Skip to content

Commit 794b785

Browse files
abrennan89abrennan89
committed
[SRVCOM-1832]: Update abstracts for Jupiter requirements
1 parent 6aef0d7 commit 794b785

16 files changed

+112
-103
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3508,8 +3508,6 @@ Topics:
35083508
File: serverless-ossm-with-kourier-jwt
35093509
- Name: Configuring a custom domain for a Knative service
35103510
File: serverless-custom-domains
3511-
- Name: Using a custom TLS certificate for domain mapping
3512-
File: serverless-custom-tls-cert-domain-mapping
35133511
# Functions
35143512
- Name: Functions
35153513
Dir: functions

‎_topic_maps/_topic_map_osd.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -311,8 +311,6 @@ Topics:
311311
File: serverless-ossm-with-kourier-jwt
312312
- Name: Configuring a custom domain for a Knative service
313313
File: serverless-custom-domains
314-
- Name: Using a custom TLS certificate for domain mapping
315-
File: serverless-custom-tls-cert-domain-mapping
316314
- Name: Functions
317315
Dir: functions
318316
Topics:

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -422,8 +422,6 @@ Topics:
422422
File: serverless-ossm-with-kourier-jwt
423423
- Name: Configuring a custom domain for a Knative service
424424
File: serverless-custom-domains
425-
- Name: Using a custom TLS certificate for domain mapping
426-
File: serverless-custom-tls-cert-domain-mapping
427425
- Name: Functions
428426
Dir: functions
429427
Topics:

‎modules/serverless-create-domain-mapping-kn.adoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,7 @@
77
[id="serverless-create-domain-mapping-kn_{context}"]
88
= Creating a custom domain mapping by using the Knative CLI
99

10-
You can use the `kn` CLI to create a `DomainMapping` custom resource (CR) that maps to an Addressable target CR, such as a Knative service or a Knative route.
11-
12-
The `--ref` flag specifies an Addressable target CR for domain mapping.
13-
14-
If a prefix is not provided when using the `--ref` flag, it is assumed that the target is a Knative service in the current namespace. The examples in the following procedure show the prefixes for mapping to a Knative service or a Knative route.
10+
You can customize the domain for your Knative service by mapping a custom domain name that you own to a Knative service. You can use the Knative (`kn`) CLI to create a `DomainMapping` custom resource (CR) that maps to an Addressable target CR, such as a Knative service or a Knative route.
1511

1612
.Prerequisites
1713

@@ -39,6 +35,10 @@ $ kn domain create <domain_mapping_name> --ref <target_name>
3935
----
4036
$ kn domain create example.com --ref example-service
4137
----
38+
+
39+
The `--ref` flag specifies an Addressable target CR for domain mapping.
40+
+
41+
If a prefix is not provided when using the `--ref` flag, it is assumed that the target is a Knative service in the current namespace.
4242
4343
* Map a domain to a Knative service in a specified namespace:
4444
+

‎modules/serverless-create-domain-mapping.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="serverless-create-domain-mapping_{context}"]
77
= Creating a custom domain mapping
88

9-
To map a custom domain name to a custom resource (CR), you must create a `DomainMapping` CR that maps to an Addressable target CR, such as a Knative service or a Knative route.
9+
You can customize the domain for your Knative service by mapping a custom domain name that you own to a Knative service. To map a custom domain name to a custom resource (CR), you must create a `DomainMapping` CR that maps to an Addressable target CR, such as a Knative service or a Knative route.
1010

1111
.Prerequisites
1212

‎modules/serverless-domain-mapping-custom-tls-cert.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
// Module included in the following assemblies:
22
//
3-
// * serverless/security/serverless-custom-tls-cert-domain-mapping.adoc
3+
// * serverless/security/serverless-custom-domains.adoc
44

55
:_content-type: PROCEDURE
66
[id="serverless-domain-mapping-custom-tls-cert_{context}"]
7-
= Adding a custom TLS certificate to a DomainMapping CR
7+
= Securing a service with a custom domain by using a TLS certificate
88

9-
You can add an existing TLS certificate with a `DomainMapping` custom resource (CR) to secure the mapped service.
9+
After you have configured a custom domain for a Knative service, you can use a TLS certificate to secure the mapped service. To do this, you must create a Kubernetes TLS secret, and then update the `DomainMapping` CR to use the TLS secret that you have created.
1010

