mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 13:08:11 +00:00
Remove unneeded intermediate folders
This commit is contained in:
Billy Tat
+25
@@ -0,0 +1,25 @@
|
||||
---
|
||||
title: Additional Steps for Project Network Isolation
|
||||
weight: 4
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/canal-and-project-network
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/canal-and-project-network/
|
||||
---
|
||||
|
||||
In clusters where:
|
||||
|
||||
- You are using the Canal network plugin with Rancher before v2.5.8, or you are using Rancher v2.5.8+ with an any RKE network plug-in that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin
|
||||
- The Project Network Isolation option is enabled
|
||||
- You install the Istio Ingress module
|
||||
|
||||
The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be inaccessible from the namespace where Istio is installed. You have two options.
|
||||
|
||||
The first option is to add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines:
|
||||
|
||||
```
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: istio-ingressgateway
|
||||
```
|
||||
|
||||
The second option is to move the `istio-system` namespace to the `system` project, which by default is excluded from the network isolation.
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
title: Configuration Options
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/
|
||||
---
|
||||
|
||||
- [Egress Support](#egress-support)
|
||||
- [Enabling Automatic Sidecar Injection](#enabling-automatic-sidecar-injection)
|
||||
- [Overlay File](#overlay-file)
|
||||
- [Selectors and Scrape Configs](#selectors-and-scrape-configs)
|
||||
- [Enable Istio with Pod Security Policies](#enable-istio-with-pod-security-policies)
|
||||
- [Additional Steps for Installing Istio on an RKE2 Cluster](#additional-steps-for-installing-istio-on-an-rke2-cluster)
|
||||
- [Additional Steps for Project Network Isolation](#additional-steps-for-project-network-isolation)
|
||||
|
||||
### Egress Support
|
||||
|
||||
By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](#overlay-file).
|
||||
|
||||
### Enabling Automatic Sidecar Injection
|
||||
|
||||
Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed.
|
||||
|
||||
### Overlay File
|
||||
|
||||
An Overlay File is designed to support extensive configuration of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario.
|
||||
|
||||
The Overlay File will add configuration on top of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation.
|
||||
|
||||
For more information on Overlay Files, refer to the [Istio documentation.](https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings)
|
||||
|
||||
### Selectors and Scrape Configs
|
||||
|
||||
The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` which enables monitoring across all namespaces by default. This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label.
|
||||
|
||||
If you would like to limit Prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources.
|
||||
|
||||
For details, refer to [this section.](./selectors-and-scrape)
|
||||
|
||||
### Enable Istio with Pod Security Policies
|
||||
|
||||
Refer to [this section.](./enable-istio-with-psp)
|
||||
|
||||
### Additional Steps for Installing Istio on an RKE2 Cluster
|
||||
|
||||
Refer to [this section.](./rke2)
|
||||
|
||||
### Additional Steps for Project Network Isolation
|
||||
|
||||
Refer to [this section.](./canal-and-project-network)
|
||||
+114
@@ -0,0 +1,114 @@
|
||||
---
|
||||
title: Enable Istio with Pod Security Policies
|
||||
weight: 1
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/enable-istio-with-psp
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/enable-istio-with-psp/
|
||||
---
|
||||
|
||||
import Tabs from '@theme/Tabs';
|
||||
import TabItem from '@theme/TabItem';
|
||||
|
||||
If you have restrictive Pod Security Policies enabled, then Istio may not be able to function correctly, because it needs certain permissions in order to install itself and manage pod infrastructure. In this section, we will configure a cluster with PSPs enabled for an Istio install, and also set up the Istio CNI plugin.
|
||||
|
||||
The Istio CNI plugin removes the need for each application pod to have a privileged `NET_ADMIN` container. For further information, see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
|
||||
|
||||
The steps differ based on the Rancher version.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="v2.5.4+">
|
||||
|
||||
> **Prerequisites:**
|
||||
>
|
||||
> - The cluster must be an RKE Kubernetes cluster.
|
||||
> - The cluster must have been created with a default PodSecurityPolicy.
|
||||
>
|
||||
> To enable pod security policy support when creating a Kubernetes cluster in the Rancher UI, go to <b>Advanced Options.</b> In the <b>Pod Security Policy Support</b> section, click <b>Enabled.</b> Then select a default pod security policy.
|
||||
|
||||
1. [Set the PodSecurityPolicy to unrestricted](#1-set-the-podsecuritypolicy-to-unrestricted)
|
||||
2. [Enable the CNI](#2-enable-the-cni)
|
||||
3. [Verify that the CNI is working.](#3-verify-that-the-cni-is-working)
|
||||
|
||||
### 1. Set the PodSecurityPolicy to unrestricted
|
||||
|
||||
An unrestricted PSP allows Istio to be installed.
|
||||
|
||||
Set the PSP to `unrestricted` in the project where is Istio is installed, or the project where you plan to install Istio.
