Integrate with Apsara DevOps for blue-green deployments on ASM-Alibaba Cloud Service Mesh-阿里云帮助中心

In Alibaba Cloud Service Mesh (ASM) Enterprise Edition instances, you can find compatibility with Istio, support for unified traffic management across multiple Kubernetes clusters, and consistent communication control for container and virtual machine applications. Based on the latest "data plane KubeAPI access" capability of the service mesh, you can manage Istio resources by using the kubeconfig of a data plane cluster. After integration with Alibaba Cloud DevOps Flow, you can enjoy the convenience of DevOps and GitOps for application releases, and also leverage Istio's fine-grained traffic control capabilities to implement blue-green deployments and ensure release stability.

Prerequisites

Create an Alibaba Cloud Service Mesh (ASM) instance with Istio version 1.12.4.50 or later.
Create a Container Service for Kubernetes (ACK) cluster.
Add the ACK cluster to the ASM instance.
The Service, VirtualService, and DestinationRule must have the same name.
The labels of the Deployment must include all selector labels from the Service.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: spring-boot-sample
  name: spring-boot-sample
spec:
  replicas: 2
  selector:
    matchLabels:
      run: spring-boot-sample
  template:
    metadata:
      labels:
        run: spring-boot-sample
    spec:
      containers:
      - image: ${IMAGE}
        name: app
---
apiVersion: v1
kind: Service
metadata:
  name: spring-boot-service
  labels:
    test: test
    labele2: label
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
  selector:
    run: spring-boot-sample
  sessionAffinity: None
  type: ClusterIP

Tutorial 1: Deploy an application using a pipeline

Objective: Using the Istio book-info application as an example, you will change the title text on the homepage. After you commit the code, an Alibaba Cloud DevOps pipeline runs. This pipeline builds an image and automatically creates or updates traffic management resources such as VirtualService, Gateway, and DestinationRule in your ASM instance, and application orchestration resources such as Deployment and Service in your ACK cluster.

Create a pipeline as follows. Configure the pipeline source to the GitHub repository at https://github.com/AliyunContainerService/asm-labs. You can also fork this repository to make your own changes. Select the flow-demo branch.

Perform the following steps: Name the pipeline ASM-Flow-v1. On the Flow Configuration tab, configure four stages: a pipeline source stage linked to the GitHub repository, a test stage with a Code scan task, a build stage with a Python build task, and a deployment stage with a Kubernetes publish task.

Configure the pipeline flow

Replace the image repository address with your namespace: registry.cn-hangzhou.aliyuncs.com/{your_name_space}/productpage:${DATETIME}. In this example, the DATETIME variable represents the version number. The Dockerfile path is productpage/Dockerfile. In the Kubectl Publish task, set the ProductpageImage variable to the image repository address you configured. In the repository's YAML file, the image for productpage is set to ${ProductpageImage} to match this variable. The pipeline contains three tasks. First, for the Code scan task, add a Python code scan step, select Python version 3.7, and enter test/ in the Exclude Subdirectories field. Second, for the Python build task, add a Build and push image to custom registry step, enter registry.cn-hangzhou.aliyuncs.com/xxx/productpage for Image Repository Address, select Service connection for Credential Type, and enter productpage/Dockerfile for Dockerfile Path. Third, for the Kubernetes publish task, select flow-cs for Cluster Connection, select v1.16.4 for Kubectl Version, enter default for Namespace, enter manifests for YAML Path, and set the Productpage variable to registry.cn-hangzhou.aliyuncs.com/xxx/productpage:${DATETIME}.

Add a data plane cluster and inject the sidecar proxy

In the Alibaba Cloud Service Mesh (ASM) console, navigate to your ASM instance. In the Cluster and Workload Management section, add the ACK instance that you want the pipeline to configure. In the global namespace, enable automatic sidecar injection for the selected namespace, such as default. In the ASM console, go to the Kubernetes cluster page and verify that the data plane cluster, such as flow-demo, has been added and its status is Running. Then, go to the Global namespace page and click Sync auto-injection from Kubernetes cluster. After the sync is successful, verify that the default namespace has the istio-injection:enabled label, which indicates that automatic sidecar injection is enabled.

Create an ASM gateway

To access the application deployed by the pipeline, create an ASM gateway as the ingress entry point and set the port to 80. In the left-side navigation pane, click ASM Gateway, and then click Create. In the Basic information section, set the Name to ingressgateway and the Namespace to istio-system. Select the deployment cluster. For Gateway type, select North-south-ingress. For Load balancer type, select Public access. For the New load balancer specification, select Economy I (slb.s1.small). In the Port mapping section, add port 80 for HTTP and port 443 for HTTPS.

Run the pipeline

After you run the pipeline, the Test (Code scan), Build (Python build), and Kubernetes publish stages should all complete successfully. The code scan finds 4 critical issues (0 blocking, 0 moderate). Click Scan report to view the details.

Verify the deployment

In your ACK cluster, verify that the image is pulled successfully and starts correctly. If you have issues pulling a private image, see Pull container images without a password by using password-free components.

In the ACK console, select the flow-demo cluster and switch the namespace to default. Go to the Workloads > Stateless page. You should see that all six Deployments for the Bookinfo example (details-v1, productpage-v1, ratings-v1, reviews-v1, reviews-v2, and reviews-v3) show a pod count of 1/1, indicating a successful deployment. In the left-side navigation pane, click ASM Gateway. You can see that the gateway named ingressgateway has been created successfully in the istio-system namespace. Record the IP address from the Kubernetes service column to access the application later. The port mapping includes HTTP 80:80 and HTTPS 443:443. Copy the address of the ASM gateway you created and enter http://{ASM gateway address}/productpage in your browser. You should see that your title change is live.

