Alibaba Cloud Service Mesh:Route gRPC traffic through an ASM ingress gateway

How the routing resources work together

Routing gRPC traffic through an ASM ingress gateway requires three Istio resources:

Traffic flows as follows: external client -> Gateway (port 8080, GRPC) -> VirtualService (routing rules) -> DestinationRule (subset selection) -> pods.

Step 1: Deploy two versions of a gRPC service

Deploy version 1 (istio-grpc-server-v1) and version 2 (istio-grpc-server-v2) of the gRPC service to your ACK cluster. Both deployments use the same container image but carry different version labels so that the DestinationRule can distinguish them.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. In the left-side navigation pane, choose Workloads > Deployments.

3. In the upper part of the Deployments page, select a namespace from the Namespace drop-down list and click Create from YAML.

   Important

   The namespace must have the istio-injection=enabled label so that sidecar proxies are injected automatically. For more information, see Enable automatic sidecar proxy injection.

4. On the Create page, set Sample Template to Custom, paste the following YAML into the editor, and click Create. The YAML creates two Deployments (v1 and v2) and one Service. Both Deployments listen on container port 50051.

   View app.yaml

      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: grpc-helloworld-py-v1
        labels:
          app: grpc-helloworld-py
          version: v1
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: grpc-helloworld-py
            version: v1
        template:
          metadata:
            labels:
              app: grpc-helloworld-py
              version: v1
          spec:
            containers:
              - name: grpc-helloworld-py
                image: registry.cn-hangzhou.aliyuncs.com/aliacs-app-catalog/istio-grpc-server:grpc-helloworld-py-v1.0
                imagePullPolicy: Always
                env:
                  - name: podname
                    valueFrom:
                      fieldRef:
                        apiVersion: v1
                        fieldPath: metadata.name
                ports:
                  - containerPort: 50051
                    name: grpc-port
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: grpc-helloworld-py-v2
        labels:
          app: grpc-helloworld-py
          version: v2
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: grpc-helloworld-py
            version: v2
        template:
          metadata:
            labels:
              app: grpc-helloworld-py
              version: v2
          spec:
            containers:
              - name: grpc-helloworld-py
                image: registry.cn-hangzhou.aliyuncs.com/aliacs-app-catalog/istio-grpc-server:grpc-helloworld-py-v1.0
                imagePullPolicy: Always
                env:
                  - name: podname
                    valueFrom:
                      fieldRef:
                        apiVersion: v1
                        fieldPath: metadata.name
                ports:
                  - containerPort: 50051
                    name: grpc-port
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: grpc-helloworld-py
        labels:
          app: grpc-helloworld-py
      spec:
        ports:
          - port: 50051
            name: grpc-port
        selector:
          app: grpc-helloworld-py

Step 2: Configure routing rules for the ASM instance

Create a Gateway, a DestinationRule, and a VirtualService. Together, these resources route all inbound gRPC traffic through the ingress gateway to istio-grpc-server-v1.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the target ASM instance or click Manage in the Actions column.

Step 3: Open port 8080 on the ingress gateway

The ingress gateway must expose port 8080 so that external gRPC clients can connect. Create a new ingress gateway with port 8080, or add the port to an existing gateway.

Step 4: Verify the setup with a gRPC client

gRPCurl is a command-line tool that you can use to interact with gRPC services. It allows you to test and debug a gRPC service, as well as view the definition and metadata of the service. To download and install gRPCurl, visit github.com/fullstorydev/grpcurl.

1. Run the following command to send a gRPC request through the ingress gateway:

      grpcurl -d '{"name": "Jack"}' -plaintext {IP address of the ingress gateway}:8080 helloworld.Greeter/SayHello

2. Verify the output. All responses should come from istio-grpc-server-v1: Run the command several times to confirm that every response identifies an istio-grpc-server-v1 pod.

      "message": "Hello, Jack! I'm from grpc-helloworld-py-v1-79b5dc9654-cg4dq!"
      "message": "Hello, Jack! I'm from grpc-helloworld-py-v1-79b5dc9654-cg4dq!"
      "message": "Hello, Jack! I'm from grpc-helloworld-py-v1-79b5dc9654-cg4dq!"
      "message": "Hello, Jack! I'm from grpc-helloworld-py-v1-79b5dc9654-cg4dq!"
      "message": "Hello, Jack! I'm from grpc-helloworld-py-v1-79b5dc9654-cg4dq!"

Step 5: Route traffic to the two versions of the gRPC service based on a specific ratio

Route 40% of the traffic to istio-grpc-server-v2 and 60% of the traffic to istio-grpc-server-v1. With both versions running and all traffic initially directed to v1, you can shift traffic to v2 using weighted routing.