You can support us by downloading this article as PDF from the Link below. Download the guide as PDF

A Service Mesh provides a uniform way to connect, secure, and monitor microservice applications in your OpenShift / Kubernetes container environment. A mesh can be described as a network of microservices that make up applications in a distributed microservice architecture. This tutorial will walk you through steps for installing Istio Service Mesh on OpenShift 4.x Cluster.

istio service mesh architecture

Red Hat OpenShift Service Mesh is based on the open source Istio project. It makes it easy to create a network of deployed services that provides discovery, load balancing, service-to-service authentication, failure recovery, metrics, and monitoring.

OpenShift Courses:

Practical OpenShift for Developers – New Course 2021

Ultimate Openshift (2021) Bootcamp by School of Devops

Features of Istio Service Mesh

  • Traffic Management – Control the flow of traffic and API calls between services, make calls more reliable, and make the network more robust in the face of adverse conditions.
  • Service Identity and Security – Provide services in the mesh with a verifiable identity and provide the ability to protect service traffic as it flows over networks of varying degrees of trustworthiness.
  • Policy Enforcement – Apply organizational policy to the interaction between services, ensure access policies are enforced and resources are fairly distributed among consumers. Policy changes are made by configuring the mesh, not by changing application code.
  • Telemetry – Gain understanding of the dependencies between services and the nature and flow of traffic between them, providing the ability to quickly identify issues.

Components of Istio Service Mesh

The Istio service mesh is split into control plane and data plane.

Control plane components:

  • Pilot – It configures the Envoy sidecar proxies at runtime.
  • Mixer – It enforces access control and usage policies. It is also responsible for collection of telemetry data from the Envoy proxy and other services.
  • Citadel – For certificates management – issuing and rotation.
  • Galley – This ingests the service mesh configuration, then validates, processes, and distributes the configuration.

Data plane:

The data plane is composed of a set of intelligent proxies (Envoy) deployed as sidecars. These proxies mediate and control all network communication between microservices. They also collect and report telemetry on all mesh traffic.

Envoy built-in features include:

  • Dynamic service discovery
  • Load balancing
  • TLS termination
  • HTTP/2 and gRPC proxies
  • Circuit breakers
  • Health checks
  • Staged rollouts with %-based traffic split
  • Fault injection
  • Rich metrics

Red Hat OpenShift Service Mesh also provides more complex operational functions including:

  • A/B testing
  • Canary releases
  • Rate limiting
  • Access control
  • End-to-end authentication

Install Istio Service Mesh on OpenShift 4.x

Now follow the next few steps to install and configure Red Hat OpenShift Service Mesh – Based on Istio. The istio-operator will be used to manage the installation of the Istio control plane.

Step 1: Install Elasticsearch Operator

The Elasticsearch operator enables you to configure and manage an Elasticsearch cluster for tracing and logging with Jaeger.

Log in to the OpenShift Container Platform web console and navigate to Operators > OperatorHub > Search Elasticsearch Operator

install istio service mesh openshift 01

Click “Install“.

install istio service mesh openshift 02

Select All namespaces on the cluster (default) for installation mode and automatic approval strategy.

install istio service mesh openshift 03

Click Subscribe to initiate installation.

Step 2: Install Jaeger Operator

Jaeger lets you perform tracing to monitor and troubleshoot transactions in complex distributed systems.

Navigate to Operators > OperatorHub > Search Jaeger Operator

install istio service mesh openshift 04

Click “Continue” to and select other settings as below to Subscribe.

install istio service mesh openshift 05

Step 3: Install Kiali Operator

Kiali enables you to view configurations, monitor traffic, and view and analyze traces in a single console. To install it search for “Kiali Operator” on OperatorHub.

install istio service mesh openshift 06

Select installation mode, update channel and approval strategy.

install istio service mesh openshift 07

All three operators should now be installed.

install istio service mesh openshift 08

Step 4: Install the Red Hat OpenShift Service Mesh Operator

Once Jaeger, Kiali and Elasticsearch operators are installed, proceed to install Istio Service Mesh Operator provided by Red Hat.

Navigate to Operators > OperatorHub > Red Hat OpenShift Service Mesh

install istio service mesh openshift 09

Select All namespaces on the cluster (default) to install the Service Mesh Operator in the openshift-operators project.

install istio service mesh openshift 10

Click Install and stable Update Channel with Automatic Approval Strategy.

install istio service mesh openshift 11

The operator should be visible in the openshift-operators project.

install istio service mesh openshift 12

Step 5: Configure Service Mesh control plane

We can now deploy the Service Mesh control plane which defines the configuration to for Control plane installation.

