Alibaba Cloud Service Mesh:Connect an ASM control plane to a data-plane cluster across VPCs through PrivateLink

How it works

The ASM control plane and the ACK data-plane cluster communicate through two separate channels. When you apply the ASMPvlConfig resource, ASM creates a PrivateLink connection for each channel:

Each PrivateLink connection requires an endpoint in the same availability zone as the target endpoint service. Because the endpoint service for the ACK API server is in the ACK VPC's zone, the ASM-side endpoint must also be in that zone, and vice versa. This is why the ASMPvlConfig resource uses cross-matched zone IDs between the two VPCs (detailed in Configure the ASMPvlConfig resource).

PrivateLink traffic stays within the Alibaba Cloud network and does not traverse the public internet, ensuring that control-plane-to-data-plane communication remains private.

Prerequisites

• An ASM instance is created

• An ACK cluster is created in the same region as the ASM instance but in a different VPC

• The PrivateLink service is activated

• kubectl is installed and configured with the kubeconfig file of the ASM instance

Add the ACK cluster to the ASM instance

Add the ACK cluster to the ASM instance.

After you add the cluster, its status shows Connected in the ASM console. This only indicates that the cluster is registered with ASM. PrivateLink connectivity is not yet established. Proceed to the next section to configure it.

Configure the ASMPvlConfig resource

Create a file named asmpvlconfig.yaml with the following content:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPvlConfig
metadata:
  name: default
spec:
  ackVpcEndpoint:
  - clusterId: <ack-cluster-id>
    vSwitches:
    - vSwitchId: <ack-vswitch-id>
      zoneId: <asm-vswitch-zone-id>
  asmVpcEndpoint:
    vSwitches:
    - vSwitchId: <asm-vswitch-id>
      zoneId: <ack-vswitch-zone-id>

Replace the placeholders with your actual values:

Apply the ASMPvlConfig resource

Connect to the ASM instance with kubectl and apply the resource:

kubectl apply -f asmpvlconfig.yaml

Verify the PrivateLink status

Wait a few minutes for ASM to provision the PrivateLink resources, then check the status:

kubectl get asmpvlconfig default -o yaml

A successful configuration adds a status section to the output:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPvlConfig
metadata:
  name: default
spec:
  ackVpcEndpoint:
  - clusterId: cab9ace222210457a83f09fcd42****
    vSwitches:
    - vSwitchId: vsw-bp1jsgsanpvxpj32yai50
      zoneId: cn-hangzhou-j
  asmVpcEndpoint:
    vSwitches:
    - vSwitchId: vsw-bp1l5hini55sstnwd2skf
      zoneId: cn-hangzhou-i
status:
  clusters:
  - clusterId: cab9ace222210457a83f09fcd42****
    pvlEndpoint:
      connectionStatus: Connected
      domainName: ep-bp1i06bad79eb60c60cc.epsrv-bp1gqb8g1b8d7uactd.cn-hangzhou.privatelink.aliyuncs.com
      id: ep-bp1i06bad79eb60c60
      status: Active
    pvlEndpointService:
      id: epsrv-bp1gqb8g1b8d7uactd
      name: com.aliyuncs.privatelink.cn-hangzhou.epsrv-bp1gqb8g1b8d7uactd
      status: Active
  pilot:
    clusters:
    - clusterId: cab9ace222210457a83f09fcd42****
      pvlEndpoint:
        connectionStatus: Connected
        domainName: ep-bp1i52311b91a5a25e.epsrv-bp1cl4qwzkf747ug6tmy.cn-hangzhou.privatelink.aliyuncs.com
        id: ep-bp1i52311b91a5a25e
        status: Active
    pvlEndpointService:
      id: epsrv-bp1cl4qwzkf747ug6t
      name: com.aliyuncs.privatelink.cn-hangzhou.epsrv-bp1cl4qwzkf747ug6tmy
      status: Active
  status: Available

Confirm that status.status is Available. This means both the API server and Pilot connections are established. Any other value indicates a configuration issue -- review your vSwitch IDs and zone IDs.

Verify the PrivateLink resources in the VPC console

To inspect the endpoint service and endpoint directly:

1. Log on to the VPC console.

2. In the left-side navigation pane, click Endpoints Service.

3. In the top navigation bar, select the region where the endpoint service resides.

4. On the Endpoints Service page, click the instance ID of the target endpoint service to view its details.

5. In the left-side navigation pane, click Endpoints. On the Endpoints page, click the instance ID of the target endpoint to view its details.

Add the PrivateLink domain to the API server certificate

The ASM control plane accesses the ACK cluster's API server through the PrivateLink endpoint domain name. For TLS validation to succeed, this domain name must be listed as a Subject Alternative Name (SAN) in the API server certificate. Without this, the control plane cannot establish a trusted connection to the API server.

From the status output in Verify the PrivateLink status, copy the pvlEndpoint.domainName value under clusters (for example, ep-bp1i06bad79eb60c60cc.epsrv-bp1gqb8g1b8d7uactd.cn-hangzhou.privatelink.aliyuncs.com) and add it to the custom SAN field of the ACK cluster's API server certificate.

For instructions, see Customize the SAN of the API server certificate when you create an ACK cluster.

Confirm cross-VPC connectivity

Check the ACK cluster's status in the ASM console. If the cluster is in the Running state, cross-VPC connectivity through PrivateLink is successfully established.