Installing Red Hat OpenShift Service Mesh 3.0.0tp1 Installing OpenShift Service Mesh Red Hat OpenShift Documentation Team

Commands:
oc label namespace istio-system istio-discovery=enabled
kind: Istio apiVersion: sailoperator.io/v1alpha1 metadata: name: default spec: namespace: istio-system values: meshConfig: discoverySelectors: - matchLabels: istio-discovery: enabled
oc apply -f istio.yaml
oc label namespace bookinfo istio-discovery=enabled istio-injection=enabled
apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo
oc get services -n bookinfo
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE details ClusterIP 172.30.137.21 <none> 9080/TCP 44s productpage ClusterIP 172.30.2.246 <none> 9080/TCP 43s ratings ClusterIP 172.30.33.85 <none> 9080/TCP 44s reviews ClusterIP 172.30.175.88 <none> 9080/TCP 44s
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-698d88b-km2jg 2/2 Running 0 66s productpage-v1-675fc69cf-cvxv9 2/2 Running 0 65s ratings-v1-6484c4d9bb-tpx7d 2/2 Running 0 65s reviews-v1-5b5d6494f4-wsrwp 2/2 Running 0 65s reviews-v2-5b667bcbf8-4lsfd 2/2 Running 0 65s reviews-v3-5b9bd44f4-44hr6 2/2 Running 0 65s
oc exec "USD(oc get pod -l app=ratings -n bookinfo -o jsonpath='{.items[0].metadata.name}')" -c ratings -n bookinfo -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"
oc apply -n bookinfo -f ingress-gateway.yaml
oc apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/bookinfo/networking/bookinfo-gateway.yaml -n bookinfo
oc expose service istio-ingressgateway -n bookinfo
apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: labels: istio: ingressgateway release: istio name: ingressgatewayhpa namespace: bookinfo spec: maxReplicas: 5 1 metrics: - resource: name: cpu target: averageUtilization: 80 type: Utilization type: Resource minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: istio-ingressgateway
apiVersion: policy/v1 kind: PodDisruptionBudget metadata: labels: istio: ingressgateway release: istio name: ingressgatewaypdb namespace: bookinfo spec: minAvailable: 1 1 selector: matchLabels: istio: ingressgateway
HOST=USD(oc get route istio-ingressgateway -n bookinfo -o jsonpath='{.spec.host}')
echo productpage URL: http://USDHOST/productpage
oc get crd gateways.gateway.networking.k8s.io &> /dev/null || { oc kustomize "github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.0.0" | oc apply -f -; }
oc apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/bookinfo/gateway-api/bookinfo-gateway.yaml -n bookinfo
oc wait --for=condition=programmed gtw bookinfo-gateway -n bookinfo
export INGRESS_HOST=USD(oc get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.status.addresses[0].value}') export INGRESS_PORT=USD(oc get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.spec.listeners[?(@.name=="http")].port}') export GATEWAY_URL=USDINGRESS_HOST:USDINGRESS_PORT
echo "http://USD{GATEWAY_URL}/productpage"
oc get istiorevisions
NAME READY STATUS IN USE VERSION AGE my-mesh-v1-23-0 True Healthy False v1.23.0 114s
oc get istiorevisions
NAME TYPE READY STATUS IN USE VERSION AGE default Local True Healthy False v1.23.0 4m57s
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-65cfcf56f9-gm6v7 1/1 Running 0 4m55s productpage-v1-d5789fdfb-8x6bk 1/1 Running 0 4m53s ratings-v1-7c9bd4b87f-6v7hg 1/1 Running 0 4m55s reviews-v1-6584ddcf65-6wqtw 1/1 Running 0 4m54s reviews-v2-6f85cb9b7c-w9l8s 1/1 Running 0 4m54s reviews-v3-6f5b775685-mg5n6 1/1 Running 0 4m54s
oc label namespace bookinfo istio-injection=enabled namespace/bookinfo labeled
oc -n bookinfo rollout restart deployments
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-7745f84ff-bpf8f 2/2 Running 0 55s productpage-v1-54f48db985-gd5q9 2/2 Running 0 55s ratings-v1-5d645c985f-xsw7p 2/2 Running 0 55s reviews-v1-bd5f54b8c-zns4v 2/2 Running 0 55s reviews-v2-5d7b9dbf97-wbpjr 2/2 Running 0 55s reviews-v3-5fccc48c8c-bjktn 2/2 Running 0 55sz
kind: Deployment apiVersion: apps/v1 metadata: name: ratings-v1 namespace: bookinfo labels: app: ratings version: v1 spec: template: metadata: labels: sidecar.istio.io/inject: 'false'
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-6bc7b69776-7f6wz 2/2 Running 0 29m productpage-v1-54f48db985-gd5q9 2/2 Running 0 29m ratings-v1-5d645c985f-xsw7p 1/1 Running 0 7s reviews-v1-bd5f54b8c-zns4v 2/2 Running 0 29m reviews-v2-5d7b9dbf97-wbpjr 2/2 Running 0 29m reviews-v3-5fccc48c8c-bjktn 2/2 Running 0 29m
oc get istiorevisions
NAME TYPE READY STATUS IN USE VERSION AGE my-mesh Local True Healthy False v1.23.0 47s
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-65cfcf56f9-gm6v7 1/1 Running 0 4m55s productpage-v1-d5789fdfb-8x6bk 1/1 Running 0 4m53s ratings-v1-7c9bd4b87f-6v7hg 1/1 Running 0 4m55s reviews-v1-6584ddcf65-6wqtw 1/1 Running 0 4m54s reviews-v2-6f85cb9b7c-w9l8s 1/1 Running 0 4m54s reviews-v3-6f5b775685-mg5n6 1/1 Running 0 4m54s
kind: Deployment apiVersion: apps/v1 metadata: name: ratings-v1 namespace: bookinfo labels: app: ratings version: v1 spec: template: metadata: labels: istio.io/rev: my-mesh
oc get pods -n bookinfo
NAME READY STATUS RESTARTS AGE details-v1-559cd49f6c-b89hw 1/1 Running 0 42m productpage-v1-5f48cdcb85-8ppz5 1/1 Running 0 42m ratings-v1-848bf79888-krdch 2/2 Running 0 9s reviews-v1-6b7444ffbd-7m5wp 1/1 Running 0 42m reviews-v2-67876d7b7-9nmw5 1/1 Running 0 42m reviews-v3-84b55b667c-x5t8s 1/1 Running 0 42m
apiVersion: maistra.io/v2 kind: ServiceMeshControlPlane metadata: name: basic spec: mode: MultiTenant
kind: Istio piVersion: sailoperator.io/v1alpha1 metadata: name: ossm3 1 spec: namespace: istio-system3 2 values: meshConfig: discoverySelectors: 3 - matchExpressions: - key: maistra.io/member-of operator: DoesNotExist updateStrategy: type: InPlace version: v1.23.0
oc label namespace <namespace-name> istio.io/rev=<revision-name>
istioctl ps -i istio-system
istioctl ps -i istio-system NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION details-v1-7f46897b-88x4l.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 mongodb-v1-6cf7dc9885-7nlmq.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 mysqldb-v1-7c4c44b9b4-22b57.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 productpage-v1-6f9c6589cb-l6rvg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v1-559b64556-f6b4l.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v2-8ddc4d65c-bztrg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v2-mysql-cbc957476-m5j7w.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v1-847fb7c54d-7dwt7.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v2-5c7ff5b77b-5bpc4.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v3-5c5d764c9b-mk8vn.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8
istioctl ps -i istio-system3 NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION details-v1-57f6466bdc-5krth.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 productpage-v1-5b84ccdddf-f8d9t.bookinfo2 Kubernetes SYNCED (2m39s) SYNCED (2m39s) SYNCED (2m34s) SYNCED (2m39s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 ratings-v1-fb764cb99-kx2dr.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v1-8bd5549cf-xqqmd.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v2-7f7cc8bf5c-5rvln.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v3-84f674b88c-ftcqg.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0