The interface currently displays the reviews-v1 version.

Tutorial 2: Blue-green deployment

The integration of Alibaba Cloud Service Mesh (ASM) and Alibaba Cloud DevOps provides blue-green deployment capabilities. This capability allows you to securely release applications by using Istio's traffic management policies.

Objective: After completing "Tutorial 1: Deploy an application by using a pipeline", you will perform a blue-green deployment to update the reviews application from v1 to v2.

Create a new pipeline

Configure the pipeline source as you did in Tutorial 1, and create an ASM Blue-green Deployment stage. Set the image to the reviews-v2 version: docker.io/istio/examples-bookinfo-reviews-v2:1.16.4. Set the initial canary traffic to 0% to restrict access to users with a specific cookie.

In the ASM blue-green deployment task editor, select the Kubernetes cluster connection and ASM cluster connection. Set the Kubectl version to v1.16.4, the Namespace to default, the Container name to reviews, and the Canary traffic cookie header to ^(.*?;)?(gray=true)(;.*)?$.

Run the deployment

In Alibaba Cloud DevOps, before starting the blue-green deployment, you must designate reviews-v1 as the stable version and remove all other versions to ensure all traffic flows to it.

On the Resolve conflicts page, click Take over traffic for reviews-v1. In the confirmation dialog that appears, click OK. The pipeline enters the Conflict resolution stage. The logs show that deployment/reviews-v2 and deployment/reviews-v3 have been deleted. The status card on the right shows that version v20220622103841 is In canary verification. You can choose to Continue deployment or Rollback.

At this point, check the status of the VirtualService in the Alibaba Cloud Service Mesh (ASM) console. It should appear as follows:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
  namespace: default
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            cookie:
              regex: ^(.*?;)?(gray=true)(;.*)?$
      route:
        - destination:
            host: reviews
            subset: v20220622103841
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 100
        - destination:
            host: reviews
            subset: v20220622103841

The DestinationRule appears as follows:

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
  namespace: default
spec:
  host: reviews
  subsets:
    - labels:
        version: v1
      name: v1
    - labels:
        version: v20220622103841
      name: v20220622103841

Test and verify

Because the reviews service is called by the backend productpage service, it is inconvenient to use a specific token for canary testing.

Modify the routing rule to match on the end-user header from the login information. Configure the rule so that the canary version is shown only when the logged-in user is asm.

The modified reviews VirtualService appears as follows. The match condition in the headers section has been changed from cookie to end-user. When the logged-in user is asm, traffic is routed to the canary version.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
    creationTimestamp: '2022-06-20T08:19:10Z'
    generation: 9
    name: reviews
    namespace: default
    resourceVersion: '3403073'
    uid: b8b5cd0b-9b6e-4853-a5ae-2642d4ff5c84
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: asm
      route:
        - destination:
            host: reviews
            subset: v20220620xxx1
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 100
        - destination:
            host: reviews
            subset: v20220620xxx1

Copy the address of the ASM gateway you created and enter http://{ASM gateway address}/productpage in your browser. Click Sign in in the upper-right corner. Enter asm as the username and any password. If you are not logged in, the v1 version of the reviews is displayed.

After logging in as user asm, the Book Reviews section displays reviews with star ratings (5 stars for Reviewer1, 4 stars for Reviewer2). This indicates that the request was routed to the canary version, reviews-v2.

Continue the deployment

After you verify the canary version, shift all traffic to the new version (reviews-v2). Click Continue deployment to complete the release.

After the deployment is complete, the reviews-v2 version is displayed even when you are not logged in.

After the deployment is complete, check the status of the reviews VirtualService.

The routing rule in the VirtualService directs all traffic (weight: 100) to the new subset, reviews-v2, and no longer distinguishes canary traffic based on request headers.

Summary

In Kubernetes, a Service is associated with multiple versions of Deployment instances through labels. When a blue-green deployment starts, Alibaba Cloud DevOps creates a new version of the application Deployment based on the current Deployment instance. After the blue environment is created, Alibaba Cloud DevOps updates the VirtualService and DestinationRule resources in Alibaba Cloud Service Mesh (ASM) to control the routing policy between traffic and specific Deployment instances.

Based on the release settings, you can modify the VirtualService to define the traffic weight between the blue and green environments. You can also set a canary identifier to determine which traffic is routed directly to the blue environment. After manual verification, you complete the release by shifting all traffic to the blue environment and removing the original green environment instance.

As the industry's first fully managed, Istio-compatible service mesh product, Alibaba Cloud Service Mesh (ASM) was designed from the ground up to align with community and industry trends. The control plane components are hosted by Alibaba Cloud, separate from the user clusters in the data plane. ASM is a customized implementation based on community Istio, providing a managed control plane with components that support fine-grained traffic management and security controls. This managed model decouples the lifecycle of Istio components from the managed Kubernetes clusters, creating a more flexible and scalable architecture. On April 1, 2022, Alibaba Cloud Service Mesh (ASM) launched its commercial edition, offering enhanced capabilities, greater scale, and comprehensive technical support. For more information, see the product introduction: https://www.aliyun.com/product/servicemesh.