How to connect to an ASM instance using kubectl - Alibaba Cloud Service Mesh

Establish a connection between the kubectl client and the control plane of an ASM instance to manage Istio resources on the instance.

Background information

kubectl is the command-line tool for Kubernetes clusters. You can use the kubectl client to manage a cluster itself, install and deploy containerized applications on the cluster, and manage Service Mesh resources.

The connection described in this topic targets the control plane of the ASM instance.

Prerequisites

RBAC permissions — Your account is assigned a predefined ASM RBAC role that covers the resources you intend to manage. For details, see Permissions granted by predefined RBAC roles.
Internet access (Internet Access tab only) — Internet access to the API server is enabled for the ASM instance, that is, the ASM instance exposes its API server through an Alibaba Cloud Elastic IP Address (EIP). You can then use any machine on the Internet as a client.

Procedure

Install and set up the kubectl client. For Kubernetes version information, see the Kubernetes release notes. For installation instructions, see Install and Set Up kubectl.
Configure the connection credentials of the ASM instance.
1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.
3. In the upper-right corner of the Base Information page, click Connection.
4. On the Connection panel, click the tab that matches the network of your client. Click the Internet Access tab if the client reaches the ASM instance over the Internet. Click the Internal Access tab if the client reaches the ASM instance over the internal network.
  Note
  If Internet access to the API server is not enabled for the ASM instance, the connection configuration for Internet access is not displayed on the Connection panel.
5. Click Copy Kubeconfig File, and then copy the content to $HOME/.kube/config on your local computer, which is where kubectl expects the credentials. If the config file does not exist in the $HOME/.kube directory, create the file manually.
Run the following command to check whether the connection is established.
```
kubectl get ns
```
If namespace information is displayed, the connection is established.
If no namespace information is displayed, check the following items and then run the command again:
- The kubeconfig content that you copied in step 2 is saved to $HOME/.kube/config on the client.
- If the client reaches the instance over the Internet, Internet access to the API server is enabled for the ASM instance. See Prerequisites.
- The RBAC role of your account covers the resources that you query. See Permissions granted by predefined RBAC roles.

Permissions granted by predefined RBAC roles

Service Mesh (ASM) builds on the role-based access control (RBAC) mechanism provided by Kubernetes and offers predefined RBAC roles that grant users a scope of access permissions for Service Mesh resources.

The istio-admin role is one of these predefined roles. It grants the following permissions:

Namespaces on the control plane — Create, delete, get, list, patch, update, and watch.
Istio resources — Create, delete, get, list, patch, update, and watch. The following ClusterRole lists the Istio API groups that these permissions cover.
istiogateways resources in the istio.alibabacloud.com API group — Create, delete, get, list, patch, update, and watch. Use these resources to define ingress gateway services.
Other resources in the istio.alibabacloud.com API group — Get and list only.

The following ClusterRole defines the permissions of the predefined istio-admin role. ASM provides this ClusterRole, so the definition is for reference only.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-admin
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: 
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - config.istio.io
  - networking.istio.io
  - authentication.istio.io
  - rbac.istio.io
  - security.istio.io
  resources: ["*"]
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - istio.alibabacloud.com
  resources: ["istiogateways"]
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - istio.alibabacloud.com
  resources: ["*"]
  verbs:
  - get
  - list