Workload Onboarding Plane

OnboardingPlane resource exposes a set of configuration options supported by the Workload Onboarding Plane installer.

The installation API is an override API, so any unset optional fields will receive sensible defaults.

The minimal OnboardingPlane resource requires only a single field - container registry that hosts Docker images of the Workload Onboarding Operator and its sub-components.

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate

If you need to pull from a private registry, you can add reference to the necessary pull secrets:

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate
  imagePullSecrets:
  - name: my-registry-creds

To onboard workloads from custom on-premise environments, you can leverage support for OIDC ID Tokens.

If workloads in your custom environment can authenticate themselves by means of an OIDC ID Token, you can define a list of JWT issuers permitted by the Workload Onboarding Plane.

For example,

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate
  workloads:
    authentication:
      jwt:
        issuers:
        - issuer: "https://mycompany.corp"
          jwksUri: "https://mycompany.corp/jwks.json"
          shortName: "mycorp"
          tokenFields:
            attributes:
              jsonPath: .custom_attributes

To ensure there will be no traffic loss when an onboarded workload gets shutdown, you can configure the time period to delay the shutdown for after deregistering the workload from the mesh, which will give enough time to reconfigure all affected mesh nodes to not load balance requests to the deregistered workload before it becomes unavailable.

For example,

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate
  workloads:
    deregistration:
      propagationDelay: 15s

It is possible to put constraints on what Istio revisions the workloads can onboard to via this Onboarding Plane.

For example,

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate
  istio:
    revisions:
      only:
        include:
        - green
        - blue

It is also possible to allow all Istio revisions for workloads to onboard via this Onboarding Plane.

For example,

apiVersion: install.onboarding.tetrate.io/v1alpha1
kind: OnboardingPlane
metadata:
  name: onboarding-plane
  namespace: istio-system
spec:
  hub: docker.io/tetrate
  istio:
    revisions:
      all: \{\}

LocalObjectReference

LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

Field	Description	Validation Rule
name	string Name of the referent.	–

OnboardingPlaneIstioSettings

Configuration of the Workload Onboarding Plane with regards to Istio.

Field	Description	Validation Rule
revisions	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneIstioSettings.RevisionSelector Settings for Istio revisions that the onboarding plane allows a workload to connect to. If not specified, workloads are allowed to connect to any of the installed Istio revisions.	–

RevisionSelector

Selects revisions that the workload is allowed to connect to.

Field	Description	Validation Rule
all	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneIstioSettings.RevisionSelector.All oneof _selector Specifies that the workload is allowed to connect to any of the installed Istio revisions.	–
only	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneIstioSettings.RevisionSelector.Only oneof _selector Specifies that the workload is allowed to connect to specific Istio revisions.	–

All

Specifies that the workload is allowed to connect to any of the installed Istio revisions.

Only

Specifies that the workload is allowed to connect to specific Istio revisions.

Field	Description	Validation Rule
include	List of string List of Istio revisions the workloads are allowed to connect to. Empty list means that workloads are NOT allowed to connect to any of the installed Istio revisions. Defaults to an empty list.	–

OnboardingPlaneSpec

OnboardingPlaneSpec specifies the desired state of components of the Workload Onboarding Plane.

Field	Description	Validation Rule
hub	string REQUIRED Container registry that hosts images of components of the Workload Onboarding Plane, e.g. docker.io/tetrate.	string = {   min_len: 1 }
uid	string Unique identifier of this particular installation of the Workload Onboarding Plane. Is used in the workload authentication flow to prevent replay attacks that abuse compromised workload credentials intended for a different installation of the Workload Onboarding Plane. Defaults to an auto-generated UUID.	string = {   min_len: 1 }
tokenIssuer	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneSpec.TokenIssuer Configuration of the built-in Workload Onboarding Token Issuer.	message = {   required: true }
workloads	tetrateio.api.onboarding.config.install.v1alpha1.WorkloadConfiguration Configuration of the workload handling.	–
imagePullSecrets	List of tetrateio.api.onboarding.private.install.v1alpha1.LocalObjectReference Pull secrets can be specified globally for all components, or defined into the kubeSpec.serviceAccount of every component if needed. In case both are defined, the most specific one (the one defined at the component) level is used. List of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#service_account-v1-core	–
istio	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneIstioSettings Configuration with regards to Istio.	–
components	tetrateio.api.onboarding.config.install.v1alpha1.OnboardingPlaneComponentSet The set of components that make up the onboarding plane. Use this to override settings for individual components.	–

TokenIssuer

Configuration of the built-in Workload Onboarding Token Issuer.

Field	Description	Validation Rule
jwt	tetrateio.api.onboarding.private.install.v1alpha1.OnboardingPlaneSpec.TokenIssuer.JwtTokenIssuer oneof _token_issuer Configuration of the built-in JWT Token Issuer.	–

JwtTokenIssuer

Configuration of the built-in JWT Token Issuer.

Field	Description	Validation Rule
expiration	google.protobuf.Duration Expiration is the duration issued tokens are valid for. Defaults to 1h.	duration = {   required: true   gt: {nanos:0} }

OnboardingPlaneStatus

OnboardingPlaneStatus represents the current status of the onboarding plane.