How to Log on to the ASM Mesh Topology with an Alibaba Cloud Account - Alibaba Cloud Service Mesh

Service Mesh (ASM) of V1.16.4.5 or later allows you to log on to Mesh Topology with an Alibaba Cloud account or as a Resource Access Management (RAM) user. This topic describes how to log on to Mesh Topology with an Alibaba Cloud account or as a RAM user.

Prerequisites

An ASM instance whose version is 1.16.4.5 or later is created. For more information, see Create an ASM instance or Update an ASM instance.
A Container Service for Kubernetes (ACK) cluster is added to the ASM instance. For more information, see Create an ACK managed cluster and Add a cluster to an ASM instance.
Mesh Topology is enabled and the logon page of Mesh Topology is accessible. For more information, see Step 1 and Step 2 in Enable Mesh Topology to observe an ASM instance in the ASM console.

Step 1: Create and configure an OAuth application in the RAM console

Create an Open Authorization (OAuth) application in the RAM console . For more information, see Create an application.

Parameter

Description

Application Type

Select WebApp.

Callback Address

If you log on to Mesh Topology by using the Classic Load Balancer (CLB) instance associated with your ASM instance, enter the IP address of the CLB instance. If you log on to Mesh Topology by using an ingress gateway, enter the IP address of the ingress gateway. The following configurations are examples:

If you use a CLB instance to log on and its IP address is xxx.xxx.xxx.xxx, set the Callback Address to http://xxx.xxx.xxx.xxx:20001. The callback URL must end with the port number 20001 and must not include a trailing path such as / or /example.
If you use an ingress gateway to log on and its IP address is yyy.yyy.yyy.yyy, set the Callback Address to http://yyy.yyy.yyy.yyy:20001. The callback URL must end with the port number 20001 and must not include a trailing path such as / or /example.

On the Enterprise Applications tab, find your application and note its Application ID.
Create an application secret for the OAuth application in the RAM console and save the application secret. For more information, see Create an application secret.
Note
The application secret is visible only when you create it and cannot be queried. Therefore, you must save the secret when you create it.

Step 2: Configure Mesh Topology in the ASM console to connect to the OAuth application

ASM Mesh Topology allows you to use the OpenID Connect (OIDC) protocol to connect to an OAuth application.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Mesh Topology.

On the Mesh Topology page, in the Authentication section, select Login with OIDC, configure the parameters, and then click Save configuration of Mesh Topology.

Parameter	Description
Client ID provided by the issuer (ClientID)	The application ID that is saved in Step 1.
Client Secret provided by the issuer	The application secret that is saved in Step 1.
Enter an OIDC issuer URL	Enter https://oauth.aliyun.com.
OAuth Scope	Select only Basic Information.

Step 3: Log on to ASM Mesh Topology with an Alibaba Cloud account or as a RAM user

Method 1: Use a CLB instance to log on to ASM Mesh Topology

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Mesh Topology.
On the Mesh Topology page, in the Access section, click Click here to access ASM Mesh Topology next to Access ASM Mesh Topology.
On the mesh topology logon page, click Log In With OpenID to access the ASM mesh topology console.

Note
If you are not logged on, clicking Log In With OpenID redirects you to the Alibaba Cloud RAM User Logon page. Log on with your Alibaba Cloud account or as a RAM user, and then click Next to continue to the ASM mesh topology console.

Method 2: Use an ingress gateway to log on to ASM Mesh Topology

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.
On the Basic Information page, in the Config Info section, click Access from Ingress Gateway next to Activate ASM mesh topology .
On the logon page of ASM Mesh Topology, click Log In With OpenID to go to the ASM Mesh Topology console.

Note
If you are not logged on, clicking Log In With OpenID redirects you to the Alibaba Cloud RAM User Logon page. Log on with your Alibaba Cloud account or as a RAM user, and then click Next to continue to the ASM mesh topology console.