{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Background","type":"text"}]},{"type":"paragraph","content":[{"text":"After the SM PoC (Guilin) we are focussing in deploying SM in Kohn using Istio as SM framework in ONAP.","type":"text"},{"type":"hardBreak"},{"text":"Target picture is described in SECCOM page:","type":"text"},{"type":"hardBreak"},{"text":"ONAP Next Generation Security & Logging Architecture","type":"text","marks":[{"type":"link","attrs":{"href":"https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16472429"}}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start"},"content":[{"type":"media","attrs":{"type":"external","url":"https://wiki.onap.org/download/attachments/103417456/image2022-7-19_9-40-18.png?version=1&modificationDate=1658238020000&api=v2"}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Cluster Preparation","type":"text"}]},{"type":"paragraph","content":[{"text":"During the setup of the K8S Cluster the Istio resources need to be dinstalled.","type":"text"},{"type":"hardBreak"},{"text":"As basis in Kohn we use the following platform versions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"helm_release: v3.8.2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"kubernetes_release: v1.23.8","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"istio_release: 1.17.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cert-Manager: 1.5.4","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Strimzi-Operator: 0.30.0 ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"More information","type":"text"}]},{"type":"paragraph","content":[{"text":"Istio Best Practices:","type":"text"},{"type":"hardBreak"},{"text":"https://docs.solo.io/gloo-mesh-enterprise/latest/setup/prod/namespaces/","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.solo.io/gloo-mesh-enterprise/latest/setup/prod/namespaces/"}}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Install Istio","type":"text"}]},{"type":"paragraph","content":[{"text":"Source: ","type":"text"},{"text":"https://istio.io/latest/docs/setup/install/helm/","type":"text","marks":[{"type":"link","attrs":{"href":"https://istio.io/latest/docs/setup/install/helm/"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Istio basics","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the Helm repository:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm repo add istio https://istio-release.storage.googleapis.com/charts\n$ helm repo update","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a namespace for \"mesh-level\" configurations","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl create namespace istio-config","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a namespace istio-system for Istio components:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl create namespace istio-system","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install the","type":"text"},{"text":" ","type":"text"},{"text":"Istio Base","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"chart which contains cluster-wide resources used by the Istio control plane:","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"$ helm upgrade -i istio-base istio/base -n istio-system --version 1.17.0","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"text":"Install the","type":"text"},{"text":" ","type":"text"},{"text":"Istio Discovery","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"chart which deploys the istiod service:","type":"text"},{"type":"hardBreak"},{"text":"(enable the variable to enforce the (sidecar) proxy startup before the container start)","type":"text"}]},{"type":"paragraph","content":[{"text":"Create a values-override.yaml file to override settings (required for oauth2-proxy):","type":"text"}]},{"type":"codeBlock","content":[{"text":"global:\n proxy:\n # Controls if sidecar is injected at the front of the container list and blocks the start of the other containers until the proxy is ready\n holdApplicationUntilProxyStarts: true\n #logging:\n # level: \"default:debug\"\nmeshConfig:\n rootNamespace: istio-config\n extensionProviders:\n - name: oauth2-proxy\n envoyExtAuthzHttp:\n service: oauth2-proxy.default.svc.cluster.local\n port: 80\n timeout: 1.5s\n includeHeadersInCheck: [\"authorization\", \"cookie\"]\n headersToUpstreamOnAllow: [\"x-forwarded-access-token\", \"authorization\", \"path\", \"x-auth-request-user\", \"x-auth-request-email\", \"x-auth-request-access-token\"]\n headersToDownstreamOnDeny: [\"content-type\", \"set-cookie\"]\npilot:\n env:\n PILOT_ENABLE_MYSQL_FILTER: true\n PILOT_HTTP10: true","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Install Istio Discovery using the override file","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm upgrade -i istiod istio/istiod -n istio-system --version 1.17.0 --wait -f ./values-override.yaml","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add an EnvoyFilter for HTTP header case","type":"text"}]},{"type":"paragraph","content":[{"text":"When handling HTTP/1.1, Envoy will normalize the header keys to be all lowercase. ","type":"text"},{"type":"hardBreak"},{"text":"While this is compliant with the HTTP/1.1 spec, in practice this can result in issues when migrating existing systems that might rely on specific header casing.","type":"text"},{"type":"hardBreak"},{"text":"In our case a problem was detected in the SDC client implementation, thich relies on uppercase header values.","type":"text"},{"type":"hardBreak"},{"text":"To solve this problem in general","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"we add a EnvoyFilter to keep the uppercase header in the istio-config namespace to apply for all namespaces.