Jump To Close Expand all Collapse all Table of contents Service Mesh 1. Service Mesh 2.x Expand section "1. Service Mesh 2.x" Collapse section "1. Service Mesh 2.x" 1.1. About OpenShift Service Mesh Expand section "1.1. About OpenShift Service Mesh" Collapse section "1.1. About OpenShift Service Mesh" 1.1.1. Introduction to Red Hat OpenShift Service Mesh 1.1.2. Core features 1.2. Service Mesh Release Notes Expand section "1.2. Service Mesh Release Notes" Collapse section "1.2. Service Mesh Release Notes" 1.2.1. Making open source more inclusive 1.2.2. New features and enhancements Expand section "1.2.2. New features and enhancements" Collapse section "1.2.2. New features and enhancements" 1.2.2.1. New features Red Hat OpenShift Service Mesh version 2.3.3 Expand section "1.2.2.1. New features Red Hat OpenShift Service Mesh version 2.3.3" Collapse section "1.2.2.1. New features Red Hat OpenShift Service Mesh version 2.3.3" 1.2.2.1.1. Component versions included in Red Hat OpenShift Service Mesh version 2.3.3 1.2.2.2. New features Red Hat OpenShift Service Mesh version 2.3.2 Expand section "1.2.2.2. New features Red Hat OpenShift Service Mesh version 2.3.2" Collapse section "1.2.2.2. New features Red Hat OpenShift Service Mesh version 2.3.2" 1.2.2.2.1. Component versions included in Red Hat OpenShift Service Mesh version 2.3.2 1.2.2.3. New features Red Hat OpenShift Service Mesh version 2.3.1 Expand section "1.2.2.3. New features Red Hat OpenShift Service Mesh version 2.3.1" Collapse section "1.2.2.3. New features Red Hat OpenShift Service Mesh version 2.3.1" 1.2.2.3.1. Component versions included in Red Hat OpenShift Service Mesh version 2.3.1 1.2.2.4. New features Red Hat OpenShift Service Mesh version 2.3 Expand section "1.2.2.4. New features Red Hat OpenShift Service Mesh version 2.3" Collapse section "1.2.2.4. New features Red Hat OpenShift Service Mesh version 2.3" 1.2.2.4.1. Component versions included in Red Hat OpenShift Service Mesh version 2.3 1.2.2.4.2. New Container Network Interface (CNI) DaemonSet container and ConfigMap 1.2.2.4.3. Gateway injection support 1.2.2.4.4. Istio 1.14 Support 1.2.2.4.5. OpenShift Service Mesh Console 1.2.2.4.6. Cluster-Wide deployment Expand section "1.2.2.4.6. Cluster-Wide deployment" Collapse section "1.2.2.4.6. Cluster-Wide deployment" 1.2.2.4.6.1. Configuring cluster-wide deployment 1.2.2.5. New features Red Hat OpenShift Service Mesh version 2.2.6 Expand section "1.2.2.5. New features Red Hat OpenShift Service Mesh version 2.2.6" Collapse section "1.2.2.5. New features Red Hat OpenShift Service Mesh version 2.2.6" 1.2.2.5.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.6 1.2.2.6. New features Red Hat OpenShift Service Mesh version 2.2.5 Expand section "1.2.2.6. New features Red Hat OpenShift Service Mesh version 2.2.5" Collapse section "1.2.2.6. New features Red Hat OpenShift Service Mesh version 2.2.5" 1.2.2.6.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.5 1.2.2.7. New features Red Hat OpenShift Service Mesh version 2.2.4 Expand section "1.2.2.7. New features Red Hat OpenShift Service Mesh version 2.2.4" Collapse section "1.2.2.7. New features Red Hat OpenShift Service Mesh version 2.2.4" 1.2.2.7.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.4 1.2.2.8. New features Red Hat OpenShift Service Mesh version 2.2.3 Expand section "1.2.2.8. New features Red Hat OpenShift Service Mesh version 2.2.3" Collapse section "1.2.2.8. New features Red Hat OpenShift Service Mesh version 2.2.3" 1.2.2.8.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.3 1.2.2.9. New features Red Hat OpenShift Service Mesh version 2.2.2 Expand section "1.2.2.9. New features Red Hat OpenShift Service Mesh version 2.2.2" Collapse section "1.2.2.9. New features Red Hat OpenShift Service Mesh version 2.2.2" 1.2.2.9.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.2 1.2.2.9.2. Copy route labels 1.2.2.10. New features Red Hat OpenShift Service Mesh version 2.2.1 Expand section "1.2.2.10. New features Red Hat OpenShift Service Mesh version 2.2.1" Collapse section "1.2.2.10. New features Red Hat OpenShift Service Mesh version 2.2.1" 1.2.2.10.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2.1 1.2.2.11. New features Red Hat OpenShift Service Mesh 2.2 Expand section "1.2.2.11. New features Red Hat OpenShift Service Mesh 2.2" Collapse section "1.2.2.11. New features Red Hat OpenShift Service Mesh 2.2" 1.2.2.11.1. Component versions included in Red Hat OpenShift Service Mesh version 2.2 1.2.2.11.2. WasmPlugin API 1.2.2.11.3. ROSA support 1.2.2.11.4. istio-node DaemonSet renamed 1.2.2.11.5. Envoy sidecar networking changes 1.2.2.11.6. Service Mesh Control Plane 1.1 1.2.2.11.7. Istio 1.12 Support 1.2.2.11.8. Kubernetes Gateway API Expand section "1.2.2.11.8. Kubernetes Gateway API" Collapse section "1.2.2.11.8. Kubernetes Gateway API" 1.2.2.11.8.1. Installing the Gateway API CRDs 1.2.2.11.8.2. Enabling Kubernetes Gateway API 1.2.2.11.8.3. Manually linking an existing gateway to a Gateway resource 1.2.2.12. New features Red Hat OpenShift Service Mesh 2.1.6 Expand section "1.2.2.12. New features Red Hat OpenShift Service Mesh 2.1.6" Collapse section "1.2.2.12. New features Red Hat OpenShift Service Mesh 2.1.6" 1.2.2.12.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.6 1.2.2.13. New features Red Hat OpenShift Service Mesh 2.1.5.2 Expand section "1.2.2.13. New features Red Hat OpenShift Service Mesh 2.1.5.2" Collapse section "1.2.2.13. New features Red Hat OpenShift Service Mesh 2.1.5.2" 1.2.2.13.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.5.2 1.2.2.14. New features Red Hat OpenShift Service Mesh 2.1.5.1 Expand section "1.2.2.14. New features Red Hat OpenShift Service Mesh 2.1.5.1" Collapse section "1.2.2.14. New features Red Hat OpenShift Service Mesh 2.1.5.1" 1.2.2.14.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.5.1 1.2.2.15. New features Red Hat OpenShift Service Mesh 2.1.5 Expand section "1.2.2.15. New features Red Hat OpenShift Service Mesh 2.1.5" Collapse section "1.2.2.15. New features Red Hat OpenShift Service Mesh 2.1.5" 1.2.2.15.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.5 1.2.2.16. New features Red Hat OpenShift Service Mesh 2.1.4 Expand section "1.2.2.16. New features Red Hat OpenShift Service Mesh 2.1.4" Collapse section "1.2.2.16. New features Red Hat OpenShift Service Mesh 2.1.4" 1.2.2.16.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.4 1.2.2.17. New features Red Hat OpenShift Service Mesh 2.1.3 Expand section "1.2.2.17. New features Red Hat OpenShift Service Mesh 2.1.3" Collapse section "1.2.2.17. New features Red Hat OpenShift Service Mesh 2.1.3" 1.2.2.17.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.3 1.2.2.18. New features Red Hat OpenShift Service Mesh 2.1.2.1 Expand section "1.2.2.18. New features Red Hat OpenShift Service Mesh 2.1.2.1" Collapse section "1.2.2.18. New features Red Hat OpenShift Service Mesh 2.1.2.1" 1.2.2.18.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.2.1 1.2.2.19. New features Red Hat OpenShift Service Mesh 2.1.2 Expand section "1.2.2.19. New features Red Hat OpenShift Service Mesh 2.1.2" Collapse section "1.2.2.19. New features Red Hat OpenShift Service Mesh 2.1.2" 1.2.2.19.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.2 1.2.2.20. New features Red Hat OpenShift Service Mesh 2.1.1 Expand section "1.2.2.20. New features Red Hat OpenShift Service Mesh 2.1.1" Collapse section "1.2.2.20. New features Red Hat OpenShift Service Mesh 2.1.1" 1.2.2.20.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1.1 1.2.2.20.2. Disabling network policies 1.2.2.21. New features and enhancements Red Hat OpenShift Service Mesh 2.1 Expand section "1.2.2.21. New features and enhancements Red Hat OpenShift Service Mesh 2.1" Collapse section "1.2.2.21. New features and enhancements Red Hat OpenShift Service Mesh 2.1" 1.2.2.21.1. Component versions included in Red Hat OpenShift Service Mesh version 2.1 1.2.2.21.2. Service Mesh Federation 1.2.2.21.3. OVN-Kubernetes Container Network Interface (CNI) generally available 1.2.2.21.4. Service Mesh WebAssembly (WASM) Extensions 1.2.2.21.5. 3scale WebAssembly Adapter (WASM) 1.2.2.21.6. Istio 1.9 Support 1.2.2.21.7. Improved Service Mesh operator performance 1.2.2.21.8. Kiali updates 1.2.2.22. New features Red Hat OpenShift Service Mesh 2.0.11.1 Expand section "1.2.2.22. New features Red Hat OpenShift Service Mesh 2.0.11.1" Collapse section "1.2.2.22. New features Red Hat OpenShift Service Mesh 2.0.11.1" 1.2.2.22.1. Component versions included in Red Hat OpenShift Service Mesh version 2.0.11.1 1.2.2.23. New features Red Hat OpenShift Service Mesh 2.0.11 Expand section "1.2.2.23. New features Red Hat OpenShift Service Mesh 2.0.11" Collapse section "1.2.2.23. New features Red Hat OpenShift Service Mesh 2.0.11" 1.2.2.23.1. Component versions included in Red Hat OpenShift Service Mesh version 2.0.11 1.2.2.24. New features Red Hat OpenShift Service Mesh 2.0.10 Expand section "1.2.2.24. New features Red Hat OpenShift Service Mesh 2.0.10" Collapse section "1.2.2.24. New features Red Hat OpenShift Service Mesh 2.0.10" 1.2.2.24.1. Component versions included in Red Hat OpenShift Service Mesh version 2.0.10 1.2.2.25. New features Red Hat OpenShift Service Mesh 2.0.9 Expand section "1.2.2.25. New features Red Hat OpenShift Service Mesh 2.0.9" Collapse section "1.2.2.25. New features Red Hat OpenShift Service Mesh 2.0.9" 1.2.2.25.1. Component versions included in Red Hat OpenShift Service Mesh version 2.0.9 1.2.2.26. New features Red Hat OpenShift Service Mesh 2.0.8 1.2.2.27. New features Red Hat OpenShift Service Mesh 2.0.7.1 Expand section "1.2.2.27. New features Red Hat OpenShift Service Mesh 2.0.7.1" Collapse section "1.2.2.27. New features Red Hat OpenShift Service Mesh 2.0.7.1" 1.2.2.27.1. Change in how Red Hat OpenShift Service Mesh handles URI fragments 1.2.2.27.2. Required update for authorization policies 1.2.2.28. New features Red Hat OpenShift Service Mesh 2.0.7 1.2.2.29. Red Hat OpenShift Service Mesh on Red Hat OpenShift Dedicated and Microsoft Azure Red Hat OpenShift 1.2.2.30. New features Red Hat OpenShift Service Mesh 2.0.6 1.2.2.31. New features Red Hat OpenShift Service Mesh 2.0.5 1.2.2.32. New features Red Hat OpenShift Service Mesh 2.0.4 Expand section "1.2.2.32. New features Red Hat OpenShift Service Mesh 2.0.4" Collapse section "1.2.2.32. New features Red Hat OpenShift Service Mesh 2.0.4" 1.2.2.32.1. Manual updates required by CVE-2021-29492 and CVE-2021-31920 1.2.2.32.2. Updating the path normalization configuration 1.2.2.32.3. Path normalization configuration examples 1.2.2.32.4. Configuring your SMCP for path normalization 1.2.2.32.5. Configuring for case normalization 1.2.2.33. New features Red Hat OpenShift Service Mesh 2.0.3 1.2.2.34. New features Red Hat OpenShift Service Mesh 2.0.2 1.2.2.35. New features Red Hat OpenShift Service Mesh 2.0.1 1.2.2.36. New features Red Hat OpenShift Service Mesh 2.0 1.2.3. Technology Preview 1.2.4. Deprecated and removed features Expand section "1.2.4. Deprecated and removed features" Collapse section "1.2.4. Deprecated and removed features" 1.2.4.1. Deprecated and removed features Red Hat OpenShift Service Mesh 2.3 1.2.4.2. Deprecated features Red Hat OpenShift Service Mesh 2.2 1.2.4.3. Removed features Red Hat OpenShift Service Mesh 2.2 1.2.4.4. Removed features Red Hat OpenShift Service Mesh 2.1 1.2.4.5. Deprecated features Red Hat OpenShift Service Mesh 2.0 1.2.5. Known issues Expand section "1.2.5. Known issues" Collapse section "1.2.5. Known issues" 1.2.5.1. Service Mesh known issues 1.2.5.2. Kiali known issues 1.2.5.3. Red Hat OpenShift distributed tracing known issues 1.2.6. Fixed issues Expand section "1.2.6. Fixed issues" Collapse section "1.2.6. Fixed issues" 1.2.6.1. Service Mesh fixed issues 1.2.6.2. Red Hat OpenShift distributed tracing fixed issues 1.3. Understanding Service Mesh Expand section "1.3. Understanding Service Mesh" Collapse section "1.3. Understanding Service Mesh" 1.3.1. Understanding service mesh 1.3.2. Service Mesh architecture 1.3.3. Understanding Kiali Expand section "1.3.3. Understanding Kiali" Collapse section "1.3.3. Understanding Kiali" 1.3.3.1. Kiali overview 1.3.3.2. Kiali architecture 1.3.3.3. Kiali features 1.3.4. Understanding distributed tracing Expand section "1.3.4. Understanding distributed tracing" Collapse section "1.3.4. Understanding distributed tracing" 1.3.4.1. Distributed tracing overview 1.3.4.2. Red Hat OpenShift distributed tracing architecture 1.3.4.3. Red Hat OpenShift distributed tracing features 1.3.5. Next steps 1.4. Service mesh deployment models Expand section "1.4. Service mesh deployment models" Collapse section "1.4. Service mesh deployment models" 1.4.1. Single mesh deployment model 1.4.2. Single tenancy deployment model 1.4.3. Multitenant deployment model 1.4.4. Multimesh or federated deployment model 1.5. Service Mesh and Istio differences Expand section "1.5. Service Mesh and Istio differences" Collapse section "1.5. Service Mesh and Istio differences" 1.5.1. Differences between Istio and Red Hat OpenShift Service Mesh Expand section "1.5.1. Differences between Istio and Red Hat OpenShift Service Mesh" Collapse section "1.5.1. Differences between Istio and Red Hat OpenShift Service Mesh" 1.5.1.1. Command line tool 1.5.1.2. Installation and upgrades 1.5.1.3. Automatic injection 1.5.1.4. Istio Role Based Access Control features 1.5.1.5. OpenSSL 1.5.1.6. External workloads 1.5.1.7. Virtual Machine Support 1.5.1.8. Component modifications 1.5.1.9. Envoy filters 1.5.1.10. Envoy services 1.5.1.11. Istio Container Network Interface (CNI) plugin 1.5.1.12. Global mTLS settings 1.5.1.13. Gateways 1.5.1.14. Multicluster configurations 1.5.1.15. Custom Certificate Signing Requests (CSR) 1.5.1.16. Routes for Istio Gateways Expand section "1.5.1.16. Routes for Istio Gateways" Collapse section "1.5.1.16. Routes for Istio Gateways" 1.5.1.16.1. Catch-all domains 1.5.1.16.2. Subdomains 1.5.1.16.3. Transport layer security 1.5.2. Multitenant installations Expand section "1.5.2. Multitenant installations" Collapse section "1.5.2. Multitenant installations" 1.5.2.1. Multitenancy versus cluster-wide installations 1.5.2.2. Cluster scoped resources 1.5.3. Kiali and service mesh 1.5.4. Distributed tracing and service mesh 1.6. Preparing to install Service Mesh Expand section "1.6. Preparing to install Service Mesh" Collapse section "1.6. Preparing to install Service Mesh" 1.6.1. Prerequisites 1.6.2. Supported configurations Expand section "1.6.2. Supported configurations" Collapse section "1.6.2. Supported configurations" 1.6.2.1. Supported platforms 1.6.2.2. Unsupported configurations 1.6.2.3. Supported network configurations 1.6.2.4. Supported configurations for Service Mesh 1.6.2.5. Supported configurations for Kiali 1.6.2.6. Supported configurations for Distributed Tracing 1.6.2.7. Supported WebAssembly module 1.6.3. Next steps 1.7. Installing the Operators Expand section "1.7. Installing the Operators" Collapse section "1.7. Installing the Operators" 1.7.1. Operator overview 1.7.2. Installing the Operators 1.7.3. Configuring the Service Mesh Operator to run on infrastructure nodes 1.7.4. Verifying the Service Mesh Operator is running on infrastructure node 1.7.5. Next steps 1.8. Creating the ServiceMeshControlPlane Expand section "1.8. Creating the ServiceMeshControlPlane" Collapse section "1.8. Creating the ServiceMeshControlPlane" 1.8.1. Deploying the Service Mesh control plane from the web console 1.8.2. Deploying the Service Mesh control plane using the CLI 1.8.3. Validating your SMCP installation with the CLI 1.8.4. Configuring all Service Mesh control plane components to run on infrastructure nodes 1.8.5. Configuring individual Service Mesh control plane components to run on infrastructure nodes 1.8.6. Verifying the Service Mesh control plane is running on infrastructure nodes 1.8.7. Validating your SMCP installation with Kiali 1.8.8. Installing on Red Hat OpenShift Service on AWS (ROSA) Expand section "1.8.8. Installing on Red Hat OpenShift Service on AWS (ROSA)" Collapse section "1.8.8. Installing on Red Hat OpenShift Service on AWS (ROSA)" 1.8.8.1. Installation location 1.8.8.2. Required Service Mesh control plane configuration 1.8.8.3. Restrictions on Kiali configuration 1.8.9. Additional resources 1.8.10. Next steps 1.9. Adding services to a service mesh Expand section "1.9. Adding services to a service mesh" Collapse section "1.9. Adding services to a service mesh" 1.9.1. About adding projects to a service mesh 1.9.2. Creating the Red Hat OpenShift Service Mesh member roll Expand section "1.9.2. Creating the Red Hat OpenShift Service Mesh member roll" Collapse section "1.9.2. Creating the Red Hat OpenShift Service Mesh member roll" 1.9.2.1. Creating the member roll from the web console 1.9.2.2. Creating the member roll from the CLI 1.9.3. Adding or removing projects from the service mesh using ServiceMeshMemberRoll resource with the web console 1.9.4. Adding or removing projects from the service mesh using ServiceMeshMemberRoll resource with the CLI 1.9.5. Adding a project to the service mesh using the ServiceMeshMember resource with the web console 1.9.6. Adding a project to the service mesh using the ServiceMeshMember resource with the CLI 1.9.7. Bookinfo example application Expand section "1.9.7. Bookinfo example application" Collapse section "1.9.7. Bookinfo example application" 1.9.7.1. Installing the Bookinfo application 1.9.7.2. Adding default destination rules 1.9.7.3. Verifying the Bookinfo installation 1.9.7.4. Removing the Bookinfo application Expand section "1.9.7.4. Removing the Bookinfo application" Collapse section "1.9.7.4. Removing the Bookinfo application" 1.9.7.4.1. Delete the Bookinfo project 1.9.7.4.2. Remove the Bookinfo project from the Service Mesh member roll 1.9.8. Next steps 1.10. Enabling sidecar injection Expand section "1.10. Enabling sidecar injection" Collapse section "1.10. Enabling sidecar injection" 1.10.1. Prerequisites 1.10.2. Enabling automatic sidecar injection 1.10.3. Validating sidecar injection 1.10.4. Setting proxy environment variables through annotations 1.10.5. Updating sidecar proxies 1.10.6. Next steps 1.11. Upgrading Service Mesh Expand section "1.11. Upgrading Service Mesh" Collapse section "1.11. Upgrading Service Mesh" 1.11.1. Understanding versioning Expand section "1.11.1. Understanding versioning" Collapse section "1.11.1. Understanding versioning" 1.11.1.1. How versioning affects Service Mesh upgrades 1.11.1.2. Understanding Service Mesh versions 1.11.2. Upgrade considerations Expand section "1.11.2. Upgrade considerations" Collapse section "1.11.2. Upgrade considerations" 1.11.2.1. Known issues that may affect upgrade 1.11.3. Upgrading the Operators 1.11.4. Upgrading the control plane Expand section "1.11.4. Upgrading the control plane" Collapse section "1.11.4. Upgrading the control plane" 1.11.4.1. Upgrade changes from version 2.2 to version 2.3 1.11.4.2. Upgrade changes from version 2.1 to version 2.2 1.11.4.3. Upgrade changes from version 2.0 to version 2.1 1.11.4.4. Upgrading the Service Mesh control plane 1.11.4.5. Migrating Red Hat OpenShift Service Mesh from version 1.1 to version 2.0 Expand section "1.11.4.5. Migrating Red Hat OpenShift Service Mesh from version 1.1 to version 2.0" Collapse section "1.11.4.5. Migrating Red Hat OpenShift Service Mesh from version 1.1 to version 2.0" 1.11.4.5.1. Upgrading Red Hat OpenShift Service Mesh 1.11.4.5.2. Configuring the 2.0 ServiceMeshControlPlane Expand section "1.11.4.5.2. Configuring the 2.0 ServiceMeshControlPlane" Collapse section "1.11.4.5.2. Configuring the 2.0 ServiceMeshControlPlane" 1.11.4.5.2.1. Architecture changes 1.11.4.5.2.2. Annotation changes 1.11.4.5.2.3. Behavioral changes 1.11.4.5.2.4. Migration details for unsupported resources 1.11.4.5.2.5. Mixer plugins 1.11.4.5.2.6. Mutual TLS changes Expand section "1.11.4.5.2.6. Mutual TLS changes" Collapse section "1.11.4.5.2.6. Mutual TLS changes" 1.11.4.5.2.6.1. Other mTLS Examples 1.11.4.5.3. Configuration recipes Expand section "1.11.4.5.3. Configuration recipes" Collapse section "1.11.4.5.3. Configuration recipes" 1.11.4.5.3.1. Mutual TLS in a data plane 1.11.4.5.3.2. Custom signing key 1.11.4.5.3.3. Tracing 1.11.4.5.3.4. Visualization 1.11.4.5.3.5. Resource utilization and scheduling 1.11.4.5.4. Next steps for migrating your applications and workloads 1.11.5. Upgrading the data plane Expand section "1.11.5. Upgrading the data plane" Collapse section "1.11.5. Upgrading the data plane" 1.11.5.1. Updating your applications and workloads 1.12. Managing users and profiles Expand section "1.12. Managing users and profiles" Collapse section "1.12. Managing users and profiles" 1.12.1. Creating the Red Hat OpenShift Service Mesh members 1.12.2. Creating Service Mesh control plane profiles Expand section "1.12.2. Creating Service Mesh control plane profiles" Collapse section "1.12.2. Creating Service Mesh control plane profiles" 1.12.2.1. Creating the ConfigMap 1.12.2.2. Setting