Alibaba Cloud Service Mesh:Improve availability for an ASM ingress gateway

In an ACK cluster, configure a pod anti-affinity policy in the YAML file when you create an ASM gateway. This distributes the pods of the ASM gateway to different nodes or zones, which improves the high availability of the ASM gateway.

• Configure the podAntiAffinity parameter of the ASM gateway to distribute the pods of the ASM gateway to different nodes.

  apiVersion: istio.alibabacloud.com/v1beta1
  kind: IstioGateway
  metadata:
    name: ingressgateway-1
    namespace: istio-system
  spec:
    clusterIds:
      - "c954ee9df88f64f229591f0ea4c61****"
    cpu:
      targetAverageUtilization: 80
    externalTrafficPolicy: Local
    maxReplicas: 4
    minReplicas: 2
    ports:
    - name: status-port
      port: 15020
      targetPort: 15020
    - name: http2
      port: 80
      targetPort: 80
    - name: https
      port: 443
      targetPort: 80
    - name: tls
      port: 15443
      targetPort: 15443
    replicaCount: 1
    resources:
      limits:
        cpu: '2'
        memory: 2G
      requests:
        cpu: 200m
        memory: 256Mi
    sds:
      enabled: true
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 2000m
          memory: 1024Mi
    serviceType: LoadBalancer
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - istio-ingressgateway-1
            topologyKey: kubernetes.io/hostname
          weight: 100
    rollingMaxSurge: "100%"
    rollingMaxUnavailable: "25%"

  • preferredDuringSchedulingIgnoredDuringExecution: indicates that the pod anti-affinity is a soft affinity policy. If no node meets the configured requirements, the pod can still be scheduled.

  • matchExpressions: set key to app, operator to In, and values to istio-ingressgateway-1. This setting specifies that a pod cannot be deployed on the same node as pods that have the app=istio-ingressgateway-1 label. In other words, each node can run only one pod with the app=istio-ingressgateway-1 label.

  • topologyKey: specifies the dimension in which the pod anti-affinity takes effect.

    In this example, kubernetes.io/hostname is specified, which indicates that the policy takes effect in the node topology domain.

• Configure the podAntiAffinity parameter of the ASM gateway to distribute the pods of the ASM gateway to different zones.

  apiVersion: istio.alibabacloud.com/v1beta1
  kind: IstioGateway
  metadata:
    name: ingressgateway-1
    namespace: istio-system
  spec:
    clusterIds:
      - "c954ee9df88f64f229591f0ea4c61****"
    cpu:
      targetAverageUtilization: 80
    externalTrafficPolicy: Local
    maxReplicas: 4
    minReplicas: 2
    ports:
    - name: status-port
      port: 15020
      targetPort: 15020
    - name: http2
      port: 80
      targetPort: 80
    - name: https
      port: 443
      targetPort: 80
    - name: tls
      port: 15443
      targetPort: 15443
    replicaCount: 1
    resources:
      limits:
        cpu: '2'
        memory: 2G
      requests:
        cpu: 200m
        memory: 256Mi
    sds:
      enabled: true
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 2000m
          memory: 1024Mi
    serviceType: LoadBalancer
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - istio-ingressgateway-1
            topologyKey: topology.kubernetes.io/zone
          weight: 100
    rollingMaxSurge: "100%"
    rollingMaxUnavailable: "25%"

  • preferredDuringSchedulingIgnoredDuringExecution: indicates that the pod anti-affinity is a soft affinity policy. If no node meets the configured requirements, the pod can still be scheduled.

  • matchExpressions: set key to app, operator to In, and values to istio-ingressgateway-1. This setting specifies that a pod cannot be deployed in the same zone as pods that have the app=istio-ingressgateway-1 label. In other words, each zone can run only one pod with the app=istio-ingressgateway-1 label.

  • topologyKey: specifies the dimension in which the pod anti-affinity takes effect.

    In this example, topology.kubernetes.io/zone is specified, which indicates that the policy takes effect in the zone topology domain.