Alibaba Cloud Service Mesh:Integrate an ALB with an ASM ingress gateway

Step 1: Deploy a test application

Create the Bookinfo sample application by using the KubeConfig of the data plane cluster. For more information, see Deploy an application to an ASM-associated cluster.

kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/platform/kube/bookinfo.yaml

Step 2: Create Istio resources

The gateway resource and virtual service that you create are used for the subsequent tests.

1. Create a gateway rule.

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Gateway.

   3. On the Gateway page, click Create and configure the following settings.

      In the Basic Information section, for Namespace, select default, and for Name, enter bookinfo-gateway. In the Apply to Gateway section, add a label with the name istio and the value ingressgateway. In the Service section, for Name, enter http; for Port, enter 80; and for Protocol, select HTTP. Then, click Create.

   4. At the bottom of the page, click Preview to view the YAML file of the gateway rule. After you confirm that the configuration is correct, click OK. Then, at the bottom of the Create page, click Create.

      Expand to view the YAML preview

      apiVersion: networking.istio.io/v1beta1
      kind: Gateway
      metadata:
        name: bookinfo-gateway
        namespace: default
      spec:
        selector:
          istio: ingressgateway
        servers:
          - port:
              number: 80
              name: http
              protocol: HTTP
            hosts:
              - '*'

2. Create a virtual service and configure routes.

   1. On the details page of the ASM instance, choose Traffic Management Center > VirtualService in the left-side navigation pane.

   2. On the VirtualService page, click Create to configure the virtual service for the bookinfo-gateway gateway.

      Configure the following parameters. For Namespace, select default. For Name, enter bookinfo. Turn off the Apply to All Sidecars switch, and add bookinfo-gateway to the gateway rules. In the HTTP Route section, add the following match rules: URI exact match /productpage, URI prefix match /static, URI exact match /login, URI exact match /logout, and URI prefix match /api/v1/products. Set the route destination service name to productpage and the port to 9080. Then, click Create.

   3. At the bottom of the Create page, click Preview to view the YAML file. After you confirm that the configuration is correct, click Submit. Then, at the bottom of the Create page, click Create.

      Expand to view the YAML preview

      apiVersion: networking.istio.io/v1beta1
      kind: VirtualService
      metadata:
        name: bookinfo
        namespace: default
      spec:
        gateways:
          - bookinfo-gateway
        hosts:
          - '*'
        http:
          - match:
              - uri:
                  exact: /productpage
              - uri:
                  prefix: /static
              - uri:
                  exact: /login
              - uri:
                  exact: /logout
              - uri:
                  prefix: /api/v1/products
            route:
              - destination:
                  host: productpage
                  port:
                    number: 9080
                              

Step 3: Create an AlbConfig

Scenario 1: Integrate an ASM ingress gateway with an existing ALB Standard Edition instance

1. Log on to Server Load Balancer console and get the ALB instance ID.

2. Use the following content to create the alb-demo.yaml file.

   Replace the config.id of the AlbConfig with the ALB instance ID.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: default
   spec:
     config:
       id: alb-xxxxx 
       forceOverride: false

3. Create the AlbConfig.

   kubectl apply -f alb-demo.yaml

Scenario 2: Integrate an ASM ingress gateway with a new ALB instance

1. Use the following content to create the alb-demo.yaml file. For more information, see Expose services with ALB Ingress.

   This configuration sets the name of the automatically created ALB instance to alb-demo.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: default
   spec:
     config:
       name: alb-demo
       addressType: Internet
       zoneMappings:
       - vSwitchId: vsw-uf6ccg2a9g71hx8go****
       - vSwitchId: vsw-uf6nun9tql5t8nh15****

   Parameter	Description
   spec.config.name	The name of the ALB instance.
   addressType	(Required) Specifies the address type of the load balancer. Valid values: Internet (default): The load balancer has a public IP address. The DNS domain name resolves to the public IP address, so the load balancer can be accessed over the Internet. Intranet: The load balancer has only a private IP address. The DNS domain name resolves to the private IP address, so the load balancer can be accessed only from the internal network of the VPC where it resides.
   zoneMappings	(Required) Specifies the vSwitch IDs for ALB Ingress. You must specify at least two vSwitch IDs in different zones. The specified vSwitches must be in zones that ALB currently supports. For information about the regions and zones that ALB Ingress supports, see Regions and zones supported by ALB; for information about how to create a vSwitch, see Create and manage vSwitches.

2. Create the AlbConfig.

    kubectl apply -f alb-demo.yaml

Step 4: Create an IngressClass

1. Create the alb.yaml file and copy the following content into it to create an IngressClass.

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: alb
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: default
       scope: Cluster

2. Create the IngressClass.

   kubectl apply -f alb.yaml

   Expected output:

   ingressclass.networking.k8s.io/alb created

Step 5: Configure an Ingress

The ASM ingress gateway service is created in the istio-system namespace. You must create the Ingress in the istio-system namespace of the data plane cluster (the ACK cluster). The port must be the same as port 80 that you specified when you created the ASM ingress gateway.

1. Create the asm-gateway-ingress.yaml file and copy the following content into it.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: asm-gateway-ingress
     namespace: istio-system
   spec:
     ingressClassName: alb
     rules:
     - http:
         paths:
         - backend:
             service:
               name: istio-ingressgateway
               port:
                 number: 80
           path: /*
           pathType: ImplementationSpecific
                   

2. Create the Ingress.

   kubectl apply -f asm-gateway-ingress.yaml

Step 6: Test access

1. Get the address of the Ingress instance.

   kubectl get ing -n istio-system

   Expected output:

   NAME                  CLASS   HOSTS   ADDRESS                                               PORTS   AGE
   asm-gateway-ingress   alb     *       alb-xxxx.xxxx.alb.aliyuncs.com                        80      18h

   The address of the Ingress instance is alb-xxxx.xxxx.alb.aliyuncs.com.

2. Access the ASM ingress gateway.

   • Method 1: Access the ASM ingress gateway by using the address of the Ingress instance from the previous step: http://alb-xxxx.xxxx.alb.aliyuncs.com/productpage.

   • Method 2: Log on to the ALB console and access the ASM ingress gateway by using the public IP address of the ALB instance. If a domain name is bound to the ALB instance, you can also use the domain name to access the gateway. On the instance details page of the ALB console, view the basic information of the ALB instance ingress_test_base. In the zone section at the bottom, get the Elastic IP Address (EIP) of each zone.

References

Terway network plugin