Skip to content

Commit e5af9b8

Browse files
rh-tokeeferh-tokeefe
committed
OSSM-3796: Refactor adding services to a mesh
1 parent cdcfbef commit e5af9b8

7 files changed

+244
-10
lines changed

‎modules/ossm-about-adding-namespace.adoc‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service_mesh/v2x/installing-ossm.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="ossm-about-adding-namespace_{context}"]
7+
= About adding projects to a service mesh
8+
9+
A project contains services; however, the services are only available if you add the project to the service mesh.
10+
11+
[NOTE]
12+
====
13+
In {product-title}, a project is essentially a Kubernetes namespace with additional annotations, such as the range of user IDs that can be used in the project. Typically, the {product-title} web console uses the term project, and the CLI uses the term namespace, but the terms are essentially synonymous.
14+
====
15+
16+
You can add projects to an existing service mesh using either the {product-title} web console or the CLI. There are two methods to add a project to a service mesh:
17+
18+
* Specifying the project name in the `ServiceMeshMemberRoll` resource.
19+
20+
* Creating the `ServiceMeshMember` resource in the project.
21+
22+
.ServiceMeshMemberRoll method
23+
24+
This is the simplest way to add a project to a service mesh. To add a project, specify the project name in the `spec.members` field of the `ServiceMeshMemberRoll` resource. The `ServiceMeshMemberRoll` resource specifies which projects are controlled by the `ServiceMeshControlPlane` resource.
25+
26+
[NOTE]
27+
====
28+
Adding projects using this method requires the user to have the `update servicemeshmemberrolls` and the `update pods` privileges in the project that is being added.
29+
====
30+
31+
* If you already have an application, workload, or service to add to the service mesh, see the instructions for adding or removing projects from the service mesh using the `ServiceMeshMemberRoll` resource with the xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-add-project-member-roll-recourse-console_ossm-create-mesh[web console] or with the xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-add-project-member-roll-resource-cli_ossm-create-mesh[CLI].
32+
33+
* Alternatively, to install a sample application called Bookinfo and add it to a `ServiceMeshMemberRoll` resource, see xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-tutorial-bookinfo-overview_ossm-create-mesh[Bookinfo example application] tutorial.
34+
35+
.ServiceMeshMember method
36+
37+
A `ServiceMeshMember` resource provides a way to add a project to a service mesh without modifying the `ServiceMeshMemberRoll` resource. To add a project, create a `ServiceMeshMember` resource in the project that you want to add to the service mesh. When the {SMProductShortName} Operator processes the `ServiceMeshMember` object, the project appears in the `status.members` list of the `ServiceMeshMemberRoll` resource. Then, the services that reside in the project are made available to the mesh. For more information, see the instructions for adding projects to the service mesh using the `ServiceMeshMember` resource with the xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-adding-project-using-smm-resource-console_ossm-create-mesh[web console] or with the xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-adding-project-using-smm-resource-cli_ossm-create-mesh[CLI].
38+
39+
The mesh administrator must grant each mesh user permission to reference the `ServiceMeshControlPlane` resource in the `ServiceMeshMember` resource. With this permission in place, this method of adding projects to a mesh can be used when the mesh user does not have direct access rights for the service mesh project or the `ServiceMeshMemberRoll` resource. For more information, see xref:../../service_mesh/v2x/ossm-profiles-users.html#ossm-members_ossm-profiles-users[Creating the {SMProductName} members].

‎modules/ossm-add-project-member-roll-resource-cli.adoc‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service_mesh/v2x/installing-ossm.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="ossm-add-project-member-roll-resource-cli_{context}"]
7+
= Adding or removing projects from the service mesh using ServiceMeshMemberRoll resource with the CLI
8+
9+
You can add any number of projects, but a project can only belong to *one* `ServiceMeshMemberRoll` resource.
10+
11+
The `ServiceMeshMemberRoll` resource is deleted when its corresponding `ServiceMeshControlPlane` resource is deleted.
12+
13+
.Prerequisites
14+
15+
* An installed, verified {SMProductName} Operator.
16+
* An existing `ServiceMeshMemberRoll` resource.
17+
* The name of the project with the `ServiceMeshMemberRoll` resource.
18+
* The names of the projects you want to add or remove from the mesh.
19+
* Access to the OpenShift CLI (`oc`).
20+
21+
.Procedure
22+
23+
. Log in to the {product-title} CLI.
24+
25+
. Edit the `ServiceMeshMemberRoll` resource.
26+
+
27+
[source,terminal]
28+
----
29+
$ oc edit smmr -n <controlplane-namespace>
30+
----
31+
32+
. Modify the YAML to add or remove projects as members. You can add any number of projects, but a project can only belong to *one* `ServiceMeshMemberRoll` resource.
33+
+
34+
.Example servicemeshmemberroll-default.yaml
35+
[source,yaml]
36+
----
37+
apiVersion: maistra.io/v1
38+
kind: ServiceMeshMemberRoll
39+
metadata:
40+
name: default
41+
namespace: istio-system #control plane project
42+
spec:
43+
members:
44+
# a list of projects joined into the service mesh
45+
- your-project-name
46+
- another-project-name
47+
----
48+
49+
. Save the file and exit the editor.

