doc-exports/docs/asm/umn/asm_01_0020.html

<a name="asm_01_0020"></a><a name="asm_01_0020"></a>

<h1 class="topictitle1">Creating a Service Mesh</h1>
<div id="body8662426"><p id="asm_01_0020__en-us_topic_0000001542706401_p7705103811473">ASM allows you to create a Basic service mesh for commercial use.</p>
<div class="section" id="asm_01_0020__en-us_topic_0000001542706401_section033812246196"><h4 class="sectiontitle">Prerequisites</h4><p id="asm_01_0020__en-us_topic_0000001542706401_p43381724171910">A CCE cluster is available.</p>
</div>
<div class="section" id="asm_01_0020__en-us_topic_0000001542706401_section1486314595204"><h4 class="sectiontitle">Constraints</h4><ul id="asm_01_0020__en-us_topic_0000001542706401_ul186475910202"><li id="asm_01_0020__en-us_topic_0000001542706401_li1786417596203">ASM depends on the domain name resolution of CoreDNS. Before creating a service mesh for a cluster, ensure that the cluster has required resources and CoreDNS is running normally.</li><li id="asm_01_0020__li133817361244">The components of Istio 1.13 and 1.15 cannot run on nodes running CentOS or EulerOS 2.5. When creating a service mesh, do not specify these types of nodes as master nodes.</li></ul>
</div>
<div class="section" id="asm_01_0020__en-us_topic_0000001542706401_section201371027102715"><h4 class="sectiontitle">Procedure</h4><ol id="asm_01_0020__en-us_topic_0000001542706401_ol1158918434276"><li id="asm_01_0020__en-us_topic_0000001542706401_li184614499427"><span>Log in to the ASM console.</span></li><li id="asm_01_0020__en-us_topic_0000001542706401_li125894431271"><span>Click <strong id="asm_01_0020__b205391310114513">Create Mesh</strong> in the upper right corner.</span></li><li id="asm_01_0020__en-us_topic_0000001542706401_li135891543162714"><span>Configure the following parameters.</span><p><ul id="asm_01_0020__en-us_topic_0000001542706401_ul75901043202711"><li id="asm_01_0020__en-us_topic_0000001542706401_li2092711501216"><strong id="asm_01_0020__en-us_topic_0000001542706401_b1094850142211">Mesh Edition</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p4479132261213">Only service meshes of the Basic edition are supported for commercial use.</p>
</li><li id="asm_01_0020__en-us_topic_0000001542706401_li35901243162718"><strong id="asm_01_0020__b1101751604">Mesh Name</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p19590743152711">Enter a service mesh name, which consists of 4 to 64 characters. It must start with a lowercase letter and cannot end with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.</p>
<p id="asm_01_0020__en-us_topic_0000001542706401_p11590144316275">Each name in the same account must be unique. After a service mesh is created, the name cannot be modified.</p>
</li><li id="asm_01_0020__en-us_topic_0000001542706401_li3590184362716"><strong id="asm_01_0020__b1115042375">Istio Version</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p19590144310274">Select the Istio version supported by the service mesh.</p>
</li><li id="asm_01_0020__li20991123625914"><strong id="asm_01_0020__b54661518132116">Enable IPv6</strong><p id="asm_01_0020__p04381549215">Conditions for enabling IPv4/IPv6 dual stack for a service mesh</p>

<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="asm_01_0020__table11439754142117" frame="border" border="1" rules="all"><thead align="left"><tr id="asm_01_0020__row1743955417212"><th align="left" class="cellrowborder" valign="top" width="12.379999999999999%" id="mcps1.3.4.2.3.2.1.4.3.1.6.1.1"><p id="asm_01_0020__p1643985417218">Service Mesh Edition</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="14.91%" id="mcps1.3.4.2.3.2.1.4.3.1.6.1.2"><p id="asm_01_0020__p8439135413212">Istio Version</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="15.260000000000002%" id="mcps1.3.4.2.3.2.1.4.3.1.6.1.3"><p id="asm_01_0020__p1443995417219">Cluster Type</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="20.4%" id="mcps1.3.4.2.3.2.1.4.3.1.6.1.4"><p id="asm_01_0020__p14394543213">Cluster Network Type</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="37.05%" id="mcps1.3.4.2.3.2.1.4.3.1.6.1.5"><p id="asm_01_0020__p6439195402115">Remarks</p>
