Skip to content

Commit 757c40d

Browse files
JSticklerJStickler
authored
Merge pull request #36045 from JStickler/OSSMDOC-394
OSSMDOC-394: Misc Federation topics.
2 parents 8426788 + 5e1b874 commit 757c40d

6 files changed

+119
-5
lines changed

‎modules/ossm-federation-across-cluster.adoc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
////
2+
This module included in the following assemblies:
3+
* service_mesh/v2x/ossm-federation.adoc
4+
////
5+
6+
[id="ossm-federation-across-clusters_{context}"]
7+
= Mesh federation across clusters
8+
9+
To connect one instance of the OpenShift Service Mesh with one running in a different cluster, the procedure is not much different as when connecting two meshes deployed in the same cluster. However, the ingress gateway of one mesh must be reachable from the other mesh. One way of ensuring this is to configure the gateway service as a `LoadBalancer` service if the cluster supports this type of service.
10+
11+
The service must be exposed through a load balancer that operates at Layer4 of the OSI model.
12+
13+
== Exposing the federation ingress on clusters running on bare metal
14+
If the cluster runs on bare metal and fully supports `LoadBalancer` services, the IP address found in the `.status.loadBalancer.ingress.ip` field of the ingress gateway `Service` object should be specified as one of the entries in the `.spec.remote.addresses` field of the `ServiceMeshPeer` object.
15+
16+
If the cluster does not support `LoadBalancer` services, using a `NodePort` service could be an option if the nodes are accessible from the cluster running the other mesh. In the `ServiceMeshPeer` object, specify the IP addresses of the nodes in the `.spec.remote.addresses` field and the service's node ports in the `.spec.remote.discoveryPort` and `.spec.remote.servicePort` fields.
17+
18+
== Exposing the federation ingress on Amazon Web Services (AWS)
19+
By default, LoadBalancer services in clusters running on AWS do not support L4 load balancing. In order for {ProductName} federation to operate correctly, the following annotation must be added to the ingress gateway service:
20+
21+
service.beta.kubernetes.io/aws-load-balancer-type: nlb
22+
23+
The Fully Qualified Domain Name found in the `.status.loadBalancer.ingress.hostname` field of the ingress gateway `Service` object should be specified as one of the entries in the `.spec.remote.addresses` field of the `ServiceMeshPeer` object.
24+
25+
== Exposing the federation ingress on Azure
26+
On Microsoft Azure, merely setting the service type to `LoadBalancer` suffices for mesh federation to operate correctly.
27+
28+
The IP address found in the `.status.loadBalancer.ingress.ip` field of the ingress gateway `Service` object should be specified as one of the entries in the `.spec.remote.addresses` field of the `ServiceMeshPeer` object.
29+
30+
== Exposing the federation ingress on Google Cloud Platform (GCP)
31+
On Google Cloud Platform, merely setting the service type to `LoadBalancer` suffices for mesh federation to operate correctly.
32+
33+
The IP address found in the `.status.loadBalancer.ingress.ip` field of the ingress gateway `Service` object should be specified as one of the entries in the `.spec.remote.addresses` field of the `ServiceMeshPeer` object.

‎modules/ossm-federation-checklist.adoc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
////
2+
This module included in the following assemblies:
3+
* service_mesh/v2x/ossm-federation.adoc
4+
////
5+
6+
[id="con-my-concept-module-a_{context}"]
7+
= Federation implementation checklist
8+
9+
Federating services meshes involves the following activities:
10+
11+
* [ ] Configure networking between the clusters that you are going to federate.
12+
13+
** [ ] Configure the load balancers supporting the services associated with the federation gateways to support raw TLS traffic.
14+
15+
* [ ] Installing the {ProductName} version 2.1 Operator in each of your clusters.
16+
17+
* [ ] Deploying a version 2.1 `ServiceMeshControlPlane` to each of your clusters.
18+
19+
* [ ] Configuring the SMCP for federation for each mesh that you want to federate:
20+
21+
** [ ] Create a federation egress gateway for each mesh you are going to federate with
22+
** [ ] Create a federation ingress gateway for each mesh you are going to federate with
23+
** [ ] Configure a unique trust domain
24+
25+
* [ ] Federate two or more meshes by creating a `ServiceMeshPeer` resource for each mesh pair.
26+
27+
* [ ] Export services by creating an `ExportServiceSet` resource to make services available from one mesh to a peer mesh.
28+
29+
* [ ] Import services by creating an `ImportServiceSet` resource to import services shared by a mesh peer.

