Functions and features
Service Mesh ASM is available in the following editions based on its features and supported scale: Standard Edition, Enterprise Edition, and Ultimate Edition. Standard Edition is a free edition, and the other two editions are commercial editions. Compare the features and supported scale of each Service Mesh ASM edition to select the one that fits your workloads.
Features supported by the ASM-managed control plane
Mesh management
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Console-based full lifecycle management, such as mesh instance deployment and upgrades |
|
|
|
|
|
|
|
|
|
All supported ACK versions, including ACK managed clusters, dedicated clusters, and ECI on ACK mode |
|
|
|
|
|
ACK managed clusters only |
ACK managed clusters only |
ACK managed clusters only |
|
ACS clusters |
|
|
|
|
|
|
|
|
|
All supported ACK Serverless versions |
|
|
|
|
|
|
|
|
|
Externally registered Kubernetes clusters |
|
|
|
|
|
|
|
|
|
ACK Edge clusters |
|
|
|
|
|
|
|
|
|
Production-grade multi-cluster support (cross-VPC and cross-region) |
|
|
|
|
|
Single cluster only |
Single cluster only |
Single cluster only |
|
Operating systems supported on the nodes where pods run |
Alibaba Cloud Linux 2 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
Alibaba Cloud Linux 2 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 |
|
Automatic diagnosis of mesh configuration issues |
Partial |
|
|
|
Partial |
|
|
|
|
Historical version management for Istio resources |
|
|
|
|
|
|
|
|
|
Access to Istio resources by using the data plane KubeConfig in managed mode |
|
|
|
|
|
|
|
|
Data plane component management
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Multi-dimensional sidecar proxy configuration management (global, namespace, and workload levels) |
Partial |
|
|
|
|
|
|
|
|
Console-based sidecar injector management |
|
|
|
|
|
|
|
|
|
Container Network Interface (CNI) mode compatibility in ACK clusters |
|
|
|
|
|
|
|
|
ASM gateway management
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Full lifecycle management of ASM gateways (create, upgrade, delete, and update configurations) |
|
|
|
|
|
|
|
|
|
Console-based routing management |
|
|
|
|
|
|
|
|
|
Advanced features (graceful shutdown, Horizontal Pod Autoscaler (HPA) scaling, traffic-lossless upgrades, and TLS performance optimization) |
|
|
|
|
|
|
|
|
|
Built-in custom authorization service (ext_authz) with visualization-based configuration |
|
|
|
|
|
|
|
|
|
One-click integration of built-in OpenID Connect (OIDC) single sign-on |
|
|
|
|
|
|
|
|
|
Built-in throttling and circuit breaking integration |
|
|
|
|
|
|
|
|
|
Certificate management |
|
|
|
|
|
|
|
|
|
Built-in observability integration |
|
|
|
|
|
|
|
|
|
High availability (HA) support |
|
|
|
|
|
|
|
|
Traffic management
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Compatibility with the Istio community VirtualService, DestinationRule, and Gateway definitions |
|
|
|
|
|
|
|
|
|
Console-based traffic rule configuration |
|
|
|
|
|
|
|
|
|
Local rate limiting |
Partial |
Partial |
|
|
|
|
|
|
|
Spring Cloud services |
|
|
|
|
|
|
|
|
|
Lossless service startup and shutdown |
|
|
|
|
|
|
|
|
|
Traffic lanes and traffic tags |
|
|
|
|
|
|
|
|
|
Route-level circuit breaking |
|
|
|
|
|
|
|
|
|
Zone affinity routing |
|
|
|
|
|
|
|
|
|
Service warm-up |
|
|
|
|
|
|
|
|
|
Service-centric traffic management |
|
|
|
|
|
|
|
|
|
Layer 7 load balancing for east-west gateways |
|
|
|
|
|
|
|
|
Observability management
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Mesh topology visualization and analysis |
Partial |
Partial |
|
|
