Alibaba Cloud Service Mesh:Configure the service discovery scope to improve mesh configuration push efficiency

Method 1: Select the namespaces to discover

Use this method to enumerate the namespaces to discover. Only the namespaces that remain selected stay in the service discovery scope, so you must update the selection when you add a namespace that the control plane must discover.

1. On the Service Discovery Selectors page, set Mesh Discovery Mode to Automatically Discover Services in the Selected Namespace of a Kubernetes Cluster on the Data Plane.

2. On the Select Namespace tab, select the target cluster.

3. In the namespace list that appears, click unselect to the right of every namespace that you do not want the control plane to discover.

4. At the bottom of the page, click OK. In the Confirm dialog box, click OK.

Method 2: Use a label selector

Use this method to match namespaces by label. Every namespace whose labels match the selector stays in the service discovery scope, including namespaces that you create later. Before you configure the selector, make sure that each namespace you want the control plane to discover carries a matching label. Namespaces without a matching label are excluded from the scope.

1. On the Service Discovery Selectors page, set Mesh Discovery Mode to Automatically Discover Services in the Selected Namespace of a Kubernetes Cluster on the Data Plane, and then click the Edit Label Selector tab.

2. Specify the label rule that the namespaces must match. For example, set Key to asm-discovery and Operator to Exists to match every namespace that has the asm-discovery label.

3. At the bottom of the page, click OK. In the Confirm dialog box, click OK.

Check that the ASM instance applied the configuration

1. In the left-side navigation pane, choose Instance Information > Base Information.

2. On the Base Information page, check the Status of the mesh.

   If Status is Running, the ASM instance has accepted the configuration and is ready again. This status confirms the readiness of the instance only. To confirm that the control plane no longer processes services in the namespaces outside the scope, check the sidecar proxy configuration and the control-plane logs as shown in Example: Verify that the service discovery scope takes effect.

Step 1: Prepare the namespaces and the sample application

1. Create the ns-in-mesh and ns-not-in-mesh namespaces for the ACK cluster on the data plane. For more information, see Create a namespace.

2. Enable automatic sidecar proxy injection for the ns-in-mesh namespace. For more information, see Enable automatic injection.

3. Run the following command to add the asm-discovery=enabled label to the ns-in-mesh namespace in the ACK cluster. The label selector in Step 3 matches this label.

   kubectl label namespace ns-in-mesh asm-discovery=enabled

4. Use the following content to create the httpbin.yaml file.

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: httpbin
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: httpbin
     labels:
       app: httpbin
       service: httpbin
   spec:
     ports:
     - name: http
       port: 8000
       targetPort: 80
     selector:
       app: httpbin
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: httpbin
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: httpbin
         version: v1
     template:
       metadata:
         labels:
           app: httpbin
           version: v1
       spec:
         serviceAccountName: httpbin
         containers:
         - image: docker.io/kennethreitz/httpbin
           imagePullPolicy: IfNotPresent
           name: httpbin
           ports:
           - containerPort: 80

5. Run the following commands to create the httpbin sample application in the ns-in-mesh and ns-not-in-mesh namespaces.

   kubectl apply -f httpbin.yaml -n ns-in-mesh
   kubectl apply -f httpbin.yaml -n ns-not-in-mesh

Step 2: Check the push behavior before you narrow the scope

1. Run the following command to get the name of the httpbin pod in the ns-in-mesh namespace.

   kubectl get pods -n ns-in-mesh

   Expected output:

   NAME                       READY   STATUS    RESTARTS   AGE
   httpbin-6fcb98998c-46qhr   2/2     Running   0          22m

2. Run the following command to export the sidecar proxy configuration. In the command, replace httpbin-6fcb98998c-46qhr with the httpbin pod name that you obtained in the previous step.

   kubectl exec -it httpbin-6fcb98998c-46qhr -c istio-proxy -n ns-in-mesh -- curl -s localhost:15000/config_dump > config_dump.json

3. Open the config_dump.json file that you exported and search for httpbin.ns-not-in-mesh.

   The search returns httpbin.ns-not-in-mesh, which indicates that the sidecar proxy configuration still contains service information from the ns-not-in-mesh namespace, even though automatic sidecar proxy injection is not enabled for that namespace.

