Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive
On this page

Buying a Service Mesh

Updated on 2024-10-08 GMT+08:00

ASM allows you to buy a service mesh of the Basic edition, which is standard for commercial use. In a service mesh of the Basic edition, control plane components are deployed in a cluster for non-intrusive governance, grayscale releases, and traffic monitoring of services in the cluster. A service mesh of the Basic version supports Istio 1.8, 1.13, 1.15, and 1.18. It can manage only one cluster and a maximum of 200 pods.

Prerequisites

You have created a CCE cluster. If not, create one by referring to Buying a CCE Cluster.

Constraints

  • ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
  • Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
  • When you enable Istio for a cluster, you must enable port 7443 in the inbound direction of the security group to which the worker node belongs, for automatic sidecar injection and callback. If you use the default security group created by CCE, this port is automatically enabled. If you create a security group rule, manually enable port 7443 to ensure that sidecars can be automatically injected.

Procedure

  1. Log in to the ASM console.
  2. Click Buy Mesh in the upper right corner.
  3. Configure the following parameters.

    • Mesh Edition

      Only service meshes of the Basic edition are supported.

    • Mesh Name

      Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.

      Service mesh names under the same account must be unique and cannot be modified after creation.

    • Istio Version

      Select the Istio version supported by the service mesh.

    • Enable IPv6

      Conditions for enabling IPv4/IPv6 dual stack for a service mesh

      Service Mesh Edition

      Istio Version

      Cluster Type

      Cluster Network Type

      Remarks

      Basic edition

      1.18 or later

      CCE Turbo clusters

      Cloud native network 2.0

      To enable IPv6, see Creating an IPv4/IPv6 Dual-Stack Cluster in CCE.

      NOTE:
      • Enable IPv6 is only available in Istio 1.18 or later.
      • IPv4/IPv6 dual stack cannot be enabled for a service mesh that is upgraded to v1.18 or later.
      • Once IPv4/IPv6 dual stack is enabled for a service mesh, it cannot be disabled. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
    • Cluster

      Select the target cluster from the cluster list or enter the target cluster name in the upper right corner of the list to search for it. You can select only the clusters which versions are supported by the current mesh version.

    • Mesh Control Plane Node

      The control plane components of the service mesh of the Basic edition are installed in the user cluster. Therefore, you need to select the node for installing the service mesh control plane. If HA is required, you can select two or more nodes from different AZs.

      The selected node is labeled with istio:master, and the components are scheduled to this node.

    • Observability Configuration
      • Application Metrics

        If this option is enabled, you can specify service access metrics, application topologies, and service health and SLO definitions in the service mesh.

        NOTE:

        Istio earlier than 1.18 can only work with Application Performance Management (APM) to monitor application metrics. Istio 1.18 or later can only work with Application Operations Management (AOM) to monitor application metrics. For details about how to view application metrics in AOM, see How Do I Query Application Metrics in AOM?

      • Access Logging

        If this option is enabled, you can query inter-service access records in the service mesh to locate exceptions. After enabling this option, you need to select the Log Tank Service (LTS) log group and log stream. Access logs will be transmitted to the log stream. You can view the access logs on the Monitoring Center > Access Logs page.

        NOTE:

        Only Istio 1.18 or later can work with LTS to collect and store access logs. To ensure logs are reported to LTS, install CCE Log-Agent on the Add-ons page in advance.

      • Tracing

        - Sampling Rate: Number of requests generated by the tracing service/Total number of requests

        - Version: tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.

        NOTE:
        • Only Istio 1.15 or later support the third-party tracing service.
        • If you want to use the third-party Jaeger or Zipkin service, install it first. You can also install it by referring to How Do I Connect a Service Mesh to Jaeger or Zipkin for Viewing Traces? Then, obtain the service address.
        • The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace Service Port with the actual value.

  4. (Optional) Configure advanced settings.

    • Namespace Injection Settings

      Select a namespace and label it with istio-injection=enabled. All pods in the namespace will be injected with an istio-proxy sidecar.

      You can inject a sidecar in Mesh Configuration > Sidecar Management after the mesh is created. For details, see Injecting a Sidecar.

    • Restart Existing Services

      : Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.

      : The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar.

    • Traffic Interception Settings
      NOTE:

      By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.

      Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.

      • Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
      • Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.

      Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.

      • Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
      • Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.

      Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.

      • Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
      • Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
    • Resource Tags

      Enter the tag key and tag value. A maximum of 20 tags can be added.

  5. Review the service mesh configuration in Configuration List on the right of the page and click Submit.

    It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.

    NOTE:

    An otel-collector workload is automatically created when a service mesh is created. For details, see otel-collector Functions.

    When the service mesh is enabled, the following operations are performed:

    • Helm orchestrates the application into a Release as the resource of the service mesh control plane.
    • A security group is enabled for the nodes to allow the inbound traffic for port 7443 to support automatic sidecar injection.

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback