Bridging the gap: Integrate legacy VMs into a zero trust Service Mesh

Dive into how to onboard legacy virtual machines into modernized workloads via Red Hat OpenShift Service Mesh.

Go to console

To proceed with integrating your legacy virtual machine (VM) into the Red Hat OpenShift Service Mesh, we must first establish several key dependencies. We'll leverage the powerful concept of bootstrapping necessary content directly into the VM during its initial boot—a technique inspired by methodologies like Solving secret zero with Vault and OpenShift Virtualization.

Prerequisites:

In this lesson, you will:

  • Prepare your environment for the creation and deployment of a VM.

Create your service mesh driver disk (ISO)

Since providing the proprietary Red Hat Enterprise Linux (RHEL) content is restricted, I will outline the precise instructions for building your own servicemesh-driver-disk.iso. This ISO will contain the mandatory packages required to onboard your RHEL 9.6-based VM into the service mesh at boot time.

Mandatory packages from rhel-guest-image:9.6

To ensure the VM can correctly authenticate and join the mesh, the following packages must be included in the ISO for the bootstrapping process:

  • iptables-nft
  • libnftnl
  • glibc.i686
  • glibc-gconv-extra.i686
  • libgcc.i686
  • libmnl.i686

Acquire the Istio Sidecar RPM

Since your OpenShift Service Mesh 3.x environment supports both Istio 1.24 and 1.26, you must include the respective Istio Sidecar RPMs on your custom driver disk. While we aren't using the traditional sidecar injection method, these packages contain the critical binaries and configuration files required for the VM to function as an Istio workload.

The progress of upstream/Red Hat OpenShift ServiceMesh in versions will also create the need to update the driver disk on a periodic basis.

You will need to source and download the RPMs that correspond to the Istio versions you intend to support:

Istio version

Required package

Reason for inclusion

1.24

istio-1.24.0-sidecar.x86_64 (for 1.24)

Necessary for environments still running the 1.24 iteration of OSSM 3.x.

1.26

istio-1.26.0-sidecar.x86_64 (for 1.26)

Aligns with the latest recommended version of OSSM 3.x.

Execute the ISO creation command

Now that you've gathered all the necessary packages and scripts, the base RHEL packages, and the Istio Sidecar RPMs, we are ready to execute the command to build the servicemesh-driver-disk.iso.

The standard utility for creating an ISO image from a set of files and directories on Linux is typically genisoimage.

The ISO can be created by executing the following commands in the console:

cat <<'EOF' > create-driver-disk.sh 
#!/bin/bash

mkdir driverdisk
cd driverdisk 
dnf download -y \
  iptables-nft \
  libnftnl \
  glibc.i686 \
  glibc-gconv-extra.i686 \
  libgcc.i686 \
  libmnl.i686
curl -sLo istio-1.24.0-sidecar.rpm \
  https://storage.googleapis.com/istio-release/releases/1.24.0/rpm/istio-sidecar.rpm
curl -sLo istio-1.26.0-sidecar.rpm \
  https://storage.googleapis.com/istio-release/releases/1.26.0/rpm/istio-sidecar.rpm
genisoimage -r -l -o ../servicemesh-driver-disk.iso .

cd ..
EOF

Followed by:

chmod +x create-dirver-disk.sh  

And finally: 

./create-driver-disk.sh
Previous resource
Prepare the mesh for network topology
Next resource
Prepare the virtual machine

Developer Preview

Openshift Virtualization VM workloads in OpenShift Service Mesh is a developer preview feature at the moment.  

If you want to know more about what the developer preview feature means or its scope of support

What is a developer preview feature?