diff --git a/install/ossm-cert-manager.adoc b/install/ossm-cert-manager.adoc index 28793bc0969..b6829af47d6 100644 --- a/install/ossm-cert-manager.adoc +++ b/install/ossm-cert-manager.adoc @@ -1,6 +1,6 @@ :_mod-docs-content-type: ASSEMBLY [id="ossm-cert-manager"] -= Configure automated certificate lifecycle management += Automate certificate lifecycle management include::_attributes/common-attributes.adoc[] :context: ossm-cert-manager diff --git a/install/ossm-enabling-mtls.adoc b/install/ossm-enabling-mtls.adoc index 6ac76ae9fbd..f091a5d97ce 100644 --- a/install/ossm-enabling-mtls.adoc +++ b/install/ossm-enabling-mtls.adoc @@ -8,7 +8,11 @@ toc::[] [role="_abstract"] -You can use {SMProductName} for your application to customize the communication security between the complex array of microservices. Mutual Transport Layer Security (mTLS) is a protocol that enables two parties to authenticate each other. +Encrypting mesh communication requires configuring Transport Layer Security (TLS) in two distinct areas: + +* Mutual TLS (mTLS) encrypts and authenticates traffic between services inside the mesh. By default, the mesh automatically uses mTLS for service-to-service communication (Auto mTLS), but services accept both encrypted and plain text connections (PERMISSIVE mode). To enforce encryption and reject plain text traffic, you must enable STRICT mTLS mode. + +* TLS for gateways encrypts traffic entering and leaving the mesh at ingress and egress gateways. You must configure gateway TLS separately from mTLS because gateways operate at the mesh boundary, not between mesh services. include::modules/ossm-about-mtls.adoc[leveloffset=+1] @@ -17,13 +21,3 @@ include::modules/ossm-enabling-strict-mtls-namespace.adoc[leveloffset=+1] include::modules/ossm-enabling-strict-mtls-whole-service-mesh.adoc[leveloffset=+1] include::modules/ossm-validating-encryptions-with-kiali.adoc[leveloffset=+1] - -[role="_additional-resources"] -[id="additional-resources_{context}"] -== Additional resources - -* link:https://istio.io/latest/docs/tasks/security/tls-configuration/workload-min-tls-version/[Istio workload minimum TLS version configuration (Istio documentation)] - -* link:https://istio.io/latest/docs/ops/configuration/traffic-management/tls-configuration/[Understanding TLS configuration (Istio documentation)] - -* link:https://istio.io/latest/docs/concepts/security/#permissive-mode[Permissive mode (Istio documentation)] \ No newline at end of file diff --git a/install/ossm-supported-platforms-configurations.adoc b/install/ossm-supported-platforms-configurations.adoc index 13e8c34b2fd..6abe2058dc6 100644 --- a/install/ossm-supported-platforms-configurations.adoc +++ b/install/ossm-supported-platforms-configurations.adoc @@ -1,6 +1,6 @@ :_mod-docs-content-type: ASSEMBLY [id="ossm-supported-platforms-configurations"] -= Check platform prerequisites += Evaluate platform compatibility include::_attributes/common-attributes.adoc[] :context: ossm-supported-platforms-configurations @@ -10,18 +10,6 @@ toc::[] Before you install {SMProductName}, verify that your environment meets the platform, configuration, and network requirements. -Confirming compatibility early prevents installation failures and ensures that all {SMProductShortName} components operate as expected in your cluster. - -Verify the following areas before installing {SMProductShortName}: - -Supported platforms:: Your {ocp-product-title} version and managed platform type are compatible with {SMProductShortName}. - -Supported configurations:: Your cluster architecture and deployment topology meet {SMProductShortName} requirements. - -Supported network configurations:: Your cluster's Container Network Interface (CNI) plugin is validated for {SMProductShortName}. - -Supported Kiali configurations:: Your web browser and authentication strategy are compatible with the Kiali console. - include::modules/ossm-supported-platforms.adoc[leveloffset=+1] include::modules/ossm-supported-configurations-sm.adoc[leveloffset=+1] @@ -29,31 +17,3 @@ include::modules/ossm-supported-configurations-sm.adoc[leveloffset=+1] include::modules/ossm-supported-configurations-networks.adoc[leveloffset=+1] include::modules/ossm-supported-configurations-kiali.adoc[leveloffset=+1] - -[role="_additional-resources"] -[id="additional-resources_{context}"] -== Additional resources - -* link:https://access.redhat.com/support/policy/updates/openshift_operators[OpenShift Operator Life