:original_name: asm_01_0020.html

.. _asm_01_0020:

Creating a Service Mesh
=======================

ASM allows you to create a service mesh of the Basic edition, which is a standard service mesh available for commercial use.

Prerequisites
-------------

A CCE cluster is available.

Constraints
-----------

-  ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
-  Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.

Procedure
---------

#. Log in to the ASM console.

#. Click Create Mesh in the upper right corner.

#. Configure the following parameters.

   -  **Mesh Edition**

      Only service meshes of the Basic edition are supported.

   -  **Mesh Name**

      Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.

      Service mesh names under the same account must be unique and cannot be modified after creation.

   -  **Istio Version**

      Select the Istio version supported by the service mesh.

   -  **Enable IPv6**

      Determine whether to enable IPv6. This option is supported only in Istio 1.18 or later.

   -  **Cluster**

      Select the target cluster from the cluster list or enter the target cluster name in the upper right corner of the list to search for it. You can select only the clusters which versions are supported by the current mesh version.

   -  **Mesh Control Plane Node**

      To install the control plane components for the service mesh of the Basic edition in your cluster, you need to select a node for installation. If HA is required, you can select two or more nodes from different AZs.

      The selected node is labeled with **istio:master**, and the components are scheduled to this node.

   -  **Observability Configuration**

      -  **Application Metrics**

         If this option is enabled, you can build service access metrics, application topologies, and service health and SLO definitions in the service mesh.

      -  **Access Logging**

         If this option is enabled, you can query inter-service access records in the service mesh to locate exceptions. After enabling this option, you need to select the Log Tank Service (LTS) log group and log stream. Access logs will be transmitted to the log stream. You can view the access logs on the **Monitoring Center** > **Access Logs** page.

         .. note::

            -  Only Istio 1.18 or later can work with LTS to collect and store access logs. To ensure logs are reported to LTS, install CCE Log-Agent on the **Add-ons** page in advance.

      -  Tracing

         - **Sampling Rate**: Number of requests generated by the tracing/Total number of requests

         - **Version**: the tracing service. If you select **Third-party Jaeger/Zipkin service**, you need to set **Service Address** and **Service Port**, which indicate the address and port number used by the third-party tracing service to receive requests.

         .. note::

            -  Only Istio 1.15 or later support the third-party tracing service.
            -  If you want to use the third-party Jaeger or Zipkin service, install Jaeger or Zipkin first. Alternatively, you can obtain the service address after installing Jaeger or Zipkin by referring to section "Installing Jaeger/Zipkin" in the *FAQs*.
            -  The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace **Service Port** with the actual value.

#. (Optional) Configure advanced settings.

   -  **Sidecar Configuration**

      Select a namespace and label it with **istio-injection=enabled**. All pods in the namespace will be injected with an istio-proxy sidecar.

      You can inject a sidecar in **Mesh Configuration** > **Sidecar Management** after the mesh is created. For details, see :ref:`Injecting a Sidecar <asm_01_0041__section65931513505>`.

   -  **Restart Existing Services**

      |image1|: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The **istio-proxy** sidecar is automatically injected into the pods of the existing services.

      |image2|: The **istio-proxy** sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar.

   -  **Traffic Interception Settings**

      .. note::

         By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in **Traffic Interception Settings**.

      **Inbound Ports**: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.

      -  **Include only specified ports** means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.

      -  **Exclude only specified ports** means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.

      **Outbound Ports**: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.

      -  **Include only specified ports** means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.

      -  **Exclude only specified ports** means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.

      **Outbound IP Ranges**: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be excluded from redirection to the sidecar.

      -  **Include only specified IP ranges** means that the traffic from specified IP ranges will be redirected to the sidecar.

      -  **Exclude only specified IP ranges** means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.

   -  **Resource Tags**

      Enter the tag key and tag value. A maximum of 20 tags can be added.

#. Review the service mesh configuration in the **Configuration List** on the right of the page and click **Submit**.

   It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from **Installing** to **Running**, the service mesh is successfully created.

   .. note::

      When the service mesh is enabled, the following operations are performed:

      -  Helm orchestrates the application into a Release as the resource of the service mesh control plane.

.. |image1| image:: /_static/images/en-us_image_0000001920032153.png
.. |image2| image:: /_static/images/en-us_image_0000001494249996.png
