-v3-6dfd49b55b-vcwpf       2/2     Running   0          12m

2. Run the following command to retrieve the URL for the product page:

   echo "http://$GATEWAY_URL/productpage"

3. Copy and paste the output in a web browser to verify the Bookinfo product page is deployed.

Procedure from Kiali web console

1. Obtain the address for the Kiali web console.

   1. Log in to the OpenShift Container Platform web console.
   2. Navigate to Networking Routes.

   3. On the Routes page, select the Service Mesh control plane project, for example istio-system, from the Namespace menu.

      The Location column displays the linked address for each route.

   4. Click the link in the Location column for Kiali.
   5. Click Log In With OpenShift. The Kiali Overview screen presents tiles for each project namespace.
2. In Kiali, click Graph.
3. Select bookinfo from the Namespace list, and App graph from the Graph Type list.

4. Click Display idle nodes from the Display menu.

   This displays nodes that are defined but have not received or sent requests. It can confirm that an application is properly defined, but that no request traffic has been reported.

   
   • Use the Duration menu to increase the time period to help ensure older traffic is captured.
   • Use the Refresh Rate menu to refresh traffic more or less often, or not at all.
5. Click Services, Workloads or Istio Config to see list views of bookinfo components, and confirm that they are healthy.

Procedure

1. Launch the Kiali console.
2. Click Log In With OpenShift.
3. In Kiali console, click Graph to view a namespace graph.
4. From the Namespace menu, select your application namespace, for example, bookinfo.

5. To choose a different graph layout, do either or both of the following:

   • Select different graph data groupings from the menu at the top of the graph.

     • App graph
     • Service graph
     • Versioned App graph (default)
     • Workload graph

   • Select a different graph layout from the Legend at the bottom of the graph.

     • Layout default dagre
     • Layout 1 cose-bilkent
     • Layout 2 cola

Procedure

1. Log in to the OpenShift Container Platform web console as a user with the cluster-admin role.
2. Navigate to Operators Installed Operators.
3. Click the Red Hat OpenShift Service Mesh Operator.
4. Click the Istio Service Mesh Control Plane tab.
5. Click the name of your control plane file, for example, basic-install.
6. Click the YAML tab.
7. Edit the Jaeger parameters, replacing the default all-in-one template with parameters for the production-elasticsearch template, modified for your use case. Ensure that the indentation is correct.
8. Click Save.
9. Click Reload. OpenShift Container Platform redeploys Jaeger and creates the Elasticsearch resources based on the specified parameters.

Procedure

1. Log in to the OpenShift Container Platform web console as a user with the cluster-admin role.
2. Navigate to Operators Installed Operators.
3. Click the Red Hat OpenShift Service Mesh Operator.
4. Click the Istio Service Mesh Control Plane tab.
5. Click the name of your control plane file, for example, basic-install.
6. Click the YAML tab.
7. Edit the Jaeger parameters, replacing the default all-in-one template with parameters for the production-elasticsearch template, modified for your use case. Ensure that the indentation is correct.
8. Click Save.
9. Click Reload. OpenShift Container Platform redeploys Jaeger and creates the Elasticsearch resources based on the specified parameters.

1. Run this command to generate manifests from a deployed adapter in the istio-system namespace:

   $ export NS="istio-system" URL="https://replaceme-admin.3scale.net:443" NAME="name" TOKEN="token"
   oc exec -n ${NS} $(oc get po -n ${NS} -o jsonpath='{.items[?(@.metadata.labels.app=="3scale-istio-adapter")].metadata.name}') \
   -it -- ./3scale-config-gen \
   --url ${URL} --name ${NAME} --token ${TOKEN} -n ${NS}

2. This will produce sample output to the terminal. Edit these samples if required and create the objects using the oc create command.

3. When the request reaches the adapter, the adapter needs to know how the service maps to an API on 3scale. You can provide this information in two ways:

   1. Label the workload (recommended)
   2. Hard code the handler as service_id

4. Update the workload with the required annotations:

   Note

   You only need to update the service ID provided in this example if it is not already embedded in the handler. The setting in the handler takes precedence.