4. Use the following content to create the sleep.yaml file.

   ##################################################################################################
   # Sleep service
   ##################################################################################################
   apiVersion: v1
   kind: Service
   metadata:
     name: sleep
     labels:
       app: sleep
   spec:
     ports:
     - port: 80
       name: http
     selector:
       app: sleep
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: sleep
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: sleep
     template:
       metadata:
         labels:
           app: sleep
       spec:
         containers:
         - name: sleep
           image: pstauffer/curl
           command: ["/bin/sleep", "3650d"]
           imagePullPolicy: IfNotPresent
   ---

5. Run the following command to deploy the sleep application in the ns-not-in-mesh namespace of the ACK cluster.

   kubectl apply -f sleep.yaml -n ns-not-in-mesh

6. Check the control-plane logs. The console entry point depends on the version of the ASM instance.

{"content":"2024-01-04T10:27:00.056248Z\tinfo\tads\tPush debounce stable[16] 1 for config ServiceEntry/ns-not-in-mesh/sleep.ns-not-in-mesh.svc.cluster.local: 100.183738ms since last change, 100.183497ms since last push, full=true","_time_":"2024-01-04T18:27:00.056310074+08:00","_source_":"stdout","_container_name_":"discovery","__pack_meta__":"1|MTcwNDM2MjU0MjUyMjE4OTYxMA==|10|4","__topic__":"asm_istiod_discovery","__source__":"log_service","__time__":"1704364020"}
{"content":"2024-01-04T10:26:59.956023Z\tinfo\tads\tFull push, new service ns-not-in-mesh/sleep.ns-not-in-mesh.svc.cluster.local","_time_":"2024-01-04T18:26:59.956087922+08:00","_source_":"stdout","_container_name_":"discovery","__pack_meta__":"1|MTcwNDM2MjU0MjUyMjE4OTYxMA==|10|3","__topic__":"asm_istiod_discovery","__source__":"log_service","__time__":"1704364020"}

{"content":"2024-01-04T10:33:21.180016Z\tinfo\tads\tPush debounce stable[28] 2 for config Address//c847e048f73054cb192835f8a60ea5219//Pod/ns-not-in-mesh/sleep-fc5cdb9c5-pkfvr and 1 more configs: 100.488198ms since last change, 121.179298ms since last push, full=true","_time_":"2024-01-04T18:33:21.180104591+08:00","_source_":"stdout","_container_name_":"discovery","__pack_meta__":"0|MTcwNDM1NjA0OTcxOTcxNzAyMw==|11|9","__topic__":"asm_istiod_discovery","__source__":"log_service","__time__":"1704364401"}
{"content":"2024-01-04T10:33:21.079470Z\tinfo\tmodel\tFull push, new service ns-not-in-mesh/sleep.ns-not-in-mesh.svc.cluster.local","_time_":"2024-01-04T18:33:21.07954976+08:00","_source_":"stdout","_container_name_":"discovery","__pack_meta__":"0|MTcwNDM1NjA0OTcxOTcxNzAyMw==|11|8","__topic__":"asm_istiod_discovery","__source__":"log_service","__time__":"1704364401"}

Step 3: Narrow the service discovery scope to the ns-in-mesh namespace

Follow the procedure in Configure the service discovery scope to keep only the ns-in-mesh namespace in the scope:

• With Method 1, click unselect to the right of every namespace other than ns-in-mesh.

• With Method 2, set Key to asm-discovery and Operator to Exists, which matches ns-in-mesh because of the label that you added in Step 1.

Step 4: Check the push behavior after you narrow the scope

1. Run the following command to export the sidecar proxy configuration again. In the command, replace httpbin-6fcb98998c-46qhr with the httpbin pod name that you obtained in Step 2.

   kubectl exec -it httpbin-6fcb98998c-46qhr -c istio-proxy -n ns-in-mesh -- curl -s localhost:15000/config_dump > config_dump.json

2. Open the config_dump.json file that you exported and search for httpbin.ns-not-in-mesh.

   The search does not return httpbin.ns-not-in-mesh, which indicates that the sidecar proxy configuration no longer contains service information from the ns-not-in-mesh namespace.

3. Run the following command to delete the sleep application from the ns-not-in-mesh namespace in the ACK cluster.

   kubectl delete -f sleep.yaml -n ns-not-in-mesh

4. Check the control-plane logs again. Use the navigation path for your ASM version in Step 2: Check the push behavior before you narrow the scope, but set the time range to 15 Minutes so that the window covers the moment when you deleted the sleep application.

   No logs about the deletion of the sleep application appear. This indicates that changes in namespaces outside the service discovery scope do not trigger the control plane to push configurations to sidecar proxies.

Exclude pods with specified labels from the service discovery scope

Exclude pods that have a specified label to quickly drain all traffic that those pods receive. By default, ASM discovers all services and pods in a Kubernetes cluster. When a pod is outside the service discovery scope, the ASM control plane does not discover the pod, and sidecar proxies send no requests to the pod.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Service Discovery Selectors.

3. Expand Advanced Options, and then click Logs with specified labels are not selected to add a pod label rule.

4. Enter a Key and a Value. Pods that have the specified label are excluded from the service discovery scope. For example, use topology.kubernetes.io/region to exclude pods in a specific region, or use topology.kubernetes.io/zone to exclude pods in a specific zone.

5. At the bottom of the page, click OK. In the dialog box that appears, click OK.