Service Mesh

Procedure

1. Log in to the OpenShift Container Platform web console as a user with the cluster-admin role. If you use Red Hat OpenShift Dedicated, you must have an account with the dedicated-admin role. Create a project named istio-system . Navigate to Home → Projects . Click Create Project . In the Name field, enter istio-system . The ServiceMeshControlPlane resource must be installed in a project that is separate from your microservices and Operators. These steps use istio-system as an example, but you can deploy your Service Mesh control plane in any project as long as it is separate from the project that contains your services. Click Create . Navigate to Operators → Installed Operators . Click the Red Hat OpenShift Service Mesh Operator, then click Istio Service Mesh Control Plane . On the Istio Service Mesh Control Plane tab, click Create ServiceMeshControlPlane . Accept the default Service Mesh control plane version to take advantage of the features available in the most current version of the product. The version of the control plane determines the features available regardless of the version of the Operator. Click Create . The Operator creates pods, services, and Service Mesh control plane components based on your configuration parameters. You can configure ServiceMeshControlPlane settings at a later time.

Procedure

1. Create a project named istio-system .

   $ oc new-project istio-system

2. Create a ServiceMeshControlPlane file named istio-installation.yaml using the following example. The version of the Service Mesh control plane determines the features available regardless of the version of the Operator.

   Example version 2.6 istio-installation.yaml

   apiVersion: maistra.io/v2
   kind: ServiceMeshControlPlane
   metadata:
     name: basic
     namespace: istio-system
   spec:
     version: v2.6
     tracing:
       type: None
       sampling: 10000
     addons:
       kiali:
         enabled: true
         name: kiali
       grafana:
         enabled: true

   Run the following command to deploy the Service Mesh control plane, where <istio_installation.yaml> includes the full path to your file.

   $ oc create -n istio-system -f <istio_installation.yaml>

3. To watch the progress of the pod deployment, run the following command:

   $ oc get pods -n istio-system -w

   You should see output similar to the following:

   NAME                                   READY   STATUS    RESTARTS   AGE
   grafana-b4d59bd7-mrgbr                 2/2     Running   0          65m
   istio-egressgateway-678dc97b4c-wrjkp   1/1     Running   0          108s
   istio-ingressgateway-b45c9d54d-4qg6n   1/1     Running   0          108s
   istiod-basic-55d78bbbcd-j5556          1/1     Running   0          108s
   jaeger-67c75bd6dc-jv6k6                2/2     Running   0          65m
   kiali-6476c7656c-x5msp                 1/1     Running   0          43m
   prometheus-58954b8d6b-m5std            2/2     Running   0          66m

Procedure

1. Run the following command to verify the Service Mesh control plane installation, where istio-system is the namespace where you installed the Service Mesh control plane.

   $ oc get smcp -n istio-system

   The installation has finished successfully when the STATUS column is ComponentsReady .

   NAME    READY   STATUS            PROFILES      VERSION   AGE
   basic   10/10   ComponentsReady   ["default"]   2.6.0     66m

Procedure

1. Log in to the OpenShift Container Platform web console. Navigate to Operators → Installed Operators . Click the Red Hat OpenShift Service Mesh Operator, and then click Istio Service Mesh Control Plane . Click the name of the control plane resource. For example, basic . Click YAML . Add the nodeSelector and tolerations fields to the spec.runtime.defaults.pod specification in the ServiceMeshControlPlane resource, as shown in the following example:

   spec:
     runtime:
       defaults:
           nodeSelector: 1
             node-role.kubernetes.io/infra: ""
           tolerations: 2
           - effect: NoSchedule
             key: node-role.kubernetes.io/infra
             value: reserved
           - effect: NoExecute
             key: node-role.kubernetes.io/infra
             value: reserved

   1

   Ensures that the ServiceMeshControlPlane pod is only scheduled on an infrastructure node. Ensures that the pod is accepted by the infrastructure node for execution. Click Save . Click Reload .