</th>
</tr>
</thead>
<tbody><tr id="asm_01_0020__row184391354172116"><td class="cellrowborder" valign="top" width="12.379999999999999%" headers="mcps1.3.4.2.3.2.1.4.3.1.6.1.1 "><p id="asm_01_0020__p2043975418214">Basic edition</p>
</td>
<td class="cellrowborder" valign="top" width="14.91%" headers="mcps1.3.4.2.3.2.1.4.3.1.6.1.2 "><p id="asm_01_0020__p643945413219">1.18 or later</p>
</td>
<td class="cellrowborder" valign="top" width="15.260000000000002%" headers="mcps1.3.4.2.3.2.1.4.3.1.6.1.3 "><p id="asm_01_0020__p94391954112116">CCE Turbo clusters</p>
</td>
<td class="cellrowborder" valign="top" width="20.4%" headers="mcps1.3.4.2.3.2.1.4.3.1.6.1.4 "><p id="asm_01_0020__p843985414211">Cloud Native Network 2.0</p>
</td>
<td class="cellrowborder" valign="top" width="37.05%" headers="mcps1.3.4.2.3.2.1.4.3.1.6.1.5 "><p id="asm_01_0020__p17439135413211">IPv6 needs to be enabled for a cluster.</p>
</td>
</tr>
</tbody>
</table>
</div>
<p id="asm_01_0020__p124428207334">For details, see <a href="asm_bestpractice_1009.html">How Do I Create a Service Mesh with IPv4/IPv6 Dual Stack Enabled</a>.</p>
<div class="note" id="asm_01_0020__note18440654152111"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="asm_01_0020__ul1744075432120"><li id="asm_01_0020__li1744055413210"><strong id="asm_01_0020__b11396256101815">Enable IPv6</strong> is only available in Basic service meshes based on Istio 1.18 or later.</li><li id="asm_01_0020__li194404548216">IPv4/IPv6 dual stack cannot be enabled for a service mesh whose Istio version is upgraded to 1.18 or later.</li></ul>
<ul id="asm_01_0020__ul144085482119"><li id="asm_01_0020__li1344010549212">IPv4/IPv6 dual stack cannot be disabled once it is enabled for a service mesh. IPv4/IPv6 dual stack cannot be enabled for an existing service mesh.</li></ul>
</div></div>
</li><li id="asm_01_0020__en-us_topic_0000001542706401_li4590154315271"><strong id="asm_01_0020__b1657068806">Cluster</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p4590184313278">Select the cluster from the cluster list or enter the cluster name in the upper right corner of the list to search for the cluster. You can only select the clusters whose versions are supported by the current service mesh version.</p>
</li><li id="asm_01_0020__en-us_topic_0000001542706401_li159044311277"><strong id="asm_01_0020__b871656394">Mesh Control Plane Node</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p125902437272">The control plane components of a Basic service mesh are installed in your cluster. You need to select a node for installing the control plane. If HA is required, you can select two or more nodes from different AZs.</p>
<p id="asm_01_0020__en-us_topic_0000001542706401_p1959024392713">A selected node will be labeled with <strong id="asm_01_0020__b12113195612363">istio:master</strong>, and the components will be scheduled to that node.</p>
</li><li id="asm_01_0020__li17225629125"><strong id="asm_01_0020__b182161818152520">Observability Configuration</strong><ul id="asm_01_0020__ul162251921123"><li id="asm_01_0020__li1522512214127"><strong id="asm_01_0020__b1443315218391">Tracing</strong><p id="asm_01_0020__p015131035712"><strong id="asm_01_0020__b1314122314192">Enable Call Chain</strong>: If this option is enabled, you can use distributed tracing to track requests in the service mesh.</p>