|
||||
|
||||
1. From the cluster view of the **Cluster Manager,** select **Projects/Namespaces.**
|
||||
1. Find the **Project: System** and select the **⋮ > Edit**.
|
||||
1. Change the Pod Security Policy option to be unrestricted, then click **Save.**
|
||||
|
||||
### 2. Enable the CNI
|
||||
|
||||
When installing or upgrading Istio through **Apps & Marketplace,**
|
||||
|
||||
1. Click **Components.**
|
||||
2. Check the box next to **Enabled CNI.**
|
||||
3. Finish installing or upgrading Istio.
|
||||
|
||||
The CNI can also be enabled by editing the `values.yaml`:
|
||||
|
||||
```
|
||||
istio_cni.enabled: true
|
||||
```
|
||||
|
||||
Istio should install successfully with the CNI enabled in the cluster.
|
||||
|
||||
### 3. Verify that the CNI is working
|
||||
|
||||
Verify that the CNI is working by deploying a [sample application](https://istio.io/latest/docs/examples/bookinfo/) or deploying one of your own applications.
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="v2.5.0-v2.5.3">
|
||||
|
||||
> **Prerequisites:**
|
||||
>
|
||||
> - The cluster must be an RKE Kubernetes cluster.
|
||||
> - The cluster must have been created with a default PodSecurityPolicy.
|
||||
>
|
||||
> To enable pod security policy support when creating a Kubernetes cluster in the Rancher UI, go to <b>Advanced Options.</b> In the <b>Pod Security Policy Support</b> section, click <b>Enabled.</b> Then select a default pod security policy.
|
||||
|
||||
1. [Configure the System Project Policy to allow Istio install.](#1-configure-the-system-project-policy-to-allow-istio-install)
|
||||
2. [Install the CNI plugin in the System project.](#2-install-the-cni-plugin-in-the-system-project)
|
||||
3. [Install Istio.](#3-install-istio)
|
||||
|
||||
### 1. Configure the System Project Policy to allow Istio install
|
||||
|
||||
1. From the cluster view of the **Cluster Manager,** select **Projects/Namespaces.**
|
||||
1. Find the **Project: System** and select the **⋮ > Edit**.
|
||||
1. Change the Pod Security Policy option to be unrestricted, then click Save.
|
||||
|
||||
### 2. Install the CNI Plugin in the System Project
|
||||
|
||||
1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
|
||||
1. Select the **Project: System** project.
|
||||
1. Choose **Tools > Catalogs** in the navigation bar.
|
||||
1. Add a catalog with the following:
|
||||
1. Name: istio-cni
|
||||
1. Catalog URL: https://github.com/istio/cni
|
||||
1. Branch: The branch that matches your current release, for example: `release-1.4`.
|
||||
1. From the main menu select **Apps**
|
||||
1. Click Launch and select istio-cni
|
||||
1. Update the namespace to be "kube-system"
|
||||
1. In the answers section, click "Edit as YAML" and paste in the following, then click launch:
|
||||
|
||||
```
|
||||
---
|
||||
logLevel: "info"
|
||||
excludeNamespaces:
|
||||
- "istio-system"
|
||||
- "kube-system"
|
||||
```
|
||||
|
||||
### 3. Install Istio
|
||||
|
||||
Follow the [primary instructions]({{<baseurl>}}/rancher/v2.5/en/istio/setup/enable-istio-in-cluster/), adding a custom answer: `istio_cni.enabled: true`.
|
||||
|
||||
After Istio has finished installing, the Apps page in System Projects should show both istio and `istio-cni` applications deployed successfully. Sidecar injection will now be functional.
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
@@ -0,0 +1,38 @@
|
||||
---
|
||||
title: Additional Steps for Installing Istio on an RKE2 Cluster
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/rke2
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/
|
||||
---
|
||||
|
||||
Through the **Cluster Explorer,** when installing or upgrading Istio through **Apps & Marketplace,**
|
||||
|
||||
1. Click **Components.**
|
||||
1. Check the box next to **Enabled CNI.**
|
||||
1. Add a custom overlay file specifying `cniBinDir` and `cniConfDir`. For more information on these options, refer to the [Istio documentation.](https://istio.io/latest/docs/setup/additional-setup/cni/#helm-chart-parameters) An example is below:
|
||||
|
||||
```yaml
|
||||
apiVersion: install.istio.io/v1alpha1
|
||||
kind: IstioOperator
|
||||
spec:
|
||||
components:
|
||||
cni:
|
||||
enabled: true
|
||||
values:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
- istio-system
|
||||
- kube-system
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
```
|
||||
1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container:
|
||||
```yaml
|
||||
securityContext:
|
||||
privileged: true
|
||||
```
|
||||
|
||||
**Result:** Now you should be able to utilize Istio as desired, including sidecar injection and monitoring via Kiali.
|
||||
+130
@@ -0,0 +1,130 @@
|
||||
---
|
||||
title: Selectors and Scrape Configs
|
||||
weight: 2
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/selectors-and-scrape
|
||||
- /rancher/v2.5/en/istio/setup/node-selectors
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/selectors-and-scrape/
|
||||
---
|
||||
|
||||
The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false`, which enables monitoring across all namespaces by default.
