Merge pull request #28948 from JStickler/OSSMDOC-199

OSSMDOC-199 Release Notes for 1.1.12 and 2.0.2 releases.

Author: neal-timpe

jaeger/rhbjaeger-release-notes.adoc

@@ -9,6 +9,10 @@ toc::[]
 
 include::modules/jaeger-product-overview.adoc[leveloffset=+1]
 
+== Making open source more inclusive
+
+Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see link:https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language[our CTO Chris Wright's message].
+
 include::modules/support.adoc[leveloffset=+1]
 
 include::modules/jaeger-rn-new-features.adoc[leveloffset=+1]

modules/jaeger-rn-fixed-issues.adoc

@@ -15,4 +15,12 @@ Fix - What did we change to fix the problem?
 Result - How has the behavior changed as a result?  Try to avoid “It is fixed” or “The issue is resolved” or “The error no longer presents”.
 ////
 
+* link:https://issues.redhat.com/browse/TRACING-1725[TRACING-1725] Follow-up to TRACING-1631.  Additional fix to ensure that Elasticsearch certificates are properly reconciled when there are multiple Jaeger production instances, using same name but within different namespaces.   See also link:https://bugzilla.redhat.com/show_bug.cgi?id=1918920[BZ-1918920].
+
 * link:https://issues.jboss.org/browse/TRACING-1631[TRACING-1631] Multiple Jaeger production instances, using same name but within different namespaces, causing Elasticsearch certificate issue.  When multiple service meshes were installed, all of the Jaeger Elasticsearch instances had the same Elasticsearch secret instead of individual secrets, which prevented the Elasticsearch Operator from communicating with all of the Elasticsearch clusters.
+
+* link:https://issues.redhat.com/browse/TRACING-1300[TRACING-1300] Failed connection between Agent and Collector when using Istio sidecar. An update of the Jaeger Operator enabled TLS communication by default between a Jaeger sidecar agent and the Jaeger Collector.
+
+* link:https://issues.redhat.com/browse/TRACING-1208[TRACING-1208] Authentication "500 Internal Error" when accessing Jaeger UI. When trying to authenticate to the UI using OAuth, I get a 500 error because oauth-proxy sidecar doesn't trust the custom CA bundle defined at installation time with the `additionalTrustBundle`.
+
+* link:https://issues.redhat.com/browse/TRACING-1166[TRACING-1166] It is not currently possible to use the Jaeger streaming strategy within a disconnected environment. When a Kafka cluster is being provisioned, it results in a error: `Failed to pull image registry.redhat.io/amq7/amq-streams-kafka-24-rhel7@sha256:f9ceca004f1b7dccb3b82d9a8027961f9fe4104e0ed69752c0bdd8078b4a1076`.

modules/jaeger-rn-known-issues.adoc

@@ -23,7 +23,6 @@ These limitations exist in Jaeger:
 
 These are the known issues in Jaeger:
 
-* link:https://issues.redhat.com/browse/TRACING-1166[TRACING-1166] It is not currently possible to use the Jaeger streaming strategy within a disconnected environment. When a Kafka cluster is being provisioned, it results in a error: `Failed to pull image registry.redhat.io/amq7/amq-streams-kafka-24-rhel7@sha256:f9ceca004f1b7dccb3b82d9a8027961f9fe4104e0ed69752c0bdd8078b4a1076`.
+* link:https://bugzilla.redhat.com/show_bug.cgi?id=1918920[BZ-1918920] The Elasticsearch pods does not get restarted automatically after an update.  As a workaround, restart the pods manually.
 
