第 12 章 Networking

Prerequisites

1. Install the OpenShift Serverless Operator and Knative Serving.
2. Install Red Hat OpenShift Service Mesh.

Procedure

1. Add the default namespace to the ServiceMeshMemberRoll as a member:

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system
   spec:
     members:
       - default

   重要

   Adding sidecar injection to Pods in system namespaces such as knative-serving and knative-serving-ingress is not supported.

2. Create a network policy that permits traffic flow from Knative system pods to Knative services:

   1. Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving namespace:

      $ oc label namespace knative-serving serving.knative.openshift.io/system-namespace=true

   2. Add the serving.knative.openshift.io/system-namespace=true label to the knative-serving-ingress namespace:

      $ oc label namespace knative-serving-ingress serving.knative.openshift.io/system-namespace=true

   3. Copy the following NetworkPolicy resource into a YAML file:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-serving-system-namespace
        namespace: default
      spec:
        ingress:
        - from:
          - namespaceSelector:
              matchLabels:
                serving.knative.openshift.io/system-namespace: "true"
        podSelector: {}
        policyTypes:
        - Ingress

   4. Apply the NetworkPolicy resource:

      $ oc apply -f <filename>