<p id="asm_01_0020__p3225124129">- <strong id="asm_01_0020__b1649171110292">Sampling Rate</strong>: The number of requests generated by the tracing service/The total number of requests</p>
<p id="asm_01_0020__p722519210123">- <strong id="asm_01_0020__b13853258294">Version</strong>: tracing service. If you select <strong id="asm_01_0020__b1028517591813">Third-party Jaeger/Zipkin service</strong>, you need to set <strong id="asm_01_0020__b613018597425">Service Address</strong> and <strong id="asm_01_0020__b665636154317">Service Port</strong>, which indicate the address and port number used by the third-party tracing service to receive requests.</p>
<div class="note" id="asm_01_0020__note122518211219"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="asm_01_0020__ul1522613251216"><li id="asm_01_0020__li112261223127">Only Istio 1.15 or later support the third-party tracing service.</li><li id="asm_01_0020__li142761222131512">If you want to use the third-party Jaeger or Zipkin service, install it first. Then, obtain the service address.</li><li id="asm_01_0020__li1622612111211">The default service ports of Jaeger and Zipkin are both 9411. If you create a custom service port during Jaeger or Zipkin installation, replace <strong id="asm_01_0020__b1161449123214">Service Port</strong> with the actual value.</li></ul>
</div></div>
</li></ul>
</li></ul>
</p></li><li id="asm_01_0020__en-us_topic_0000001542706401_li185901043112713"><span>(Optional) Specify advanced settings.</span><p><ul id="asm_01_0020__en-us_topic_0000001542706401_ul195914431277"><li id="asm_01_0020__en-us_topic_0000001542706401_li105911243172720"><strong id="asm_01_0020__b1108310788">Namespace Injection Settings</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p0591154316270">Select a namespace and label it with <strong id="asm_01_0020__b0190101221818">istio-injection=enabled</strong>. After being restarted, all pods in the namespace will be automatically injected with istio-proxy sidecars.</p>
<p id="asm_01_0020__en-us_topic_0000001542706401_p1459184332714">If you do not configure namespace injection, you can inject a sidecar on the <strong id="asm_01_0020__b1960806132112">Sidecar Management</strong> tab (<strong id="asm_01_0020__b86087612111">Mesh Configuration</strong> &gt; <strong id="asm_01_0020__b196087611215">Sidecar Management</strong>) after the service mesh is created. For details, see <a href="asm_01_0041.html#asm_01_0041__section65931513505">Injecting a Sidecar</a>.</p>
</li><li id="asm_01_0020__en-us_topic_0000001542706401_li1059184310276"><strong id="asm_01_0020__b109080228">Restart Existing Services</strong><p id="asm_01_0020__en-us_topic_0000001542706401_p12591144362715"><span><img id="asm_01_0020__image879324619490" src="en-us_image_0000001920032153.png"></span>: The pods of existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecars can be automatically injected to the pods of existing services only after the pods are restarted.</p>
<p id="asm_01_0020__en-us_topic_0000001542706401_p195911343162718"><span><img id="asm_01_0020__en-us_topic_0000001542706401_image1736110311031" src="en-us_image_0000001494249996.png"></span>: The istio-proxy sidecars cannot be automatically injected into the pods of existing services. You need to manually restart the pods on the CCE console to inject the sidecars.</p>
</li><li id="asm_01_0020__li103761117176"><strong id="asm_01_0020__b161488533415">Traffic Interception Settings</strong><div class="note" id="asm_01_0020__note9376117978"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="asm_01_0020__p2376181712720">By default, sidecars intercept all inbound and outbound traffic of pods. You can modify the default traffic rules in <strong id="asm_01_0020__b134331479345">Traffic Interception Settings</strong>.</p>
</div></div>
