Skip to content

Commit afbde79

Browse files
JSticklerJStickler
authored
Merge pull request #40433 from rh-tokeefe/OSSMDOC-451
OSSMDOC-451: Service Mesh 2.1.1 Release Notes
2 parents fef17a6 + 34121df commit afbde79

File tree

5 files changed

+114
-32
lines changed

5 files changed

+114
-32
lines changed

‎modules/ossm-config-disable-networkpolicy.adoc

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
////
2+
This module included in the following assemblies:
3+
-v2x/servicemesh-release-notes.adoc
4+
////
5+
6+
[id="ossm-config-disable-networkpolicy_{context}"]
7+
= Disabling network policies
8+
9+
{ProductName} automatically creates and manages a number of `NetworkPolicies` resources in the control plane and application namespaces. This is to ensure that applications and the control plane can communicate with each other.
10+
11+
If you want to disable the automatic creation and management of `NetworkPolicies` resources, for example to enforce company security policies, you can do so. You can edit the `ServiceMeshControlPlane` to set the `spec.security.manageNetworkPolicy` setting to `false`
12+
13+
[NOTE]
14+
====
15+
When you disable `spec.security.manageNetworkPolicy` {ProductName} will not create *any* `NetworkPolicy` objects. The system administrator is responsible for managing the network and fixing any issues this might cause.
16+
====
17+
18+
.Procedure
19+
20+
. In the {product-title} web console, click *Operators* -> *Installed Operators*.
21+
22+
. Select the project where you installed the control plane, for example `istio-system`, from the Project menu.
23+
24+
. Click the {ProductName} Operator. In the *Istio Service Mesh Control Plane* column, click the name of your `ServiceMeshControlPlane`, for example `basic-install`.
25+
26+
. On the *Create ServiceMeshControlPlane Details* page, click `YAML` to modify your configuration.
27+
28+
. Set the `ServiceMeshControlPlane` field `spec.security.manageNetworkPolicy` to `false`, as shown in this example.
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: maistra.io/v2
33+
kind: ServiceMeshControlPlane
34+
spec:
35+
security:
36+
trust:
37+
manageNetworkPolicy: false
38+
----
39+
+
40+
. Click *Save*.

‎modules/ossm-document-attributes.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
:ProductName: Red Hat OpenShift Service Mesh
1616
:ProductShortName: Service Mesh
1717
:ProductRelease:
18-
:ProductVersion: 2.1
18+
:ProductVersion: 2.1.1
1919
:MaistraVersion: 2.0
2020
:product-build:
2121

‎modules/ossm-rn-fixed-issues.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ The following issues been resolved in the current release:
1919
[id="ossm-rn-fixed-issues-ossm_{context}"]
2020
== {ProductShortName} fixed issues
2121

22+
* link:https://issues.redhat.com/browse/OSSM-797[OSSM-797] Kiali Operator pod generates `CreateContainerConfigError` while installing or updating the operator.
23+
24+
* https://issues.redhat.com/browse/OSSM-722[OSSM-722]
25+
Namespace starting with `kube` is hidden from Kiali.
26+
2227
* link:https://issues.redhat.com/browse/OSSM-569[OSSM-569] There is no CPU memory limit for the Prometheus `istio-proxy` container. The Prometheus `istio-proxy` sidecar now uses the resource limits defined in `spec.proxy.runtime.container`.
2328

2429
* link:https://issues.redhat.com/browse/OSSM-449[OSSM-449] VirtualService and Service causes an error "Only unique values for domains are permitted. Duplicate entry of domain."
@@ -33,6 +38,8 @@ The following issues been resolved in the current release:
3338

3439
* link:https://issues.redhat.com/browse/OSSM-287[OSSM-287] In the Kiali console there are no traces being displayed on the Graph Service.
3540

41+
* link:https://issues.jboss.org/browse/MAISTRA-2687[MAISTRA-2687] {ProductName} 2.1 federation gateway does not send the full certificate chain when using external certificates. The {ProductShortName} federation egress gateway only sends the client certificate. Because the federation ingress gateway only knows about the root certificate, it cannot verify the client certificate unless you add the root certificate to the federation import `ConfigMap`.
42+
3643
* link:https://issues.redhat.com/browse/MAISTRA-2635[MAISTRA-2635] Replace deprecated Kubernetes API. To remain compatible with {product-title} 4.8, the `apiextensions.k8s.io/v1beta1` API was deprecated as of {ProductName} 2.0.8.
3744

3845
* link:https://issues.redhat.com/browse/MAISTRA-2631[MAISTRA-2631] The WASM feature is not working because podman is failing due to nsenter binary not being present. {ProductName} generates the following error message: `Error: error configuring CNI network plugin exec: "nsenter": executable file not found in $PATH`. The container image now contains nsenter and WASM works as expected.

‎modules/ossm-rn-known-issues.adoc

Lines changed: 22 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -32,39 +32,32 @@ These are the known issues in {ProductName}:
3232

3333
* link:https://github.com/istio/istio/issues/14743[Istio-14743] Due to limitations in the version of Istio that this release of {ProductName} is based on, there are several applications that are currently incompatible with {ProductShortName}. See the linked community issue for details.
3434

35+
* https://issues.redhat.com/browse/OSSM-882[OSSM-882] Namespace is in the accessible_namespace list but does not appear in Kiali UI. By default, Kiali will not show any namespaces that start with "kube" because these namespaces are typically internal-use only and not part of a mesh.
36+
+
37+
For example, if you create a namespace called 'akube-a' and add it to the Service Mesh member roll, then the Kiali UI does not display the namespace. For defined exclusion patterns, the software excludes namespaces that start with or contain the pattern.
38+
+
39+
The workaround is to change the Kiali Custom Resource setting so it prefixes the setting with a carat (^). For example:
40+
41+
api:
42+
namespaces:
43+
exclude:
44+
- "^istio-operator"
45+
- "^kube-.*"
46+
- "^openshift.*"
47+
- "^ibm.*"
48+
- "^kiali-operator"
49+
3550
* link:https://issues.redhat.com/browse/OSSM-285[OSSM-285] When trying to access the Kiali console, receive the following error message "Error trying to get OAuth Metadata". The workaround is to restart the Kiali pod.
3651

37-
* link:https://issues.redhat.com/browse/MAISTRA-2692[MAISTRA-2692] With Mixer removed, custom metrics that have been defined in {ProductShortName} 2.0.x cannot be used in 2.1. Custom metrics can be configured using `EnvoyFilter`. Red Hat is unable to support `EnvoyFilter` configuration except where explicitly documented. This is due to tight coupling with the underlying Envoy APIs, meaning that backward compatibility cannot be maintained.
52+
* link:https://issues.redhat.com/browse/MAISTRA-2735[MAISTRA-2735] The resources that the Service Mesh Operator deletes when reconciling the SMCP have changed. Previously, the Operator deleted a resource with the following labels:
53+
54+
** `maistra.io/owner`
55+
** `app.kubernetes.io/version`
3856