the correct network policy 1.13. Security Expand section "1.13. Security" Collapse section "1.13. Security" 1.13.1. About mutual Transport Layer Security (mTLS) Expand section "1.13.1. About mutual Transport Layer Security (mTLS)" Collapse section "1.13.1. About mutual Transport Layer Security (mTLS)" 1.13.1.1. Enabling strict mTLS across the service mesh Expand section "1.13.1.1. Enabling strict mTLS across the service mesh" Collapse section "1.13.1.1. Enabling strict mTLS across the service mesh" 1.13.1.1.1. Configuring sidecars for incoming connections for specific services 1.13.1.1.2. Configuring sidecars for outgoing connections 1.13.1.1.3. Setting the minimum and maximum protocol versions 1.13.1.2. Validating encryption with Kiali 1.13.2. Configuring Role Based Access Control (RBAC) Expand section "1.13.2. Configuring Role Based Access Control (RBAC)" Collapse section "1.13.2. Configuring Role Based Access Control (RBAC)" 1.13.2.1. Configure intra-project communication Expand section "1.13.2.1. Configure intra-project communication" Collapse section "1.13.2.1. Configure intra-project communication" 1.13.2.1.1. Restrict access to services outside a namespace 1.13.2.1.2. Creating allow-all and default deny-all authorization policies 1.13.2.2. Allow or deny access to the ingress gateway 1.13.2.3. Restrict access with JSON Web Token 1.13.3. Configuring cipher suites and ECDH curves 1.13.4. Adding an external certificate authority key and certificate Expand section "1.13.4. Adding an external certificate authority key and certificate" Collapse section "1.13.4. Adding an external certificate authority key and certificate" 1.13.4.1. Adding an existing certificate and key 1.13.4.2. Verifying your certificates 1.13.4.3. Removing the certificates 1.14. Managing traffic in your service mesh Expand section "1.14. Managing traffic in your service mesh" Collapse section "1.14. Managing traffic in your service mesh" 1.14.1. Using gateways Expand section "1.14.1. Using gateways" Collapse section "1.14.1. Using gateways" 1.14.1.1. Enabling gateway injection 1.14.1.2. Deploying automatic gateway injection 1.14.1.3. Managing ingress traffic Expand section "1.14.1.3. Managing ingress traffic" Collapse section "1.14.1.3. Managing ingress traffic" 1.14.1.3.1. Determining the ingress IP and ports Expand section "1.14.1.3.1. Determining the ingress IP and ports" Collapse section "1.14.1.3.1. Determining the ingress IP and ports" 1.14.1.3.1.1. Determining ingress ports with a load balancer 1.14.1.3.1.2. Determining ingress ports without a load balancer 1.14.1.4. Configuring an ingress gateway 1.14.2. Understanding automatic routes Expand section "1.14.2. Understanding automatic routes" Collapse section "1.14.2. Understanding automatic routes" 1.14.2.1. Routes with subdomains 1.14.2.2. Creating subdomain routes 1.14.2.3. Route labels and annotations 1.14.2.4. Disabling automatic route creation Expand section "1.14.2.4. Disabling automatic route creation" Collapse section "1.14.2.4. Disabling automatic route creation" 1.14.2.4.1. Disabling automatic route creation for specific cases 1.14.2.4.2. Disabling automatic route creation for all cases 1.14.3. Understanding service entries 1.14.4. Using VirtualServices Expand section "1.14.4. Using VirtualServices" Collapse section "1.14.4. Using VirtualServices" 1.14.4.1. Configuring VirtualServices 1.14.4.2. VirtualService configuration reference 1.14.5. Understanding destination rules 1.14.6. Understanding network policies Expand section "1.14.6. Understanding network policies" Collapse section "1.14.6. Understanding network policies" 1.14.6.1. Disabling automatic NetworkPolicy creation 1.14.7. Configuring sidecars for traffic management 1.14.8. Routing Tutorial Expand section "1.14.8. Routing Tutorial" Collapse section "1.14.8. Routing Tutorial" 1.14.8.1. Bookinfo routing tutorial 1.14.8.2. Applying a virtual service 1.14.8.3. Testing the new route configuration 1.14.8.4. Route based on user identity 1.15. Metrics, logs, and traces Expand section "1.15. Metrics, logs, and traces" Collapse section "1.15. Metrics, logs, and traces" 1.15.1. Discovering console addresses 1.15.2. Accessing the Kiali console 1.15.3. Viewing service mesh data in the Kiali console Expand section "1.15.3. Viewing service mesh data in the Kiali console" Collapse section "1.15.3. Viewing service mesh data in the Kiali console" 1.15.3.1. Changing graph layouts in Kiali 1.15.3.2. Viewing logs in the Kiali console 1.15.3.3. Viewing metrics in the Kiali console 1.15.4. Distributed tracing Expand section "1.15.4. Distributed tracing" Collapse section "1.15.4. Distributed tracing" 1.15.4.1. Connecting an existing distributed tracing instance 1.15.4.2. Adjusting the sampling rate 1.15.5. Accessing the Jaeger console 1.15.6. Accessing the Grafana console 1.15.7. Accessing the Prometheus console 1.16. Performance and scalability Expand section "1.16. Performance and scalability" Collapse section "1.16. Performance and scalability" 1.16.1. Setting limits on compute resources 1.16.2. Load test results Expand section "1.16.2. Load test results" Collapse section "1.16.2. Load test results" 1.16.2.1. Service Mesh Control plane performance 1.16.2.2. Data plane performance Expand section "1.16.2.2. Data plane performance" Collapse section "1.16.2.2. Data plane performance" 1.16.2.2.1. CPU and memory consumption 1.16.2.2.2. Additional latency 1.17. Configuring Service Mesh for production Expand section "1.17. Configuring Service Mesh for production" Collapse section "1.17. Configuring Service Mesh for production" 1.17.1. Configuring your ServiceMeshControlPlane resource for production 1.17.2. Additional resources 1.18. Connecting service meshes Expand section "1.18. Connecting service meshes" Collapse section "1.18. Connecting service meshes" 1.18.1. Federation overview 1.18.2. Federation features 1.18.3. Federation security 1.18.4. Federation limitations 1.18.5. Federation prerequisites 1.18.6. Planning your mesh federation 1.18.7. Mesh federation across clusters Expand section "1.18.7. Mesh federation across clusters" Collapse section "1.18.7. Mesh federation across clusters" 1.18.7.1. Exposing the federation ingress on clusters running on bare metal 1.18.7.2. Exposing the federation ingress on clusters running on IBM Power and IBM Z 1.18.7.3. Exposing the federation ingress on Amazon Web Services (AWS) 1.18.7.4. Exposing the federation ingress on Azure 1.18.7.5. Exposing the federation ingress on Google Cloud Platform (GCP) 1.18.8. Federation implementation checklist 1.18.9. Configuring a Service Mesh control plane for federation Expand section "1.18.9. Configuring a Service Mesh control plane for federation" Collapse section "1.18.9. Configuring a Service Mesh control plane for federation" 1.18.9.1. Understanding federation gateways 1.18.9.2. Understanding federation trust domain parameters 1.18.10. Joining a federated mesh Expand section "1.18.10. Joining a federated mesh" Collapse section "1.18.10. Joining a federated