Alibaba Cloud Service Mesh:Log on to ASM Mesh Topology with an Alibaba Cloud account or as a RAM user

Prerequisites

• An ASM instance whose version is 1.16.4.5 or later is created. For more information, see Create an ASM instance or Update an ASM instance.

• A Container Service for Kubernetes (ACK) cluster is added to the ASM instance. For more information, see Create an ACK managed cluster and Add a cluster to an ASM instance.

• Mesh Topology is enabled and the logon page of Mesh Topology is accessible. For more information, see Step 1 and Step 2 in Enable Mesh Topology to observe an ASM instance in the ASM console.

Step 1: Create and configure an OAuth application in the RAM console

1. Create an Open Authorization (OAuth) application in the RAM console . For more information, see Create an application.

   Parameter	Description
   Application Type	Select WebApp.
   Callback URL	If you log on to Mesh Topology by using the Classic Load Balancer (CLB) instance associated with your ASM instance, enter the IP address of the CLB instance. If you log on to Mesh Topology by using an ingress gateway, enter the IP address of the ingress gateway. The following configurations are examples: If you use a CLB instance to log on to Mesh Topology and the IP address of the CLB instance is xxx.xxx.xxx.xxx, set the Callback URL parameter to http://xxx.xxx.xxx.xxx:20001 without forward slashes (/) following 20001. For example, 20001/xxx, 20001/, 20001/xxx/, and 20001/xxx/yyy are not allowed. If you use an ingress gateway to log on to Mesh Topology and the IP address of the ingress gateway is yyy.yyy.yyy.yyy, set the Callback URL parameter to http://yyy.yyy.yyy.yyy:20001 without forward slashes (/) following 20001. For example, 20001/xxx, 20001/, 20001/xxx/, and 20001/xxx/yyy are not allowed.

2. On the Enterprise Applications tab, save the ID of the OAuth application shown in the Application ID column.

3. Create an application secret for the OAuth application in the RAM console and save the application secret. For more information, see Create an application secret.

   Note

   The application secret is visible only when you create it and cannot be queried. Therefore, you must save the secret when you create it.

Step 2: Configure Mesh Topology in the ASM console to connect to the OAuth application

ASM Mesh Topology allows you to use the OpenID Connect (OIDC) protocol to connect to an OAuth application.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Mesh Topology.

3. In the Authentication section of the Mesh Topology page, select Login with OIDC, configure parameters as required, and then click Save configuration of Mesh Topology.

   Parameter	Description
   Client ID	The application ID that is saved in Step 1.
   Client Secret	The application secret that is saved in Step 1.
   OIDC Issuer URL	Enter https://oauth.aliyun.com.
   OAuth Scope	Select only Basic Information.

Step 3: Log on to ASM Mesh Topology with an Alibaba Cloud account or as a RAM user