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"but set the context to SIDECAR_INBOUND and SIDECAR_OUTBOUND to avoid problems in the connection between Istio-Gateway and Services","type":"text"}]}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a EnvoyFilter file (e.g. envoyfilter-case.yaml)","type":"text"}]},{"type":"codeBlock","content":[{"text":"---\napiVersion: networking.istio.io/v1alpha3\nkind: EnvoyFilter\nmetadata:\n name: header-casing-inbound\n namespace: istio-config\n #annotations:\n # argocd.argoproj.io/hook: PostSync\nspec:\n configPatches:\n - applyTo: CLUSTER\n match:\n context: SIDECAR_INBOUND\n patch:\n operation: MERGE\n value:\n typed_extension_protocol_options:\n envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n use_downstream_protocol_config:\n http_protocol_options:\n header_key_format:\n stateful_formatter:\n name: preserve_case\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig\n - applyTo: NETWORK_FILTER\n match:\n listener:\n filterChain:\n filter:\n name: envoy.filters.network.http_connection_manager\n patch:\n operation: MERGE\n value:\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n http_protocol_options:\n header_key_format:\n stateful_formatter:\n name: preserve_case\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig\n---\napiVersion: networking.istio.io/v1alpha3\nkind: EnvoyFilter\nmetadata:\n name: header-casing-outbound\n namespace: istio-config\n #annotations:\n # argocd.argoproj.io/hook: PostSync\nspec:\n configPatches:\n - applyTo: CLUSTER\n match:\n context: SIDECAR_OUTBOUND\n patch:\n operation: MERGE\n value:\n typed_extension_protocol_options:\n envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n use_downstream_protocol_config:\n http_protocol_options:\n header_key_format:\n stateful_formatter:\n name: preserve_case\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig\n - applyTo: NETWORK_FILTER\n match:\n listener:\n filterChain:\n filter:\n name: envoy.filters.network.http_connection_manager\n patch:\n operation: MERGE\n value:\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n http_protocol_options:\n header_key_format:\n stateful_formatter:\n name: preserve_case\n typed_config:\n '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig\n ","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Apply the change to Istio","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl apply -f envoyfilter-case.yaml","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Istio Ingress Gateway","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a namespace istio-ingress for the Istio Ingress gateway and enable istio-injection:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl create namespace istio-ingress\n$ kubectl label namespace istio-ingress istio-injection=enabled","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install the","type":"text"},{"text":" ","type":"text"},{"text":"Istio Gateway","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"chart:","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"$ helm upgrade -i istio-ingress istio/gateway -n istio-ingress --version 1.15.1 --wait ","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"text":"(Addon required for ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Install Jaeger/Kiali","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Kiali Installation","type":"text"}]},{"type":"paragraph","content":[{"text":"see: ","type":"text"},{"text":"https://kiali.io/docs/installation/installation-guide/example-install/","type":"text","marks":[{"type":"link","attrs":{"href":"https://kiali.io/docs/installation/installation-guide/example-install/"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create kiali-operator Namespace","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl create namespace kiali-operator\n$ kubectl label namespace kiali-operator istio-injection=enabled","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install Kiali Operator ","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm repo add kiali https://kiali.org/helm-charts\n$ helm repo update kiali\n$ helm install \\\n --namespace kiali-operator \\\n kiali/kiali-operator","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create Kiali CR file (e.g. kiali.yaml)","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"kiali.yaml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"apiVersion: kiali.io/v1alpha1\nkind: Kiali\nmetadata:\n name: kiali\n namespace: istio-system\n annotations:\n ansible.operator-sdk/verbosity: \"1\"\nspec:\n auth:\n strategy: anonymous\n istio_component_namespaces:\n prometheus: monitoring\n external_services:\n grafana:\n in_cluster_url: http://prometheus-stack-grafana.monitoring\n prometheus:\n url: http://prometheus-stack-kube-prom-prometheus.monitoring:9090\n tracing:\n in_cluster_url: http://istio-query.observability:16686\n deployment:\n accessible_namespaces: [\"**\"]\n view_only_mode: false\n server:\n web_root: \"/kiali\"","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install