How to use an ASM gateway to expose in-cluster services - Alibaba Cloud Service Mesh

ASM lets you use Ingress resources in managed clusters and specify an ASM gateway as the ingress controller. This topic describes how to configure an Ingress resource in ACK and use an ASM gateway as an ingress controller to expose in-cluster services.

Prerequisites

An ACK cluster is added to an ASM instance (v1.16 or later). For more information, see Add a cluster to an ASM instance.
An ingress gateway service is deployed with ports 80 and 443 exposed. For more information, see Deploy an ingress gateway service.
The httpbin application is deployed. The application does not need to be exposed on the gateway. For more information, see Deploy the httpbin application.

Limitations

When you use an ASM gateway as an ingress controller, the defaultBackend field is not supported in an Ingress. For more information, see Ingress.
Only Ingress API v1 is supported in the data plane.

Overview

An Ingress is a standard Kubernetes API object that manages external access to services in a cluster. You can configure routing rules in an Ingress resource to expose HTTP or HTTPS services to external traffic.

ASM allows you to use Ingress resources in managed clusters and specify an ASM gateway as the Ingress Controller. The ASM gateway supports various advanced features, such as automatic scaling, TLS hardware acceleration, and graceful gateway shutdown. When you use an ASM gateway as an Ingress Controller, you can use the various observability and security capabilities that the Service Mesh provides. The ASM gateway also supports dynamic certificate loading. The private keys, server certificates, and root certificates required for TLS (Transport Layer Security) can be dynamically configured without restarting the gateway.

Step 1: Enable Ingress API access

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
For the target gateway, click Enable Ingress API access in the Advanced features: section. In the Confirm dialog box, click OK.

Step 2: Create an Ingress resource and specify the ingress controller

Because you cannot specify listener ports in an Ingress resource, traffic defaults to port 80 for HTTP and port 443 for HTTPS. Therefore, you must expose these ports on your ASM gateway.

Specify the ingress controller by using an annotation

Create a file named ingress.yaml with the following content.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
  name: ingress
spec:
  rules:
  - host: httpbin.aliyun.com
    http:
      paths:
      - path: /status
        pathType: Prefix
        backend:
          service:
            name: httpbin
            port:
              number: 8000

Connect to the ACK cluster with kubectl and run the following command:
```
kubectl apply -f ingress.yaml
```

Specify the ingress controller by using an IngressClass

Use the following content to create ingress.yaml.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
spec:
  ingressClassName: istio
  rules:
  - host: httpbin.aliyun.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: httpbin
            port:
              number: 8000

Connect to the ACK cluster with kubectl and run the following command:
```
kubectl apply -f ingress.yaml
```

Step 3: Verify HTTP access

Run the following command to access the httpbin service.

curl -H 'host: httpbin.aliyun.com'  http://${ASM_GATEWAY_IP}/status/418

Expected output:

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/

This output confirms that the Ingress resource exposed the httpbin application through the ASM gateway.

Step 4: Configure TLS and verify HTTPS access

ASM lets you specify TLS settings in an Ingress resource. Because the ASM gateway runs in the istio-system namespace, any Secret referenced in the Ingress resource must also exist in the istio-system namespace.

The ASM gateway's dynamic certificate loading allows you to configure TLS by mounting Secrets without restarting gateway pods. You can mount multiple Secrets to load different certificates. This process does not require a gateway pod restart.

The following procedure shows how to load a single certificate as an example. If you need to support multiple certificates, create an additional Secret for each certificate. The certificates are loaded automatically when referenced in the Ingress resource by following the patterns in step 2 and step 3 below.

Prepare the server certificate and private key.
A domain name must have an ICP filing to be accessible from the Chinese mainland. This example uses aliyun.com to generate a certificate and a private key and saves them as a Secret.
- Scenario 1: You do not have a certificate and private key for aliyun.com
  
  Use openssl to generate a certificate and key:
  1. Run the following command to create a root certificate and private key.
```
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt
```
  2. Run the following commands to generate a server certificate and private key for aliyun.com.
```
openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt
```
  3. From your KubeConfig environment, run the following command to create a Secret in the istio-system namespace:
```
kubectl create -n istio-system secret tls myexample-credential --key=aliyun.com.key --cert=aliyun.com.crt
```
- Scenario 2: You already have a valid certificate and private key for aliyun.com
  1. Name the certificate aliyun.com.crt and the private key aliyun.com.key.
  2. From your KubeConfig environment, run the following command to create a Secret in the istio-system namespace:
```
kubectl create -n istio-system secret tls myexample-credential --key=aliyun.com.key --cert=aliyun.com.crt
```
Create an Ingress resource and specify the TLS Secret as myexample-credential created in Step 1.
1. Use the following content to create ingress-https.yaml.
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.class: istio
spec:
  rules:
    - host: httpbin.aliyun.com
      http:
        paths:
          - backend:
              service:
                name: httpbin
                port:
                  number: 8000
            path: /status
            pathType: Prefix
  tls:
    - hosts:
        - httpbin.aliyun.com
      secretName: myexample-credential
```
  Note
  If you create an Ingress resource in the ACK console, you can select a Secret for a certificate only from the same namespace as the Ingress resource. For example, if you create an Ingress resource in the default namespace, you can select only Secrets from the default namespace. Therefore, you need to copy the myexample-credential Secret that you created in Step 1 to the default namespace to ensure that you can select this Secret in the ACK console.
2. Connect to the ACK cluster by using kubectl and run the following command to apply the Ingress resource.
```
kubectl apply -f ingress-https.yaml
```

Run the following command to access the httpbin service over HTTPS.

curl  -H Host:httpbin.aliyun.com --resolve httpbin.aliyun.com:443:${ASM_GATEWAY_IP} https://httpbin.aliyun.com:443/status/418 -k

Expected output:

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/

This output confirms that the Ingress resource exposed the httpbin application over HTTPS via the ASM gateway.