Upgrade & Secure Your Future with DevOps, SRE, DevSecOps, MLOps!

Install Knative Components

1.1 Set up Knative Serving Resources

Create the serving namespace

kubectl create namespace serving

Install Knative Serving Components ( CRDs and Core Components) serving-components.yaml file

kubectl apply -f serving/serving-components.yaml

Check if Knative Serving Core Components are up-and-running

kubectl get pods -n serving

1.2 Set up KNative Eventing Resources

Create the eventing namespace

kubectl create namespace eventing

Install Knative Eventing Components ( CRDs and Core Components ) eventing-components.yaml file

kubectl apply -f eventing/eventing-components.yaml

Check if Knative Eventing Core Components are up-and-running

kubectl get pods -n eventing

Set up Istio

1.1 Install `istioctl` version `1.12`

Follow the steps presented here

https://istio.io/latest/docs/setup/getting-started/#download

Check if the proper version has been installed

istioctl version

1.2 Install `Istio`

istioctl install -y

1.3 Deploy `Istio Resources` ( istio-resources.yaml )

kubectl apply -f istio/istio-resources.yaml

1.4 Check `Istio setup`

kubectl get pods -n istio-system

Upgrade & Secure Your Future with DevOps, SRE, DevSecOps, MLOps!

Knative Tutorials: Install Knative Serving, Eventing Resources with Istio

Install Knative Components

1.1 Set up Knative Serving Resources

1.2 Set up KNative Eventing Resources

Set up Istio

1.1 Install `istioctl` version `1.12`

1.2 Install `Istio`

1.3 Deploy `Istio Resources` ( istio-resources.yaml )

1.4 Check `Istio setup`

Certification Courses

Need Assistance!!!

Feel Free To Contact Us

+1 (469) 756-6329

(US Call-WhatsApp)

+91 7004 215 841

(India Call-WhatsApp)

Email us

Contact@DevOpsSchool.com

	# Generated when HEAD was 9ab0b805e55833059a489c8ee8515617dc483cd2
	#
	# Copyright 2019 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	kind: ClusterRole
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	# These are the permissions needed by the Istio Ingress implementation.
	name: knative-serving-istio
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	serving.knative.dev/controller: "true"
	networking.knative.dev/ingress-provider: istio
	rules:
	- apiGroups: ["networking.istio.io"]
	resources: ["virtualservices", "gateways", "destinationrules"]
	verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

	---
	# Copyright 2019 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	# This is the shared Gateway for all Knative routes to use.
	apiVersion: networking.istio.io/v1alpha3
	kind: Gateway
	metadata:
	name: knative-ingress-gateway
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	istio: ingressgateway
	servers:
	- port:
	number: 80
	name: http
	protocol: HTTP
	hosts:
	- "*"

	---
	# Copyright 2019 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	# A cluster local gateway to allow pods outside of the mesh to access
	# Services and Routes not exposing through an ingress. If the users
	# do have a service mesh setup, this isn't required.
	apiVersion: networking.istio.io/v1alpha3
	kind: Gateway
	metadata:
	name: knative-local-gateway
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	istio: ingressgateway
	servers:
	- port:
	number: 8081
	name: http
	protocol: HTTP
	hosts:
	- "*"
	---
	apiVersion: v1
	kind: Service
	metadata:
	name: knative-local-gateway
	namespace: istio-system
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	experimental.istio.io/disable-gateway-port-translation: "true"
	spec:
	type: ClusterIP
	selector:
	istio: ingressgateway
	ports:
	- name: http2
	port: 80
	targetPort: 8081

	---
	# Copyright 2018 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: config-istio
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	data:
	# TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
	_example: \|
	################################
	# #
	# EXAMPLE CONFIGURATION #
	# #
	################################

	# This block is not actually functional configuration,
	# but serves to illustrate the available configuration
	# options and document them in a way that is accessible
	# to users that `kubectl edit` this config map.
	#
	# These sample configuration options may be copied out of
	# this example block and unindented to be in the data block
	# to actually change the configuration.

