How to install Istio Service Mesh on OpenShift 4.x

The
You can download this article in PDF format to support us through the following link.

Download the guide as a PDF

turn off
The

The
The

The service mesh provides a unified way to connect, protect and monitor microservice applications in the OpenShift / Kubernetes container environment. The grid can be described as a microservice network that composes the applications in a distributed microservice architecture. This tutorial will guide you through the steps of installing Istio Service Mesh on an OpenShift 4.x cluster.

Red Hat OpenShift service mesh is based on open source Istio project. It makes it easy to create a network of deployed services that provides discovery, load balancing, service-to-service authentication, failure recovery, metrics, and monitoring.

Features of the Istio service mesh

  • Traffic management – Control the flow between services and API call flow to make the call more reliable and make the network more robust under adverse conditions.
  • Service identity and security – Provide verifiable identities for services in the mesh network and protect service traffic from flowing through the network with varying degrees of credibility.
  • Policy Implementation – Apply organizational policies to the interaction between services to ensure that access policies are implemented and resources are fairly distributed among consumers. Policy changes are made through the configuration grid, not through application code changes.
  • telemetry – Understand the dependencies between services and the nature and flow of traffic between services so that problems can be discovered quickly

Components of the Istio service grid

The Istio service grid is divided into a control plane and a data plane.

Control plane components:

  • pilot – Configure the Envoy Sidecar proxy at runtime.
  • mixer – Implement access control and usage policies. It is also responsible for collecting telemetry data from Envoy agents and other services.
  • fortress – For certificate management – ​​issuance and rotation.
  • Gary – This will ingest the service mesh configuration and then verify, process and distribute the configuration.

Data plane:

of Data plane By a group of intelligent agents (messenger) Deployed as a sidecar. These agents mediate and control all network communications between microservices. They also collect and report telemetry on all mesh network traffic.

Envoy’s built-in features include:

  • Dynamic service discovery
  • Load balancing
  • TLS termination
  • HTTP / 2 and gRPC proxy
  • breaker
  • health examination
  • Launched in stages, distributing traffic by percentage
  • Fault injection
  • Rich indicators

Red Hat OpenShift Service Mesh also provides more complex operation functions, including:

  • A / B test
  • Canary release
  • Speed ​​limit
  • Access control
  • End-to-end authentication

Install Istio Service Mesh on OpenShift 4.x

Now, follow the next few steps to install and configure Red Hat OpenShift Service Mesh based on Istio. of Organization operator Will be used to manage the installation of the Istio control plane.

Step 1: Install Elasticsearch Operator

of Elastic search Operators allow you to configure and manage Elasticsearch clusters to track and record with Jaeger.

Log in to the OpenShift Container Platform web console and navigate to Operators > OperatorHub > Search Elastic search operator

How to install Istio Service Mesh on OpenShift 4.x

Click “installation“.

How to install Istio Service Mesh on OpenShift 4.x

Select All namespaces on the cluster (default) Used for installation mode and automatic approval strategy.

How to install Istio Service Mesh on OpenShift 4.x

Click Subscribe to start the installation.

Step 2: Install Jaeger Operator

Jaeger-LeCoultre Allows you to perform tracing to monitor and troubleshoot transactions in complex distributed systems.

Navigation Operators > OperatorHub > Search Jaeger-LeCoultre operator

How to install Istio Service Mesh on OpenShift 4.x

Click “carry on“, And then choose the other settings below to subscribe.

How to install Istio Service Mesh on OpenShift 4.x

Step 3: Install Kiali Operator

Kelly Allows you to view configuration, monitor traffic, and view and analyze traces in a single console. To install it, search for “Kiali operator“On OperatorHub.

How to install Istio Service Mesh on OpenShift 4.x

Choose the installation method, update channels and approval strategy.

How to install Istio Service Mesh on OpenShift 4.x

All three operators should now be installed.

How to install Istio Service Mesh on OpenShift 4.x

Step 4: Install Red Hat OpenShift Service Mesh Operator

After installing Jaeger, Kiali and Elasticsearch operators, please continue to install Istio Service Mesh Operator provided by Red Hat.