1111
.Prerequisites
1212

@@ -27,7 +27,7 @@ You can add an existing TLS certificate with a `DomainMapping` custom resource (
2727
$ oc create secret tls <tls_secret_name> --cert=<path_to_certificate_file> --key=<path_to_key_file>
2828
----
2929

30-
. Update the `DomainMapping` CR to use the TLS secret you have created:
30+
. Update the `DomainMapping` CR to use the TLS secret that you have created:
3131
+
3232
[source,yaml]
3333
----

‎modules/serverless-domain-mapping-odc-admin.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
[id="serverless-domain-mapping-odc-admin_{context}"]
77
= Mapping a custom domain to a service by using the Administrator perspective
88

9+
include::snippets/serverless-domain-mapping.adoc[]
10+
911
ifdef::openshift-enterprise[]
1012
If you have cluster administrator permissions, you can create a `DomainMapping` custom resource (CR) by using the *Administrator* perspective in the {product-title} web console.
1113
endif::[]

‎modules/serverless-domain-mapping-odc-developer.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="serverless-domain-mapping-odc-developer_{context}"]
77
= Mapping a custom domain to a service by using the Developer perspective
88

9-
You can use the *Developer* perspective of the {product-title} web console to map a `DomainMapping` custom resource (CR) to a Knative service.
9+
You can customize the domain for your Knative service by mapping a custom domain name that you own to a Knative service. You can use the *Developer* perspective of the {product-title} web console to map a `DomainMapping` custom resource (CR) to a Knative service.
1010

1111
.Prerequisites
1212

‎modules/serverless-ossm-enable-sidecar-injection-with-kourier.adoc

Lines changed: 0 additions & 53 deletions
This file was deleted.

‎modules/serverless-ossm-v1x-jwt.adoc

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,52 @@
66
[id="serverless-ossm-v1x-jwt_{context}"]
77
= Using JSON Web Token authentication with {SMProductShortName} 1.x and {ServerlessProductName}
88

9-
You can use the following procedure to enable using JSON Web Token authentication with {SMProductShortName} 1.x and {ServerlessProductName}.
9+
You can use JSON Web Token (JWT) authentication with Knative services by using {SMProductShortName} 1.x and {ServerlessProductName}. To do this, you must create a policy in the application namespace that is a member of the `ServiceMeshMemberRoll` object. You must also enable sidecar injection for the service.
10+
11+
[IMPORTANT]
12+
====
13+
Adding sidecar injection to pods in system namespaces, such as `knative-serving` and `knative-serving-ingress`, is not supported when Kourier is enabled.
14+
15+
ifdef::openshift-enterprise[]
16+
If you require sidecar injection for pods in these namespaces, see the {ServerlessProductName} documentation on _Integrating {SMProductShortName} with {ServerlessProductName} natively_.
17+
endif::[]
18+
====
1019

1120
.Prerequisites
1221

13-
* You have installed the {ServerlessOperatorName} and Knative Serving.
22+
* You have installed the {ServerlessOperatorName}, Knative Serving, and {SMProductName} on your cluster.
1423
* Install the OpenShift CLI (`oc`).
1524
* You have created a project or have access to a project with the appropriate roles and permissions to create applications and other workloads in {product-title}.
1625
1726
.Procedure
1827

28+
. Add the `sidecar.istio.io/inject="true"` annotation to your service:
29+
+
30+
.Example service
31+
[source,yaml]
32+
----
33+
apiVersion: serving.knative.dev/v1
34+
kind: Service
35+
metadata:
36+
name: <service_name>
37+
spec:
38+
template:
39+
metadata:
40+
annotations:
41+
sidecar.istio.io/inject: "true" <1>
42+
sidecar.istio.io/rewriteAppHTTPProbers: "true" <2>
43+
...
44+
----
45+
<1> Add the `sidecar.istio.io/inject="true"` annotation.
46+
<2> You must set the annotation `sidecar.istio.io/rewriteAppHTTPProbers: "true"` in your Knative service, because {ServerlessProductName} versions 1.14.0 and higher use an HTTP probe as the readiness probe for Knative services by default.
47+
48+
. Apply the `Service` resource:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc apply -f <filename>
53+
----
54+
1955
. Create a policy in a serverless application namespace which is a member in the `ServiceMeshMemberRoll` object, that only allows requests with valid JSON Web Tokens (JWT):
2056
+
2157
[IMPORTANT]
@@ -43,6 +79,7 @@ spec:
4379
----
4480
<1> The path on your application to collect metrics by system pod.
4581
<2> The path on your application to probe by system pod.
82+
4683
. Apply the `Policy` resource:
4784
+
4885
[source,terminal]
@@ -64,6 +101,7 @@ $ curl http://hello-example-default.apps.mycluster.example.com/
64101
----
65102
Origin authentication failed.
66103
----
104+
67105
. Verify the request with a valid JWT.
68106
.. Get the valid JWT token:
69107
+