 * link:https://issues.redhat.com/browse/TRACING-809[TRACING-809] Jaeger Ingester is incompatible with Kafka 2.3. When there are two or more instances of the Jaeger Ingester and enough traffic it will continuously generate rebalancing messages in the logs.  This is due to a regression in Kafka 2.3 that was fixed in Kafka 2.3.1.  For more information, see https://github.com/jaegertracing/jaeger/issues/1819[Jaegertracing-1819].
-

modules/ossm-architecture.adoc

@@ -7,14 +7,14 @@
 
 {ProductName} is logically split into a data plane and a control plane:
 
-The *data plane* is a set of intelligent proxies deployed as sidecars. These proxies intercept and control all inbound and outbound network communication between microservices in the service mesh. 
+The *data plane* is a set of intelligent proxies deployed as sidecars. These proxies intercept and control all inbound and outbound network communication between microservices in the service mesh.
 
 * *Envoy proxy* intercepts all inbound and outbound traffic for all services in the service mesh. Envoy is deployed as a sidecar to the relevant service in the same pod.
 
 The *control plane* manages and configures Istiod to enforce proxies to route traffic.
 
 Istiod provides service discovery, configuration and certificate management. It converts high-level routing rules to Envoy configurations and propagates them to the sidecars at runtime.
 
-Security Discovery Service (SDS) distributes certificates and keys to sidecars directly from Istiod.
+Secret Discovery Service (SDS) distributes certificates and keys to sidecars directly from Istiod.
 
 {ProductName} also uses the *istio-operator* to manage the installation of the control plane. An _Operator_ is a piece of software that enables you to implement and automate common activities in your OpenShift cluster. It acts as a controller, allowing you to set or change the desired state of objects in your cluster.

modules/ossm-rn-deprecated-features-1x.adoc

@@ -15,7 +15,7 @@ Deprecated functionality is still included in {product-title} and continues to b
 
 == Deprecated features {ProductName} 1.1.5
 
-The following custom resources are deprecated in this release and will be removed in a future release.
+The following custom resources were deprecated in release 1.1.5 and were removed in release 1.1.12
 
 * `Policy` - The `Policy` resource is deprecated and will be replaced by the `PeerAuthentication` resource in a future release.
 * `MeshPolicy` - The `MeshPolicy` resource is deprecated and will be replaced by the `PeerAuthentication` resource in a future release.

modules/ossm-rn-deprecated-features.adoc

@@ -15,7 +15,7 @@ Deprecated functionality is still included in {product-title} and continues to b
 
 == Deprecated features {ProductName} 2.0
 
-The Mixer component is deprecated and will be removed in a future release.  While using Mixer for implementing extensions is still supported in release 2.0, you should be migrating your extensions to the new link:https://istio.io/latest/blog/2020/wasm-announce/[WebAssembly] mechanism.
+The Mixer component was deprecated in release 2.0 and will be removed in release 2.1.  While using Mixer for implementing extensions was still supported in release 2.0, extensions should have been migrated to the new link:https://istio.io/latest/blog/2020/wasm-announce/[WebAssembly] mechanism.
 
 The following resource types are no longer supported in {ProductName} 2.0:
 

modules/ossm-rn-fixed-issues-1x.adoc

@@ -19,43 +19,6 @@ The following issues been resolved in the current release:
 [id="ossm-rn-fixed-issues-ossm_{context}"]
 == {ProductShortName} fixed issues
 
