Improve availability and elasticity with an ASM Serverless gateway - Alibaba Cloud Service Mesh

A Service Mesh (ASM) serverless gateway is a new type of gateway that is provided by ASM. Serverless gateways help you handle traffic spikes to improve the stability of your system while keeping computing costs low. Compared with ASM gateways that run in Container Service for Kubernetes (ACK) clusters on the data plane, ASM serverless gateways have the advantages of high stability, high elasticity, and low cost. In addition, ASM serverless gateways are deployed in a serverless manner and managed by ASM. Therefore, ASM serverless gateways are highly available because they do not depend on ACK clusters. This topic describes how to use ASM serverless gateways and introduces logs and metrics related to ASM serverless gateways.

Prerequisites

An ACK cluster is added to your ASM instance whose version is 1.18.0.147 or later.
An application is deployed in the cluster that is added to the ASM instance.

Scenarios

ASM serverless gateways help you handle traffic spikes to improve the stability of your system while keeping computing costs low. ASM serverless gateways are commonly used in the following scenarios:

For online services with obvious traffic fluctuations, such as online education and e-commerce, you can use ASM serverless gateways to handle traffic spikes. With the serverless architecture, you can significantly reduce the amount of fixed resources, helping you reduce computing costs.
When multiple clusters are added to an ASM instance, for example, two ACK clusters are added to an ASM instance, ASM serverless gateways are deployed independent of a specific ACK cluster. This provides high availability.

Step 1: Create an ASM serverless ingress gateway

Currently, you can create an ASM Serverless gateway only with a YAML file. Compared to a standard ASM gateway that runs in a data plane ACK cluster, an ASM Serverless gateway requires the asm.alibabacloud.com/managed-by-asm: 'true' annotation and does not require an ACK cluster ID. To collect metrics, you can use the asm.alibabacloud.com/export-metrics annotation to export the gateway's metrics to a target data plane ACK cluster.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

On the Ingress Gateway page, click Create from YAML. Enter a name for the gateway, use the following YAML configuration, and then click Create.

apiVersion: istio.alibabacloud.com/v1beta1
kind: IstioGateway
metadata:
  annotations:
    asm.alibabacloud.com/managed-by-asm: 'true'
    asm.alibabacloud.com/export-metrics: 'ack-cluster-id'
  name: ingressgateway
  namespace: istio-system
spec:
  gatewayType: ingress
  dnsPolicy: ClusterFirst
  externalTrafficPolicy: Local
  hostNetwork: false
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
  replicaCount: 1
  resources:
    limits:
      cpu: '2'
      memory: 2G
    requests:
      cpu: 200m
      memory: 256Mi
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  runAsRoot: true
  serviceType: LoadBalancer

Note: The ASM serverless gateway that you created supports LoadBalancer and ClusterIP Services. If you set the serviceType parameter to ClusterIP, make sure that the client and gateway pods are interconnected. For example, by default, pods in the same virtual private cloud (VPC) can access each other by using the Terway plug-in.

Step 2: Create a traffic rule

Create an HTTP domain name.
1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
3. On the Ingress Gateway page, click the target gateway. In the left-side navigation pane of the gateway, click Domain/Certificate. On the Domain tab, click Create.
4. On the Add domain panel, set Domain to *, Protocol to HTTP, Port Name to http, and port to 80. Then, click Create.
Import the productpage service.
1. In the left-side navigation pane of the gateway, click Upstream Service and then click Import service.
2. On the Import service panel, select the default namespace, select productpage, click the icon, and then click Submit.
Create a routing rule.
1. In the left-side navigation pane of the gateway, click Route management and then click Create.
2. In the set route detail step, set route type to http, Namespaces to default, and Route Name to productpage. In the Matching Rules section, set matchRules to Prefix and Content to /. Then, click Next.
3. In the set route destination step, set select upstream service to productpage and then click Next.
4. In the Advanced Options step, click Create.

Step 3: Access the productpage service through the ASM serverless gateway

In the address bar of your browser, enter {Gateway IP address}/productpage to view the application's user interface. To obtain the IP address of the gateway, see Obtain the IP address of an ingress gateway.

Step 4: Configure the access log collection feature of the ASM serverless gateway

Important

If you configure the access log collection feature of the ASM serverless gateway, the gateway restarts. We recommend that you perform this operation during off-peak hours.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the Ingress Gateway page, find the target gateway, click View YAML in the Actions column. In the YAML editor, add the asm.alibabacloud.com/aliyun-logs-project: k8s-log-**** annotation to specify a Log Service project.

In this example, the access logs of the ASM serverless gateway are collected to the mesh-log-c4e1bbed247634d0482000d94e947**** project. The following code block provides the sample configurations:
Show the ingressgateway.yaml file
```
apiVersion: istio.alibabacloud.com/v1beta1
kind: IstioGateway
metadata:
  annotations:
    asm.alibabacloud.com/managed-by-asm: 'true'
    asm.alibabacloud.com/aliyun-logs-project: mesh-log-c4e1bbed247634d0482000d94e947****
  name: ingressgateway
  namespace: istio-system
spec:
 ....
```
Click OK to update the Serverless gateway.