   $ export CREDENTIALS_NAME="replace-me"
   export SERVICE_ID="replace-me"
   export DEPLOYMENT="replace-me"
   patch="$(oc get deployment "${DEPLOYMENT}"
   patch="$(oc get deployment "${DEPLOYMENT}" --template='{"spec":{"template":{"metadata":{"labels":{ {{ range $k,$v := .spec.template.metadata.labels }}"{{ $k }}":"{{ $v }}",{{ end }}"service-mesh.3scale.net/service-id":"'"${SERVICE_ID}"'","service-mesh.3scale.net/credentials":"'"${CREDENTIALS_NAME}"'"}}}}}' )"
   oc patch deployment "${DEPLOYMENT}" --patch ''"${patch}"''

Procedure

1. Match the rule destination.labels["service-mesh.3scale.net/credentials"] == "threescale" that you previously created in the configuration, in the kind: rule resource.
2. Add the above label to PodTemplateSpec on the Deployment of the target workload to integrate a service. the value, threescale, refers to the name of the generated handler. This handler stores the access token required to call 3scale.
3. Add the destination.labels["service-mesh.3scale.net/service-id"] == "replace-me" label to the workload to pass the service ID to the adapter via the instance at request time.

Procedure

1. Log in to the OpenShift Container Platform web console.
2. Click the Project menu and select the project where you installed the Service Mesh control plane, for example istio-system.
3. Navigate to Operators Installed Operators.
4. Click Service Mesh Control Plane under Provided APIs.
5. Click the ServiceMeshControlPlane menu .
6. Click Delete Service Mesh Control Plane.
7. Click Delete on the confirmation dialog window to remove the ServiceMeshControlPlane.

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Run the following command to delete the ServiceMeshMemberRoll resource.

   $ oc delete smmr -n istio-system default

3. Run this command to retrieve the name of the installed ServiceMeshControlPlane:

   $ oc get smcp -n istio-system

4. Replace <name_of_custom_resource> with the output from the previous command, and run this command to remove the custom resource:

   $ oc delete smcp -n istio-system <name_of_custom_resource>

Procedure

1. Log in to the OpenShift Container Platform web console.
2. From the Operators Installed Operators page, scroll or type a keyword into the Filter by name to find each Operator. Then, click the Operator name.
3. On the Operator Details page, select Uninstall Operator from the Actions menu. Follow the prompts to uninstall each Operator.

Procedure

1. Log in to the OpenShift Container Platform CLI as a cluster administrator.

2. Run the following commands to clean up resources after uninstalling the Operators. If you intend to keep using Jaeger as a stand alone service without service mesh, do not delete the Jaeger resources.

   Note

   The Operators are installed in the openshift-operators namespace by default. If you installed the Operators in another namespace, replace openshift-operators with the name of the project where the Red Hat OpenShift Service Mesh Operator was installed.

   $ oc delete validatingwebhookconfiguration/openshift-operators.servicemesh-resources.maistra.io

   $ oc delete mutatingwebhookconfiguration/openshift-operators.servicemesh-resources.maistra.io

   $ oc delete -n openshift-operators daemonset/istio-node

   $ oc delete clusterrole/istio-admin clusterrole/istio-cni clusterrolebinding/istio-cni

   $ oc delete clusterrole istio-view istio-edit

   $ oc delete clusterrole jaegers.jaegertracing.io-v1-admin jaegers.jaegertracing.io-v1-crdview jaegers.jaegertracing.io-v1-edit jaegers.jaegertracing.io-v1-view

   $ oc get crds -o name | grep '.*\.istio\.io' | xargs -r -n 1 oc delete

   $ oc get crds -o name | grep '.*\.maistra\.io' | xargs -r -n 1 oc delete

   $ oc get crds -o name | grep '.*\.kiali\.io' | xargs -r -n 1 oc delete

   $ oc delete crds jaegers.jaegertracing.io

   $ oc delete svc admission-controller -n <operator-project>

   $ oc delete project <istio-system-project>