Kiali","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"$ kubectl apply -f kiali.yaml","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create Ingress gateway entry for the Kiali web interface","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"kiali-Ingress.yaml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"apiVersion: networking.istio.io/v1beta1\nkind: Gateway\nmetadata:\n name: kiali-gateway\nspec:\n selector:\n istio: ingress\n servers:\n - hosts:\n - kiali.simpledemo.onap.org\n port:\n name: http\n number: 80\n protocol: HTTP\n---\napiVersion: networking.istio.io/v1beta1\nkind: VirtualService\nmetadata:\n name: kiali-service\nspec:\n hosts:\n - kiali.simpledemo.onap.org\n gateways:\n - kiali-gateway\n http:\n - route:\n - destination:\n port:\n number: 20001\n host: kiali","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the Ingress entry for Kiali","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl -n istio-system apply -f kiali-ingress.yaml","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Configure ONAP charts","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Global settings","type":"text"}]},{"type":"paragraph","content":[{"text":"Global values used for ServiceMesh and Ingress setup can be found in","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://git.onap.org/oom/tree/kubernetes/onap/values.yaml","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.onap.org/oom/tree/kubernetes/onap/values.yaml"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://git.onap.org/oom/tree/kubernetes/onap/resources/overrides/onap-all-ingress-istio.yaml","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.onap.org/oom/tree/kubernetes/onap/resources/overrides/onap-all-ingress-istio.yaml"}}]}]}]}]},{"type":"paragraph","content":[{"text":"The following variable settings are used for enabling ServiceMesh as well as Istio Ingress:","type":"text"}]},{"type":"codeBlock","content":[{"text":"#ingress virtualhost based configuration\nglobal:\n ingress:\n enabled: true\n virtualhost:\n baseurl: \"simpledemo.onap.org\"\n # All http requests via ingress will be redirected\n config:\n ssl: \"redirect\"\n # you can set an own Secret containing a certificate\n # tls:\n # secret: 'my-ingress-cert'\n # optional: Namespace of the Istio IngressGateway\n namespace: istio-ingress\n...\n serviceMesh:\n enabled: true\n tls: true\n # be aware that linkerd is not well tested\n engine: \"istio\" # valid value: istio or linkerd\n aafEnabled: false\n cmpv2Enabled: false\n tlsEnabled: false\n msbEnabled: false","type":"text"}]},{"type":"paragraph","content":[{"text":"ServiceMesh settings:","type":"text","marks":[{"type":"underline"},{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"enabled: true","type":"text","marks":[{"type":"strong"}]},{"text":" → enables ServiceMesh functionality in the ONAP Namespace (Istio: enables Sidecar deployment)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"tls: true","type":"text","marks":[{"type":"strong"}]},{"text":" → enables mTLS encryption in Sidecar communication","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"engine: istio","type":"text","marks":[{"type":"strong"}]},{"text":" → sets the SM engine (currently only Istio is supported)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"aafEnabled: false","type":"text","marks":[{"type":"strong"}]},{"text":" → disables AAF usage for TLS interfaces","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"tlsEnabled: false","type":"text","marks":[{"type":"strong"}]},{"text":" → disables creation of TLS in component services","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"cmpv2Enabled: false","type":"text","marks":[{"type":"strong"}]},{"text":" → disable cmpv2 feature","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"msbEnabled: false","type":"text","marks":[{"type":"strong"}]},{"text":" → MSB is not used in Istio setup (Open, if all components are MSB independend) ","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Ingress settings:","type":"text","marks":[{"type":"underline"},{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"enabled: true","type":"text","marks":[{"type":"strong"}]},{"text":" → enables Ingress using: Nginx (when SM disabled), Istio IngressGateway (when SM enabled) ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"virtualhost.baseurl: \"simpledemo.onap.org\"","type":"text","marks":[{"type":"strong"}]},{"text":" → sets globally the URL for all Interfaces set by the components, resulting in e.g. \"aai-api.simpledemo.onap.org\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"config.ssl: redirect","type":"text","marks":[{"type":"strong"}]},{"text":" → sets in the Ingress globally the redirection of all Interfaces from http (port 80) to https (port 443)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"config.tls.secret: \"...