Buying a Service Mesh

Prerequisites

You have created a CCE cluster. If not, create one by referring to Buying a CCE Cluster.

Constraints

• ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
• The components of Istio 1.13 and 1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
• When you enable Istio for a cluster, port 7443 must be allowed in the inbound rules of the security group that master nodes and worker nodes belong to, for automatic sidecar injection using webhooks. If you use the default security group created by CCE, this port is automatically allowed. If you create a security group rule, manually allow port 7443 to ensure that sidecars can be automatically injected.

Procedure

1. Log in to the ASM console.
2. Click Buy Mesh in the upper right corner.
3. Configure the following parameters.
   Figure 1 Service mesh parameters
   
   • Mesh Edition

     Only service meshes of the Basic edition are supported for commercial use.

   • Mesh Name

     Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.

     Service mesh names under the same account must be unique and cannot be modified after creation.

   • Istio Version

     Select the Istio version supported by the service mesh.

   • Cluster

     Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for it. You can only select the clusters whose versions are supported by the current service mesh version.

   • Mesh Control Plane Node

     The control plane components of a Basic service mesh are installed in a user cluster. You need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.

     A selected node will be labeled with istio:master, and the components will be scheduled to that node.

4. (Optional) Configure advanced settings.
   • Namespace Injection Settings

     Select a namespace and label it with istio-injection=enabled. After being restarted, all pods in the namespace will be automatically injected with an istio-proxy sidecar.

     If you do not configure namespace injection, you can inject a sidecar on the Sidecar Management tab (Mesh Configuration > Sidecar Management) after the service mesh is created. For details, see Injecting a Sidecar.

   • Restart Existing Services

     : The pods of existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecars can be automatically injected to the pods of existing services only after the pods are restarted.

     : When you do not enable Restart Existing Services, the istio-proxy sidecars cannot be automatically injected into the pods of existing services. In this case, you need to manually restart the pods on the CCE console to inject the sidecars.

   • Resource Tags

     Enter the tag key and tag value. A maximum of 20 tags can be added.

5. Review the service mesh configuration in Configuration List on the right of the page and click Submit.

   It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.

   

   When the service mesh is enabled, the following operations are performed:

   • Helm orchestrates the application into a Release as the resource of the service mesh control plane.
   • A security group is enabled for the nodes to allow the inbound traffic for port 7443 to support automatic sidecar injection.