public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-05-17 18:37:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Grammar/style edit

Browse Source
This commit is contained in:
Catherine Luse
2020-03-11 14:16:11 -07:00
committed by GitHub
parent c72ec1e278
commit 7b51d0dd76
1 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
+16 -11
View File
@@ -2,19 +2,24 @@
title: Enable Istio with Pod Security Policies
---
>**Note:** The following guide is only for RKE provisioned clusters
>**Note:** The following guide is only for RKE provisioned clusters.
If you have restrictive Pod Security Policies enabled, then istio may not be able to function correctly as it needs certain permissions in order to install itself and manage pod infrastructure. In this section we will configure a cluster with PSP's enabled for an Istio install, and also setup the Istio CNI plugin.
If you have restrictive Pod Security Policies enabled, then Istio may not be able to function correctly, because it needs certain permissions in order to install itself and manage pod infrastructure. In this section, we will configure a cluster with PSPs enabled for an Istio install, and also set up the Istio CNI plugin.
The Istio CNI plugin removes the need for each application pod to have a priveleged `NET_ADMIN` container. For further information see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
The Istio CNI plugin removes the need for each application pod to have a priveleged `NET_ADMIN` container. For further information, see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
#### Allow access to iptables
- 1. [Allow access to iptables.](#1-allow-access-to-iptables)
- 2. [Configure the System Project Policy to allow Istio install.](#2-configure-the-system-project-policy-to-allow-istio-install)
- 3. [Install the CNI plugin in the System project.](#3-install-the-cni-plugin-in-the-system-project)
- 4. [Install Istio.](#4-install-istio)
Configure the cluster to allow the CNI plugin to set networking rules via iptables modules
### 1. Allow access to iptables
1. From the **Global** view, navigate to the **cluster** where you want to enable Istio.
Configure the cluster to allow the CNI plugin to set networking rules via iptables modules:
1. From the **Global** view, navigate to the cluster where you want to enable Istio.
1. Select the **Ellipsis (...) > Edit**.
1. Click "Edit as YAML", find the services block and edit to include:
1. Click "Edit as YAML", find the services block, and edit to include:
```
services:
@@ -23,14 +28,14 @@ services:
- '/lib/modules:/lib/modules'
```
#### Configure the System Project Policy to allow Istio install
### 2. Configure the System Project Policy to allow Istio install
1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
1. Find the **Project: System** project and select the **Ellipsis (...) > Edit**.
1. Change the Pod Security Policy option to be unrestricted, then click Save.
#### Install the CNI Plugin in the System Project
### 3. Install the CNI Plugin in the System Project
1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
1. Select the **Project: System** project.
@@ -52,8 +57,8 @@ services:
```
1. Click Launch
#### Install Istio
### 4. Install Istio
Follow the [primary instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/), adding a custom answer: `istio_cni.enabled: true`.
After Istio has finished installing, the Apps page in System Projects should show both istio and istio-cni applications deployed successfully. Sidecar injection will now be functional.
After Istio has finished installing, the Apps page in System Projects should show both istio and `istio-cni` applications deployed successfully. Sidecar injection will now be functional.