Buying a Service Mesh
ASM allows you to buy a Basic service mesh for commercial use. In a Basic service mesh, control plane components are deployed in a user cluster for non-intrusive service governance, grayscale releases, and traffic monitoring. A Basic service mesh supports Istio 1.8, 1.13, 1.15, and 1.18. It can manage only one cluster and a maximum of 200 pods.
Prerequisites
You have created a CCE cluster. If not, create one by referring to Buying a CCE Cluster.
Constraints
- ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
- The components of Istio 1.13 and 1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
- When you enable Istio for a cluster, port 7443 must be allowed in the inbound rules of the security group that master nodes and worker nodes belong to, for automatic sidecar injection using webhooks. If you use the default security group created by CCE, this port is automatically allowed. If you create a security group rule, manually allow port 7443 to ensure that sidecars can be automatically injected.
Procedure
- Log in to the ASM console.
- Click Buy Mesh in the upper right corner.
- Configure the following parameters.
- Mesh Edition
Only service meshes of the Basic edition are supported for commercial use.
- Mesh Name
Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
Service mesh names under the same account must be unique and cannot be modified after creation.
- Istio Version
Select the Istio version supported by the service mesh.
- Enable IPv6
Conditions for enabling IPv4/IPv6 dual stack for a service mesh
Service Mesh Edition
Istio Version
Cluster Type
Cluster Network Type
Remarks
Basic edition
1.18 or later
CCE Turbo clusters
Cloud Native Network 2.0
IPv6 needs to be enabled for a cluster. For details, see Creating an IPv4/IPv6 Dual-Stack Cluster in CCE.
For details, see Creating a Service Mesh with IPv4/IPv6 Dual Stack Enabled.
- Enable IPv6 is only available in Basic service meshes based on Istio 1.18 or later.
- IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- Cluster
Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for it. You can only select the clusters whose versions are supported by the current service mesh version.
- Mesh Control Plane Node
The control plane components of a Basic service mesh are installed in a user cluster. You need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.
A selected node will be labeled with istio:master, and the components will be scheduled to that node.
- Observability Configuration
- Application Metrics
If this option is enabled, you can specify service access metrics, application topologies, and service health and SLO definitions in the service mesh.
Istio earlier than 1.18 can only work with Application Performance Management (APM) to monitor application metrics. Istio 1.18 or later can only work with Application Operations Management (AOM) to monitor application metrics. For details about how to view application metrics in AOM, see How Do I Query Application Metrics in AOM?
- Access Logging
If this option is enabled, you can query inter-service access records in the service mesh to locate exceptions. After enabling this option, you need to select the Log Tank Service (LTS) log group and log stream. Access logs will be transmitted to the log stream. You can view the access logs on the Monitoring Center > Access Logs page.
Only Istio 1.18 or later can work with LTS to collect and store access logs. To ensure logs are reported to LTS, install CCE Log-Agent on the Add-ons page in advance.
- Tracing
Sampling Rate: Number of requests generated by the tracing service/Total number of requests
Version: tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.
- Only Istio 1.15 or later support the third-party tracing service.
- If you want to use the third-party Jaeger or Zipkin service, install it first. You can also install it by referring to How Do I Connect a Service Mesh to Jaeger or Zipkin for Viewing Traces? Then, obtain the service address.
- The default service ports of Jaeger and Zipkin are both 9411. If you create a custom service port during Jaeger or Zipkin installation, replace Service Port with the actual value.
- Application Metrics
- Mesh Edition
- (Optional) Configure advanced settings.
- Namespace Injection Settings
Select a namespace and label it with istio-injection=enabled. After being restarted, all pods in the namespace will be automatically injected with an istio-proxy sidecar.
If you do not configure namespace injection, you can inject a sidecar on the Sidecar Management tab (Mesh Configuration > Sidecar Management) after the service mesh is created. For details, see Injecting a Sidecar.
- Restart Existing Services
: The pods of existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecars can be automatically injected to the pods of existing services only after the pods are restarted.
: When you do not enable Restart Existing Services, the istio-proxy sidecars cannot be automatically injected into the pods of existing services. In this case, you need to manually restart the pods on the CCE console to inject the sidecars.
- Traffic Interception Settings
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
- Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.
- Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.
- Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
- Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
- Resource Tags
Enter the tag key and tag value. A maximum of 20 tags can be added.
- Namespace Injection Settings
- Review the service mesh configuration in Configuration List on the right of the page and click Submit.
It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.
An otel-collector workload is automatically created when a service mesh is created. For details, see otel-collector Functions.
When the service mesh is enabled, the following operations are performed:
- Helm orchestrates the application into a Release as the resource of the service mesh control plane.
- A security group is enabled for the nodes to allow the inbound traffic for port 7443 to support automatic sidecar injection.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot