Chapter 4. Day Two

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Run this command to check the current Mixer policy enforcement status:

   $ oc get cm -n istio-system istio -o jsonpath='{.data.mesh}' | grep disablePolicyChecks

3. If disablePolicyChecks: true, edit the Service Mesh ConfigMap:

   $ oc edit cm -n istio-system istio

4. Locate disablePolicyChecks: true within the ConfigMap and change the value to false.
5. Save the configuration and exit the editor.
6. Re-check the Mixer policy enforcement status to ensure it is set to false.

Procedure

1. Log in to the OpenShift Container Platform web console as a user with cluster-admin rights.
2. Click to Home Projects.
3. Click Create Project.

4. Enter bookinfo as the Project Name, enter a Display Name, and enter a Description, then click Create.

   • Alternatively, you can run this command from the CLI to create the bookinfo project.

     $ oc new-project bookinfo

5. Click Operators Installed Operators.
6. Click the Project menu and use the control plane namespace. In this example, use istio-system.
7. Click the Red Hat OpenShift Service Mesh Operator.

8. Click the Istio Service Mesh Member Roll link.

   1. If you have already created a Istio Service Mesh Member Roll, click the name, then click the YAML tab to open the YAML editor.

   2. If you have not created a Istio Service Mesh Member Roll, click Create Service Mesh Member Roll.

      Note

      You need cluster-admin rights to edit the Istio Service Mesh Member Roll.

9. Edit the default Service Mesh Member Roll YAML and add bookinfo to the members list.

   Bookinfo ServiceMeshMemberRoll example

     apiVersion: maistra.io/v1
     kind: ServiceMeshMemberRoll
     metadata:
       name: default
     spec:
       members:
       - bookinfo

   • Alternatively, you can run this command from the CLI to add the bookinfo project to the ServiceMeshMemberRoll. Replace <control plane project> with the name of your control plane project.

     $ oc -n <control plane project> patch --type='json' smmr default -p '[{"op": "add", "path": "/spec/members", "value":["'"bookinfo"'"]}]'

10. Click Create to save the updated Service Mesh Member Roll.

11. From the CLI, deploy the Bookinfo application in the `bookinfo` project by applying the bookinfo.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-1.1/samples/bookinfo/platform/kube/bookinfo.yaml

12. Create the ingress gateway by applying the bookinfo-gateway.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-1.1/samples/bookinfo/networking/bookinfo-gateway.yaml

13. Set the value for the GATEWAY_URL parameter:

    Note

    Replace <control_plane_project> with the name of your control plane project. In this example, the control plane project is istio-system.

    $ export GATEWAY_URL=$(oc -n <control_plane_project> get route istio-ingressgateway -o jsonpath='{.spec.host}')

Procedure

1. To add destination rules, run one of the following commands:

   • If you did not enable mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-1.1/samples/bookinfo/networking/destination-rule-all.yaml

   • If you enabled mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-1.1/samples/bookinfo/networking/destination-rule-all-mtls.yaml

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Run this command to confirm that Bookinfo is deployed:

   $ curl -o /dev/null -s -w "%{http_code}\n" http://$GATEWAY_URL/productpage

   • Alternatively, you can open http://$GATEWAY_URL/productpage in your browser.

   • You can also verify that all pods are ready with this command:

     $ oc get pods -n bookinfo

Procedure

1. After you have deployed the Bookinfo application you will need to generate calls to the Bookinfo application so that you have some trace data to analyze. Access http://<GATEWAY_URL>/productpage and refresh the page a few times to generate some trace data.

2. The installation process creates a route to access the Jaeger console.

   1. In the OpenShift Container Platform console, navigate to Networking Routes and search for the Jaeger route, which is the URL listed under Location.

   2. Use the CLI to query for details of the route:

      $ export JAEGER_URL=$(oc get route -n bookinfo jaeger-query -o jsonpath='{.spec.host}')

3. Launch a browser and navigate to https://<JAEGER_URL>.
4. If necessary, log in using the same user name and password as you use to access the OpenShift Container Platform console.

5. In the left pane of the Jaeger dashboard, from the Service menu, select "productpage" and click the Find Traces button at the bottom of the pane. A list of traces is displayed, as shown in the following image:

   

6. Click one of the traces in the list to open a detailed view of that trace. If you click on the top (most recent) trace, you see the details that correspond to the latest refresh of the `/productpage.

   

   The trace in the previous figure consists of a few nested spans, each corresponding to a Bookinfo Service call, all performed in response to a `/productpage request. Overall processing time was 2.62s, with the details Service taking 3.56ms, the reviews Service taking 2.6s, and the ratings Service taking 5.32ms. Each of the calls to remote Services is represented by a client-side and server-side span. For example, the details client-side span is labeled productpage details.myproject.svc.cluster.local:9080. The span nested underneath it, labeled details details.myproject.svc.cluster.local:9080, corresponds to the server-side processing of the request. The trace also shows calls to istio-policy, which reflect authorization checks made by Istio.

1. In the ServiceMeshControlPlane resource, add the ior_enabled parameter and set it to true. For example, see the following resource snippet: