Creating a Service Mesh
+ASM allows you to create a Basic service mesh for commercial use.
+Prerequisites
A CCE cluster is available.
+Constraints
- ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
- Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
Procedure
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters.
- Mesh Edition
Only service meshes of the Basic edition are supported for commercial use.
+ - Mesh Name
Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
+Service mesh names under the same account must be unique and cannot be modified after creation.
+ - Istio Version
Select the Istio version supported by the service mesh.
+ - Enable IPv6
Conditions for enabling IPv4/IPv6 dual stack for a service mesh
+ ++
+Service Mesh Edition
+Istio Version
+Cluster Type
+Cluster Network Type
+Remarks
+Basic edition
+1.18 or later
+CCE Turbo clusters
+Cloud native network 2.0
+To enable IPv6.
+For details, see How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled
++
- Enable IPv6 is only available in Basic service meshes based on Istio 1.18 or later.
- IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- Cluster
Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for it. You can only select the clusters whose versions are supported by the current service mesh version.
+ - Mesh Control Plane Node
The control plane components of the Basic service mesh are installed in the user cluster. Therefore, you need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.
+A selected node will be labeled with istio:master, and the components will be scheduled to that node.
+ - Observability Configuration
- Application Metrics
If this option is enabled, you can specify service access metrics, application topologies, and service health and SLO definitions in the service mesh.
+ - Tracing
- Sampling Rate: Number of requests generated by the tracing service/Total number of requests
+- Version: tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.
++ - Only Istio 1.15 or later support the third-party tracing service.
- If you want to use the third-party Jaeger or Zipkin service, install it first. Then, obtain the service address.
- The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace Service Port with the actual value.
- Application Metrics
- Mesh Edition
- (Optional) Configure advanced settings.
- Namespace Injection Settings
Select a namespace and label it with istio-injection=enabled. After being restarted, all pods in the namespace will be automatically injected with an istio-proxy sidecar.
+If you do not configure namespace injection, you can inject a sidecar on the Sidecar Management tab (Mesh Configuration > Sidecar Management) after the service mesh is created. For details, see Injecting a Sidecar.
+ - Restart Existing Services
+
: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
+
: The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. - Traffic Interception Settings+
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
+Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
+- Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.
+- Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.
+- Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
- Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
- Resource Tags
Enter the tag key and tag value. A maximum of 20 tags can be added.
+
- Namespace Injection Settings
- Review the service mesh configuration in Configuration List on the right of the page and click Submit.
It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.
++ When the service mesh is enabled, the following operations are performed:
+- Helm orchestrates the application into a Release as the resource of the service mesh control plane.
Sidecar Management
-On the Sidecar Management page, you can view information about all workloads injected with sidecars, perform sidecar injection, and configure sidecar resource limits.
-Injecting a Sidecar
You can view the namespace and cluster to which the injected sidecar belongs. If no sidecar has been injected or you need to inject sidecar for more namespaces, perform the following operations:
-- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane, choose Mesh Configuration. Then click the Sidecar Management tab.
- Click Sidecar Management, select a namespace, determine whether to restart the existing services, and click OK.
- Namespace: Select one or more namespaces. The system labels the namespaces with istio-injection=enabled.
- Restart Existing Services
-
: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
+
: The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. Whether to restart existing services affects only existing services. If the namespaces are labeled with istio-injection=enabled, sidecars will be automatically injected into new pods.On the Sidecar Management tab, you can view information about all workloads injected with sidecars, inject sidecars, and configure sidecar resource limits.
+Injecting a Sidecar
You can view the namespace and cluster that the injected sidecar belongs to. If no sidecar has been injected or you need to inject sidecars for more namespaces, perform the following operations:
+- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane, choose Mesh Configuration. Then, click the Sidecar Management tab.
- Click Sidecar Management, select a namespace, determine whether enable Restart Existing Services, and click OK.
Parameter description:
+- Namespace: Select one or more namespaces. The system adds labels for namespaces based on Istio versions.
- istio-injection=enabled can be used in Istio 1.13.9-r3 and earlier versions, as well as Istio 1.15.5-r2 and earlier versions.
- istio.io/rev=<revision> can be used in Istio later than 1.13.9-r3, Istio later than 1.15.5-r2, and all Istio 1.18 versions.
- Restart Existing Services
+: Enabling Restart Existing Services will restart the associated pods and temporarily interrupt your services. New pods will have istio-proxy sidecars automatically injected.- If you select a new namespace, an automatic injection label is added. After all pods running the Deployment in that namespace are restarted, the istio-proxy sidecars will be automatically injected into new pods.
