Chapter 2. Installing OpenShift Service Mesh

Procedure

1. In the OpenShift Container Platform web console, click Home Projects.
2. Click Create Project.
3. At the prompt, enter a name for the project in the Name field. For example, istio-system. The other fields provide supplementary information to the Istio resource definition and are optional.
4. Click Create. The Service Mesh Operator deploys Istio to the project you specified.

Procedure

1. In the OpenShift Container Platform web console, click Operators Installed Operators.
2. Select istio-system in the Project drop-down menu.
3. Click the Service Mesh Operator.
4. Click Istio.
5. Click Create Istio.
6. Select the istio-system project from the Namespace drop-down menu.

7. Click Create. This action deploys the Istio control plane.

   When State: Healthy appears in the Status column, Istio is successfully deployed.

Procedure

1. In the OpenShift Container Platform web console, click Home Projects.
2. Click Create Project.
3. At the prompt, you must enter a name for the project in the Name field. For example, istio-cni. The other fields provide supplementary information and are optional.
4. Click Create.

Procedure

1. In the OpenShift Container Platform web console, click Operators Installed Operators.
2. Select istio-cni in the Project drop-down menu.
3. Click the Service Mesh Operator.
4. Click IstioCNI.
5. Click Create IstioCNI.
6. Ensure that the name is default.

7. Click Create. This action deploys the Istio CNI plugin.

   When State: Healthy appears in the Status column, the Istio CNI plugin is successfully deployed.

Procedure

1. Add a label to the namespace containing the Istio control plane, for example, the istio-system system namespace.

   $ oc label namespace istio-system istio-discovery=enabled

   Copy to Clipboard Toggle word wrap

2. Modify the Istio control plane resource to include a discoverySelectors section with the same label.

   kind: Istio
   apiVersion: sailoperator.io/v1
   metadata:
     name: default
   spec:
     namespace: istio-system
     values:
       meshConfig:
         discoverySelectors:
           - matchLabels:
               istio-discovery: enabled

   Copy to Clipboard Toggle word wrap

3. Apply the Istio CR:

   $ oc apply -f istio.yaml

   Copy to Clipboard Toggle word wrap
4. Ensure that all namespaces that will contain workloads that are to be part of the Service Mesh have both the discoverySelector label and, if needed, the appropriate Istio injection label.

Procedure

1. In the OpenShift Container Platform web console, navigate to the Home Projects page.
2. Click Create Project.

3. Enter bookinfo in the Project name field.

   The Display name and Description fields provide supplementary information and are not required.

4. Click Create.

5. Apply the Istio discovery selector and injection label to the bookinfo namespace by entering the following command:

   $ oc label namespace bookinfo istio-discovery=enabled istio-injection=enabled

   Copy to Clipboard Toggle word wrap
   Note

   In this example, the name of the Istio resource is default. If the Istio resource name is different, you must set the istio.io/rev label to the name of the Istio resource instead of adding the istio-injection=enabled label.

6. Apply the bookinfo YAML file to deploy the bookinfo application by entering the following command:

   oc apply -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.24/samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the bookinfo service is available by running the following command:

   $ oc get services -n bookinfo

   Copy to Clipboard Toggle word wrap

   Example output

   NAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
   details       ClusterIP   172.30.137.21   <none>        9080/TCP   44s
   productpage   ClusterIP   172.30.2.246    <none>        9080/TCP   43s
   ratings       ClusterIP   172.30.33.85    <none>        9080/TCP   44s
   reviews       ClusterIP   172.30.175.88   <none>        9080/TCP   44s

   Copy to Clipboard Toggle word wrap

2. Verify that the bookinfo pods are available by running the following command:

   $ oc get pods -n bookinfo

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   details-v1-698d88b-km2jg         2/2     Running   0          66s
   productpage-v1-675fc69cf-cvxv9   2/2     Running   0          65s
   ratings-v1-6484c4d9bb-tpx7d      2/2     Running   0          65s
   reviews-v1-5b5d6494f4-wsrwp      2/2     Running   0          65s
   reviews-v2-5b667bcbf8-4lsfd      2/2     Running   0          65s
   reviews-v3-5b9bd44f4-44hr6       2/2     Running   0          65s

   Copy to Clipboard Toggle word wrap

   When the Ready columns displays 2/2, the proxy sidecar was successfully injected. Confirm that Running appears in the Status column for each pod.

3. Verify that the bookinfo application is running by sending a request to the bookinfo page. Run the following command:

   $ oc exec "$(oc get pod -l app=ratings -n bookinfo -o jsonpath='{.items[0].metadata.name}')" -c ratings -n bookinfo -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the istio-ingressgateway deployment and service by running the following command:

   $ oc apply -n bookinfo -f ingress-gateway.yaml

   Copy to Clipboard Toggle word wrap
   Note

   This example uses a sample ingress-gateway.yaml file that is available in the Istio community repository.

2. Configure the bookinfo application to use the new gateway. Apply the gateway configuration by running the following command:

   $ oc apply -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.24/samples/bookinfo/networking/bookinfo-gateway.yaml -n bookinfo

   Copy to Clipboard Toggle word wrap
   Note

   To configure gateway injection with the bookinfo application, this example uses a sample gateway configuration file that must be applied in the namespace where the application is installed.

