Access a WebSocket service through an ingress gateway - Alibaba Cloud Service Mesh

Prerequisites

Step 1: Deploy the sample application

Connect to the cluster using kubectl. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Create a YAML file named tornado.yaml with the following content.

apiVersion: v1
kind: Service
metadata:
  name: tornado
  labels:
    app: tornado
    service: tornado
spec:
  ports:
  - port: 8888
    name: http
  selector:
    app: tornado
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tornado
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tornado
      version: v1
  template:
    metadata:
      labels:
        app: tornado
        version: v1
    spec:
      containers:
      - name: tornado
        image: registry.cn-beijing.aliyuncs.com/aliacs-app-catalog/tornado:lastest
        imagePullPolicy: Always
        ports:
        - containerPort: 8888
---

Run the following command to create the tornado application.
```
kubectl apply -f tornado.yaml
```

Step 2: Configure routing rules

Log on to the ASM console.
In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
Create a Gateway.
1. On the details page of the ASM instance, choose ASM Gateways > Gateway in the left-side navigation pane. On the page that appears, click Create from YAML.
2. Set Namespaces to default, paste the following content, and click Create.
```
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tornado-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
```
  Set number to 80 to allow the WebSocket service to accept incoming or outgoing HTTP or TCP connections on port 80.
Create a VirtualService.
1. On the details page of the ASM instance, choose Traffic Management Center > VirtualService in the left-side navigation pane. On the page that appears, click Create from YAML.
2. Set Namespaces to default, paste the following content, and click Create.
```
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tornado
spec:
  hosts:
  - "*"
  gateways:
  - tornado-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: tornado
      weight: 100
```
  Setting hosts to * allows any request to access the WebSocket service.

Step 3: Get the ingress gateway address

ASM console

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the Ingress Gateway page, find the Service address.

ACK console

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Network > Services.
At the top of the Hosts page, select Namespaces from the Namespace drop-down list. In the External IP column, find the IP address associated with port 80 for the istio-ingressgateway service.

Step 4: Verify WebSocket service access

Enter http://<ingress gateway address> in four different browsers.

The page displays the title tornado WebSocket example. The WebSocket status is open (indicated by a green label). Below, the page displays nine data entries in three tables with No., id, and value columns. All initial values are 0.

Run the following commands to send requests to the WebSocket service.

curl "http://<ingress gateway address>/api?id=8&value=300"

curl "http://<ingress gateway address>/api?id=5&value=600"

curl "http://<ingress gateway address>/api?id=1&value=200"

curl "http://<ingress gateway address>/api?id=3&value=290"

The data on the WebSocket service pages in all four browsers updates simultaneously, showing identical results.

Step 5: Switch to the wss protocol

Configure a server certificate and private key for the gateway. For more information, see Step 1: Prepare server certificates and private keys for multiple hosts.

Ensure that you have a Secret named myexample-credential that contains the certificate and private key in the istio-system namespace of your ACK cluster.

Modify the Gateway you created in Step 2: Configure routing rules.

Example YAML:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tornado-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - hosts:
    - "*"
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: myexample-credential
      mode: SIMPLE

Step 6: Verify WebSocket service access over wss

Modify the hosts file on your local machine to resolve a.aliyun.com to the IP address of the ASM gateway. This allows you to access the ASM gateway by using the domain name in the certificate configured in Step 5.1.
In four different browsers, open https://a.aliyun.com.

The page displays the title tornado WebSocket example. The WebSocket status is open (indicated by a green label). Below, the page displays nine data entries in three tables with No., id, and value columns. All initial values are 0.

Run the following commands to send requests to the WebSocket service.

curl -k "https://<ingress gateway address>/api?id=8&value=300"

curl -k "https://<ingress gateway address>/api?id=5&value=600"

curl -k "https://<ingress gateway address>/api?id=1&value=200"

curl -k "https://<ingress gateway address>/api?id=3&value=290"

The data on the WebSocket service pages in all four browsers updates simultaneously, showing identical results.