You can connect applications deployed in Container Service for Kubernetes (ACK) to Alibaba Cloud Service Mesh (ASM) to simplify service mesh administration, enable service observability, and reduce the workload for developers and operations teams.
Background information
Alibaba Cloud Service Mesh (ASM) is a fully managed service mesh platform compatible with the open source Istio Service Mesh. ASM simplifies service administration, including traffic routing and splitting for service invocations, security for inter-service communication, and mesh observability. ASM is suitable for scenarios that require traffic management, security management, fault recovery, observability and monitoring, and migration to a microservices architecture.
Architecture
The following figure shows the architecture of ASM.
ASM integrates and manages all components on the Istio control plane to simplify your use of ASM. So you can focus on application development and deployment. ASM is compatible with open source Istio. You can use declarative parameters to define flexible 路由 rules and manage traffic between services in a mesh.
An ASM instance can manage application services from multiple Kubernetes clusters. It provides comprehensive traffic management and service discovery functions. By centrally managing service traffic across different clusters, ASM instances can route requests to ensure high availability and load balancing.
Key features
The following table describes key features of ASM. For more information, see Features.
Feature | Description | References |
Full lifecycle management of mesh instances | Fully managed control plane, compatible with Istio community specifications, supporting one-click deployment, upgrade, and deletion operations. Reduces usage and maintenance barriers. | |
Support for multiple infrastructure applications | Support for applications on ACK, ACK Serverless, ACS clusters, edge clusters, and externally registered Kubernetes clusters. | |
Unified ingress and egress gateways | Provides unified traffic entry and exit points within the mesh. Supports one-click enabling or disabling of mTLS, implementing end-to-end secure encryption and traffic control. | |
Multiple types of traffic management | Support for multi-protocol traffic management, end-to-end canary releases, circuit breaking, local rate limiting, slow start warm-up, and traffic fallback capabilities. | |
Compatible with multiple observability capabilities | Provides mesh diagnostic capabilities, integrates managed tracing, monitoring, and logging services to achieve end-to-end visibility. | |
Non-intrusive zero trust security system | Provides an out-of-the-box feature, zero trust security solution with dynamic configuration. Includes identity authentication, security certificates, policy enforcement, and visual analytics. | |
Extensibility for custom logic | The plug-in marketplace includes multiple out-of-the-box extension plug-ins. Also supports custom EnvoyFilter. | |
Comprehensive ecosystem integration | Support for GitOps tools. Also for Serverless and AI services such as Knative and KServe. |
Related operations
To get started with ASM, see Get started.