Chapter 3. Service Mesh feature support tables
Feature support tables help you determine which OpenShift Service Mesh 3.4.3 features are generally available, in Technology Preview, in Developer Preview, or not available.
3.1. Support level definitions
For Red Hat OpenShift Service Mesh 3.4.3, features that are Generally Available (GA) are fully supported and are suitable for production use.
Technology Preview (TP) features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and give feedback during the development process. See the Technology Preview scope of support on the Red Hat Customer Portal for more information about Technology Preview features.
Developer Preview (DP) features are not supported by Red Hat in any way and are not functionally complete or production-ready. Do not use Developer Preview features for production or business-critical workloads. Developer Preview features provide early access to upcoming product features in advance of their possible inclusion in a Red Hat product offering, enabling customers to test functionality and give feedback during the development process. These features might not have any documentation, are subject to change or removal at any time, and testing is limited. Red Hat might provide ways to submit feedback on Developer Preview features without an associated SLA.
Not available (NA) features might not be available with Red Hat OpenShift Service Mesh 3.4.3.
3.2. Sail Operator APIs
The Sail Operator provides the following custom resource definitions (CRDs) for managing Istio components in OpenShift Service Mesh.
| Feature | Status |
|---|---|
| Istio | GA |
| IstioRevision | GA |
| IstioCNI | GA |
| IstioRevisionTag | GA |
| ZTunnel | GA |
3.3. Istio deployment and lifecycle
Istio deployment and lifecycle features include installation, upgrades, multicluster configurations, and networking capabilities for OpenShift Service Mesh 3.4.3.
| Feature | Status |
|---|---|
| Installation with the Red Hat OpenShift Service Mesh Operator | GA |
| Istio sidecar mode data plane | GA |
|
| GA |
| The Istio multicluster mesh deployment models | GA |
| The Istio external control plane deployment models | GA |
| Multiple control planes on a single OpenShift Container Platform cluster | GA |
|
| GA |
|
Istio configuration scoping: Sidecar API, | GA |
| IPv6 support | GA |
| Dual stack IPv4/IPv6 | GA [4] |
| Virtual machine (non-OpenShift) workload integration | DP |
| Istioctl for select commands | GA [1] |
| Helm or Istioctl installation | NA [2] |
| ProxyConfig | GA [3] |
|
Native | GA [5] |
| Agentgateway | NA |
- For more information, see "Support for Istioctl".
- Installation is only supported by using the OpenShift Service Mesh Operator, which uses the Istio Helm chart values for managing configuration.
-
The
ProxyConfigAPI is supported with the exception of the image field, which is not supported. - Dual-Stack IPv4/IPv6 is supported on x86 environments only. On non-x86 environments, this feature remains a Technology Preview.
-
To deploy OpenShift Service Mesh on nodes running Red Hat Enterprise Linux (RHEL) 10 or Red Hat Enterprise Linux CoreOS (RHCOS) 10, you must enable native
nftablessupport. In the Istio resource, set thespec.values.global.nativeNftablesparameter totrue.
3.4. Istio traffic management
Traffic management features control how requests flow between services in your mesh, including routing, load balancing, and resilience capabilities.
| Feature | Status |
|---|---|
| Protocols: HTTP1.1/HTTP2/HTTPS/gRPC/TCP/TLS | GA |
| Traffic control: label/content based routing, traffic shifting | GA |
|
| GA |
| Resilience features: timeouts, retries, connection pools, outlier detection | GA |
| Gateway: ingress, egress for all supported protocols | GA |
| Gateway injection | GA |
| TLS termination and SNI support in gateways | GA |
| Locality load balancing | GA |
| DNS proxying | GA |
| Kubernetes Multi-Cluster Service (MCS) discovery | DP |
3.5. Kubernetes Gateway APIs
Kubernetes Gateway APIs provide standard resources for configuring ingress gateways, mesh traffic, and gateway behavior in OpenShift Service Mesh 3.4.3.
| Feature | Status |
|---|---|
| Kubernetes Gateway APIs for ingress (Gateway parentRef) | GA |
| Kubernetes Gateway APIs for mesh (Service parentRef) | GA |
| Kubernetes Gateway API custom resource definitions (CRDs) | GA [1] |
| Kubernetes Gateway API manual deployment | NA |
| Gateway network topology configuration | DP |
| Gateway inference extensions | TP |
- The use of Kubernetes Gateway API requires custom resource definitions (CRDs). The CRDs are present by default and generally available on OpenShift Container Platform 4.19 and later releases. OpenShift Container Platform 4.18 and earlier releases do not include or provide support for these CRDs.
3.6. Security features
Security features provide encryption, authentication, and authorization capabilities for securing service-to-service communication and protecting workloads in your mesh.
