Chapter 4. OpenShift Service Mesh and cert-manager

Procedure

1. Create the istio-system namespace by running the following command:

   $ oc create namespace istio-system

2. Create the root issuer by creating an Issuer object in a YAML file.

   1. Create an Issuer object similar to the following example:

      Note

      The selfSigned issuer serves demonstration purposes, testing, or proof-of-concept environments. For production deployments, use a secure and trusted CA.

      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: selfsigned
        namespace: istio-system
      spec:
        selfSigned: {}
      ---
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
          name: istio-ca
          namespace: istio-system
      spec:
        isCA: true
        duration: 87600h # 10 years
        secretName: istio-ca
        commonName: istio-ca
        privateKey:
          algorithm: ECDSA
          size: 256
        subject:
          organizations:
            - cluster.local
            - cert-manager
        issuerRef:
          name: selfsigned
          kind: Issuer
          group: cert-manager.io
      ---
      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: istio-ca
        namespace: istio-system
      spec:
        ca:
          secretName: istio-ca
      ---

   2. Create the objects by running the following command:

      $ oc apply -f issuer.yaml

   3. Wait for the istio-ca certificate to contain the "Ready" status condition by running the following command:

      $ oc wait --for=condition=Ready certificates/istio-ca -n istio-system

3. Copy the istio-ca certificate to the cert-manager namespace so it can be used by istio-csr:

   apiVersion: operator.openshift.io/v1alpha1
   kind: IstioCSR
   metadata:
     name: default
     namespace: istio-csr
   spec:
     istioCSRConfig:
       certManager:
         issuerRef:
           name: istio-ca
           kind: Issuer
           group: cert-manager.io
       istiodTLSConfig:
         trustDomain: cluster.local
       istio:
         namespace: istio-system

   1. Create the istio-csr agent by running the following command:

      $ oc create -f istioCSR.yaml

   2. Verify that the istio-csr deployment is ready by running the following command:

      $ oc get deployment -n istio-csr

4. Install the istio resource:

   Note

   The configuration disables the built-in CA server for Istio and forwards certificate signing requests from istiod to the istio-csr agent. The istio-csr agent obtains certificates for both istiod and mesh workloads from the cert-manager Operator. The istio-csr agent generates the istiod TLS certificate, and the system mounts it into the pod at a known location.

   1. Create the Istio object similar to the following example:

      apiVersion: sailoperator.io/v1
      kind: Istio
      metadata:
        name: default
      spec:
        version: v1.24-latest
        namespace: istio-system
        values:
          global:
            caAddress: cert-manager-istio-csr.istio-csr.svc:443
          pilot:
            env:
              ENABLE_CA_SERVER: "false"

   2. Create the Istio resource by running the following command:

      $ oc apply -f istio.yaml

   3. Verify that the istio resource displays the "Ready" status condition by running the following command:

      $ oc get -n istio-system secret istio-ca -o jsonpath='{.data.tls\.crt}' | base64 -d > ca.pem

   4. Create a secret from the local certificate file in the cert-manager namespace by running the following command:

      $ oc create secret generic -n cert-manager istio-root-ca --from-file=ca.pem=ca.pem