Skip to content

Commit c599180

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #102344 from openshift-cherrypick-robot/cherry-pick-100109-to-enterprise-4.18
[enterprise-4.18] OSDOCS#15839: istio-csr integration for cert-manager GA
2 parents ed91b5e + 5a535bc commit c599180

10 files changed

+266
-56
lines changed

‎modules/cert-manager-config-metrics-collection.adoc‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-config-metrics-collection_{context}"]
7+
= Configuring metrics collection for the istio-csr operand
8+
9+
The istio-csr operand exposes metrics by default on port `9402` at the `/metrics` service endpoint. You can configure metrics collection for the operand by creating a `ServiceMonitor` custom resource (CR), which enables the Prometheus Operator to collect custom metrics. For more information, see "Configuring user workload monitoring".
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have installed the {cert-manager-operator}.
15+
* You have enabled user workload monitoring.
16+
17+
.Procedure
18+
19+
. Create the `ServiceMonitor` CR definition file:
20+
+
21+
.Example `servicemonitor-istio-csr.yaml` file
22+
[source,yaml]
23+
----
24+
apiVersion: monitoring.coreos.com/v1
25+
kind: ServiceMonitor
26+
metadata:
27+
labels:
28+
app: cert-manager-istio-csr
29+
app.kubernetes.io/instance: cert-manager-istio-csr
30+
app.kubernetes.io/name: cert-manager-istio-csr
31+
name: cert-manager-istio-csr
32+
namespace: <istio_csr_project_name> <1>
33+
spec:
34+
endpoints:
35+
- honorLabels: false
36+
interval: 60s
37+
path: /metrics
38+
scrapeTimeout: 30s
39+
targetPort: 9402
40+
namespaceSelector:
41+
matchNames:
42+
- <istio_csr_project_name> <1>
43+
selector:
44+
matchLabels:
45+
app: cert-manager-istio-csr
46+
app.kubernetes.io/instance: cert-manager-istio-csr
47+
app.kubernetes.io/name: cert-manager-istio-csr
48+
----
49+
<1> Replace `<istio_csr_project_name>` with the namespace where you created the `IstioCSR` CR.
50+
51+
. Create the `ServiceMonitor` CR by running the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc apply -f servicemonitor-istio-csr.yaml
56+
----
57+
58+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance starts collecting metrics from the istio-csr operand. The collected metrics are labeled with `job="cert-manager-istio-csr"`.
59+
60+
.Verification
61+
62+
. Log in to the {product-title} web console.
63+
. Click *Observe* -> *Targets*.
64+
. In the **Label filter** field, enter the `service=cert-manager-istio-csr` label to filter the metrics targets.
65+
. Confirm that the *Status* column shows *Up* for the `cert-manager-istio-csr` target.

‎modules/cert-manager-enabling-istio.adoc‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎modules/cert-manager-istio-csr-config-ca-cert.adoc‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="cert-manager-istio-csr-config-ca-cert_{context}"]
3+
= Configuring the CA certificate for the Istio server
4+
5+
You can configure the `ConfigMap` that contains the CA bundle used by Istio workloads to verify the Istio server certificate. If not configured, the {cert-manager-operator} looks for the CA certificate in the configured issuer and in the Kubernetes Secret that contains the Istio certificates.
6+
7+
.Prerequisites
8+
9+
* You have access to the cluster with `cluster-admin` privileges.
10+
* You have created the `IstioCSR` custom resource (CR).
11+
12+
.Procedure
13+
14+
. Edit the `IstioCSR` CR by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
oc edit istiocsrs.operator.openshift.io default -n <istio_csr_project_name> <1>
19+
----
20+
<1> Replace `<istio_csr_project_name>` with the namespace where you created the `IstioCSR` CR.
21+
22+
. Configure the CA bundle by editing the `spec.istioCSRConfig.certManager` section:
23+
+
24+
.Sample `IstioCSR` CR with CA bundle configuration
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: IstioCSR
29+
...
30+
spec:
31+
istioCSRConfig:
32+
certManager:
33+
istioCACertificate:
34+
key: <key_in_the_configmap> <1>
35+
name: <configmap_name> <2>
36+
namespace: <configmap_namespace> <3>
37+
----
38+
<1> Specify the key name in the `ConfigMap` that contains the CA bundle.
39+
<2> Specify the name of the `ConfigMap`. Ensure that the referenced `ConfigMap` and key exist before you update this field.
40+
<3> Optional: Specify the namespace where the `ConfigMap` exists. If you do not set this field, the {cert-manager-operator} searches for the `ConfigMap` in the namespace where you have installed the `IstioCSR` CR.
41+
+
42+
[NOTE]
43+
====
44+
Whenever the CA certificate is rotated, you must manually update the `ConfigMap` with the latest certificate.
45+
====
46+
47+
. Save and close the editor to apply your changes. After the changes are applied, the cert-manager Operator updates the CA bundle for the `istio-csr` operand.