Procedure

1. Log in to the OpenShift Container Platform web console. Navigate to Operators → Installed Operators . Click the Red Hat OpenShift Service Mesh Operator, and then click Istio Service Mesh Control Plane . Click the name of the control plane resource. For example, basic . Click YAML . Add the nodeSelector and tolerations fields to the spec.runtime.components.pilot.pod specification in the ServiceMeshControlPlane resource, as shown in the following example:

   spec:
     runtime:
       components:
         pilot:
             nodeSelector: 1
               node-role.kubernetes.io/infra: ""
             tolerations: 2
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved

   1

   Ensures that the Istiod pod is only scheduled on an infrastructure node. Ensures that the pod is accepted by the infrastructure node for execution. Add the nodeSelector and the tolerations fields to the spec.gateways.ingress.runtime.pod and spec.gateways.egress.runtime.pod specifications in the ServiceMeshControlPlane resource, as shown in the following example:

   spec:
     gateways:
       ingress:
         runtime:
             nodeSelector: 1
               node-role.kubernetes.io/infra: ""
             tolerations: 2
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved
       egress:
         runtime:
             nodeSelector: 3
               node-role.kubernetes.io/infra: ""
             tolerations: 4
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved

   1 3

   Ensures that the gateway pod is only scheduled on an infrastructure node Ensures that the pod is accepted by the infrastructure node for execution. Click Save . Click Reload .

Procedure

1. Open the ServiceMeshControlPlane resource as a YAML file:

   $ oc -n istio-system edit smcp <name> 1

   1

   <name> represents the name of the ServiceMeshControlPlane resource. To run all of the Service Mesh components deployed by the ServiceMeshControlPlane on infrastructure nodes, add the nodeSelector and tolerations fields to the spec.runtime.defaults.pod spec in the ServiceMeshControlPlane resource:

   spec:
     runtime:
       defaults:
           nodeSelector: 1
             node-role.kubernetes.io/infra: ""
           tolerations: 2
           - effect: NoSchedule
             key: node-role.kubernetes.io/infra
             value: reserved
           - effect: NoExecute
             key: node-role.kubernetes.io/infra
             value: reserved

   1

   Ensures that the SMCP pods are only scheduled on an infrastructure node. Ensures that the pods are accepted by the infrastructure node.

Procedure

1. Open the ServiceMeshControlPlane resource as a YAML file.

   $ oc -n istio-system edit smcp <name> 1

   1

   <name> represents the name of the ServiceMeshControlPlane resource. To run the Istiod component on an infrastructure node, add the nodeSelector and the tolerations fields to the spec.runtime.components.pilot.pod spec in the ServiceMeshControlPlane resource.

   spec:
     runtime:
       components:
         pilot:
             nodeSelector: 1
               node-role.kubernetes.io/infra: ""
             tolerations: 2
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved

   1

   Ensures that the Istiod pod is only scheduled on an infrastructure node. Ensures that the pod is accepted by the infrastructure node. To run Ingress and Egress Gateways on infrastructure nodes, add the nodeSelector and the tolerations fields to the spec.gateways.ingress.runtime.pod spec and the spec.gateways.egress.runtime.pod spec in the ServiceMeshControlPlane resource.

   spec:
     gateways:
       ingress:
         runtime:
             nodeSelector: 1
               node-role.kubernetes.io/infra: ""
             tolerations: 2
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved
       egress:
         runtime:
             nodeSelector: 3
               node-role.kubernetes.io/infra: ""
             tolerations: 4
             - effect: NoSchedule
               key: node-role.kubernetes.io/infra
               value: reserved
             - effect: NoExecute
               key: node-role.kubernetes.io/infra
               value: reserved

   1 3

   Ensures that the gateway pod is only scheduled on an infrastructure node Ensures that the pod is accepted by the infrastructure node.

Procedure

1. Create a project named istio-system . Navigate to Home → Projects . Click Create Project . In the Name field, enter istio-system . The ServiceMeshControlPlane resource must be installed in a project that is separate from your microservices and Operators. These steps use istio-system as an example. You can deploy the Service Mesh control plane to any project as long as it is separate from the project that contains your services. Click Create . Navigate to Operators → Installed Operators . Click the Red Hat OpenShift Service Mesh Operator, then click Istio Service Mesh Control Plane . On the Istio Service Mesh Control Plane tab, click Create ServiceMeshControlPlane . Click YAML view . The version of the Service Mesh control plane determines the features available regardless of the version of the Operator. Modify the spec.mode field of the YAML file to specify ClusterWide .

   Example version 2.6 istio-installation.yaml

   apiVersion: maistra.io/v2
   kind: ServiceMeshControlPlane
   metadata:
     name: basic
     namespace: istio-system
   spec:
     version: v2.6
     mode: ClusterWide

   Click Create . The Operator creates pods, services, and Service Mesh control plane components based on your configuration parameters. The operator also creates the ServiceMeshMemberRoll if it does not exist as part of the default configuration.

