Skip to content

Commit db104c1

Browse files
agantonyagantony
authored
Merge pull request #89324 from rh-tokeefe/OSSM-8958
OSSM-8958: Cluster-wide migration using istio injection label
2 parents 5249c79 + 87c2bcf commit db104c1

File tree

3 files changed

+242
-0
lines changed

3 files changed

+242
-0
lines changed

‎migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ include::modules/ossm-control-plane-configuration-migration-requirements.adoc[le
1717

1818
include::modules/ossm-cluster-wide-migration-methods.adoc[leveloffset=+1]
1919

20+
// The following tasks are for migration using the Istio revision label
2021
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-revision-label.adoc[leveloffset=+1]
2122

2223
[role="_additional-resources"]
@@ -33,3 +34,30 @@ include::modules/ossm-creating-a-default-revision-tag-and-relabeling-the-namespa
3334
You can proceed to complete the migration and remove {SMProduct} 2 resources.
3435

3536
* xref:../../migrating/done/ossm-migrating-complete-assembly.adoc[Completing the Migration]
37+
38+
// The following tasks are for migration using the Istio injection label
39+
include::modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label.adoc[leveloffset=+1]
40+
41+
[role="_additional-resources"]
42+
.Additional resources
43+
44+
* xref:../../install/ossm-sidecar-injection-assembly.adoc#ossm-identifying-revision-name_ossm-sidecar-injection-assembly[Identifying the revision name]
45+
46+
include::modules/ossm-migrating-workloads-using-the-istio-injection-label.adoc[leveloffset=+2]
47+
48+
.Next steps
49+
50+
If you are using gateways, you must migrate them before you complete the migration process.
51+
52+
* xref:../../migrating/migrating-gateways/ossm-migrating-gateways-assembly.adoc[Migrating gateways from Service Mesh 2 to Service Mesh 3]
53+
54+
If you are not using gateways, and have verified your cluster-wide migration, create a default revision tag and re-label namespaces.
55+
56+
[IMPORTANT]
57+
====
58+
Before creating a default revision tag and relabelling the namespaces, you must migrate all remaining workload namespaces, including gateways.
59+
====
60+
61+
// insert xref to "Creating the default revision tag and relabeling the namespaces" after PR OSSM-9000 is merged
62+
63+
* Creating the default revision tag and relabeling the namespaces

