Connect ACK applications to the MSE governance center - Microservices Engine

You can connect your Spring Cloud and Dubbo microservice applications running in Container Service for Kubernetes and Container Compute Service to the MSE governance center. With MSE, you can use a wide range of service governance capabilities to improve the stability of your online microservices and increase development efficiency. This topic describes how to connect microservice applications from ACK and ACS to the MSE governance center.

Prerequisites

You have created a managed cluster or an ACK Serverless cluster.
You have activated MSE microservices governance.
The ACK or ACS cluster and the MSE governance center are in the same region.

Important

If your project uses the open-source Sentinel component along with com.alibaba.cloud.sentinel.feign.SentinelFeignAutoConfiguration, the connection to the MSE governance center will fail.
The JVM heap memory must be greater than 256 MB when you attach the MSE Java agent.
Ensure that the ACK cluster has the required permissions to access MSE resources.

By default, managed ACK clusters include this token. However, some older clusters may not, so we recommend verifying that the token exists.

Follow these steps to check for the ARMS Addon Token in a managed ACK cluster:
1. Log on to the Container Service for Kubernetes console. On the Clusters page, click the name of the target cluster.
2. In the navigation pane on the left, choose Configuration Management > Secrets. From the Namespaces drop-down list, select kube-system and check if addon.arms.token exists. If it does not exist, you must grant the permissions manually.
If you use a RAM user for this process, see Permissions for RAM users.

Procedure

Note

Recommendations for selecting a connection method:

If you need to connect all or most applications in a namespace to the MSE governance center, we recommend following Scenario 1: Enable governance for a namespace. For applications that do not need to be connected, you must add the following label to their YAML files: spec.template.labels.msePilotAutoEnable: "off".
If you need to connect only a few applications in a namespace to the MSE governance center, we recommend following Scenario 2: Enable governance for a single application.

Scenario 1: Enable governance for a namespace

After you enable MSE microservices governance for a namespace, MSE automatically connects the pods of all newly created and redeployed applications in that namespace to the governance center. You do not need to connect them individually. For more information about how to create an application, see Create a stateless workload Deployment.

Log on to the MSE console, and select a region in the top navigation bar.
In the left-side navigation pane, choose Microservices Governance > Application Governance.
On the Application list page, click ACK Application Access.

In the ACK Application Access dialog box, configure the parameters and click OK.

Set Onboarding Type to Namespace or Single Application. From the Container Cluster Namespace drop-down list, select the target namespace, such as default. In the Governance Namespace field, enter a name for the corresponding namespace.

Parameter	Description
Cluster type	Select ACK Cluster, ACK Serverless Cluster, or ACS Cluster. Note If you have not authorized Container Service for Kubernetes to call MSE, click Authorize Now to grant the required permissions.
Cluster Name/ID	Select the Cluster Name/ID of the cluster that you want to connect to the MSE governance center. You can search for the cluster by keyword.
ack-onepilot	Displays the status of the ack-onepilot component. For more information about this component and how to upgrade it, see ack-onepilot component and Install and upgrade the MSE microservices governance component. If ack-onepilot is not installed, the system automatically starts the installation after you select a cluster and displays the message "The installation process takes about 1 minute. Wait for a while." If you use a RAM user and receive a permission error, log on to the Container Service for Kubernetes console. Go to the target cluster, and in the navigation pane on the left, click Add-ons. Find ack-onepilot and click Install. If ack-onepilot is already installed, the UI displays the installed version, for example, `Installed 4.2.0`. Note You can view details about the ack-onepilot component by logging on to the Container Service for Kubernetes console, navigating to the target cluster, and choosing Operations > Add-ons. After ack-onepilot is installed, it automatically injects a Java agent. This may increase application startup time by up to 10 seconds. When connecting by namespace, if your target cluster is not in one of the listed regions, ensure it has public network access and can connect to acm.aliyun.com:8080: China (Qingdao), China (Hangzhou), China (Beijing), China (Shanghai), Shanghai Finance Cloud, China (Shenzhen), Hong Kong (China), Singapore, Germany (Frankfurt), Australia (Sydney), US (Silicon Valley), and US (Virginia).
Access Type	Select Namespace Access.
Cluster Namespace	Select the Cluster Namespace.
Microservices Governance Namespace	Select a Microservices Governance Namespace.