mesh" 1.18.10.1. Creating a ServiceMeshPeer resource 1.18.11. Exporting a service from a federated mesh Expand section "1.18.11. Exporting a service from a federated mesh" Collapse section "1.18.11. Exporting a service from a federated mesh" 1.18.11.1. Creating an ExportedServiceSet 1.18.12. Importing a service into a federated mesh Expand section "1.18.12. Importing a service into a federated mesh" Collapse section "1.18.12. Importing a service into a federated mesh" 1.18.12.1. Creating an ImportedServiceSet 1.18.13. Configuring a federated mesh for failover Expand section "1.18.13. Configuring a federated mesh for failover" Collapse section "1.18.13. Configuring a federated mesh for failover" 1.18.13.1. Configuring an ImportedServiceSet for failover 1.18.13.2. Configuring a DestinationRule for failover 1.18.14. Removing a service from the federated mesh Expand section "1.18.14. Removing a service from the federated mesh" Collapse section "1.18.14. Removing a service from the federated mesh" 1.18.14.1. To remove a service from a single mesh 1.18.14.2. To remove a service from the entire federated mesh 1.18.15. Removing a mesh from the federated mesh 1.19. Extensions Expand section "1.19. Extensions" Collapse section "1.19. Extensions" 1.19.1. WebAssembly modules overview 1.19.2. WasmPlugin container format 1.19.3. WasmPlugin API reference Expand section "1.19.3. WasmPlugin API reference" Collapse section "1.19.3. WasmPlugin API reference" 1.19.3.1. Deploying WasmPlugin resources 1.19.4. ServiceMeshExtension container format 1.19.5. ServiceMeshExtension reference Expand section "1.19.5. ServiceMeshExtension reference" Collapse section "1.19.5. ServiceMeshExtension reference" 1.19.5.1. Deploying ServiceMeshExtension resources 1.19.6. Migrating from ServiceMeshExtension to WasmPlugin resources Expand section "1.19.6. Migrating from ServiceMeshExtension to WasmPlugin resources" Collapse section "1.19.6. Migrating from ServiceMeshExtension to WasmPlugin resources" 1.19.6.1. API changes 1.19.6.2. Container image format changes 1.19.6.3. Migrating to WasmPlugin resources 1.20. Using the 3scale WebAssembly module Expand section "1.20. Using the 3scale WebAssembly module" Collapse section "1.20. Using the 3scale WebAssembly module" 1.20.1. Compatibility 1.20.2. Usage as a stand-alone module 1.20.3. Prerequisites 1.20.4. Configuring the threescale-wasm-auth module Expand section "1.20.4. Configuring the threescale-wasm-auth module" Collapse section "1.20.4. Configuring the threescale-wasm-auth module" 1.20.4.1. The WasmPlugin API extension 1.20.5. Applying 3scale external ServiceEntry objects 1.20.6. The 3scale WebAssembly module configuration Expand section "1.20.6. The 3scale WebAssembly module configuration" Collapse section "1.20.6. The 3scale WebAssembly module configuration" 1.20.6.1. Configuring the 3scale WebAssembly module 1.20.6.2. The 3scale WebAssembly module api object 1.20.6.3. The 3scale WebAssembly module system object 1.20.6.4. The 3scale WebAssembly module upstream object 1.20.6.5. The 3scale WebAssembly module backend object 1.20.6.6. The 3scale WebAssembly module services object 1.20.6.7. The 3scale WebAssembly module credentials object 1.20.6.8. The 3scale WebAssembly module lookup queries 1.20.6.9. The 3scale WebAssembly module source object 1.20.6.10. The 3scale WebAssembly module operations object 1.20.6.11. The 3scale WebAssembly module mapping_rules object 1.20.6.12. The 3scale WebAssembly module mapping_rule object 1.20.7. The 3scale WebAssembly module examples for credentials use cases Expand section "1.20.7. The 3scale WebAssembly module examples for credentials use cases" Collapse section "1.20.7. The 3scale WebAssembly module examples for credentials use cases" 1.20.7.1. API key (user_key) in query string parameters 1.20.7.2. Application ID and key 1.20.7.3. Authorization header 1.20.7.4. OpenID Connect (OIDC) use case 1.20.7.5. Picking up the JWT token from a header 1.20.8. 3scale WebAssembly module minimal working configuration 1.21. Using the 3scale Istio adapter Expand section "1.21. Using the 3scale Istio adapter" Collapse section "1.21. Using the 3scale Istio adapter" 1.21.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh Expand section "1.21.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh" Collapse section "1.21.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh" 1.21.1.1. Generating 3scale custom resources Expand section "1.21.1.1. Generating 3scale custom resources" Collapse section "1.21.1.1. Generating 3scale custom resources" 1.21.1.1.1. Generate templates from URL examples 1.21.1.2. Generating manifests from a deployed adapter 1.21.1.3. Routing service traffic through the adapter 1.21.2. Configure the integration settings in 3scale 1.21.3. Caching behavior 1.21.4. Authenticating requests Expand section "1.21.4. Authenticating requests" Collapse section "1.21.4. Authenticating requests" 1.21.4.1. Applying authentication patterns Expand section "1.21.4.1. Applying authentication patterns" Collapse section "1.21.4.1. Applying authentication patterns" 1.21.4.1.1. API key authentication method 1.21.4.1.2. Application ID and application key pair authentication method 1.21.4.1.3. OpenID authentication method 1.21.4.1.4. Hybrid authentication method 1.21.5. 3scale Adapter metrics 1.21.6. 3scale backend cache Expand section "1.21.6. 3scale backend cache" Collapse section "1.21.6. 3scale backend cache" 1.21.6.1. Advantages of enabling backend cache 1.21.6.2. Trade-offs for having lower latencies 1.21.6.3. Backend cache configuration settings 1.21.7. 3scale Istio Adapter APIcast emulation 1.21.8. 3scale Istio adapter verification 1.21.9. 3scale Istio adapter troubleshooting checklist 1.22. Troubleshooting your service mesh Expand section "1.22. Troubleshooting your service mesh" Collapse section "1.22. Troubleshooting your service mesh" 1.22.1. Understanding Service Mesh versions 1.22.2. Troubleshooting Operator installation Expand section "1.22.2. Troubleshooting Operator installation" Collapse section "1.22.2. Troubleshooting Operator installation" 1.22.2.1. Validating Operator installation 1.22.2.2. Troubleshooting service mesh Operators Expand section "1.22.2.2. Troubleshooting service mesh Operators" Collapse section "1.22.2.2. Troubleshooting service mesh Operators" 1.22.2.2.1. Viewing Operator pod logs 1.22.3. Troubleshooting the control plane Expand section "1.22.3. Troubleshooting the control plane" Collapse section "1.22.3. Troubleshooting the control plane" 1.22.3.1. Validating the Service Mesh control plane installation Expand section "1.22.3.1. Validating the Service Mesh control plane installation" Collapse section "1.22.3.1. Validating the Service Mesh control plane installation" 1.22.3.1.1. Accessing the Kiali console 1.22.3.1.2. Accessing the Jaeger console 1.22.3.2. Troubleshooting the Service Mesh control plane 1.22.4. Troubleshooting the data plane Expand section "1.22.4. Troubleshooting the data plane" Collapse section "1.22.4. Troubleshooting