‎modules/serverless-ossm-v2x-jwt.adoc

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,52 @@
66
[id="serverless-ossm-v2x-jwt_{context}"]
77
= Using JSON Web Token authentication with {SMProductShortName} 2.x and {ServerlessProductName}
88

9-
You can use the following procedure to enable using JSON Web Token authentication with {SMProductShortName} 2.x and {ServerlessProductName}.
9+
You can use JSON Web Token (JWT) authentication with Knative services by using {SMProductShortName} 2.x and {ServerlessProductName}. To do this, you must create authentication requests and policies in the application namespace that is a member of the `ServiceMeshMemberRoll` object. You must also enable sidecar injection for the service.
10+
11+
[IMPORTANT]
12+
====
13+
Adding sidecar injection to pods in system namespaces, such as `knative-serving` and `knative-serving-ingress`, is not supported when Kourier is enabled.
14+
15+
ifdef::openshift-enterprise[]
16+
If you require sidecar injection for pods in these namespaces, see the {ServerlessProductName} documentation on _Integrating {SMProductShortName} with {ServerlessProductName} natively_.
17+
endif::[]
18+
====
1019

1120
.Prerequisites
1221

13-
* You have installed the {ServerlessOperatorName} and Knative Serving.
22+
* You have installed the {ServerlessOperatorName}, Knative Serving, and {SMProductName} on your cluster.
1423
* Install the OpenShift CLI (`oc`).
1524
* You have created a project or have access to a project with the appropriate roles and permissions to create applications and other workloads in {product-title}.
1625
1726
.Procedure
1827

28+
. Add the `sidecar.istio.io/inject="true"` annotation to your service:
29+
+
30+
.Example service
31+
[source,yaml]
32+
----
33+
apiVersion: serving.knative.dev/v1
34+
kind: Service
35+
metadata:
36+
name: <service_name>
37+
spec:
38+
template:
39+
metadata:
40+
annotations:
41+
sidecar.istio.io/inject: "true" <1>
42+
sidecar.istio.io/rewriteAppHTTPProbers: "true" <2>
43+
...
44+
----
45+
<1> Add the `sidecar.istio.io/inject="true"` annotation.
46+
<2> You must set the annotation `sidecar.istio.io/rewriteAppHTTPProbers: "true"` in your Knative service, because {ServerlessProductName} versions 1.14.0 and higher use an HTTP probe as the readiness probe for Knative services by default.
47+
48+
. Apply the `Service` resource:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc apply -f <filename>
53+
----
54+
1955
. Create a `RequestAuthentication` resource in each serverless application namespace that is a member in the `ServiceMeshMemberRoll` object:
2056
+
2157
[source,yaml]
@@ -30,12 +66,14 @@ spec:
3066
- issuer: [email protected]
3167
jwksUri: https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/jwks.json
3268
----
69+
3370
. Apply the `RequestAuthentication` resource:
3471
+
3572
[source,terminal]
3673
----
3774
$ oc apply -f <filename>
3875
----
76+
3977
. Allow access to the `RequestAuthenticaton` resource from system pods for each serverless application namespace that is a member in the `ServiceMeshMemberRoll` object, by creating the following `AuthorizationPolicy` resource:
4078
+
4179
[source,yaml]
@@ -56,12 +94,14 @@ spec:
5694
----
5795
<1> The path on your application to collect metrics by system pod.
5896
<2> The path on your application to probe by system pod.
97+
5998
. Apply the `AuthorizationPolicy` resource:
6099
+
61100
[source,terminal]
62101
----
63102
$ oc apply -f <filename>
64103
----
104+
65105
. For each serverless application namespace that is a member in the `ServiceMeshMemberRoll` object, create the following `AuthorizationPolicy` resource:
66106
+
67107
[source,yaml]
@@ -78,6 +118,7 @@ spec:
78118
- source:
79119
requestPrincipals: ["[email protected]/[email protected]"]
80120
----
121+
81122
. Apply the `AuthorizationPolicy` resource:
82123
+
83124
[source,terminal]
@@ -100,6 +141,7 @@ $ curl http://hello-example-1-default.apps.mycluster.example.com/
100141
----
101142
RBAC: access denied
102143
----
144+
103145
. Verify the request with a valid JWT.
104146
.. Get the valid JWT token:
105147
+

