To manage traffic, observability, and security for workloads running in a Kubernetes cluster, add the cluster to your Service Mesh (ASM) instance. ASM then handles traffic management, troubleshooting, centralized monitoring, and log management for all services in that cluster.
Overview
Adding a cluster to ASM involves the following steps:
Verify that you have an ASM instance and a Kubernetes cluster.
Establish network connectivity between the cluster and the ASM control plane (if they are in different VPCs).
Add the cluster through the ASM console.
Verify that the cluster status is Running.
How it works
When you add a cluster, the sidecar proxy containers in the cluster connect to Istio Pilot on the ASM control plane. This connection enables ASM to enforce traffic policies and collect telemetry from workloads in the cluster.
The key requirement is network connectivity: proxy containers must be able to reach Istio Pilot on the ASM control plane. The connectivity method depends on your network topology.
Prerequisites
Before you begin, ensure that you have:
An ASM instance. See Create an ASM instance.
A Container Service for Kubernetes (ACK) cluster or a Container Compute Service (ACS) cluster. See Create an ACK dedicated cluster (discontinued), Create an ACK managed cluster, Create an ACK One registered cluster, or Create an ACS cluster.
We recommend that you deploy the cluster in the same virtual private cloud (VPC) as the ASM instance. If they are in different VPCs, establish connectivity before adding the cluster. For cross-region deployments, see Cross-region disaster recovery with multiple ACK clusters in different VPCs (using CEN to connect VPC networks).
Choose a connectivity method
Select the method that matches your network topology.
Topology | Method | When to use |
Same VPC | Direct (no extra setup) | The cluster and the ASM control plane are in the same VPC |
Different VPCs, private connectivity | Cloud Enterprise Network (CEN) | Connect VPCs through a transit router for private, low-latency communication |
Different VPCs, private connectivity | PrivateLink | Establish a private endpoint connection between VPCs |
Different VPCs or networks, public connectivity | Internet | No private connectivity is available; the ASM control plane is accessible over the Internet |
Option 1: Same VPC or CEN-connected VPCs (recommended)
If the cluster is in the same VPC as the ASM control plane, or the VPCs are already interconnected through CEN or other methods, skip to Add the cluster.
To connect VPCs through CEN, see Enable secure network communication using Enterprise Edition transit routers.
Option 2: PrivateLink
Establish a private endpoint connection between the cluster's VPC and the ASM control plane's VPC. For details, see Use PrivateLink to manage network connectivity between a control plane and a data-plane cluster across VPCs.
Option 3: Internet
Use this method only when private connectivity is not available.
Enable Internet access for the ACK cluster.
Associate an elastic IP address (EIP) with the ASM control plane. For details, see Associate an EIP with or disassociate an EIP from the control plane of an ASM instance.
Proceed to Add the cluster.
Add the cluster
Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Cluster & Workload Management > Kubernetes Clusters. Click Add.
On the Add Kubernetes Cluster page, select the cluster and click OK.
To find clusters in the same VPC as the ASM instance, click Filter out Kubernetes clusters that are in the same VPC as the ASM instance.
Make sure that the proxy container of the cluster can access Istio Pilot of the ASM instance. If Istio Pilot does not allow Internet access, verify that the proxy container can reach it through the VPC.
In the Note message, click OK.
Verify the result
After you add the cluster, verify that the operation succeeded:
Go to the ASM Instance > Base Information page. The Status field shows Updating while the cluster is being added.
Wait for the update to complete, then click Refresh in the upper-right corner. When the Status changes to Running, the cluster has been added. The wait time varies depending on the number of clusters being added.
In the left-side navigation pane, choose Cluster & Workload Management > Kubernetes Clusters. Confirm that the newly added cluster appears in the list.
Remove a cluster
To remove a cluster from the ASM instance:
In the left-side navigation pane, choose Cluster & Workload Management > Kubernetes Clusters.
Select the cluster to remove, then click Remove.
In the Submit dialog box, click OK.
After removal, Service Mesh is unavailable to the cluster. Exercise caution when you remove a cluster.
What's next
Create an ingress gateway -- Deploy an ASM ingress gateway to expose applications over the Internet or an internal network.
Version-based traffic routing with Istio -- Set up canary releases and A/B testing by distributing traffic across service versions.
View application mesh topology -- Visualize call relationships and traffic flows across services.
API reference
To add a cluster programmatically, use the AddClusterIntoServiceMesh API operation.