Control Plane

This page will introduce you to how the TSB Operator manages the lifecycle of control plane components and what custom resources you can configure and manage using the TSB Operator.

The TSB Operator, configured to manage the lifecycle of the control plane components, watches for ControlPlane CRs in the same namespace where it's deployed. The default namespace for the control plane is istio-system. For more information about the custom resource API, refer to the Control Plane Install API Reference Docs.

Components

These are the types of custom components you can configure and manage using the control plane operator:

Component	Service	Deployment
istio	Istio-operator-metrics (istiod, vmgateway)	Istio-operator (istiod vmgateway) (istio-cni-node daemonset in kube-system namespace)
oap	oap	oap-deployment
collector	otel-collector	otel-collector
xcpOperator	xcp-operator-edge	xcp-operator-edge
xcpEdge	xcp-edge	edge

The components configured and installed by the operator are:

• istio: The open source Istio operator to which the TSB operator delegates the management of open source Istio components.
• oap: Responsible for mesh and envoy gateways RED metrics collection and aggregation and trace collection
• collector: The Open Telemetry Collector that collects the control plane components' metrics and exposes them through a Prometheus metrics endpoint. xcpOperator: The control plane operator to which the TSB operator delegates the management of control plane components
• xcpEdge: Responsible for translating configurations from xcpCentral into Istio CRDs and saving them to the local cluster, and pushing cluster information to xcpCentral

Istio as TSB component

As described above, the TSB operator responsible for the control plane, installs the open source Istio operator. Istio and its operator are regarded as part of the TSB control plane components, under direct control of the TSB operator. Users do not directly configure Istio. Instead, the interaction with Istio always happens through the TSB Operator ControlPlane CR.

The TSB operator that manages the control plane creates the IstioOperator CR called tsb-istiocontrolplane in the control plane's namespace. The IstioOperator CR instructs the Istio operator to manage the deployment of the needed Istio (sub)components. For the TSB control plane, the following (sub)components are enabled: pilot, cni, ingressGateway.

The TSB ingressGateway (sub)component is a customized configuration of Envoy which is deployed as vmgateway to support smooth VM integration. Its primary purpose is to route traffic originating from service mesh onboarded VMs to services deployed inside the Kubernetes cluster when direct VM to Kubernetes pod traffic is not possible.

Sidecar proxy versions

Though sidecar proxies technically belong to the data plane, their versions are pinned to the control plane operator version.