Chapter 3. Day Two

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Run this command to check the current Mixer policy enforcement status:

   $ oc get cm -n istio-system istio -o jsonpath='{.data.mesh}' | grep disablePolicyChecks

3. If disablePolicyChecks: true, edit the Service Mesh ConfigMap:

   $ oc edit cm -n istio-system istio

4. Locate disablePolicyChecks: true within the ConfigMap and change the value to false.
5. Save the configuration and exit the editor.
6. Re-check the Mixer policy enforcement status to ensure it is set to false.

Procedure

1. Log in to the OpenShift Container Platform web console as a user with cluster-admin rights.
2. Click to Home Projects.
3. Click Create Project.

4. Enter bookinfo as the Project Name, enter a Display Name, and enter a Description, then click Create.

   • Alternatively, you can run this command from the CLI to create the bookinfo project.

     $ oc new-project bookinfo

5. Click Catalog Installed Operators.
6. Click the Project menu and use the control plane namespace. In this example, use istio-system.
7. Click the Red Hat OpenShift Service Mesh Operator.

8. Click the Istio Service Mesh Member Roll link.

   1. If you have already created a Istio Service Mesh Member Roll, click the name, then click the YAML tab to open the YAML editor.

   2. If you have not created a Istio Service Mesh Member Roll, click Create Service Mesh Member Roll.

      Note

      You need cluster-admin rights to edit the Istio Service Mesh Member Roll.

9. Edit the default Service Mesh Member Roll YAML and add bookinfo to the members list.

   Bookinfo ServiceMeshMemberRoll example

     apiVersion: maistra.io/v1
     kind: ServiceMeshMemberRoll
     metadata:
       name: default
     spec:
       members:
       - bookinfo

   • Alternatively, you can run this command from the CLI to add the bookinfo project to the ServiceMeshMemberRoll. Replace <control plane project> with the name of your control plane project.

     $ oc -n <control plane project> patch --type='json' smmr default -p '[{"op": "add", "path": "/spec/members", "value":["'"bookinfo"'"]}]'

10. Click Create to save the updated Service Mesh Member Roll.

11. From the CLI, deploy the Bookinfo application in the `bookinfo` project by applying the bookinfo.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/bookinfo/maistra-1.0/bookinfo.yaml

12. Create the ingress gateway by applying the bookinfo-gateway.yaml file:

    $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/bookinfo/maistra-1.0/bookinfo-gateway.yaml

13. Set the value for the GATEWAY_URL parameter:

    Note

    Replace <control_plane_project> with the name of your control plane project.

    $ export GATEWAY_URL=$(oc -n <control_plane_project> get route istio-ingressgateway -o jsonpath='{.spec.host}')

Procedure

1. To add destination rules, run one of the following commands:

   • If you did not enable mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/istio/istio/release-1.1/samples/bookinfo/networking/destination-rule-all.yaml

   • If you enabled mutual TLS:

     $ oc apply -n bookinfo -f https://raw.githubusercontent.com/istio/istio/release-1.1/samples/bookinfo/networking/destination-rule-all-mtls.yaml

Procedure

1. Log in to the OpenShift Container Platform CLI.

2. Run this command to confirm that Bookinfo is deployed:

   $ curl -o /dev/null -s -w "%{http_code}\n" http://$GATEWAY_URL/productpage

   • Alternatively, you can open http://$GATEWAY_URL/productpage in your browser.

   • You can also verify that all pods are ready with this command:

     $ oc get pods -n bookinfo

Procedure from the console

1. In the OpenShift Container Platform console, navigate to Networking Routes and search for the Kiali route.

2. Click the URL listed under Location.

   The default login strategy is openshift which means that you should be automatically logged into the Kiali console using the same user name and password as you use to access the OpenShift Container Platform console. When you first log in you see the Overview page, which provides a quick overview of the health of the various Namespaces that are part of your Service Mesh.

   

3. Use the left navigation or click one of the Namespace icons to view your Applications, Workloads, or Services.

Procedure from the CLI

1. Run this command from the CLI to obtain the route and Kiali URL:

   $ oc get routes

   Sample CLI output showing routes

   NAME                   HOST/PORT                                                PATH      SERVICES               PORT              TERMINATION   WILDCARD
   grafana                grafana-openshift-operators.127.0.0.1.nip.io                          grafana                http                            None
   istio-ingress          istio-ingress-openshift-operators.127.0.0.1.nip.io                    istio-ingress          http                            None
   istio-ingressgateway   istio-ingressgateway-openshift-operators.127.0.0.1.nip.io             istio-ingressgateway   http                            None
   jaeger-query           jaeger-query-openshift-operators.127.0.0.1.nip.io                     jaeger-query           jaeger-query      edge          None
   kiali                  kiali-openshift-operators.127.0.0.1.nip.io                            kiali                  <all>                           None
   prometheus             prometheus-openshift-operators.127.0.0.1.nip.io                       prometheus             http-prometheus                 None
   tracing                tracing-openshift-operators.127.0.0.1.nip.io                          tracing                tracing           edge          None

2. Launch a browser and navigate to https://<KIALI_URL> (in the CLI output example, this is kiali-openshift-operators.127.0.0.1.nip.io). You should see the Kiali console login screen.
3. Log in to the Kiali console using the user name and password that you use when logging into the OpenShift Container Platform console.