apiVersion: maistra.io/v2 kind: ServiceMeshControlPlane metadata: name: basic spec: mode: ClusterWide
apiVersion: maistra.io/v2 kind: ServiceMeshControlPlane metadata: name: basic namespace: istio-system spec: version: v2.6 mode: ClusterWide meshConfig: discoverySelectors: - matchExpressions: - key: maistra.io/member-of operator: Exists runtime: components: pilot: container: env: ENABLE_ENHANCED_RESOURCE_SCOPING: 'true'
kind: Istio apiVersion: sailoperator.io/v1alpha1 metadata: name: ossm3 1 spec: namespace: istio-system3 2 values: meshConfig: discoverySelectors: 3 - matchExpressions: - key: maistra.io/member-of operator: DoesNotExist updateStrategy: type: InPlace version: v1.23.0
oc label namespace <namespace-name> istio.io/rev=ossm3
istioctl ps -i istio-system
istioctl ps -i istio-system NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION details-v1-7f46897b-88x4l.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 mongodb-v1-6cf7dc9885-7nlmq.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 mysqldb-v1-7c4c44b9b4-22b57.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 productpage-v1-6f9c6589cb-l6rvg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v1-559b64556-f6b4l.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v2-8ddc4d65c-bztrg.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 ratings-v2-mysql-cbc957476-m5j7w.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v1-847fb7c54d-7dwt7.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v2-5c7ff5b77b-5bpc4.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8 reviews-v3-5c5d764c9b-mk8vn.bookinfo Kubernetes SYNCED SYNCED SYNCED SYNCED NOT SENT istiod-install-istio-system-bd58bdcd5-2htkf 1.20.8
istioctl ps -i istio-system3 NAME CLUSTER CDS LDS EDS RDS ECDS ISTIOD VERSION details-v1-57f6466bdc-5krth.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 productpage-v1-5b84ccdddf-f8d9t.bookinfo2 Kubernetes SYNCED (2m39s) SYNCED (2m39s) SYNCED (2m34s) SYNCED (2m39s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 ratings-v1-fb764cb99-kx2dr.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v1-8bd5549cf-xqqmd.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v2-7f7cc8bf5c-5rvln.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0 reviews-v3-84f674b88c-ftcqg.bookinfo2 Kubernetes SYNCED (2m40s) SYNCED (2m40s) SYNCED (2m34s) SYNCED (2m40s) IGNORED istiod-ossm3-5b46b6b8cb-gbjx6 1.23.0
oc create namespace istio-system
apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: selfsigned namespace: istio-system spec: selfSigned: {} --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: istio-ca namespace: istio-system spec: isCA: true duration: 87600h # 10 years secretName: istio-ca commonName: istio-ca privateKey: algorithm: ECDSA size: 256 subject: organizations: - cluster.local - cert-manager issuerRef: name: selfsigned kind: Issuer group: cert-manager.io --- apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: istio-ca namespace: istio-system spec: ca: secretName: istio-ca ---
oc apply -f issuer.yaml
oc wait --for=condition=Ready certificates/istio-ca -n istio-system
oc get -n istio-system secret istio-ca -o jsonpath='{.data.tls\.crt}' | base64 -d > ca.pem
oc create secret generic -n cert-manager istio-root-ca --from-file=ca.pem=ca.pem
helm repo add jetstack https://charts.jetstack.io --force-update
helm upgrade cert-manager-istio-csr jetstack/cert-manager-istio-csr --install --namespace cert-manager --wait --set "app.tls.rootCAFile=/var/run/secrets/istio-csr/ca.pem" --set "volumeMounts[0].name=root-ca" --set "volumeMounts[0].mountPath=/var/run/secrets/istio-csr" --set "volumes[0].name=root-ca" --set "volumes[0].secret.secretName=istio-root-ca" --set "app.istio.namespace=istio-system"
