Deploy Bookinfo and Secure Traffic with Ambient mTLS - Alibaba Cloud Service Mesh

After you add an ingress gateway to a Service Mesh (ASM) instance, deploy applications to the associated clusters. This tutorial walks through deploying the Bookinfo sample application to an ACK cluster, enabling ambient mode on the namespace, and verifying that mutual TLS (mTLS) encryption is active between all pods -- without sidecars or application restarts.

Bookinfo application architecture

Bookinfo is a book review application composed of four microservices.

Microservice	Role
Productpage	Generates the page by calling Details and Reviews
Details	Provides book information
Reviews	Displays book reviews; may call Ratings
Ratings	Returns star ratings based on reviews

The Reviews microservice runs three versions simultaneously:

v1 -- Returns reviews only. Does not call Ratings.
v2 -- Calls Ratings. Displays one to five black stars.
v3 -- Calls Ratings. Displays one to five red stars.

Prerequisites

Before you begin, make sure that you have:

The cluster is added to the ASM instance.
An ingress gateway created in ambient mode
Managed Service for Prometheus or a self-managed Prometheus instance integrated with the ACK cluster for metrics collection. For setup instructions, see Integrate Managed Service for Prometheus or Integrate self-managed Prometheus

Step 1: Deploy the Bookinfo application

Create a file named bookinfo.yaml with the following content.

View the full YAML manifest

apiVersion: v1
kind: Service
metadata:
  name: details
  labels:
    app: details
    service: details
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: details
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bookinfo-details
  labels:
    account: details
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: details-v1
  labels:
    app: details
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: details
      version: v1
  template:
    metadata:
      labels:
        app: details
        version: v1
    spec:
      serviceAccountName: bookinfo-details
      containers:
      - name: details
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-details-v1:1.20.1
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
---
##################################################################################################
# Ratings service
##################################################################################################
apiVersion: v1
kind: Service
metadata:
  name: ratings
  labels:
    app: ratings
    service: ratings
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: ratings
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bookinfo-ratings
  labels:
    account: ratings
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ratings-v1
  labels:
    app: ratings
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ratings
      version: v1
  template:
    metadata:
      labels:
        app: ratings
        version: v1
    spec:
      serviceAccountName: bookinfo-ratings
      containers:
      - name: ratings
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-ratings-v1:1.20.1
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
---
##################################################################################################
# Reviews service
##################################################################################################
apiVersion: v1
kind: Service
metadata:
  name: reviews
  labels:
    app: reviews
    service: reviews
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bookinfo-reviews
  labels:
    account: reviews
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v1
  labels:
    app: reviews
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: reviews
      version: v1
  template:
    metadata:
      labels:
        app: reviews
        version: v1
    spec:
      serviceAccountName: bookinfo-reviews
      containers:
      - name: reviews
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-reviews-v1:1.20.1
        imagePullPolicy: IfNotPresent
        env:
        - name: LOG_DIR
          value: "/tmp/logs"
        ports:
        - containerPort: 9080
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: wlp-output
          mountPath: /opt/ibm/wlp/output
      volumes:
      - name: wlp-output
        emptyDir: {}
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: reviews-v1
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
    version: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v2
  labels:
    app: reviews
    version: v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: reviews
      version: v2
  template:
    metadata:
      labels:
        app: reviews
        version: v2
    spec:
      serviceAccountName: bookinfo-reviews
      containers:
      - name: reviews
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-reviews-v2:1.20.1
        imagePullPolicy: IfNotPresent
        env:
        - name: LOG_DIR
          value: "/tmp/logs"
        ports:
        - containerPort: 9080
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: wlp-output
          mountPath: /opt/ibm/wlp/output
      volumes:
      - name: wlp-output
        emptyDir: {}
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: reviews-v2
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
    version: v2
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v3
  labels:
    app: reviews
    version: v3
spec:
  replicas: 1
  selector:
    matchLabels:
      app: reviews
      version: v3
  template:
    metadata:
      labels:
        app: reviews
        version: v3
    spec:
      serviceAccountName: bookinfo-reviews
      containers:
      - name: reviews
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-reviews-v3:1.20.1
        imagePullPolicy: IfNotPresent
        env:
        - name: LOG_DIR
          value: "/tmp/logs"
        ports:
        - containerPort: 9080
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: wlp-output
          mountPath: /opt/ibm/wlp/output
      volumes:
      - name: wlp-output
        emptyDir: {}
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: reviews-v3
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
    version: v3
---
##################################################################################################
# Productpage services
##################################################################################################
apiVersion: v1
kind: Service
metadata:
  name: productpage
  labels:
    app: productpage
    service: productpage
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: productpage
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bookinfo-productpage
  labels:
    account: productpage
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-v1
  labels:
    app: productpage
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: productpage
      version: v1
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9080"
        prometheus.io/path: "/metrics"
      labels:
        app: productpage
        version: v1
    spec:
      serviceAccountName: bookinfo-productpage
      containers:
      - name: productpage
        image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/examples-bookinfo-productpage-v1:1.20.1
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
        volumeMounts:
        - name: tmp
          mountPath: /tmp
      volumes:
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: productpage-v1
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: productpage
    version: v1
---
apiVersion: v1
kind: Service
metadata:
  name: ratings-v1
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: ratings
    version: v1
---
apiVersion: v1
kind: Service
metadata:
  name: details-v1
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: details
    version: v1

