What's New

1

Istio-CNI

From ASM 1.18 (Basic edition) and later versions, the Istio-CNI add-on will be enabled by default.
In ASM 1.15 and earlier versions, the istio-init container is injected into pods by default, and the NET_ADMIN and NET_RAW permissions are used to configure iptables rules in the network namespace.
With Istio-CNI enabled, the istio-init container is no longer injected into pods. Once a service mesh is created, the DaemonSet istio-cni-node is deployed in the istio-system namespace of the cluster by default. The DaemonSet installs and configures the add-on on each node in the cluster. When a pod is created, kubelet executes the add-on so that iptables rules can be configured to redirect traffic. As a result, the NET_ADMIN and NET_RAW permissions are no longer required, which improves security.

Istio-CNI is only available in ASM 1.18 and later versions.

Open beta testing

Istio / Install Istio with the Istio CNI plugin

2

ASM of the Basic edition supports Istio 1.18.5

ASM of the Basic edition supports Istio 1.18.5.

Open beta testing

ASM of the Basic edition supports Istio 1.18.5

3

IPv4/IPv6 dual stack

ASM of the Basic edition (Istio 1.18) supports IPv4/IPv6 dual stack.

Open beta testing

IPv4/IPv6 dual stack

4

Traffic interception settings

ASM of the Basic edition allows you to configure traffic interception policies to intercept or allow traffic from and to specified IP address ranges over specified ports for new service meshes. You can also modify the policies of existing service meshes.

Commercial use

Traffic interception settings

5

Istio 1.15.7

ASM of the Basic edition supports Istio 1.15.7-r1 where security vulnerabilities, such as CVE-2023-44487, CVE-2023-39325, and CVE-2023-27487, are fixed.

Commercial use

Istio 1.15.7

6

Interconnection with Jaeger/Zipkin

ASM of the Basic edition allows you to use Jaeger and Zipkin for distributed tracing across services.

Open beta testing

Interconnection with Jaeger/Zipkin

7

Access logging

ASM of the Basic edition can work with Huawei Cloud Log Tank Service (LTS) to collect and store access logs. If access logging is enabled, you can query key access records in a service mesh to locate exceptions.

Open beta testing

Access logging

1

Traffic management and security policy configuration

ASM of the Basic edition supports traffic management (retries, timeouts, connection pools, circuit breaking, load balancing, HTTP headers, and fault injection) and security policy configuration (access authorization and peer authentication).

Commercial use

Traffic Management Secure

Security

2

Istio 1.13.3

ASM of the Basic edition supports Istio 1.13.3.

Commercial use

Features in Istio 1.13

3

Resource configuration using YAML

You can create Istio resources on the console or using YAML for Istio resource management. To avoid configuration conflicts, you are advised to:
- Use console to maintain resources created on the console.
- Use YAML to maintain resources created using YAML.
If resources created on the console are modified using YAML, some functions on the console will be unavailable. 

Commercial use

Resource Configuration Using YAML

1

This is the first official release. ASM provides non-intrusive traffic management and grayscale release capabilities.

ASM is a service mesh platform developed by Huawei Cloud based on Istio. It is seamlessly interconnected with CCE and provides out-of-the-box usability, enhanced reliability, and visualized management.

Commercial use

What Is Application Service Mesh (ASM)?