‎modules/cert-manager-istio-csr-config-namespace-sel.adoc‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="cert-manager-istio-csr-config-namespace-sel_{context}"]
3+
= Configuring the namespace selector for CA bundle distribution
4+
5+
The Istio-CSR agent creates and updates the `istio-ca-root-cert` `ConfigMap`, which contains the CA bundle. Workloads in the service mesh use this CA bundle to validate connections to the Istio control plane. You can configure a namespace selector to specify the namespaces in which the Istio-CSR agent creates this `ConfigMap`. If you do not configure a selector, the Istio-CSR agent creates the `ConfigMap` in all namespaces.
6+
7+
.Prerequisites
8+
9+
* You have access to the cluster with `cluster-admin` privileges.
10+
* You have created the `IstioCSR` custom resource (CR).
11+
12+
.Procedure
13+
14+
. Edit the `IstioCSR` CR by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
oc edit istiocsrs.operator.openshift.io default -n <istio_csr_project_name> <1>
19+
----
20+
<1> Replace `<istio_csr_project_name>` with the namespace where you created the `IstioCSR` CR.
21+
22+
. Configure the `spec.istioCSRConfig.istioDataPlaneNamespaceSelector` section to set the namespace selector:
23+
+
24+
.Sample IstioCSR CR configuration with a namespace selector
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: IstioCSR
29+
...
30+
spec:
31+
istioCSRConfig:
32+
istioDataPlaneNamespaceSelector: maistra.io/member-of=istio-system <1>
33+
# ...
34+
----
35+
<1> Replace `maistra.io/member-of=istio-system` with the label key and value that identify the namespaces in your service mesh. Use the format `<key>=<value>`.
36+
+
37+
[NOTE]
38+
====
39+
The istio-csr component does not delete or manage `ConfigMap` objects in namespaces that do not match the configured selector. If you create or update the selector after deploying the `IstioCSR` CR, or if you remove a label from a namespace, you must manually delete these `ConfigMap` objects to avoid conflicts.
40+
41+
You can run the following command to list `ConfigMap` objects that are not in namespaces matching the selector. In this example, the selector is `maistra.io/member-of=istio-system`:
42+
[source,terminal]
43+
----
44+
printf "%-25s %10s\n" "ConfigMap" "Namespace"; \
45+
for ns in $(oc get namespaces -l "maistra.io/member-of!=istio-system" -o=jsonpath='{.items[*].metadata.name}'); do \
46+
oc get configmaps -l "istio.io/config=true" -n $ns --no-headers -o jsonpath='{.items[*].metadata.name}{"\t"}{.items[*].metadata.namespace}{"\n"}' --ignore-not-found; \
47+
done
48+
----
49+
====
50+
51+
. Save and close the editor to apply your changes. After the changes are applied, the {cert-manager-operator} updates the namespace selector configuration for the istio-csr operand.

‎modules/cert-manager-istio-csr-customizing.adoc‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-operator-integrating-istio.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-istio-csr-customizing_{context}"]
7+
8+
= Customizing the IstioCSR custom resource
9+
10+
You can modify the `IstioCSR` custom resource (CR) to define how Istio workloads interact with the cert-manager Operator.

‎modules/cert-manager-istio-csr-setting-log-level.adoc‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="cert-manager-istio-csr-setting-log-level_{context}"]
3+
= Setting the log level for the istio-csr component
4+
5+
You can set the log level for the istio-csr component to control the verbosity and format of its log messages.
6+
7+
.Prerequisites
8+
9+
* You have access to the cluster with `cluster-admin` privileges.
10+
* You have created the `IstioCSR` custom resource (CR).
11+
12+
.Procedure
13+
14+
. Edit the `IstioCSR` CR by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
oc edit istiocsrs.operator.openshift.io default -n <istio_csr_project_name> <1>
19+
----
20+
<1> Replace `<istio_csr_project_name>` with the namespace where you created the `IstioCSR` CR.
21+
22+
. Configure the log level and format in the `spec.istioCSRConfig` section:
23+
+
24+
.Sample IstioCSR CR configuration for setting the log level
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: IstioCSR
29+
...
30+
spec:
31+
istioCSRConfig:
32+
logFormat: text <1>
33+
logLevel: 2 <2>
34+
# ...
35+
----
36+
<1> Specify the log output format. You can set this field to either `text` or `json`.
37+
<2> Set the log level. Supported values are in the range `1` through `5`, as defined by Kubernetes logging guidelines. The default value is `1`.
38+
39+
. Save and close the editor to apply your changes. After the changes are applied, the cert-manager Operator updates the log configuration for the istio-csr operand.

