// Module included in the following assemblies:
//
// * service_mesh/v2x/ossm-deployment-models.adoc

:_mod-docs-content-type: PROCEDURE
[id="ossm-config-individual-control-plane-infrastructure-node-console_{context}"]
= Configuring individual control plane components to run on infrastructure nodes using the web console

Perform this task if individual components deployed by the {SMProductShortName} control plane will run on infrastructure nodes. These deployed components include Istiod, the Ingress Gateway, and the Egress Gateway.

If the control plane will run on a worker node, skip this task.

.Prerequisites

* You have installed the {SMProductName} Operator.
ifndef::openshift-rosa,openshift-dedicated[]
* You are logged in to {product-title} as`cluster-admin`.
endif::openshift-rosa,openshift-dedicated[]
ifdef::openshift-rosa,openshift-dedicated[]
* You are logged in to {product-title} as a user with the `dedicated-admin` role.
endif::openshift-rosa,openshift-dedicated[]

.Procedure

. Log in to the {product-title} web console.

. Navigate to *Ecosystem* -> *Installed Operators*.

. Click the {SMProductName} Operator, and then click *Istio Service Mesh Control Plane*.

. Click the name of the control plane resource. For example, `basic`.

. Click *YAML*.

. Add the `nodeSelector` and `tolerations` fields to the `spec.runtime.components.pilot.pod` specification in the `ServiceMeshControlPlane` resource, as shown in the following example:
+
[source,yaml]
----
spec:
  runtime:
    components:
      pilot:
        pod:
          nodeSelector: <1>
            node-role.kubernetes.io/infra: ""
          tolerations: <2>
          - effect: NoSchedule
            key: node-role.kubernetes.io/infra
            value: reserved
          - effect: NoExecute
            key: node-role.kubernetes.io/infra
            value: reserved
----
<1> Ensures that the `Istiod` pod is only scheduled on an infrastructure node.
<2> Ensures that the pod is accepted by the infrastructure node for execution.

. Add the `nodeSelector` and the `tolerations` fields to the `spec.gateways.ingress.runtime.pod` and `spec.gateways.egress.runtime.pod` specifications in the `ServiceMeshControlPlane` resource, as shown in the following example:
+
[source,yaml]
----
spec:
  gateways:
    ingress:
      runtime:
        pod:
          nodeSelector: <1>
            node-role.kubernetes.io/infra: ""
          tolerations: <2>
          - effect: NoSchedule
            key: node-role.kubernetes.io/infra
            value: reserved
          - effect: NoExecute
            key: node-role.kubernetes.io/infra
            value: reserved
    egress:
      runtime:
        pod:
          nodeSelector: <1>
            node-role.kubernetes.io/infra: ""
          tolerations: <2>
          - effect: NoSchedule
            key: node-role.kubernetes.io/infra
            value: reserved
          - effect: NoExecute
            key: node-role.kubernetes.io/infra
            value: reserved
----
<1> Ensures that the gateway pod is only scheduled on an infrastructure node
<2> Ensures that the pod is accepted by the infrastructure node for execution.

. Click *Save*.

. Click *Reload*.
