Update Serverless + Service Mesh integration documentation #97

ReToCode · 2023-07-24T12:08:05Z

For JIRAs:

Changes

Provide DP docs for Serverless Service Mesh Integration
Provide DP docs for Multi-tenancy with Service Mesh
Provide docs for OpenShift ingress sharding with Serverless (related to the MT stuff)

…M-2356)

netlify · 2023-07-24T12:08:10Z

✅ Deploy Preview for jazzy-shortbread-5f62b7 ready!

Name	Link
🔨 Latest commit	`7ccf02e`
🔍 Latest deploy log	https://app.netlify.com/sites/jazzy-shortbread-5f62b7/deploys/650810555400880009d52c32
😎 Deploy Preview	https://deploy-preview-97--jazzy-shortbread-5f62b7.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

Add Eventing diagram for Istio authorization policies

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

Fix format

nak3

A few comments but LGTM overall.

modules/serverless-common/pages/service-mesh/common-service-mesh-network-isolation.adoc

rhuss

Thanks a lot, this a is major step forward and a great improvements for the docs. I did an in-depth review with some proposals that might be difficult to imlplement. Let's discuss them on the topic.

One overall comment that might also affects other parts of the documentation: I would prefer to use kn service create instead of adding the plain yaml files because its much shorter and focus on the important parts. See the example that I have added when verifying the mt setup.

A part that might be a bit controversial is how we organise the content in the ToC. Combining Serving and Eventing right now might be the right thing, but will become later difficult in case we want to split Serving and Eventing apart into separatre products. But see my comments above.

modules/ROOT/nav.adoc

rhuss · 2023-08-25T06:16:36Z

.../serverless-common/assets/images/service-mesh/multi-tenancy-service-mesh-Eventing.drawio.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>


I like the graphic, but I wonder whether this will work in the OpenShift docs with having a lot of blurb around (navigation, headers), so screen real estate might be an issue. I wonder whether we could shorten the text and maybe add some callouts to just the resource type ? Details can then be in the flow text.

We are not even sure if we even can add visuals to the official docs as they would need resources to re-draw the visuals themselves (in the OCP docs style). Lets discuss that point with docs first.

Agreed, but I'm pretty sure that one of the feedback will be that we need to move out the text from the graphics. So we could already do this improvement to ease the discussion with docs.

@pierDipi for you.

+1, I will work on it

...s/serverless-common/assets/images/service-mesh/multi-tenancy-service-mesh-Serving.drawio.svg

modules/serverless-common/pages/service-mesh/common-service-mesh-network-isolation.adoc

modules/serverless-common/pages/service-mesh/common-service-mesh-setup.adoc

mgencur

Nice! Many review comments were already provided. I'm adding a few more.

mgencur · 2023-08-25T08:02:57Z

.../serverless-common/assets/images/service-mesh/multi-tenancy-service-mesh-Eventing.drawio.svg

Regarding the blue arrows.

Arrow 1) seems correct to me

Arrow 2) - I'm missing the number "2)" next to the arrow

Arrow 3) - the arrow has "3)" next to it but the description for "3)" at the bottom of the picture seems to belong to the blue arrow that doesn't have any number next to it. Just because it speaks about "tenant-2" namespace but the arrow with "3)" comes from "knative-eventing". Not sure if we can make it more clear...

I was previously asking @pierDipi whether it is possible for the sender to sneak-in the Kn-Namespace header to act like it can communicate with the tenants. The answer was something like "it is only added by Eventing core" so it's not possible to sneak it in.
But here I see "ksvc" in tenant-2 and it looks like this service needs to provide "Kn-Namespace" by itself. Is it true? Is it possible to abuse communication by somebody who is not supposed to belong to the tenants?
Note: We still need to write tests for this. That's TODO

@pierDipi can you answer those?

@mgencur I think to make 3 more clear I can "slice" sender and receiver with "tenant-1" and "tenant-2"

OK. I will try to answer it myself. The ksvc is NOT supposed to set Kn-Namespace header and the AuthorizatioPolicy we have is defining the "source" namespace as "knative-eventing" so the Kn-Namespace header is taken into account only when sent by a component from knative-eventing ns:

- from: - source: namespaces: - "knative-eventing" when: - key: request.headers[Kn-Namespace] values: - "tenant-1"

Yes, @mgencur for the other comment, that's the idea, only when coming from our own namespace it's expected to match the header

For 2 and 3, I've updated the diagram and the legend in ReToCode#3

modules/serverless-common/pages/service-mesh/common-service-mesh-setup.adoc

modules/serverless-common/pages/service-mesh/common-service-mesh-network-isolation.adoc

nak3 · 2023-08-31T06:45:34Z

I have reviewed the new commit:

https://deploy-preview-97--jazzy-shortbread-5f62b7.netlify.app/docs/latest/serverless/serving/serving-with-ingress-sharding
e9fd163

LGTM 🎉

rhuss · 2023-09-07T09:19:51Z

@ReToCode thanks a lot for the refactoring, looks good to me.

ReToCode · 2023-09-12T13:05:58Z

@rhuss I added the kn verification as a tab, as it is possible here in asciidoc (plugin is there). Let's see/discuss this with the docs team for the official docs.

openshift-ci · 2023-09-18T07:53:16Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ReToCode, rhuss

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

modules/serverless/pages/service-mesh/common-service-mesh-network-isolation.adoc

…sion of the diagram Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

pierDipi · 2023-09-18T08:33:12Z

@ReToCode ReToCode#3

Update eventing diagram to use textual legend and a tenant-sliced version of the diagram

ReToCode · 2023-09-18T08:55:57Z

@mgencur PTAL: #97 (comment) . If you are ok with that, I think we can merge this.

ReToCode · 2023-09-18T08:58:36Z

/unhold

mgencur · 2023-09-18T09:08:50Z

@mgencur PTAL: #97 (comment) . If you are ok with that, I think we can merge this.

It looks good to me. Thanks!

ReToCode added 7 commits July 20, 2023 10:52

update service-mesh integration setup documentation (SRVCOM-2368)

9bc353e

add page for network-isolation based on Service Mesh (SRVCOM-2368)

974179d

add helm generator to the network-isolation docs

e18b41e

refer to external yaml files on GitHub

3dea20d

add improvements for general, more isolated istio installation (SRVCO…

7fe1604

…M-2356)

minor fixes

8cdf267

remove todo for monitoring resources

4743483

openshift-ci bot added do-not-merge/work-in-progress do-not-merge/hold labels Jul 24, 2023

add resources for setup

d6e8df7

ReToCode mentioned this pull request Jul 24, 2023

Add serving resources to helm chart openshift-knative/knative-istio-authz-chart#1

Merged

ReToCode added 2 commits July 26, 2023 15:03

add block to verify setup

6cfb94f

use updated diagram of tenancy diagram

8711a95

pierDipi self-assigned this Aug 21, 2023

pierDipi self-requested a review August 21, 2023 10:05

pierDipi added 2 commits August 23, 2023 09:36

Format document

e043ee1

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

Add Eventing diagram for Istio authorization policies

b5101c8

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

pierDipi mentioned this pull request Aug 23, 2023

Add Eventing diagram for Istio authorization policies ReToCode/oss-docs#1

Merged

ReToCode and others added 3 commits August 23, 2023 10:17

Merge pull request #1 from pierDipi/sm-integration-eventing-diagram

a7db9da

Add Eventing diagram for Istio authorization policies

Fix format

176969c

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

Merge pull request #2 from pierDipi/sm-integration-eventing-diagram

22a6e20

Fix format

ReToCode changed the title ~~[WIP] Update Serverless + Service Mesh integration documentation~~ Update Serverless + Service Mesh integration documentation Aug 25, 2023

openshift-ci bot removed the do-not-merge/work-in-progress label Aug 25, 2023

ReToCode assigned matzew, mgencur, nak3 and skonto Aug 25, 2023

nak3 reviewed Aug 25, 2023

View reviewed changes

modules/serverless-common/pages/service-mesh/common-service-mesh-network-isolation.adoc Outdated Show resolved Hide resolved

modules/serverless-common/pages/service-mesh/common-service-mesh-network-isolation.adoc Outdated Show resolved Hide resolved

rhuss requested changes Aug 25, 2023

View reviewed changes

mgencur reviewed Aug 25, 2023

View reviewed changes

ReToCode added 4 commits August 28, 2023 08:36

add review improvements

8e08f93

extract text out of Serving image

05ce8da

add pre-install verification steps

9b83905

add page for Serving with OCP ingress sharding

e9fd163

add tabs to show verification steps with kn cli

4501ea9

ReToCode mentioned this pull request Sep 13, 2023

add a new page for Serving scaling & performance #98

Merged

rhuss approved these changes Sep 18, 2023

View reviewed changes

pierDipi reviewed Sep 18, 2023

View reviewed changes

modules/serverless/pages/service-mesh/common-service-mesh-network-isolation.adoc Show resolved Hide resolved

Update eventing diagram to use textual legend and a tenant-sliced ver…

e6866af

…sion of the diagram Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

pierDipi mentioned this pull request Sep 18, 2023

Update eventing diagram to use textual legend and a tenant-sliced version of the diagram ReToCode/oss-docs#3

Merged

ReToCode added 2 commits September 18, 2023 10:48

Merge pull request #3 from pierDipi/sm-integration

276b652

Update eventing diagram to use textual legend and a tenant-sliced version of the diagram

add authorization policy symbol to tenant-2

7ccf02e

openshift-ci bot removed the do-not-merge/hold label Sep 18, 2023

ReToCode merged commit 4aad433 into openshift-knative:master Sep 18, 2023

pierDipi mentioned this pull request Oct 2, 2023

[WIP] Document authorization policies using Service Mesh #96

Closed

Update Serverless + Service Mesh integration documentation #97

Update Serverless + Service Mesh integration documentation #97

Uh oh!

Conversation

ReToCode commented Jul 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

netlify bot commented Jul 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for jazzy-shortbread-5f62b7 ready!

Uh oh!

nak3 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rhuss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mgencur left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pierDipi Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pierDipi Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nak3 commented Aug 31, 2023

Uh oh!

rhuss commented Sep 7, 2023

Uh oh!

ReToCode commented Sep 12, 2023

Uh oh!

openshift-ci bot commented Sep 18, 2023

Uh oh!

Uh oh!

pierDipi commented Sep 18, 2023

Uh oh!

ReToCode commented Sep 18, 2023

Uh oh!

ReToCode commented Sep 18, 2023

Uh oh!

mgencur commented Sep 18, 2023

ReToCode commented Jul 24, 2023 •

edited

Loading

netlify bot commented Jul 24, 2023 •

edited

Loading

pierDipi Sep 18, 2023 •

edited

Loading

pierDipi Sep 18, 2023 •

edited

Loading