Create a new project: Home > Projects > Create Project

install istio service mesh openshift 13

Name the project istio-system

Creation of project automatically switch to new project in OpenShift. Navigate to Operators > Installed Operators > Istio Service Mesh Control Plane

install istio service mesh openshift 14

Click Create ServiceMeshControlPlane

A default ServiceMeshControlPlane template is provided in YAML format. Modify these to fit your use case. You can refer to Customization guide for more details.

I customized my configuration to look like below.

NOTE: Please don’t COPY PASTE this configuration – it includes tolerations for running Istio services on infra nodes with taints. It may not work for you!!.

apiVersion: maistra.io/v1
kind: ServiceMeshControlPlane
metadata:
  name: full-install
  namespace: istio-system
spec:
  istio:
    global:
      proxy:
        accessLogFile: "/dev/stdout"
      mtls:
        enabled: false
      disablePolicyChecks: true
      policyCheckFailOpen: false
      outboundTrafficPolicy:
          mode: "REGISTRY_ONLY"
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: true
        ior_enabled: true
      istio-egressgateway:
        autoscaleEnabled: true
        nodeSelector:
          node-role.kubernetes.io/infra: ""
        tolerations:
          - key: infra
            value: reserved
            effect: NoSchedule
          - key: infra
            value: reserved
            effect: NoExecute
    mixer:
      enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    kiali:
      enabled: true
      dashboard:
        viewOnlyMode: false
      ingress:
        enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    grafana:
      enabled: true
      nodeSelector:
        node-role.kubernetes.io/infra: ""
      tolerations:
        - key: infra
          value: reserved
          effect: NoSchedule
        - key: infra
          value: reserved
          effect: NoExecute
    tracing:
      enabled: true
      jaeger:
        template: all-in-one

Click “Create” and control plane should start installing.

install istio service mesh openshift 15

You can check the status of the control plane installation from CLI

$ oc get smcp -n istio-system

You can watch the progress of the Pods as they are created.

$ oc get pods -n istio-system -w

Step 6: Configure Service Mesh member roll

The Projects that belong to the control plane are listed in ServiceMeshMemberRoll. You need to create a ServiceMeshMemberRoll resource named default in the istio-system project.

Switch to istio-system project: Home > Projects > istio-system

The navigate to Operators > Installed Operators > Red Hat OpenShift Service Mesh > Istio Service Mesh Member Roll

install istio service mesh openshift 16

Under ServiceMeshMemberRolls click Create ServiceMeshMemberRoll.

install istio service mesh openshift 17

Add the projects you want to be part of Istio service mesh and click “Create“. From CLI, the ServiceMeshMemberRoll resource can be updated after creation.

$ oc edit smmr -n istio-system

Step 7: Deploy applications with Automatic sidecar injection

To deploy your applications into the Service Mesh, you must opt in to injection by specifying the sidecar.istio.io/inject annotation with a value of "true".

See example below.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: sleep
    spec:
      containers:
      - name: sleep
        image: tutum/curl
        command: ["/bin/sleep","infinity"]
        imagePullPolicy: IfNotPresent

For pre-existing applications in a project added as member to control plane, you can update the pod template in the deployment by adding or modifying an annotation:

$ oc patch deployment/<deployment> -p '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt": "'`date -Iseconds`'"}}}}}'

You can learn more by going through the Deploy Bookinfo scenario.

More guides on OpenShift.

Configure Chrony NTP Service on OpenShift 4.x / OKD 4.x

Run Ceph toolbox for Rook on Kubernetes / OpenShift

Add Harbor Image Registry Pull Secret to Kubernetes / OpenShift

Manage OpenShift / OKD Users with HTPasswd Identity Provider

How To Display Logs of OpenShift Nodes With oc Command

How To Open a Shell Prompt on an OpenShift Node

As an appreciation for the content we put out,
we would be thrilled if you support us!


As we continue to grow, we would wish to reach and impact more people who visit and take advantage of the guides we have on our blog. This is a big task for us and we are so far extremely grateful for the kind people who have shown amazing support for our work over the time we have been online.

Thank You for your support as we work to give you the best of guides and articles. Click below to buy us a coffee.

LEAVE A REPLY

Please enter your comment!
Please enter your name here