Integrate with Apsara DevOps for blue-green deployments on ASM-Alibaba Cloud Service Mesh-阿里云帮助中心

Background information

The Enterprise edition of Alibaba Cloud Service Mesh (ASM) is compatible with Istio. It supports unified traffic management across multiple Kubernetes clusters and provides consistent communication controls for containerized applications. The latest data plane KubeAPI access feature of Service Mesh lets you manage Istio resources using the KubeConfig of the data plane cluster. By integrating with Alibaba Cloud DevOps Flow, you can simplify application releases through DevOps and GitOps. This integration also enables you to use Istio's fine-grained traffic management for blue-green deployments and ensure release stability.

Prerequisites

An ASM instance with Istio version 1.12.4.50 or later is created.
A Container Service for Kubernetes (ACK) cluster is created.
The ACK cluster is added to the ASM instance.
The Service, VirtualService, and DestinationRule resources must have the same name.
The labels of the deployment must include all selector labels of the service. For example:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: spring-boot-sample
  name: spring-boot-sample
spec:
  replicas: 2
  selector:
    matchLabels:
      run: spring-boot-sample
  template:
    metadata:
      labels:
        run: spring-boot-sample
    spec:
      containers:
      - image: ${IMAGE}
        name: app
---
apiVersion: v1
kind: Service
metadata:
  name: spring-boot-service
  labels:
    test: test
    labele2: label
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
  selector:
    run: spring-boot-sample
  sessionAffinity: None
  type: ClusterIP

Practice 1: Deploy an application using a pipeline

Objective: This section uses the scenario from Deploy an application in a cluster associated with an ASM instance as an example to demonstrate how to change the title of a home page. After you commit the code, an Alibaba Cloud DevOps pipeline is executed to generate an image. The pipeline automatically creates or updates the application's traffic management resources, such as VirtualService, Gateway, and DestinationRule, in the Service Mesh (ASM) cluster. It also creates or updates orchestration resources, such as Deployment and Service, in the Container Service for Kubernetes (ACK) cluster.

Create the pipeline as follows. Configure the pipeline source to a GitHub repository. The test address is https://github.com/AliyunContainerService/asm-labs. You can also fork the repository and customize it. Select the flow-demo branch.

The steps are as follows:

Configure the pipeline flow

Set Image Repository Address to your address space: registry.cn-hangzhou.aliyuncs.com/{your_name_space}/productpage:${DATETIME}. In this example, DATETIME is used as the version number. The Dockerfile path is productpage/Dockerfile. In the Kubectl Deploy step of the Kubernetes deployment, set the Variable ProductpageImage to the image repository address that you configured earlier. In the YAML file of the code repository, the image for productpage is set to ${ProductpageImage} to use this variable.

Add a data plane cluster and inject a sidecar proxy

In the Service Mesh (ASM) console, go to the ASM instance. In the cluster and workload management section, add the ACK cluster that you want to use for the pipeline. Then, in the Global Namespace, Enable Automatic Sidecar Injection for the selected namespace, such as default.

Create an ASM gateway

To easily access the application deployed by the pipeline, create an ASM gateway. Set the port to 80.

Run Pipeline

View the deployment result

In the ACK cluster, confirm that the image is pulled successfully and starts properly. If the private image fails to pull, see Install and use the passwordless component for unmanaged clusters.

Copy the address of the ASM gateway that you created. In a browser, enter http://{ASM gateway address}/productpage. The home page now displays the modified title.

The interface currently displays the reviews-v1 version.

Practice 2: Blue-green deployment

The integration of Service Mesh (ASM) and Alibaba Cloud DevOps provides blue-green deployment capabilities. This enables secure application releases based on Istio's traffic management policies.

Objective: After you complete Practice 1, you can use a blue-green deployment to update the reviews service from v1 to v2.

Create a new pipeline

Configure the pipeline source as described in Practice 1. Create an ASM Blue-Green Deployment stage. For this stage, set the image to the reviews-v2 image: docker.io/istio/examples-bookinfo-reviews-v2:1.16.4. Set the initial canary traffic to 0%. Only users with a specific cookie identifier can access the blue-green version.

Execute

In Alibaba Cloud DevOps Flow, before you start the blue-green deployment, specify the workload version to use. Delete all other workload versions to ensure that traffic flows only to the stable version (reviews-v1).

At this point, check the status of the virtual service in the Service Mesh (ASM) console. The status is as follows.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
  namespace: default
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            cookie:
              regex: ^(.*?;)?(gray=true)(;.*)?$
      route:
        - destination:
            host: reviews
            subset: v20220622103841
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 100
        - destination:
            host: reviews
            subset: v20220622103841

The destination rule is as follows.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
  namespace: default
spec:
  host: reviews
  subsets:
    - labels:
        version: v1
      name: v1
    - labels:
        version: v20220622103841
      name: v20220622103841

Test and verify

Because the reviews service is invoked by the productpage backend service, it is difficult to pass a specific token for canary testing.

Modify the cookie setting in the header to use the end-user's logon information. Configure the system to display the canary release version if the username is 'asm'.

Copy the address of the ASM gateway that you created. In a browser, enter http://{ASM gateway address}/productpage. Click Log On in the upper-right corner. Enter 'asm' as the username and any password. If you are not logged on, the v1 version of the reviews information is displayed.

Continue the deployment

After the canary release version passes the tests, switch all traffic to the new version (reviews-v2). Click Continue Deployment to complete the deployment.

After the deployment is complete, the reviews-v2 version is displayed even when you are not logged on.

Status of the reviews virtual service after the deployment is complete.

Summary

In Kubernetes, a Service is associated with multiple versions of deployment instances through labels. When a blue-green deployment starts, Alibaba Cloud DevOps Flow creates a new version of the application deployment based on the current deployment. After the blue environment is created, you can update the VirtualService and DestinationRule resource objects in ASM to control the traffic routing policies between specific deployment versions.

Based on the deployment settings, you can modify the VirtualService to determine the traffic weight for the blue and green environments. You can also set a canary tag to determine which traffic directly enters the blue environment. After manual validation, you can complete the deployment by routing all traffic to the blue environment and removing the original green environment instance.

As the industry's first fully managed Istio-compatible service mesh, ASM was designed from the beginning to align with community and industry trends. The control plane components are hosted on Alibaba Cloud, separate from the user clusters on the data plane side. ASM is a product customized based on the community version of Istio. It provides components on the managed control plane to support fine-grained traffic management and security management. The managed pattern decouples the lifecycle management of Istio components from the managed Kubernetes clusters. This makes the architecture more flexible and improves system scalability. ASM launched a commercial version on April 1, 2022. This version offers richer features, greater scale support, and more comprehensive technical guarantees to better meet the needs of various scenarios.