Cycles] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installation_overview/ocp-installation-overview#installation-overview_ocp-installation-overview[About {product-title} installation] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_aws/installing-methods-aws[Installing {product-title} on AWS] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_aws/user-provisioned-infrastructure[Installing {product-title} on AWS with user-provisioned infrastructure] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_bare_metal/preparing-to-install-on-bare-metal[Installing {product-title} on bare metal] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_vmware_vsphere/preparing-to-install-on-vsphere[Installing {product-title} on vSphere] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_ibm_z_and_ibm_linuxone/preparing-to-install-on-ibm-z[Installing {product-title} on {ibm-z-title}® and IBM® LinuxONE] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installing_on_ibm_power/preparing-to-install-on-ibm-power[Installing {product-title} on {ibm-power-title}®] - -* link:https://docs.redhat.com/en/documentation/openshift_dedicated/latest/html/networking/ovn-kubernetes-network-plugin#about-ovn-kubernetes[About the OVN-Kubernetes network plugin] - -* link:https://access.redhat.com/articles/5436171[Certified OpenShift CNI plugins] - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/installation_overview/installing-preparing#supported-installation-methods-for-different-platforms[Restricted network] - -* link:https://access.redhat.com/support/policy/updates/openshift_operators[Support Policy] \ No newline at end of file diff --git a/modules/ossm-about-SPIRE.adoc b/modules/ossm-about-SPIRE.adoc new file mode 100644 index 00000000000..818db9d73fa --- /dev/null +++ b/modules/ossm-about-SPIRE.adoc @@ -0,0 +1,39 @@ +// Module included in the following assemblies: +// +// * install/ossm-SPIRE.adoc + +:_mod-docs-content-type: CONCEPT +[id="ossm-about-SPIRE_{context}"] += SPIRE for workload identity management + +[role="_abstract"] +The SPIFFE Runtime Environment (SPIRE), supported by the OpenShift Zero Trust Workload Identity Manager, provides attested workload identity for your service mesh. + +include::snippets/technology-preview-SPIRE.adoc[] + +You can deploy SPIRE as a standalone solution or integrate it with cert-manager. When used together, cert-manager acts as the root Certificate Authority (CA), automatically issuing intermediate signing certificates to SPIRE, while SPIRE handles workload identity for mesh communication. + +[id="about-spire-and-spiffe_{context}"] +== About SPIRE and SPIFFE + +SPIRE implements the Secure Production Identity Framework for Everyone (SPIFFE) open standards. It issues short-lived cryptographic credentials, called SPIFFE Verifiable Identity Documents (SVIDs), to workloads and service mesh components. The architecture uses a central server and node agents to integrate with the {SMProduct} data plane through a local UNIX domain socket API. + +Before issuing an SVID, SPIRE enforces rigorous verification. Node attestation verifies the underlying host platform, while workload attestation inspects runtime attributes such as pod namespaces and service accounts. This process ensures cryptographically verified identities and strong workload authentication before any communication across the mesh begins. + +[id="benefits-of-spire_{context}"] +== Benefits of SPIRE + +SPIRE provides the following key benefits: + +* Zero-trust architecture: Every workload interaction requires cryptographic verification based on attested identity, with no implicit trust zones. + +* Cross-platform authentication: Uses SPIFFE identities for workload authentication across clouds, virtual machines, and bare-metal environments. + +* Network-independent security: Authentication does not depend on network boundaries, IP addresses, or firewall rules. + +* Automatic credential management: Automatically issues and rotates credentials for workloads, eliminating embedded passwords, API keys, and certificates. + +[IMPORTANT] +==== +Currently, only single-cluster sidecar deployments of {SMProduct} integrate with SPIRE. +==== diff --git a/modules/ossm-about-cert-manager.adoc b/modules/ossm-about-cert-manager.adoc index fd31332efe1..9b0822da542 100644 --- a/modules/ossm-about-cert-manager.adoc +++ b/modules/ossm-about-cert-manager.adoc @@ -4,14 +4,8 @@ :_mod-docs-content-type: CONCEPT [id="ossm-cert-manager-integration-istio_{context}"] -= The cert-manager Operator += Cert-manager Operator overview [role="_abstract"] The {cert-manager-operator} manages the `istio-csr` agent, which handles certificate signing requests from mesh proxies. You must install the Operator and deploy the agent before you create your `{istio}` resource. For Operator installation instructions, see the {ocp-product-title} documentation. - -[role="_additional-resources"] -[id="additional-resources_{context}"] -== Additional resources - -* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift#cert-manager-operator-install[Installing the {cert-manager-operator}] diff --git a/modules/ossm-about-configuring-a-gateway-to-accept-ingress-traffic.adoc b/modules/ossm-about-configuring-a-gateway-to-accept-ingress-traffic.adoc index 4bd6ab846f3..2c772e9714c 100644 --- a/modules/ossm-about-configuring-a-gateway-to-accept-ingress-traffic.adoc +++ b/modules/ossm-about-configuring-a-gateway-to-accept-ingress-traffic.adoc @@ -8,7 +8,7 @@ [role="_abstract"] -{SMProductName} offers two approaches to configure ingress traffic routing to services in the mesh. The approach depends on the service mesh deployment mode and traffic management requirements. +Routing ingress traffic to mesh services requires two steps: configuring routing rules and exposing the gateway proxy to external clients. {SMProductName} offers two approaches for configuring routing rules, depending on your deployment mode and traffic management requirements. Ingress routing with gateway injection and {istio} APIs:: When you install a gateway by using gateway injection, you can configure it to receive ingress traffic by using the {istio} `Gateway` and `VirtualService` resources in combination. @@ -23,5 +23,5 @@ While {istio} `Gateway` and `VirtualService` resources support certain ingress u [NOTE] ==== -After configuring ingress routing with one of these approaches, you must expose the gateway to external traffic using either a LoadBalancer service or an {ocp-short-name} route. +After configuring ingress routing with one of these approaches, you must expose the gateway to external traffic using either a LoadBalancer service or an {ocp-short-name} route. This gives external clients access to mesh services. ==== diff --git a/modules/ossm-about-exposing-services-to-traffic-outside-a-cluster.adoc b/modules/ossm-about-exposing-services-to-traffic-outside-a-cluster.adoc index 59d1c81f87f..ebdb7527b47 100644 --- a/modules/ossm-about-exposing-services-to-traffic-outside-a-cluster.adoc +++ b/modules/ossm-about-exposing-services-to-traffic-outside-a-cluster.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-about-exposing-services-to-traffic-outside-a-cluster_{context}"] -= About exposing services to traffic outside a cluster += External access to mesh services [role="_abstract"] diff --git a/modules/ossm-about-ingress-routing-ambient-mode.adoc b/modules/ossm-about-ingress-routing-ambient-mode.adoc index e647551fcf5..c68b0fca2f2 100644 --- a/modules/ossm-about-ingress-routing-ambient-mode.adoc +++ b/modules/ossm-about-ingress-routing-ambient-mode.adoc @@ -4,11 +4,11 @@ :_mod-docs-content-type: CONCEPT [id="ossm-about-ingress-routing-ambient-mode_{context}"] -= About ingress traffic routing approaches in ambient mode += Ambient mode ingress routing [role="_abstract"] -When using the {istio} ambient mode, you can use the {k8s} Gateway API to configure ingress traffic routing. +In the {istio} ambient mode, use the {k8s} Gateway API to configure ingress traffic routing. Waypoint proxies for Layer 7 routing:: You can deploy a waypoint proxy in the namespace that has your service to apply Layer 7 (L7) routing policies, such as path-based routing or header matching. In ambient mode, waypoint proxies process L7 traffic and enforce `HTTPRoute` and `GRPCRoute` rules. diff --git a/modules/ossm-about-mtls.adoc b/modules/ossm-about-mtls.adoc index 0695454adcd..330af3a9590 100644 --- a/modules/ossm-about-mtls.adoc +++ b/modules/ossm-about-mtls.adoc @@ -4,16 +4,29 @@ :_mod-docs-content-type: CONCEPT [id="ossm-about-mtls_{context}"] -= Mutual TLS in {SMProductName} += Authenticate services with mutual TLS [role="_abstract"] +Mutual TLS (mTLS) authentication operates differently depending on your mesh deployment mode. -Review the following `{istio}` resources and concepts to configure mTLS settings properly: +[id="ossm-about-mtls-sidecar_{context}"] +== Mutual TLS in sidecar mode -`PeerAuthentication`:: defines the type of mTLS traffic a sidecar accepts. `PERMISSIVE` mode allows both plain text and mTLS traffic. `STRICT` mode requires mTLS for all incoming traffic.. +In sidecar mode, mTLS settings operate between sidecar proxies without application code changes: -`DestinationRule`:: configures the type of TLS traffic a sidecar sends. In `DISABLE` mode, the sidecar sends plain text. In `SIMPLE`, `MUTUAL`, and `ISTIO_MUTUAL` modes, the sidecar establishes a TLS connection. +`PeerAuthentication`:: Controls incoming traffic rules. By default, `PERMISSIVE` mode accepts both plain text and mTLS traffic. `STRICT` mode rejects plain text and requires mTLS for all incoming requests. -`Auto mTLS`:: ensures the mesh uses mTLS by default to encrypt all inter-mesh traffic, regardless of the `PeerAuthentication` mode configuration. The `enableAutoMtls` global mesh configuration field controls `Auto mTLS`, which {SMProduct} 2 and 3 enable by default. The mTLS setting operates entirely between sidecar proxies, requiring no changes to application or service code. +`DestinationRule`:: Controls outgoing traffic rules. In `DISABLE` mode, the sidecar sends plain text. In `SIMPLE`, `MUTUAL`, and `ISTIO_MUTUAL` modes, the sidecar initiates a TLS connection. -By default, `PeerAuthentication` uses `PERMISSIVE` mode, allowing sidecars in the {SMProductShortName} to accept both plain text and mTLS-encrypted traffic. \ No newline at end of file +`Auto mTLS`:: Enabled by default in {SMProduct} 2 and 3. Automatically uses mTLS for inter-mesh traffic whenever a destination pod has a sidecar proxy, falling back to plain text for non-mesh targets. + +[id="ossm-about-mtls-ambient_{context}"] +== Mutual TLS in ambient mode + +In ambient mode, mTLS operates transparently at the infrastructure level by using `ztunnel` node agents and optional waypoint proxies: + +Automatic L4 encryption:: Traffic between workloads enrolled in ambient mode is automatically encrypted at Layer 4 using mTLS. + +`PeerAuthentication` enforcement:: By default, ambient mode uses `PERMISSIVE` mode, allowing ambient workloads to encrypt inter-mesh traffic while still accepting plain text from non-ambient sources. Applying a `PeerAuthentication` policy with `mode: STRICT` causes the `ztunnel` agent to enforce mTLS and reject plain text requests before they reach your application. + +Waypoint proxy scope:: Waypoint proxies handle Layer 7 (L7) application policies and routing. They receive connections that have already been authenticated by `ztunnel` at Layer 4. \ No newline at end of file diff --git a/modules/ossm-configure-attested-workload-identity.adoc b/modules/ossm-configure-attested-workload-identity.adoc index a207b294926..682c77d6418 100644 --- a/modules/ossm-configure-attested-workload-identity.adoc +++ b/modules/ossm-configure-attested-workload-identity.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-configure-attested-workload-identity_{context}"] -= Configure attested workload identity += Verify workload identity with cryptographic proof [role="_abstract"] diff --git a/modules/ossm-configure-authorization-policies.adoc b/modules/ossm-configure-authorization-policies.adoc index eecd190fb76..bec73457ef3 100644 --- a/modules/ossm-configure-authorization-policies.adoc +++ b/modules/ossm-configure-authorization-policies.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-configure-authorization-policies_{context}"] -= Configure service authorization policies += Control service access with authorization policies [role="_abstract"] diff --git a/modules/ossm-customize-mesh-topology.adoc b/modules/ossm-customize-mesh-topology.adoc new file mode 100644 index 00000000000..19ba3264c13 --- /dev/null +++ b/modules/ossm-customize-mesh-topology.adoc @@ -0,0 +1,20 @@ +// Module included in the following assemblies: +// +// TBD + +:_mod-docs-content-type: CONCEPT +[id="ossm-customize-mesh-topology_{context}"] += Customize your mesh topology + +[role="_abstract"] +As your service mesh requirements evolve, you might need to adapt your deployment topology to support specific operational, security, or architectural goals. Customizing your mesh topology helps you align the mesh infrastructure with constraints such as geographic distribution, team boundaries, security posture, or availability requirements. + +The default single-cluster, single-control-plane topology works well for many deployments. However, certain scenarios might benefit from topology customization: + +Multi-cluster mesh:: When services need to communicate across clusters, extending your mesh across multiple clusters can provide cross-cluster service discovery, load balancing, and failover capabilities. This approach might suit scenarios where you need geographic