‎modules/ossm-add-project-member-roll-resource-console.adoc‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service_mesh/v2x/installing-ossm.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="ossm-add-project-member-roll-recourse-console_{context}"]
7+
= Adding or removing projects from the service mesh using ServiceMeshMemberRoll resource with the web console
8+
9+
You can add any number of projects, but a project can only belong to *one* `ServiceMeshMemberRoll` resource.
10+
11+
The `ServiceMeshMemberRoll` resource is deleted when its corresponding `ServiceMeshControlPlane` resource is deleted.
12+
13+
.Prerequisites
14+
* An installed, verified {SMProductName} Operator.
15+
* An existing `ServiceMeshMemberRoll` resource.
16+
* The name of the project with the `ServiceMeshMemberRoll` resource.
17+
* The names of the projects you want to add or remove from the mesh.
18+
19+
.Procedure
20+
21+
. Log in to the {product-title} web console.
22+
23+
. Navigate to *Operators* -> *Installed Operators*.
24+
25+
. Click the *Project* menu and choose the project where your `ServiceMeshControlPlane` resource is deployed from the list. For example `istio-system`.
26+
27+
. Click the {SMProductName} Operator.
28+
29+
. Click the *Istio Service Mesh Member Roll* tab.
30+
31+
. Click the `default` link.
32+
33+
. Click the YAML tab.
34+
35+
. Modify the YAML to add projects as members (or delete them to remove existing members). You can add any number of projects, but a project can only belong to *one* `ServiceMeshMemberRoll` resource.
36+
+
37+
.Example servicemeshmemberroll-default.yaml
38+
[source,yaml]
39+
----
40+
apiVersion: maistra.io/v1
41+
kind: ServiceMeshMemberRoll
42+
metadata:
43+
name: default
44+
namespace: istio-system #control plane project
45+
spec:
46+
members:
47+
# a list of projects joined into the service mesh
48+
- your-project-name
49+
- another-project-name
50+
----
51+
52+
. Click *Save*.
53+
54+
. Click *Reload*.

‎modules/ossm-adding-project-using-smm-resource-cli.adoc‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service_mesh/v2x/ossm-create-mesh.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="ossm-adding-project-using-smm-resource-cli_{context}"]
7+
= Adding a project to the service mesh using the ServiceMeshMember resource with the CLI
8+
9+
You can add one or more projects to the {SMProductShortName} from the CLI.
10+
11+
.Prerequisites
12+
* An installed, verified {SMProductName} Operator.
13+
* Name of the `ServiceMeshControlPlane` resource and the name of the project it belongs to.
14+
* Name of the project you want to add to the mesh.
15+
* A service mesh administrator must explicitly grant access to the service mesh. Administrators can grant users permissions to access the mesh by assigning them the `mesh-user` `Role` using a `RoleBinding` or `ClusterRoleBinding`. For more information, see xref:../../service_mesh/v2x/ossm-profiles-users.html#ossm-members_ossm-profiles-users[Creating the {SMProductName} members].
16+
17+
.Procedure
18+
19+
. Log in to the {product-title} CLI.
20+
21+
. Create the YAML file for the `ServiceMeshMember` manifest. The manifest adds the `my-application` project to the service mesh that was created by the `ServiceMeshControlPlane` resource deployed in the `istio-system` namespace:
22+
+
23+
[source,yaml]
24+
----
25+
apiVersion: maistra.io/v1
26+
kind: ServiceMeshMember
27+
metadata:
28+
name: default
29+
namespace: my-application
30+
spec:
31+
controlPlaneRef:
32+
namespace: istio-system
33+
name: basic
34+
----
35+
36+
. Apply the YAML file to create the `ServiceMeshMember` resource:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc apply -f <file-name>
41+
----
42+
43+
. After creating the `ServiceMeshMember` resource, verify that the namespace is part of the mesh. Confirm the that the value `True` appears in the `READY` column when you run the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get smm default -n my-application
48+
----
49+
+
50+
Alternatively, if you can access the `ServiceMeshMemberRoll` resource, you can also confirm that the `my-application` namespace is displayed in the `status.members` and `status.configuredMembers` fields of the `ServiceMeshMemberRoll` resource.

