Alibaba Cloud Service Mesh (ASM) allows you to configure service discovery selectors to ensure that the ASM control plane discovers and processes only application services in the selected namespaces. This makes it more efficient for the control plane to push service configurations to sidecar proxies on the data plane. This topic describes how to configure service discovery selectors.
Prerequisites
- A Container Service for Kubernetes (ACK) cluster is created. An ASM instance running the version v1.10.5.32-g28fe5008-aliyun or later is created. The ACK cluster is added to the ASM instance. For more information, see The cluster is added to the ASM instance.
- A kubectl client is connected to the cluster.
Background information
By default, sidecar proxies on the data plane store the configurations of services in all the namespaces of a cluster, including those in the namespaces that do not have sidecar injection enabled. The control plane monitors services in all the namespaces and pushes the service changes to sidecar proxies.
You can configure label selectors based on the labels of the namespaces in the cluster. The label selectors ensure that the control plane discovers and processes only services in the selected namespaces. This way, sidecar proxies store only the configurations of services in the selected namespaces, because the control plane does not push the configurations of services in unselected namespaces to sidecar proxies.
- Exact match: You can specify a label name and a label value. A namespace can be selected only when its label name and value match the ones you specify.
- Match by expression: You can specify a label name, an expression operator, and some label values to select data-plane namespaces whose labels meet the specified conditions. The following items describe the meanings of operators:
- In: A namespace on the data plane can be selected only when it has a label whose name matches the specified name and the corresponding label value is among the specified values.
- NotIn: A namespace on the data plane can be selected only when it has a label whose name matches the specified name but the corresponding label value is not among the specified values.
- Exists: A namespace on the data plane can be selected when it has a label whose name matches the specified name. No requirements are imposed on the corresponding label value.
- DoesNotExist: A namespace on the data plane can be selected only when none of its labels matches the specified label name. No requirements are imposed on label values.
Step 1: Create two namespaces in ASM
- Log on to the ASM console. In the left-side navigation pane, choose .
- On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
- On the Global Namespace page, click Create.
- In the Create Namespace panel, enter a namespace name and click OK. In this example, the name is set to ns-in-mesh.
- Repeat the preceding steps to create another namespace named ns-not-in-mesh.
- Enable automatic sidecar injection for the ns-in-mesh namespace.
- On the Global Namespace page, find the ns-in-mesh namespace, and click Enable Automatic Sidecar Injection in the Automatic Sidecar Injection column.
- In the message that appears, click OK.
Step 2: Deploy a sample application in the two namespaces
- Run the following command to add the
asm-discovery=enabled
label to the ns-in-mesh namespace:kubectl label namespace ns-in-mesh asm-discovery=enabled
- Create an httpbin.yaml file that contains the following content:
apiVersion: v1 kind: ServiceAccount metadata: name: httpbin --- apiVersion: v1 kind: Service metadata: name: httpbin labels: app: httpbin service: httpbin spec: ports: - name: http port: 8000 targetPort: 80 selector: app: httpbin --- apiVersion: apps/v1 kind: Deployment metadata: name: httpbin spec: replicas: 1 selector: matchLabels: app: httpbin version: v1 template: metadata: labels: app: httpbin version: v1 spec: serviceAccountName: httpbin containers: - image: docker.io/kennethreitz/httpbin imagePullPolicy: IfNotPresent name: httpbin ports: - containerPort: 80
- Deploy the httpbin application in the two namespaces.
- Run the following command to deploy the httpbin application in the ns-in-mesh namespace:
kubectl apply -f httpbin.yaml -n ns-in-mesh
- Run the following command to deploy the httpbin application in the ns-not-in-mesh namespace:
kubectl apply -f httpbin.yaml -n n-not-in-meshs
- Run the following command to deploy the httpbin application in the ns-in-mesh namespace:
Step 3: Check whether the control plane pushes the configurations to sidecar proxies
- View configurations in sidecar proxies.
- View control-plane logs.
Step 4: Configure a service discovery selector in ASM
You can configure a service discovery selector to make the control plane push only the configurations of application services in the namespace with the asm-discovery label to sidecar proxies.
You can select the namespace or edit the label selector to configure a service discovery selector.
Method 1: Select the namespace
- Log on to the ASM console. In the left-side navigation pane, choose .
- On the details page of the ASM instance, choose in the left-side navigation pane.
- On the Service Discovery Selector page, set Mesh Discovery Mode to Discovery services according to Discovery Selectors.
- On the Select Namespaces tab, select the ACK cluster, click select next to the ns-in-mesh namespace in the list, and then click OK.
- Check whether the configuration is successful.
Method 2: Edit the label selector
- Log on to the ASM console. In the left-side navigation pane, choose .
- On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
- On the Service Discovery Selector page, set Mesh Discovery Mode to Discovery services according to Discovery Selectors, and click the Edit Discovery Selectors Directly tab.
- Click Add a label selector. In the new label selector, click Add a matchExpressions. Set the Key parameter to asm-discovery and the Value parameter to Exists. Then, click OK.
- Check whether the configuration is successful.
Step 5: Verify that the service discovery selector takes effect
- View configurations in sidecar proxies.
- View control-plane logs.