\"","type":"text","marks":[{"type":"strong"}]},{"text":" → (optional) overrides the default selfsigned SSL certificate with a certificate stored in the specified secret","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"namespace: istio-ingress","type":"text","marks":[{"type":"strong"}]},{"text":" → (optional) overrides the namespace of the ingress gateway which is used for the created SSL certificate","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Install ONAP","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Clone OOM repository from ONAP","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ git clone -b http://gerrit.onap.org/r/oom --recurse-submodules","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an ServiceMesh override file (here ~/onap-overides.yaml) with the following example content (including a workarround for DMAAP AAF issue)","type":"text"},{"type":"hardBreak"},{"text":"The Ingress configuration can be found in ~/oom/kubernetes/onap/resources/overrides/onap-all-ingress-istio.yaml","type":"text"}]},{"type":"codeBlock","content":[{"text":"---\nglobal:\n serviceMesh:\n enabled: true\n tls: true\n aafEnabled: false\n tlsEnabled: false\n msbEnabled: false\n\naaf:\n # workarround for DMAAP SM issue\n enabled: true\n global:\n aafEnabled: true\ndmaap:\n # workarround for DMAAP SM issue\n global:\n aafEnabled: true","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install Helm Plugins","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm plugin install --version v0.10.2 https://github.com/chartmuseum/helm-push.git\n$ helm plugin install /opt/oom/kubernetes/helm/plugins/deploy\n$ helm plugin install /opt/oom/kubernetes/helm/plugins/undeploy","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install ChartMuseum as Helm Registry, start it and add local repository","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ curl -LO https://s3.amazonaws.com/chartmuseum/release/latest/bin/linux/amd64/chartmuseum\n$ chmod +x ./chartmuseum\n$ mv ./chartmuseum /usr/local/bin\n$ chartmuseum --storage local --storage-local-rootdir ~/helm3-storage -port 8879 &\n$ helm repo add local http://127.0.0.1:8879","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Compile ONAP helm charts (here with 4 parallel threads)","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ cd ~/oom\n$ make all -j4","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create ONAP namespace and label it for Istio sidecar injection:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ kubectl create namespace onap\n$ kubectl label namespace onap istio-injection=enabled --overwrite=true","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Deploy ONAP:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm deploy onap local/onap --namespace onap --version 11.0.0 --values ~/oom/kubernetes/onap/resources/overrides/onap-all-ingress-istio.yaml --values ~/oom/kubernetes/onap/resources/overrides/environment.yaml --values ~/onap-overrides.yaml --timeout '900s'","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Re-deploy or upgrade a single components (here platform)","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ helm upgrade -i onap-platform local/platform --namespace onap --version 11.0.0 --values ~/oom/kubernetes/onap/values.yaml --values ~/oom/kubernetes/onap/resources/overrides/onap-all-ingress-istio.yaml --values ~/oom/kubernetes/onap/resources/overrides/environment.yaml --values ~/onap-overrides.yaml --timeout '900s'","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Access ONAP APIs/UIs","type":"text"}]},{"type":"paragraph","content":[{"text":"In the ServiceMesh deployment the Istio IngressGateway is the only accesspoint for ONAP component interfaces.","type":"text"},{"type":"hardBreak"},{"text":"Usually the Ingress is accessed via a LoadBalancer IP (, which is used as central address.","type":"text"},{"type":"hardBreak"},{"text":"All APIs/UIs are provided via separate URLs which are routed to the component service.","type":"text"},{"type":"hardBreak"},{"text":"To use these URLs they need to be resolvable via DNS or via /etc/hosts, here is the example:","type":"text"}]},{"type":"codeBlock","content":[{"text":" kiali.simpledemo.onap.org\n aaf-cm-api.simpledemo.onap.org\n aaf-fs-api.simpledemo.onap.org\n aaf-locate-api.simpledemo.onap.org\n aaf-oauth-api.simpledemo.onap.org\n aaf-service-api.simpledemo.onap.org\n aaf-ui.simpledemo.onap.org\n aai-api.simpledemo.onap.org\n aai-babel-api.simpledemo.onap.org\n aai-sparkybe-api.simpledemo.onap.org\n appc-dgbuilder.simpledemo.onap.org\n appc-api.simpledemo.onap.org\n cds-blueprintsprocessor-api.simpledemo.onap.org\n cds-ui.simpledemo.onap.org\n cli-api.simpledemo.onap.org\n cli2-api.simpledemo.onap.org\n consul-api.simpledemo.onap.org\n cps-core-api.simpledemo.onap.org\n cps-ncmp-dmi-plugin-api.simpledemo.onap.org\n cps-temporal-api.simpledemo.onap.org\n dcaemod-distributor-api.simpledemo.onap.org\n dcaemod-genprocessor-api.simpledemo.onap.org\n dcaemod-nifi-ui.simpledemo.onap.org\n dcaemod-nifi-api.simpledemo.onap.org\n dcaemod-onboarding-api.simpledemo.onap.org\n dmaap-bc-api.simpledemo.onap.org\n dmaap-dr-node-api.simpledemo.onap.org\n dmaap-dr-prov-api.simpledemo.onap.org\n dmaap-mr-api.simpledemo.onap.org\n keycloak-ui.simpledemo.onap.org\n log-es-api.simpledemo.onap.org\n log-kibana-ui.simpledemo.onap.org\n log-ls-api.simpledemo.onap.org\n log-ls-http-api.simpledemo.onap.org\n msb-consul-api.simpledemo.onap.org\n msb-discovery-api.simpledemo.onap.org\n msb-eag-ui.simpledemo.onap.org\n msb-iag-ui.simpledemo.onap.org\n nbi-api.simpledemo.onap.org\n oof-has-api.simpledemo.onap.org\n oof-osdf-api.simpledemo.onap.org\n policy-ui.simpledemo.onap.org\n robot-api.simpledemo.onap.org\n sdc-be-api.simpledemo.onap.org","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}