Managed mode deploys a single Mesh Topology service for an entire Service Mesh (ASM) instance, providing unified observation of the traffic topology across its data plane clusters. Enable managed mode when you want to observe multiple clusters instead of maintaining one Mesh Topology service in every data plane cluster.
Overview
Mesh Topology is an observability tool for ASM that provides a visual interface for viewing the services in the mesh and their configurations, which helps you quickly assess the health of your application services. Mesh Topology combines real-time request traffic with mesh configuration information to visualize mesh traffic, provide immediate insight into ASM behavior, and help you quickly locate issues.
Deployment modes
Mesh Topology can be enabled in either of the following two deployment modes: In-cluster deployment on the data plane and Managed mode. Managed mode requires an ASM instance that runs version 1.18.2.112 or later. Earlier versions support only in-cluster deployment on the data plane.
The following table compares the two modes.
| Item | In-cluster deployment on the data plane | Managed mode |
| Deployment and observation scope | Each data plane cluster of the ASM instance deploys its own Mesh Topology service. Each service connects to the Prometheus instance of the cluster that it runs in and observes the traffic topology of the services in that cluster. | Only one Mesh Topology service is deployed for the entire ASM instance, which provides unified observation of the traffic topology across multiple clusters. |
| Configuration | The Mesh Topology service in each data plane cluster requires separate configuration and has its own access endpoint, which increases configuration complexity. | The Mesh Topology service does not require separate configuration for each cluster, which reduces the configuration workload. |
| Service reliability | The availability of the Mesh Topology service depends on the data plane cluster. Issues such as insufficient cluster resources can make the service unavailable. | The workload of the Mesh Topology service is deployed as an Elastic Container Instance (ECI), which provides higher service reliability and usability. |
This topic describes how to enable Mesh Topology in managed mode. Use managed mode when you need unified observation of the traffic topology across multiple clusters.
Prerequisites
-
A Container Service for Kubernetes (ACK) managed cluster is created. For more information, see Create an ACK managed cluster.
-
The cluster is added to an ASM instance that runs version 1.18.2.112 or later. For more information, see Add a cluster to an ASM instance.
-
Mesh monitoring is implemented with a self-managed Prometheus instance or with Managed Service for Prometheus. For more information, see Integrate a self-managed Prometheus for mesh monitoring or Integrate Managed Service for Prometheus for mesh monitoring.
-
The access address of the Prometheus instance that the Mesh Topology service depends on is obtained. You specify this address when you enable managed mode. If you want to observe multiple clusters, the Prometheus instance must have collected the Envoy monitoring metrics of all the clusters that you want to observe.
-
(Conditional) If you do not create a Classic Load Balancer (CLB) instance to access Mesh Topology, access through an ASM gateway is configured and the gateway address is recorded. For instructions, see Method 2: Use an ASM gateway to access Mesh Topology in the "Step 2: Access Mesh Topology" section of Enable Mesh Topology to improve observability.
Step 1: Enable managed mode
Managed mode can be selected only when you enable Mesh Topology. If Mesh Topology is already enabled, disable the Mesh Topology feature and then enable it again.
-
Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
-
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Mesh Topology.
-
On the Mesh Topology page, click the Managed Mode tab, and then click Activate.
-
In the Enable Mesh Topology in Managed Mode dialog box, configure the parameters described in the following table, and then click OK.
| Parameter | Description |
| Clusters to observe |
Select one or more data plane clusters that you want the Mesh Topology service to observe. In managed mode, only one Mesh Topology service exists in the entire ASM instance. Important
When you configure a data plane cluster to be observed by the Mesh Topology service, the Mesh Topology workload obtains read-only permissions on the |
| Configure Prometheus address | Specify the access address of the Prometheus instance that the Mesh Topology service depends on. If you observe a single cluster, you can directly use the HTTP API address of the Prometheus instance integrated with that cluster. To obtain the address of a Managed Service for Prometheus instance, see Access Prometheus data through HTTP API URLs in Grafana or self-managed applications. If you observe multiple clusters, make sure that the Prometheus instance that you use has collected the Envoy monitoring metrics of all the specified clusters. If you use Managed Service for Prometheus, you can create an aggregation Prometheus instance for the Prometheus instances of the multiple clusters and obtain the HTTP API address of the aggregation instance. For more information, see Prometheus instance for GlobalView. |
| Access | Select whether to create a CLB instance to access Mesh Topology. If you do not select Create a CLB Instance to Access ASM Mesh Topology, you must configure access through an ASM gateway and record the gateway address before you enable the feature. See Prerequisites. |
| Authentication | In managed mode, Mesh Topology supports authentication only by logon with an Alibaba Cloud account or by OpenID Connect (OIDC). Logon by Using an Alibaba Cloud Account: If you did not select Create a CLB Instance to Access ASM Mesh Topology for Access, you must configure The address to access Mesh Topology. This address is the ASM gateway address that you configured for Access. Login with OIDC: You must configure the ClientID, ClientSecret, and IssuerUri fields of the identity provider (IdP). For more information about the IdP configuration, see Step 2: Add and configure an OIDC application. |
Step 2: Access Mesh Topology
In managed mode, you can access Mesh Topology either by creating a CLB instance or by using an ASM gateway. For instructions, see Method 1: Directly access Mesh Topology and Method 2: Use an ASM gateway to access Mesh Topology in the "Step 2: Access Mesh Topology" section of Enable Mesh Topology to improve observability.
References
-
If you find that some requests take an abnormally long time, you can use access logs to locate the cause of the abnormal request latency. For more information, see Use access logs to identify the cause of high request latency.
-
To keep traffic within the same availability zone as much as possible when a client accesses a destination service, use the zone-aware routing feature. This minimizes the call latency between services. For more information, see Use Mesh Topology to observe zone-aware routing.
-
In the Managed Service for OpenTelemetry console, you can view call information and the topology graphs generated from it to quickly analyze and diagnose performance bottlenecks and improve diagnostic efficiency. For more information, see Collect ASM tracing data to Managed Service for OpenTelemetry.
-
Enable the mesh audit feature to record or trace the daily operations of different users. To notify alert contacts promptly when critical resources change, you can also configure audit alerts for mesh resource operations. For more information, see Use KubeAPI operation audit and Configure audit alerts for mesh resource operations.
-
ASM reduces the attack surface in cloud-native environments and provides the framework required for a zero trust application network. By using ASM to manage service-to-service security, you can ensure end-to-end encryption, service-level authentication, and granular access control policies in ASM. For more information, see Zero trust security overview.