‎modules/ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label.adoc‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-migrating-a-cluster-wide-deployment-using-the-istio-injection-label_{context}"]
7+
= Migrating a cluster-wide deployment by using the istio injection label
8+
9+
You can perform a canary upgrade with the gradual migration of data plane namespaces for a cluster-wide deployment by using the `istio-injection=enabled` label and the `default` revision tag.
10+
11+
You must re-label all of the data plane namespaces. However, it is safe to restart any of the workloads at any point during the migration process.
12+
13+
The `bookinfo` application is used as an example for the `Istio` resource. For more information about configuration differences between the {SMProduct} 2 `ServiceMeshControlPlane` resource and the {SMProduct} 3 `Istio` resource, see "ServiceMeshControlPlane resource to Istio resource fields mapping".
14+
15+
.Prerequisites
16+
17+
* You have deployed {ocp-product-title} 4.14 or later.
18+
* You are logged in to the {ocp-product-title} web console as a user with the `cluster-admin` role.
19+
* You have completed the premigration checklists.
20+
* You have the {SMProduct} {SMv2Version} Operator installed.
21+
* You have the {SMProduct} 3 Operator installed.
22+
* You have created an `IstioCNI` resource.
23+
* You have installed the `istioctl` tool.
24+
* You are running a cluster-wide Service Mesh control plane resource.
25+
* You have installed the `bookinfo` application.
26+
27+
.Procedure
28+
29+
. Identify the namespaces that contain a 2.6 control plane by running the following command:
30+
+
31+
[source,terminal]
32+
----
33+
$ oc get smcp -A
34+
----
35+
+
36+
.Example output
37+
[source,terminal]
38+
----
39+
NAMESPACE NAME READY STATUS PROFILES VERSION AGE
40+
istio-system install-istio-system 6/6 ComponentsReady ["default"] 2.6.6 115m
41+
----
42+
43+
. Create a YAML file named `ossm-3.yaml`. This procedure creates the {istio} resource for the 3.0 installation in the same namespace as the `ServiceMeshControlPlane` resource for the 2.6 installation.
44+
+
45+
[NOTE]
46+
====
47+
In the following example configuration, the {istio} control plane has access to all namespaces on the cluster. If you want to limit the namespaces the control plan has access to, you must define discovery selectors. You must match all the data plane namespaces that you plan to migrate from version 2.6.
48+
====
49+
+
50+
.Example `Istio` resource
51+
[source,yaml,subs="attributes,verbatim"]
52+
----
53+
apiVersion: sailoperator.io/v1
54+
kind: Istio
55+
metadata:
56+
name: ossm-3 # <1>
57+
spec:
58+
updateStrategy:
59+
type: RevisionBased
60+
namespace: istio-system # <2>
61+
version: v1.24.3
62+
values:
63+
meshConfig:
64+
extensionProviders: # <3>
65+
- name: prometheus
66+
prometheus: {}
67+
- name: otel
68+
opentelemetry:
69+
port: 4317
70+
service: otel-collector.opentelemetrycollector-3.svc.cluster.local
71+
----
72+
<1> The `name`, `updateStrategy` and `version` fields specify how the `IstioRevision` resource name is created. For more information, see "Identifying the revision name".
73+
<2> The 3.0 and 2.6 control planes must run in the same namespace.
74+
<3> Optional: If you are migrating metrics and tracing, update the `extensionProviders` fields according to your tracing and metrics configurations.
75+
+
76+
[NOTE]
77+
====
78+
To prevent the {SMProduct} 3.0 control plane from injecting proxies in the namespaces that have the `istio-injection=enabled` label applied and are still managed by {SMProduct} 2.6 control plane, do not use use the `default` name for the {istio} resource, and do not create the `default` revision tag in the following steps. You create the `default` revision tag later in this procedure.
79+
====
80+
81+
. Apply the YAML file by running the following command:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc apply -f ossm-3.yaml
86+
----
87+
88+
.Verification
89+
90+
. Verify that the new `istiod` resource uses the existing root certificate by running the following command:
91+
+
92+
[source,terminal]
93+
----
94+
$ oc logs deployments/istiod-ossm-3-v1-24-3 -n istio-system | grep 'Load signing key and cert from existing secret'
95+
----
96+
+
97+
.Example output
98+
[source,terminal]
99+
----
100+
2024-12-18T08:13:53.788959Z info pkica Load signing key and cert from existing secret istio-system/istio-ca-secret
101+
----

