Alibaba Cloud Service Mesh:Manage workloads on ACK CloudBox nodes with ASM

Deployment overview

The setup consists of three steps:

1. Deploy an ingress gateway in the CloudBox zone -- Create an IstioGateway resource with zone annotations so that both the Classic Load Balancer (CLB) instance and the gateway pod are placed in the CloudBox zone.

2. Deploy an application and configure routing -- Schedule the httpbin application on CloudBox nodes and route traffic through the ingress gateway.

3. Verify connectivity -- Send test requests through the gateway to confirm traffic reaches the application.

CloudBox networking constraints

CloudBox restricts how LoadBalancer-type Services work compared to public cloud zones. CLB instances in a CloudBox zone can only use CloudBox Elastic Compute Service (ECS) instances as backends, and CLB instances in a public cloud zone can only use public cloud ECS instances. CloudBox CLB instances do not support Elastic IP Address (EIP) attachment, so you cannot create a public-facing CLB in a CloudBox zone.

Because of these constraints, the gateway CLB and gateway pod must reside in the same zone. A CLB in the public cloud zone cannot route traffic to pods in the CloudBox zone, and vice versa.

Prerequisites

Before you begin, make sure that you have:

• An ACK cluster with a CloudBox node pool. For more information, see Use CloudBox resources in an ACK cluster

• An ASM instance with the ACK cluster added. For more information, see Create an ASM instance and Add a cluster to an ASM instance

• Automatic sidecar proxy injection is enabled.

Deploy an ingress gateway in the CloudBox zone

To place the gateway in the CloudBox zone, configure two fields in the IstioGateway spec:

• serviceAnnotations -- Pin the CLB instance to the CloudBox zone and virtual switch.

• nodeSelector -- Schedule the gateway pod onto nodes in the CloudBox zone. You can also use the affinity field for more advanced scheduling rules.

The following YAML creates an intranet-facing ingress gateway in the CloudBox zone:

apiVersion: istio.alibabacloud.com/v1beta1
kind: IstioGateway
metadata:
  name: ingressgateway
  namespace: "istio-system"
spec:
  clusterIds:
    - <your-ack-cluster-id>
  externalTrafficPolicy: Local
  gatewayType: ingress
  ports:
  - name: http
    port: 80
    targetPort: 80
  - name: https
    port: 443
    targetPort: 443
  replicaCount: 2
  resources:
    limits:
      cpu: '2'
      memory: 2G
    requests:
      cpu: 200m
      memory: 256Mi
  serviceType: LoadBalancer
  serviceAnnotations:
    service.beta.kubernetes.io/alicloud-loadbalancer-address-type: intranet
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vswitch-id: <cloudbox-vswitch-id>
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-master-zoneid: <cloudbox-zone-id>
  nodeSelector:
    topology.kubernetes.io/zone: <cloudbox-zone-id>
  rollingMaxSurge: "100%"
  rollingMaxUnavailable: "25%"

Replace the following placeholders with your actual values:

Apply the YAML using one of these methods:

• kubectl with ASM kubeconfig: Save the YAML to a file and run kubectl apply -f <file>.yaml using the ASM instance kubeconfig.

• ASM console: Create the gateway through YAML in the ASM console. For more information, see Use KubeAPI to manage an ingress gateway.

# Check gateway pod status
kubectl get pods -n istio-system -l istio=ingressgateway

# Check the gateway Service and its external IP
kubectl get svc -n istio-system ingressgateway

Deploy the application and configure routing

The gateway created in the previous step is intranet-only and not accessible from the public internet. Make sure your test environment has connectivity to the VPC network before you proceed.

Follow the steps in Deploy the httpbin application to:

1. Deploy the httpbin application to the ACK cluster on CloudBox nodes.

2. Create a Gateway and VirtualService to route traffic through the ingress gateway.

# Get the gateway IP
GATEWAY_IP=$(kubectl get svc -n istio-system ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

# Send a test request
curl -I http://$GATEWAY_IP/status/200

Troubleshooting

Related topics

• Configure traffic management policies for fine-grained routing between public cloud and CloudBox workloads

• Enable observability to monitor cross-zone traffic

• Set up mTLS to secure communication between services across zones