Troubleshoot external database authentication in ASM-阿里云帮助中心

This topic describes why authentication can fail when a service within an ASM instance attempts to access an external database. It also provides the symptoms, cause, and solutions.

Symptoms

You are using ASM version 1.10 or earlier and have multiple external databases that require different login credentials. After you add a service, such as Service A, to the Service Mesh and inject a sidecar proxy, requests to the databases fail with an authentication error.

Cause

You have defined a DNS alias for an external TCP service, such as a database, by using a Kubernetes service of the ExternalName type. After your application service joins the Service Mesh, its sidecar proxy does not have a mapping between a cluster IP address and the external service. As a result, the sidecar proxy routes outbound traffic based only on the destination port. If multiple external services use the same port, traffic intended for Database A might be incorrectly routed to Database B. This causes an authentication failure because the credentials for the two databases are different.

Solutions

Solution 1: Upgrade the ASM instance

Upgrade your ASM instance to version 1.11 or later to resolve this issue. For more information, see Upgrade an ASM instance.

Solution 2: Use a service entry

You can create a service entry in ASM to allow services within the mesh to access a database at a specific IP address. You can also create the service entry in a specific namespace to limit its scope.

Log on to the ASM console.
In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
On the details page of the ASM instance, choose Cluster & Workload Management > External Service(ServiceEntry). On the page that appears, click Create from YAML.

On the Create page, set the Namespaces to istio-system, select a template, replace the content in the YAML editor with the following code, and then click Create.

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: mysql-demo
spec:
  addresses:
  - 172.1.xx.xx
  endpoints:
  - address: 172.1.xx.xx
  hosts:
  - test-mysql.com
  location: MESH_EXTERNAL
  ports:
  - name: tcp
    number: 3306
    protocol: TCP
  resolution: STATIC

addresses: Set this to the IP address of your database.
number: Set this to the port number of your database.