Service Mesh overview
You can connect applications deployed in Container Service for Kubernetes (ACK) to Alibaba Cloud Service Mesh (ASM) to simplify service mesh administration, enable service observability, and reduce the workload for developers and operations teams.
Background information
Alibaba Cloud Service Mesh (ASM) is a fully managed service mesh platform compatible with the open source Istio Service Mesh. ASM simplifies service administration, including traffic routing and splitting for service invocations, security for inter-service communication, and mesh observability. ASM is suitable for scenarios that require traffic management, security management, fault recovery, observability and monitoring, and migration to a microservices architecture.
Service architecture
ASM consists of two parts: the control plane and the data plane.
-
The control plane reads user configurations and instructs the data plane on how to process traffic. Because ASM fully manages the control plane, it is more stable and efficient than self-built service meshes.
-
The data plane consists of network proxies deployed in your cluster that intercept and process traffic according to the control plane's configuration.
Core features
The following table lists the core features of ASM. For more information, see Features.
|
Feature |
Description |
References |
|
Full lifecycle management of mesh instances |
Fully managed control plane compatible with Istio community specifications. Supports one-click deployment, upgrade, and deletion to reduce operational overhead. |
|
|
Support for multiple infrastructure applications |
Supports applications on ACK, ACK Serverless, ACS, edge clusters, and ACK One registered clusters. |
|
|
Unified ingress and egress gateways |
Unified traffic entry and exit points for mesh applications. Supports one-click enabling or disabling of mTLS for end-to-end encryption and traffic control. |
|
|
Multiple types of traffic management |
Multi-protocol traffic management with end-to-end canary releases, circuit breaking, local rate limiting, slow start warm-up, and traffic fallback. |
|
|
Compatible with multiple observability capabilities |
Mesh diagnostics with integrated managed tracing, monitoring, and logging for end-to-end visibility. |
|
|
Non-intrusive zero trust security system |
Out-of-the-box, dynamically configurable zero trust security with identity authentication, certificate management, policy enforcement, and visual analytics. |
|
|
Extensibility for custom logic |
A plugin marketplace with ready-to-use extension plugins, plus support for custom EnvoyFilter resources. |
|
|
Comprehensive ecosystem integration |
Integration with common GitOps tools and Serverless and AI services such as Knative and KServe. |
Related operations
To get started with ASM, see Get started.