Skip to content

Commit 1afe60e

Browse files
kcarmichael08kcarmichael08
authored
Merge pull request #90090 from openshift-cherrypick-robot/cherry-pick-89488-to-service-mesh-docs-3.0
[service-mesh-docs-3.0] OSSM-8986: Cluster-wide migration using istio injection label with ce…
2 parents eacc3c8 + 3e53edf commit 1afe60e

4 files changed

+396
-8
lines changed

‎migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,7 @@ include::modules/ossm-control-plane-configuration-migration-requirements.adoc[le
3030
3131
include::modules/ossm-cluster-wide-migration-methods.adoc[leveloffset=+1]
3232

33-
3433
// The following tasks are for migration using the Istio revision label
35-
3634
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-revision-label.adoc[leveloffset=+1]
3735

3836
include::modules/ossm-migrating-workloads-using-the-istio-revision-label.adoc[leveloffset=+2]
@@ -47,7 +45,7 @@ If you are not using gateways, and have verified your cluster-wide migration, yo
4745

4846
* xref:../../migrating/done/ossm-migrating-complete-assembly.adoc[Completing the Migration]
4947
50-
//The following tasks are for the Istio revision label with cert-manager
48+
//The following tasks are for migrating using the Istio revision label with cert-manager
5149
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-revision-label-with-cert-manager.adoc[leveloffset=+1]
5250

5351
include::modules/ossm-migrating-workloads-using-the-istio-revision-label-with-cert-manager.adoc[leveloffset=+2]
@@ -62,7 +60,7 @@ If you are not using gateways, and have verified your cluster-wide migration, yo
6260

6361
* xref:../../migrating/done/ossm-migrating-complete-assembly.adoc[Completing the Migration]
6462
65-
// The following tasks are for the Istio injection label
63+
// The following tasks are for migrating using the Istio injection label
6664

6765
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label.adoc[leveloffset=+1]
6866

@@ -72,9 +70,10 @@ include::modules/ossm-migrating-workloads-using-the-istio-injection-label.adoc[l
7270

7371
If you are using gateways, you must migrate them before you complete the migration process.
7472

75-
* xref:../../migrating/migrating-gateways/ossm-migrating-gateways-assembly.adoc[Migrating gateways from Service Mesh 2 to Service Mesh 3]
73+
* Migrating gateways from Service Mesh 2 to Service Mesh 3
74+
//* xref:../../migrating/migrating-gateways/ossm-migrating-gateways-assembly.adoc#ossm-migrating-gateways-assembly[Migrating gateways from Service Mesh 2 to Service Mesh 3]
7675
77-
If you are not using gateways, and have verified your cluster-wide migration, create a default revision tag and re-label namespaces.
76+
If you are not using gateways, and have verified your cluster-wide migration, create a default revision tag and relabel namespaces.
7877

7978
include::modules/ossm-creating-a-default-revision-tag-and-relabeling-the-namespaces.adoc[leveloffset=+2]
8079

@@ -89,9 +88,28 @@ You can proceed to complete the migration and remove {SMProduct} 2 resources.
8988
Before creating a default revision tag and relabelling the namespaces, you must migrate all remaining workload namespaces, including gateways.
9089
====
9190

92-
// insert xref to "Creating the default revision tag and relabeling the namespaces" after PR OSSM-9000 is merged
91+
// The following tasks are for migration using the Istio injection label with cert-manager
92+
93+
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label-with-cert-manager.adoc[leveloffset=+1]
94+
95+
include::modules/ossm-migrating-workloads-using-the-istio-injection-label-with-cert-manager.adoc[leveloffset=+2]
96+
97+
.Next steps
98+
99+
If you are using gateways, you must migrate them before you complete the migration process.
100+
101+
* Migrating gateways from Service Mesh 2 to Service Mesh 3
102+
//* xref:../../migrating/migrating-gateways/ossm-migrating-gateways-assembly.adoc#ossm-migrating-gateways-assembly[Migrating gateways from Service Mesh 2 to Service Mesh 3]
103+
104+
If you are not using gateways, and have verified your cluster-wide migration, create a default revision tag and relabel namespaces.
105+
106+
[IMPORTANT]
107+
====
108+
Before creating a default revision tag and relabelling the namespaces, you must migrate all remaining workload namespaces, including gateways.
109+
====
110+
111+
include::modules/ossm-creating-a-default-revision-tag-and-relabeling-the-namespaces-with-cert-manager.adoc[leveloffset=+2]
93112