helm repo add jetstack https://charts.jetstack.io --force-update
helm upgrade cert-manager-istio-csr jetstack/cert-manager-istio-csr --install --namespace cert-manager --wait --set "app.tls.rootCAFile=/var/run/secrets/istio-csr/ca.pem" --set "volumeMounts[0].name=root-ca" --set "volumeMounts[0].mountPath=/var/run/secrets/istio-csr" --set "volumes[0].name=root-ca" --set "volumes[0].secret.secretName=istio-root-ca" --set "app.istio.namespace=istio-system" --set "app.istio.revisions={default-v1-23-0}"
apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: v1.23.0 namespace: istio-system values: global: caAddress: cert-manager-istio-csr.cert-manager.svc:443 pilot: env: ENABLE_CA_SERVER: "false" volumeMounts: - mountPath: /tmp/var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true
kind: Istio metadata: name: default spec: updateStrategy: type: RevisionBased
oc apply -f istio.yaml
oc wait --for=condition=Ready istios/default -n istio-system
oc new-project sample
oc get istiorevisions
oc label namespace sample istio.io/rev=<your-active-revision-name> --overwrite=true
oc apply -n sample -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml
oc apply -n sample -f https://raw.githubusercontent.com/istio/istio/refs/heads/master/samples/sleep/sleep.yaml
oc rollout status -n sample deployment httpbin sleep
oc exec "USD(oc get pod -l app=sleep -n sample -o jsonpath={.items..metadata.name})" -c sleep -n sample -- curl http://httpbin.sample:8000/ip -s -o /dev/null -w "%{http_code}\n"
200
istioctl proxy-config secret -n sample USD(oc get pods -n sample -o jsonpath='{.items..metadata.name}' --selector app=httpbin) -o json | jq -r '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | base64 --decode | openssl x509 -text -noout
Issuer: O = cert-manager + O = cluster.local, CN = istio-ca X509v3 Subject Alternative Name: URI:spiffe://cluster.local/ns/sample/sa/httpbin
helm upgrade cert-manager-istio-csr jetstack/cert-manager-istio-csr --wait --reuse-values --set "app.istio.revisions={<old_revision>,<new_revision>}"
apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: <new_revision> 1
helm upgrade cert-manager-istio-csr jetstack/cert-manager-istio-csr --install --namespace cert-manager --wait --reuse-values --set "app.istio.revisions={default-v1-23-1}"
openssl genrsa -out root-key.pem 4096
encrypt_key = no prompt = no utf8 = yes default_md = sha256 default_bits = 4096 req_extensions = req_ext x509_extensions = req_ext distinguished_name = req_dn [ req_ext ] subjectKeyIdentifier = hash basicConstraints = critical, CA:true keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign [ req_dn ] O = Istio CN = Root CA
openssl req -sha256 -new -key root-key.pem -config root-ca.conf -out root-cert.csr
openssl x509 -req -sha256 -days 3650 -signkey root-key.pem -extensions req_ext -extfile root-ca.conf -in root-cert.csr -out root-cert.pem
mkdir east
openssl genrsa -out east/ca-key.pem 4096
[ req ] encrypt_key = no prompt = no utf8 = yes default_md = sha256 default_bits = 4096 req_extensions = req_ext x509_extensions = req_ext distinguished_name = req_dn [ req_ext ] subjectKeyIdentifier = hash basicConstraints = critical, CA:true, pathlen:0 keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign subjectAltName=@san [ san ] DNS.1 = istiod.istio-system.svc [ req_dn ] O = Istio CN = Intermediate CA L = east
openssl req -new -config east/intermediate.conf -key east/ca-key.pem -out east/cluster-ca.csr
openssl x509 -req -sha256 -days 3650 -CA root-cert.pem -CAkey root-key.pem -CAcreateserial -extensions req_ext -extfile east/intermediate.conf -in east/cluster-ca.csr -out east/ca-cert.pem