|
||||
|
||||
This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label.
|
||||
|
||||
If you would like to limit Prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources.
|
||||
|
||||
- [Limiting Monitoring to Specific Namespaces by Setting ignoreNamespaceSelectors to True](#limiting-monitoring-to-specific-namespaces-by-setting-ignorenamespaceselectors-to-true)
|
||||
- [Enabling Prometheus to Detect Resources in Other Namespaces](#enabling-prometheus-to-detect-resources-in-other-namespaces)
|
||||
- [Monitoring Specific Namespaces: Create a Service Monitor or Pod Monitor](#monitoring-specific-namespaces-create-a-service-monitor-or-pod-monitor)
|
||||
- [Monitoring Across Namespaces: Set ignoreNamespaceSelectors to False](#monitoring-across-namespaces-set-ignorenamespaceselectors-to-false)
|
||||
|
||||
### Limiting Monitoring to Specific Namespaces by Setting ignoreNamespaceSelectors to True
|
||||
|
||||
This limits monitoring to specific namespaces.
|
||||
|
||||
1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace**
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** Prometheus will be limited to specific namespaces which means one of the following configurations will need to be set up to continue to view data in various dashboards
|
||||
|
||||
### Enabling Prometheus to Detect Resources in Other Namespaces
|
||||
|
||||
There are two different ways to enable Prometheus to detect resources in other namespaces when `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`:
|
||||
|
||||
- **Monitoring specific namespaces:** Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape.
|
||||
- **Monitoring across namespaces:** Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces.
|
||||
|
||||
### Monitoring Specific Namespaces: Create a Service Monitor or Pod Monitor
|
||||
|
||||
This option allows you to define which specific services or pods you would like monitored in a specific namespace.
|
||||
|
||||
The usability tradeoff is that you have to create the service monitor or pod monitor per namespace since you cannot monitor across namespaces.
|
||||
|
||||
> **Prerequisite:** Define a ServiceMonitor or PodMonitor for `<your namespace>`. An example ServiceMonitor is provided below.
|
||||
|
||||
1. From the **Cluster Explorer**, open the kubectl shell
|
||||
1. Run `kubectl create -f <name of service/pod monitor file>.yaml` if the file is stored locally in your cluster.
|
||||
1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command.
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart and scroll down to **Preview Yaml**.
|
||||
1. Run `kubectl label namespace <your namespace> istio-injection=enabled` to enable the envoy sidecar injection
|
||||
|
||||
**Result:** `<your namespace>` can be scraped by prometheus.
|
||||
|
||||
<figcaption>Example Service Monitor for Istio Proxies</figcaption>
|
||||
|
||||
```yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: envoy-stats-monitor
|
||||
namespace: istio-system
|
||||
labels:
|
||||
monitoring: istio-proxies
|
||||
spec:
|
||||
selector:
|
||||
matchExpressions:
|
||||
- {key: istio-prometheus-ignore, operator: DoesNotExist}
|
||||
namespaceSelector:
|
||||
any: true
|
||||
jobLabel: envoy-stats
|
||||
endpoints:
|
||||
- path: /stats/prometheus
|
||||
targetPort: 15090
|
||||
interval: 15s
|
||||
relabelings:
|
||||
- sourceLabels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- action: labeldrop
|
||||
regex: "__meta_kubernetes_pod_label_(.+)"
|
||||
- sourceLabels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
targetLabel: namespace
|
||||
- sourceLabels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
targetLabel: pod_name
|
||||
```
|
||||
|
||||
### Monitoring across namespaces: Set ignoreNamespaceSelectors to False
|
||||
|
||||
This enables monitoring across namespaces by giving Prometheus additional scrape configurations.
|
||||
|
||||
The usability tradeoff is that all of Prometheus' `additionalScrapeConfigs` are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs before installing Istio.
|
||||
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade** and then **Preview Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.additionalScrapeConfigs` array to the **Additional Scrape Config** provided below.
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
|
||||
|
||||
<figcaption>Additional Scrape Config</figcaption>
|
||||
|
||||
``` yaml
|
||||
- job_name: 'istio/envoy-stats'
|
||||
scrape_interval: 15s
|
||||
metrics_path: /stats/prometheus
|
||||
kubernetes_sd_configs:
|
||||
- role: pod
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
||||
action: replace
|
||||
regex: ([^:]+)(?::\d+)?;(\d+)
|
||||
replacement: $1:15090
|
||||
target_label: __address__
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_pod_label_(.+)
|
||||
- source_labels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
target_label: namespace
|
||||
- source_labels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
target_label: pod_name
|
||||
```
|
||||
Reference in New Issue
Block a user