<p id="asm_01_0020__p93763174718"><strong id="asm_01_0020__b9810181314341">Inbound Ports</strong>: Inbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for inbound traffic redirection.</p>
<ul id="asm_01_0020__ul1376817679"><li id="asm_01_0020__li33768171718"><strong id="asm_01_0020__b16992015173412">Include only specified ports</strong> means that the traffic to services in a service mesh over specified ports will be redirected to the sidecar.</li></ul>
<ul id="asm_01_0020__ul73766176715"><li id="asm_01_0020__li1137612175714"><strong id="asm_01_0020__b15386151833412">Exclude only specified ports</strong> means that the traffic to services in a service mesh over the ports except the specified ports will be redirected to the sidecar.</li></ul>
<p id="asm_01_0020__p437612171973"><strong id="asm_01_0020__b155051822203412">Outbound Ports</strong>: Outbound ports separated by commas (,). You can use this field to specify the ports that will be included or excluded for outbound traffic redirection.</p>
<ul id="asm_01_0020__ul10376151714710"><li id="asm_01_0020__li16376121711719"><strong id="asm_01_0020__b10871024123417">Include only specified ports</strong> means that the traffic from services in a service mesh over specified ports will be redirected to the sidecar.</li></ul>
<ul id="asm_01_0020__ul337611714716"><li id="asm_01_0020__li1337717171578"><strong id="asm_01_0020__b67131127173417">Exclude only specified ports</strong> means that the traffic from services in a service mesh over the ports except the specified ports will be redirected to the sidecar.</li></ul>
<p id="asm_01_0020__p11377181717712"><strong id="asm_01_0020__b20653518442">Outbound IP Ranges</strong>: IP address ranges separated by commas (,) in CIDR format. You can use this field to specify the IP ranges that will be included or excluded for outbound traffic redirection.</p>
<ul id="asm_01_0020__ul1337716172078"><li id="asm_01_0020__li1377417579"><strong id="asm_01_0020__b39502030153411">Include only specified IP ranges</strong> means that the traffic from specified IP ranges will be redirected to the sidecar.</li></ul>
<ul id="asm_01_0020__ul14377181711717"><li id="asm_01_0020__li3377171710719"><strong id="asm_01_0020__b393303213347">Exclude only specified IP ranges</strong> means that the traffic from IP ranges except the specified IP ranges will be redirected to the sidecar.</li></ul>
</li><li id="asm_01_0020__li1611138125316"><strong id="asm_01_0020__b308289121">Resource Tags</strong><p id="asm_01_0020__p1711128135317">Enter the tag key and tag value. A maximum of 20 tags can be added.</p>
</li></ul>
</p></li><li id="asm_01_0020__en-us_topic_0000001542706401_li859154318271"><span>Review the service mesh configuration in <strong id="asm_01_0020__b298934016">Configuration List</strong> on the right of the page and click <strong id="asm_01_0020__b1869262857">Submit</strong>.</span><p><p id="asm_01_0020__en-us_topic_0000001542706401_p13591174382714">It takes about 1 to 3 minutes to create a service mesh. If the service mesh status changes from <strong id="asm_01_0020__b1089376003">Installing</strong> to <strong id="asm_01_0020__b341929893">Running</strong>, the service mesh is successfully created.</p>
<div class="note" id="asm_01_0020__en-us_topic_0000001542706401_note14591184342712"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="asm_01_0020__en-us_topic_0000001542706401_p1459119432275">When the service mesh is enabled, the following operations are performed:</p>
<ul id="asm_01_0020__en-us_topic_0000001542706401_ul859134311276"><li id="asm_01_0020__en-us_topic_0000001542706401_li195911043152719">Helm orchestrates the application into a Release as the resource of the service mesh control plane.</li></ul>
</div></div>
</p></li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="asm_01_0017.html">Creating a Service Mesh</a></div>
</div>
</div>