the data plane" 1.22.4.1. Troubleshooting sidecar injection Expand section "1.22.4.1. Troubleshooting sidecar injection" Collapse section "1.22.4.1. Troubleshooting sidecar injection" 1.22.4.1.1. Troubleshooting Istio sidecar injection 1.22.4.1.2. Troubleshooting Jaeger agent sidecar injection 1.23. Troubleshooting Envoy proxy Expand section "1.23. Troubleshooting Envoy proxy" Collapse section "1.23. Troubleshooting Envoy proxy" 1.23.1. Enabling Envoy access logs 1.23.2. Getting support Expand section "1.23.2. Getting support" Collapse section "1.23.2. Getting support" 1.23.2.1. About the Red Hat Knowledgebase 1.23.2.2. Searching the Red Hat Knowledgebase 1.23.2.3. About the must-gather tool 1.23.2.4. About collecting service mesh data 1.23.2.5. Submitting a support case 1.24. Service Mesh control plane configuration reference Expand section "1.24. Service Mesh control plane configuration reference" Collapse section "1.24. Service Mesh control plane configuration reference" 1.24.1. Service Mesh Control plane parameters 1.24.2. spec parameters Expand section "1.24.2. spec parameters" Collapse section "1.24.2. spec parameters" 1.24.2.1. general parameters 1.24.2.2. profiles parameters 1.24.2.3. techPreview parameters 1.24.2.4. tracing parameters 1.24.2.5. version parameter 1.24.2.6. 3scale configuration 1.24.3. status parameter 1.24.4. Additional resources 1.25. Kiali configuration reference Expand section "1.25. Kiali configuration reference" Collapse section "1.25. Kiali configuration reference" 1.25.1. Specifying Kiali configuration in the SMCP 1.25.2. Specifying Kiali configuration in a Kiali custom resource 1.26. Jaeger configuration reference Expand section "1.26. Jaeger configuration reference" Collapse section "1.26. Jaeger configuration reference" 1.26.1. Enabling and disabling tracing 1.26.2. Specifying Jaeger configuration in the SMCP 1.26.3. Deploying the distributed tracing platform Expand section "1.26.3. Deploying the distributed tracing platform" Collapse section "1.26.3. Deploying the distributed tracing platform" 1.26.3.1. Default distributed tracing platform deployment 1.26.3.2. Production distributed tracing platform deployment (minimal) 1.26.3.3. Production distributed tracing platform deployment (fully customized) 1.26.3.4. Streaming Jaeger deployment 1.26.4. Specifying Jaeger configuration in a Jaeger custom resource Expand section "1.26.4. Specifying Jaeger configuration in a Jaeger custom resource" Collapse section "1.26.4. Specifying Jaeger configuration in a Jaeger custom resource" 1.26.4.1. Deployment best practices 1.26.4.2. Configuring distributed tracing security for service mesh Expand section "1.26.4.2. Configuring distributed tracing security for service mesh" Collapse section "1.26.4.2. Configuring distributed tracing security for service mesh" 1.26.4.2.1. Configuring distributed tracing security for service mesh from the OpenShift console 1.26.4.2.2. Configuring distributed tracing security for service mesh from the command line 1.26.4.3. Distributed tracing default configuration options 1.26.4.4. Jaeger Collector configuration options 1.26.4.5. Distributed tracing sampling configuration options 1.26.4.6. Distributed tracing storage configuration options Expand section "1.26.4.6. Distributed tracing storage configuration options" Collapse section "1.26.4.6. Distributed tracing storage configuration options" 1.26.4.6.1. Auto-provisioning an Elasticsearch instance 1.26.4.6.2. Connecting to an existing Elasticsearch instance 1.26.4.7. Managing certificates with Elasticsearch 1.26.4.8. Query configuration options 1.26.4.9. Ingester configuration options 1.27. Uninstalling Service Mesh Expand section "1.27. Uninstalling Service Mesh" Collapse section "1.27. Uninstalling Service Mesh" 1.27.1. Removing the Red Hat OpenShift Service Mesh control plane Expand section "1.27.1. Removing the Red Hat OpenShift Service Mesh control plane" Collapse section "1.27.1. Removing the Red Hat OpenShift Service Mesh control plane" 1.27.1.1. Removing the Service Mesh control plane using the web console 1.27.1.2. Removing the Service Mesh control plane using the CLI 1.27.2. Removing the installed Operators Expand section "1.27.2. Removing the installed Operators" Collapse section "1.27.2. Removing the installed Operators" 1.27.2.1. Removing the Operators 1.27.3. Clean up Operator resources 2. Service Mesh 1.x Expand section "2. Service Mesh 1.x" Collapse section "2. Service Mesh 1.x" 2.1. Service Mesh Release Notes Expand section "2.1. Service Mesh Release Notes" Collapse section "2.1. Service Mesh Release Notes" 2.1.1. Making open source more inclusive 2.1.2. Introduction to Red Hat OpenShift Service Mesh 2.1.3. Getting support Expand section "2.1.3. Getting support" Collapse section "2.1.3. Getting support" 2.1.3.1. About the must-gather tool 2.1.3.2. Prerequisites 2.1.3.3. About collecting service mesh data 2.1.4. Red Hat OpenShift Service Mesh supported configurations Expand section "2.1.4. Red Hat OpenShift Service Mesh supported configurations" Collapse section "2.1.4. Red Hat OpenShift Service Mesh supported configurations" 2.1.4.1. Supported configurations for Kiali on Red Hat OpenShift Service Mesh 2.1.4.2. Supported Mixer adapters 2.1.5. New Features Expand section "2.1.5. New Features" Collapse section "2.1.5. New Features" 2.1.5.1. New features Red Hat OpenShift Service Mesh 1.1.18.2 Expand section "2.1.5.1. New features Red Hat OpenShift Service Mesh 1.1.18.2" Collapse section "2.1.5.1. New features Red Hat OpenShift Service Mesh 1.1.18.2" 2.1.5.1.1. Component versions included in Red Hat OpenShift Service Mesh version 1.1.18.2 2.1.5.2. New features Red Hat OpenShift Service Mesh 1.1.18.1 Expand section "2.1.5.2. New features Red Hat OpenShift Service Mesh 1.1.18.1" Collapse section "2.1.5.2. New features Red Hat OpenShift Service Mesh 1.1.18.1" 2.1.5.2.1. Component versions included in Red Hat OpenShift Service Mesh version 1.1.18.1 2.1.5.3. New features Red Hat OpenShift Service Mesh 1.1.18 Expand section "2.1.5.3. New features Red Hat OpenShift Service Mesh 1.1.18" Collapse section "2.1.5.3. New features Red Hat OpenShift Service Mesh 1.1.18" 2.1.5.3.1. Component versions included in Red Hat OpenShift Service Mesh version 1.1.18 2.1.5.4. New features Red Hat OpenShift Service Mesh 1.1.17.1 Expand section "2.1.5.4. New features Red Hat OpenShift Service Mesh 1.1.17.1" Collapse section "2.1.5.4. New features Red Hat OpenShift Service Mesh 1.1.17.1" 2.1.5.4.1. Change in how Red Hat OpenShift Service Mesh handles URI fragments 2.1.5.4.2. Required update for authorization policies 2.1.5.5. New features Red Hat OpenShift Service Mesh 1.1.17 2.1.5.6. New features Red Hat OpenShift Service Mesh 1.1.16 2.1.5.7. New features Red Hat OpenShift Service Mesh 1.1.15 2.1.5.8. New features Red Hat OpenShift Service Mesh 1.1.14 Expand section "2.1.5.8. New features Red Hat OpenShift Service Mesh 1.1.14" Collapse section "2.1.5.8. New features Red Hat OpenShift Service Mesh 1.1.14" 2.1.5.8.1. Manual