Update:

We added nodeAffinity to istio-cni chart in upstream Istio and now we have to decide how we can expose this setting for customers. Ideas:
1) We can hardcode nodeAffinity + matchExpression + NotIn label maistra.io/exclude-cni
2) We allow to customize nodeAffinity by exposing it in spec.runtime...cni.nodeAfinity etc.

The second option looks more flexible, however, we deploy one istio-cni daemon set for all SMCPs, so it looks that the second option does not make sense.

Beside that we should plan testing scope.

First refinement:

istio-cni is currently deployed to all OCP nodes by default. This is necessary, as it needs to be present on every OCP node that runs OSSM workloads. Some customers, however, appear to be running OSSM on specific nodes only, and would like to be able to restrict the istio-cni pod to run only on the nodes that are also used to run OSSM workloads.

Acceptance Criteria:

• add nodeSelector to istio-cni chart to restrict the DaemonSet, to Nodes that don't have the label maistra.io/exclude-cni
• create OSSMDOCS ticket that explains how to opt-out nodes of CNI (by adding the label)

Original description:

Currently the istio-cni-node DaemonSet has kubernetes.io/os=linux set as nodeSelector. Meaning the DaemonSet will run on every OpenShift Container Platform 4 - Node of the OpenShift Container Platform 4 - Cluster.

In certain environments, OpenShift Container Platform 4 - Clusters may be segmented for different customer use-cases (via specific OpenShift Container Platform 4 - Node) where not every use-case will run and require OpenShift Service Mesh. Still, the istio-cni-node pod will run on each OpenShift Container Platform 4 - Node consuming unncessary resources (and thus generating unnecessary costs).

Based on this, it's required that the nodeSelector for the istio-cni-node DaemonSet can be configured by customers to restrict the DaemonSet to OpenShift Container Platform 4 - Node(s) that are part of the OpenShift Service Mesh.

That way resources can be saved as the components of OpenShift Service Mesh will only run where required and where components and projects part of the Mesh are operating.