You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Update docs to include mention of `IstioRevisionTag`
Signed-off-by: Daniel Grimm <[email protected]>
* Update docs/ossm/injection/README.md
---------
Signed-off-by: Daniel Grimm <[email protected]>
Co-authored-by: Marko Lukša <[email protected]>
When the service mesh's `IstioRevision` name is "default", it's possible to use following labels on a namespace or a pod to enable sidecar injection:
27
+
When the service mesh's `IstioRevision` name is "default", or if there is an `IstioRevisionTag` with the name `default` that references the `IstioRevision`, it's possible to use following labels on a namespace or a pod to enable sidecar injection:
28
28
| Resource | Label | Enabled value | Disabled value |
#### Example 1a: Enabling sidecar injection with namespace labels and an `IstioRevisionTag`
117
+
118
+
If your revision name is not `default` - e.g. because you are using the `RevisionBased` update strategy - you can still use the `istio-injection=enabled` label. To do that, you just have to create an `IstioRevisionTag` with the name `default` that references your `Istio` resource.
119
+
120
+
Procedure:
121
+
122
+
1. Find the name of your `Istio` resource:
123
+
124
+
```bash
125
+
$ oc get istio
126
+
NAME REVISIONS READY IN USE ACTIVE REVISION STATUS VERSION AGE
In this case, the `Istio` resource has the name `default`, but the underlying revision is called `default-v1-23-2`.
130
+
131
+
1. Create the `IstioRevisionTag`:
132
+
133
+
```bash
134
+
$ oc apply -f - <<EOF
135
+
apiVersion: sailoperator.io/v1alpha1
136
+
kind: IstioRevisionTag
137
+
metadata:
138
+
name: default
139
+
spec:
140
+
targetRef:
141
+
kind: Istio
142
+
name: default
143
+
EOF
144
+
145
+
1. Verify that the `IstioRevisionTag` has been created successfully:
146
+
147
+
```bash
148
+
$ oc get istiorevisiontags.sailoperator.io
149
+
NAME STATUS IN USE REVISION AGE
150
+
default Healthy True default-v1-23-2 4m23s
151
+
```
152
+
As you can see, the new tag is referencing your active revision `default-v1-23-2`.
153
+
154
+
1. Follow steps of [Example 1](#example-1-enabling-sidecar-injection-with-namespace-labels).
155
+
156
+
You are now able to use the `istio-injection=enabled` label as if your revision was called `default`.
157
+
115
158
#### Example 2: Exclude a workload from the mesh
116
159
117
160
There may be times when you want to exclude individual workloads from a namespace where all workloads are otherwise injected with sidecars. This continues the previous example to exclude the `details` service from the mesh.
Copy file name to clipboardExpand all lines: docs/ossm/ossm2-vs-ossm3.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ Sidecar injection in OpenShift Service Mesh 3 works the same way as it does for
52
52
53
53
When an `Istio` resource has the name “default” and `InPlace` upgrades are used (as opposed to `RevisionBased` described below), there will be a single `IstioRevision` with the name "default" and the label `istio-injection=enabled` may be used for injection.
54
54
55
-
However, when an `IstioRevision` resource has a name other than “default” - as required when multiple control plane instances are present and/or a canary-style control plane upgrade is in progress, it is necessary to use a label that indicates which control plane (revision) the workload(s) belong to - namely, `istio.io/rev=<IstioRevision-name>`. These labels may be applied at the workload or namespace level. Available revisions may be inspected with the command `oc get istiorevision`.
55
+
However, when an `IstioRevision` resource has a name other than “default” - as required when multiple control plane instances are present and/or when using the `RevisionBased` update strategy, it might be necessary to use a label that indicates which control plane (revision) the workload(s) belong to - namely, `istio.io/rev=<IstioRevision-name>`. These labels may be applied at the workload or namespace level. Available revisions may be inspected with the command `oc get istiorevision`. In order to use the `istio-injection=enabled` in combination with `RevisionBased` deployments, it is possible to create an `IstioRevisionTag` resource that is named `default`, see the [`IstioRevisionTag`](https://github.com/istio-ecosystem/sail-operator/blob/main/docs/api-reference/sailoperator.io.md#istiorevisiontag) documentation for more information.
0 commit comments