updates required by CVE-2021-29492 and CVE-2021-31920 2.1.5.8.2. Updating the path normalization configuration 2.1.5.8.3. Path normalization configuration examples 2.1.5.8.4. Configuring your SMCP for path normalization 2.1.5.9. New features Red Hat OpenShift Service Mesh 1.1.13 2.1.5.10. New features Red Hat OpenShift Service Mesh 1.1.12 2.1.5.11. New features Red Hat OpenShift Service Mesh 1.1.11 2.1.5.12. New features Red Hat OpenShift Service Mesh 1.1.10 2.1.5.13. New features Red Hat OpenShift Service Mesh 1.1.9 2.1.5.14. New features Red Hat OpenShift Service Mesh 1.1.8 2.1.5.15. New features Red Hat OpenShift Service Mesh 1.1.7 2.1.5.16. New features Red Hat OpenShift Service Mesh 1.1.6 2.1.5.17. New features Red Hat OpenShift Service Mesh 1.1.5 2.1.5.18. New features Red Hat OpenShift Service Mesh 1.1.4 Expand section "2.1.5.18. New features Red Hat OpenShift Service Mesh 1.1.4" Collapse section "2.1.5.18. New features Red Hat OpenShift Service Mesh 1.1.4" 2.1.5.18.1. Manual updates required by CVE-2020-8663 2.1.5.18.2. Upgrading from Elasticsearch 5 to Elasticsearch 6 2.1.5.19. New features Red Hat OpenShift Service Mesh 1.1.3 2.1.5.20. New features Red Hat OpenShift Service Mesh 1.1.2 2.1.5.21. New features Red Hat OpenShift Service Mesh 1.1.1 2.1.5.22. New features Red Hat OpenShift Service Mesh 1.1.0 Expand section "2.1.5.22. New features Red Hat OpenShift Service Mesh 1.1.0" Collapse section "2.1.5.22. New features Red Hat OpenShift Service Mesh 1.1.0" 2.1.5.22.1. Manual updates from 1.0 to 1.1 2.1.6. Deprecated features Expand section "2.1.6. Deprecated features" Collapse section "2.1.6. Deprecated features" 2.1.6.1. Deprecated features Red Hat OpenShift Service Mesh 1.1.5 2.1.7. Known issues Expand section "2.1.7. Known issues" Collapse section "2.1.7. Known issues" 2.1.7.1. Service Mesh known issues 2.1.7.2. Kiali known issues 2.1.7.3. Red Hat OpenShift distributed tracing known issues 2.1.8. Fixed issues Expand section "2.1.8. Fixed issues" Collapse section "2.1.8. Fixed issues" 2.1.8.1. Service Mesh fixed issues 2.1.8.2. Kiali fixed issues 2.1.8.3. Red Hat OpenShift distributed tracing fixed issues 2.2. Understanding Service Mesh Expand section "2.2. Understanding Service Mesh" Collapse section "2.2. Understanding Service Mesh" 2.2.1. Understanding service mesh 2.2.2. Red Hat OpenShift Service Mesh Architecture 2.2.3. Understanding Kiali Expand section "2.2.3. Understanding Kiali" Collapse section "2.2.3. Understanding Kiali" 2.2.3.1. Kiali overview 2.2.3.2. Kiali architecture 2.2.3.3. Kiali features 2.2.4. Understanding Jaeger Expand section "2.2.4. Understanding Jaeger" Collapse section "2.2.4. Understanding Jaeger" 2.2.4.1. Distributed tracing overview 2.2.4.2. Distributed tracing architecture 2.2.4.3. Red Hat OpenShift distributed tracing features 2.2.5. Next steps 2.3. Service Mesh and Istio differences Expand section "2.3. Service Mesh and Istio differences" Collapse section "2.3. Service Mesh and Istio differences" 2.3.1. Multitenant installations Expand section "2.3.1. Multitenant installations" Collapse section "2.3.1. Multitenant installations" 2.3.1.1. Multitenancy versus cluster-wide installations 2.3.1.2. Cluster scoped resources 2.3.2. Differences between Istio and Red Hat OpenShift Service Mesh Expand section "2.3.2. Differences between Istio and Red Hat OpenShift Service Mesh" Collapse section "2.3.2. Differences between Istio and Red Hat OpenShift Service Mesh" 2.3.2.1. Command line tool 2.3.2.2. Automatic injection 2.3.2.3. Istio Role Based Access Control features 2.3.2.4. OpenSSL 2.3.2.5. Component modifications 2.3.2.6. Envoy, Secret Discovery Service, and certificates 2.3.2.7. Istio Container Network Interface (CNI) plugin 2.3.2.8. Routes for Istio Gateways Expand section "2.3.2.8. Routes for Istio Gateways" Collapse section "2.3.2.8. Routes for Istio Gateways" 2.3.2.8.1. Catch-all domains 2.3.2.8.2. Subdomains 2.3.2.8.3. Transport layer security 2.3.3. Kiali and service mesh 2.3.4. Distributed tracing and service mesh 2.4. Preparing to install Service Mesh Expand section "2.4. Preparing to install Service Mesh" Collapse section "2.4. Preparing to install Service Mesh" 2.4.1. Prerequisites 2.4.2. Red Hat OpenShift Service Mesh supported configurations Expand section "2.4.2. Red Hat OpenShift Service Mesh supported configurations" Collapse section "2.4.2. Red Hat OpenShift Service Mesh supported configurations" 2.4.2.1. Supported configurations for Kiali on Red Hat OpenShift Service Mesh 2.4.2.2. Supported Mixer adapters 2.4.3. Operator overview 2.4.4. Next steps 2.5. Installing Service Mesh Expand section "2.5. Installing Service Mesh" Collapse section "2.5. Installing Service Mesh" 2.5.1. Prerequisites 2.5.2. Installing the OpenShift Elasticsearch Operator 2.5.3. Installing the Red Hat OpenShift distributed tracing platform Operator 2.5.4. Installing the Kiali Operator 2.5.5. Installing the Operators 2.5.6. Deploying the Red Hat OpenShift Service Mesh control plane Expand section "2.5.6. Deploying the Red Hat OpenShift Service Mesh control plane" Collapse section "2.5.6. Deploying the Red Hat OpenShift Service Mesh control plane" 2.5.6.1. Deploying the control plane from the web console 2.5.6.2. Deploying the control plane from the CLI 2.5.7. Creating the Red Hat OpenShift Service Mesh member roll Expand section "2.5.7. Creating the Red Hat OpenShift Service Mesh member roll" Collapse section "2.5.7. Creating the Red Hat OpenShift Service Mesh member roll" 2.5.7.1. Creating the member roll from the web console 2.5.7.2. Creating the member roll from the CLI 2.5.8. Adding or removing projects from the service mesh Expand section "2.5.8. Adding or removing projects from the service mesh" Collapse section "2.5.8. Adding or removing projects from the service mesh" 2.5.8.1. Adding or removing projects from the member roll using the web console 2.5.8.2. Adding or removing projects from the member roll using the CLI 2.5.9. Manual updates Expand section "2.5.9. Manual updates" Collapse section "2.5.9. Manual updates" 2.5.9.1. Updating sidecar proxies 2.5.10. Next steps 2.6. Customizing security in a Service Mesh Expand section "2.6. Customizing security in a Service Mesh" Collapse section "2.6. Customizing security in a Service Mesh" 2.6.1. Enabling mutual Transport Layer Security (mTLS) Expand section "2.6.1. Enabling mutual Transport Layer Security (mTLS)" Collapse section "2.6.1. Enabling mutual Transport Layer Security (mTLS)" 2.6.1.1. Enabling strict mTLS across the mesh Expand section "2.6.1.1. Enabling strict mTLS across the mesh" Collapse section "2.6.1.1. Enabling strict mTLS across the mesh" 2.6.1.1.1. Configuring sidecars for incoming connections for specific services 2.6.1.2. Configuring sidecars for outgoing connections 2.6.1.3. Setting the minimum and maximum protocol versions 2.6.2. Configuring cipher suites and ECDH curves 2.6.3. Adding an external certificate authority key and certificate Expand section "2.6.3. Adding an external certificate authority