diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md index 7a4c71709c0..e1f14e7fa75 100644 --- a/content/rancher/v2.x/en/istio/_index.md +++ b/content/rancher/v2.x/en/istio/_index.md @@ -3,24 +3,24 @@ title: Istio weight: 15 --- -> This section is about the new version of the Istio app in Rancher v2.5.0. If you are using a Rancher version from v2.3.0 to v2.5.0, the older way of setting up Istio is documented in [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/) +# Istio in Cluster Manager +If you are using a Rancher version from **v2.3.x** to **v2.4.x**, the older way of setting up Istio in th **Cluster Manager** is documented in [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/) - [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. - As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. +# Istio in Cluster Explorer + [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices. -Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. +As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. -This service mesh provides features that include but are not limited to the following: +Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to a team of developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. -- Traffic management features -- Enhanced monitoring and tracing -- Service discovery and routing -- Secure connections and service-to-service authentication with mutual TLS -- Load balancing -- Automatic retries, backoff, and circuit breaking +This core service mesh provides features that include but are not limited to the following: -After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`. +- **Traffic Management** such as ingress and egress routing, circuit breaking, mirroring. +- **Security** with resources to authenticate and authorize traffic and users, mTLS included. +- **Observability** of logs, metrics, and distributed traffic flows. + +After [setting up istio]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) you can leverage Istio's control plane functionality through the Cluster Explorer, `kubectl`, or `istioctl`. Rancher's Istio integration comes with a comprehensive visualization aid: @@ -66,7 +66,7 @@ To access the Grafana and Prometheus visualizations, from the **Cluster Explorer To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. -By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards. +By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup](URLNEEDED) if you would like to use a different configuration for prometheus data scraping. Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml. @@ -86,7 +86,7 @@ By default, each Rancher-provisioned cluster has one NGINX ingress controller al ![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{}}/img/rancher/istio-ingress.svg) - Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED) + Additional Istio Ingress gateways can be enabled via the [overlay file](URLNEEDED). ### Egress Support diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md index a1c3face6e3..2aea1303e56 100644 --- a/content/rancher/v2.x/en/istio/resources/_index.md +++ b/content/rancher/v2.x/en/istio/resources/_index.md @@ -16,18 +16,18 @@ Before enabling Istio, we recommend that you confirm that your Rancher worker no > **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component. -The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each central Istio component. +The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each core Istio component. In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) Workload | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable ----------|---------------|---------------|-------------|-------------|------------- -istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y - istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y - istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y -istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y - Others | 500m | 500Mi | - | - | Y - **Total** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** +---------:|---------------:|---------------:|-------------:|-------------:|-------------: +Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y +Istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y +Istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y +Istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y +Others | 500m | 500Mi | - | - | Y +**Total** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** # Configuring Resource Allocations diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md index 382a67c8daa..ce4536c6780 100644 --- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md @@ -35,12 +35,26 @@ For more information on Overlay Files, refer to the [documentation](https://isti ## Selectors & Scrape Configs -The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=true` which means only the `istio-system` namespace will be scraped by prometheus by default. To ensure you can view traffic, metrics and graphs for resources deployed in other namespaces you will need to add additional configuration. +The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` which enables monitoring across all namespaces by default. This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label. -There are three different ways to enable prometheus to detect resources in other namespaces: +If you would like to limit prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources. + +**Set ingnoreNamspaceSelectors to True** + +This limits monitoring to specific namespaces. + + +1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace** +1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. +1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. +1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true` +1. Complete install or upgrade + +**Result:** Prometheus will be limited to specific namespaces which means one of the following configurations will need to be set up to continue to view data in various dashboards + +There are two different ways to enable prometheus to detect resources in other namespaces when `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`: 1. Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape. -1. Set `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` on your rancher-monitoring instance. 1. Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces. **Option 1: Create a Service Monitor or Pod Monitor** @@ -94,18 +108,7 @@ spec: targetLabel: pod_name ``` -**Option 2: Set ingnoreNamspaceSelectors to False** -This enables monitoring accross namespaces which means ServiceMonitors or PodMonitors will not need to be created per namespace. - - >Potential security trade off is users in namespace A can create a service monitor that monitors services in namespace B despite not having permissions to namespace B -1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace** -1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. -1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. -1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true` -1. Complete install or upgrade - -**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus. **Option 3: Set ingnoreNamspaceSelectors to False**