94-
* Creating the default revision tag and relabeling the namespaces
95113
[role="_additional-resources"]
96114
.Additional resources
97115

‎modules/ossm-creating-a-default-revision-tag-and-relabeling-the-namespaces-with-cert-manager.adoc

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-creating-a-default-revision-tag-and-relabeling-the-namespaces-with-cert-manager_{context}"]
7+
= Creating the default revision tag and relabeling the namespaces with cert manager
8+
9+
You can create the default revision tag and relabel the namespaces after you have completed the {SMProduct} 2 to {SMProduct} 3 cluster-wide migration process by using the {istio} injection label.
10+
11+
The `bookinfo` application is used as an example.
12+
13+
.Prerequisites
14+
15+
* You have completed the {SMProduct} 2 to {SMProduct} 3 cluster-wide migration process by using {istio} injection label.
16+
17+
.Procedure
18+
19+
. Create a YAML file called `rev-tag.yaml` that defines the `IstioRevisionTag` resource:
20+
+
21+
.Example `IstioRevisionTag` resource
22+
[source,yaml,subs="attributes,verbatim"]
23+
----
24+
apiVersion: sailoperator.io/v1
25+
kind: IstioRevisionTag
26+
metadata:
27+
name: default
28+
spec:
29+
targetRef:
30+
kind: IstioRevision
31+
name: ossm-3-v1-24-3
32+
----
33+
34+
. Apply the YAML file by running the following command:
35+
+
36+
[source,terminal]
37+
----
38+
$ oc apply -f rev-tag.yaml
39+
----
40+
41+
. Verify the status of the `IstioRevisionTag` resource by running the following command:
42+
+
43+
[source,terminal]
44+
----
45+
$ oc get istiorevisiontags
46+
----
47+
+
48+
.Example output
49+
[source,terminal]
50+
----
51+
NNAME STATUS IN USE REVISION AGE
52+
default NotReferencedByAnything False ossm-3-v1-24-3 18s
53+
----
54+
55+
. Add the `istio-injection=enabled` label to the `bookinfo` namespace, and remove the `istio.io/rev` label by running the following command:
56+
+
57+
[source,terminal]
58+
----
59+
$ oc label ns bookinfo istio-injection=enabled istio.io/rev-
60+
----
61+
+
62+
[NOTE]
63+
====
64+
Remove the `maistra.io/ignore-namespace="true"` label only after the 2.6 control plane has been uninstalled.
65+
====
66+
67+
. Restart the workloads by running the following command:
68+
+
69+
[source,terminal]
70+
----
71+
$ oc rollout restart deployments -n bookinfo
72+
----
73+
+
74+
[NOTE]
75+
====
76+
Repeat steps 4 and 5 for each namespace you are migrating.
77+
====
78+
79+
.Verification
80+
81+
. Verify that the `IstioRevisionTag` resource is in use by running the following command:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc get istiorevisiontags
86+
----
87+
+
88+
.Example output
89+
[source,terminal]
90+
----
91+
NAME STATUS IN USE REVISION AGE
92+
default Healthy True ossm-3-v1-24-3 28s
93+
----
94+
95+
. Ensure that expected workloads are managed by the new control plane by running the following command:
96+
+
97+
[source,terminal]
98+
----
99+
$ istioctl ps -n bookinfo
100+
----
101+
+
102+
.Example output
103+
[source,terminal]
104+
----
105+
NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION
106+
details-v1-79dfbd6fff-t5lzm.bookinfo Kubernetes SYNCED (57s) SYNCED (57s) SYNCED (3s) SYNCED (57s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
107+
details-v1-7cb48d8bb-6rjq8.bookinfo Kubernetes SYNCED (3s) SYNCED (3s) SYNCED (3s) SYNCED (3s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
108+
productpage-v1-7d9cdf655d-cqk48.bookinfo Kubernetes SYNCED (10s) SYNCED (10s) SYNCED (3s) SYNCED (10s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
109+
ratings-v1-5b67b59fcb-w4whk.bookinfo Kubernetes SYNCED (18s) SYNCED (18s) SYNCED (3s) SYNCED (18s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
110+
reviews-v1-585fc84dbb-fvm2h.bookinfo Kubernetes SYNCED (11s) SYNCED (11s) SYNCED (3s) SYNCED (11s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
111+
reviews-v2-65cb66b45c-6ggp9.bookinfo Kubernetes SYNCED (57s) SYNCED (57s) SYNCED (3s) SYNCED (57s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
112+
reviews-v2-698b86b848-v92xq.bookinfo Kubernetes SYNCED (3s) SYNCED (3s) SYNCED (3s) SYNCED (3s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
113+
reviews-v3-6cbc49c8c8-v4jck.bookinfo Kubernetes SYNCED (11s) SYNCED (11s) SYNCED (3s) SYNCED (11s) IGNORED istiod-ossm-3-v1-24-3-6595bf8695-s8ktn 1.24.3
114+
----