distribution, fault isolation across clusters, or hybrid cloud architectures. + +Multiple independent meshes on one cluster:: When teams or applications share a cluster but require strict isolation, deploying multiple independent meshes with separate control planes can enforce boundaries between workloads. This approach might suit scenarios where you need tenant isolation, separate security policies, or independent lifecycle management for different application groups. + +External control plane:: When security requirements call for separating management infrastructure from application workloads, hosting the control plane on a separate cluster can reduce the attack surface on your application cluster. This approach might suit scenarios where you need to meet compliance requirements, minimize control plane resource contention with workloads, or centralize mesh management across multiple data plane clusters. + +Each topology customization introduces additional operational complexity and resource requirements. Consider your current and anticipated needs (such as failover requirements, team autonomy, security boundaries, and operational capacity) when evaluating whether to customize your topology. diff --git a/modules/ossm-enable-pqc.adoc b/modules/ossm-enable-pqc.adoc index 6ff9af47692..415272a5ae8 100644 --- a/modules/ossm-enable-pqc.adoc +++ b/modules/ossm-enable-pqc.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-enable-pqc_{context}"] -= Configure post-quantum cryptography (PQC) += Protect against quantum computing threats [role="_abstract"] diff --git a/modules/ossm-enabling-strict-mtls-namespace.adoc b/modules/ossm-enabling-strict-mtls-namespace.adoc index 88999df23de..d59cc7f118a 100644 --- a/modules/ossm-enabling-strict-mtls-namespace.adoc +++ b/modules/ossm-enabling-strict-mtls-namespace.adoc @@ -5,7 +5,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-enabling-strict-mtls-namespace_{context}"] -= Enabling strict mTLS mode by using the namespace += Enable strict mTLS for a namespace in sidecar mode [role="_abstract"] diff --git a/modules/ossm-enabling-strict-mtls-whole-service-mesh.adoc b/modules/ossm-enabling-strict-mtls-whole-service-mesh.adoc index dc7fd0ea403..3220591b490 100644 --- a/modules/ossm-enabling-strict-mtls-whole-service-mesh.adoc +++ b/modules/ossm-enabling-strict-mtls-whole-service-mesh.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-enabling-strict-mtls-whole-service-mesh_{context}"] -= Enabling strict mTLS across the whole service mesh += Enable strict mTLS mesh-wide in sidecar mode [role="_abstract"] diff --git a/modules/ossm-release-notes-consoles-and-dashboards.adoc b/modules/ossm-release-notes-consoles-and-dashboards.adoc index afa35e5fe5a..9ec136c9469 100644 --- a/modules/ossm-release-notes-consoles-and-dashboards.adoc +++ b/modules/ossm-release-notes-consoles-and-dashboards.adoc @@ -7,6 +7,7 @@ = Consoles and dashboards [role="_abstract"] +Console and dashboard tools provide visualization and management capabilities for monitoring and configuring your service mesh. [cols="1,1"] |=== diff --git a/modules/ossm-release-notes-definitions.adoc b/modules/ossm-release-notes-definitions.adoc index 14481d81202..5ffde697351 100644 --- a/modules/ossm-release-notes-definitions.adoc +++ b/modules/ossm-release-notes-definitions.adoc @@ -4,14 +4,13 @@ :_mod-docs-content-type: REFERENCE [id="release-notes-definitions_{context}"] -= Release notes definitions += Support level definitions [role="_abstract"] +For {SMProductName} {SMProductVersion}, features that are Generally Available (GA) are fully supported and are suitable for production use. -For {SMProductName} 3, features that are Generally Available (GA) are fully supported and are suitable for production use. +Technology Preview (TP) features are not supported with Red{nbsp}Hat production service level agreements (SLAs) and might not be functionally complete. Red{nbsp}Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and give feedback during the development process. See the link:https://access.redhat.com/support/offerings/techpreview[Technology Preview scope of support on the Red{nbsp}Hat Customer Portal] for more information about Technology Preview features. -Technology Preview (TP) features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. See the link:https://access.redhat.com/support/offerings/techpreview[Technology Preview scope of support on the Red Hat Customer Portal] for more information about Technology Preview features. +Developer Preview (DP) features are not supported by Red{nbsp}Hat in any way and are not functionally complete or production-ready. Do not use Developer Preview features for production or business-critical workloads. Developer Preview features provide early access to upcoming product features in advance of their possible inclusion in a Red{nbsp}Hat product offering, enabling customers to test functionality and give feedback during the development process. These features might not have any documentation, are subject to change or removal at any time, and testing is limited. Red{nbsp}Hat might provide ways to submit feedback on Developer Preview features without an associated SLA. -Developer Preview (DP) features are not supported by Red Hat in any way and are not functionally complete or production-ready. Do not use Developer Preview features for production or business-critical workloads. Developer Preview features provide early access to upcoming product features in advance of their possible inclusion in a Red Hat product offering, enabling customers to test functionality and provide feedback during the development process. These features might not have any documentation, are subject to change or removal at any time, and testing is limited. Red Hat might provide ways to submit feedback on Developer Preview features without an associated SLA. - -Not available (NA) features might not be available with {SMProductName} 3. \ No newline at end of file +Not available (NA) features might not be available with {SMProductName} {SMProductVersion}. \ No newline at end of file diff --git a/modules/ossm-release-notes-extensibility-features.adoc b/modules/ossm-release-notes-extensibility-features.adoc index 161dde2f343..ad4d88b5f7e 100644 --- a/modules/ossm-release-notes-extensibility-features.adoc +++ b/modules/ossm-release-notes-extensibility-features.adoc @@ -7,6 +7,7 @@ = Extensibility features [role="_abstract"] +Extensibility features allow you to customize and extend Istio proxy behavior. [cols="1,1"] |=== @@ -15,10 +16,16 @@ | WebAssembly extension | GA ^[1]^ -| `EnvoyFilter` API +| EnvoyFilter API | DP ^[2]^ + +| TrafficExtension API +| TP ^[3]^ + |=== -. The `WasmPlugin` API for extending Istio using Web Assembly extensions is supported, but support is not provided for any Web Assembly extension modules unless explicitly documented. +. The WasmPlugin API for extending Istio with WebAssembly extensions is supported, but support is not provided for any Web Assembly extension modules unless explicitly documented. + +. The EnvoyFilter API is available for use with {SMProductName}, but is not supported, except where explicitly documented. Due to tight coupling with the underlying Envoy APIs, backward compatibility cannot be maintained. Note that EnvoyFilter patches are very sensitive to the format of the Envoy configuration that is generated by Istio. If the configuration generated by Istio changes, it has the potential to break the application of the EnvoyFilter configuration. Any configuration provided through this API should be carefully monitored across Istio proxy version upgrades to ensure that deprecated fields are removed and replaced appropriately. If a support case is raised where an EnvoyFilter configuration is used, Red Hat might request that the issue be reproduced with the EnvoyFilter configuration removed. -. The `EnvoyFilter` API is available for use with {SMProductName}, but is not supported, except where explicitly documented. Due to tight coupling with the underlying Envoy APIs, backward compatibility cannot be maintained. Note that `EnvoyFilter` patches are very sensitive to the format of the Envoy configuration that is generated by Istio. If the configuration generated by Istio changes, it has the potential to break the application of the `EnvoyFilter` configuration. Any configuration provided through this API should be carefully monitored across Istio proxy version upgrades to ensure that deprecated fields are removed and replaced appropriately. If a support case is raised where an `EnvoyFilter` configuration is used, Red Hat might request that the issue be reproduced with the `EnvoyFilter` configuration removed. \ No newline at end of file +. Red{nbsp}Hat does not debug or provide other support for plugins and scripts configured through the TrafficExtension API. \ No newline at end of file diff --git a/modules/ossm-release-notes-istio-ambient-mode.adoc b/modules/ossm-release-notes-istio-ambient-mode.adoc index 194b52be422..3b7744d3acd 100644 --- a/modules/ossm-release-notes-istio-ambient-mode.adoc +++ b/modules/ossm-release-notes-istio-ambient-mode.adoc @@ -7,6 +7,7 @@ = Istio Ambient mode (sidecarless) data plane [role="_abstract"] +Ambient mode features include core ztunnel and waypoint capabilities, traffic management, security, multicluster support, and upgrade strategies. [cols="1,1"] |=== @@ -46,10 +47,13 @@ | TP | Mixing sidecar and ambient namespaces within a single mesh -| DP +| GA ^†^ | Deploying ambient mode on a cluster with an existing sidecar mesh -| NA +| GA ^†^ + +| Migrating workloads from sidecar mode to ambient mode +| GA ^†^ | Multiple “ambient mode” meshes in a single cluster | NA @@ -66,4 +70,9 @@ | Upgrades: RevisionBased | NA +| Virtual Machine workload integration +| NA + |=== + +† These features are supported with the exception of limitations noted in their respective documentation. \ No newline at end of file diff --git a/modules/ossm-release-notes-istio-deployment-lifecycle.adoc b/modules/ossm-release-notes-istio-deployment-lifecycle.adoc index a4b6d5d2334..c50d1f1935b 100644 --- a/modules/ossm-release-notes-istio-deployment-lifecycle.adoc +++ b/modules/ossm-release-notes-istio-deployment-lifecycle.adoc @@ -8,6 +8,7 @@ = Istio deployment and lifecycle [role="_abstract"] +Istio deployment and lifecycle features include installation, upgrades, multicluster configurations, and networking capabilities for {SMProduct} {SMProductVersion}. [cols="1,1"] |=== @@ -52,13 +53,16 @@ | ProxyConfig | GA ^[3]^ -|Native `nftables` support -|GA ^[5]^ +| Native `nftables` support +| GA ^[5]^ + +| Agentgateway +| NA |=== . For more information, see "Support for Istioctl". -. Installation is only supported by using the {SMProduct} 3 Operator, which uses the Istio Helm chart values for managing configuration. +. Installation is only supported by using the {SMProduct} Operator, which uses the Istio Helm chart values for managing configuration. . The `ProxyConfig` API is supported with the exception of the image field, which is not supported. . Dual-Stack IPv4/IPv6 is supported on x86 environments only. On non-x86 environments, this feature remains a Technology Preview. . To deploy {SMProduct} on nodes running {op-system-base-full} 10 or {op-system-first} 10, you must enable native `nftables` support. In the {istio} resource, set the `spec.values.global.nativeNftables` parameter to `true`. \ No newline at end of file diff --git a/modules/ossm-release-notes-istio-traffic-management.adoc b/modules/ossm-release-notes-istio-traffic-management.adoc index baf12f93294..97c1588c048 100644 --- a/modules/ossm-release-notes-istio-traffic-management.adoc +++ b/modules/ossm-release-notes-istio-traffic-management.adoc @@ -7,6 +7,7 @@ = Istio traffic management [role="_abstract"] +Traffic management features control how requests flow between services in your mesh, including routing, load balancing, and resilience capabilities. [cols="1,1"] |=== diff --git a/modules/ossm-release-notes-kubernetes-gateway-api.adoc b/modules/ossm-release-notes-kubernetes-gateway-api.adoc index cef5614d68e..edeee779b99 100644 --- a/modules/ossm-release-notes-kubernetes-gateway-api.adoc +++ b/modules/ossm-release-notes-kubernetes-gateway-api.adoc @@ -4,9 +4,10 @@ :_mod-docs-content-type: REFERENCE [id="kubernetes-gateway-api_{context}"] -= Kubernetes Gateway API += Kubernetes Gateway APIs [role="_abstract"] +Kubernetes Gateway APIs provide standard resources for configuring ingress gateways, mesh traffic, and gateway behavior in {SMProduct} {SMProductVersion}. [cols="1,1"] |=== @@ -31,4 +32,4 @@ | TP |=== -. The use of {k8s} Gateway API requires custom resource definitions (CRDs). The CRDs are present by default and generally available on {product-title} 4.19 and later releases. {product-title} 4.18 and earlier releases do not include or provide support for these CRDs. \ No newline at end of file +. The use of {k8s} Gateway API requires custom resource definitions (CRDs). The CRDs are present by default and generally available on {ocp-product-title} 4.19 and later releases. {ocp-product-title} 4.18 and earlier releases do not include or provide support for these CRDs. \ No newline at end of file diff --git a/modules/ossm-release-notes-observability-features.adoc b/modules/ossm-release-notes-observability-features.adoc index 323ed654c90..aae4686f741 100644 --- a/modules/ossm-release-notes-observability-features.adoc +++ b/modules/ossm-release-notes-observability-features.adoc @@ -7,10 +7,9 @@ = Observability features [role="_abstract"] +{SMProduct} {SMProductVersion} provides