‎modules/ossm-federation-remove-mesh.adoc

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
////
2+
This module included in the following assemblies:
3+
* service_mesh/v2x/ossm-federation.adoc
4+
////
5+
6+
[id="ossm-federation-remove-mesh_{context}"]
7+
= Removing a mesh from the federated mesh
8+
9+
If you need to remove a mesh from the federation, you can do so.
10+
11+
. Edit the removed mesh's `ServiceMeshControlPlane` resource to remove all federation ingress gateways for peer meshes.
12+
13+
. For each mesh peer that the removed mesh has been federated with:
14+
15+
.. Remove the `ServiceMeshPeer` resource that links the two meshes.
16+
17+
.. Edit the peer mesh's `ServiceMeshControlPlane` resource to remove the egress gateway that serves the removed mesh.

‎modules/ossm-federation-remove-service.adoc

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
////
2+
This module included in the following assemblies:
3+
* service_mesh/v2x/ossm-federation.adoc
4+
////
5+
6+
[id="ossm-federation-remove-service_{context}"]
7+
= Removing a service from the federated mesh
8+
9+
If you need to remove a service from the federated mesh, for example if it has become obsolete or has been replaced by a different service, you can do so.
10+
11+
== To remove a service from a single mesh
12+
13+
Remove the entry for the service from the `ImportedServiceSet` resource for the mesh peer that no longer should access the service.
14+
15+
== To remove a service from the entire federated mesh
16+
17+
Remove the entry for the service from the `ExportedServiceSet` resource for the mesh that owns the service.

‎modules/ossm-federation-security.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
////
2+
This module included in the following assemblies:
3+
* service_mesh/v2x/ossm-federation.adoc
4+
////
5+
6+
[id="ossm-federation-security_{context}"]
7+
= Federation security
8+
9+
Red Hat OpenShift Service Mesh federation takes an opinionated approach to a multi-cluster implementation of Service Mesh that assumes minimal trust between meshes. Data security is built in as part of the federation features.
10+
11+
* Each mesh is considered to be a unique tenant, with a unique administration.
12+
* You create a unique trust domain for each mesh in the federation.
13+
* Traffic between the federated meshes is automatically encrypted using mutual Transport Layer Security (mTLS).
14+
* The Kiali graph only displays your mesh and services that you have imported. You cannot see the other mesh or services that have not been imported into your mesh.

‎service_mesh/v2x/ossm-federation.adoc

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,16 @@ _Federation_ is a deployment model that lets you share services and workloads be
99

1010
// The following include statements pull in the module files that comprise the assembly.
1111

12-
include::modules/ossm-federation-planning.adoc[leveloffset=+2]
12+
include::modules/ossm-federation-overview.adoc[leveloffset=+2]
1313

14-
include::modules/ossm-federation-config-export.adoc[leveloffset=+2]
14+
include::modules/ossm-federation-features.adoc[leveloffset=+2]
1515

16-
include::modules/ossm-federation-create-export.adoc[leveloffset=+3]
16+
include::modules/ossm-federation-security.adoc[leveloffset=+2]
1717

18-
include::modules/ossm-federation-config-import.adoc[leveloffset=+2]
18+
include::modules/ossm-federation-across-cluster.adoc[leveloffset=+2]
1919

20-
include::modules/ossm-federation-create-import.adoc[leveloffset=+3]
20+
include::modules/ossm-federation-checklist.adoc[leveloffset=+2]
21+
22+
include::modules/ossm-federation-remove-service.adoc[leveloffset=+2]
23+
24+
include::modules/ossm-federation-remove-mesh.adoc[leveloffset=+2]

0 commit comments

Comments
 (0)