Creating a Service Mesh
-ASM allows you to create a service mesh of the Basic edition, which is a standard service mesh available for commercial use.
-Prerequisites
A CCE cluster is available.
-Constraints
- ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
- Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
Procedure
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters.
- Mesh Edition
Only service meshes of the Basic edition are supported.
- - Mesh Name
Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
-Service mesh names under the same account must be unique and cannot be modified after creation.
- - Istio Version
Select the Istio version supported by the service mesh.
- - Enable IPv6
Determine whether to enable IPv6. This option is supported only in Istio 1.18 or later.
- - Cluster
Select the target cluster from the cluster list or enter the target cluster name in the upper right corner of the list to search for it. You can select only the clusters which versions are supported by the current mesh version.
- - Mesh Control Plane Node
To install the control plane components for the service mesh of the Basic edition in your cluster, you need to select a node for installation. If HA is required, you can select two or more nodes from different AZs.
-The selected node is labeled with istio:master, and the components are scheduled to this node.
- - Observability Configuration
- Application Metrics
If this option is enabled, you can build service access metrics, application topologies, and service health and SLO definitions in the service mesh.
- - Access Logging
If this option is enabled, you can query inter-service access records in the service mesh to locate exceptions. After enabling this option, you need to select the Log Tank Service (LTS) log group and log stream. Access logs will be transmitted to the log stream. You can view the access logs on the Monitoring Center > Access Logs page.
--
- Only Istio 1.18 or later can work with LTS to collect and store access logs. To ensure logs are reported to LTS, install CCE Log-Agent on the Add-ons page in advance.
- Tracing
- Sampling Rate: Number of requests generated by the tracing/Total number of requests
-- Version: the tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.
-- - Only Istio 1.15 or later support the third-party tracing service.
- If you want to use the third-party Jaeger or Zipkin service, install Jaeger or Zipkin first. Alternatively, you can obtain the service address after installing Jaeger or Zipkin by referring to section "Installing Jaeger/Zipkin" in the FAQs.
- The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace Service Port with the actual value.
- Application Metrics
- Mesh Edition
- (Optional) Configure advanced settings.
- Sidecar Configuration
Select a namespace and label it with istio-injection=enabled. All pods in the namespace will be injected with an istio-proxy sidecar.
-You can inject a sidecar in Mesh Configuration > Sidecar Management after the mesh is created. For details, see Injecting a Sidecar.
- - Restart Existing Services
-
: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
-
: The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. - Traffic Interception Settings-
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
-Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
-- Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.
-- Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be excluded from redirection to the sidecar.
-- Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
- Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
- Resource Tags
Enter the tag key and tag value. A maximum of 20 tags can be added.
-
- Sidecar Configuration
- Review the service mesh configuration in the Configuration List on the right of the page and click Submit.
It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.
-- When the service mesh is enabled, the following operations are performed:
-- Helm orchestrates the application into a Release as the resource of the service mesh control plane.
+
Mesh configuration provides cluster management, sidecar management, Istio resource management, and upgrade capabilities.
The mesh control plane workloads inject and manage sidecars of data plane pods, deliver policies and configurations, and collect monitoring data. Sidecars work with service containers in data plane pods, and they are in charge of routing and forwarding, traffic policy configuration, and monitoring data collection.
The functions of each tab page in Mesh Configuration are as follows:
-- Basic Information: You can view the mesh name, ID, status, edition, version, observability, creation time, and clusters with the mesh enabled.
- Sidecar Management: You can view information about all workloads injected with sidecars, perform sidecar injection, and configure sidecar resource limits. For details, see Sidecar Management.
- Istio Resource Management: You can view all Istio resources (such as VirtualService and DestinationRule), create Istio resources in YAML or JSON format, and modify existing Istio resources. For details, see Istio Resource Management.
- Upgrade: You can upgrade the version of a service mesh.
- Mesh extension: provides the observability configuration. For details, see Service Mesh Extension.
- Basic Information: You can view the mesh name, ID, status, edition, version, observability, creation time, and clusters with the mesh enabled.
- Sidecar Management: You can view information about all workloads injected with sidecars, perform sidecar injection, and configure sidecar resource limits. For details, see Sidecar Management.
- Istio Resource Management: You can view all Istio resources (such as VirtualService and DestinationRule), create Istio resources in YAML or JSON format, and modify existing Istio resources. For details, see Istio Resource Management.
- Upgrade: You can upgrade the version of a service mesh.
- Extensions: provides the observability configuration.
Maximum number of retries allowed for a single request. The default retry interval is 25 ms. The actual number of retries depends on the configured timeout period and retry timeout period.
1-2147483647
+1-4294967295
Retry Timeout (s)
@@ -75,14 +75,14 @@Maximum number of HTTP/TCP connections to the target service. The default value is 4294967295.
1-2147483647
+1-4294967295
Maximum Number of Non-responses
Maximum number of keepalive probes to be sent before the connection is determined to be invalid. By default, the OS-level configuration is used. (The default value is 9 for Linux.)
1-2147483647
+1-4294967295
Health Check Interval (s)
@@ -122,14 +122,14 @@Maximum number of requests that can be forwarded to a single service pod. The default value is 4294967295.
1-2147483647
+1-4294967295
Maximum Number of Pending Requests
Maximum number of HTTP requests that can be forwarded to the target service for processing. The default value is 4294967295.
1-2147483647
+1-4294967295
Maximum Connection Idle Period (s)
@@ -143,7 +143,7 @@Maximum number of retries of all service pods within a specified period. The default value is 4294967295.
1-2147483647
+1-4294967295
Maximum Number of Requests Per Connection
@@ -173,7 +173,7 @@Number of consecutive errors in a specified time period. If the number of consecutive errors exceeds the parameter value, the pod will be ejected. The default value is 5.
1-2147483647
+1-4294967295
Base Ejection Time (s)
diff --git a/docs/asm/umn/asm_01_0051.html b/docs/asm/umn/asm_01_0051.html deleted file mode 100644 index 1af62d6d..00000000 --- a/docs/asm/umn/asm_01_0051.html +++ /dev/null @@ -1,15 +0,0 @@ - - -Viewing Traffic Monitoring
-Scenario
In the traffic management window, you can view the traffic monitoring data of the last hour, including RPS, success rate, and request latency.
-Procedure
- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane, choose Service Management. In the upper right corner of the list, select the namespace that your services belong to.
- Locate the target service and click Manage Traffic in the Operation column. In the window that slides out from the right, view the traffic monitoring data of the last hour.Figure 1 Traffic monitoring-
- After real-time monitoring is enabled, data is dynamically refreshed every minute.
Changing a Traffic Policy
-Scenario
You can change the settings of a configured traffic policy. For example, you can change the load balancing algorithm from Round robin to Random.
+Scenarios
You can change the settings of a configured traffic policy. For example, you can change the load balancing algorithm from Round robin to Random.
Procedure
- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane, choose Service Management. Locate the service whose traffic policy needs to be modified and click Manage Traffic in the Operation column. In the window that slides out from the right, modify traffic policies.