-* link:https://issues.redhat.com/browse/MAISTRA-1352[MAISTRA-1352] Cert-manager Custom Resource Definitions (CRD) from the control plane installation have been removed for this release and future releases. If you have already installed {ProductName}, the CRDs must be removed manually if cert-manager is not being used.
-+
-To remove the CRDs, run the following commands:
-+
-[source,terminal]
-----
-$ oc delete crd clusterissuers.certmanager.k8s.io
-----
-+
-[source,terminal]
-----
-$ oc delete crd issuers.certmanager.k8s.io
-----
-+
-[source,terminal]
-----
-$ oc delete crd certificates.certmanager.k8s.io
-----
-+
-[source,terminal]
-----
-$ oc delete crd orders.certmanager.k8s.io
-----
-+
-[source,terminal]
-----
-$ oc delete crd challenges.certmanager.k8s.io
-----
-
-* link:https://issues.redhat.com/projects/MAISTRA/issues/MAISTRA-1649[MAISTRA-1649] Headless services conflict when in different namespaces. When deploying headless services within different namespaces the endpoint configuration is merged and results in invalid Envoy configurations being pushed to the sidecars.
-
-* link:https://issues.redhat.com/browse/MAISTRA-1541[MAISTRA-1541] Panic in kubernetesenv when the controller is not set on owner reference. If a pod has an ownerReference which does not specify the controller, this will cause a panic within the `kubernetesenv cache.go` code.
-
-* link:https://issues.redhat.com/browse/TRACING-1300[TRACING-1300] Failed connection between Agent and Collector when using Istio sidecar. An update of the Jaeger Operator enabled TLS communication by default between a Jaeger sidecar agent and the Jaeger Collector.
-
-* link:https://issues.redhat.com/browse/TRACING-1208[TRACING-1208] Authentication "500 Internal Error" when accessing Jaeger UI. When trying to authenticate to the UI using OAuth, I get a 500 error because oauth-proxy sidecar doesn't trust the custom CA bundle defined at installation time with the additionalTrustBundle.
-
 * link:https://issues.jboss.org/browse/OSSM-99[OSSM-99] Workloads generated from direct Pod without labels may crash Kiali.
 
 * link:https://issues.jboss.org/browse/OSSM-93[OSSM-93] IstioConfigList can't filter by two or more names.
@@ -65,6 +28,12 @@ $ oc delete crd challenges.certmanager.k8s.io
 * link:https://issues.jboss.org/browse/OSSM-90[OSSM-90] Traces not available on the service details page.
 
 [id="ossm-rn-fixed-issues-maistra_{context}"]
+* link:https://issues.redhat.com/projects/MAISTRA/issues/MAISTRA-1649[MAISTRA-1649] Headless services conflict when in different namespaces. When deploying headless services within different namespaces the endpoint configuration is merged and results in invalid Envoy configurations being pushed to the sidecars.
+
+* link:https://issues.redhat.com/browse/MAISTRA-1541[MAISTRA-1541] Panic in kubernetesenv when the controller is not set on owner reference. If a pod has an ownerReference which does not specify the controller, this will cause a panic within the `kubernetesenv cache.go` code.
+
+* link:https://issues.redhat.com/browse/MAISTRA-1352[MAISTRA-1352] Cert-manager Custom Resource Definitions (CRD) from the control plane installation have been removed for this release and future releases. If you have already installed {ProductName}, the CRDs must be removed manually if cert-manager is not being used.
+
 * link:https://issues.jboss.org/browse/MAISTRA-1001[MAISTRA-1001] Closing HTTP/2 connections could lead to segmentation faults in `istio-proxy`.
 
 * link:https://issues.jboss.org/browse/MAISTRA-932[MAISTRA-932] Added the `requires` metadata to add dependency relationship between Jaeger operator and Elasticsearch operator. Ensures that when the Jaeger operator is installed, it automatically deploys the Elasticsearch operator if it is not available.
@@ -83,6 +52,10 @@ $ oc delete crd challenges.certmanager.k8s.io
 
 * link:https://issues.jboss.org/browse/MAISTRA-348[MAISTRA-348] OpenShift 4 Beta on AWS does not support ingress gateway traffic on ports other than 80 or 443.  If you configure your ingress gateway to handle TCP traffic with a port number other than 80 or 443, you have to use the service hostname provided by the AWS load balancer rather than the OpenShift router as a workaround.
 