‎modules/cert-manager-istio-csr-updating.adoc‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎modules/cert-manager-query-metrics-for-istio-csr-operand.adoc‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-query-metrics-for-istio-csr-operand_{context}"]
7+
= Querying metrics for the istio-csr operand
8+
9+
Cluster administrators, or users with view access to all namespaces, can query metrics for the istio-csr operand by using the {product-title} web console. For more information, see "Accessing metrics".
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have installed the {cert-manager-operator}.
15+
* You have enabled monitoring and metrics collection by creating the `ServiceMonitor` object for the istio-csr operand.
16+
17+
.Procedure
18+
19+
. Log in to the {product-title} web console.
20+
. Click *Observe* -> *Metrics*.
21+
. In the query field, enter the following PromQL expression to query the `istio-csr` operand metrics:
22+
+
23+
`{job="cert-manager-istio-csr"}`
24+
25+
The results display metrics collected for the istio-csr operand, which can help you monitor its performance and behavior.

‎security/cert_manager_operator/cert-manager-monitoring.adoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,19 @@ include::modules/cert-manager-query-metrics.adoc[leveloffset=+1]
3030
.Additional resources
3131

3232
* xref:../../observability/monitoring/accessing-metrics/accessing-metrics-as-an-administrator.adoc#accessing-metrics[Accessing metrics]
33+
34+
// Configuring metrics collection for cert-manager Operator for Red Hat OpenShift istio-csr operand by using a ServiceMonitor
35+
include::modules/cert-manager-config-metrics-collection.adoc[leveloffset=+1]
36+
37+
[role="_additional-resources"]
38+
.Additional resources
39+
40+
* xref:../../observability/monitoring/configuring-user-workload-monitoring/preparing-to-configure-the-monitoring-stack-uwm.adoc#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm[Configuring user workload monitoring]
41+
42+
// Querying metrics for the istio-csr operand
43+
include::modules/cert-manager-query-metrics-for-istio-csr-operand.adoc[leveloffset=+1]
44+
45+
[role="_additional-resources"]
46+
.Additional resources
47+
48+
* xref:../../observability/monitoring/accessing-metrics/accessing-metrics-as-an-administrator.adoc#accessing-metrics-as-an-administrator[Accessing metrics as an administrator]

‎security/cert_manager_operator/cert-manager-operator-integrating-istio.adoc‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,13 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
:FeatureName: Istio-CSR integration for {cert-manager-operator}
10-
include::snippets/technology-preview.adoc[]
11-
129
The {cert-manager-operator} provides enhanced support for securing workloads and control plane components in {SMProductName} or Istio. This includes support for certificates enabling mutual TLS (mTLS), which are signed, delivered, and renewed using cert-manager issuers. You can secure Istio workloads and control plane components by using the {cert-manager-operator} managed Istio-CSR agent.
1310

1411
With this Istio-CSR integration, Istio can now obtain certificates from the {cert-manager-operator}, simplifying security and certificate management.
1512

1613
[id="cert-manager-operator-istio-csr-installing_{context}"]
1714
== Installing the Istio-CSR agent through {cert-manager-operator}
1815

19-
// Enabling Istio-CSR
20-
include::modules/cert-manager-enabling-istio.adoc[leveloffset=+2]
21-
2216
// Creating issuer
2317
include::modules/cert-manager-istio-creating-issuer.adoc[leveloffset=+2]
2418

@@ -30,8 +24,17 @@ include::modules/cert-manager-istio-creating-issuer.adoc[leveloffset=+2]
3024
// Installing using Istio-CSR
3125
include::modules/cert-manager-istio-csr-installing.adoc[leveloffset=+2]
3226

33-
// Uninstalling cert-manager Operator with Istio-CSR
34-
include::modules/cert-manager-istio-csr-uninstalling.adoc[leveloffset=+1]
27+
// Customizing the IstioCSR custom resource
28+
include::modules/cert-manager-istio-csr-customizing.adoc[leveloffset=+1]
29+
30+
// Setting a log level for istio-csr
31+
include::modules/cert-manager-istio-csr-setting-log-level.adoc[leveloffset=+2]
3532

36-
// Updating Istio-CSR
37-
include::modules/cert-manager-istio-csr-updating.adoc[leveloffset=+1]
33+
// Configuring the namespace selector for CA bundle distribution [leveloffset=+3]
34+
include::modules/cert-manager-istio-csr-config-namespace-sel.adoc[leveloffset=+2]
35+
36+
// Configuring the CA certificate of the istio server [leveloffset=+3]
37+
include::modules/cert-manager-istio-csr-config-ca-cert.adoc[leveloffset=+2]
38+
39+
// Uninstalling cert-manager Operator with Istio-CSR
40+
include::modules/cert-manager-istio-csr-uninstalling.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)