3. Use a route to expose the gateway external to the cluster by running the following command:

   $ oc expose service istio-ingressgateway -n bookinfo

   Copy to Clipboard Toggle word wrap

4. Modify the YAML file to automatically scale the pod when ingress traffic increases.

   Example configuration

   apiVersion: autoscaling/v2
   kind: HorizontalPodAutoscaler
   metadata:
     labels:
       istio: ingressgateway
       release: istio
     name: ingressgatewayhpa
     namespace: bookinfo
   spec:
     maxReplicas: 5 

   1

   
     metrics:
     - resource:
         name: cpu
         target:
           averageUtilization: 80
           type: Utilization
       type: Resource
     minReplicas: 2
     scaleTargetRef:
       apiVersion: apps/v1
       kind: Deployment
       name: istio-ingressgateway

   Copy to Clipboard Toggle word wrap

   1

   This example sets the the maximum replicas to 5 and the minimum replicas to 2. It also creates another replica when utilization reaches 80%.

5. Specify the minimum number of pods that must be running on the node.

   Example configuration

   apiVersion: policy/v1
   kind: PodDisruptionBudget
   metadata:
     labels:
       istio: ingressgateway
       release: istio
     name: ingressgatewaypdb
     namespace: bookinfo
   spec:
     minAvailable: 1 

   1

   
     selector:
       matchLabels:
         istio: ingressgateway

   Copy to Clipboard Toggle word wrap

   1

   This example ensures one replica is running if a pod gets restarted on a new node.

6. Obtain the gateway host name and the URL for the product page by running the following command:

   $ HOST=$(oc get route istio-ingressgateway -n bookinfo -o jsonpath='{.spec.host}')

   Copy to Clipboard Toggle word wrap

7. Verify that the productpage is accessible from a web browser by running the following command:

   $ echo productpage URL: http://$HOST/productpage

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable the Gateway API CRDs for OpenShift Container Platform 4.18 and earlier, by running the following command:

   $ oc get crd gateways.gateway.networking.k8s.io &> /dev/null ||  { oc kustomize "github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.0.0" | oc apply -f -; }

   Copy to Clipboard Toggle word wrap

2. Create and configure a gateway by using the Gateway and HTTPRoute resources by running the following command:

   $ oc apply -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.24/samples/bookinfo/gateway-api/bookinfo-gateway.yaml -n bookinfo

   Copy to Clipboard Toggle word wrap
   Note

   To configure a gateway with the bookinfo application by using the Gateway API, this example uses a sample gateway configuration file that must be applied in the namespace where the application is installed.

3. Ensure that the Gateway API service is ready, and has an address allocated by running the following command:

   $ oc wait --for=condition=programmed gtw bookinfo-gateway -n bookinfo

   Copy to Clipboard Toggle word wrap

4. Retrieve the host by running the following command:

   $ export INGRESS_HOST=$(oc get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.status.addresses[0].value}')

   Copy to Clipboard Toggle word wrap

5. Retrieve the port by running the following command:

   $ export INGRESS_PORT=$(oc get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')

   Copy to Clipboard Toggle word wrap

6. Retrieve the gateway URL by running the following command:

   $ export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT

   Copy to Clipboard Toggle word wrap

7. Obtain the gateway host name and the URL of the product page by running the following command:

   $ echo "http://${GATEWAY_URL}/productpage"

   Copy to Clipboard Toggle word wrap

Procedure

1. In the OpenShift Container Platform web console, click Installed Operators.
2. Click Red Hat OpenShift Service Mesh 3 Operator.
3. Click Istio.
4. Click the name of the Istio installation. For example, default.
5. Click YAML.

6. Modify the Istio custom resource (CR) similar to the following example:

   Example configuration

   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     namespace: istio-system
     values:
       pilot:
         autoscaleMin: 2 

   1

   
         autoscaleMax: 5 

   2

   
         cpu:
           targetAverageUtilization: 80 

   3

   
         memory:
           targetAverageUtilization: 80 

   4

   Copy to Clipboard Toggle word wrap

   1

   Specifies the minimum number of Istio control plane replicas that always run.

   2

   Specifies the maximum number of Istio control plane replicas, allowing for scaling based on load. To support HA, there must be at least two replicas.

   3

   Specifies the target CPU utilization for autoscaling to 80%. If the average CPU usage exceeds this threshold, the Horizontal Pod Autoscaler (HPA) automatically increases the number of replicas.

   4

   Specifies the target memory utilization for autoscaling to 80%. If the average memory usage exceeds this threshold, the HPA automatically increases the number of replicas.

Procedure

1. Obtain the name of the Istio resource by running the following command:

   $ oc get istio -n istio-sytem

   Copy to Clipboard Toggle word wrap

   Example output

   NAME      REVISIONS   READY   IN USE   ACTIVE REVISION   STATUS    VERSION   AGE
   default   1           1       0        default           Healthy   v1.24.6   24m

   Copy to Clipboard Toggle word wrap

   The name of the Istio resource is default.

2. Update the Istio custom resource (CR) by adding the autoscaleEnabled and replicaCount parameters by running the following command:

   $ oc patch istio default -n istio-system --type merge -p '
   spec:
     values:
       pilot:
         autoscaleEnabled: false 

   1

   
         replicaCount: 2 

   2

   
   '

   Copy to Clipboard Toggle word wrap

   1

   Specifies a setting that disables autoscaling and ensures that the number of replicas remains fixed.

   2

   Specifies the number of Istio control plane replicas. To support HA, there must be at least two replicas.

Verification

1. Verify the status of the Istio control pods by running the following command:

   $ oc get pods -n istio-system -l app=istiod

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                      READY   STATUS    RESTARTS   AGE
   istiod-7c7b6564c9-nwhsg   1/1     Running   0          70s
   istiod-7c7b6564c9-xkmsl   1/1     Running   0          85s

   Copy to Clipboard Toggle word wrap

   Two istiod pods are running, which is the minimum requirement for an HA Istio control plane and indicates that a basic HA setup is in place.