You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Use bookinfo for injection examples
* Update docs/ossm/injection/README.md
Co-authored-by: Filip Brychta <[email protected]>
* Feedback from PR, and add exclusion example
* Update docs/ossm/injection/README.md
Co-authored-by: Filip Brychta <[email protected]>
* Further updates from review, remove extra restarts not needed
---------
Co-authored-by: Filip Brychta <[email protected]>
@@ -49,81 +49,180 @@ The injector is configured with the following logic:
49
49
1. If either label (`istio-injection` or `sidecar.istio.io/inject`) is disabled, the pod is not injected.
50
50
2. If either label (`istio-injection` or `sidecar.istio.io/inject` or `istio.io/rev`) is enabled, the pod is injected.
51
51
52
-
### Example: Enabling sidecar injection
52
+
### Sidecar injection examples
53
+
54
+
The following examples use the [Bookinfo application](https://docs.openshift.com/service-mesh/3.0.0tp1/install/ossm-installing-openshift-service-mesh.html#deploying-book-info_ossm-about-bookinfo-application) to demonstrate different approaches for configuring side car injection.
55
+
56
+
> Note: If you have followed the procedure to deploy the Bookinfo application, step 5 added a sidecar injection label to the `bookinfo` namespace, and these steps are not necessary to repeat.
57
+
53
58
Prerequisites:
54
-
- The OpenShift Service Mesh operator has been installed
55
-
- An Istio CNI resource has been created
59
+
- You have installed the Red Hat OpenShift Service Mesh Operator, created an `Istio` resource, and the Operator has deployed Istio.
60
+
- You have created the `IstioCNI` resource, and the Operator has deployed the necessary IstioCNI pods.
61
+
- You have created the namespaces that are to be part of the mesh, and they are [discoverable by the Istio control plane](https://docs.openshift.com/service-mesh/3.0.0tp1/install/ossm-installing-openshift-service-mesh.html#ossm-scoping-service-mesh-with-discoveryselectors_ossm-creating-istiocni-resource).
62
+
- (Optional) You have deployed the workloads to be included in the mesh. In the following examples, the [Bookinfo has been deployed](https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0.0tp1/html-single/installing/index#ossm-about-bookinfo-application_ossm-discoveryselectors-scope-service-mesh) to the `bookinfo` namespace, but sidecar injection (step 5) has not been configured.
63
+
64
+
#### Example 1: Enabling sidecar injection with namespace labels
65
+
66
+
In this example, all workloads within a namespace will be injected with a sidecar proxy. This is the best approach if most of the workloads within a namespace are to be included in the mesh.
67
+
68
+
Procedure:
69
+
70
+
1. Verify the revision name of the Istio control plane:
56
71
57
-
1. Create the `istio-system` namespace:
58
72
```bash
59
-
oc create ns istio-system
73
+
$ oc get istiorevision
74
+
NAME TYPE READY STATUS IN USE VERSION AGE
75
+
default Local True Healthy False v1.23.0 4m57s
60
76
```
61
-
1. Prepare `default``istio.yaml`:
62
-
```yaml
63
-
kind: Istio
64
-
apiVersion: sailoperator.io/v1alpha1
65
-
metadata:
66
-
name: default
67
-
spec:
68
-
namespace: istio-system
69
-
updateStrategy:
70
-
type: InPlace
71
-
version: v1.23.0
72
-
```
73
-
1. Create the `default` Istio CR in`istio-system` namespace:
77
+
Since the revision name is `default`, we can used the default injection labels and do not need to reference the specific revision name.
78
+
79
+
1. For workloads already running in the desired namespace, verify that they show "1/1" containers as "READY", indicating that the pods are currently running without sidecars:
1. Workloads that were already running when the injection label was added will need to be redeployed forsidecar injection to occur. The following command can be used to perform a rolling update of all workloadsin the `bookinfo` namespace:
There may be times when you want to exclude individual workloads from a namespace where all workloads are otherwise injected with sidecars. This continues the previous example to exclude the `details` service from the mesh.
118
+
119
+
> Note: This example is for demonstration purposes only, and the bookinfo application requires all workloads to be part of the mesh for it to work.
120
+
121
+
Procedure:
122
+
123
+
1. Open the application’s `Deployment` resource in an editor. In this case, we will exclude the `ratings-v1` service.
124
+
125
+
1. Modify the `spec.template.metadata.labels` section of your `Deployment` resource to include the appropriate pod injection or revision label to set injection to "false". In this case, `sidecar.istio.io/inject: false`:
126
+
127
+
```yaml
128
+
kind: Deployment
129
+
apiVersion: apps/v1
130
+
metadata:
131
+
name: ratings-v1
132
+
namespace: bookinfo
133
+
labels:
134
+
app: ratings
135
+
version: v1
136
+
spec:
137
+
template:
138
+
metadata:
139
+
labels:
140
+
sidecar.istio.io/inject: 'false'
97
141
```
98
-
1. Injection occurs at pod creation time. Remove the running pod to be injected with a proxy sidecar.
142
+
> Note: Adding the label to the `Deployment`'s top level `labels` section will not impact sidecar injection.
143
+
144
+
Updating the deployment will result in a rollout, where a new `ReplicaSet` is created with updated pod(s).