‎modules/ossm-adding-project-using-smm-resource-console.adoc‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service_mesh/v2x/ossm-create-mesh.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="ossm-adding-project-using-smm-resource-console_{context}"]
7+
= Adding a project to the service mesh using the ServiceMeshMember resource with the web console
8+
9+
You can add one or more projects to the {SMProductShortName} from the web console.
10+
11+
.Prerequisites
12+
* An installed, verified {SMProductName} Operator.
13+
* Name of the `ServiceMeshControlPlane` resource and the name of the project that the resource belongs to.
14+
* Name of the project you want to add to the mesh.
15+
* A service mesh administrator must explicitly grant access to the service mesh. Administrators can grant users permissions to access the mesh by assigning them the `mesh-user` `Role` using a `RoleBinding` or `ClusterRoleBinding`. For more information, see xref:../../service_mesh/v2x/ossm-profiles-users.html#ossm-members_ossm-profiles-users[Creating the {SMProductName} members].
16+
17+
.Procedure
18+
19+
. Log in to the {product-title} web console.
20+
21+
. Navigate to *Operators* -> *Installed Operators*.
22+
23+
. Click the *Project* menu and choose the project that you want to add to the mesh from the drop-down list. For example, `istio-system`.
24+
25+
. Click the {SMProductName} Operator.
26+
27+
. Click the *Istio Service Mesh Member* tab.
28+
29+
. Click *Create ServiceMeshMember*
30+
31+
. Accept the default name for the `ServiceMeshMember`.
32+
33+
. Click to expand *ControlPlaneRef*.
34+
35+
. In the *Namespace* field, select the project that the `ServiceMeshControlPlane` resource belongs to. For example, `istio-system`.
36+
37+
. In the *Name* field, enter the name of the `ServiceMeshControlPlane` resource that this namespace belongs to. For example, `basic`.
38+
39+
. Click *Create*.
40+
41+
. Confirm the `ServiceMeshMember` resource was created, and that the project was added to the mesh. Click the resource name; for example, `default`. View the *Conditions* section shown at the end of the screen. Confirm that the `Status` of the `Reconciled` and `Ready` conditions is `True`. If the `Status` is `False`, see the `Reason` and `Message` columns for more information.

‎service_mesh/v2x/ossm-create-mesh.adoc‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,19 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
After installing the Operators and `ServiceMeshControlPlane` resource, add applications, workloads, or services to your mesh by creating a `ServiceMeshMemberRoll` resource and specifying the namespaces where your content is located. If you already have an application, workload, or service to add to a `ServiceMeshMemberRoll` resource, use the following steps. Or, to install a sample application called Bookinfo and add it to a `ServiceMeshMemberRoll` resource, skip to the tutorial for installing the xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-tutorial-bookinfo-overview_ossm-create-mesh[Bookinfo example application] to see how an application works in {SMProductName}.
9+
After installing the Operators and creating the `ServiceMeshControlPlane` resource, add one or more projects to the service mesh.
1010

11-
The items listed in the `ServiceMeshMemberRoll` resource are the applications and workflows that are managed by the `ServiceMeshControlPlane` resource. The control plane, which includes the {SMProductShortName} Operators, Istiod, and `ServiceMeshControlPlane`, and the data plane, which includes applications and Envoy proxy, must be in separate namespaces.
12-
13-
[NOTE]
14-
====
15-
After you add the namespace to the `ServiceMeshMemberRoll`, access to services or pods in that namespace will not be accessible to callers outside the service mesh.
16-
====
11+
include::modules/ossm-about-adding-namespace.adoc[leveloffset=+1]
1712

1813
include::modules/ossm-member-roll-create.adoc[leveloffset=+1]
1914

20-
include::modules/ossm-member-roll-modify.adoc[leveloffset=+1]
15+
include::modules/ossm-add-project-member-roll-resource-console.adoc[leveloffset=+1]
16+
17+
include::modules/ossm-add-project-member-roll-resource-cli.adoc[leveloffset=+1]
18+
19+
include::modules/ossm-adding-project-using-smm-resource-console.adoc[leveloffset=+1]
20+
21+
include::modules/ossm-adding-project-using-smm-resource-cli.adoc[leveloffset=+1]
2122

2223
include::modules/ossm-tutorial-bookinfo-overview.adoc[leveloffset=+1]
2324

‎service_mesh/v2x/ossm-create-smcp.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
You can deploy a basic installation of the `ServiceMeshControlPlane`(SMCP) by using either the {product-title} web console or from the command line using the `oc` client tool.
9+
The control plane includes Istiod, Ingress and Egress Gateways, and other components, such as Kiali and Jaeger. The control plane must be deployed in a separate namespace than the {SMProductShortName} Operators and the data plane applications and services. You can deploy a basic installation of the `ServiceMeshControlPlane`(SMCP) from the {product-title} web console or the command line using the `oc` client tool.
1010

1111
[NOTE]
1212
====
@@ -46,4 +46,4 @@ include::modules/ossm-install-rosa.adoc[leveloffset=+1]
4646

4747
== Next steps
4848

49-
* Create a `ServiceMeshMemberRoll` resource to specify the namespaces associated with the {SMProductShortName}. For more information, see xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-create-mesh[Adding services to a service mesh].
49+
* Add a project to the {SMProductShortName} so that applications can be made available. For more information, see xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-create-mesh[Adding services to a service mesh].

0 commit comments

Comments
 (0)