All Products
Search

This Product

    Container Service for Kubernetes:Manage applications in a registered cluster using ASM

    Document Center

    Container Service for Kubernetes:Manage applications in a registered cluster using ASM

    Last Updated:Aug 26, 2026

    You can connect an on-premises or third-party Kubernetes cluster to Alibaba Cloud as a registered cluster and manage its applications using Alibaba Cloud Service Mesh (ASM).

    Prerequisites

    • You have activated ASM. For more information, see What is ASM? and Billing.

    • You have added an external cluster to Alibaba Cloud as a registered cluster. For more information, see Create an ACK One registered cluster.

      Ensure the data plane of the registered cluster can communicate with the VPC of the ASM instance and has sufficient bandwidth. This connectivity allows ASM to push and synchronize configurations with the sidecar proxies.

    Procedure

    1. Create an ASM instance.

      1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

      2. On the Mesh Management page, click Create ASM Instance, configure the parameters, review the Service Agreement, and then click Create Service Mesh.

        The following table describes the key parameters.

        Parameter

        Description

        Region

        Select a region that is geographically close to your registered cluster.

        VPC

        From the list of existing VPCs, select the VPC that the registered cluster uses.

        vSwitch

        From the list of vSwitches, select the one you need. You can also click Create vSwitch to create a new one.

        API Server access

        Specifies whether to Use EIP to expose API Server. ASM instances run on the Kubernetes runtime. You can use the API Server to define and manage various mesh resources, such as virtual services, destination rules, or Istio gateways.

        • Enabled: Creates an elastic IP address (EIP) and associates it with an internal-facing Classic Load Balancer (CLB) instance, which exposes port 6443 of the API server. You can then use a kubeconfig file to manage the cluster and define mesh resources over the internet.

        • Disabled: No EIP is created. You can use a kubeconfig file to manage the cluster and define mesh resources only from within the VPC.
        Note

        • To expose Istio Pilot through a public endpoint, submit a ticket.

        • It takes about 2 to 3 minutes to create an ASM instance.

    2. Add the registered cluster to the ASM instance.

    3. Create an ingress gateway.

      The following table describes the key parameters.

      Parameter

      Description

      Cluster

      Select the registered cluster where you want to deploy the ingress gateway.

      CLB instance type

      Select Internet Access or Private Access. If your cluster environment does not support automatic provisioning for the selected service type, you can select Internet Access first. After the ingress gateway is created, you can modify the YAML configuration to specify another service type, such as NodePort or ClusterIP.

      New CLB instance

      Only Create SLB Instance is supported.

      Port Mapping

      In the ASM console, the container port matches the service port by default. If you create an ingress gateway using YAML, we recommend that you set the container port to the same value as the service port.

    4. Deploy applications in the registered cluster.

      You can deploy applications in the registered cluster using the kubectl command-line tool or the console.

    5. Define Istio resources.