key and certificate" Collapse section "2.6.3. Adding an external certificate authority key and certificate" 2.6.3.1. Adding an existing certificate and key 2.6.3.2. Verifying your certificates 2.6.3.3. Removing the certificates 2.7. Traffic management Expand section "2.7. Traffic management" Collapse section "2.7. Traffic management" 2.7.1. Using gateways 2.7.2. Configuring an ingress gateway 2.7.3. Managing ingress traffic Expand section "2.7.3. Managing ingress traffic" Collapse section "2.7.3. Managing ingress traffic" 2.7.3.1. Determining the ingress IP and ports Expand section "2.7.3.1. Determining the ingress IP and ports" Collapse section "2.7.3.1. Determining the ingress IP and ports" 2.7.3.1.1. Determining ingress ports with a load balancer 2.7.3.1.2. Determining ingress ports without a load balancer 2.7.4. Automatic route creation Expand section "2.7.4. Automatic route creation" Collapse section "2.7.4. Automatic route creation" 2.7.4.1. Enabling Automatic Route Creation 2.7.4.2. Subdomains 2.7.5. Understanding service entries 2.7.6. Using VirtualServices Expand section "2.7.6. Using VirtualServices" Collapse section "2.7.6. Using VirtualServices" 2.7.6.1. Configuring VirtualServices 2.7.6.2. VirtualService configuration reference 2.7.7. Understanding destination rules 2.7.8. Bookinfo routing tutorial Expand section "2.7.8. Bookinfo routing tutorial" Collapse section "2.7.8. Bookinfo routing tutorial" 2.7.8.1. Applying a virtual service 2.7.8.2. Testing the new route configuration 2.7.8.3. Route based on user identity 2.7.9. Additional resources 2.8. Deploying applications on Service Mesh Expand section "2.8. Deploying applications on Service Mesh" Collapse section "2.8. Deploying applications on Service Mesh" 2.8.1. Prerequisites 2.8.2. Creating control plane templates Expand section "2.8.2. Creating control plane templates" Collapse section "2.8.2. Creating control plane templates" 2.8.2.1. Creating the ConfigMap 2.8.3. Enabling automatic sidecar injection 2.8.4. Setting proxy environment variables through annotations 2.8.5. Updating Mixer policy enforcement Expand section "2.8.5. Updating Mixer policy enforcement" Collapse section "2.8.5. Updating Mixer policy enforcement" 2.8.5.1. Setting the correct network policy 2.8.6. Bookinfo example application Expand section "2.8.6. Bookinfo example application" Collapse section "2.8.6. Bookinfo example application" 2.8.6.1. Installing the Bookinfo application 2.8.6.2. Adding default destination rules 2.8.6.3. Verifying the Bookinfo installation 2.8.6.4. Removing the Bookinfo application Expand section "2.8.6.4. Removing the Bookinfo application" Collapse section "2.8.6.4. Removing the Bookinfo application" 2.8.6.4.1. Delete the Bookinfo project 2.8.6.4.2. Remove the Bookinfo project from the Service Mesh member roll 2.8.7. Generating example traces and analyzing trace data 2.9. Data visualization and observability Expand section "2.9. Data visualization and observability" Collapse section "2.9. Data visualization and observability" 2.9.1. Viewing service mesh data 2.9.2. Viewing service mesh data in the Kiali console Expand section "2.9.2. Viewing service mesh data in the Kiali console" Collapse section "2.9.2. Viewing service mesh data in the Kiali console" 2.9.2.1. Changing graph layouts in Kiali 2.10. Custom resources Expand section "2.10. Custom resources" Collapse section "2.10. Custom resources" 2.10.1. Prerequisites 2.10.2. Red Hat OpenShift Service Mesh custom resources 2.10.3. ServiceMeshControlPlane parameters Expand section "2.10.3. ServiceMeshControlPlane parameters" Collapse section "2.10.3. ServiceMeshControlPlane parameters" 2.10.3.1. Istio global example 2.10.3.2. Istio gateway configuration 2.10.3.3. Istio Mixer configuration 2.10.3.4. Istio Pilot configuration 2.10.4. Configuring Kiali Expand section "2.10.4. Configuring Kiali" Collapse section "2.10.4. Configuring Kiali" 2.10.4.1. Configuring Kiali for Grafana 2.10.4.2. Configuring Kiali for Jaeger 2.10.5. Configuring Jaeger Expand section "2.10.5. Configuring Jaeger" Collapse section "2.10.5. Configuring Jaeger" 2.10.5.1. Configuring Elasticsearch 2.10.5.2. Connecting to an existing Jaeger instance 2.10.5.3. Configuring Elasticsearch 2.10.5.4. Configuring the Elasticsearch index cleaner job 2.10.6. 3scale configuration 2.11. Using the 3scale Istio adapter Expand section "2.11. Using the 3scale Istio adapter" Collapse section "2.11. Using the 3scale Istio adapter" 2.11.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh Expand section "2.11.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh" Collapse section "2.11.1. Integrate the 3scale adapter with Red Hat OpenShift Service Mesh" 2.11.1.1. Generating 3scale custom resources Expand section "2.11.1.1. Generating 3scale custom resources" Collapse section "2.11.1.1. Generating 3scale custom resources" 2.11.1.1.1. Generate templates from URL examples 2.11.1.2. Generating manifests from a deployed adapter 2.11.1.3. Routing service traffic through the adapter 2.11.2. Configure the integration settings in 3scale 2.11.3. Caching behavior 2.11.4. Authenticating requests Expand section "2.11.4. Authenticating requests" Collapse section "2.11.4. Authenticating requests" 2.11.4.1. Applying authentication patterns Expand section "2.11.4.1. Applying authentication patterns" Collapse section "2.11.4.1. Applying authentication patterns" 2.11.4.1.1. API key authentication method 2.11.4.1.2. Application ID and application key pair authentication method 2.11.4.1.3. OpenID authentication method 2.11.4.1.4. Hybrid authentication method 2.11.5. 3scale Adapter metrics 2.11.6. 3scale Istio adapter verification 2.11.7. 3scale Istio adapter troubleshooting checklist 2.12. Removing Service Mesh Expand section "2.12. Removing Service Mesh" Collapse section "2.12. Removing Service Mesh" 2.12.1. Removing the Red Hat OpenShift Service Mesh control plane Expand section "2.12.1. Removing the Red Hat OpenShift Service Mesh control plane" Collapse section "2.12.1. Removing the Red Hat OpenShift Service Mesh control plane" 2.12.1.1. Removing the Service Mesh control plane using the web console 2.12.1.2. Removing the Service Mesh control plane using the CLI 2.12.2. Removing the installed Operators Expand section "2.12.2. Removing the installed Operators" Collapse section "2.12.2. Removing the installed Operators" 2.12.2.1. Removing the Operators 2.12.2.2. Clean up Operator resources Legal Notice Settings Close Language: 日本語 简体中文 English 한국어 Language: 日本語 简体中文 English 한국어 Format: Multi-page Single-page PDF Format: Multi-page Single-page PDF Language and Page Formatting Options Language: 日本語 简体中文 English 한국어 Language: 日本語 简体中文 English 한국어 Format: Multi-page Single-page PDF Format: Multi-page Single-page PDF Service Mesh OpenShift Container Platform 4.10Service Mesh installation, usage, and release notesRed Hat OpenShift Documentation TeamLegal NoticeAbstract This document provides information on how to use Service Mesh in OpenShift Container Platform. Next