Navigation Operators > OperatorHub > Red Hat OpenShift Service Mesh

How to install Istio Service Mesh on OpenShift 4.x

Select All namespaces on the cluster (default) Install Service Mesh Operator in the openshift-operators project.

How to install Istio Service Mesh on OpenShift 4.x

Please click installation with stable Use update channel automatic Approval strategy.

How to install Istio Service Mesh on OpenShift 4.x

The operator should be openshift-operators project.

How to install Istio Service Mesh on OpenShift 4.x

Step 5: Configure the service mesh control plane

Now we can deploy the service mesh control plane, which defines the configuration for the control plane installation.

Create a new project: Home > Project > Create a project

How to install Istio Service Mesh on OpenShift 4.x

Named project Organization system

The created project will automatically switch to the new project in OpenShift. Navigation Operators > Operators installed > Istio Service Mesh Control Plane

How to install Istio Service Mesh on OpenShift 4.x

Click create ServiceMeshControlPlane

The default ServiceMeshControlPlane template is provided in YAML format. Modify them to suit your use case. You can refer to customized Guide for more detailed information.

I customized the configuration as shown below.

Note: Please do not copy and paste this configuration-it allows running Istio services on the tainted base node. It may not work for you!

apiVersion: maistra.io/v1
kind: ServiceMeshControlPlane
metadata:
  name: full-install
  namespace: istio-system
spec:
  istio:
    global:
      proxy:
        accessLogFile: "/dev/stdout"
      mtls:
        enabled: false
      disablePolicyChecks: true
      policyCheckFailOpen: false
      outboundTrafficPolicy:
          mode: "REGISTRY_ONLY"
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: true
        ior_enabled: true
      istio-egressgateway:
        autoscaleEnabled: true
        nodeSelector:
          node-role.kubernetes.io/infra: ""
        tolerations:
          - key: infra
            value: reserved
            effect: NoSchedule
          - key: infra
            value: reserved
            effect: NoExecute
    mixer:
      enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    kiali:
      enabled: true
      dashboard:
        viewOnlyMode: false
      ingress:
        enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    grafana:
      enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    tracing:
      enabled: true
      jaeger:
        template: all-in-one

Click “create“And the control panel should begin installation.

How to install Istio Service Mesh on OpenShift 4.x

You can check the status of the control plane installation from the CLI

$ oc get smcp -n istio-system

You can watch the progress of the Pod when it is created.

$ oc get pods -n istio-system -w

Step 6: Configure the service mesh member volume

ServiceMeshMemberRoll lists the items belonging to the control plane. You need to create a resource called ServiceMeshMemberRoll default In the istio-system project.

Switch to the istio-system project: Home> Projects> istio-system

Navigate to Carrier> Installed Carrier> Red Hat OpenShift Service Mesh> Istio Service Mesh Member Volume

How to install Istio Service Mesh on OpenShift 4.x

Down ServiceMeshMemberRolls Click Create ServiceMeshMemberRoll.

How to install Istio Service Mesh on OpenShift 4.x

Add the project you want to be part of the Istio service mesh, and then click Create Through the CLI, ServiceMeshMemberRoll resources can be updated after creation.

$ oc edit smmr -n istio-system

Step 7: Use automatic Sidecar injection to deploy the application

To deploy the application to Service Mesh, you must specify sidecar.istio.io/inject Value of the note "true".

See the example below.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: sleep
    spec:
      containers:
      - name: sleep
        image: tutum/curl
        command: ["/bin/sleep","infinity"]
        imagePullPolicy: IfNotPresent

For existing applications added to the control plane as members in the project, you can update the pod template in the deployment by adding or modifying comments:

$ oc patch deployment/ -p '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt": "'`date -Iseconds`'"}}}}}'

You can read Deploy Bookinfo Scenes.

More guides about OpenShift.

Configure Chrony NTP service on OpenShift 4.x / OKD 4.x

Run Ceph toolbox for Rook on Kubernetes / OpenShift

Add Harbor Image Registry Pull Secret to Kubernetes / OpenShift

Manage OpenShift / OKD users with HTPasswd identity provider

How to use the oc command to display the log of the OpenShift node

How to open Shell prompt on OpenShift node

The
You can download this article in PDF format to support us through the following link.

Download the guide as a PDF

turn off
The

The
The

Sidebar