Alibaba Cloud Service Mesh:Create an IPv6 gateway

Method 1: Create an IPv6 ASM gateway

When you create an ASM gateway, add theservice.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version: "ipv6" annotation to assign it an IPv6 address.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

3. On the Ingress Gateway page, click Create from YAML.

4. On the Create page, set Namespaces to istio-system, enter the following content in the editor, and then click Create.

   Set the clusterIds field to the ID of your data plane cluster.

   Sample YAML

   apiVersion: istio.alibabacloud.com/v1beta1
   kind: IstioGateway
   metadata:
     name: ingressgateway
     namespace: istio-system
   spec:
     gatewayType: ingress
     clusterIds:
       - c808cdd6abd854d5ba6764da5ca2e****          # Replace this with the ID of your data plane cluster.
     ports:
       - name: http-0
         port: 80
         targetPort: 80
         protocol: HTTP
       - name: https-1
         port: 443
         targetPort: 443
         protocol: HTTPS
     serviceAnnotations:
       service.beta.kubernetes.io/alicloud-loadbalancer-address-type: internet
       service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec: slb.s1.small
       service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version: "ipv6"
     replicaCount: 1
     resources:
       limits:
         cpu: '2'
         memory: 4G
       requests:
         cpu: 200m
         memory: 256Mi
     serviceType: LoadBalancer
     autoCreateGatewayYaml: true                      

   Parameter	Description
   service.beta.kubernetes.io/alicloud-loadbalancer-address-type	The network type of the CLB instance. Valid values are: internet: A public network. intranet: A private network.
   service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec	The specification of the CLB instance. Valid values are:slb.s1.small, slb.s2.small, slb.s2.medium, slb.s3.small, slb.s3.medium, and slb.s3.large.
   service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version	Set the value to "ipv6" to assign an IPv6 address to the CLB instance.

   After the gateway is created, the Ingress Gateway page displays an IPv6 address as the Service address for the gateway.

Method 2: Add IPv6 to an existing ASM gateway

If you have an ASM gateway that uses an IPv4 address, you can add IPv6 support by creating an additional CLB instance. This allows the gateway to use both IPv4 and IPv6 addresses.

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Network > Services.

3. On the Services page, set Namespace to istio-system at the top of the page, and then click Create Resources in YAML in the upper-right corner.

4. On the Create page, set Sample Template to Custom, copy the following content into the Template editor, and then click Create.

   Important

   The nodePort value must not conflict with any existing port number.

   Sample YAML

   apiVersion: v1
   kind: Service
   metadata:
     annotations:
       service.beta.kubernetes.io/alicloud-loadbalancer-address-type: internet
       service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec: slb.s1.small
       service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version: "ipv6"
     labels:
       app: istio-ingressgateway
       asm-system: 'true'
       istio: ingressgateway
     name: istio-ingressgateway-2
     namespace: istio-system
   spec:
     externalTrafficPolicy: Cluster
     ports:
       - name: http-0
         nodePort: 30544
         port: 80
         protocol: TCP
         targetPort: 80
       - name: https-2
         nodePort: 30682
         port: 443
         protocol: TCP
         targetPort: 443
     selector:
       app: istio-ingressgateway
       asm-system: 'true'
       istio: ingressgateway
       provider: asm
     sessionAffinity: None
     type: LoadBalancer
                           

   Parameter	Description
   service.beta.kubernetes.io/alicloud-loadbalancer-address-type	The network type of the CLB instance. Valid values are: internet: A public network. intranet: A private network.
   service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec	The specification of the CLB instance. Valid values are:slb.s1.small, slb.s2.small, slb.s2.medium, slb.s3.small, slb.s3.medium, and slb.s3.large.
   service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version	Set the value to "ipv6" to assign an IPv6 address to the CLB instance.

   After the service is created, the Services page lists the IPv4 and IPv6 addresses for istio-ingressgateway and istio-ingressgateway-2 in the External IP column. These addresses serve as the IPv4 and IPv6 entrypoints for the ASM gateway.

FAQ

Get the original client IPv6 address

1. Configure the CLB instance that is associated with the IPv6 address. Modify the listener configurations for ports 80 and 443. In the Advanced Settings section, enable the Proxy Protocol. For more information, see Obtain the real IP address of a client by using the Layer 4 listener of a CLB instance.

2. Create an EnvoyFilter Template.

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template. On the page that appears, click Create EnvoyFilter Template.

   3. On the Create page, enter a template name, click Add an EnvoyFilter template for specific adapted istio version., select an Adapted istio version, configure the following YAML, and then click Create.

      apiVersion: networking.istio.io/v1alpha3
      kind: EnvoyFilter
      metadata:
        name: proxy-protocol
        namespace: istio-system
      spec:
        configPatches:
        - applyTo: LISTENER
          patch:
            operation: MERGE
            value:
              listener_filters:
              - name: envoy.listener.proxy_protocol
              - name: envoy.listener.tls_inspector
        workloadSelector:
          labels:
            istio: ingressgateway

3. Apply the EnvoyFilter Template to the ASM gateway to enable Proxy Protocol support.

   1. On the EnvoyFilter Template page, find the target template and click Edit template in the Actions column.

   2. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and then click Bind EnvoyFilter to Workloads.

   3. In the Bind EnvoyFilter to Workloads dialog box, set Namespaces to istio-system and Workload Type to Deployment. In the Not bound section, click Bind next to the target gateway, and then click OK.

4. Access the IPv6 URL of the gateway over an IPv6 network and view the corresponding gateway logs.

   In the sample gateway log below, the value of thedownstream_remote_address field is the client's original IPv6 address.

   {"upstream_cluster":null,"bytes_received":0,"downstream_local_address":"[2400:XXXX:1300::12d1]:80","upstream_service_time":null,"FILTER_CHAIN_NAME":null,"path":"/","x_forwarded_for":"2402:XXXX:1800:af00:0:9671:f00f:314b","upstream_host":null,"bytes_sent":0,"requested_server_name":null,"route_name":null,"response_flags":"NR","start_time":"2022-12-28T06:41:57.796Z","upstream_transport_failure_reason":null,"protocol":"HTTP/1.1","authority":"[2400:XXXX:1300::12d1]","LOCAL_REPLY_BODY":"","duration":0,"method":"GET","downstream_remote_address":"[2402:XXXX:1800:af00:0:9671:f00f:314b]:58272","request_id":"fee2b69a-b755-986b-91e4-5d228c81****","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36","trace_id":null,"authority_for":"[2400:XXXX:1300::12d1]","upstream_local_address":null,"istio_policy_status":null,"response_code":404}