39-
* link:https://issues.jboss.org/browse/MAISTRA-2687[MAISTRA-2687] {ProductName} 2.1 federation gateway does not send the full certificate chain when using external certificates. The {ProductShortName} federation egress gateway only sends the client certificate. Because the federation ingress gateway only knows about the root certificate, it cannot verify the client certificate unless you add the root certificate to the federation import `ConfigMap`.
40-
+
41-
. To provide both the root certificate and CA certificate when setting the federation import `ConfigMap`:
42-
+
43-
[source,yaml]
44-
----
45-
apiVersion: v1
46-
kind: ConfigMap
47-
metadata:
48-
name: mesh1-ca-root-cert
49-
namespace: mesh2-system
50-
data:
51-
root-cert.pem: |-
52-
{{MESH1_CERT}}
53-
----
54-
+
55-
. Assign the certificate values to the mesh variable:
56-
+
57-
[source,terminal]
58-
----
59-
$ MESH1_CERT=$(cat cacerts/root-cert.pem cacerts/ca-cert.pem | sed ':a;N;$!ba;s/\n/\\\n /g')
60-
----
61-
+
62-
. Insert the certificate information into `ConfigMap` and apply the change:
6357
+
64-
[source,terminal]
65-
----
66-
$ sed "s:{{MESH1_CERT}}:$MESH1_CERT:g" import/configmap.yaml | oc apply -f -
67-
----
58+
Now, the Operator ignores resources that don't also include the `app.kubernetes.io/managed-by=maistra-istio-operator` label. If you create your own resources, you should not add the `app.kubernetes.io/managed-by=maistra-istio-operator` label to them.
59+
60+
* link:https://issues.redhat.com/browse/MAISTRA-2692[MAISTRA-2692] With Mixer removed, custom metrics that have been defined in {ProductShortName} 2.0.x cannot be used in 2.1. Custom metrics can be configured using `EnvoyFilter`. Red Hat is unable to support `EnvoyFilter` configuration except where explicitly documented. This is due to tight coupling with the underlying Envoy APIs, meaning that backward compatibility cannot be maintained.
6861

6962
* link:https://issues.redhat.com/browse/MAISTRA-2648[MAISTRA-2648] `ServiceMeshExtensions` are currently not compatible with meshes deployed on IBM Z Systems.
7063

‎modules/ossm-rn-new-features.adoc

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Module included in the following assemblies:
2424
|Component |Version
2525

2626
|Istio
27-
|1.9.8
27+
|1.9.9
2828

2929
|Envoy Proxy
3030
|1.17.1
@@ -33,9 +33,51 @@ Module included in the following assemblies:
3333
|1.24.1
3434

3535
|Kiali
36-
|1.36.5
36+
|1.36.7
3737
|===
3838

39+
== New features {ProductName} 2.1.1
40+
41+
This release of {ProductName} addresses Common Vulnerabilities and Exposures (CVEs) and bug fixes.
42+
43+
This release also adds the ability to disable the automatic creation of network policies.
44+
45+
[id="ossm-config-disable-networkpolicy_{context}"]
46+
=== Disabling network policies
47+
48+
{ProductName} automatically creates and manages a number of `NetworkPolicies` resources in the control plane and application namespaces. This is to ensure that applications and the control plane can communicate with each other.
49+
50+
If you want to disable the automatic creation and management of `NetworkPolicies` resources, for example to enforce company security policies, you can do so. You can edit the `ServiceMeshControlPlane` to set the `spec.security.manageNetworkPolicy` setting to `false`
51+
52+
[NOTE]
53+
====
54+
When you disable `spec.security.manageNetworkPolicy` {ProductName} will not create *any* `NetworkPolicy` objects. The system administrator is responsible for managing the network and fixing any issues this might cause.
55+
====
56+
57+
.Procedure
58+
59+
. In the {product-title} web console, click *Operators* -> *Installed Operators*.
60+
61+
. Select the project where you installed the control plane, for example `istio-system`, from the Project menu.
62+
63+
. Click the {ProductName} Operator. In the *Istio Service Mesh Control Plane* column, click the name of your `ServiceMeshControlPlane`, for example `basic-install`.
64+
65+
. On the *Create ServiceMeshControlPlane Details* page, click `YAML` to modify your configuration.
66+
67+
. Set the `ServiceMeshControlPlane` field `spec.security.manageNetworkPolicy` to `false`, as shown in this example.
68+
+
69+
[source,yaml]
70+
----
71+
apiVersion: maistra.io/v2
72+
kind: ServiceMeshControlPlane
73+
spec:
74+
security:
75+
trust:
76+
manageNetworkPolicy: false
77+
----
78+
+
79+
. Click *Save*.
80+
3981
== New features and enhancements {ProductName} 2.1
4082

4183
This release of {ProductName} adds support for Istio 1.9.8, Envoy Proxy 1.17.1, Jaeger 1.24.1, and Kiali 1.36.5 on {product-title} 4.6 EUS, 4.7, 4.8, and 4.9.

0 commit comments

Comments
 (0)