ASMEgressTrafficPolicy CRD description - Alibaba Cloud Service Mesh

The ASMEgressTrafficPolicy custom resource definition (CRD) defines how an egress gateway routes outbound traffic from in-mesh services to external destinations. By using a combination of sidecar proxies and authorization policies, you can control egress traffic in a comprehensive manner.

Requires Service Mesh (ASM) version 1.16.4 or later.

YAML examples

Route a service to an external endpoint over HTTP

The sleep-a service in the mytest namespace accesses http://www.httpbin.org through the egress gateway egressgateway-a on port 80.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMEgressTrafficPolicy
metadata:
  name: egress-by-egressgateway-a  # Name corresponds to the egress gateway.
  namespace: istio-egress          # Fixed namespace for egress policies.
spec:
  byEgressGateway:
    name: egressgateway-a
  egressRules:
  - from:
    - namespace: mytest
      workloadSelector:
        app: sleep-a
    to:
    - name: httpbin-service-http
      hosts:
      - www.httpbin.org  # Multiple domains that resolve to the same address.
      - httpbin.org
      port:
        name: http
        number: 80
        protocol: HTTP
      byEgressGateway:
        port: 80  # Traffic path: Sidecar -> port 80 on gateway -> port 80 on httpbin.org

Traffic flow: The sidecar proxy intercepts the outbound request from sleep-a, forwards it to port 80 on the egress gateway, and the gateway sends it to port 80 on httpbin.org.

Upgrade HTTP to HTTPS and route multiple services

This example defines three egress rules through the same gateway:

Source service	External destination	Gateway port	Protocol	HTTPS upgrade
`sleep-a` (mytest)	httpbin.org	80	HTTP	Yes (port 443)
`sleep-a` (mytest)	httpbin.org	444	HTTPS	No
`sleep-b` (mytest)	www.aliyun.com	445	HTTPS	No

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMEgressTrafficPolicy
metadata:
  name: egress-by-egressgateway-a
  namespace: istio-egress
spec:
  byEgressGateway:
    name: egressgateway-a
  egressRules:
  - from:
     - namespace: mytest
       workloadSelector:
          app: sleep-a
    to:
    - name: httpbin-service-http
      hosts:
      - www.httpbin.org
      - httpbin.org
      port:
        name: http
        number: 80
        protocol: HTTP
      byEgressGateway:
        port: 80
      httpsUpgrade:
        enabled: true   # Set to false to disable the upgrade. The port below is ignored when disabled.
        port: 443       # Traffic path: Sidecar -> port 80 on gateway -> port 443 on httpbin.org (HTTPS)
    - name: httpbin-service-https
      hosts:
      - www.httpbin.org
      - httpbin.org
      port:
        name: https
        number: 443
        protocol: HTTPS
      byEgressGateway:
        port: 444
  - from:
     - namespace: mytest
       workloadSelector:
          app: sleep-b
    to:
    - name: aliyun-service-https
      hosts:
      - www.aliyun.com
      port:
        name: https
        number: 443
        protocol: HTTPS
      byEgressGateway:
        port: 445

The first rule demonstrates HTTPS upgrade: the sidecar sends HTTP on port 80 to the gateway, and the gateway originates an HTTPS connection on port 443 to httpbin.org. The application sends plain HTTP while the gateway handles TLS.

Route HTTP and TCP traffic with automatic port allocation

Starting from ASM 1.24.6.45, ASMEgressTrafficPolicy supports the TCP protocol. When all byEgressGateway fields in the to sections are omitted, ASM automatically allocates forwarding ports on the egress gateway from the default range 10000--20000. These auto-assigned ports are internal and do not affect your workloads.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMEgressTrafficPolicy
metadata:
  name: egress-by-egressgateway-a
  namespace: istio-egress
spec:
  byEgressGateway:
    name: egressgateway-a
  egressRules:
  - from:
    - namespace: default
      workloadSelector:
        app: sleep
    to:
    - name: aliyun-com-http  # HTTP route
      hosts:
      - aliyun.com
      port:
        name: http
        number: 80
        protocol: HTTP
    - name: aliyun-https     # HTTPS route
      hosts:
      - aliyun.com
      port:
        name: https
        number: 443
        protocol: HTTPS
    - name: https-upgrade    # HTTP upgraded to HTTPS at the gateway
      hosts:
      - taobao.com
      port:
        name: http
        protocol: HTTP
        number: 80
      httpsUpgrade:
        enabled: true
        port: 443
    - name: tcp-svc1         # TCP service 1
      hosts:
      - 1.1.1.1
      port:
        name: tcp
        protocol: TCP
        number: 44
    - name: tcp-svc2         # TCP service 2
      hosts:
      - test-tcp.com
      port:
        name: tcp
        protocol: TCP
        number: 444

No byEgressGateway is specified in any to entry, so ASM auto-assigns gateway forwarding ports for all five destinations.

CRD field reference

Spec

Field	Type	Required	Description
byEgressGateway	ByEgressGateway	Yes	The egress gateway that routes traffic to external services.
egressRules	EgressRule[]	Yes	Egress traffic rules that define source-to-destination mappings.

ByEgressGateway

Field	Type	Required	Description
name	string	Yes	Name of the egress gateway. Keep the name to 32 characters or fewer.
port	uint32	No	Port on the egress gateway through which traffic is forwarded.

EgressRule

Field	Type	Required	Description
name	string	No	A descriptive name for this rule.
from	From[]	Yes	The in-mesh workloads that initiate outbound requests.
to	To[]	Yes	The external services that receive the traffic.

From

Field	Type	Required	Description
namespace	string	Yes	Namespace of the workload that initiates the request.
workloadSelector	map[string]string	No	Label selector that identifies specific workloads within the namespace.

To

Field	Type	Required	Description
name	string	Yes	A unique name for this external service entry within the rule.
hosts	string[]	Yes	Domain names or IP addresses of the external service. You can specify multiple domains, but all entries must resolve to the same address.
port	Port	Yes	Port of the external service. The `protocol` field accepts `HTTP`, `HTTPS`, or `TCP`.
byEgressGateway	ByEgressGateway	Yes	Port on the egress gateway used to forward traffic to this service. From ASM 1.24.6.45, if all `byEgressGateway` fields across every `to` entry in the policy are omitted, ASM auto-assigns a port for each service.
httpsUpgrade	HttpsUpgrade	No	Upgrades outbound HTTP requests to HTTPS at the egress gateway.

HttpsUpgrade

Field	Type	Required	Description
enabled	bool	Yes	Set to `true` to upgrade HTTP requests to HTTPS at the egress gateway. When set to `false`, the `port` value below is ignored.
port	uint32	Yes	HTTPS port on the external service (typically `443`).

Usage notes

Namespace: All ASMEgressTrafficPolicy resources must be created in the istio-egress namespace.
Naming: Name each policy after its associated egress gateway (for example, egress-by-egressgateway-a for gateway egressgateway-a).
Multiple domains: When listing multiple entries in hosts, all domains must resolve to the same IP address.
Auto port allocation: Available from ASM 1.24.6.45. Applies only when every to entry in the policy omits the byEgressGateway field.
Supported protocols: The protocol field in port accepts HTTP, HTTPS, or TCP. TCP support requires ASM 1.24.6.45 or later.

Alibaba Cloud Service Mesh:ASMEgressTrafficPolicy CRD description