Connect clusters across VPCs with PrivateLink - Alibaba Cloud Service Mesh

PrivateLink connects an ASM control plane to a data plane ACK cluster that resides in the same region but in a different VPC. ASM provides the ASMPvlConfig custom resource definition (CRD) to simplify the network configuration that this cross-VPC connection requires.

Prerequisites

An ASM instance is created. For more information, see Create an ASM instance.
An ACK cluster is created in the same region as the ASM instance but in a different VPC. For more information, see Create a cluster.
The PrivateLink service is activated. For more information, see Get started with PrivateLink.

Important

To use PrivateLink for cross-VPC connectivity, the vSwitch that you specify for the ASM instance and the vSwitch that you specify for the ACK cluster must be in the same availability zone.

Procedure

Add the ACK cluster to the ASM instance. For more information, see Add a cluster to an ASM instance.
After the cluster is added, it is in the Connecting state. Complete the following steps to establish connectivity.

Create a file named asmpvlconfig.yaml with the following content.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPvlConfig
metadata:
  name: default
spec:
  ackVpcEndpoint:
  - clusterId: cab9ace222210457a83f09fcd42e9****
    vSwitches:
    - vSwitchId: vsw-bp1jsgsanpvxpj32yai50
      zoneId: cn-hangzhou-j
  asmVpcEndpoint:
    vSwitches:
    - vSwitchId: vsw-bp1l5hini55sstnwd2skf
      zoneId: cn-hangzhou-i

The following table describes the fields.

Parameter	Sub-parameter	Description
`metadata`	`name`	The name of the resource object. The value of `name` must be `default`. Any other name is invalid.
`spec`	`ackVpcEndpoint`	An array that contains the following sub-parameters for the VPC of the ACK cluster.
`spec`	`ackVpcEndpoint.clusterId`	The ID of the ACK cluster that is added to the ASM instance. Example: `cab9ace222210457a83f09fcd42e9****`.
`spec`	`ackVpcEndpoint.vSwitches`	An array of available vSwitch configurations in the VPC of the ACK cluster.
`spec`	`ackVpcEndpoint.vSwitches.vSwitchId`	The ID of a specific vSwitch. Example: `vsw-bp1jsgsanpvxpj32yai50`.
`spec`	`ackVpcEndpoint.vSwitches.zoneId`	The ID of the availability zone for the vSwitch. Example: `cn-hangzhou-j` is an availability zone in the China (Hangzhou) region. For the availability zone requirement, see Prerequisites.
`spec`	`asmVpcEndpoint`	Contains the vSwitch configurations for the VPC of the ASM instance.
`spec`	`asmVpcEndpoint.vSwitches`	An array of vSwitch configurations that contains the following sub-parameters.
`spec`	`asmVpcEndpoint.vSwitches.vSwitchId`	The ID of a specific vSwitch in the VPC of the ASM instance.
`spec`	`asmVpcEndpoint.vSwitches.zoneId`	The ID of the availability zone where the vSwitch of the ASM instance is located. For the availability zone requirement, see Prerequisites.

Using the kubeconfig of the ASM instance, run the following command to apply the ASMPvlConfig resource.
```
kubectl apply -f asmpvlconfig.yaml
```

Wait a few minutes, and then run the following command to check the status of the ASMPvlConfig resource object.

kubectl get asmpvlconfig default -o yaml

Expected output:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPvlConfig
metadata:
  name: default
spec:
  ackVpcEndpoint:
  - clusterId: cab9ace222210457a83f09fcd42****
    vSwitches:
    - vSwitchId: vsw-bp1jsgsanpvxpj32yai50
      zoneId: cn-hangzhou-j
  asmVpcEndpoint:
    vSwitches:
    - vSwitchId: vsw-bp1l5hini55sstnwd2skf
      zoneId: cn-hangzhou-i
status:
  clusters:
  - clusterId: cab9ace222210457a83f09fcd42****
    pvlEndpoint:
      connectionStatus: Connected
      domainName: ep-bp1i06bad79eb60c60cc.epsrv-bp1gqb8g1b8d7uactd.cn-hangzhou.privatelink.aliyuncs.com
      id: ep-bp1i06bad79eb60c60
      status: Active
    pvlEndpointService:
      id: epsrv-bp1gqb8g1b8d7uactd
      name: com.aliyuncs.privatelink.cn-hangzhou.epsrv-bp1gqb8g1b8d7uactd
      status: Active
  pilot:
    clusters:
    - clusterId: cab9ace222210457a83f09fcd42****
      pvlEndpoint:
        connectionStatus: Connected
        domainName: ep-bp1i52311b91a5a25e.epsrv-bp1cl4qwzkf747ug6tmy.cn-hangzhou.privatelink.aliyuncs.com
        id: ep-bp1i52311b91a5a25e
        status: Active
    pvlEndpointService:
      id: epsrv-bp1cl4qwzkf747ug6t
      name: com.aliyuncs.privatelink.cn-hangzhou.epsrv-bp1cl4qwzkf747ug6tmy
      status: Active
  status: Available

A status section is added to the output. The following table describes its fields.

Parameter	Description
`clusters`	The list of status information about the ACK clusters.
`clusters.clusterId`	The unique ID of the ACK cluster.
`clusters.pvlEndpoint`	Details about a specific PrivateLink endpoint.
`clusters.pvlEndpoint.connectionStatus`	The status of the PrivateLink connection that the ASM instance uses.
`clusters.pvlEndpoint.domainName`	The domain name of the PrivateLink endpoint that the ASM instance uses.
`clusters.pvlEndpoint.id`	The unique ID of the PrivateLink endpoint that the ASM instance uses.
`clusters.pvlEndpoint.status`	The status of the PrivateLink endpoint that the ASM instance uses.
`clusters.pvlEndpointService`	Information about the PrivateLink endpoint service resource.
`clusters.pvlEndpointService.id`	The unique ID of the PrivateLink endpoint service for the API server SLB instance of the ACK cluster.
`clusters.pvlEndpointService.name`	The name of the PrivateLink endpoint service for the API server SLB instance of the ACK cluster.
`clusters.pvlEndpointService.status`	The status of the PrivateLink endpoint service for the API server SLB instance of the ACK cluster.
`pilot`	The list of status information about the managed service of the ASM control plane.
`pilot.clusters`	The list of ACK cluster statuses.
`pilot.clusters.clusterId`	The unique ID of the ACK cluster.
`pilot.clusters.pvlEndpoint`	Details about a specific PrivateLink endpoint.
`pilot.clusters.pvlEndpoint.connectionStatus`	The status of the PrivateLink connection that the ACK cluster uses.
`pilot.clusters.pvlEndpoint.domainName`	The domain name of the PrivateLink endpoint that the ACK cluster uses.
`pilot.clusters.pvlEndpoint.id`	The unique ID of the PrivateLink endpoint that the ACK cluster uses.
`pilot.clusters.pvlEndpoint.status`	The status of the PrivateLink endpoint that the ACK cluster uses.
`pilot.pvlEndpointService`	Information about the PrivateLink endpoint service resource.
`pilot.pvlEndpointService.id`	The unique ID of the PrivateLink endpoint service for the Pilot SLB instance of the ASM instance.
`pilot.pvlEndpointService.name`	The name of the PrivateLink endpoint service for the Pilot SLB instance of the ASM instance.
`pilot.pvlEndpointService.status`	The status of the PrivateLink endpoint service for the Pilot SLB instance of the ASM instance.
`status`	The overall availability status. `Available` indicates that the connectivity configuration is complete. Any other value indicates a failure.

Check the status of the endpoint service and the endpoint in the PrivateLink console.
1. Log on to the PrivateLink console. In the left-side navigation pane, click Endpoint Service.
2. In the top navigation bar, select the region in which the endpoint service resides.
3. On the Endpoint Service page, click the instance ID of the target endpoint service to view its details.
4. In the left-side navigation pane, click Endpoints, and then click the instance ID of the target endpoint to view its details.
In the output of Step 4, find the pvlEndpoint.domainName value that is reported under clusters for the clusterId of the ACK cluster. Add this value to the Subject Alternative Name (SAN) field of the custom API server certificate of that ACK cluster. An example of this value is ep-bp1i06bad79eb60c60cc.epsrv-bp1gqb8g1b8d7uactd.cn-hangzhou.privatelink.aliyuncs.com. For more information, see Customize the SAN of the API server certificate for an ACK cluster.
Check the status of the ACK cluster.
If the cluster is in the Running state, cross-VPC connectivity over PrivateLink is established.