Skip to content

Commit b5bca5e

Browse files
rh-tokeeferh-tokeefe
committed
OSSM-8958: Cluster-wide migration using istio-injection label
1 parent 53b6bf3 commit b5bca5e

File tree

2 files changed

+183
-0
lines changed

2 files changed

+183
-0
lines changed

‎modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label.adoc‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/checklists/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label_{context}"]
7+
= Migrating a cluster-wide deployment using the istio injection label
8+
9+
This procedure performs a canary upgrade with the gradual migration of data plane namespaces for a cluster-wide deployment using the `istio-injection=enabled` label. It is safe to restart any workloads at any point during the {SMProduct} {SMv2Version} to {SMProduct} 3 migration process. You must apply new namespace labels.
10+
11+
The `bookinfo` example application is being used for demonstration purposes with a minimal example for the `Istio` resource. For more information on configuration differences between the {SMProduct} 2 `ServiceMeshControlPlane` resource and the {SMProduct} 3 `Istio` resource, see "ServiceMeshControlPlane resource to Istio resource fields mapping".
12+
13+
You can follow these same steps with your own workloads.
14+
15+
.Prerequisites
16+
17+
* You have deployed {ocp-product-title} 4.14 or later.
18+
* You are logged in to the {ocp-product-title} web console as a user with the `cluster-admin` role.
19+
* You have completed the premigration checklists.
20+
* You have the {SMProduct} {SMv2Version} Operator installed.
21+
* You have the {SMProduct} 3 Operator installed.
22+
* You created an `IstioCNI` resource.
23+
* You have the `istioctl` tool installed.
24+
* You are running a `MultiTenant` `ServiceMeshControlPlane`.
25+
* You have installed the `bookinfo` application.
26+
27+
.Procedure
28+
29+
. Identify the namespaces that contain a 2.6 control plane by running the following command:
30+
+
31+
[source,terminal]
32+
----
33+
$ oc get smcp -A
34+
----
35+
+
36+
.Sample output:
37+
[source,terminal]
38+
----
39+
NAMESPACE NAME READY STATUS PROFILES VERSION AGE
40+
istio-system install-istio-system 6/6 ComponentsReady ["default"] 2.6.4 115m
41+
----
42+
43+
. Create a YAML file named `ossm-3.yaml` that creates the {istio} resource for the 3.0 installation in the same namespace as the `ServiceMeshControlPlane` resource for the 2.6 installation.
44+
45+
.Example configuration
46+
[source,yaml,subs="attributes,verbatim"]
47+
----
48+
apiVersion: sailoperator.io/v1alpha1
49+
kind: Istio
50+
metadata:
51+
name: ossm-3 <1>
52+
spec:
53+
updateStrategy:
54+
type: RevisionBased
55+
namespace: istio-system <2>
56+
version: v1.24.1
57+
values: <3>
58+
meshConfig:
59+
extensionProviders:
60+
- name: prometheus
61+
prometheus: {}
62+
- name: otel
63+
opentelemetry:
64+
port: 4317
65+
service: otel-collector.opentelemetrycollector-3.svc.cluster.local
66+
----
67+
<1> The `name`, `updateStrategy` and `version` fields are significant for injection labels.
68+
<2> The 3.0 and 2.6 control planes must run in the same namespace.
69+
<3> Tracing and metrics configurations are optional.
70+
+
71+
This example configuration does not use any `discoverySelectors`, which means the {istio} control plane has access to all namespaces. If you want to define `discoverySelectors` all data plane namespaces that you plan to migrate from 2.6 must be matched.
72+
+
73+
[NOTE]
74+
====
75+
To prevent the {SMProduct} 3.0 control pane from injecting proxies to workloads in namespaces with istio-injection=enabled label applied do not use use the default name or default revision tag.
76+
====
77+
78+
. Apply the YAML file by running the following command:
79+
+
80+
[source,terminal]
81+
----
82+
$ oc apply -f ossm-3.yaml
83+
----
84+
85+
. Verify that the new `istiod` resource uses the existing root certificate by running the following command:
86+
+
87+
[source,terminal]
88+
----
89+
$ oc logs deployments/istiod-ossm-3-v1-24-1 -n istio-system | grep 'Load signing key and cert from existing secret'
90+
----
91+
+
92+
.Sample output:
93+
[source,terminal]
94+
----
95+
2024-12-18T08:13:53.788959Z info pkica Load signing key and cert from existing secret istio-system/istio-ca-secret
96+
----