- If you deselect a namespace, the automatic injection label is deleted. After all pods running the Deployment in that namespace are restarted, new pods do not have istio-proxy sidecars.
- If there are pods that are not injected with sidecars in selected namespaces, all pods running the Deployment will be restarted to inject sidecars. If all pods have sidecars injected, the pods will not be restarted.
: When you do not enable Restart Existing Services, the istio-proxy sidecars cannot be automatically injected into the associated pods. You need to manually restart the workload on the CCE console to inject sidecars. This parameter affects only existing services. If the namespaces are labeled with istio-injection=enabled, sidecars will be automatically injected into new pods. - Traffic Interception Settings
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
diff --git a/docs/asm/umn/asm_01_0063.html b/docs/asm/umn/asm_01_0063.html index ac2f3255..62b29842 100644 --- a/docs/asm/umn/asm_01_0063.html +++ b/docs/asm/umn/asm_01_0063.html @@ -3,13 +3,26 @@All Pods Have Sidecars Injected
-Description
An istio-proxy container must exist in all pods of a Service. Otherwise, this item is abnormal.
Rectification Guide
- Log in to the ASM console and click the name of the service mesh that the Service is added to. Choose Mesh Configuration in the navigation pane, click the Sidecar Management tab, and check whether a sidecar is injected into the namespace that the Service belongs to. -
- Inject a sidecar.
You can inject sidecars for pods of all workloads in the namespace. For details, see Injecting a Sidecar. You can also inject sidecars for a workload as follows:
-- Label the namespace where the workload is located with istio-injection=enabled.
kubectl label ns <namespace> istio-injection=enabled
- - Add the annotations field for the workload on the CCE console.
annotations: +
Rectification Guide
- Log in to the ASM console and click the name of the service mesh that the Service is added to. Choose Mesh Configuration in the navigation pane, click the Sidecar Management tab, and check whether a sidecar is injected into the namespace that the Service belongs to.
- If the sidecar is not injected into the namespace, go to 2.
- If the sidecar has been injected into the namespace, go to 3.
Check method:
+On the CCE console, click the cluster name to access the cluster console. In the navigation pane, choose Namespaces. On the displayed page, locate your namespace and click Edit YAML in the Operation column. If there is the istio.io/rev=<revision> or istio-injection=enabled label, the sidecar has been injected.
++ - There must the istio-injection=enabled label for Istio 1.13.9-r3 and earlier versions, as well as Istio 1.15.5-r2 and earlier versions. Note that the version numbers are combined by hyphens (-).
- There must be the istio.io/rev=<revision> label for Istio later than 1.13.9-r3, Istio later than 1.15.5-r2, and all Istio 1.18 versions. Note that the version numbers are combined by hyphens (-).
+
- Inject a sidecar into a workload or inject sidecars into the pods of all workloads in the namespace. For details, see Injecting a Sidecar.
Injection methods:
+- To inject sidecars into the pods of all workloads in the namespace, run the following command to add a label to the namespace (the label varies depending on the Istio version):
kubectl label ns <namespace> istio-injection=enabled
+Or
+kubectl label ns <namespace> istio.io/rev=<revision>
++ The system adds labels for namespaces based on Istio versions.+- istio-injection=enabled can be used in Istio 1.13.9-r3 and earlier versions, as well as Istio 1.15.5-r2 and earlier versions.
- istio.io/rev=<revision> can be used in Istio later than 1.13.9-r3, Istio later than 1.15.5-r2, and all Istio 1.18 versions.
- To inject sidecars into the pods of all workloads in the namespace, run the following command to add a label to the namespace (the label varies depending on the Istio version):
For more details about sidecar injection, see Installing the Sidecar.
- If namespace injection is enabled for the cluster but no sidecar is injected into the pod, you need to manually restart the pod on the CCE console as follows:
On the CCE console, choose More > Redeploy in the Operation column of the target workload.
- Check whether the host network mode is configured for the workload as follows:
On the CCE console, choose More > Edit YAML in the Operation column of the target workload, and check whether spec.template.spec.hostNetwork: true is configured. If yes, check whether this field can be deleted or set to false. Otherwise, sidecars cannot be injected.
diff --git a/docs/asm/umn/asm_01_0084.html b/docs/asm/umn/asm_01_0084.html deleted file mode 100644 index 05c180e6..00000000 --- a/docs/asm/umn/asm_01_0084.html +++ /dev/null @@ -1,84 +0,0 @@ - - -Creating a Service Mesh
--ASM allows you to create a Basic service mesh for commercial use.
--Prerequisites
A CCE cluster is available.
--Constraints
- ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
- Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
-Procedure
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters.
- Mesh Edition
Only service meshes of the Basic edition are supported for commercial use.
- - Mesh Name
Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
-Service mesh names under the same account must be unique and cannot be modified after creation.
- - Istio Version
Select the Istio version supported by the service mesh.
- - Enable IPv6
Conditions for enabling IPv4/IPv6 dual stack for a service mesh
- --
-Service Mesh Edition
-Istio Version
-Cluster Type
-Cluster Network Type
-Remarks
-Basic edition
-1.18 or later
-CCE Turbo clusters
-Cloud native network 2.0
-To enable IPv6.
-For details, see How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled
-- - Enable IPv6 is only available in Basic service meshes based on Istio 1.18 or later.
- IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- Cluster
Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for it. You can only select the clusters whose versions are supported by the current service mesh version.
- - Mesh Control Plane Node
The control plane components of the Basic service mesh are installed in the user cluster. Therefore, you need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.
-A selected node will be labeled with istio:master, and the components will be scheduled to that node.
- - Observability Configuration
- Application Metrics
If this option is enabled, you can specify service access metrics, application topologies, and service health and SLO definitions in the service mesh.
- - Tracing
- Sampling Rate: Number of requests generated by the tracing service/Total number of requests
-- Version: tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.
-- - Only Istio 1.15 or later support the third-party tracing service.
- If you want to use the third-party Jaeger or Zipkin service, install it first. Then, obtain the service address.
- The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace Service Port with the actual value.
- Application Metrics
- Mesh Edition
- (Optional) Configure advanced settings.
- Namespace Injection Settings
Select a namespace and label it with istio-injection=enabled. After being restarted, all pods in the namespace will be automatically injected with an istio-proxy sidecar.
-You can inject a sidecar in Mesh Configuration > Sidecar Management after the mesh is created. For details, see Injecting a Sidecar.
- - Restart Existing Services
-: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
-: The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. - Traffic Interception Settings-
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
-Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
-- Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.
-- Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.
-- Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
- Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
- Resource Tags
Enter the tag key and tag value. A maximum of 20 tags can be added.
-
- Namespace Injection Settings
- Review the service mesh configuration in Configuration List on the right of the page and click Submit.
It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.
-- When the service mesh is enabled, the following operations are performed:
-- Helm orchestrates the application into a Release as the resource of the service mesh control plane.
-- diff --git a/docs/asm/umn/asm_01_0124.html b/docs/asm/umn/asm_01_0124.html index 5cad39f7..9f1d916d 100644 --- a/docs/asm/umn/asm_01_0124.html +++ b/docs/asm/umn/asm_01_0124.html @@ -1,7 +1,7 @@--Parent topic: Creating a Service Mesh-Features in v1.18
-- Istio 1.18 is supported.
- CCE Turbo clusters v1.25, v1.27, and v1.28 are supported.
- CCE clusters v1.25, v1.27, and v1.28 are supported.
- Kubernetes Gateway API is supported.
- Istio 1.18 is supported.
- CCE Turbo clusters v1.25, v1.27, v1.28, v1.29, and v1.30 are supported.
- CCE clusters v1.25, v1.27, v1.28, v1.29, and v1.30 are supported.
- Kubernetes Gateway API is supported.
For details, visit https://istio.io/latest/news/releases/1.18.x/.
diff --git a/docs/asm/umn/asm_faq_0044.html b/docs/asm/umn/asm_faq_0044.html index d3f43785..0c7bcfd5 100644 --- a/docs/asm/umn/asm_faq_0044.html +++ b/docs/asm/umn/asm_faq_0044.html @@ -21,7 +21,7 @@1.18
1.25,1.27, and 1.28
+1.25, 1.27, 1.28, 1.29, and 1.30
2024-10-12
+2024-12-02
+Added clusters v1.29 and v1.30.
+2024-10-12
- The following are modifications based on review comments:
- Added the "Upgrades" chapter.
- Updated the infographic of ASM.
diff --git a/docs/asm/umn/asm_productdesc_0004.html b/docs/asm/umn/asm_productdesc_0004.html index acd11042..fde9c8cb 100644 --- a/docs/asm/umn/asm_productdesc_0004.html +++ b/docs/asm/umn/asm_productdesc_0004.html @@ -16,14 +16,13 @@
1.18
v1.25, v1.27, or v1.28
+v1.25, v1.27, v1.28, v1.29, or v1.30
Containers on the node running Ubuntu 22.04 in a CCE Turbo cluster cannot be added to a service mesh earlier than v1.18.
-- Ubuntu 22.04
diff --git a/docs/asm/umn/asm_qs_0001_0.html b/docs/asm/umn/asm_qs_0001_0.html index 131cb936..c48bb2ff 100644 --- a/docs/asm/umn/asm_qs_0001_0.html +++ b/docs/asm/umn/asm_qs_0001_0.html @@ -27,12 +27,12 @@Constraints on Service Meshes
When you use service meshes for service governance, a Deployment can only match with one service to avoid abnormal grayscale release, gateway access, or other functions.
- Create a load balancer.
A load balancer will be used as the external access entry of a service mesh, which will route the traffic to backend services.
- Log in to the Elastic Load Balance (ELB) console.
- Click Create Elastic Load Balancer in the upper right corner.
- VPC and Subnet: Select the VPC and subnet created in 1, configure other parameters as prompted, and click Create Now.
- Create a cluster.
- Log in to the Cloud Container Engine (CCE) console.
- In the navigation pane, choose Resource Management > Clusters. Then, click Create CCE Cluster in the upper right corner.
- On the Configure page, configure the following parameters and retain the default values for other parameters.
- Cluster Name: Enter a cluster name, for example, cce-asm.
- VPC and Subnet: Select the VPC and subnet created in 1.
- Click Next: Create Node, configure the following parameters, and retain the default values for other parameters.
- Specifications: 4 vCPUs and 8 GiB of memory.
This is the minimum specifications for deploying Bookinfo.
+- Create a cluster.
- Log in to the Cloud Container Engine (CCE) console.
- In the navigation pane, choose Resource Management > Clusters. Then, click Create CCE Cluster in the upper right corner.
- On the Configure page, configure the following parameters and retain the default values for other parameters.
- Cluster Name: Enter a cluster name, for example, cce-asm.
- VPC and Subnet: Select the VPC and subnet created in 1.
- Click Next: Create Node, configure the following parameters, and retain the default values for other parameters.
- Specifications: 4 vCPUs and 8 GiB of memory.-
This is the minimum specifications for deploying Bookinfo.
- Login Mode: Select the key pair created in 2 for identity authentication upon remote node login.
- Specifications: 4 vCPUs and 8 GiB of memory.
- Click Next: Install Add-on and select the add-ons to be installed in the Install Add-on step.
System resource add-on must be installed. Advanced functional add-on is optional.
- - Click Next: Confirm. Read the product constraints and select I am aware of the above limitations. Review the configured parameters and specifications.
- Submit the order.
It takes about 6 to 10 minutes to create a cluster. You can click Back to Cluster List to perform other operations on the cluster or click Go to Cluster Events to view the cluster details.
+ - Login Mode: Select the key pair created in 2 for identity authentication upon remote node login. +
- Click Next: Install Add-on and select the add-ons to be installed in the Install Add-on step.
System resource add-on must be installed. Advanced functional add-on is optional.
+- Click Next: Confirm. Read the product constraints and select I am aware of the above limitations. Review the configured parameters and specifications.
- Submit the order.
It takes about 6 to 10 minutes to create a cluster. You can click Back to Cluster List to perform other operations on the cluster or click Go to Cluster Events to view the cluster details.
- Prepare the images required by Bookinfo (as shown in Table 1), push them to SWR and set their Type to Public.
diff --git a/docs/asm/umn/en-us_image_0000002086005592.png b/docs/asm/umn/en-us_image_0000002086005592.png new file mode 100644 index 00000000..d6265e25 Binary files /dev/null and b/docs/asm/umn/en-us_image_0000002086005592.png differ
The image name and tag of each service must be the same as those in Table 1. Otherwise, the experience task may fail.
- Create a cluster.
- Specifications: 4 vCPUs and 8 GiB of memory.
- Log in to the ASM console and click the name of the service mesh that the Service is added to. Choose Mesh Configuration in the navigation pane, click the Sidecar Management tab, and check whether a sidecar is injected into the namespace that the Service belongs to.
- Label the namespace where the workload is located with istio-injection=enabled.
- Namespace: Select one or more namespaces. The system adds labels for namespaces based on Istio versions.
