Alibaba Cloud Service Mesh:Create an ingress gateway

Procedure

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

3. On the Ingress Gateway page, click Create and configure the basic parameters for the gateway.

   You can also click Ingress Gateway on the Create from YAML page to define an ingress gateway. For more information, see Manage an ingress gateway by using the KubeAPI.

   Parameter	Description
   Name	Enter a custom name for the gateway.
   Cluster	Select the cluster where you want to deploy the gateway.
   Service Type	Supported types are LoadBalancer, ClusterIP, and NodePort. For more information about the three types, see Service. Note If your data plane cluster is a registered cluster and you select LoadBalancer, make sure that the cluster supports LoadBalancer services to prevent creation failures.
   CLB/NLB	This parameter is required only when Service Type is set to LoadBalancer. Supported access methods are Internet Access and Private Access.
   Create SLB Instance	This parameter is required only when Service Type is set to LoadBalancer. Create SLB Instance: If you select CLB, select the desired specification from the Select CLB Specifications drop-down list. If you select NLB, select the vSwitches that correspond to at least two availability zones from the Select Zones for NLB Instance drop-down list. Use Existing CLB Instance: Select an existing load balancer from the list. Important Assign a dedicated load balancer to each Kubernetes Service. Sharing a load balancer across multiple Services introduces the following risks: Using an existing load balancer overwrites its existing listeners, which can make your applications inaccessible. Load balancers created by Kubernetes through Services cannot be reused. You can reuse only load balancers that you create manually in the console or by calling an API operation. Multiple Services that share the same load balancer cannot have the same frontend listener port. Otherwise, port conflicts will occur. When a load balancer is reused, Kubernetes uses the listener names and vServer group names as unique identifiers. Do not modify these names. You cannot reuse a load balancer across different clusters or regions.
   Port Mapping	Configure the Protocol and Service Port. Note The console provides two default ports that are commonly used by Istio. You can modify them as needed.
   Resources Limits	Select the CPU and memory specifications for the gateway Pods.
   Gateway instances	Set the number of gateway replicas.

4. Optional: Click Advanced Options to configure additional settings.

   Parameter	Description
   External Traffic Policy	Set the external traffic policy. Local: Traffic is routed only to Pods on the local node. Cluster: Traffic can be forwarded to Pods on other nodes in the cluster.
   HPA	Select HPA and configure the following parameters: metrics: Set the Monitoring items and Threshold. The number of gateway replicas scales up if the threshold is exceeded and scales down if the metric falls below the threshold. If you set thresholds for both CPU and memory, scaling is triggered if either threshold is met. Maximum replicas: The maximum number of replicas for scale-out. Minimum number of replicas: The minimum number of replicas for scale-in. Note This feature is available only for Enterprise Edition and Ultimate Edition instances.
   Rolling Upgrade	Select Rolling Upgrade and configure the following parameters: Maximum number of unavailable instances: The maximum number of replicas that can be unavailable during a rolling upgrade. Exceeding the desired number of instances: The maximum number of replicas that can be created beyond the desired number during a rolling upgrade. For example, if you set this parameter to 25%, the number of replicas cannot exceed 125% of the original number during the upgrade.
   TLS performance optimization	Select TLS performance optimization to accelerate TLS encryption and decryption. supported nodeaffinity: Selects nodes for performance optimization based on node labels. Poll Delay(ms): This parameter reduces the waiting time for encryption and decryption operations. For more information, see Parameter description. Note This feature is available only for Enterprise Edition and Ultimate Edition instances.
   Deploy ASM Gateway replicas as widely as possible	When you set podAntiAffinity, Pods are preferentially scheduled on different nodes.
   Custom Deployment Policy	You can customize the nodeSelector, tolerations, and affinity of the gateway. For more information about the fields, see ASM Gateway CRD Description.
   SLB graceful offline	When enabled, services are not disrupted when gateway Pods are removed from the load balancer. Connection timeout (seconds): After the load balancer removes a gateway Pod, it waits for the specified period before disconnecting. This buffer allows the Pod to finish processing existing connections. The default graceful shutdown period is 30s, so the load balancer timeout should not exceed 30s. Note This feature is available only for Enterprise Edition and Ultimate Edition instances.

5. After you complete the configuration, click Create.

   The gateway is created successfully when its status changes to Running. The Service address is the IP address of the ingress gateway.