Alibaba Cloud Service Mesh:Manage Spring Cloud services

Method 1: Reverse DNS (all registries)

1. Connect kubectl to the ASM control plane. See Use kubectl on the control plane to access Istio resources.

2. Create a file named any-spring-cloud-support.yaml: Replace the following values based on your environment:

   Parameter	Description	Where to find it
   portNumber	Port of your Spring Cloud service. Remove this parameter to match all ports, or create separate EnvoyFilter resources to target specific ports.	Application configuration
   pod_cidrs	Pod CIDR block of the ACK or ACK Serverless cluster.	In the Container Service Management Console, go to Clusters, click your cluster, and open the Cluster Resources tab. Click the VPC link to view the vSwitch CIDR block.

      apiVersion: networking.istio.io/v1alpha3
      kind: EnvoyFilter
      metadata:
        labels:
          provider: "asm"
          asm-system: "true"
        name: any-spring-cloud-support
        namespace: istio-system
      spec:
        configPatches:
        - applyTo: HTTP_FILTER
          match:
            proxy:
              proxyVersion: "^1.*"
            context: SIDECAR_OUTBOUND
            listener:
              portNumber: 8070
              filterChain:
                filter:
                  name: "envoy.filters.network.http_connection_manager"
                  subFilter:
                    name: "envoy.filters.http.router"
          patch:
            operation: INSERT_BEFORE
            value:
             name: com.aliyun.reverse_dns
             typed_config:
               "@type": "type.googleapis.com/udpa.type.v1.TypedStruct"
               type_url: type.googleapis.com/envoy.config.filter.reverse_dns.v3alpha.CommonConfig
               value:
                 pod_cidrs:
                 - "10.0.128.0/18"

3. Apply the EnvoyFilter:

      kubectl apply -f any-spring-cloud-support.yaml

Method 2: Lua filter (Nacos only)

1. Connect kubectl to the ASM control plane. See Use kubectl on the control plane to access Istio resources.

2. Create a file named external-nacos-svc.yaml to define a service entry for the Nacos server: Replace <your-nacos-server-host> with the Nacos server endpoint (for example, mse-xxx-p.nacos-ans.mse.aliyuncs.com). Port 8848 is the default Nacos port. If your self-managed Nacos uses a different port, update the number value.

      kind: ServiceEntry
      metadata:
        name: external-nacos-svc
      spec:
        hosts:
        - "<your-nacos-server-host>"  # Example: mse-xxx-p.nacos-ans.mse.aliyuncs.com
        location: MESH_EXTERNAL
        ports:
        - number: 8848
          name: http
        resolution: DNS

3. Apply the service entry:

      kubectl apply -f external-nacos-svc.yaml

4. Create a file named external-envoyfilter.yaml for the Lua-based EnvoyFilter:

      apiVersion: networking.istio.io/v1alpha3
      kind: EnvoyFilter
      metadata:
        labels:
          provider: "asm"
          asm-system: "true"
        name: nacos-subscribe-lua
        namespace: istio-system
      spec:
        configPatches:
        - applyTo: HTTP_FILTER
          match:
            proxy:
              proxyVersion: "^1.*"
            context: SIDECAR_OUTBOUND
            listener:
              portNumber: 8848
              filterChain:
                filter:
                  name: "envoy.filters.network.http_connection_manager"
                  subFilter:
                    name: "envoy.filters.http.router"
          patch:
            operation: INSERT_BEFORE
            value:
             name: envoy.lua
             typed_config:
                "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
                inlineCode: |
                   -- copyright: ASM (Alibaba Cloud ServiceMesh)
                   function envoy_on_request(request_handle)
                     local request_headers = request_handle:headers()
                     local path = request_headers:get(":path")
                     if string.match(path,"^/nacos/v1/ns/instance/list") then
                       local servicename = string.gsub(path,".*&serviceName.*40([%w.\\_\\-]+)&.*","%1")
                       request_handle:streamInfo():dynamicMetadata():set("context", "request.path", path)
                       request_handle:streamInfo():dynamicMetadata():set("context", "request.servicename", servicename)
                       request_handle:logInfo("subscribe for serviceName: " .. servicename)
                     else
                       request_handle:streamInfo():dynamicMetadata():set("context", "request.path", "")
                     end
                   end
                   function envoy_on_response(response_handle)
                     local request_path = response_handle:streamInfo():dynamicMetadata():get("context")["request.path"]
                     if request_path == "" then
                        return
                     end
                     local servicename = response_handle:streamInfo():dynamicMetadata():get("context")["request.servicename"]
                     response_handle:logInfo("modified response ip to serviceName:" .. servicename)
                     local bodyObject = response_handle:body(true)
                     local body= bodyObject:getBytes(0,bodyObject:length())
                     body = string.gsub(body,"%s+","")
                     body = string.gsub(body,"(ip\":\")(%d+.%d+.%d+.%d+)","%1"..servicename)
                     response_handle:body():setBytes(body)
                   end

