From 15a46fb7da0abf5858125e531823182bd97c74bf Mon Sep 17 00:00:00 2001 From: catherineluse Date: Tue, 13 Oct 2020 16:28:09 -0700 Subject: [PATCH] Fix formatting in Istio doc --- .../setup/enable-istio-in-cluster/_index.md | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md index 59df49bae16..9bee04ac7ab 100644 --- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md @@ -3,8 +3,10 @@ title: 1. Enable Istio in the Cluster weight: 1 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster + - /rancher/v2.x/en/istio/setup/enable-istio-in-cluster --- + Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. - `cluster-admin` @@ -22,21 +24,23 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/ Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed. ->**Note:** In clusters where: -> -> - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. -> - The Project Network Isolation option is enabled. -> - You install the Istio Ingress module -> ->The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options: -> 1. You add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: -> ``` -> ... -> - podSelector: -> matchLabels: -> app: istio-ingressgateway ->``` -> 2. You move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation +**Note:** In clusters where: + + - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. + - The Project Network Isolation option is enabled. + - You install the Istio Ingress module + +The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options. + + +The first option is to add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: + +``` +- podSelector: + matchLabels: + app: istio-ingressgateway +``` +The second option is to move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation ## Additonal Config Options