+* link:https://issues.jboss.org/browse/MAISTRA-193[MAISTRA-193] Unexpected console info messages are visible when health checking is enabled for citadel.
+
+* link:https://bugzilla.redhat.com/show_bug.cgi?id=1821432[Bug 1821432] Toggle controls in {product-title} Control Resource details page do not update the CR correctly. UI Toggle controls in the Service Mesh Control Plane (SMCP) Overview page in the {product-title} web console sometimes update the wrong field in the resource. To update a ServiceMeshControlPlane resource, edit the YAML content directly or update the resource from the command line instead of clicking the toggle controls.
+
 [id="ossm-rn-fixed-issues-kiali_{context}"]
 == Kiali fixed issues
 

modules/ossm-rn-fixed-issues.adoc

@@ -19,6 +19,14 @@ The following issues been resolved in the current release:
 [id="ossm-rn-fixed-issues-ossm_{context}"]
 == {ProductShortName} fixed issues
 
+* link:https://issues.redhat.com/browse/OSSM-296[OSSM-296] When adding health configuration to the Kiali custom resource (CR) is it not being replicated to the Kiali configmap.
+
+* link:https://issues.redhat.com/browse/OSSM-291[OSSM-291] In the Kiali console, on the Applications, Services, and Workloads pages, the "Remove Label from Filters" function is not working.
+
+* link:https://issues.redhat.com/browse/OSSM-289[OSSM-289] In the Kiali console, on the Service Details pages for the 'istio-ingressgateway' and 'jaeger-query' services there are no Traces being displayed. The traces exist in Jaeger.
+
+* link:https://issues.redhat.com/browse/OSSM-287[OSSM-287] In the Kiali console there are no traces being displayed on the Graph Service.
+
 * link:https://issues.redhat.com/browse/MAISTRA-2010[MAISTRA-2010] AuthorizationPolicy does not support `request.regex.headers` field. The `validatingwebhook` rejects any AuthorizationPolicy with the field, and even if you disable that, Pilot tries to validate it using the same code, and it does not work.
 
 * link:https://issues.jboss.org/browse/MAISTRA-1979[MAISTRA-1979] _Migration to 2.0_ The conversion webhook drops the following important fields when converting `SMCP.status` from v2 to v1:
@@ -32,8 +40,17 @@ Upgrading the operator to 2.0 might break client tools that read the SMCP status
 +
 This also causes the READY and STATUS columns to be empty when you run `oc get servicemeshcontrolplanes.v1.maistra.io`.
 
-* link:https://issues.redhat.com/browse/MAISTRA-1983[MAISTRA-1983] Upgrading to 2.0.0 with an existing invalid `ServiceMeshControlPlane` cannot easily be repaired. The invalid items in the `ServiceMeshControlPlane` resource caused an unrecoverable error. The fix makes the errors recoverable. You can delete the invalid resource and replace it with a new one or edit the resource to fix the errors. For more information about editing your resource, see [Configuring the Red Hat OpenShift Service Mesh installation].
+* link:https://issues.jboss.org/browse/MAISTRA-1089[MAISTRA-1089] _Migration to 2.0_ Gateways created in a non-control plane namespace are automatically deleted.  Users will need to manually delete these resources after removing the gateway definition from the SMCP spec.
+
+* link:https://issues.redhat.com/browse/MAISTRA-1983[MAISTRA-1983]  _Migration to 2.0_ Upgrading to 2.0.0 with an existing invalid `ServiceMeshControlPlane` cannot easily be repaired. The invalid items in the `ServiceMeshControlPlane` resource caused an unrecoverable error. The fix makes the errors recoverable. You can delete the invalid resource and replace it with a new one or edit the resource to fix the errors. For more information about editing your resource, see [Configuring the Red Hat OpenShift Service Mesh installation].
 
 * link:https://issues.redhat.com/browse/MAISTRA-1502[Maistra-1502] As a result of CVEs fixes in version 1.0.10, the Istio dashboards are not available from the *Home Dashboard* menu in Grafana. The Istio dashboards still exist. To access them, click the *Dashboard* menu in the navigation panel and select the *Manage* tab.
 
