Installing the Service Mesh involves installing the Elasticsearch, Jaeger, Kiali and Service Mesh Operators, creating and managing a ServiceMeshControlPlane resource to deploy the control plane, and creating a ServiceMeshMemberRoll resource to specify the namespaces associated with the Service Mesh.

Mixer’s policy enforcement is disabled by default. You must enable it to run policy tasks. See Update Mixer policy enforcement for instructions on enabling Mixer policy enforcement.

Multi-tenant control plane installations are the default configuration starting with Red Hat OpenShift Service Mesh 1.0.

Prerequisites

Installing the Operators from OperatorHub

The Service Mesh installation process uses the OperatorHub to install the ServiceMeshControlPlane custom resource definition within the openshift-operators project. The Red Hat OpenShift Service Mesh defines and monitors the ServiceMeshControlPlane related to the deployment, update, and deletion of the control plane.

Starting with Red Hat OpenShift Service Mesh 1.0, you must install the Elasticsearch Operator, the Jaeger Operator, and the Kiali Operator before the Red Hat OpenShift Service Mesh Operator can install the control plane.

Installing the Elasticsearch Operator

You must install the Elasticsearch Operator for the Red Hat OpenShift Service Mesh Operator to install the control plane.

Do not install Community versions of the Operators. Community Operators are not supported.

Prerequisites
  • Access to the OpenShift Container Platform web console.

Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Navigate to CatalogOperatorHub.

  3. Type Elasticsearch into the filter box to locate the Elasticsearch Operator.

  4. Click the Elasticsearch Operator to display information about the Operator.

  5. Click Install.

  6. On the Create Operator Subscription page, select All namespaces on the cluster (default). This installs the Operator in the default openshift-operators project and makes the Operator available to all projects in the cluster.

  7. Select the preview Update Channel.

  8. Select the Automatic Approval Strategy.

    The Manual approval strategy requires a user with appropriate credentials to approve the Operator install and subscription process.

  9. Click Subscribe.

  10. The Subscription Overview page displays the Elasticsearch Operator’s installation progress.

Installing the Jaeger Operator

You must install the Jaeger Operator for the Red Hat OpenShift Service Mesh Operator to install the control plane.

Do not install Community versions of the Operators. Community Operators are not supported.

Prerequisites
  • Access to the OpenShift Container Platform web console.

  • The Elasticsearch Operator must be installed.

Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Navigate to CatalogOperatorHub.

  3. Type Jaeger into the filter box to locate the Jaeger Operator.

  4. Click the Jaeger Operator provided by Red Hat to display information about the Operator.

  5. Click Install.

  6. On the Create Operator Subscription page, select All namespaces on the cluster (default). This installs the Operator in the default openshift-operators project and makes the Operator available to all projects in the cluster.

  7. Select the stable Update Channel.

  8. Select the Automatic Approval Strategy.

    The Manual approval strategy requires a user with appropriate credentials to approve the Operator install and subscription process.

  9. Click Subscribe.

  10. The Subscription Overview page displays the Jaeger Operator’s installation progress.

Installing the Kiali Operator

You must install the Kiali Operator for the Red Hat OpenShift Service Mesh Operator to install the control plane.

Do not install Community versions of the Operators. Community Operators are not supported.

Prerequisites
  • Access to the OpenShift Container Platform web console.

Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Navigate to CatalogOperatorHub.

  3. Type Kiali into the filter box to find the Kiali Operator.

  4. Click the Kiali Operator provided by Red Hat to display information about the Operator.

  5. Click Install.

  6. On the Create Operator Subscription page, select All namespaces on the cluster (default). This installs the Operator in the default openshift-operators project and makes the Operator available to all projects in the cluster.

  7. Select the stable Update Channel.

  8. Select the Automatic Approval Strategy.

    The Manual approval strategy requires a user with appropriate credentials to approve the Operator install and subscription process.

  9. Click Subscribe.

  10. The Subscription Overview page displays the Kiali Operator’s installation progress.

Installing the Red Hat OpenShift Service Mesh Operator

Prerequisites
  • Access to the OpenShift Container Platform web console.

  • The Elasticsearch Operator must be installed.

  • The Jaeger Operator must be installed.

  • The Kiali Operator must be installed.

Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Navigate to CatalogOperatorHub.

  3. Type Red Hat OpenShift Service Mesh into the filter box to find the Red Hat OpenShift Service Mesh Operator.

  4. Click the Red Hat OpenShift Service Mesh Operator to display information about the Operator.

  5. On the Create Operator Subscription page, select All namespaces on the cluster (default). This installs the Operator in the default openshift-operators project and makes the Operator available to all projects in the cluster.

  6. Click Install.

  7. Select the 1.0 Update Channel.

  8. Select the Automatic Approval Strategy.

    The Manual approval strategy requires a user with appropriate credentials to approve the Operator install and subscription process.

  9. Click Subscribe.

  10. The Subscription Overview page displays the Red Hat OpenShift Service Mesh Operator’s installation progress.

Deploying the Red Hat OpenShift Service Mesh control plane

You can deploy the Service Mesh control plane by using the OpenShift Container Platform web console or the CLI.

Deploying the control plane with the web console

Follow this procedure to deploy the Red Hat OpenShift Service Mesh control plane by using the web console.

Prerequisites
Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Create a new project named istio-system.

  3. Navigate to CatalogsInstalled Operators.

  4. Click the Red Hat OpenShift Service Mesh Operator.

  5. Under Provided APIs, the Operator enables you to create two resource types:

    • A ServiceMeshControlPlane resource

    • A ServiceMeshMemberRoll resource

  6. Click Create New under Istio Service Mesh Control Plane.

  7. Modify the minimal ServiceMeshControlPlane template.

    Review Customize the Red Hat OpenShift Service Mesh installation for additional information on customizing the control plane and control plane parameters.

  8. Click Create to create the control plane.

  9. The Operator starts up the pods, services, and Service Mesh control plane components.

  10. Click the Istio Service Mesh Control Plane tab.

  11. Click the name of the new control plane.

  12. Click the Resources tab to see the Red Hat OpenShift Service Mesh control plane resources the Operator created and configured.

Deploying the control plane from the CLI

Follow this procedure to deploy the Red Hat OpenShift Service Mesh control plane by using the CLI.

Prerequisites

Review Customize the Red Hat OpenShift Service Mesh installation for additional information on customizing the control plane and control plane parameters.

Procedure
  1. Log in to the OpenShift Container Platform CLI.

  2. Create a ServiceMeshControlPlane file named istio-installation.yaml.

  3. Run this command to deploy the control plane:

    $ oc create -n istio-system -f istio-installation.yaml
  4. Run this command to watch the progress of the pods during the installation process:

    $ oc get pods -n istio-system -w

Configure the Red Hat OpenShift Service Mesh member roll

You must create a ServiceMeshMemberRoll resource named default associated with the Service Mesh in the same project as the ServiceMeshControlPlane.

If Container Network Interface (CNI) plugin is enabled, manual sidecar injection will work, but pods will not be able to communicate with the control plane unless those pods are specified in the ServiceMeshMemberRoll resource.

The member projects are only updated if the Service Mesh control plane installation succeeds.

  • You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.

The ServiceMeshMemberRoll resource is deleted when its corresponding ServiceMeshControlPlane resource is deleted.

Configure the member roll from the OpenShift Container Platform web console

Follow this procedure to add the Bookinfo project to the Service Mesh member roll by using the web console.

Prerequisites
  • An installed, verified Red Hat OpenShift Service Mesh Operator.

Procedure
  1. Log in to the OpenShift Container Platform web console.

  2. Click to HomeProjects.

  3. Click Create Project.

  4. Enter a Project Name (for example, bookinfo), a Display Name, and a Description, then click Create.

  5. Click CatalogInstalled Operators.

  6. Click the Project menu and choose istio-system from the list.

  7. Click the Istio Service Mesh Member Roll link under Provided APIs for the Red Hat OpenShift Service Mesh Operator.

  8. Click on All Instances, click Create New, and then click Create Istio Service Mesh Member Roll.

    It can take a short time for the Operator to finish creating the projects, therefore you may need to refresh the screen before the web console presents the Create Istio Service Mesh Member Roll button.

  9. Edit the default Service Mesh Member Roll YAML and add bookinfo to the members list.

  10. Click Create to save the updated Service Mesh Member Roll.

Configure the member roll from the CLI

This example joins the Bookinfo project to the Service Mesh from the CLI.

Prerequisites
  • An installed, verified Service Mesh Operator.

  • Name of the project with the ServiceMeshMemberRoll resource.

  • Access to the OpenShift Container Platform Command-line Interface (CLI) also known as oc.

Procedure
  1. Log in to the OpenShift Container Platform CLI.

  2. Create ServiceMeshMemberRoll resource in the same project as the ServiceMeshControlPlane resource.

  3. Name the resource default.

  4. Add the Bookinfo project to the member list in the ServiceMeshMemberRoll. In this example, the bookinfo project is joined to the Service Mesh deployed in the same project as the ServiceMeshMembereRoll resource.

    Project configuration example
      apiVersion: maistra.io/v1
      kind: ServiceMeshMemberRoll
      metadata:
        name: default
      spec:
        members:
        # a list of projects joined into the service mesh
        - bookinfo