Alibaba Cloud Service Mesh:Using DNS proxy in ASM

Scenario 1: Enable the DNS proxy feature globally

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Data Plane Component Management > Sidecar Proxy Setting.

3. On the Global tab, click DNS Proxy Feature, turn on the Enable DNS Proxy Feature switch, and then click Update Settings.

4. Restart the pod to apply the DNS configuration to the application.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Pods.

   3. On the Pods page, click Operation More > Delete in the column of the target pod.

   4. In the Prompt dialog box, click OK.

      Wait for a while. The configuration takes effect after the container restarts.

Scenario 2: Enable the DNS proxy feature for a specific namespace

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Data Plane Component Management > Sidecar Proxy Setting.

3. On the Sidecar Proxy Configuration page, click the Namespace tab.

4. Select a Namespace, click DNS Proxy Feature, select Enable DNS Proxy Feature, turn on the switch on the right, and then click Update Settings.

5. Restart the pod to apply the DNS configuration to the application.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Pods.

   3. On the Pods page, click Operation More > Delete in the column of the target pod.

   4. In the Prompt dialog box, click OK.

      Wait for a while. The configuration takes effect after the container restarts.

Scenario 3: Enable the DNS proxy feature for a specific pod

You need to add annotations to the pod's YAML file to enable the DNS proxy feature for a specific pod.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Deployments.

3. On the Stateless page, in the Operation column on the right side of the target application, select More > View YAML.

4. In the Edit YAML dialog box, add the following annotations under the spec parameter, and then click Update.

   annotations:
     proxy.istio.io/config: |
       proxyMetadata:
         ISTIO_META_DNS_CAPTURE: "true"
         ISTIO_META_DNS_AUTO_ALLOCATE: "true"

   

5. Restart the pod to apply the DNS configuration to the application.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Pods.

   3. On the Pods page, click Operation More > Delete in the column of the target pod.

   4. In the Prompt dialog box, click OK.

      Wait for a while. The configuration takes effect after the container restarts.

Step 1: Create an external service

Use an external service to add aliyun.com to the service registry maintained within Service Mesh.

1. Log on to the ASM console.

2. In the left-side navigation pane, choose Service Mesh > Mesh Management.

3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.

4. On the details page of the ASM instance, choose Cluster & Workload Management > External Service(ServiceEntry). On the page that appears, click Create from YAML.

5. On the Create page, select a Namespace, select any Scenario Template, copy the following service content to the text box, and then click Create.

   apiVersion: networking.istio.io/v1beta1
   kind: ServiceEntry
   metadata:
    name: test1-mydnsproxying
   spec:
    hosts:
    - aliyun.com
    location: MESH_EXTERNAL
    ports:
    - number: 443
      name: https
      protocol: TLS
    resolution: DNS

Step 2: Deploy a sample application

1. Obtain the KubeConfig file of the cluster and connect to the cluster by using kubectl.

2. Use the following content to create a file named sleep.yaml.

   Click to view sleep.yaml

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sleep
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: sleep
     labels:
       app: sleep
       service: sleep
   spec:
     ports:
     - port: 80
       name: http
     selector:
       app: sleep
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: sleep
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: sleep
     template:
       metadata:
         labels:
           app: sleep
       spec:
         terminationGracePeriodSeconds: 0
         serviceAccountName: sleep
         containers:
         - name: sleep
           image: curlimages/curl
           command: ["/bin/sleep", "3650d"]
           imagePullPolicy: IfNotPresent
           volumeMounts:
           - mountPath: /etc/sleep/tls
             name: secret-volume
         volumes:
         - name: secret-volume
           secret:
             secretName: sleep-secret
             optional: true

3. Run the following command to deploy the Sleep application.

   kubectl apply -f sleep.yaml

4. Run the following command to check whether the Sleep pod is successfully started.

   kubectl get pod |grep sleep

   Expected output:

   NAME                       READY   STATUS    RESTARTS   AGE
   sleep-66cd8f684f-nxw8v     2/2     Running   0          16m

Step 3: Enable the DNS proxy feature for the Sleep container

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Deployments.

3. On the Stateless page, in the Actions column on the right side of the target application, select More > View YAML.

4. In the Edit YAML dialog box, add the following annotations under the spec parameter, and then click Update.

   annotations:
     proxy.istio.io/config: |
       proxyMetadata:
         ISTIO_META_DNS_CAPTURE: "true"
         ISTIO_META_DNS_AUTO_ALLOCATE: "true"

   

5. Restart the pod to apply the DNS configuration to the application.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Pods.

   3. On the Pods page, click Operation More > Delete in the column of the target pod.

   4. In the Prompt dialog box, click OK.

      Wait for a while. The configuration takes effect after the container restarts.

Step 4: Verify whether the DNS proxy feature is successfully used

1. View the logs of the istio-init container.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Workloads > Pods.

   3. On the Pods page, click the name of the Sleep container.

   4. On the container details page, click the Logs tab and set Container to istio-init.

      You can see the following logs.

      -A OUTPUT -p udp --dport 53 -d 192.168.0.10/32 -j REDIRECT --to-port 15053
      -A ISTIO_OUTPUT -p tcp --dport 53 -d 192.168.0.10/32 -j REDIRECT --to-ports 15053

      The Sidecar proxy intercepts all DNS queries from the application container in the same way it intercepts other types of traffic through iptables rules. Istio adds additional iptables rules to redirect all DNS packets on port 53 (TCP and UDP) sent to the Kubernetes DNS service (such as the CoreDNS service) to port 15053.

2. View the ports that the pilot-agent process listens on.

   1. In the left-side navigation pane of the details page, choose Workloads > Pods.

   2. On the Pods page, click Operation Terminal in the istio-proxy column of the Sleep container, and then click .

   3. Run the following command in the istio-proxy container to view the ports that the pilot-agent process listens on.

      netstat -anp |grep 15053

      Expected output:

      tcp        0      0 127.0.0.1:15053         0.0.0.0:*               LISTEN      1/pilot-agent
      udp        0      0 127.0.0.1:15053         0.0.0.0:*                           1/pilot-agent

      DNS queries are redirected to the pilot-agent process running in the Sidecar proxy container. You can see that this process is listening on port 15053.

3. Access aliyun.com.

   1. In the left-side navigation pane of the details page, choose Workloads > Pods.

   2. On the Pods page, click Operations in the column to the right of the Sleep container, and then click Terminal. Click sleep.

   3. Run the following command in the Sleep container to access aliyun.com.

      curl -v https://aliyun.com

      Expected output:

      *   Trying 240.240.**.**:443...
      * Connected to aliyun.com (240.240.**.**) port 443 (#0)

      You can see that the returned address is 240.240.**.**, which is a virtual IP automatically assigned by Service Mesh, not the actual public IP address. Service Mesh uses iptables to intercept requests to kube-dns and routes them to the Sidecar Proxy running in the pod. When the application pod resolves aliyun.com to a virtual IP and sends a request, the virtual IP is replaced with the actual public IP address resolved in the Sidecar Proxy.