3.6.1. Encryption and certificate management
| Feature | Status |
|---|---|
| Service-to-service mutual TLS encryption | GA |
| Identity and certificate management for workloads | GA |
| Peer authentication | GA |
| Certificate management for ingress gateway | GA |
| Pluggable key/certificate support for Istio certificate authority (CA) | GA |
| Cert-Manager integration with the cert-manager Operator for Red Hat OpenShift | GA |
| Kubernetes ClusterTrustBundles | DP |
| SPIFFE Runtime Environment (SPIRE) integration through the Zero Trust Workload Identity Manager | TP |
3.6.2. Authorization and policy enforcement
| Feature | Status |
|---|---|
| AuthorizationPolicy | GA |
| External authorization | GA |
| End user (JWT) authentication | GA |
| JWT claim based routing | GA |
| Authorization dry run | TP |
| Copy JWT claims to HTTP Headers | DP |
| RequestAuthentication | GA |
3.7. Observability features
OpenShift Service Mesh 3.4.3 provides end-to-end support for observability, including logs, metrics, and distributed tracing with Red Hat OpenShift Observability and the Kiali Operator provided by Red Hat.
Integrations with other community projects (including community Prometheus) and third-party solutions can be configurable through Istio or Observability operators, but those solutions are not supported by Red Hat.
| Feature | Status |
|---|---|
| Integration with Red Hat OpenShift Observability - user workload monitoring | GA |
| Red Hat OpenShift distributed tracing platform (Tempo) | GA |
| Red Hat OpenShift distributed tracing data collection Operator | GA |
| Trace sampling configuration | GA |
| Istio Telemetry API for configuring logs, metrics, and traces | GA |
| Istio preconfigured Grafana dashboards | DP [1] |
| Request classification | NA |
- While Grafana is not included as part of OpenShift Service Mesh, the preconfigured dashboards for Grafana maintained by the Istio community can be use with OpenShift Service Mesh under a Developer Preview scope. These are best used as a starting point for building your own dashboards.
3.8. Consoles and dashboards
Console and dashboard tools provide visualization and management capabilities for monitoring and configuring your service mesh.
| Feature | Status |
|---|---|
| Kiali Operator provided by Red Hat | GA |
| Kiali Server | GA |
| OpenShift Service Mesh Console (OSSMC) plugin | GA |
3.9. Extensibility features
Extensibility features allow you to customize and extend Istio proxy behavior.
| Feature | Status |
|---|---|
| WebAssembly extension | GA [1] |
| EnvoyFilter API | DP [2] |
| TrafficExtension API | TP [3] |
- The WasmPlugin API for extending Istio with WebAssembly extensions is supported, but support is not provided for any Web Assembly extension modules unless explicitly documented.
- The EnvoyFilter API is available for use with Red Hat OpenShift Service Mesh, but is not supported, except where explicitly documented. Due to tight coupling with the underlying Envoy APIs, backward compatibility cannot be maintained. Note that EnvoyFilter patches are very sensitive to the format of the Envoy configuration that is generated by Istio. If the configuration generated by Istio changes, it has the potential to break the application of the EnvoyFilter configuration. Any configuration provided through this API should be carefully monitored across Istio proxy version upgrades to ensure that deprecated fields are removed and replaced appropriately. If a support case is raised where an EnvoyFilter configuration is used, Red Hat might request that the issue be reproduced with the EnvoyFilter configuration removed.
- Red Hat does not debug or provide other support for plugins and scripts configured through the TrafficExtension API.
3.10. Istio Ambient mode (sidecarless) data plane
Ambient mode features include core ztunnel and waypoint capabilities, traffic management, security, multicluster support, and upgrade strategies.
| Feature | Status |
|---|---|
| Ztunnel: Core | GA |
| Waypoint: Core | GA |
| Waypoint: Gateway API Stable Channel (HTTPRoute, GRPCRoute) | GA |
| Gateway API Experimental Channel (TLSRoute, TCPRoute) | DP |
| Waypoint: DestinationRule | GA |
| Waypoint: VirtualService | TP |
| Waypoint: Cross-namespace usage | GA |
| Waypoint: WebAssembly extensibility (WasmPlugin) | DP |
| AuthorizationPolicy, PeerAuthentication, RequestAuthentication | GA |
| DNS Proxying | GA |
| Dual-stack and IPv6 single stack | TP |
| Mixing sidecar and ambient namespaces within a single mesh | GA † |
| Deploying ambient mode on a cluster with an existing sidecar mesh | GA † |
| Migrating workloads from sidecar mode to ambient mode | GA † |
| Multiple “ambient mode” meshes in a single cluster | NA |
| Multi-Cluster - Multi-primary topology | TP |
| Multi-Cluster - Other topologies | NA |
| Upgrades: InPlace | GA |
| Upgrades: RevisionBased | NA |
| Virtual Machine workload integration | NA |
† These features are supported with the exception of limitations noted in their respective documentation.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}