TSB Components
This page will explain in details TSB components and external dependencies that you have to provision and connect to be able to run TSB.
Before you continue, make sure you've:
✓ Checked TSB architecture and understood the four layers of TSB: data plane (envoy proxies), local control plane (Istio), global control plane (XCP) and management plane (TSB itself).
Management Plane
Following image shows Management Plane (MP) components
front-envoy port
The default Envoy Gateway (or front-envoy) port is 8443 and is user configurable (e.g. changed to 443). If default port is changed then components that communicate via front-envoy need to be adjusted accordingly to match the user-defined value.
front-envoy as Elasticsearch proxy
TSB front-envoy can act as proxy to Elasticsearch that is configured in ManagementPlane CR.
To use this, set elastic host and port to the TSB front-envoy host and port in the ControlPlane CR. Then traffic from control plane OAP to Elasticsearch will go through front-envoy.
There are two operators running in the management plane to manage lifecycles of the TSB components:
| Operator name | Description |
|---|---|
| TSB management plane operator | Operator to manage lifecycle of TSB components in the management plane. |
| XCP central operator | Operator to manage lifecycle of XCP central. TSB management plane operator deploys XCP operator and CRD for this operator, leaving up to them the management of XCP central. |
Following are the management plane components. Go to management plane install API for further reference.
| Component name | Description |
|---|---|
| envoy gateway (front-envoy) | Provides single entry point for TSB API and UI. |
| IAM | External authorization for front-envoy. IAM decides if incoming request to TSB API will be allowed or denied. |
| TSB API server | Core of TSB. Stores configurations that will be shipped to control planes. Uses NGAC for access decisions. Use PostgreSQL as backend storage. |
| Web UI | Provide UI components. Has BFF (Backend for Frontend) to help connecting to various TSB components (API server, OAP). |
| MPC (MP Controller) | Provide Bi-directional config and cluster state sync between TSB API and XCP central. |
| XCP central | Orchestrate multi-cluster discovery. Sends the configurations to all of the connected XCP Edges that run in the cluster. Receives cluster state and config status updates from XCP edges. This component is managed by XCP central operator. |
| OAP (SkyWalking) | Query point for UI to get aggregated metrics and traces from all clusters OAP. Use Elasticsearch as backend storage. |
| OTEL Collector | Scrapes metrics from different components in the management plane. Receives metrics from each control plane's OpenTelemetry (OTEL) collector. Note that OTEL Collector is strictly for TSB Components monitoring only, not your applications. |
| teamsync | Created when using LDAP and Azure AD as IdP. Fetches users and groups from IdP and syncs into TSB storage. |
| cert-manager | Created when using INTERNAL cert-manager. cert-manager provisions certificates for internal TSB components for purposes like webhook certificates. |
Control Plane
Following image shows Control Plane (CP) components along with Data Plane (DP).
There are four operators running in the control plane to manage lifecycles of the TSB components:
| Operator name | Description |
|---|---|
| TSB control plane operator | Operator to manage lifecycle of TSB control plane components. |
| XCP edge operator | Operator to manage lifecycle of XCP edge. TSB control plane operator deploys XCP operator and CRD for this operator, leaving up to them the management of XCP edge. |
| Istio Operator | Operator to manage lifecycle of Istio control plane. TSB control plane operator deploys Istio operator and CRD for this operator, leaving up to them the management of Istio components. |
| Onboarding Operator | Operator to manage lifecycle of components required to onboard VM workloads (also known as mesh expansion). |
Revisioned Control Plane
TSB 1.5 introduces Revisioned Control Plane. When you use revisioned control plane, Istio Operator is deployed by XCP edge operator instead of TSB control plane operator. To learn more about revisioned control plane, go to Istio Isolation Boundaries.
Following are the control plane components. Go to control plane install API for further reference.
| Component name | Description |
|---|---|
| XCP edge | Receive configurations from XCP central and translate to Istio configurations. Send updates to XCP central on config status and cluster inventory. Managed by XCP edge operator. |
| Istiod | Istio component that provides service discovery, configuration distribution to Envoy proxies and workload certificate management. Managed by Istio Operator. |
| OAP (SkyWalking) | Receives access logs and traces from all of the Istio sidecars and gateways in the cluster. Processes those access logs and generates metrics. Metrics and traces are sent to Elasticsearch. |
| OTEL Collector | Scrapes metrics from different TSB components in the control plane. Exports metrics to Prometheus exporter in the same pod and to Management plane OTEL collector via front envoy. Note that OTEL Collector is strictly for TSB Components monitoring only, not your applications. |
| SkyWalking HPA | Provides an external metrics adapter from which the Kubernetes Horizontal Pod Autoscaling (HPA) controller can retrieve metrics from. |
| Ratelimit server | Optional component that provides built-in ratelimiting capability. |
| VM Gateway | Deployed when mesh expansion is enabled. VM Gateway that provides connection to Istiod and OAP from sidecars running in VM. |
| Onboarding Plane | Deployed when mesh expansion is enabled. A component that the Onboarding Agent in the VM will connect to in order to onboard external mesh workload (e.g. workload running in VM) into the mesh. |
| Onboarding Repository | Deployed when mesh expansion is enabled. A HTTP server serving DEB and RPM packages of Onboarding Agent and Istio Sidecar. |
| cert-manager | Created when using INTERNAL cert-manager. cert-manager provisions certificates for internal TSB components for purposes like webhook certificates. |
Data Plane
Revisioned Control Plane
TSB 1.5 introduces Revisioned Control Plane. When you use revisioned control plane, Data plane operator is not required anymore to manage Istio gateways. To learn more about revisioned control plane, go to Istio Isolation Boundaries.
There are two operators running in data plane to manage lifecycles of the gateway deployment:
| Operator name | Description |
|---|---|
| TSB data plane operator | Operator to manage lifecycle of TSB data plane components. |
| Istio Operator | Operator to manage lifecycle of Istio Gateways based on Gateway CR specified in data plane install API |