Procedure

1. Create a project named istio-system .

   $ oc new-project istio-system

2. Create a ServiceMeshControlPlane file named istio-installation.yaml using the following example:

   Example version 2.6 istio-installation.yaml

   apiVersion: maistra.io/v2
   kind: ServiceMeshControlPlane
   metadata:
     name: basic
     namespace: istio-system
   spec:
     version: v2.6
     mode: ClusterWide

   Run the following command to deploy the Service Mesh control plane:

   $ oc create -n istio-system -f <istio_installation.yaml>

   where:

   <istio_installation.yaml>

   Specifies the full path to your file.

Verification

1. To monitor the progress of the pod deployment, run the following command:

   $ oc get pods -n istio-system -w

   You should see output similar to the following example:

   Example output

   NAME                                   READY   STATUS    RESTARTS   AGE
   grafana-b4d59bd7-mrgbr                 2/2     Running   0          65m
   istio-egressgateway-678dc97b4c-wrjkp   1/1     Running   0          108s
   istio-ingressgateway-b45c9d54d-4qg6n   1/1     Running   0          108s
   istiod-basic-55d78bbbcd-j5556          1/1     Running   0          108s
   jaeger-67c75bd6dc-jv6k6                2/2     Running   0          65m
   kiali-6476c7656c-x5msp                 1/1     Running   0          43m
   prometheus-58954b8d6b-m5std            2/2     Running   0          66m

Procedure

1. Log in to the OpenShift Container Platform web console. If you do not already have services for your mesh, or you are starting from scratch, create a project for your applications. It must be different from the project where you installed the Service Mesh control plane. Navigate to Home → Projects . Enter a name in the Name field. Click Create . Navigate to Operators → Installed Operators . Click the Project menu and choose the project where your ServiceMeshControlPlane resource is deployed from the list, for example istio-system . Click the Red Hat OpenShift Service Mesh Operator. Click the Istio Service Mesh Member Roll tab. Click Create ServiceMeshMemberRoll Click Members , then enter the name of your project in the Value field. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource. Click Create .

Procedure

1. Log in to the OpenShift Container Platform CLI.

   $ oc login --username=<NAMEOFUSER> https://<HOSTNAME>:6443

2. If you do not already have services for your mesh, or you are starting from scratch, create a project for your applications. It must be different from the project where you installed the Service Mesh control plane.

   $ oc new-project <your-project>

3. To add your projects as members, modify the following example YAML. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource. In this example, istio-system is the name of the Service Mesh control plane project.

   Example servicemeshmemberroll-default.yaml

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system
   spec:
     members:
       # a list of projects joined into the service mesh
       - your-project-name
       - another-project-name

   Run the following command to upload and create the ServiceMeshMemberRoll resource in the istio-system namespace.

   $ oc create -n istio-system -f servicemeshmemberroll-default.yaml

4. Run the following command to verify the ServiceMeshMemberRoll was created successfully.

   $ oc get smmr -n istio-system default

   The installation has finished successfully when the STATUS column is Configured .

Procedure

1. Log in to the OpenShift Container Platform web console. Navigate to Operators → Installed Operators . Click the Project menu and choose the project where your ServiceMeshControlPlane resource is deployed from the list. For example istio-system . Click the Red Hat OpenShift Service Mesh Operator. Click the Istio Service Mesh Member Roll tab. Click the default link. Click the YAML tab. Modify the YAML to add projects as members (or delete them to remove existing members). You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.

   Example servicemeshmemberroll-default.yaml

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system #control plane project
   spec:
     members:
       # a list of projects joined into the service mesh
       - your-project-name
       - another-project-name

   Click Save . Click Reload .

Procedure

1. Log in to the OpenShift Container Platform CLI. Edit the ServiceMeshMemberRoll resource.

   $ oc edit smmr -n <controlplane-namespace>

2. Modify the YAML to add or remove projects as members. You can add any number of projects, but a project can only belong to one ServiceMeshMemberRoll resource.

   Example servicemeshmemberroll-default.yaml

   apiVersion: maistra.io/v1
   kind: ServiceMeshMemberRoll
   metadata:
     name: default
     namespace: istio-system #control plane project
   spec:
     members:
       # a list of projects joined into the service mesh
       - your-project-name
       - another-project-name

   Save the file and exit the editor.