‎modules/ossm-migrating-workloads-using-the-istio-injection-label.adoc‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/checklists/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label_{context}"]
7+
= Migrating workloads for cluster-wide deployment using the istio injection label
8+
9+
Now you can migrate your workloads from the {SMProduct} 2.6 control plane to the {SMproduct} 3.0 control plane.
10+
11+
[NOTE]
12+
====
13+
You can migrate workloads and gateways separately, and in any order. For more information, see "Migrating gateways".
14+
====
15+
16+
.Procedure
17+
18+
. Update the injection labels on the data plane namespace by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc label ns bookinfo istio.io/rev=ossm-3-v1-24-1 maistra.io/ignore-namespace="true" istio-injection- --overwrite=true
23+
----
24+
+
25+
The previous example adds two labels and removes one.
26+
+
27+
The `istio.io/rev=ossm-3-v1-24-1` label ensures that 3.0 proxy gets injected to any new or restarted pods in the namespace. In the previous example, the 3.0 revision is named `ossm-3-v1-24-1`.
28+
+
29+
The `maistra.io/ignore-namespace: "true"` label ensures that 2.6 control plane stops injecting proxies in this namespace to avoid conflicts between 2.6 and 3.0 side car injectors.
30+
+
31+
The `istio-injection` label must be removed if it exists because it takes precedence over `istio.io/rev` label. Leaving the `istio-injection=enabled` label applied prevents proxy injection.
32+
33+
. Restart the workloads by using one of the following options:
34+
+
35+
.. To restart all the workloads at once so that the new pods are injected with the {SMProduct} 3.0 proxy, run the following command:
36+
+
37+
.Example command for `bookinfo` application
38+
[source,terminal]
39+
----
40+
$ oc rollout restart deployments -n bookinfo
41+
----
42+
43+
.. To restart each workload individually, run the following command for each workload:
44+
+
45+
.Example command with `bookinfo` application
46+
[source,terminal]
47+
----
48+
$ oc rollout restart deployments productpage-v1 -n bookinfo
49+
----
50+
51+
. Wait for the `productpage` application to restart by running the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc rollout status deployment productpage-v1 -n bookinfo
56+
----
57+
58+
.Verification
59+
60+
. Ensure that expected workloads are managed by the new control plane by running the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ istioctl ps -n bookinfo
65+
----
66+
+
67+
.Sample output:
68+
[source,terminal]
69+
----
70+
$ istioctl ps -n bookinfo
71+
NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION
72+
details-v1-7f46897b-d497c.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
73+
productpage-v1-74bfbd4d65-vsxqm.bookinfo Kubernetes SYNCED (4s) SYNCED (4s) SYNCED (3s) SYNCED (4s) IGNORED istiod-ossm-3-v1-24-1-797bb4d78f-xpchx 1.24.1
74+
ratings-v1-559b64556-c5ppg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
75+
reviews-v1-847fb7c54d-qxt5d.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
76+
reviews-v2-5c7ff5b77b-8jbhd.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
77+
reviews-v3-5c5d764c9b-rrx8w.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
78+
----
79+
+
80+
Even if there are different versions of the proxies communication between services should work.
81+
82+
. If the 2.6 installation contains additional namespaces, migrate the next namespace now.
83+
+
84+
[Important]
85+
====
86+
Do not remove the `maistra.io/ignore-namespace="true"` label until the 2.6 control plane is uninstalled.
87+
====

0 commit comments

Comments
 (0)