Procedure
- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane on the left, choose Gateway Management and click Add Gateway.
- Configure the following parameters.
- Gateway Name
Enter a gateway name. Enter 4 to 59 characters starting with a lowercase letter and ending with a lowercase letter or digit. Only lowercase letters, digits, and hyphens (-) are allowed.
- Cluster
Select the cluster to which the gateway belongs.
- - Load Balancer
- Gateways use shared load balancers of ELB for the access over both public and private IPv4 networks.
- Listener
Gateways configure a listener for the load balancer, which listens to requests from the load balancer and distributes traffic.
+ - Load Balancer
- Gateways use shared and dedicated load balancers of ELB for the access over both public and private IPv4 networks.
- Access Entry
Gateways configure a listener for the load balancer, which listens to requests from the load balancer and distributes traffic.
- External Protocol
Select one to match the protocol type of your service. HTTP, gRPC, TCP, TLS, and HTTPS are supported.
- External Port
Enter the port number exposed in the Load Balancer Service address. The port number can be specified randomly.
- TLS Termination
If External Protocol is HTTPS, TLS Termination is enabled and cannot be disabled.
diff --git a/docs/asm/umn/asm_01_0057.html b/docs/asm/umn/asm_01_0057.html index 3079030a..65e809c1 100644 --- a/docs/asm/umn/asm_01_0057.html +++ b/docs/asm/umn/asm_01_0057.html @@ -1,7 +1,7 @@Adding a Route
-Scenario
You can add multiple routes and configure multiple forwarding policies for a created gateway.
+Scenarios
You can add multiple routes and configure multiple forwarding policies for a created gateway.
-Procedure
- Log in to the ASM console and click the name of the target service mesh to go to its details page.
- In the navigation pane on the left, choose Gateway Management, select the target gateway, click Add Route in the Operation column, and configure the following parameters:
- Domain Name
Enter the external domain name of the service. If this parameter is left blank, the IP address of the load balancer is used by default. If you enable TLS termination, enter a domain name configured in the certificate for SNI domain name verification.
- URL Matching Rule
- Prefix: A URL can be accessed if its prefix is the same as that you configure. For example, /healthz/v1 and /healthz/v2.
- Exact: Only the URL that fully matches the values you set can be accessed. For example, if the URL is set to /healthz, only /healthz can be accessed.
<protocol> can be http, tcp, or grpc. Istio provides routing capabilities based on protocols defined on ports. For example, name: http-service0 and name: tcp are valid port names, while name: httpforecast is not.
If the Service port name is invalid, this item is abnormal.
- Domain Name
diff --git a/docs/asm/umn/asm_01_0067.html b/docs/asm/umn/asm_01_0067.html index 6ec4f32c..cd15a921 100644 --- a/docs/asm/umn/asm_01_0067.html +++ b/docs/asm/umn/asm_01_0067.html @@ -3,7 +3,7 @@Rectification Guide
- Log in to the CCE console.
- Click the cluster name to go to the cluster console. In the navigation pane on the left, choose Services & Ingresses. On the Services tab, search for the Service by cluster name and namespace and click Edit YAML. Then, view the Service protocol and add a protocol type before the service name.
+
Rectification Guide
- Log in to the CCE console and click the cluster name to go to the cluster console.
- In the navigation pane, choose Services & Ingresses. Click the Service tab, search for the Service by cluster name and namespace, and click Edit YAML. Then, view the Service protocol and add a protocol type before the Service name.
- Click OK.
The Service Selector Cannot Contain version Labels
-Description
The spec.selector of a Service cannot be labeled with version. Otherwise, this item is abnormal.
diff --git a/docs/asm/umn/asm_01_0082.html b/docs/asm/umn/asm_01_0082.html new file mode 100644 index 00000000..d2c4feb1 --- /dev/null +++ b/docs/asm/umn/asm_01_0082.html @@ -0,0 +1,17 @@ + + +Rectification Guide
- Log in to the CCE console.
- Click the cluster name to go to the cluster console. In the navigation pane on the left, choose Services & Ingresses. On the Services tab, search for the Service by cluster name and namespace and click Edit YAML. Then, view the selector (specified by spec.selector) of the Service and delete the version label.
+
Rectification Guide
- Log in to the CCE console and click the cluster name to go to the cluster console.
- In the navigation pane, choose Services & Ingresses. Click the Service tab, search for the Service by cluster name and namespace, click Edit YAML. Then, view spec.selector and delete the version label.
Upgrades
+ +++ diff --git a/docs/asm/umn/asm_01_0084.html b/docs/asm/umn/asm_01_0084.html new file mode 100644 index 00000000..05c180e6 --- /dev/null +++ b/docs/asm/umn/asm_01_0084.html @@ -0,0 +1,84 @@ + + +-
+
- Features in v1.15
+
+ - Features in v1.18
+
+
++Parent topic: Mesh Configuration+Creating a Service Mesh
++ASM allows you to create a Basic service mesh for commercial use.
++Prerequisites
A CCE cluster is available.
++Constraints
- ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.
- Istio components v1.13 and v1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.
+Procedure
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters.
- Mesh Edition
Only service meshes of the Basic edition are supported for commercial use.
+ - Mesh Name
Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
+Service mesh names under the same account must be unique and cannot be modified after creation.
+ - Istio Version
Select the Istio version supported by the service mesh.
+ - Enable IPv6
Conditions for enabling IPv4/IPv6 dual stack for a service mesh
+ ++
+Service Mesh Edition
+Istio Version
+Cluster Type
+Cluster Network Type
+Remarks
+Basic edition
+1.18 or later
+CCE Turbo clusters
+Cloud native network 2.0
+To enable IPv6.
+For details, see How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled
++ - Enable IPv6 is only available in Basic service meshes based on Istio 1.18 or later.
- IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- Cluster
Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for it. You can only select the clusters whose versions are supported by the current service mesh version.
+ - Mesh Control Plane Node
The control plane components of the Basic service mesh are installed in the user cluster. Therefore, you need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.
+A selected node will be labeled with istio:master, and the components will be scheduled to that node.
+ - Observability Configuration
- Application Metrics
If this option is enabled, you can specify service access metrics, application topologies, and service health and SLO definitions in the service mesh.
+ - Tracing
- Sampling Rate: Number of requests generated by the tracing service/Total number of requests
+- Version: tracing service. If you select Third-party Jaeger/Zipkin service, you need to set Service Address and Service Port, which indicate the address and port number used by the third-party tracing service to receive requests.
++ - Only Istio 1.15 or later support the third-party tracing service.
- If you want to use the third-party Jaeger or Zipkin service, install it first. Then, obtain the service address.
- The default service ports of Jaeger and Zipkin are both 9411. If you customize the service port during Jaeger or Zipkin installation, replace Service Port with the actual value.
- Application Metrics
- Mesh Edition
- (Optional) Configure advanced settings.
- Namespace Injection Settings
Select a namespace and label it with istio-injection=enabled. After being restarted, all pods in the namespace will be automatically injected with an istio-proxy sidecar.
+You can inject a sidecar in Mesh Configuration > Sidecar Management after the mesh is created. For details, see Injecting a Sidecar.
+ - Restart Existing Services
+: Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
+: The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. - Traffic Interception Settings+
By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in Traffic Interception Settings.
+Inbound Ports: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.
+- Include only specified ports means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound Ports: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.
+- Include only specified ports means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.
- Exclude only specified ports means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.
Outbound IP Ranges: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.
+- Include only specified IP ranges means that the traffic from specified IP ranges will be redirected to the sidecar.
- Exclude only specified IP ranges means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.
- Resource Tags
Enter the tag key and tag value. A maximum of 20 tags can be added.
+
- Namespace Injection Settings
- Review the service mesh configuration in Configuration List on the right of the page and click Submit.
It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from Installing to Running, the service mesh is successfully created.
++ When the service mesh is enabled, the following operations are performed:
+- Helm orchestrates the application into a Release as the resource of the service mesh control plane.
++ diff --git a/docs/asm/umn/asm_01_0085.html b/docs/asm/umn/asm_01_0085.html index 1217a051..86da70c6 100644 --- a/docs/asm/umn/asm_01_0085.html +++ b/docs/asm/umn/asm_01_0085.html @@ -8,8 +8,6 @@++Parent topic: Creating a Service Mesh+- Configuring a Traffic Policy
-
- Viewing Traffic Monitoring
-- Changing a Traffic Policy
diff --git a/docs/asm/umn/asm_01_0086.html b/docs/asm/umn/asm_01_0086.html index 63855985..2ebf3880 100644 --- a/docs/asm/umn/asm_01_0086.html +++ b/docs/asm/umn/asm_01_0086.html @@ -1,15 +1,15 @@ -
Uninstalling a Mesh
-Scenario
When a mesh is no longer needed, you can uninstall it.
+Uninstalling a Service Mesh
+-Scenarios
If you no longer need a service mesh, you can uninstall it.
Constraints
- To uninstall a mesh in which a grayscale release task is running, you need to complete the grayscale release first.
- You need to ensure available nodes exist in the clusters for running the cleanup task to avoid uninstallation failure.
-Constraints
- To uninstall a service mesh in which a grayscale release task is running, you need to complete the grayscale release first.
- You need to ensure available nodes exist in the clusters for running the cleanup task to avoid uninstallation failure.
Procedure
- Log in to the ASM console.
- Click
in the target mesh. - On the dialogue box displayed, select whether to restart existing services and read the precautions.
By default, existing services are not restarted during the uninstallation. The injected istio-poxy sidecar is removed only after the existing services are restarted. If you want to restart the services, select Yes. Restarting the services will interrupt your services temporarily.
+diff --git a/docs/asm/umn/asm_01_0095.html b/docs/asm/umn/asm_01_0095.html new file mode 100644 index 00000000..ba7d6cd1 --- /dev/null +++ b/docs/asm/umn/asm_01_0095.html @@ -0,0 +1,12 @@ + + +Procedure
- Log in to the ASM console.
- Click in the service mesh.
- On the dialogue box displayed, select whether to restart existing services and read the precautions.
By default, existing services are not restarted during the uninstallation. The injected istio-poxy sidecar is removed only after the existing services are restarted. If you want to restart the services, select Yes. Restarting the services will interrupt your services temporarily.
- You are advised to restart existing services to avoid the following exceptions: If the cluster enables the current mesh again after it is uninstalled, gateway access failed.
- Uninstalling a mesh will uninstall its control plane components and data plane sidecars.
- After the uninstallation, service gateways of applications cannot be used. Configure Services for external access to applications.
To update the external access mode, log in to the CCE console and click the cluster name to go to the cluster console. Then, choose Services & Ingresses > Services.
- - Uninstalling a mesh will delete the labels of the mesh exclusive nodes, but the Istio-master node will not be automatically deleted. You can delete it on the CCE console.
To view node information, log in to the CCE console and click the cluster name to go to the cluster console. In the navigation pane on the left, choose Nodes > Nodes.
+- Uninstalling a service mesh will uninstall its control plane components and data plane sidecars.
- After the uninstallation, service gateways of applications cannot be used. Configure Services for external access to applications.
To update the external access mode, log in to the CCE console and click the cluster name to go to the cluster console. Then, choose Services & Ingresses > Services.
+ - Uninstalling a service mesh will delete the labels of the Istio exclusive nodes, but the Istio-master node will not be automatically deleted. You can delete it on the CCE console.
To view node information, log in to the CCE console and click the cluster name to go to the cluster console. In the navigation pane on the left, choose Nodes > Nodes.
Features in v1.15
++- Istio 1.15.7 is supported.
- CCE Turbo clusters v1.21, v1.23, v1.25, and v1.27 are supported.
- CCE clusters v1.21, v1.23, v1.25, and v1.27 are supported.
- Security vulnerabilities such as CVE-2023-44487, CVE-2023-39325 and CVE-2023-27487 are fixed.
For details, visit https://istio.io/latest/news/releases/1.15.x/announcing-1.15.7/.
+++ diff --git a/docs/asm/umn/asm_01_0097.html b/docs/asm/umn/asm_01_0097.html index 437d7795..ad8303d1 100644 --- a/docs/asm/umn/asm_01_0097.html +++ b/docs/asm/umn/asm_01_0097.html @@ -2,7 +2,7 @@++Parent topic: Upgrades+Authenticating JWT Requests on the Ingress Gateway Using ASM
This section describes how to authenticate JWT requests on the ingress gateway using ASM to ensure that users access services through the ingress gateway with a reliable access token.
-diff --git a/docs/asm/umn/asm_01_0123.html b/docs/asm/umn/asm_01_0123.html deleted file mode 100644 index 1eb02ecb..00000000 --- a/docs/asm/umn/asm_01_0123.html +++ /dev/null @@ -1,20 +0,0 @@ - - -Preparations
- A mesh of version 1.15 or 1.18 has been created.
- The httpbin service that passes the diagnosis exists in the mesh. The image is httpbin, the port protocol is HTTP, and the port number is 80.
- An accessible gateway has been created for the httpbin service in the mesh.
Preparations
- A service mesh of version 1.15 or 1.18 has been created.
- The httpbin service that passes the diagnosis exists in the mesh. The image is httpbin, the port protocol is HTTP, and the port number is 80.
- An accessible gateway has been created for the httpbin service in the mesh.
Creating JWT Authentication
- Create a JWK.
- Visit JWT tool website, set Algorithm to RS512, and obtain the public key (PUBLIC KEY).Figure 1 Generating a public key
- Select PEM-to-JWK (RSA Only) in the JWK to PEM Convertor online tool, enter the public key obtained in the previous step, and click submit to convert the public key into a JWK.Figure 2 Converting the public key to a JWK@@ -45,7 +45,7 @@ date: Wed, 21 Sep 2022 03:29:31 GMT server: istio-envoy x-envoy-upstream-service-time: 6
According to the preceding outputs, the request with the correct JWT token can access the service, and the request with an incorrect JWT token or without a JWT token cannot access the service, which indicate that the request identity authentication takes effect.
+According to the preceding outputs, the request with the correct JWT token can access the service, and the request with an incorrect JWT token or without a JWT token cannot access the service. This means the request identity authentication takes effect.
- Visit JWT tool website, set Algorithm to RS512, and obtain the public key (PUBLIC KEY).
Service Mesh Extension
--Observability configuration includes access logs, application metrics, and traces of the current service mesh. You can enable application metric collection and access logging.
-- Tracing can be enabled only when a service mesh is created.
--Constraints
Only Istio 1.18 or later can work with LTS to collect and store access logs. To enable access logging, install CCE Log-Agent on the Add-ons page in advance.
--Enabling Application Metrics
- Log in to the ASM console.
- Click the name of the service mesh to go to its details page.
- In the navigation pane, choose Mesh Configuration. Then click the tab for displaying service mesh extension.
- Enable application metrics, select an AOM instance, and click OK.
- -Enabling Access Logging
- Log in to the ASM console.
- Click the name of the service mesh to go to its details page.
- In the navigation pane, choose Mesh Configuration. Then click the tab for displaying service mesh extension.
- Enable access logging, select the log group and log stream, and click OK.
-- diff --git a/docs/asm/umn/asm_01_0124.html b/docs/asm/umn/asm_01_0124.html new file mode 100644 index 00000000..5cad39f7 --- /dev/null +++ b/docs/asm/umn/asm_01_0124.html @@ -0,0 +1,12 @@ + + +--Parent topic: Mesh Configuration-Features in v1.18
++- Istio 1.18 is supported.
- CCE Turbo clusters v1.25, v1.27, and v1.28 are supported.
- CCE clusters v1.25, v1.27, and v1.28 are supported.
- Kubernetes Gateway API is supported.
For details, visit https://istio.io/latest/news/releases/1.18.x/.
+++ diff --git a/docs/asm/umn/asm_01_0133.html b/docs/asm/umn/asm_01_0133.html index b00755cc..8498cf08 100644 --- a/docs/asm/umn/asm_01_0133.html +++ b/docs/asm/umn/asm_01_0133.html @@ -1,11 +1,11 @@ -++Parent topic: Upgrades+Mesh Events
-Scenario
ASM supports the event center, which allows you to query details about important operations such as mesh creation and deletion and gateway creation and deletion.
- You can view events in a mesh of the Basic edition (1.15 or later).
+Service Mesh Events
+-Scenarios
ASM supports the event center, which allows you to query details about important operations such as service mesh creation and deletion and gateway creation and deletion.
+ You can view events in a Basic service mesh (based on Istio 1.15 or later).
Procedure
- Log in to the ASM console and search for the mesh of the Basic edition by edition.
- Click
in the upper right corner. In the window that slides out from the right, view mesh events.
+diff --git a/docs/asm/umn/asm_bestpractice_1009.html b/docs/asm/umn/asm_bestpractice_1009.html index b6361203..454127fe 100644 --- a/docs/asm/umn/asm_bestpractice_1009.html +++ b/docs/asm/umn/asm_bestpractice_1009.html @@ -1,10 +1,10 @@ -Procedure
- Log in to the ASM console and search for the Basic service mesh by edition.
- Click in the upper right corner. In the window that slides out from the right, view service mesh events.
Creating a Service Mesh with IPv4/IPv6 Dual Stack Enabled
+How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled
You can create a CCE cluster with IPv4/IPv6 dual stack enabled and enable IPv4/IPv6 dual stack for the service mesh that the cluster is added to. IPv4/IPv6 dual stack allows services in the service mesh to use both IPv4 and IPv6 addresses for service-to-service interactions. After an IPv4/IPv6 dual-stack gateway is added for the service mesh, you can provide services for users using an IPv6 client. This section describes how you can create a service mesh with IPv4/IPv6 dual stack, so that services in the service mesh can communicate with each other using IPv6 addresses.
-Application Scenarios
- If an IPv6 address is required for service access and traffic management, you can enable IPv4/IPv6 dual stack.
- If you provide services for users who use IPv6 clients, you can create a gateway for a service mesh with IPv4/IPv6 dual stack enabled.
diff --git a/docs/asm/umn/asm_faq_0014.html b/docs/asm/umn/asm_faq_0014.html new file mode 100644 index 00000000..d240099d --- /dev/null +++ b/docs/asm/umn/asm_faq_0014.html @@ -0,0 +1,25 @@ + + +Constraints
- Constraints on enabling IPv4/IPv6 dual stack for a service mesh
Constraints
- Conditions for enabling IPv4/IPv6 dual stack for a service mesh
-Service Mesh Edition
- Constraints on creating an IPv4/IPv6 dual-stack gateway
- Conditions for creating an IPv4/IPv6 dual-stack gateway
-Service Mesh Edition
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- IPv4/IPv6 dual stack is only available for service meshes of v1.18 or later, but it cannot be enabled for a service mesh that is upgraded to v1.18 or later.
- Enable IPv6 is only available in Basic service meshes based on Istio 1.18 or later.
- IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.
- IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.
diff --git a/docs/asm/umn/asm_faq_0001_0.html b/docs/asm/umn/asm_faq_0001_0.html index 804c3710..93d7568b 100644 --- a/docs/asm/umn/asm_faq_0001_0.html +++ b/docs/asm/umn/asm_faq_0001_0.html @@ -12,6 +12,8 @@Creating a Service Mesh with IPv6 Addresses
- Log in to the ASM console, a service mesh, and configure the parameters as follows:
- Mesh Edition: Select Basic edition.
- Mesh Name: Enter a service mesh name.
- Istio Version: Select 1.18 or later.
- Enable IPv6: If this option is enabled, CCE clusters that meet the conditions will be displayed.
- Service Governance for Dubbo-based Applications
- - Creating a Service Mesh with IPv4/IPv6 Dual Stack Enabled
+ - How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled
- Performing Grayscale Release
+
- Monitoring Traffic
+Monitoring Traffic
+ +++ diff --git a/docs/asm/umn/asm_faq_0015.html b/docs/asm/umn/asm_faq_0015.html new file mode 100644 index 00000000..f481dd8e --- /dev/null +++ b/docs/asm/umn/asm_faq_0015.html @@ -0,0 +1,11 @@ + + +-
+
- Why Cannot I View Traffic Monitoring Data Immediately After a Pod Is Started?
+
+ - Why Are the Latency Statistics on the Dashboard Page Inaccurate?
+
+ - Why Is the Traffic Ratio Inconsistent with That in the Traffic Monitoring Chart?
+
+ - Why Can't I Find Certain Error Requests in Tracing?
+
+ - Why Cannot I Find My Service in the Traffic Monitoring Topology?
+
+ - How Do I Connect a Service Mesh to Jaeger or Zipkin for Viewing Traces?
+
+
++Parent topic: FAQs+Why Cannot I View Traffic Monitoring Data Immediately After a Pod Is Started?
++- Check whether APM has been enabled for the cluster.
- Traffic monitoring aggregates the collected data. Please wait for a minute for the data to be displayed on the Traffic Monitoring page.
++ diff --git a/docs/asm/umn/asm_faq_0016.html b/docs/asm/umn/asm_faq_0016.html new file mode 100644 index 00000000..09a39e18 --- /dev/null +++ b/docs/asm/umn/asm_faq_0016.html @@ -0,0 +1,11 @@ + + +++Parent topic: Monitoring Traffic+Why Are the Latency Statistics on the Dashboard Page Inaccurate?
++The latency statistics displayed on the Dashboard page are data of the services that have the highest latency among all the services in all the clusters of your account within the last one minute. Therefore, ensure that the service has been accessed within the last one minute.
+++ diff --git a/docs/asm/umn/asm_faq_0017.html b/docs/asm/umn/asm_faq_0017.html new file mode 100644 index 00000000..e2f3fdfc --- /dev/null +++ b/docs/asm/umn/asm_faq_0017.html @@ -0,0 +1,11 @@ + + +++Parent topic: Monitoring Traffic+Why Is the Traffic Ratio Inconsistent with That in the Traffic Monitoring Chart?
++The traffic ratio data is polled every 10 seconds, while the traffic monitoring data shows the traffic situation of the last 10 seconds.
+++ diff --git a/docs/asm/umn/asm_faq_0018.html b/docs/asm/umn/asm_faq_0018.html new file mode 100644 index 00000000..26dc6903 --- /dev/null +++ b/docs/asm/umn/asm_faq_0018.html @@ -0,0 +1,11 @@ + + +++Parent topic: Monitoring Traffic+Why Can't I Find Certain Error Requests in Tracing?
++For performance purposes, the sampling rate of tracing is 10%. That is, 10 of your 100 requests are recorded and displayed on the page.
+++ diff --git a/docs/asm/umn/asm_faq_0019.html b/docs/asm/umn/asm_faq_0019.html index ef4ae608..d5cd215c 100644 --- a/docs/asm/umn/asm_faq_0019.html +++ b/docs/asm/umn/asm_faq_0019.html @@ -4,7 +4,7 @@++Parent topic: Monitoring Traffic+-
-
- Why Cannot I Create a Mesh for My Cluster?
+ - Why Cannot I Create a Service Mesh for My Cluster?
- Why Are Exclusive Nodes Still Exist After Istio Is Uninstalled?
diff --git a/docs/asm/umn/asm_faq_0020.html b/docs/asm/umn/asm_faq_0020.html
index 1f035478..8f8a142e 100644
--- a/docs/asm/umn/asm_faq_0020.html
+++ b/docs/asm/umn/asm_faq_0020.html
@@ -1,11 +1,11 @@
- - Check the cluster version. Currently, only clusters of v1.15, v1.17, or v1.19 can be managed by meshes.
- Check your browser. Chrome is recommended. The button for mesh creation may be unavailable when you are using other browsers, such as Firefox, due to adaptation problems.
- Check the cluster version. Currently, only clusters v1.21 or later can be managed by service meshes.
- Check your browser. Chrome is recommended. The button for service mesh creation may be unavailable when you are using other browsers, such as Firefox, due to adaptation problems.
- Select a mesh, cluster, and namespace to monitor service traffic.
- Check whether the ICAgent collector is correctly installed in the cluster.
- Check whether the service has been added to the service mesh.
- Why Does a Service Mesh Remain in the Installing Status for a Long Time After I Enable It for a Cluster?
+ - Why Does a Service Mesh Remain in the Installing State for a Long Time After I Enable It for a Cluster?
- - Why Does a Service Mesh Remain in the Unready Status for a Long Time After I Uninstall It?
+ - Why Does a Service Mesh Remain in the Unready State for a Long Time After I Uninstall It?
- Log in to the CCE console. Click the cluster name to go to the cluster console. In the navigation pane on the left, choose App Templates.
- Click Releases and select the target cluster from the drop-down list. Check the releases and the latest events about uninstallation failure.
The Status of istio-master is Uninstallation Failed, and the following message is displayed.
+@@ -15,7 +15,7 @@ kubectl delete ClusterRoleBinding -n istio-system `kubectl get ClusterRoleBindin kubectl delete job -n istio-system `kubectl get job -n istio-system | grep istio | awk '{print $1}'` kubectl delete crd -n istio-system `kubectl get crd -n istio-system | grep istio | awk '{print $1}'` kubectl delete mutatingwebhookconfigurations -n istio-system `kubectl get mutatingwebhookconfigurations -n istio-system | grep istio | awk '{print $1}'` -Fault Diagnosis
- Log in to the CCE console. Click the cluster name to go to the cluster console. In the navigation pane, choose App Templates.
- Click Releases and select the target cluster from the drop-down list. Check the releases and the latest events about uninstallation failure.
The Status of istio-master is Uninstallation Failed, and the following message is displayed.
deletion failed with 1 error(s): clusterroles:rbac.authorization.k8s.io "istio-cleanup-secrets-istio-system" already exists
- Log in to the ASM console and uninstall the mesh again.
- Log in to the ASM console and uninstall the service mesh again.
- Log in to the CCE console and click the cluster name to go to the cluster console. Then, choose Workloads > Deployments.
- Locate the workload and click Edit YAML in the Operation column.
- Find the spec.template.metadata.annotations field and add sidecar.istio.io/inject: 'false'.
annotations: +
If sidecar injection is enabled for a namespace of a cluster, sidecars are automatically injected for the pods of all workloads in the namespace. To prevent sidecars from being injected for some workloads, perform the following operations:
+- Log in to the CCE console and click the cluster name to go to the cluster console. In the navigation pane, choose Workloads. Then, click the Deployments tab.
- Locate the workload and click Edit YAML in the Operation column.
- Locate the target field based on the service mesh version and add sidecar.istio.io/inject: 'false'.
- For service meshes earlier than 1.13Locate the spec.template.metadata.annotations field and add sidecar.istio.io/inject: 'false'.
annotations: sidecar.istio.io/inject: 'false'+
-
For more details about sidecar injection, see Automatic Sidecar Injection.
+
- For service meshes 1.13 or later:
Locate the spec.template.metadata.label field and add sidecar.istio.io/inject: 'false'.
+label: + sidecar.istio.io/inject: 'false'
+
+
For more details about sidecar injection, see Automatic Sidecar Injection.
- For service meshes earlier than 1.13
diff --git a/docs/asm/umn/asm_faq_0044.html b/docs/asm/umn/asm_faq_0044.html index 74e08f16..d3f43785 100644 --- a/docs/asm/umn/asm_faq_0044.html +++ b/docs/asm/umn/asm_faq_0044.html @@ -2,32 +2,32 @@How Do I Handle a Canary Upgrade Failure?
-There are many reasons for a canary upgrade failure. In case of a canary upgrade failure, you can use the following solutions to handle it.
-- Failed to check custom resource definitions (CRDs) before the upgrade.
Solution: New Istio version does not support some CRDs, including clusterrbacconfigs, serviceroles, servicerolebindings, and policies. If there are resources to be discarded in the current version, delete them before the upgrade.
+- Failed to check custom resource definitions (CRDs) before the upgrade.
Solution: New Istio version does not support some CRDs, including ClusterRbacConfigs, ServiceRoles, ServiceRoleBindings, and Policies. If there are resources to be discarded in the current version, delete them before the upgrade.
- Failed to check Istio gateway labels before the upgrade.
Solution: Configure Istio gateway labels (specified by matchLabels) in {app: istio-ingressgateway, istio: ingressgateway} format.
- Failed to check add-ons before the upgrade.
Solution: ASM 1.8 and later versions do not support the tracing, kiali, grafana, and prometheus add-ons. Uninstall the add-ons before the upgrade. You can install open-source add-ons or use APM.
- Failed to check the cluster status before the upgrade.
Solution: If the cluster is unavailable before the upgrade, do not perform the upgrade.
- Failed to query resources before the upgrade.
Solution: Prepare the required resources for the canary upgrade.
- Failed to check the cluster version before the upgrade.
Solution: Use the cluster version listed in the following table.
-Mesh Version
+-Service Mesh Version
Supported Cluster Version
1.15
1.21,1.23,1.25,1.27
+1.21, 1.23, 1.25, and 1.27
1.18
1.25,1.27,1.28,1.29
+1.25,1.27, and 1.28
- Failed to check the component affinity before the upgrade.
Solutions: If you upgrade Istio from a non-canary version to a canary version, ensure that there are at least twice as many nodes labeled with istio:master as there are istiod instances, and at least twice as many schedulable nodes as there are istio-ingressgateway or istio-egressgateway instances (depending on which one is larger). If such conditions are not met, add nodes to meet the scheduling requirements or set the anti-affinity of istiod, istio-ingressgateway, and istio-egressgateway to Preferred.
+- Failed to check the component affinity before the upgrade.
Solutions: If you upgrade Istio from a non-canary version to a canary version, ensure that there are at least twice as many nodes labeled with istio:master as there are istiod instances, and at least twice as many schedulable nodes as there are istio-ingressgateway or istio-egressgateway instances (depending on which one is larger). If such conditions are not met, add nodes to meet the scheduling requirements or set the anti-affinity of istiod, istio-ingressgateway, and istio-egressgateway to Preferred.
- Method 1: Add nodes labeled with istio:master on the CCE console.
- Solution 2: Edit the YAML file to modify the anti-affinity policy on the CCE console.
Alternatively, change the anti-affinity from Required to Preferred on the CCE console.
-- Failed to check the automatic namespace injection before the upgrade.
Solution: If there are pods in the namespace when you migrate mesh data from the Dedicated edition to the Basic edition, enable automatic injection for the namespace.
+- Failed to check the automatic namespace injection before the upgrade.
Solution: If there are pods in the namespace when you migrate service mesh data from the Dedicated edition to the Basic edition, enable automatic injection for the namespace.
diff --git a/docs/asm/umn/asm_faq_0049.html b/docs/asm/umn/asm_faq_0049.html new file mode 100644 index 00000000..78ae4ff2 --- /dev/null +++ b/docs/asm/umn/asm_faq_0049.html @@ -0,0 +1,95 @@ + + +How Do I Connect a Service Mesh to Jaeger or Zipkin for Viewing Traces?
++ASM can export traces to Jaeger or Zipkin. You can view them on the Jaeger or Zipkin UI. The following uses Zipkin as an example.
++Prerequisites
The cluster and namespace where Zipkin is to be installed have been specified.
++Procedure
- Create a Deployment named zipkin.
Log in to the CCE console and click the cluster name to go to the cluster console. In the navigation pane, choose Workloads. On the Deployments tab, click Create from YAML, and copy the following content to the YAML file:
+apiVersion: apps/v1 +kind: Deployment +metadata: + name: zipkin + namespace: monitoring +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app.kubernetes.io/instance: zipkin + app.kubernetes.io/name: zipkin + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + labels: + app.kubernetes.io/instance: zipkin + app.kubernetes.io/name: zipkin + spec: + automountServiceAccountToken: false + containers: + - env: + - name: STORAGE_TYPE + value: mem + image: openzipkin/zipkin-slim:latest # Community Zipkin image path. Ensure that you can access this path. + imagePullPolicy: IfNotPresent + name: zipkin + readinessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 9411 + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + cpu: 500m + memory: 4Gi + requests: + cpu: 100m + memory: 128Mi + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + terminationGracePeriodSeconds: 30
+The Deployment named zipkin is displayed on the Deployments tab. If the status of zipkin changes to Running, Zipkin has been installed in the monitoring namespace of the target cluster.
+ + + - Create a Service of the LoadBalancer type.
On the cluster console, choose Services & Ingresses in the navigation pane. On the Services tab, click Create Service. Then, configure the parameters as follows:
+- Service Name: Enter a name. zipkin is used as an example here.
- Service Type: Select LoadBalancer.
- Selector: Click Reference Workload Label. The label is automatically added.
- Ports: Configure the container port and Service port. 9411 is used as an example here.
Retain the default values for other parameters.
+ +The Service named zipkin is displayed on the Services tab.
+ ++
If you do not need to access the Zipkin UI, set Access Type to ClusterIP.
+ - Buy a service mesh and interconnect it with Zipkin.
Log in to the ASM console and click . In Cluster Configuration, select the cluster in 1. In Observability Configuration, enable tracing. Then, select Third-party Jaeger/Zipkin service for Version, set Service Address and Access Port, and configure other parameters as required.
+ + + - . After the deployment is complete, the services shown in the following figure are displayed on the Service Management page. +
- Access the productpage details page to trigger tracing.
Go to the service mesh details page. In the navigation pane, choose Service Management. On the displayed page, click the external address http://{IP address}:{Port number}/productpage of the productpage service.
+ - View the traces on the Zipkin UI at http://{Public IP address of the load balancer configured for zipkin}:{Access port of zipkin}/zipkin/.
++
You can obtain the IP address and port for logging in to the Zipkin client as follows:
+- IP address: Go to the console of the cluster where Zipkin is installed. In the navigation pane, choose Services & Ingresses. On the Services tab, view the public IP address of the load balancer configured for zipkin.
- Port: On the Services tab, view the access port of zipkin.
++ diff --git a/docs/asm/umn/asm_his_0001.html b/docs/asm/umn/asm_his_0001.html new file mode 100644 index 00000000..d5f9f5b9 --- /dev/null +++ b/docs/asm/umn/asm_his_0001.html @@ -0,0 +1,29 @@ + + +++Parent topic: Monitoring Traffic+Change History
++ ++ diff --git a/docs/asm/umn/asm_productdesc_0017.html b/docs/asm/umn/asm_productdesc_0017.html index eb5ea524..40ecb7db 100644 --- a/docs/asm/umn/asm_productdesc_0017.html +++ b/docs/asm/umn/asm_productdesc_0017.html @@ -2,7 +2,7 @@Infographic for ASM
-
+
diff --git a/docs/asm/umn/asm_qs_0001_0.html b/docs/asm/umn/asm_qs_0001_0.html index d610889d..131cb936 100644 --- a/docs/asm/umn/asm_qs_0001_0.html +++ b/docs/asm/umn/asm_qs_0001_0.html @@ -1,7 +1,7 @@Grayscale Release Practices of Bookinfo
-Application Service Mesh (ASM) is a service mesh platform developed based on Istio and seamlessly interconnects with Cloud Container Engine (CCE). With better usability, reliability, and visualization, ASM provides you with out-of-the-box features and enhanced user experience.
+Application Service Mesh (ASM) is a service mesh platform developed based on Istio and seamlessly interconnects with Cloud Container Engine (CCE). With better usability, reliability, and visualization, ASM provides you with out-of-the-box features and enhanced experience.
Introduction
Grayscale releases enable smooth iteration of software products in production environments. This section takes Bookinfo as an example to illustrate Istio-based service governance using ASM.
The grayscale release process of Bookinfo is as follows.
Figure 1 Grayscale release process of Bookinfo@@ -10,8 +10,8 @@
Bookinfo consists of four independent services developed in different languages. These services demonstrate the features of a typical service mesh. They are described as follows:
- productpage: calls the details and reviews services to generate a page.
- details: contains book information.
- reviews: contains book reviews and calls the ratings service.
- ratings: contains book rating information based on reviews.
The reviews service has three versions:
-- The v1 (1.5.0) version does not call the ratings service.
- The v2 (1.5.1) version calls the ratings service and uses one to five black stars to show ratings.
- The v3 (1.5.2) version calls the ratings service and uses one to five red stars to show ratings.
To demonstrate traffic switching between versions, this section takes 1.5.1 (rating with black stars) and 1.5.2 (rating with red stars) of the reviews service as examples.
+- v1 (1.17.0) does not call the ratings service.
- v2 (1.17.1) calls the ratings service and uses one to five black stars to show ratings.
- v3 (1.17.2) calls the ratings service and uses one to five red stars to show ratings.
To demonstrate traffic switching between versions, this section takes 1.17.1 (rating with black stars) and 1.17.2 (rating with red stars) of the reviews service as examples.
Figure 2 End-to-end architecture of Bookinfo
Running Bookinfo with ASM does not require any changes on the application itself. Simply configure and run the services in the ASM environment, that is, inject an Envoy sidecar into each service. Figure 3 shows the final deployment.
@@ -27,12 +27,12 @@- Create a load balancer.
A load balancer will be used as the external access entry of a service mesh, which will route the traffic to backend services.
- Log in to the Elastic Load Balance (ELB) console.
- Click Create Elastic Load Balancer in the upper right corner.
- VPC and Subnet: Select the VPC and subnet created in 1, configure other parameters as prompted, and click Create Now.
- Create a cluster.
- Log in to the Cloud Container Engine (CCE) console.
- In the navigation pane, choose Resource Management > Clusters. Then, click Create CCE Cluster in the upper right corner.
- On the Configure page, configure the following parameters and retain the default values for other parameters.
- Cluster Name: Enter a cluster name, for example, cce-asm.
- VPC and Subnet: Select the VPC and subnet created in 1.
- Click Next: Create Node, configure the following parameters, and retain the default values for other parameters.
- Specifications: 4 vCPUs and 8 GiB of memory.
This is the minimum specifications for deploying Bookinfo.
+- Create a cluster.
- Log in to the Cloud Container Engine (CCE) console.
- In the navigation pane, choose Resource Management > Clusters. Then, click Create CCE Cluster in the upper right corner.
- On the Configure page, configure the following parameters and retain the default values for other parameters.
- Cluster Name: Enter a cluster name, for example, cce-asm.
- VPC and Subnet: Select the VPC and subnet created in 1.
- Click Next: Create Node, configure the following parameters, and retain the default values for other parameters.
- Specifications: 4 vCPUs and 8 GiB of memory.-
This is the minimum specifications for deploying Bookinfo.
- Login Mode: Select the key pair created in 2 for identity authentication upon remote node login.
- Specifications: 4 vCPUs and 8 GiB of memory.
- Click Next: Install Add-on and select the add-ons to be installed in the Install Add-on step.
System resource add-on must be installed. Advanced functional add-on is optional.
- - Click Next: Confirm. Read the product constraints and select I am aware of the above limitations. Review the configured parameters and specifications.
- Submit the order.
It takes about 6 to 10 minutes to create a cluster. You can click Back to Cluster List to perform other operations on the cluster or click Go to Cluster Events to view the cluster details.
+ - Login Mode: Select the key pair created in 2 for identity authentication upon remote node login. +
- Click Next: Install Add-on and select the add-ons to be installed in the Install Add-on step.
System resource add-on must be installed. Advanced functional add-on is optional.
+- Click Next: Confirm. Read the product constraints and select I am aware of the above limitations. Review the configured parameters and specifications.
- Submit the order.
It takes about 6 to 10 minutes to create a cluster. You can click Back to Cluster List to perform other operations on the cluster or click Go to Cluster Events to view the cluster details.
- Prepare the images required by Bookinfo (as shown in Table 1), push them to SWR and set their Type to Public.
@@ -49,61 +49,61 @@ The image name and tag of each service must be the same as those in Table 1. Otherwise, the experience task may fail.
- Create a cluster.
- Specifications: 4 vCPUs and 8 GiB of memory.
examples-bookinfo-productpage-v1
1.5.0
+1.17.0
details
examples-bookinfo-details-v1
1.5.01.5.0
+1.17.01.17.0
ratings
examples-bookinfo-ratings-v1
1.5.01.5.0
+1.17.01.17.0
reviews
examples-bookinfo-reviews-v1
1.5.1
+1.17.1
examples-bookinfo-reviews-v1
1.5.2
+1.17.2
The following uses Bookinfo images as an example:
-- Prepare a computer that can access the Internet and has Docker 1.11.2 or later installed.
- Run the following commands in sequence to download the images required by Bookinfo:
docker pull docker.io/istio/examples-bookinfo-productpage-v1:1.5.0
-docker pull docker.io/istio/examples-bookinfo-details-v1:1.5.0
-docker pull docker.io/istio/examples-bookinfo-ratings-v1:1.5.0
-docker pull docker.io/istio/examples-bookinfo-reviews-v2:1.5.0
-docker pull docker.io/istio/examples-bookinfo-reviews-v3:1.5.0
- - Connect to SWR.
- Label the images pulled in 5.b. Ensure that the image names and tags are the same as those in Table 1.
docker tag docker.io/istio/examples-bookinfo-productpage-v1:1.5.0 swr.xxxxxxxxx./group/examples-bookinfo-productpage-v1:1.5.0
-docker tag docker.io/istio/examples-bookinfo-details-v1:1.5.0 swr.xxxxxxxxx./group/examples-bookinfo-details-v1:1.5.0
-docker tag docker.io/istio/examples-bookinfo-ratings-v1:1.5.0 swr.xxxxxxxxx./group/examples-bookinfo-ratings-v1:1.5.0
-docker tag docker.io/istio/examples-bookinfo-reviews-v2:1.5.0 swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.5.1
-docker tag docker.io/istio/examples-bookinfo-reviews-v3:1.5.0 swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.5.2
+- Prepare a computer that can access the Internet and has Docker 1.11.2 or later installed.
- Run the following commands in sequence to download the images required by Bookinfo:
docker pull docker.io/istio/examples-bookinfo-productpage-v1:1.17.0
+docker pull docker.io/istio/examples-bookinfo-details-v1:1.17.0
+docker pull docker.io/istio/examples-bookinfo-ratings-v1:1.17.0
+docker pull docker.io/istio/examples-bookinfo-reviews-v2:1.17.0
+docker pull docker.io/istio/examples-bookinfo-reviews-v3:1.17.0
+ - Connect to SWR.
- Label the images pulled in 5.b. Ensure that the image names and tags are the same as those in Table 1.
docker tag docker.io/istio/examples-bookinfo-productpage-v1:1.17.0 swr.xxxxxxxxx./group/examples-bookinfo-productpage-v1:1.17.0
+docker tag docker.io/istio/examples-bookinfo-details-v1:1.17.0 swr.xxxxxxxxx./group/examples-bookinfo-details-v1:1.17.0
+docker tag docker.io/istio/examples-bookinfo-ratings-v1:1.17.0 swr.xxxxxxxxx./group/examples-bookinfo-ratings-v1:1.17.0
+docker tag docker.io/istio/examples-bookinfo-reviews-v2:1.17.0 swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.17.1
+docker tag docker.io/istio/examples-bookinfo-reviews-v3:1.17.0 swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.17.2
swr.xxxxxxxxx. indicates the image repository address, and group indicates the organization name. Replace them with the actual values.
- - Push the images to the SWR.
docker push swr.xxxxxxxxx./group/examples-bookinfo-productpage-v1:1.5.0
-docker push swr.xxxxxxxxx./group/examples-bookinfo-details-v1:1.5.0
-docker push swr.xxxxxxxxx./group/examples-bookinfo-ratings-v1:1.5.0
-docker push swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.5.1
-docker push swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1..5.2
+ - Push the images to the SWR.
docker push swr.xxxxxxxxx./group/examples-bookinfo-productpage-v1:1.17.0
+docker push swr.xxxxxxxxx./group/examples-bookinfo-details-v1:1.17.0
+docker push swr.xxxxxxxxx./group/examples-bookinfo-ratings-v1:1.17.0
+docker push swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.17.1
+docker push swr.xxxxxxxxx./group/examples-bookinfo-reviews-v1:1.17.2
- Change the image type to Public.
- Failed to check the component affinity before the upgrade.
- Failed to check custom resource definitions (CRDs) before the upgrade.
Creating a Mesh
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters and retain the default values for other parameters.
- Mesh Edition
The default value is Basic edition.
- - Mesh Name
Enter the mesh name.
- - Istio Version
Select the Istio version supported by the mesh.
+Creating a Service Mesh
- Log in to the ASM console.
- Click Create Mesh in the upper right corner.
- Configure the following parameters and retain the default values for other parameters.
- Mesh Edition
The default value is Basic edition.
+ - Mesh Name
Enter the service mesh name.
+ - Istio Version
Select the Istio version supported by the service mesh.
- Cluster
Select the cluster created in 4.
- Mesh Control Plane Node
To achieve HA, select two or more nodes from different AZs.
- Mesh Edition
- Mesh Edition
Why Cannot I Create a Mesh for My Cluster?
-Symptom
I cannot create a mesh for my cluster.
+Why Cannot I Create a Service Mesh for My Cluster?
+-Symptom
I cannot create a service mesh for my cluster.
Analysis
Currently, clusters of versions earlier than 1.15 cannot be managed by meshes.
+-Analysis
Currently, clusters earlier than v1.21 cannot be managed by service meshes.
Solution
Solution
diff --git a/docs/asm/umn/asm_faq_0023.html b/docs/asm/umn/asm_faq_0023.html new file mode 100644 index 00000000..c6bf3886 --- /dev/null +++ b/docs/asm/umn/asm_faq_0023.html @@ -0,0 +1,11 @@ + + +Why Cannot I Find My Service in the Traffic Monitoring Topology?
++++ diff --git a/docs/asm/umn/asm_faq_0029.html b/docs/asm/umn/asm_faq_0029.html index bc261711..58028373 100644 --- a/docs/asm/umn/asm_faq_0029.html +++ b/docs/asm/umn/asm_faq_0029.html @@ -4,9 +4,9 @@++Parent topic: Monitoring Traffic+-
-
Why Does a Service Mesh Remain in the Installing Status for a Long Time After I Enable It for a Cluster?
-Symptom
After I create a service mesh (that is, create a Dedicated mesh) for a CCE cluster, the mesh remains in the installing status for a long time and a message is displayed, indicating that the user security group rules are successfully enabled.
+Why Does a Service Mesh Remain in the Installing State for a Long Time After I Enable It for a Cluster?
+Symptom
After I create a service mesh (that is, create a Dedicated service mesh) for a CCE cluster, it remains in the installing state for a long time and a message is displayed indicating that the user security group rules are successfully enabled.
Fault Diagnosis
Log in to the CCE console and click the cluster name to go to the cluster console. In the navigation pane, choose Namespaces. Then, check whether the istio-system namespace exists.
-Analysis
Residual istio-system namespaces exist.
Solution
Delete the residual istio-system namespaces and install the mesh again.
+Solution
Delete the residual istio-system namespaces and install the service mesh again.
diff --git a/docs/asm/umn/asm_faq_0031.html b/docs/asm/umn/asm_faq_0031.html index b0e7cf5e..bd7c0347 100644 --- a/docs/asm/umn/asm_faq_0031.html +++ b/docs/asm/umn/asm_faq_0031.html @@ -1,9 +1,9 @@ -Why Does a Service Mesh Remain in the Unready Status for a Long Time After I Uninstall It?
-Symptom
On the ASM console, after I uninstall a service mesh, the mesh remains in the unready status for a long time.
+Why Does a Service Mesh Remain in the Unready State for a Long Time After I Uninstall It?
+-Symptom
On the ASM console, after I uninstall a service mesh, it remains in the unready state for a long time.
Fault Diagnosis
diff --git a/docs/asm/umn/asm_faq_0037.html b/docs/asm/umn/asm_faq_0037.html index cc97f5af..f7034971 100644 --- a/docs/asm/umn/asm_faq_0037.html +++ b/docs/asm/umn/asm_faq_0037.html @@ -1,11 +1,18 @@How Do I Disable Sidecar Injection for Workloads?
-After sidecar injection is enabled for a namespace of a cluster, sidecars are automatically injected for pods of all workloads in the namespace. You can configure sidecars not to be injected into some workloads:
-
- External Protocol
- Gateway Name