Skip to content

Support for network changes starting with Istio v1.10 and greater #2538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Sep 21, 2021
Merged

Support for network changes starting with Istio v1.10 and greater #2538

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5dac86e
Update http-probe to bind to server ip
lennyphan Sep 1, 2021
b12a2cf
Add readiness port NAP for both server pod ip and localhost
lennyphan Sep 1, 2021
12c0b46
Create localhost binding NAPs
lennyphan Sep 15, 2021
4144132
Update Istio support document for Istio network changes
lennyphan Sep 17, 2021
2beb22a
Fix pull request analysis failure and enhanced nameContainsLocalHostI…
lennyphan Sep 18, 2021
5c78565
Remove print statement
lennyphan Sep 18, 2021
a2f4618
Python Dict has_key not supported
lennyphan Sep 18, 2021
169785b
Changes based on code review
lennyphan Sep 20, 2021
7d277ca
Update istio.md
rjeberhard Sep 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions documentation/staging/content/userguide/istio/istio.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,39 @@ If the WebLogic administration port is enabled on the Administration Server:
Additionally, when Istio support is enabled for a domain, the operator
ensures that the Istio sidecar is not injected into the introspector job's pods.

#### Support for network changes in Istio v1.10 and later

Prior to Istio release 1.10, the Istio Envoy proxy redirected all inbound traffic to the localhost
Copy link
Member

@rjeberhard rjeberhard Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think the "prior to" paragraph is necessary and you can just begin with "Starting with Istio 1.10". Also, let's link to that article describing the change.

Copy link
Member

@rjeberhard rjeberhard Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that you did link the article later. Move the link up here :)

Copy link
Member Author

@lennyphan lennyphan Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed. Moved the link up.

Copy link
Member Author

@lennyphan lennyphan Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, removed the text describing the previous Istio network behavior.

network interface. The network channels listed above, which the operator automatically added,
were bound to the localhost interface in order for WebLogic to receive the inbound traffic.
Starting with Istio 1.10, the networking behavior was changed in that the proxy no longer redirects
the traffic to the localhost interface, but instead forwards it to the network interface associated
to the pod's IP. In order to support Istio v1.10 and later, as well as pre-1.10 releases, the
Copy link
Member

@rjeberhard rjeberhard Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"pre-1.10 releases" -> "previous releases"

Copy link
Member Author

@lennyphan lennyphan Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed.

operator will:

* Add an additional WebLogic HTTP protocol network channel for the readiness probe that is bound to the localhost network interface.
* Add additional WebLogic network channels, bound to the localhost network interface, for each defined custom network channel.
* Continue to automatically add the network channels described above in [How Istio-enabled domains differ from regular domains](#how-istio-enabled-domains-differ-from-regular-domains)

When adding additional WebLogic network channels for the readiness probe and any defined custom channels,
the name of the additional channel will be appended with '-lhNN', where NN represents
a two digit value for uniqueness.

For example, the additional WebLogic HTTP protocol network channel for the readiness probe would be
defined as follows:

|Name|Port|Listening address|Protocol|Exposed as a container port|
|----|----|----|--------|-----|
|`http-probe-lh01`|From configuration Istio `readinessPort` | `127.0.0.1` | `http`| No |

As another example, for a custom WebLogic network channel defined as `T3Channel` with port `5556`
and protocol `t3`, the additional channel would be defined as follows:

|Name|Port|Listening address|Protocol|Exposed as a container port|
|----|----|----|--------|-----|
|`T3Channel-lh01`| `5556` | `127.0.0.1` | `t3`| Yes |

To learn more about changes to Istio networking beginning with Istio 1.10, see [Upcoming networking changes in Istio 1.10](https://istio.io/latest/blog/2021/upcoming-networking-changes//).
Copy link
Member

@jshum2479 jshum2479 Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the user need to do anything if upgrading istio from 1.9 to 1.10 or higher, does he/she needs to re-run the introspector by updating the introspectVersion or something else?

Copy link
Member Author

@lennyphan lennyphan Sep 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a very good question. With this change, we can support all versions of Istio and so I don't believe re-running introspection would make much difference or is necessary. Do we have a documented process for upgrading Istio in a cluster? That is, do we recommend shutting down the domain before upgrading Istio or can you upgrade Istio while a domain is running?


### Apply the Domain YAML file

Expand Down
Loading