Configure CSI Driver with Istio in registry-only mode

When using Istio configured to REGISTRY_ONLY mode with the codeModulesImage field for CSI Driver, you need to apply additional configuration to ensure proper communication with the image registry.

Prerequisites

  • Istio is installed and configured in REGISTRY_ONLY mode.
  • Dynatrace CSI Driver is injected with Istio.
  • codeModulesImage field is specified in the CSI Driver configuration.

Configure ServiceEntry for CSI Driver

  1. Create a ServiceEntry.

    The ServiceEntry configuration allows the Dynatrace CSI Driver to communicate with the specified image registry. Without this configuration, the image pull process will fail. See an example of ServiceEntry for docker.io below.

    apiVersion: networking.istio.io/v1
    kind: ServiceEntry
    metadata:
      name: codemodules-docker-io
      namespace: dynatrace
    spec:
      hosts:
      - index.docker.io
      - auth.docker.io
      - production.cloudflare.docker.com
      location: MESH_EXTERNAL
      ports:
      - name: https-443
        number: 443
        protocol: HTTPS
      resolution: DNS

  2. Apply the ServiceEntry.

    Save and apply the above configuration to a file.

    kubectl apply -f serviceentry.yaml