Buying a Mesh

Prerequisites

You have created a CCE cluster. If not, create one by referring to Buying a CCE Cluster.

Constraints

• ASM depends on the domain name resolution capability of a cluster's CoreDNS. Before creating a mesh for a cluster, ensure that the cluster has abundant resources and CoreDNS is running properly.
• When you enable Istio for a cluster, you must enable port 7443 in the inbound direction of the security group to which the worker node belongs, for automatic sidecar injection and callback. If you use the default security group created by CCE, this port is automatically enabled. If you create a security group rule, manually enable port 7443 to ensure that sidecars can be automatically injected.

Procedure

1. Log in to the ASM console.
2. Click Buy Mesh in the upper right corner.
3. Configure the following parameters.
   Figure 1 Mesh parameters
   
   • Mesh Edition

     Only Basic mesh is supported.

   • Mesh Name

     Mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.

     Mesh names under the same account must be unique and cannot be modified after creation.

   • Istio Version

     Istio version supported by the mesh.

   • Cluster

     Select the target cluster from the cluster list or enter the target cluster name in the upper right corner of the list to search for it. You can select only the clusters which versions are supported by the current mesh version.

   • Mesh Control Plane Node

     The control plane components of the Basic mesh are installed in the user cluster. Therefore, you need to select the node for installing the mesh control plane. To achieve HA, select two or more nodes from different AZs.

     The selected nodes are labeled with istio:master, and the mesh components are scheduled to the nodes.

4. (Optional) Configure advanced settings.
   • Sidecar Configuration

     Select a namespace and label it with istio-injection=enabled. All pods in the namespace will be injected with an istio-proxy sidecar.

     You can inject a sidecar in Mesh Configuration > Sidecar Management after the mesh is created. For details, see Injecting a Sidecar.

   • Restart Existing Services

     : Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.

     : The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar.

5. Review the mesh configuration in the Configuration List on the right of the page and click Submit.

   It takes about 1 to 3 minutes to create a mesh. If the mesh status changes from Installing to Running, the mesh is successfully created.

   

   When the mesh is enabled, the following operations are performed:

   • Helm orchestrates the application into a Release as the resource of the mesh control plane.
   • A security group is enabled for the nodes to allow the inbound traffic for port 7443 to support automatic sidecar injection.