‎modules/ossm-migrating-workloads-using-the-istio-injection-label.adoc‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * service-mesh-docs-main/migrating/cluster-wide/ossm-migrating-cluster-wide-assembly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ossm-migrating-workloads-using-the-istio-injection-label_{context}"]
7+
= Migrating workloads by using the istio injection label
8+
9+
Now you can migrate your workloads from the {SMProduct} 2.6 control plane to the {SMproduct} 3.0 control plane.
10+
11+
[NOTE]
12+
====
13+
You can migrate workloads and gateways separately, and in any order. For more information, see "Migrating gateways".
14+
====
15+
16+
.Procedure
17+
18+
. Find the current `IstioRevision` resource for your {SMProduct} 3.0 control plane by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc get istios
23+
----
24+
+
25+
.Example output
26+
+
27+
[source,terminal]
28+
----
29+
NAME REVISIONS READY IN USE ACTIVE REVISION STATUS VERSION AGE
30+
ossm-3 1 1 0 ossm-3-v1-24-3 Healthy v1.24.3 30s
31+
----
32+
33+
. Copy the `ACTIVE REVISION` value to use as your `istio.io/rev` label in the next step.
34+
+
35+
[NOTE]
36+
====
37+
The naming format of your revisions depends on which upgrade strategy you choose for your `Istio` instance.
38+
====
39+
40+
. Update the injection labels on the data plane namespace by running the following command:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc label ns bookinfo istio.io/rev=ossm-3-v1-24-3 maistra.io/ignore-namespace="true" istio-injection- --overwrite=true
45+
----
46+
+
47+
The `oc label` command performs the following actions:
48+
49+
.. Removes the `istio-injection` label: This label prevents the 3.0 control plane from injecting the proxy. The `istio-injection` label takes precedence over the `istio.io/rev` label. You must temporarily remove the `istio-injection=enabled` because you cannot create the default `IstioRevisionTag` tag yet. Leaving the `istio-injection=enabled` label applied would prevent the 3.0 control plane from performing proxy injection.
50+
51+
.. Adds the `istio.io/rev=ossm-3-v1-24-3` label: This label ensures that any newly created or restarted pods in the namespace connect to the {SMProduct} 3.0 proxy.
52+
53+
.. Adds the `maistra.io/ignore-namespace: "true"` label: This label disables sidecar injection for {SMProduct} 2.6 proxies in the namespace. With the label applied, {SMProduct} 2.6 stops injecting proxies in this namespace, and any new proxies are injected by {SMProduct} 3.0. Without this label, the {SMProduct} 2.6 injection webhook tries to inject the pod and the injected sidecar proxy refuses to start since it will has both the {SMProduct} 2.6 and the {SMProduct} 3.0 Container Network Interface(CNI) annotations.
54+
+
55+
[NOTE]
56+
====
57+
After you apply the `maistra.io/ignore-namespace` label, any new pod that gets created in the namespace connects to the {SMProduct} 3.0 proxy. Workloads can still communicate with each other regardless of which control plane they are connected to.
58+
====
59+
60+
. Restart the workloads by using one of the following options:
61+
+
62+
.. To restart all the workloads at the same time so that the new pods are injected with the {SMProduct} 3.0 proxy, run the following command:
63+
+
64+
.Example command for `bookinfo` application
65+
[source,terminal]
66+
----
67+
$ oc rollout restart deployments -n bookinfo
68+
----
69+
70+
.. To restart each workload individually, run the following command for each workload:
71+
+
72+
.Example command for `bookinfo` application
73+
[source,terminal]
74+
----
75+
$ oc rollout restart deployments productpage-v1 -n bookinfo
76+
----
77+
78+
. Wait for the `productpage` application to restart by running the following command:
79+
+
80+
[source,terminal]
81+
----
82+
$ oc rollout status deployment productpage-v1 -n bookinfo
83+
----
84+
85+
.Verification
86+
87+
. Verify that the the new control plane manages the expected workloads by running the following command:
88+
+
89+
[source,terminal]
90+
----
91+
$ istioctl ps -n bookinfo
92+
----
93+
+
94+
.Example output:
95+
[source,terminal]
96+
----
97+
NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION
98+
details-v1-7f46897b-d497c.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
99+
productpage-v1-74bfbd4d65-vsxqm.bookinfo Kubernetes SYNCED (4s) SYNCED (4s) SYNCED (3s) SYNCED (4s) IGNORED istiod-ossm-3-v1-24-3-797bb4d78f-xpchx 1.24.3
100+
ratings-v1-559b64556-c5ppg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
101+
reviews-v1-847fb7c54d-qxt5d.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
102+
reviews-v2-5c7ff5b77b-8jbhd.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
103+
reviews-v3-5c5d764c9b-rrx8w.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-866b57d668-6lpcr 1.20.8
104+
----
105+
+
106+
The output shows that the `productpage-v1` deployment is the only deployment that has been restarted and was injected with the 3.0 proxy. Even if there are different versions of the proxies, communication between the services still works.
107+
108+
. If the 2.6 installation contains additional namespaces, migrate the next namespace now.
109+
+
110+
[NOTE]
111+
====
112+
Remove the `maistra.io/ignore-namespace="true"` label only after the 2.6 control plane has been uninstalled.
113+
====

0 commit comments

Comments
 (0)