Skip to content

Commit 078f0a0

Browse files
author
Kalyani Desai
committed
SRVKS-1192-Serverless: Updated the procedure and added knative eventing content as well
1 parent 2fa22bb commit 078f0a0

File tree

3 files changed

+93
-21
lines changed

3 files changed

+93
-21
lines changed

‎integrations/serverless-ossm-setup.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ include::modules/serverless-ossm-installing-and-configuring-openshift-serverless
5959
include::modules/serverless-ossm-verifying-the-integration.adoc[leveloffset=+2]
6060

6161
include::modules/serverless-ossm-enabling-serving-metrics.adoc[leveloffset=+1]
62-
63-
62+
include::modules/serverless-ossm-disabling-network-policies.adoc[leveloffset=+1]
6463
// with kourier
6564
include::modules/serverless-ossm-secret-filtering-net-istio.adoc[leveloffset=+1]

‎modules/serverless-ossm-disabling-network-policies.adoc

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * /serverless/integrations/serverless-ossm-setup.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="serverless-ossm-disabling-network-policies_{context}"]
7+
= Disabling the default network policies
8+
9+
The {ServerlessOperatorName} generates the network policies by default. To disable the default network policy generation, you can add the `serverless.openshift.io/disable-istio-net-policies-generation` annotation in the `KnativeEventing` and `KnativeServing` custom resources (CRs).
10+
11+
.Prerequisites
12+
13+
* You have one of the following permissions to access the cluster:
14+
** Cluster administrator permissions on {ocp-product-title}
15+
** Cluster administrator permissions on {rosa-product-title}
16+
** Dedicated administrator permissions on {dedicated-product-title}
17+
* You have installed the OpenShift CLI (`oc`).
18+
* You have access to a project with the appropriate roles and permissions to create applications and other workloads.
19+
* You have installed the {ServerlessOperatorName}, Knative Serving, and Knative Eventing on your cluster.
20+
* You have installed {SMProductName} with the mTLS functionality enabled.
21+
22+
.Procedure
23+
24+
* Add the `serverless.openshift.io/disable-istio-net-policies-generation: "true"` annotation to your Knative custom resources.
25+
+
26+
[NOTE]
27+
====
28+
The {ServerlessOperatorName} generates the required network policies by default. When you configure `ServiceMeshControlPlane` with `manageNetworkPolicy: false`, you must disable the default network policy generation to ensure proper event delivery. To disable the default network policy generation, you can add the `serverless.openshift.io/disable-istio-net-policies-generation` annotation in the `KnativeEventing` and `KnativeServing` custom resources (CRs).
29+
====
30+
31+
.. Annotate the `KnativeEventing` CR by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ oc edit KnativeEventing -n knative-eventing
36+
----
37+
+
38+
.Example `KnativeEventing` CR
39+
[source,yaml]
40+
----
41+
apiVersion: operator.knative.dev/v1beta1
42+
kind: KnativeEventing
43+
metadata:
44+
name: knative-eventing
45+
namespace: knative-eventing
46+
annotations:
47+
serverless.openshift.io/disable-istio-net-policies-generation: "true"
48+
----
49+
50+
.. Annotate the `KnativeServing` CR by running the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc edit KnativeServing -n knative-serving
55+
----
56+
+
57+
.Example `KnativeServing` CR
58+
[source,yaml]
59+
----
60+
apiVersion: operator.knative.dev/v1beta1
61+
kind: KnativeServing
62+
metadata:
63+
name: knative-serving
64+
namespace: knative-serving
65+
annotations:
66+
serverless.openshift.io/disable-istio-net-policies-generation: "true"
67+
----
68+

‎modules/serverless-ossm-enabling-serving-metrics.adoc

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,21 @@
44

55
:_content-type: PROCEDURE
66
[id="serverless-ossm-enabling-serving-metrics_{context}"]
7-
= Enabling Knative Serving metrics when using Service Mesh with mTLS
7+
= Enabling Knative Serving and Knative Eventing metrics when using Service Mesh with mTLS
88

9-
If Service Mesh is enabled with mTLS, metrics for Knative Serving are disabled by default, because Service Mesh prevents Prometheus from scraping metrics. This section shows how to enable Knative Serving metrics when using Service Mesh and mTLS.
9+
If Service Mesh is enabled with Mutual Transport Layer Security (mTLS), metrics for Knative Serving and Knative Eventing are disabled by default, because Service Mesh prevents Prometheus from scraping metrics. You can enable Knative Serving and Knative Eventing metrics when using Service Mesh and mTLS.
1010

1111
.Prerequisites
1212

13-
* You have installed the {ServerlessOperatorName} and Knative Serving on your cluster.
13+
* You have one of the following permissions to access the cluster:
14+
** Cluster administrator permissions on {ocp-product-title}
15+
** Cluster administrator permissions on {rosa-product-title}
16+
** Dedicated administrator permissions on {dedicated-product-title}
17+
* You have installed the OpenShift CLI (`oc`).
18+
* You have access to a project with the appropriate roles and permissions to create applications and other workloads.
19+
* You have installed the {ServerlessOperatorName}, Knative Serving, and Knative Eventing on your cluster.
1420
* You have installed {SMProductName} with the mTLS functionality enabled.
1521
16-
* You have cluster administrator permissions on {ocp-product-title}, or you have cluster or dedicated administrator permissions on {rosa-product-title} or {dedicated-product-title}.
17-
18-
* Install the OpenShift CLI (`oc`).
19-
* You have created a project or have access to a project with the appropriate roles and permissions to create applications and other workloads.
20-
2122
.Procedure
2223

2324
. Specify `prometheus` as the `metrics.backend-destination` in the `observability` spec of the Knative Serving custom resource (CR):
@@ -28,6 +29,7 @@ apiVersion: operator.knative.dev/v1beta1
2829
kind: KnativeServing
2930
metadata:
3031
name: knative-serving
32+
namespace: knative-serving
3133
spec:
3234
config:
3335
observability:
@@ -36,23 +38,26 @@ spec:
3638
----
3739
+
3840
This step prevents metrics from being disabled by default.
41+
+
42+
[NOTE]
43+
====
44+
When you configure `ServiceMeshControlPlane` with `manageNetworkPolicy: false`, you must use the annotation on KnativeEventing to ensure proper event delivery.
45+
====
3946

40-
. Apply the following network policy to allow traffic from the Prometheus namespace:
47+
+
48+
The same mechanism is used for Knative Eventing. To enable metrics for Knative Eventing, you need to specify `prometheus` as the `metrics.backend-destination` in the `observability` spec of the Knative Eventing custom resource (CR) as follows:
4149
+
4250
[source,yaml]
4351
----
44-
apiVersion: networking.k8s.io/v1
45-
kind: NetworkPolicy
52+
apiVersion: operator.knative.dev/v1beta1
53+
kind: KnativeEventing
4654
metadata:
47-
name: allow-from-openshift-monitoring-ns
48-
namespace: knative-serving
55+
name: knative-eventing
56+
namespace: knative-eventing
4957
spec:
50-
ingress:
51-
- from:
52-
- namespaceSelector:
53-
matchLabels:
54-
name: "openshift-monitoring"
55-
podSelector: {}
58+
config:
59+
observability:
60+
metrics.backend-destination: "prometheus"
5661
...
5762
----
5863

0 commit comments

Comments
 (0)