‎modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label-with-cert-manager.adoc

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label-with-cert-manager_{context}"]
7+
= Migrating a cluster-wide deployment by using the Istio injection label with cert-manager
8+
9+
You can perform a canary upgrade with the gradual migration of data plane namespaces for a cluster-wide deployment by using the `istio-injection=enabled` label and the `default` revision tag.
10+
11+
You must relabel all of the data plane namespaces. However, it is safe to restart any of the workloads at any point during the migration process.
12+
13+
The `bookinfo` application is used as an example for the `Istio` resource. For more information about configuration differences between the {SMProduct} 2 `ServiceMeshControlPlane` resource and the {SMProduct} 3 `Istio` resource, see "ServiceMeshControlPlane resource to Istio resource fields mapping".
14+
15+
.Prerequisites
16+
17+
* You have deployed {ocp-product-title} 4.14 or later.
18+
* You have logged in to the {ocp-product-title} web console as a user with the `cluster-admin` role.
19+
* You have completed the premigration checklists.
20+
* You have the {SMProduct} {SMv2Version} Operator installed.
21+
* You have the {SMProduct} 3 Operator installed.
22+
* You have created an `IstioCNI` resource.
23+
* You have installed the `istioctl` tool.
24+
* You are using the cert-manager and istio-csr tools in a cluster-wide deployment.
25+
* Your {SMProduct} {SMv2Version} `ServiceMeshControlPlane` resource is configured with the cert-manager tool.
26+
* You have installed the `bookinfo` application.
27+
28+
.Procedure
29+
30+
. Check that your {SMProduct} 2 `ServiceMeshControlPlane` resource is configured with the cert-manager-tool:
31+
+
32+
.Example `ServiceMeshControlPlane` cert-manager configuration
33+
[source,yaml]
34+
----
35+
apiVersion: maistra.io/v2
36+
kind: ServiceMeshControlPlane
37+
metadata:
38+
name: basic
39+
namespace: istio-system
40+
spec:
41+
...
42+
security:
43+
certificateAuthority:
44+
cert-manager:
45+
address: cert-manager-istio-csr.istio-system.svc:443
46+
type: cert-manager
47+
dataPlane:
48+
mtls: true
49+
identity:
50+
type: ThirdParty
51+
manageNetworkPolicy: false
52+
----
53+
54+
. Update the `istio-csr` deployment to include your {SMProduct} 3 control plane by running the following command:
55+
+
56+
[source,terminal]
57+
----
58+
helm upgrade cert-manager-istio-csr jetstack/cert-manager-istio-csr \
59+
--install \
60+
--reuse-values \
61+
--namespace istio-system \
62+
--wait \
63+
--set "app.istio.revisions={basic,ossm-3-v1-24-3}" <1>
64+
----
65+
+
66+
<1> The `app.istio.revisions` field needs to include your {SMProduct} 3.0 control plane revision _before_ you create your `Istio` resource so that proxies can properly communicate with the {SMProduct} 3.0 control plane.
67+
68+
. Identify the namespaces that contain a 2.6 control plane by running the following command:
69+
+
70+
[source,terminal]
