Skip to content

Commit 88cb7bf

Browse files
longmuirsridhargaddamdgn
authored
Update discoverySelectors example to use bookinfo (openshift-service-mesh#165)
* Update discoverySelectors example to use bookinfo * Update docs/ossm/create-mesh/README.md Co-authored-by: Sridhar Gaddam <[email protected]> * Update docs/ossm/create-mesh/README.md Co-authored-by: Daniel Grimm <[email protected]> --------- Co-authored-by: Sridhar Gaddam <[email protected]> Co-authored-by: Daniel Grimm <[email protected]>
1 parent 07682a7 commit 88cb7bf

File tree

1 file changed

+11
-67
lines changed

1 file changed

+11
-67
lines changed

‎docs/ossm/create-mesh/README.md‎

Lines changed: 11 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
# Scoping the service mesh with DiscoverySelectors
2-
This page describes how the service mesh control plane discovers and observes cluster resources and how to manage this scope.
32

43
A service mesh will include a workload that:
54
1. Has been discovered by the control plane
@@ -27,23 +26,20 @@ You can configure each label selector for a variety of use cases, including but
2726
- A list of namespace labels using set-based selectors which carries OR semantics, for example, all namespaces with label `istio-discovery=enabled` OR `region=us-east1`
2827
- Inclusion and/or exclusion of namespaces, for example, all namespaces with label `istio-discovery=enabled` AND label key `app` equal to `helloworld`
2928

30-
#### Using Discovery Selectors to Scope of a Service Mesh
31-
Assuming you know which namespaces to include as part of the service mesh, as a mesh administrator, you can configure `discoverySelectors` at installation time or post-installation by adding your desired discovery selectors to Istio’s MeshConfig resource. For example, you can configure Istio to discover only the namespaces that have the label `istio-discovery=enabled`.
29+
#### Using Discovery Selectors to Scope a Service Mesh
30+
Assuming you know which namespaces to include as part of the service mesh, as a mesh administrator, you can configure `discoverySelectors` at installation time or post-installation by adding your desired discovery selectors to Istio’s MeshConfig resource.
31+
32+
For example, you can configure Istio to discover only the namespaces that have the label `istio-discovery=enabled`.
3233

3334
##### Prerequisites
3435
- The OpenShift Service Mesh operator has been installed
3536
- An Istio CNI resource has been created
36-
- The `istioctl` binary has been installed on your localhost
3737

