1 .. This work is licensed under a Creative Commons Attribution 4.0
2 .. International License.
3 .. http://creativecommons.org/licenses/by/4.0
4 .. Copyright (C) 2022 Nordix Foundation
7 .. _Prometheus stack README: https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack#readme
8 .. _ONAP Next Generation Security & Logging Structure: https://wiki.onap.org/pages/viewpage.action?pageId=103417456
9 .. _Istio best practices: https://docs.solo.io/gloo-mesh-enterprise/latest/setup/prod/namespaces/
10 .. _Istio setup guide: https://istio.io/latest/docs/setup/install/helm/
11 .. _Kiali setup guide: https://kiali.io/docs/installation/installation-guide/example-install/
12 .. _Kserve setup guide: https://kserve.github.io/website/0.10/admin/kubernetes_deployment/
14 .. _oom_base_optional_addons:
19 The following optional applications can be added to your kubernetes environment.
21 Install Prometheus Stack
22 ************************
24 Prometheus is an open-source systems monitoring and alerting toolkit with
27 Kube Prometheus Stack is a collection of Kubernetes manifests, Grafana
28 dashboards, and Prometheus rules combined with documentation and scripts to
29 provide easy to operate end-to-end Kubernetes cluster monitoring with
30 Prometheus using the Prometheus Operator. As it includes both Prometheus
31 Operator and Grafana dashboards, there is no need to set up them separately.
32 See the `Prometheus stack README`_ for more information.
34 To install the prometheus stack, execute the following:
36 - Add the prometheus-community Helm repository::
38 > helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
40 - Update your local Helm chart repository cache::
44 - To install prometheus, execute the following, replacing the <recommended-pm-version> with the version defined in the :ref:`versions_table` table::
46 > helm install prometheus prometheus-community/kube-prometheus-stack --namespace=prometheus --create-namespace --version=<recommended-pm-version>
52 "ONAP on Service Mesh" is not fully supported in "Kohn". Full support is
53 planned for London release to support the
54 `ONAP Next Generation Security & Logging Structure`_
56 .. figure:: ../../resources/images/servicemesh/ServiceMesh.png
59 ONAP is currenty planned to support Istio as default ServiceMesh platform.
60 Therefor the following instructions describe the setup of Istio and required tools.
61 Used `Istio best practices`_ and `Istio setup guide`_
63 .. _oom_base_optional_addons_istio_installation:
65 Istio Platform Installation
66 ===========================
68 Install Istio Basic Platform
69 ----------------------------
71 - Configure the Helm repository::
73 > helm repo add istio https://istio-release.storage.googleapis.com/charts
77 - Create a namespace for "mesh-level" configurations::
79 > kubectl create namespace istio-config
81 - Create a namespace istio-system for Istio components::
83 > kubectl create namespace istio-system
85 - Install the Istio Base chart which contains cluster-wide resources used by the
86 Istio control plane, replacing the <recommended-istio-version> with the version
87 defined in the :ref:`versions_table` table::
89 > helm upgrade -i istio-base istio/base -n istio-system --version <recommended-istio-version>
91 - Install the Istio Base Istio Discovery chart which deploys the istiod service, replacing the
92 <recommended-istio-version> with the version defined in the :ref:`versions_table` table
93 (enable the variable to enforce the (sidecar) proxy startup before the container start)::
95 > helm upgrade -i istiod istio/istiod -n istio-system --version <recommended-istio-version>
96 --wait --set global.proxy.holdApplicationUntilProxyStarts=true --set meshConfig.rootNamespace=istio-config
98 Add an EnvoyFilter for HTTP header case
99 ---------------------------------------
101 When handling HTTP/1.1, Envoy will normalize the header keys to be all lowercase.
102 While this is compliant with the HTTP/1.1 spec, in practice this can result in issues
103 when migrating existing systems that might rely on specific header casing.
104 In our case a problem was detected in the SDC client implementation, which relies on
105 uppercase header values. To solve this problem in general we add a EnvoyFilter to keep
106 the uppercase header in the istio-config namespace to apply for all namespaces, but
107 set the context to SIDECAR_INBOUND to avoid problems in the connection between Istio-Gateway and Services
109 - Create a EnvoyFilter file (e.g. envoyfilter-case.yaml)
111 .. collapse:: envoyfilter-case.yaml
113 .. include:: ../../resources/yaml/envoyfilter-case.yaml
116 - Apply the change to Istio::
118 > kubectl apply -f envoyfilter-case.yaml
120 Install Istio Gateway
121 ---------------------
123 - Create a namespace istio-ingress for the Istio Ingress gateway
124 and enable istio-injection::
126 > kubectl create namespace istio-ingress
128 > kubectl label namespace istio-ingress istio-injection=enabled
130 - Install the Istio Gateway chart,replacing the
131 <recommended-istio-version> with the version defined in
132 the :ref:`versions_table` table::
134 > helm upgrade -i istio-ingress istio/gateway -n istio-ingress
135 --version <recommended-istio-version> --wait
140 Kiali is used to visualize the Network traffic in a ServiceMesh enabled cluster
141 For setup the kiali operator is used, see `Kiali setup guide`_
143 - Install kiali-operator namespace::
145 > kubectl create namespace kiali-operator
147 > kubectl label namespace kiali-operator istio-injection=enabled
149 - Install the kiali-operator::
151 > helm repo add kiali https://kiali.org/helm-charts
153 > helm repo update kiali
155 > helm install --namespace kiali-operator kiali/kiali-operator
157 - Create Kiali CR file (e.g. kiali.yaml)
159 .. collapse:: kiali.yaml
161 .. include:: ../../resources/yaml/kiali.yaml
166 > kubectl apply -f kiali.yaml
168 - Create Ingress gateway entry for the kiali web interface
169 using the configured Ingress <base-url> (here "simpledemo.onap.org")
170 as described in :ref:`oom_customize_overrides`
172 .. collapse:: kiali-ingress.yaml
174 .. include:: ../../resources/yaml/kiali-ingress.yaml
177 - Add the Ingress entry for Kiali::
179 > kubectl -n istio-system apply -f kiali-ingress.yaml
191 KServe is a standard Model Inference Platform on Kubernetes. It supports RawDeployment mode to enable InferenceService deployment with Kubernetes resources. Comparing to serverless deployment it unlocks Knative limitations such as mounting multiple volumes, on the other hand Scale down and from Zero is not supported in RawDeployment mode.
193 This installation is necessary for the ML models to be deployed as inference service. Once deployed, the inference services can be queried for the prediction.
195 **Kserve participant component in Policy ACM requires this installation. Kserve participant deploy/undeploy inference services in Kserve.**
197 Dependent component version compatibility details and installation instructions can be found at `Kserve setup guide`_
199 Kserve installation requires the following components:
201 - Istio. Its installation instructions can be found at :ref:`oom_base_optional_addons_istio_installation`
203 - Cert-Manager. Its installation instructions can be found at :ref:`oom_base_setup_cert_manager`
205 Installation instructions as follows,
207 - Create kserve namespace::
209 > kubectl create namespace kserve
213 > kubectl apply -f https://github.com/kserve/kserve/releases/download/v<recommended-kserve-version>/kserve.yaml
215 - Install Kserve default serving runtimes::
217 > kubectl apply -f https://github.com/kserve/kserve/releases/download/v<recommended-kserve-version>/kserve-runtimes.yaml
219 - Patch ConfigMap inferenceservice-config as follows::
221 > kubectl patch configmap/inferenceservice-config -n kserve --type=strategic -p '{"data": {"deploy": "{\"defaultDeploymentMode\": \"RawDeployment\"}"}}'