	# A gateway and Istio service to serve external traffic.
	# The configuration format should be
	# `gateway.{{gateway_namespace}}.{{gateway_name}}: "{{ingress_name}}.{{ingress_namespace}}.svc.cluster.local"`.
	# The {{gateway_namespace}} is optional; when it is omitted, the system will search for
	# the gateway in the serving system namespace `knative-serving`
	gateway.knative-serving.knative-ingress-gateway: "istio-ingressgateway.istio-system.svc.cluster.local"

	# A cluster local gateway to allow pods outside of the mesh to access
	# Services and Routes not exposing through an ingress. If the users
	# do have a service mesh setup, this isn't required and can be removed.
	#
	# An example use case is when users want to use Istio without any
	# sidecar injection (like Knative's istio-ci-no-mesh.yaml). Since every pod
	# is outside of the service mesh in that case, a cluster-local service
	# will need to be exposed to a cluster-local gateway to be accessible.
	# The configuration format should be `local-gateway.{{local_gateway_namespace}}.
	# {{local_gateway_name}}: "{{cluster_local_gateway_name}}.
	# {{cluster_local_gateway_namespace}}.svc.cluster.local"`. The
	# {{local_gateway_namespace}} is optional; when it is omitted, the system
	# will search for the local gateway in the serving system namespace
	# `knative-serving`
	local-gateway.knative-serving.knative-local-gateway: "knative-local-gateway.istio-system.svc.cluster.local"

	# If true, knative will use the Istio VirtualService's status to determine
	# endpoint readiness. Otherwise, probe as usual.
	# NOTE: This feature is currently experimental and should not be used in production.
	enable-virtualservice-status: "false"

	---
	# Allows the Webhooks to be reached by kube-api with or without
	# sidecar injection and with mTLS PERMISSIVE and STRICT.
	apiVersion: "security.istio.io/v1beta1"
	kind: "PeerAuthentication"
	metadata:
	name: "webhook"
	namespace: "serving"
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	matchLabels:
	app: webhook
	portLevelMtls:
	"8443":
	mode: PERMISSIVE
	---
	apiVersion: "security.istio.io/v1beta1"
	kind: "PeerAuthentication"
	metadata:
	name: "domainmapping-webhook"
	namespace: "serving"
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	matchLabels:
	app: domainmapping-webhook
	portLevelMtls:
	"8443":
	mode: PERMISSIVE
	---
	apiVersion: "security.istio.io/v1beta1"
	kind: "PeerAuthentication"
	metadata:
	name: "net-istio-webhook"
	namespace: "serving"
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	matchLabels:
	app: net-istio-webhook
	portLevelMtls:
	"8443":
	mode: PERMISSIVE

	---
	# Copyright 2019 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: apps/v1
	kind: Deployment
	metadata:
	name: net-istio-controller
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	matchLabels:
	app: net-istio-controller
	template:
	metadata:
	annotations:
	cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
	# This must be outside of the mesh to probe the gateways.
	# NOTE: this is allowed here and not elsewhere because
	# this is the Istio controller, and so it may be Istio-aware.
	sidecar.istio.io/inject: "false"
	labels:
	app: net-istio-controller
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	spec:
	serviceAccountName: controller
	containers:
	- name: controller
	# This is the Go import path for the binary that is containerized
	# and substituted here.
	image: gcr.io/knative-releases/knative.dev/net-istio/cmd/controller@sha256:812673b9127af530272fdeb584f91486e8f7b4ef1ea49f5b43805560f8ca6986
	resources:
	requests:
	cpu: 30m
	memory: 40Mi
	limits:
	cpu: 300m
	memory: 400Mi
	env:
	- name: SYSTEM_NAMESPACE
	valueFrom:
	fieldRef:
	fieldPath: metadata.namespace
	- name: CONFIG_LOGGING_NAME
	value: config-logging
	- name: CONFIG_OBSERVABILITY_NAME
	value: config-observability
	- name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID
	value: "false"
	# TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
	- name: METRICS_DOMAIN
	value: knative.dev/net-istio
	securityContext:
	allowPrivilegeEscalation: false
	readOnlyRootFilesystem: true
	runAsNonRoot: true
	capabilities:
	drop:
	- all
	ports:
	- name: metrics
	containerPort: 9090
	- name: profiling
	containerPort: 8008

	# Unlike other controllers, this doesn't need a Service defined for metrics and
	# profiling because it opts out of the mesh (see annotation above).

	---
	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: apps/v1
	kind: Deployment
	metadata:
	name: net-istio-webhook
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	selector:
	matchLabels:
	app: net-istio-webhook
	role: net-istio-webhook
	template:
	metadata:
	annotations:
	cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
	labels:
	app: net-istio-webhook
	role: net-istio-webhook
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	spec:
	serviceAccountName: controller
	containers:
	- name: webhook
	# This is the Go import path for the binary that is containerized
	# and substituted here.
	image: gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook@sha256:6f5032b1db2ecea984b713613f2af8b7aed9c4cd1bc033f208720b7d035f81f4
	resources:
	requests:
	cpu: 20m
	memory: 20Mi
	limits:
	cpu: 200m
	memory: 200Mi
	env:
	- name: SYSTEM_NAMESPACE
	valueFrom:
	fieldRef:
	fieldPath: metadata.namespace
	- name: CONFIG_LOGGING_NAME
	value: config-logging
	- name: CONFIG_OBSERVABILITY_NAME
	value: config-observability
	# TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
	- name: METRICS_DOMAIN
	value: knative.dev/net-istio
	- name: WEBHOOK_NAME
	value: net-istio-webhook
	securityContext:
	allowPrivilegeEscalation: false
	ports:
	- name: metrics
	containerPort: 9090
	- name: profiling
	containerPort: 8008
	- name: https-webhook
	containerPort: 8443