Partial |
Partial |
|
|
|
Integration with self-managed Prometheus monitoring |
Partial (requires separate installation) |
|
|
|
Partial (requires separate installation) |
|
|
|
|
Integration with Application Real-Time Monitoring Service (ARMS) |
|
|
|
|
|
|
|
|
|
Integration with Simple Log Service (SLS) |
|
|
|
|
|
|
|
|
|
Custom monitoring metrics |
Partial |
Partial |
|
|
Partial |
Partial |
|
|
|
Enhanced built-in common dashboards and reports |
|
|
|
|
|
|
|
|
|
Service-level objective (SLO) policies |
|
|
|
|
|
|
|
|
|
SLO-driven application elasticity |
|
|
|
|
|
|
|
|
Security
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Integration with the cloud platform account system (such as RAM authorization) |
|
|
|
|
|
|
|
|
|
Console-based security policy rule configuration |
|
|
|
|
|
|
|
|
|
Scenario-based one-stop security policies (such as OIDC single sign-on and JSON Web Token (JWT) authentication) |
|
|
|
|
|
|
|
|
|
Fine-grained access control based on Open Policy Agent (OPA) |
|
|
|
|
|
|
|
|
|
Alibaba Cloud OpenAPI operation audit |
|
|
|
|
|
|
|
|
|
Kubernetes API operation audit |
|
|
|
|
|
|
|
|
|
Alibaba Cloud account authorization system integration |
|
|
|
|
|
|
|
|
|
Dry-run mode |
|
|
|
|
|
|
|
|
Extensibility and ecosystem integration
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Plugin marketplace |
|
|
|
|
|
|
|
|
|
EnvoyFilter multi-version API compatibility |
|
|
|
|
|
|
|
|
|
Third-party service registry integration |
|
|
|
|
|
|
|
|
|
Built-in integration with the KServe cloud-native inference service framework |
|
|
|
|
|
|
|
|
|
Built-in best practices for application delivery with Argo CD, Argo Rollouts, and KubeVela |
|
|
|
|
|
|
|
|
|
Terraform support |
|
|
|
|
|
|
|
|
Performance optimization and best practices
|
Feature |
Sidecar mode |
Ambient mode |
||||||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
TLS acceleration with Multi-Buffer enabled |
|
|
|
|
|
|
|
|
|
Console-based selective service discovery configuration |
|
|
|
|
|
|
|
|
|
Sidecar resource configuration optimization automatically recommended by access log analysis |
|
|
|
|
|
|
|
|
|
Hardware-software combined performance optimization, where Node Feature Discovery (NFD) automatically detects hardware features and adaptively supports features such as AVX instruction sets and QAT acceleration |
|
|
|
|
|
|
|
|
|
Built-in best practices and analysis, including standardized service definitions and parameter settings optimization |
|
|
|
|
|
|
|
|
Stability and supported scale
|
Feature |
Sidecar mode/Ambient mode |
|||
|
Open source community |
Standard Edition |
Enterprise Edition |
Ultimate Edition |
|
|
Data plane supported scale |
Recommended for development and testing only |
50 pods |
1,000 pods |
10,000 pods |
|
Hosted control plane Istiod component |
- |
Single replica |
Multiple replicas |
Multiple replicas |
Standard Edition data plane supported scale works as follows:
-
For development and testing only.
-
To ensure cluster stability, ASM checks the number of pods in the data plane cluster during an upgrade. If the number of pods exceeds the limit, you must upgrade the ASM instance edition before you can continue the upgrade. Otherwise, your workloads may be affected. For instructions, see Change an ASM instance edition.
Pod count rules: ASM counts pods based on the namespaces used for service discovery and automatically excludes system namespaces such as istio-system, arms-prom, kube-node-lease, kube-public, and kube-system.
References for commercial edition features
|
Feature area |
Document |
|
Mesh management |
|
|
ASM gateway |
|
|
Traffic management |