Step 5: Configure access over HTTPS

Run the following commands to generate a Certificate Authority (CA) certificate.

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt 
openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

Configure the certificate.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Certificate Management.

On the Certificate Management page, click Create. In the Certificate Information panel, configure the parameters and click OK.

Parameter	Description
Name	The name of the certificate. For this example, enter myexample-credential.
Public Key Certificate	The electronic document used to prove the validity of the public key. For this example, enter the content of the aliyun.com.crt file generated in substep 1 in Step 5.
Private Key	The private key. For this example, enter the content of the aliyun.com.key file generated in substep 1 in Step 5.

Create an HTTPS domain name.
1. In the left-side navigation pane, click Ingress Gateway. Click the target gateway. In the left-side navigation pane of the gateway, click Domain/Certificate. On the Domain tab, click Create.
2. On the Add domain panel, set Domain to *, Protocol to HTTPS, Port Name to https, and port to 443. For Certificate, select myexample-credential. Select Secure connections with standard TLS semantics. and then click Create.

Run the following command to access the ASM serverless gateway over HTTPS:

curl -k -H Host:aliyun.com --resolve aliyun.com:443:{IP address of the desired ASM serverless gateway}  https://aliyun.com/productpage -I

Step 6: View the access logs of the ASM serverless gateway

Log on to the Simple Log Service console.
In the Projects area, click the target log name (the log name that you configured in Step 4.1). In the left navigation bar, click the icon (Log Storage). In the Logstore list, click mesh-ingress-log. In the search box, enter productpage and then click Search & Analyze.

The query results show the access logs for the istio-ingressgateway. In the content field of a log entry, a route_name of productpage and a response_code of 503 indicate that the gateway returned a 503 response for that route.

FAQ

How do I export the metrics of an ASM serverless gateway?

Ensure that metric generation and collection are enabled for ASM, allowing you to view the metrics dashboard on the Observability Management Center > Monitoring metrics page. For more information, see Collect metrics to Managed Service for Prometheus.
In the YAML file for the Serverless gateway, add the asm.alibabacloud.com/export-metrics: ${ack-cluster-id} annotation to export metrics.

This feature is available only for ASM instances whose versions are 1.18.0.147 or later. For more information about how to upgrade an ASM instance, see Upgrade an ASM instance.

After the asm.alibabacloud.com/export-metrics: ${ack-cluster-id} annotation is added, the services and endpoints of the ASM serverless gateway are synchronized to the specified ACK cluster. Then, you just need to configure the endpoint for data collection in Managed Service for Prometheus.

In the Application Real-Time Monitoring Service (ARMS) console, configure the endpoint for data collection.

Log on to the ARMS console.
In the left-side navigation pane, choose Managed Service for Prometheus > Instances. In the upper-left corner, select the target region.
On the Instances page, click the name of the Prometheus instance. In the left-side navigation pane, click Settings.

On the Settings tab of the Settings page, click Edit Prometheus.yaml, add the following configuration, and then click Save.

Show the YAML code

scrape_configs:
- job_name: istio-system/managed-envoy
  honor_timestamps: true
  honor_labels: false
  scrape_interval: 30s
  scheme: http
  metrics_path: /stats/prometheus
  relabel_configs:
  - regex: 'true'
    action: keep
    source_labels:
    - __meta_kubernetes_service_labelpresent_asm_sync_target
    replacement: $1
    separator: ;
  - regex: http-envoy-prom
    action: keep
    source_labels:
    - __meta_kubernetes_endpoint_port_name
    replacement: $1
    separator: ;
  - regex: (.*)
    action: replace
    source_labels:
    - __meta_kubernetes_namespace
    replacement: $1
    separator: ;
    target_label: namespace
  metric_relabel_configs:
  - regex: envoy_.*
    action: drop
    source_labels:
    - __name__
    replacement: $1
    separator: ;
  kubernetes_sd_configs:
  - role: endpoints
    namespaces: {}
    follow_redirects: true
  scrape_timeout: 10s

What do I do if I cannot access a backend application by using an ASM serverless gateway?

Make sure that the security group of the desired cluster on the data plane does not block traffic from the ASM serverless gateway.
1. View the CIDR block of the vSwitch of your ASM instance.
  1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.
  3. On the Basic Information page, click the link to the right of vSwitch. On the vSwitch details page, find the vSwitch's CIDR block.
2. View the security group of the desired cluster on the data plane.
  1. Log on to the ACK console. In the left navigation pane, click Clusters.
  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.
  3. On the Cluster Information page, click the Cluster Resources tab and then click the link to the right of Security Group.
  4. On the details page of the security group, view the inbound rules of the security group. Make sure that the CIDR block of the vSwitch of your ASM instance and the port of the backend application pod fall in the range that the rules specify.
If status codes such as 404 and 503 are returned, check whether traffic rules are correctly configured and whether the backend application runs as expected.