Everything has a start, this blog as well as the following tutorials. This series of tutorials shall provide a brief and working overview about OpenShift Service Mesh. It is starting with the installation and the first steps, and will continue with advanced settings and configuration options.
OpenShift 4.x and ServiceMesh
UPDATE: At 10th April 2020 Red Hat released Service Mesh version 1.1 which supports:
Istio - 1.4.6
Kiali - 1.12.7
Jaeger - 1.17.1
The following tutorials for OpenShift Service Mesh are based on the official documentation: OpenShift 4.3 Service Mesh and on the Interactive Learning Portal. All operations have been successfully tested on OpenShift 4.3.
Currently OpenShift supports Istio 1.4.6, which shall be updated in one of the future releases.
To learn the basics of Service Mesh, please consult the documentation as they are not repeated here.
It is assumed that OpenShift has access to external registries, like quay.io.
Other resource I can recommend are:
Istio By Example: A very good and brief overview of different topics by Megan O’Keefe.
At the very beginning OpenShift must be installed. This tutorial is based on OpenShift 4.3 and a Lab installation on Hetzner was used.
Moreover, it is assumed that the OpenShift Client and Git are installed on the local system.
During the tutorials an example application in the namespace tutorial will be deployed. This application will contain 3 microservices:
customer (the entry point)
preference
recommendation
This application is also used at the Interactive Learning Portal which can be tested there interactively. However, the training is still based on OpenShift version 3.
Elasticsearch is a very memory intensive application. Per default it will request 16GB of memory which can be reduced on Lab environments.
Link Jaeger and Grafana to Kiali
In the lab environment it happened that Kiali was not able to auto detect Grafana or Jaeger.
This is visible when the link Distributed Tracing is missing in the left menu.
To fix this the ServiceMeshControlPlane object in the istio-system namespace must be updated with 3 lines:
oc edit ServiceMeshControlPlane -n istio-system
kiali: # ADD THE FOLLOWING LINES
dashboard:
grafanaURL: https://grafana-istio-system.apps.<your clustername>
jaegerURL: https://jaeger-istio-system.apps.<your clustername>
This change will take a few minutes to be effective.
This is our second look into the Kubernetes Gateway API an it’s integration into OpenShift. This post covers TLS configuration.
The Kubernetes Gateway API is new implementation of the ingress, load balancing and service mesh API’s. See upstream for more information.
Also the OpenShift documentation provides an overview of the Gateway API and it’s integration.
We demonstrate how to add TLS to our Nginx deployment, how to implement a shared Gateway and finally how to implement HTTP to HTTPS redirection with the Gateway API. Furthermore we cover how HTTPRoute objects attach to Gateways and dive into ordering of HTTPRoute objects.
When working with Argo CD at scale, you often find yourself creating similar Application manifests repeatedly. Each application needs the same basic structure but with different configurations for source repositories, destinations, and sync policies. Additionally, managing namespace metadata becomes tricky when you need to conditionally control whether Argo CD should manage namespace metadata based on sync options.
In this article, I’ll walk you through a reusable Helm template that solves these challenges by providing a flexible, DRY (Don’t Repeat Yourself) approach to creating Argo CD Applications. This template is available in my public Helm Chart library and can easily be used by anyone.
One of the most commonly deployed operators in OpenShift environments is the Cert-Manager Operator. It automates the management of TLS certificates for applications running within the cluster, including their issuance and renewal.
The tool supports a variety of certificate issuers by default, including ACME, Vault, and self-signed certificates. Whenever a certificate is needed, Cert-Manager will automatically create a CertificateRequest resource that contains the details of the certificate. This resource is then processed by the appropriate issuer to generate the actual TLS certificate. The approval process in this case is usually fully automated, meaning that the certificate is issued without any manual intervention.
But what if you want to have more control? What if certificate issuance must follow strict organizational policies, such as requiring a specifc country code or organization name? This is where the CertificateRequestPolicy resource, a resource provided by the Approver Policy, comes into play.
This article walks through configuring the Cert-Manager Approver Policy in OpenShift to enforce granular policies on certificate requests.
The following 1-minute article is a follow-up to my previous article about how to use Keycloak as an authentication provider for OpenShift. In this article, I will show you how to configure Keycloak and OpenShift for Single Log Out (SLO). This means that when you log out from Keycloak, you will also be logged out from OpenShift automatically. This requires some additional configuration in Keycloak and OpenShift, but it is not too complicated.
Thomas Jungbauer
( Lastmod: 2024-05-05 )
-
2 min read