38-
1. Create the `istio-system` system namespace:
39-
```bash
40-
oc create ns istio-system
41-
```
42-
1. Label the `istio-system` system namespace:
38+
1. Add a label to the namespace containing the Istio control plane, for example, the `istio-system` system namespace:
4339
```bash
44-
oc label ns istio-system istio-discovery=enabled
40+
oc label namespace istio-system istio-discovery=enabled
4541
```
46-
1. Prepare `istio.yaml` with `discoverySelectors` configured:
42+
1. Modify the `Istio` control plane resource to include a `discoverySelectors` section with the same label, for example:
4743
```yaml
4844
kind: Istio
4945
apiVersion: sailoperator.io/v1alpha1
@@ -56,69 +52,17 @@ Assuming you know which namespaces to include as part of the service mesh, as a
5652
discoverySelectors:
5753
- matchLabels:
5854
istio-discovery: enabled
59-
updateStrategy:
60-
type: InPlace
61-
version: v1.23.0
6255
```
56+
6357
1. Apply the Istio CR:
6458
```bash
6559
oc apply -f istio.yaml
6660
```
67-
1. Create first application namespace:
68-
```bash
69-
oc create ns app-ns-1
70-
```
71-
1. Create second application namespace:
72-
```bash
73-
oc create ns app-ns-2
74-
```
75-
1. Label first application namespace to be matched by defined `discoverySelectors` and enable sidecar injection:
76-
```bash
77-
oc label ns app-ns-1 istio-discovery=enabled istio-injection=enabled
78-
```
79-
1. Deploy the sleep application to the first namespaces:
61+
1. You then must ensure that all namespaces that will contain workloads that are to be part of the service mesh have both the `discoverySelector` label and, if desired, the appropriate Istio injection label. For example, for the `bookinfo` application, you can apply both labels as follows:
8062
```bash
81-
oc apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/sleep/sleep.yaml -n app-ns-1
63+
oc label namespace bookinfo istio-discovery=enabled istio-injection=enabled
8264
```
83-
1. Deploy the sleep application to the second namespaces:
84-
```bash
85-
oc apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/sleep/sleep.yaml -n app-ns-2
86-
```
87-
1. Verify that you don't see any endpoints from the second namespace:
88-
```bash
89-
istioctl pc endpoint deploy/sleep -n app-ns-1
90-
ENDPOINT STATUS OUTLIER CHECK CLUSTER
91-
10.128.2.197:15010 HEALTHY OK outbound|15010||istiod.istio-system.svc.cluster.local
92-
10.128.2.197:15012 HEALTHY OK outbound|15012||istiod.istio-system.svc.cluster.local
93-
10.128.2.197:15014 HEALTHY OK outbound|15014||istiod.istio-system.svc.cluster.local
94-
10.128.2.197:15017 HEALTHY OK outbound|443||istiod.istio-system.svc.cluster.local
95-
10.131.0.32:80 HEALTHY OK outbound|80||sleep.app-ns-1.svc.cluster.local
96-
127.0.0.1:15000 HEALTHY OK prometheus_stats
97-
127.0.0.1:15020 HEALTHY OK agent
98-
unix://./etc/istio/proxy/XDS HEALTHY OK xds-grpc
99-
unix://./var/run/secrets/workload-spiffe-uds/socket HEALTHY OK sds-grpc
100-
```
101-
1. Label second application namespace to be matched by defined `discoverySelectors` and enable sidecar injection:
102-
```bash
103-
oc label ns app-ns-2 istio-discovery=enabled
104-
```
105-
1. Verify that after labeling second namespace it also appears on the list of discovered endpoints:
106-
```bash
107-
istioctl pc endpoint deploy/sleep -n app-ns-1
108-
ENDPOINT STATUS OUTLIER CHECK CLUSTER
109-
10.128.2.197:15010 HEALTHY OK outbound|15010||istiod.istio-system.svc.cluster.local
110-
10.128.2.197:15012 HEALTHY OK outbound|15012||istiod.istio-system.svc.cluster.local
111-
10.128.2.197:15014 HEALTHY OK outbound|15014||istiod.istio-system.svc.cluster.local
112-
10.128.2.197:15017 HEALTHY OK outbound|443||istiod.istio-system.svc.cluster.local
113-
10.131.0.32:80 HEALTHY OK outbound|80||sleep.app-ns-1.svc.cluster.local
114-
10.131.0.33:80 HEALTHY OK outbound|80||sleep.app-ns-2.svc.cluster.local
115-
127.0.0.1:15000 HEALTHY OK prometheus_stats
116-
127.0.0.1:15020 HEALTHY OK agent
117-
unix://./etc/istio/proxy/XDS HEALTHY OK xds-grpc
118-
unix://./var/run/secrets/workload-spiffe-uds/socket HEALTHY OK sds-grpc
119-
```
120-
121-
See [Multiple Istio Control Planes in a Single Cluster](../multi-control-planes/README.md) for another example of `discoverySelectors` usage.
65+
In addition to limiting the scope of a single service mesh, `discoverySelectors` also play a critical role in limiting the scope of control plane when [multiple Istio control planes are to be deployed within a single cluster](../multi-control-planes/README.md).
12266

12367
### Next Steps: Sidecar injection
12468
As described earlier, in addition to the control plane discovering the namespaces to be included in the mesh, workloads must be [injected with a sidecar proxy](../injection/README.md) to be included in the service mesh.

0 commit comments

Comments
 (0)