end-to-end support for observability, including logs, metrics, and distributed tracing with {ObservabilityLongName} and the {KialiProduct}. -{SMProduct} 3 provides end-to-end support for observability, including logs, metrics, and distributed tracing with {ObservabilityLongName} and the {KialiProduct}. - -+Integrations with other community projects (including community Prometheus) and third-party solutions can be configurable through Istio or {ObservabilityShortName} operators, but those solutions are not supported by Red Hat. +Integrations with other community projects (including community Prometheus) and third-party solutions can be configurable through Istio or {ObservabilityShortName} operators, but those solutions are not supported by Red Hat. [cols="1,1"] diff --git a/modules/ossm-release-notes-sail-operator-apis.adoc b/modules/ossm-release-notes-sail-operator-apis.adoc index 2dedf14102a..4cb4d759af2 100644 --- a/modules/ossm-release-notes-sail-operator-apis.adoc +++ b/modules/ossm-release-notes-sail-operator-apis.adoc @@ -7,6 +7,7 @@ = Sail Operator APIs [role="_abstract"] +The Sail Operator provides the following custom resource definitions (CRDs) for managing Istio components in {SMProduct}. [cols="1,1"] |=== diff --git a/modules/ossm-release-notes-security-features.adoc b/modules/ossm-release-notes-security-features.adoc index 21c87d9c679..b9f6cfcc305 100644 --- a/modules/ossm-release-notes-security-features.adoc +++ b/modules/ossm-release-notes-security-features.adoc @@ -7,6 +7,7 @@ = Security features [role="_abstract"] +Security features provide encryption, authentication, and authorization capabilities for securing service-to-service communication and protecting workloads in your mesh. [id="encryption-and-certificate-management_{context}"] == Encryption and certificate management @@ -35,6 +36,10 @@ | Kubernetes ClusterTrustBundles | DP + +| SPIFFE Runtime Environment (SPIRE) integration through the Zero Trust Workload Identity Manager +| TP + |=== [id="authorization-and-policy-enforcement_{context}"] diff --git a/modules/ossm-service-mesh-deployment-resources.adoc b/modules/ossm-service-mesh-deployment-resources.adoc index 06d7a96d6f0..5277c43aafc 100644 --- a/modules/ossm-service-mesh-deployment-resources.adoc +++ b/modules/ossm-service-mesh-deployment-resources.adoc @@ -132,4 +132,4 @@ When using an `{istio}` resource as the target, the Operator automatically updat [IMPORTANT] ==== You can only use the `istio-injection` label for revisions and revision tags that have the name `default`. -==== \ No newline at end of file +==== diff --git a/modules/ossm-service-mesh-overview.adoc b/modules/ossm-service-mesh-overview.adoc index ea5b04595b6..b6d988882a6 100644 --- a/modules/ossm-service-mesh-overview.adoc +++ b/modules/ossm-service-mesh-overview.adoc @@ -4,7 +4,7 @@ :_mod-docs-content-type: CONCEPT [id="ossm-servicemesh-overview_{context}"] -= Introduction to {SMProductName} += {SMProductName} overview [role="_abstract"] diff --git a/ossm-release-notes/ossm-release-notes-feature-support-tables.adoc b/ossm-release-notes/ossm-release-notes-feature-support-tables.adoc index 0a83553a70c..371eef67b75 100644 --- a/ossm-release-notes/ossm-release-notes-feature-support-tables.adoc +++ b/ossm-release-notes/ossm-release-notes-feature-support-tables.adoc @@ -1,7 +1,7 @@ :_mod-docs-content-type: ASSEMBLY [id="ossm-release-notes-feature-support-tables"] -= {SMProductShortName} feature support tables += Check mesh feature availability and support levels include::_attributes/common-attributes.adoc[] :context: ossm-release-notes-support-tables @@ -14,8 +14,8 @@ include::_attributes/attributes-openshift-dedicated.adoc[] toc::[] [role="_abstract"] +Feature support tables help you determine which {SMProduct} {SMProductVersion} features are generally available, in Technology Preview, in Developer Preview, or not available. -{SMProductVersion} feature support tables offer guidance on feature availability in {SMProduct} 3. include::modules/ossm-release-notes-definitions.adoc[leveloffset=+1] @@ -36,10 +36,3 @@ include::modules/ossm-release-notes-consoles-and-dashboards.adoc[leveloffset=+1] include::modules/ossm-release-notes-extensibility-features.adoc[leveloffset=+1] include::modules/ossm-release-notes-istio-ambient-mode.adoc[leveloffset=+1] - -[role="_additional-resources"] -[id="additional-resources_{context}"] -== Additional resources - -* xref:../install/ossm-istioctl-tool.adoc#ossm-support-for-istioctl_ossm-istioctl-tool[Support for Istioctl] -