‎serverless/admin_guide/serverless-admin-perspective.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ If you do not want to switch to the *Developer* perspective in the {product-titl
1010

1111
// Create services as an admin
1212
include::modules/creating-serverless-apps-admin-console.adoc[leveloffset=+1]
13+
// domain mapping as an admin
14+
include::modules/serverless-domain-mapping-odc-admin.adoc[leveloffset=+1]
1315
// Event sources
1416
include::modules/serverless-creating-event-source-admin-web-console.adoc[leveloffset=+1]
1517
// Brokers

‎serverless/security/serverless-custom-domains.adoc

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,11 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
Knative services are automatically assigned a default domain name based on your cluster configuration. For example, `<service_name>.<namespace>.example.com`.
10-
11-
You can customize the domain for your Knative service by mapping a custom domain name that you own to a Knative service, by creating a `DomainMapping` resource for the service. You can also create multiple `DomainMapping` resources to map multiple domains and subdomains to a single service.
9+
include::snippets/serverless-domain-mapping.adoc[]
1210

1311
include::modules/serverless-create-domain-mapping.adoc[leveloffset=+1]
1412
include::modules/serverless-create-domain-mapping-kn.adoc[leveloffset=+1]
13+
// ODC
14+
include::modules/serverless-domain-mapping-odc-developer.adoc[leveloffset=+1]
1515

16-
// Using the web console
17-
18-
[id="serverless-custom-domains-odc"]
19-
== Creating a custom domain mapping by using the web console
20-
21-
You can use the *Administrator* or *Developer* perspective of the {product-title} web console to create a custom domain mapping for a Knative service.
22-
23-
include::modules/serverless-domain-mapping-odc-admin.adoc[leveloffset=+2]
24-
include::modules/serverless-domain-mapping-odc-developer.adoc[leveloffset=+2]
16+
include::modules/serverless-domain-mapping-custom-tls-cert.adoc[leveloffset=+1]

‎serverless/security/serverless-custom-tls-cert-domain-mapping.adoc

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎serverless/security/serverless-ossm-with-kourier-jwt.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
After the {SMProductShortName} integration with {ServerlessProductName} and Kourier has been configured on your cluster, you can enable JSON Web Token (JWT) authentication for your Knative services.
9+
{ServerlessProductName} does not currently have user-defined authorization features. To add user-defined authorization to your deployment, you must integrate {ServerlessProductName} with {SMProductName}, and then configure JSON Web Token (JWT) authentication and sidecar injection for Knative services.
1010

11-
include::modules/serverless-ossm-enable-sidecar-injection-with-kourier.adoc[leveloffset=+1]
1211
include::modules/serverless-ossm-v2x-jwt.adoc[leveloffset=+1]
1312
include::modules/serverless-ossm-v1x-jwt.adoc[leveloffset=+1]

‎snippets/serverless-domain-mapping.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// Text snippet included in the following files
2+
//
3+
// * serverless/security/serverless-custom-domains.adoc
4+
// * modules/serverless-domain-mapping-odc-admin.adoc
5+
6+
Knative services are automatically assigned a default domain name based on your cluster configuration. For example, `<service_name>-<namespace>.example.com`. You can customize the domain for your Knative service by mapping a custom domain name that you own to a Knative service.
7+
8+
You can do this by creating a `DomainMapping` resource for the service. You can also create multiple `DomainMapping` resources to map multiple domains and subdomains to a single service.

0 commit comments

Comments
 (0)