cat east/ca-cert.pem root-cert.pem > east/cert-chain.pem && cp root-cert.pem east
mkdir west
openssl genrsa -out west/ca-key.pem 4096
[ req ] encrypt_key = no prompt = no utf8 = yes default_md = sha256 default_bits = 4096 req_extensions = req_ext x509_extensions = req_ext distinguished_name = req_dn [ req_ext ] subjectKeyIdentifier = hash basicConstraints = critical, CA:true, pathlen:0 keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign subjectAltName=@san [ san ] DNS.1 = istiod.istio-system.svc [ req_dn ] O = Istio CN = Intermediate CA L = west
openssl req -new -config west/intermediate.conf -key west/ca-key.pem -out west/cluster-ca.csr
openssl x509 -req -sha256 -days 3650 -CA root-cert.pem -CAkey root-key.pem -CAcreateserial -extensions req_ext -extfile west/intermediate.conf -in west/cluster-ca.csr -out west/ca-cert.pem
cat west/ca-cert.pem root-cert.pem > west/cert-chain.pem && cp root-cert.pem west
oc login -u https://<east_cluster_api_server_url>
export CTX_CLUSTER1=USD(oc config current-context)
oc get project istio-system --context "USD{CTX_CLUSTER1}" || oc new-project istio-system --context "USD{CTX_CLUSTER1}"
oc --context "USD{CTX_CLUSTER1}" label namespace istio-system topology.istio.io/network=network1
oc get secret -n istio-system --context "USD{CTX_CLUSTER1}" cacerts || oc create secret generic cacerts -n istio-system --context "USD{CTX_CLUSTER1}" --from-file=east/ca-cert.pem --from-file=east/ca-key.pem --from-file=east/root-cert.pem --from-file=east/cert-chain.pem
oc login -u https://<west_cluster_api_server_url>
export CTX_CLUSTER2=USD(oc config current-context)
oc get project istio-system --context "USD{CTX_CLUSTER2}" || oc new-project istio-system --context "USD{CTX_CLUSTER2}"
oc --context "USD{CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2
oc get secret -n istio-system --context "USD{CTX_CLUSTER2}" cacerts || oc create secret generic cacerts -n istio-system --context "USD{CTX_CLUSTER2}" --from-file=west/ca-cert.pem --from-file=west/ca-key.pem --from-file=west/root-cert.pem --from-file=west/cert-chain.pem
export ISTIO_VERSION=1.24.1
cat <<EOF | oc --context "USD{CTX_CLUSTER1}" apply -f - apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: vUSD{ISTIO_VERSION} namespace: istio-system values: global: meshID: mesh1 multiCluster: clusterName: cluster1 network: network1 EOF
oc --context "USD{CTX_CLUSTER1}" wait --for condition=Ready istio/default --timeout=3m
oc --context "USD{CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/east-west-gateway-net1.yaml
oc --context "USD{CTX_CLUSTER1}" apply -n istio-system -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/expose-services.yaml
cat <<EOF | oc --context "USD{CTX_CLUSTER2}" apply -f - apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: vUSD{ISTIO_VERSION} namespace: istio-system values: global: meshID: mesh1 multiCluster: clusterName: cluster2 network: network2 EOF
oc --context "USD{CTX_CLUSTER2}" wait --for condition=Ready istio/default --timeout=3m
oc --context "USD{CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/east-west-gateway-net2.yaml
oc --context "USD{CTX_CLUSTER2}" apply -n istio-system -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/expose-services.yaml
istioctl create-remote-secret --context="USD{CTX_CLUSTER2}" --name=cluster2 | oc --context="USD{CTX_CLUSTER1}" apply -f -
istioctl create-remote-secret --context="USD{CTX_CLUSTER1}" --name=cluster1 | oc --context="USD{CTX_CLUSTER2}" apply -f -
oc --context "USD{CTX_CLUSTER1}" get project sample || oc --context="USD{CTX_CLUSTER1}" new-project sample
oc --context="USD{CTX_CLUSTER1}" label namespace sample istio-injection=enabled
