Manage Spring Cloud services

Connect to the control plane cluster by using kubectl. For more information, see Access Istio resources on the control plane by using kubectl.

Create an EnvoyFilter in the ASM cluster.

1. Create a file named any-spring-cloud-support.yaml with the following content.

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     labels:
       provider: "asm"
       asm-system: "true"
     name: any-spring-cloud-support
     namespace: istio-system
   spec:
     configPatches:
     - applyTo: HTTP_FILTER
       match:
         proxy:
           proxyVersion: "^1.*"
         context: SIDECAR_OUTBOUND
         listener:
           portNumber: 8070
           filterChain:
             filter:
               name: "envoy.filters.network.http_connection_manager"
               subFilter:
                 name: "envoy.filters.http.router"
       patch:
         operation: INSERT_BEFORE
         value: # reverse_dns filter specification
          name: com.aliyun.reverse_dns
          typed_config:
            "@type": "type.googleapis.com/udpa.type.v1.TypedStruct"
            type_url: type.googleapis.com/envoy.config.filter.reverse_dns.v3alpha.CommonConfig
            value:
              pod_cidrs:
              - "10.0.128.0/18"

   Modify the parameters in the YAML file based on your business requirements. The parameters are described as follows:

   • portNumber: The port of the Spring Cloud service. If the ports are not uniform, you can remove this parameter. If the ports can be consolidated, you can configure multiple EnvoyFilter resources, each binding to a specific portNumber.

   • pod_cidrs: The pod CIDR of the ACK or ACK Serverless cluster. To find this value, log on to the Container Service Management Console and go to the Cluster Information page. On the Cluster Resources tab, find the Pod CIDR block under VPC and use this value for the parameter.

2. Run the following command to apply the EnvoyFilter.

   kubectl apply -f any-spring-cloud-support.yaml

Connect to the control plane cluster by using kubectl. For more information, see Access Istio resources on the control plane by using kubectl.

Create a ServiceEntry.

1. Create a file named external-nacos-svc.yaml with the following content.

   kind: ServiceEntry
   metadata:
     name: external-nacos-svc
   spec:
     hosts:
     - "NACOS_SERVER_HOST"  ## Replace this with your Nacos Server HOST, for example, "mse-xxx-p.nacos-ans.mse.aliyuncs.com".
     location: MESH_EXTERNAL
     ports:
     - number: 8848
       name: http
     resolution: DNS

   In the preceding YAML file, 8848 is the default port for Nacos. If you use a self-managed Nacos server and have changed the port, you must also modify the number parameter accordingly.

2. Run the following command to create the ServiceEntry.

   kubectl apply -f external-nacos-svc.yaml

Create an EnvoyFilter.

1. Create a file named external-envoyfilter.yaml with the following content.

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     labels:
       provider: "asm"
       asm-system: "true"
     name: nacos-subscribe-lua
     namespace: istio-system
   spec:
     configPatches:
       # The first patch adds the lua filter to the listener/http connection manager.
     - applyTo: HTTP_FILTER
       match:
         proxy:
           proxyVersion: "^1.*"
         context: SIDECAR_OUTBOUND
         listener:
           portNumber: 8848
           filterChain:
             filter:
               name: "envoy.filters.network.http_connection_manager"
               subFilter:
                 name: "envoy.filters.http.router"
       patch:
         operation: INSERT_BEFORE
         value: # lua filter specification
          name: envoy.lua
          typed_config:
             "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
             inlineCode: |
                -- copyright: ASM (Alibaba Cloud ServiceMesh)
                function envoy_on_request(request_handle)
                  local request_headers = request_handle:headers()
                  -- /nacos/v1/ns/instance/list?healthyOnly=false&namespaceId=public&clientIP=10.122.63.81&serviceName=DEFAULT_GROUP%40%40service-provider&udpPort=53174&encoding=UTF-8
                  local path = request_headers:get(":path")
                  if string.match(path,"^/nacos/v1/ns/instance/list") then
                    local servicename = string.gsub(path,".*&serviceName.*40([%w.\\_\\-]+)&.*","%1")
                    request_handle:streamInfo():dynamicMetadata():set("context", "request.path", path)
                    request_handle:streamInfo():dynamicMetadata():set("context", "request.servicename", servicename)
                    request_handle:logInfo("subscribe for serviceName: " .. servicename)
                  else
                    request_handle:streamInfo():dynamicMetadata():set("context", "request.path", "")
                  end
                end
                function envoy_on_response(response_handle)
                  local request_path = response_handle:streamInfo():dynamicMetadata():get("context")["request.path"]
                  if request_path == "" then
                     return
                  end
                  local servicename = response_handle:streamInfo():dynamicMetadata():get("context")["request.servicename"]
                  response_handle:logInfo("modified response ip to serviceName:" .. servicename)
                  local bodyObject = response_handle:body(true)
                  local body= bodyObject:getBytes(0,bodyObject:length())
                  body = string.gsub(body,"%s+","")
                  body = string.gsub(body,"(ip\":\")(%d+.%d+.%d+.%d+)","%1"..servicename)
                  response_handle:body():setBytes(body)
                end

2. Run the following command to create the EnvoyFilter.

   kubectl apply -f external-envoyfilter.yaml

Check whether traffic interception is enabled for the Nacos port or IP address.

To intercept the registration process, you must create the EnvoyFilter before the workloads. If a workload was created first, you must perform a rolling update on it.

Check that a Kubernetes Service of the ClusterIP type exists for each service.

Check which method you used to enable Spring Cloud support on the ASM control plane.

Check the sidecar version of the services. If the sidecar image version is earlier than 1.13.4.32, only the control plane of the ASM instance was upgraded, but not the data plane. You need to perform a rolling update on the affected service deployments.