	---
	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: v1
	kind: Secret
	metadata:
	name: net-istio-webhook-certs
	namespace: serving
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio

	---
	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: v1
	kind: Service
	metadata:
	name: net-istio-webhook
	namespace: serving
	labels:
	role: net-istio-webhook
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	spec:
	ports:
	# Define metrics and profiling for them to be accessible within service meshes.
	- name: http-metrics
	port: 9090
	targetPort: 9090
	- name: http-profiling
	port: 8008
	targetPort: 8008
	- name: https-webhook
	port: 443
	targetPort: 8443
	selector:
	app: net-istio-webhook

	---
	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: admissionregistration.k8s.io/v1
	kind: MutatingWebhookConfiguration
	metadata:
	name: webhook.istio.networking.internal.knative.dev
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	webhooks:
	- admissionReviewVersions:
	- v1
	- v1beta1
	clientConfig:
	service:
	name: net-istio-webhook
	namespace: serving
	failurePolicy: Fail
	sideEffects: None
	objectSelector:
	matchExpressions:
	- {key: "serving.knative.dev/configuration", operator: Exists}
	name: webhook.istio.networking.internal.knative.dev

	---
	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: admissionregistration.k8s.io/v1
	kind: ValidatingWebhookConfiguration
	metadata:
	name: config.webhook.istio.networking.internal.knative.dev
	labels:
	app.kubernetes.io/component: net-istio
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/version: "1.5.0"
	networking.knative.dev/ingress-provider: istio
	webhooks:
	- admissionReviewVersions:
	- v1
	- v1beta1
	clientConfig:
	service:
	name: net-istio-webhook
	namespace: serving
	failurePolicy: Fail
	sideEffects: None
	name: config.webhook.istio.networking.internal.knative.dev
	objectSelector:
	matchLabels:
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/component: net-istio

	---

	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: apiextensions.k8s.io/v1
	kind: CustomResourceDefinition
	metadata:
	creationTimestamp: null
	labels:
	eventing.knative.dev/release: "v1.5.1"
	eventing.knative.dev/source: "true"
	duck.knative.dev/source: "true"
	knative.dev/crd-install: "true"
	app.kubernetes.io/version: "1.5.1"
	app.kubernetes.io/name: knative-eventing
	annotations:
	# TODO add schemas and descriptions
	registry.knative.dev/eventTypes: \|
	[
	{ "type": "dev.knative.apiserver.resource.add" },
	{ "type": "dev.knative.apiserver.resource.delete" },
	{ "type": "dev.knative.apiserver.resource.update" },
	{ "type": "dev.knative.apiserver.ref.add" },
	{ "type": "dev.knative.apiserver.ref.delete" },
	{ "type": "dev.knative.apiserver.ref.update" }
	]
	name: apiserversources.sources.knative.dev
	spec:
	group: sources.knative.dev
	versions:

	# Copyright 2020 The Knative Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# https://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	apiVersion: apiextensions.k8s.io/v1
	kind: CustomResourceDefinition
	metadata:
	name: certificates.networking.internal.knative.dev
	labels:
	app.kubernetes.io/name: knative-serving
	app.kubernetes.io/component: networking
	app.kubernetes.io/version: "1.5.0"
	knative.dev/crd-install: "true"
	spec:
	group: networking.internal.knative.dev
	versions:
	- name: v1alpha1
	served: true
	storage: true
	subresources:
	status: {}
	schema:
	openAPIV3Schema:
	type: object
	# this is a work around so we don't need to flush out the
	# schema for each version at this time
	#
	# see issue: https://github.com/knative/serving/issues/912
	x-kubernetes-preserve-unknown-fields: true
	additionalPrinterColumns:

Upgrade & Secure Your Future with DevOps, SRE, DevSecOps, MLOps!

Install Knative Components

1.1 Set up Knative Serving Resources

1.2 Set up KNative Eventing Resources

Set up Istio

1.1 Install istioctl version 1.12

1.2 Install Istio

1.3 Deploy Istio Resources ( istio-resources.yaml )

1.4 Check Istio setup

Certification Courses

1.1 Install `istioctl` version `1.12`

1.2 Install `Istio`

1.3 Deploy `Istio Resources` ( istio-resources.yaml )

1.4 Check `Istio setup`