Deploy the application to the default namespace.
```
kubectl apply -f bookinfo.yaml
```

Verify that all pods are running. Expected output: Wait until all six pods show Running status before you continue.

kubectl get pods

NAME                              READY   STATUS    RESTARTS   AGE
details-v1-xxx                    1/1     Running   0          30s
productpage-v1-xxx                1/1     Running   0          30s
ratings-v1-xxx                    1/1     Running   0          30s
reviews-v1-xxx                    1/1     Running   0          30s
reviews-v2-xxx                    1/1     Running   0          30s
reviews-v3-xxx                    1/1     Running   0          30s

Step 2: Deploy and configure the ingress gateway

Create a file named bookinfo-gateway.yaml with the following content. The Gateway listens on port 80, and the VirtualService forwards matching requests (/productpage, /static, /login, /logout, /api/v1/products) to port 9080 of the productpage service.

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - '*'
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: vs-demo
  namespace: default
spec:
  hosts:
    - '*'
  http:
    - name: gw-to-productage
      match:
        - uri:
            exact: /productpage
        - uri:
            prefix: /static
        - uri:
            exact: /login
        - uri:
            exact: /logout
        - uri:
            prefix: /api/v1/products
      route:
        - destination:
            host: productpage
            port:
              number: 9080
  gateways:
    - bookinfo-gateway

Apply the gateway configuration.
```
kubectl apply -f bookinfo-gateway.yaml
```

Step 3: Access the application

Get the ingress gateway IP address.

echo $(kubectl -n istio-system get istiogateway ingressgateway -o jsonpath="{.status.GatewayAddress[0]}")

Open http://<gateway-ip>/productpage in a browser. Replace <gateway-ip> with the IP address from the previous step.
Refresh the page several times. The star ratings under Book Reviews cycle through three states, matching the three versions of the Reviews service: This confirms that all three versions of the Reviews service are running and load-balanced.
- No stars (v1)
- Black stars (v2)
- Red stars (v3)

Step 4: Enable ambient mode

Ambient mode adds mTLS encryption between all pods in a namespace without injecting sidecar proxies. No application restarts are required.

Log on to the ASM console.
In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of your ASM instance.
In the left-side navigation pane, choose ASM Instance > Global Namespace.
In the Data Plane Mode column of the Default namespace, click Switch To Ambient Mesh Mode.
To revert, switch the Data Plane Mode back to sidecar mode at any time from the Global Namespaces page.
Open http://<gateway-ip>/productpage in a browser to verify that the application still works. The page loads exactly as before. The difference is that mTLS encryption is now active between all Bookinfo pods. Service-to-service communication is encrypted transparently, without code changes or restarts.

Step 5: View the mesh topology

Set up monitoring metrics collection and mesh topology to visualize traffic between services.

Enable monitoring metrics collection

Skip this section if you already use a self-managed Prometheus instance.

On the Mesh Management page, click the name of your ASM instance.
In the left-side navigation pane, choose Observability Management Center > Monitoring metrics.
Click Collect Metrics to Managed Service for Prometheus. In the Submit dialog box, select the cluster name and click OK.

Enable mesh topology

On the Mesh Management page, click the name of your ASM instance.
In the left-side navigation pane, choose Observability Management Center > Mesh Topology.

Click To Enable and configure the following parameters.

Add a dedicated port for mesh topology by editing the gateway configuration.

Parameter	Description
Service deployment mode	Data plane deployment mode for your Kubernetes cluster. Note The managed deployment mode only supports access through a Serverless ASM gateway.
Observability cluster	Your observability cluster ID (for example, `c6118d720xxxxxxxxxxxxxx58410a9c7d0`).
Prometheus scrape address	Leave blank for Managed Service for Prometheus. For self-managed Prometheus, enter the read address. When multiple clusters are added to ASM, create an aggregation instance and enter its read address.
Identity authentication - logon method	Token
Entry	ASM. For Select an ASM gateway, choose `ingressgateway`. For Select an ASM gateway port, choose `443`.

Click Confirm Enabling.

Generate test traffic and view the topology

Send 100 requests to generate traffic data for the topology diagram.

export GATEWAY_ADDRESS=$(kubectl -n istio-system get istiogateway ingressgateway -o jsonpath="{.status.GatewayAddress[0]}")
for i in $(seq 1 100); do
  echo "Request $i: $(curl -sSI -o /dev/null -w "%{http_code}" "http://${GATEWAY_ADDRESS}:80/productpage")"
done

On the Mesh Topology page, in the Logon Method section, click View the logon token and copy the token.
Click Access ASM mesh topology next to Topology address. On the Kiali page, paste the token into the Token field and click Log in. The topology graph shows traffic flow between all Bookinfo microservices, confirming that ambient mode, mTLS, and monitoring are working together.