oc --context="USD{CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/helloworld/helloworld.yaml -l service=helloworld -n sample
oc --context="USD{CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/helloworld/helloworld.yaml -l version=v1 -n sample
oc --context="USD{CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/sleep/sleep.yaml -n sample
oc --context="USD{CTX_CLUSTER1}" wait --for condition=available -n sample deployment/helloworld-v1
oc --context="USD{CTX_CLUSTER1}" wait --for condition=available -n sample deployment/sleep
oc --context "USD{CTX_CLUSTER2}" get project sample || oc --context="USD{CTX_CLUSTER2}" new-project sample
oc --context="USD{CTX_CLUSTER2}" label namespace sample istio-injection=enabled
oc --context="USD{CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/helloworld/helloworld.yaml -l service=helloworld -n sample
oc --context="USD{CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/helloworld/helloworld.yaml -l version=v2 -n sample
oc --context="USD{CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/istio/istio/USD{ISTIO_VERSION}/samples/sleep/sleep.yaml -n sample
oc --context="USD{CTX_CLUSTER2}" wait --for condition=available -n sample deployment/helloworld-v2
oc --context="USD{CTX_CLUSTER2}" wait --for condition=available -n sample deployment/sleep
for i in {0..9}; do oc --context="USD{CTX_CLUSTER1}" exec -n sample deploy/sleep -c sleep -- curl -sS helloworld.sample:5000/hello; done
for i in {0..9}; do oc --context="USD{CTX_CLUSTER2}" exec -n sample deploy/sleep -c sleep -- curl -sS helloworld.sample:5000/hello; done
oc --context="USD{CTX_CLUSTER1}" delete istio/default ns/istio-system ns/sample ns/istio-cni
oc --context="USD{CTX_CLUSTER2}" delete istio/default ns/istio-system ns/sample ns/istio-cni
export ISTIO_VERSION=1.24.1
oc --context="USD{CTX_CLUSTER1}" label namespace istio-system topology.istio.io/network=network1
cat <<EOF | oc --context "USD{CTX_CLUSTER1}" apply -f - apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: vUSD{ISTIO_VERSION} namespace: istio-system values: global: meshID: mesh1 multiCluster: clusterName: cluster1 network: network1 externalIstiod: true 1 EOF
oc --context "USD{CTX_CLUSTER1}" wait --for condition=Ready istio/default --timeout=3m
oc --context "USD{CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/east-west-gateway-net1.yaml
oc --context "USD{CTX_CLUSTER1}" apply -n istio-system -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/expose-istiod.yaml
oc --context "USD{CTX_CLUSTER1}" apply -n istio-system -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/expose-services.yaml
export DISCOVERY_ADDRESS=USD(oc --context="USD{CTX_CLUSTER1}" -n istio-system get svc istio-eastwestgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
cat <<EOF | oc --context "USD{CTX_CLUSTER2}" apply -f - apiVersion: sailoperator.io/v1alpha1 kind: Istio metadata: name: default spec: version: vUSD{ISTIO_VERSION} namespace: istio-system profile: remote values: istiodRemote: injectionPath: /inject/cluster/cluster2/net/network2 global: remotePilotAddress: USD{DISCOVERY_ADDRESS} EOF
oc --context="USD{CTX_CLUSTER2}" annotate namespace istio-system topology.istio.io/controlPlaneClusters=cluster1
oc --context="USD{CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2
istioctl create-remote-secret --context="USD{CTX_CLUSTER2}" --name=cluster2 | oc --context="USD{CTX_CLUSTER1}" apply -f -
oc --context "USD{CTX_CLUSTER2}" wait --for condition=Ready istio/default --timeout=3m
oc --context "USD{CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/docs/multicluster/east-west-gateway-net2.yaml