Procedure

1. Log in to the OpenShift Container Platform web console. Navigate to Operators → Installed Operators . Click the Project menu and choose the project that you want to add to the mesh from the drop-down list. For example, istio-system . Click the Red Hat OpenShift Service Mesh Operator. Click the Istio Service Mesh Member tab. Click Create ServiceMeshMember Accept the default name for the ServiceMeshMember . Click to expand ControlPlaneRef . In the Namespace field, select the project that the ServiceMeshControlPlane resource belongs to. For example, istio-system . In the Name field, enter the name of the ServiceMeshControlPlane resource that this namespace belongs to. For example, basic . Click Create .

Verification

1. Confirm the ServiceMeshMember resource was created and that the project was added to the mesh by using the following steps: Click the resource name, for example, default . View the Conditions section shown at the end of the screen. Confirm that the Status of the Reconciled and Ready conditions is True . If the Status is False , see the Reason and Message columns for more information.

Procedure

1. Log in to the OpenShift Container Platform CLI. Create the YAML file for the ServiceMeshMember manifest. The manifest adds the my-application project to the service mesh that was created by the ServiceMeshControlPlane resource deployed in the istio-system namespace:

   apiVersion: maistra.io/v1
   kind: ServiceMeshMember
   metadata:
     name: default
     namespace: my-application
   spec:
     controlPlaneRef:
       namespace: istio-system
       name: basic

2. Apply the YAML file to create the ServiceMeshMember resource:

   $ oc apply -f <file-name>

Procedure

1. Navigate to Operators → Installed Operators . Click the Project menu, and from the drop-down list, select the project where your ServiceMeshMemberRoll resource is deployed. For example, istio-system . Click the Red Hat OpenShift Service Mesh Operator. Click the Istio Service Mesh Member Roll tab. Click Create ServiceMeshMember Roll . Accept the default name for the ServiceMeshMemberRoll . In the Labels field, enter key-value pairs to define the labels that identify which namespaces to include in the service mesh. If a project namespace has either label specified by the selectors, then the project namespace is included in the service mesh. You do not need to include both labels. For example, entering mykey=myvalue includes all namespaces with this label as part of the mesh. When the selector identifies a match, the project namespace is added to the service mesh. Entering myotherkey=myothervalue includes all namespaces with this label as part of the mesh. When the selector identifies a match, the project namespace is added to the service mesh. Click Create .

Procedure

1. Log in to the OpenShift Container Platform CLI. Edit the ServiceMeshMemberRoll resource.

   $ oc edit smmr default -n istio-system

   You can deploy the Service Mesh control plane to any project provided that it is separate from the project that contains your services. Modify the YAML file to include namespace label selectors in the spec.memberSelectors field of the ServiceMeshMemberRoll resource. Instead of using the matchLabels field, you can also use the matchExpressions field in the selector.

Procedure

1. Click Home → Projects . Click Create Project . Enter bookinfo as the Project Name , enter a Display Name , and enter a Description , then click Create . Alternatively, you can run this command from the CLI to create the bookinfo project.

   $ oc new-project bookinfo

Procedure

1. To add destination rules, run one of the following commands: If you did not enable mutual TLS:

   $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/destination-rule-all.yaml

2. If you enabled mutual TLS:

   $ oc apply -n bookinfo -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.6/samples/bookinfo/networking/destination-rule-all-mtls.yaml

   You should see output similar to the following:

   destinationrule.networking.istio.io/productpage created
   destinationrule.networking.istio.io/reviews created
   destinationrule.networking.istio.io/ratings created
   destinationrule.networking.istio.io/details created

Procedure from CLI

1. Verify that all pods are ready with this command:

   $ oc get pods -n bookinfo

   All pods should have a status of Running . You should see output similar to the following:

   NAME                              READY   STATUS    RESTARTS   AGE
   details-v1-55b869668-jh7hb        2/2     Running   0          12m
   productpage-v1-6fc77ff794-nsl8r   2/2     Running   0          12m
   ratings-v1-7d7d8d8b56-55scn       2/2     Running   0          12m
   reviews-v1-868597db96-bdxgq       2/2     Running   0          12m
   reviews-v2-5b64f47978-cvssp       2/2     Running   0          12m
   reviews-v3-6dfd49b55b-vcwpf       2/2     Running   0          12m