Procedure

1. In the Kiali console, click Graph in the left navigation.

   

2. If necessary, select bookinfo from the Namespace menu. The graph displays the applications in the Bookinfo application.
3. Click the question mark (?) under the Namespace menu to take the Graph Help Tour.
4. Click Done to close the Help Tour.

5. Click Legend in the lower left corner. Kiali displays the graph legend.

   

6. Close the Graph Legend.
7. Hover over the productpage Node. Note how the graph highlights only the incoming and outgoing traffic from the Node.
8. Click the productpage Node. Note how the details on the right side of the page change to display the productpage details.

Procedure

1. In the Kiali console, click Applications in the left navigation.
2. If necessary, select bookinfo from the Namespace menu. The page displays the applications in the selected Namespace and their health.
3. Hover over the Health icon to view additional health details.

4. Click the reviews Service to view the details for that application.

   

5. On the Applications Details page you can view more detailed health information, and drill down for further details about the three versions of the reviews Service.
6. From the Application Details page you can also click tabs to view Traffic and Inbound and Outbound Metrics for the application.

Procedure

1. In the Kiali console, click Workloads in the left navigation.
2. If necessary, select bookinfo from the Namespace menu. The page displays the Workloads in the selected Namespace, their health, and labels.
3. Click the reviews-v1 Workload to view the details for that Workload.

4. On the Workload Details page you can view an overview of Pods and Services associated with the Workload.

   

5. From the Workload Details page you can also click tabs to view Traffic, Logs, and Inbound and Outbound Metrics for the Workload.

Procedure

1. In the Kiali console, click Services in the left navigation.
2. If necessary, select bookinfo from the Namespace menu. The page displays a listing of all the Services that are running in the selected Namespace and additional information about them, such as health status.
3. Hover over the health icon for any of the Services to view health information about the Service. A Service is considered healthy when it is online and responding to requests without errors.

4. Click the Reviews Service to view its details. Note that there are three different versions of this Service.

   

5. On the Services Details page you can view an overview of Workloads, virtual Services, and destination rules associated with the Service.
6. From the Services Details page you can also click tabs to view Traffic, Inbound Metrics, and Traces for the Service.

7. Click the Actions menu. From here you can perform the following actions:

   • Create Weighted Routing
   • Create Matching Routing
   • Suspend Traffic
   • Delete ALL Traffic Routing
8. Click the name of one of the Services to view additional details about that specific version of the Service.

Procedure

1. In the Kiali console, click Istio Config in the left navigation.

2. If necessary, select bookinfo from the Namespace menu. The page displays a listing of configurations running in the selected Namespace and validation status.

   

3. Click one of the configurations to view additional information about the configuration file.

   

Procedure

1. After you have deployed the Bookinfo application you will need to generate calls to the Bookinfo application so that you have some trace data to analyze. Access http://<GATEWAY_URL>/productpage and refresh the page a few times to generate some trace data.

2. The installation process creates a route to access the Jaeger console.

   1. In the OpenShift Container Platform console, navigate to Networking Routes and search for the Jaeger route, which is the URL listed under Location.

   2. Use the CLI to query for details of the route:

      $ export JAEGER_URL=$(oc get route -n bookinfo jaeger-query -o jsonpath='{.spec.host}')

3. Launch a browser and navigate to https://<JAEGER_URL>.
4. If necessary, log in using the same user name and password as you use to access the OpenShift Container Platform console.

5. In the left pane of the Jaeger dashboard, from the Service menu, select "productpage" and click the Find Traces button at the bottom of the pane. A list of traces is displayed, as shown in the following image:

   

6. Click one of the traces in the list to open a detailed view of that trace. If you click on the top (most recent) trace, you see the details that correspond to the latest refresh of the `/productpage.

   

   The trace in the previous figure consists of a few nested spans, each corresponding to a Bookinfo Service call, all performed in response to a `/productpage request. Overall processing time was 2.62s, with the details Service taking 3.56ms, the reviews Service taking 2.6s, and the ratings Service taking 5.32ms. Each of the calls to remote Services is represented by a client-side and server-side span. For example, the details client-side span is labeled productpage details.myproject.svc.cluster.local:9080. The span nested underneath it, labeled details details.myproject.svc.cluster.local:9080, corresponds to the server-side processing of the request. The trace also shows calls to istio-policy, which reflect authorization checks made by Istio.