+* link:https://issues.jboss.org/browse/MAISTRA-858[MAISTRA-858] The following Envoy log messages describing link:https://www.envoyproxy.io/docs/envoy/latest/intro/deprecated[deprecated options and configurations associated with Istio 1.1.x] are expected:
++
+** [2019-06-03 07:03:28.943][19][warning][misc] [external/envoy/source/common/protobuf/utility.cc:129] Using deprecated option 'envoy.api.v2.listener.Filter.config'. This configuration will be removed from Envoy soon.
+** [2019-08-12 22:12:59.001][13][warning][misc] [external/envoy/source/common/protobuf/utility.cc:174] Using deprecated option 'envoy.api.v2.Listener.use_original_dst' from file lds.proto. This configuration will be removed from Envoy soon.
+
+* link:https://issues.jboss.org/browse/MAISTRA-193[MAISTRA-193] Unexpected console info messages are visible when health checking is enabled for citadel.
+
 * link:https://bugzilla.redhat.com/show_bug.cgi?id=1821432[Bug 1821432] Toggle controls in {product-title} Control Resource details page do not update the CR correctly. UI Toggle controls in the Service Mesh Control Plane (SMCP) Overview page in the {product-title} web console sometimes update the wrong field in the resource. To update a SMCP, edit the YAML content directly or update the resource from the command line instead of clicking the toggle controls.

modules/ossm-rn-known-issues-1x.adoc

@@ -26,10 +26,6 @@ These limitations exist in {ProductName}:
 
 These are the known issues in {ProductName}:
 
-* link:https://issues.redhat.com/browse/MAISTRA-1502[Maistra-1502] As a result of CVEs fixes in version 1.0.10, the Istio dashboards are not available from the *Home Dashboard* menu in Grafana. The Istio dashboards still exist. To access them, click the *Dashboard* menu in the navigation panel and select the *Manage* tab.
-
-* link:https://bugzilla.redhat.com/show_bug.cgi?id=1821432[Bug 1821432] Toggle controls in {product-title} Control Resource details page do not update the CR correctly. UI Toggle controls in the Service Mesh Control Plane (SMCP) Overview page in the {product-title} web console sometimes update the wrong field in the resource. To update a SMCP, edit the YAML content directly or update the resource from the command line instead of clicking the toggle controls.
-
 * link:https://access.redhat.com/solutions/4970771[Jaeger/Kiali Operator upgrade blocked with operator pending] When upgrading the Jaeger or Kiali Operators with Service Mesh 1.0.x installed, the operator status shows as Pending. There is a solution in progress and a workaround. See the linked Knowledge Base article for more information.
 
 * link:https://github.com/istio/istio/issues/14743[Istio-14743] Due to limitations in the version of Istio that this release of {ProductName} is based on, there are several applications that are currently incompatible with {ProductShortName}. See the linked community issue for details.
@@ -49,15 +45,18 @@ If the `istio-operator` pod is evicted while deploying the control pane, delete
 
 * link:https://issues.jboss.org/browse/MAISTRA-453[MAISTRA-453] If you create a new project and deploy pods immediately, sidecar injection does not occur. The operator fails to add the `maistra.io/member-of` before the pods are created, therefore the pods must be deleted and recreated for sidecar injection to occur.
 
-* link:https://issues.jboss.org/browse/MAISTRA-193[MAISTRA-193] Unexpected console info messages are visible when health checking is enabled for citadel.
-
 * link:https://issues.jboss.org/browse/MAISTRA-158[MAISTRA-158] Applying multiple gateways referencing the same hostname will cause all gateways to stop functioning.
 
 
 
 [id="ossm-rn-known-issues-kiali_{context}"]
 == Kiali known issues
 
+[NOTE]
+====
+New issues for Kiali should be created in the link:https://issues.redhat.com/projects/OSSM/[OpenShift Service Mesh]  project with the `Component` set to `Kiali`.
+====
+
 These are the known issues in Kiali:
 
 * link:https://issues.jboss.org/browse/KIALI-2206[KIALI-2206] When you are accessing the Kiali console for the first time, and there is no cached browser data for Kiali, the “View in Grafana” link on the Metrics tab of the Kiali Service Details page redirects to the wrong location. The only way you would encounter this issue is if you are accessing Kiali for the first time.