2. Run the following command to retrieve the URL for the product page:

   echo "http://$GATEWAY_URL/productpage"

3. Copy and paste the output in a web browser to verify the Bookinfo product page is deployed.

Procedure from Kiali web console

1. Obtain the address for the Kiali web console. Log in to the OpenShift Container Platform web console. Navigate to Networking → Routes . On the Routes page, select the Service Mesh control plane project, for example istio-system , from the Namespace menu. The Location column displays the linked address for each route. Click the link in the Location column for Kiali. Click Log In With OpenShift . The Kiali Overview screen presents tiles for each project namespace. In Kiali, click Graph . Select bookinfo from the Namespace list, and App graph from the Graph Type list. Click Display idle nodes from the Display menu. This displays nodes that are defined but have not received or sent requests. It can confirm that an application is properly defined, but that no request traffic has been reported. Use the Duration menu to increase the time period to help ensure older traffic is captured. Use the Refresh Rate menu to refresh traffic more or less often, or not at all. Click Services , Workloads or Istio Config to see list views of bookinfo components, and confirm that they are healthy.

Procedure

1. Log in to the OpenShift Container Platform CLI as a cluster-admin . If you use Red Hat OpenShift Dedicated, you must have an account with the dedicated-admin role. From the CLI, run this command to create the ConfigMap named smcp-templates in the openshift-operators project and replace <profiles-directory> with the location of the ServiceMeshControlPlane files on your local disk:

   $ oc create configmap --from-file=<profiles-directory> smcp-templates -n openshift-operators

2. You can use the profiles parameter in the ServiceMeshControlPlane to specify one or more templates.

     apiVersion: maistra.io/v2
     kind: ServiceMeshControlPlane
     metadata:
       name: basic
     spec:
       profiles:
       - default

Procedure

1. Launch the Kiali console. Click Log In With OpenShift . In Kiali console, click Graph to view a namespace graph. From the Namespace menu, select your application namespace, for example, bookinfo . To choose a different graph layout, do either or both of the following: Select different graph data groupings from the menu at the top of the graph. App graph Service graph Versioned App graph (default) Workload graph Select a different graph layout from the Legend at the bottom of the graph. Layout default dagre Layout 1 cose-bilkent Layout 2 cola

Procedure

1. Launch the Kiali console. Click Log In With OpenShift . The Kiali Overview page displays namespaces that have been added to the mesh that you have permissions to view. Click Workloads . On the Workloads page, select the project from the Namespace menu. If necessary, use the filter to find the workload whose logs you want to view. Click the workload Name . For example, click ratings-v1 . On the Workload Details page, click the Logs tab to view the logs for the workload. If you do not see any log entries, you may need to adjust either the Time Range or the Refresh interval.

Procedure

1. Launch the Kiali console. Click Log In With OpenShift . The Kiali Overview page displays namespaces that have been added to the mesh that you have permissions to view. Click either Applications , Workloads , or Services . On the Applications , Workloads , or Services page, select the project from the Namespace menu. If necessary, use the filter to find the application, workload, or service whose logs you want to view. Click the Name . On the Application Detail , Workload Details , or Service Details page, click either the Inbound Metrics or Outbound Metrics tab to view the metrics.

Procedure

1. Create an OpenTelemetry Collector instance in a mesh namespace. This example uses the bookinfo namespace:

   Example OpenTelemetry Collector configuration

   apiVersion: opentelemetry.io/v1alpha1
   kind: OpenTelemetryCollector
   metadata:
     name: otel
     namespace: bookinfo  1
     annotations:
       sidecar.istio.io/inject: 'true' 2
   spec:
     mode: deployment
     config: |
       receivers:
         otlp:
           protocols:
             grpc:
               endpoint: 0.0.0.0:4317
       exporters:
         otlp:
           endpoint: "tempo-sample-distributor.tracing-system.svc.cluster.local:4317" 3
             insecure: true
       service:
         pipelines:
           traces:
             receivers: [otlp]
             processors: []
             exporters: [otlp]

   Include the namespace in the ServiceMeshMemberRoll member list. The sidecar injection annotation is only required when you enable the spec.security.dataPlane parameter for mTLS encryption in the ServiceMeshControlPlane resource. In this example, a TempoStack instance is running in the tracing-system namespace. You do not have to include the TempoStack namespace, such as`tracing-system`, in the ServiceMeshMemberRoll member list. You only need to create one instance of the OpenTelemetry Collector in one of the ServiceMeshMemberRoll member namespaces. Check the otel-collector pod log and verify that the pod is running:

   Example otel-collector pod log check

   $ oc logs -n bookinfo  -l app.kubernetes.io/name=otel-collector

   Create or update an existing ServiceMeshControlPlane custom resource (CR) in the istio-system namespace:

   Example SMCP custom resource

   kind: ServiceMeshControlPlane
   apiVersion: maistra.io/v2
   metadata:
     name: basic
     namespace: istio-system
   spec:
     addons:
       grafana:
         enabled: false
       kiali:
         enabled: true
       prometheus:
         enabled: true
     meshConfig:
       extensionProviders:
         - name: otel
           opentelemetry:
             port: 4317
             service: otel-collector.bookinfo.svc.cluster.local
     policy:
       type: Istiod
     telemetry:
       type: Istiod
     version: v2.6

   When upgrading from SMCP 2.5 to 2.6, set the spec.tracing.type parameter to None :

   Example SMCP spec.tracing.type parameter

   spec:
     tracing:
       type: None

   Create a Telemetry resource in the istio-system namespace:

   Example Telemetry resource

   apiVersion: telemetry.istio.io/v1alpha1
   kind: Telemetry
   metadata:
     name: mesh-default
     namespace: istio-system
   spec:
     tracing:
     - providers:
       - name: otel
       randomSamplingPercentage: 100

   Verify the istiod log. Configure the Kiali resource specification to enable a Kiali workload traces dashboard. You can use the dashboard to view tracing query results.

   Example Kiali resource

   apiVersion: kiali.io/v1alpha1
   kind: Kiali
   # ...
   spec:
     external_services:
       tracing:
         query_timeout: 30 1
         enabled: true
         in_cluster_url: 'http://tempo-sample-query-frontend.tracing-system.svc.cluster.local:16685'
         url: '[Tempo query frontend Route url]'
         use_grpc: true 2

   The default query_timeout integer value is 30 seconds. If you set the value to greater than 30 seconds, you must update .spec.server.write_timeout in the Kiali CR and add the annotation haproxy.router.openshift.io/timeout=50s to the Kiali route. Both .spec.server.write_timeout and haproxy.router.openshift.io/timeout= must be greater than query_timeout . If you are not using the default HTTP or gRPC port, replace the in_cluster_url: port with your custom port. Kiali 1.73 uses the Jaeger Query API, which causes a longer response time depending on Tempo resource limits. If you see a Could not fetch spans error message in the Kiali UI, then check your Tempo configuration or reduce the limit per query in Kiali. Send requests to your application. Verify the istiod pod logs and the otel-collector pod logs.

Procedure

1. In the OpenShift Container Platform web console, click Operators → Installed Operators . Click the Project menu and select the project where you installed the Service Mesh control plane, for example istio-system . Click the Red Hat OpenShift Service Mesh Operator. In the Istio Service Mesh Control Plane column, click the name of your ServiceMeshControlPlane resource, for example basic . Add the name of your distributed tracing platform (Jaeger) instance to the ServiceMeshControlPlane . Click the YAML tab. Add the name of your distributed tracing platform (Jaeger) instance to spec.addons.jaeger.name in your ServiceMeshControlPlane resource. In the following example, distr-tracing-production is the name of the distributed tracing platform (Jaeger) instance.

   Example distributed tracing configuration

   spec:
     addons:
       jaeger:
         name: distr-tracing-production

   Click Save . Click Reload to verify the ServiceMeshControlPlane resource was configured correctly.

Procedure

1. In the OpenShift Container Platform web console, click Operators → Installed Operators . Click the Project menu and select the project where you installed the control plane, for example istio-system . Click the Red Hat OpenShift Service Mesh Operator. In the Istio Service Mesh Control Plane column, click the name of your ServiceMeshControlPlane resource, for example basic . To adjust the sampling rate, set a different value for spec.tracing.sampling . Click the YAML tab. Set the value for spec.tracing.sampling in your ServiceMeshControlPlane resource. In the following example, set it to 100 .

   Jaeger sampling example

   spec:
     tracing:
       sampling: 100

   Click Save . Click Reload to verify the ServiceMeshControlPlane resource was configured correctly.