145
+
146
+
1. Verify that the updated pod(s) do not contain a sidecar container, and shows "1/1" containers "Running":
99
147
```bash
100
-
oc delete pod -l app=sleep
148
+
oc get pods -n bookinfo
149
+
NAME READY STATUS RESTARTS AGE
150
+
details-v1-6bc7b69776-7f6wz 1/1 Running 0 7s
151
+
productpage-v1-54f48db985-gd5q9 2/2 Running 0 29m
152
+
ratings-v1-5d645c985f-xsw7p 2/2 Running 0 29m
153
+
reviews-v1-bd5f54b8c-zns4v 2/2 Running 0 29m
154
+
reviews-v2-5d7b9dbf97-wbpjr 2/2 Running 0 29m
155
+
reviews-v3-5fccc48c8c-bjktn 2/2 Running 0 29m
101
156
```
102
-
1. Verify a new pod is created with the injected sidecar. The original pod has `1/1 READY` containers, and the pod with injected sidecar has `2/2 READY` containers.
103
-
```bash
104
-
oc get pod -l app=sleep
105
-
NAME READY STATUS RESTARTS AGE
106
-
sleep-5577c64d7c-w9vpk 2/2 Running 0 12s
157
+
158
+
### Example 3: Enabling sidecar injection with pod labels
159
+
160
+
Rather than including all workloads within a namespace, you can include individual workloads for sidecar injection. This approach is ideal when only a few workloads within a namespace will be part of a service mesh.
161
+
162
+
This example also demonstrates the use of a revision label for sidecar injection. In this case, the `Istio` resource has been created with the name "my-mesh". A unique resource `Istio` name is needed when there are multiple Istio control planes present in the same cluster, or a revision based control plane upgrade is in progress.
163
+
164
+
Procedure:
165
+
166
+
1. Verify the revision name of the Istio control plane:
167
+
168
+
```console
169
+
$ oc get istiorevision
170
+
NAME TYPE READY STATUS IN USE VERSION AGE
171
+
my-mesh Local True Healthy False v1.23.0 47s
107
172
```
108
-
1. View the detailed state of the injected pod. You should see the injected `istio-proxy` container.
173
+
Since the revision name is `my-mesh`, we must use the a revision label to enable sidecar injection. In this case, `istio.io/rev=my-mesh`.
174
+
175
+
1. For workloads already running, verify that they show "1/1" containers as "READY", indicating that the pods are currently running without sidecars:
176
+
109
177
```bash
110
-
oc describe pod -l app=sleep
111
-
...
112
-
Events:
113
-
Type Reason Age From Message
114
-
---- ------ ---- ---- -------
115
-
Normal Scheduled 50s default-scheduler Successfully assigned default/sleep-5577c64d7c-w9vpk to user-rhos-d-1-v8rnx-worker-0-rwjrr
116
-
Normal AddedInterface 50s multus Add eth0 [10.128.2.179/23] from ovn-kubernetes
117
-
Normal Pulled 50s kubelet Container image "registry.redhat.io/openshift-service-mesh-tech-preview/istio-proxyv2-rhel9@sha256:c0170ef9a34869828a5f2fea285a7cda543d99e268f7771e6433c54d6b2cbaf4" already present on machine
118
-
Normal Created 50s kubelet Created container istio-validation
119
-
Normal Started 50s kubelet Started container istio-validation
120
-
Normal Pulled 50s kubelet Container image "curlimages/curl" already present on machine
121
-
Normal Created 50s kubelet Created container sleep
122
-
Normal Started 50s kubelet Started container sleep
123
-
Normal Pulled 50s kubelet Container image "registry.redhat.io/openshift-service-mesh-tech-preview/istio-proxyv2-rhel9@sha256:c0170ef9a34869828a5f2fea285a7cda543d99e268f7771e6433c54d6b2cbaf4" already present on machine
124
-
Normal Created 50s kubelet Created container istio-proxy
125
-
Normal Started 50s kubelet Started container istio-proxy
1. Open the application’s `Deployment` resource in an editor. In this case, we will update the `ratings-v1` service.
189
+
190
+
1. Update the `spec.template.metadata.labels` section of your `Deployment` to include the appropriate pod injection or revision label. In this case, `istio.io/rev: my-mesh`:
191
+
192
+
```yaml
193
+
kind: Deployment
194
+
apiVersion: apps/v1
195
+
metadata:
196
+
name: ratings-v1
197
+
namespace: bookinfo
198
+
labels:
199
+
app: ratings
200
+
version: v1
201
+
spec:
202
+
template:
203
+
metadata:
204
+
labels:
205
+
istio.io/rev: my-mesh
127
206
```
128
-
> [!CAUTION]
129
-
> Injection using the `istioctl kube-inject` which is not supported by Red Hat OpenShift Service Mesh.
207
+
208
+
> Note: Adding the label to the `Deployment`'s top level `labels` section will not impact sidecar injection.
209
+
210
+
Updating the deployment will result in a rollout, where a new `ReplicaSet` is created with updated pod(s).
211
+
212
+
1. Verify that only the `ratings-v1` pod now shows "2/2" containers "READY", indicating that the sidecar has been successfully injected:
213
+
```
214
+
oc get pods -n bookinfo
215
+
NAME READY STATUS RESTARTS AGE
216
+
details-v1-559cd49f6c-b89hw 1/1 Running 0 42m
217
+
productpage-v1-5f48cdcb85-8ppz5 1/1 Running 0 42m
218
+
ratings-v1-848bf79888-krdch 2/2 Running 0 9s
219
+
reviews-v1-6b7444ffbd-7m5wp 1/1 Running 0 42m
220
+
reviews-v2-67876d7b7-9nmw5 1/1 Running 0 42m
221
+
reviews-v3-84b55b667c-x5t8s 1/1 Running 0 42m
222
+
```
223
+
224
+
1. Repeat forother workloads that you wish to includein the mesh.
0 commit comments