Additional information:

After you connect an application in an ACK or ACS cluster to the MSE governance center, the console displays its Deployment name by default. To specify a custom application name, modify the YAML configuration of the deployed application.

spec:
  template:
    metadata:
      labels:
        # The MSE microservices governance namespace for your application. Defaults to 'default'.
        mseNamespace: default
        # Replace with your desired application name.
        msePilotCreateAppName: "your-deployment-name"

To disable microservices governance for a specific application, add the msePilotAutoEnable label to the application's YAML configuration and set its value to off.

spec:
  template:
    metadata:
      labels:
        # The value "off" must be enclosed in single or double quotation marks.
        msePilotAutoEnable: "off"

Scenario 2: Enable governance for a single application

If you need to connect only a few applications in your namespace to the MSE governance center, you can connect them one by one.

Log on to the MSE console, and select a region in the top navigation bar.
In the left-side navigation pane, choose Microservices Governance > Application Governance.
On the Application list page, click ACK Application Access.

In the ACK Application Access dialog box, configure the parameters and click OK.

Set Onboarding Type to Single Application. In the Edit Labels (YAML format) section, add the following labels under spec.template.metadata.labels in the application's Deployment YAML file: msePilotAutoEnable: "on" to enable microservices governance, mseNamespace: default to specify the MSE namespace, and msePilotCreateAppName: "your-deployment-name" to set the application name. Replace your-deployment-name with the actual Deployment name.

Parameter	Description
Cluster type	Select ACK Cluster, ACK Serverless Cluster, or ACS Cluster. Note If you have not authorized Container Service for Kubernetes to call MSE, click Authorize Now to grant the required permissions.
Cluster Name/ID	Select the Cluster Name/ID of the cluster that you want to connect to the MSE governance center. You can search for the cluster by keyword.
ack-onepilot	Displays the status of the ack-onepilot component. For more information about this component and how to upgrade it, see ack-onepilot component and Install and upgrade the MSE microservices governance component. If ack-onepilot is not installed, the system automatically starts the installation after you select a cluster and displays the message "The installation process takes about 1 minute. Wait for a while." If you use a RAM user and receive a permission error, log on to the Container Service for Kubernetes console. Go to the target cluster, and in the navigation pane on the left, click Add-ons. Find ack-onepilot and click Install. If ack-onepilot is already installed, the UI displays the installed version, for example, `Installed 4.2.0`. Note You can view details about the ack-onepilot component by logging on to the Container Service for Kubernetes console, navigating to the target cluster, and choosing Operations > Add-ons. After ack-onepilot is installed, it automatically injects a Java agent. This may increase application startup time by up to 10 seconds. When connecting by namespace, if your target cluster is not in one of the listed regions, ensure it has public network access and can connect to acm.aliyun.com:8080: China (Qingdao), China (Hangzhou), China (Beijing), China (Shanghai), Shanghai Finance Cloud, China (Shenzhen), Hong Kong (China), Singapore, Germany (Frankfurt), Australia (Sydney), US (Silicon Valley), and US (Virginia).
Access Type	Select Single Application Access.
Access Procedure	Follow these steps. Step 1: In the Container Service for Kubernetes console, navigate to the Workloads > Deployments page of your cluster and switch to your application's namespace. Step 2: Find the target application and click Edit YAML. Step 3: Edit the `labels` field as shown in the following example and click Update. `spec: template: metadata: labels: # Set to "on" to enable connection. The value must be enclosed in double quotation marks. msePilotAutoEnable: "on" # Specify the target governance namespace. If the namespace does not exist, it is automatically created. mseNamespace: default # Specify the application name to be displayed in MSE. The value must be enclosed in double quotation marks. msePilotCreateAppName: "your-deployment-name"`

Verify the results

After you complete these steps and restart your applications, MSE microservices governance becomes active for the applications in Container Service for Kubernetes and Container Compute Service.

Log on to the MSE console, and select a region in the top navigation bar.
In the left-side navigation pane, choose Microservices Governance > Application Governance.
Select the target microservices governance namespace to view the connected applications.

Next steps

After you connect your application to the MSE governance center, you can use features such as end-to-end canary release, graceful startup and shutdown, and traffic throttling rules. For more information, see Get started with service governance in 15 minutes (Java).