5. Apply the EnvoyFilter:

      kubectl apply -f external-envoyfilter.yaml

Observe default behavior (before routing rules)

1. Get the ingress gateway IP address:

   1. Log on to the ASM console.

   2. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   3. Click your ASM instance name, then choose ASM Gateways > Ingress Gateway.

   4. Note the Service address on the Ingress Gateway page.

2. Send several requests to the consumer service: The responses alternate between V1 and V2 in round-robin fashion: This confirms that the consumer discovers both provider versions through Nacos and distributes traffic evenly. No Istio routing rules are in effect yet.

      curl <ingress-gateway-ip>/echo/world

      Hello Nacos Discovery From v1world
      Hello Nacos Discovery From v2world
      Hello Nacos Discovery From v1world
      Hello Nacos Discovery From v2world

Apply routing rules (after)

1. Create a file named service-provider.yaml to define a destination rule with version-based subsets:

      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: service-provider
      spec:
        host: service-provider
        subsets:
        - name: v1
          labels:
            label: v1
        - name: v2
          labels:
            label: v2

2. Apply the destination rule:

      kubectl apply -f service-provider.yaml

3. Create a file named service-provider-vs.yaml to define a virtual service that routes /echo/hello requests to V1 and all other requests to V2:

      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: service-provider
      spec:
        hosts:
        - service-provider
        http:
        - name: "hello-v1"
          match:
          - uri:
              prefix: "/echo/hello"
          route:
          - destination:
              host: service-provider
              subset: v1
        - name: "default"
          route:
          - destination:
              host: service-provider
              subset: v2

4. Apply the virtual service:

      kubectl apply -f service-provider-vs.yaml

5. Test the routing rules: All responses now come from V1 only: Compare this with the round-robin behavior observed earlier: /echo/hello requests now route exclusively to V1, while all other requests go to V2. Istio CRDs have taken over Spring Cloud traffic routing, confirming that ASM manages the services.

      curl <ingress-gateway-ip>/echo/hello

      Hello Nacos Discovery From v1hello
      Hello Nacos Discovery From v1hello

Traffic is not intercepted by the mesh

Check whether traffic blocking is enabled for the port or IP address of the registry:

• Method 1 (reverse DNS): You must block the IP address of the pod. Make sure the pod_cidrs value in your EnvoyFilter covers the correct pod CIDR block of your ACK cluster.

• Method 2 (Lua filter): You must block the Nacos server IP address and the cluster IP address.

Services are not registering correctly

This usually happens when the EnvoyFilter was not in place before the services started. The filter must intercept the registration process from the beginning. Restart the affected deployments:

kubectl rollout restart deployment <deployment-name>

Also confirm that each Spring Cloud service has a corresponding Kubernetes service resource with a cluster IP address.

Routing rules are not taking effect

Two common causes:

1. Nacos client SDK version (Method 2 only): Method 2 requires Nacos client SDK earlier than 2.0. Version 2.0+ uses gRPC instead of HTTP, which is incompatible with the Lua filter. Switch to Method 1 if your Nacos client SDK is 2.0 or later -- Method 1 works with all Nacos versions.

2. Outdated sidecar version: If the sidecar image version is earlier than 1.13.4.32, the data plane may not have been updated after a control plane upgrade. Restart the affected deployments to pick up the latest sidecar version.