71+
----
72+
$ oc get smcp -A
73+
----
74+
+
75+
.Example output:
76+
[source,terminal]
77+
----
78+
NAMESPACE NAME READY STATUS PROFILES VERSION AGE
79+
istio-system install-istio-system 6/6 ComponentsReady ["default"] 2.6.6 115m
80+
----
81+
82+
. Create a YAML file named `ossm-3.yaml`. This procedure creates the {istio} resource for the 3.0 installation in the same namespace as the `ServiceMeshControlPlane` resource for the 2.6 installation.
83+
+
84+
[NOTE]
85+
====
86+
In the following example configuration, the {istio} control plane has access to all namespaces on the cluster. If you want to limit the namespaces the control plan has access to, you must define discovery selectors. You must match all the data plane namespaces that you plan to migrate from version 2.6.
87+
====
88+
+
89+
.Example `Istio` resource
90+
[source,yaml,subs="attributes,verbatim"]
91+
----
92+
apiVersion: sailoperator.io/v1
93+
kind: Istio
94+
metadata:
95+
name: ossm-3 # <1>
96+
spec:
97+
updateStrategy:
98+
type: RevisionBased
99+
namespace: istio-system # <2>
100+
version: v1.24.3
101+
values:
102+
meshConfig:
103+
extensionProviders: # <3>
104+
- name: prometheus
105+
prometheus: {}
106+
- name: otel
107+
opentelemetry:
108+
port: 4317
109+
service: otel-collector.opentelemetrycollector-3.svc.cluster.local
110+
global:
111+
caAddress: cert-manager-istio-csr.istio-system.svc:443
112+
pilot:
113+
env:
114+
ENABLE_CA_SERVER: "false"
115+
----
116+
<1> The `name`, `updateStrategy`, and `version` fields specify how the `IstioRevision` resource name is created. For more information, see "Identifying the revision name".
117+
<2> The 3.0 and 2.6 control planes must run in the same namespace.
118+
<3> If you are migrating metrics and tracing, update the `extensionProviders` fields according to your tracing and metrics configurations.
119+
+
120+
[NOTE]
121+
====
122+
The proxies with the `istio-injection=enabled` label applied and are still managed by {SMProduct} 2.6 control plane. To prevent the {SMProduct} 3.0 control plane from injecting proxies in the namespaces that are still managed by {SMProduct} 2.6 control plane, do not use the default name for the Istio resource, and do not create the default revision tag in the following steps. You create the default revision tag later in this procedure.
123+
====
124+
125+
. Apply the YAML file by running the following command:
126+
+
127+
[source,terminal]
128+
----
129+
$ oc apply -f ossm-3.yaml
130+
----
131+
132+
. Verify that the new `istiod` resource uses the existing root certificate by running the following command:
133+
+
134+
[source,terminal]
135+
----
136+
$ oc logs deployments/istiod-ossm-3-v1-24-3 -n istio-system | grep 'Load signing key and cert from existing secret'
137+
----
138+
+
139+
.Example output:
140+
[source,terminal]
141+
----
142+
2024-12-18T08:13:53.788959Z info pkica Load signing key and cert from existing secret istio-system/istio-ca-secret
143+
----

0 commit comments

Comments
 (0)