Alibaba Cloud Service Mesh:Use service discovery selectors to reduce control plane push overhead

Label selector matching rules

Label selectors support two matching modes:

Exact match

Specify a label key and value. A namespace is selected only when both the key and value match exactly.

Expression-based match

Specify a label key, an operator, and optionally a set of values:

Method 1: Select namespaces in the console

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Service Discovery Selectors.

3. Set Mesh Discovery Mode to Automatically Discover Services in the Selected Namespace of a Kubernetes Cluster on the Data Plane.

4. On the Select Namespaces tab, select the cluster, then click unselect next to every namespace that should be excluded from discovery. Keep only the namespaces whose services need to be pushed to sidecar proxies. Click OK, then click OK in the Submit dialog.

5. Verify the configuration:

   1. In the left-side navigation pane, choose ASM Instance > Base Information.

   2. Confirm that Status shows Running.

Method 2: Use a label selector expression

This method is better for environments managed through infrastructure as code. Label each namespace that should be included, then define a label selector in the console.

1. Label each target namespace:

   kubectl label namespace <namespace-name> asm-discovery=enabled

2. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

3. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Service Discovery Selectors.

4. Set Mesh Discovery Mode to Automatically Discover Services in the Selected Namespace of a Kubernetes Cluster on the Data Plane, then click Edit Discovery Selectors Directly.

5. Define the label selector. For example, to select all namespaces that carry the asm-discovery label regardless of value, set Key to asm-discovery and Operator to Exists. Click OK, then click OK in the Submit dialog.

6. Verify the configuration:

   1. In the left-side navigation pane, choose ASM Instance > Base Information.

   2. Confirm that Status shows Running.

Check the sidecar proxy configuration

1. Get the pod name of a workload in a selected namespace:

   kubectl get pods -n <selected-namespace>

   NAME                       READY   STATUS    RESTARTS   AGE
   httpbin-6fcb98998c-46qhr   2/2     Running   0          22m

2. Dump the sidecar proxy configuration:

   kubectl exec -it <pod-name> -c istio-proxy -n <selected-namespace> -- curl -s localhost:15000/config_dump > config_dump.json

3. Search the config_dump.json file for a service in an excluded namespace. For example, search for httpbin.ns-not-in-mesh. If no match is found, the selector is working correctly -- sidecar proxies no longer store configurations from that namespace.

Check control plane logs

Trigger a service change in an excluded namespace (for example, create or delete a deployment), then verify that no corresponding push logs appear in the control plane logs.

Step 1: Create namespaces

1. Create two namespaces: ns-in-mesh and ns-not-in-mesh. For more information, see Create a namespace.

2. Enable automatic sidecar proxy injection for the ns-in-mesh namespace. For more information, see Enable automatic sidecar proxy injection.

3. Add the asm-discovery=enabled label to the ns-in-mesh namespace:

   kubectl label namespace ns-in-mesh asm-discovery=enabled

Step 2: Deploy a sample application

1. Create a file named httpbin.yaml with the following content:

   Show the httpbin.yaml file

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: httpbin
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: httpbin
     labels:
       app: httpbin
       service: httpbin
   spec:
     ports:
     - name: http
       port: 8000
       targetPort: 80
     selector:
       app: httpbin
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: httpbin
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: httpbin
         version: v1
     template:
       metadata:
         labels:
           app: httpbin
           version: v1
       spec:
         serviceAccountName: httpbin
         containers:
         - image: docker.io/kennethreitz/httpbin
           imagePullPolicy: IfNotPresent
           name: httpbin
           ports:
           - containerPort: 80

2. Deploy the HTTPBin application in both namespaces:

   kubectl apply -f httpbin.yaml -n ns-in-mesh
   kubectl apply -f httpbin.yaml -n ns-not-in-mesh

Step 3: Observe default push behavior

Before configuring a selector, verify that sidecar proxies receive configurations from all namespaces, including ns-not-in-mesh.

1. Get the pod name:

   kubectl get pods -n ns-in-mesh

   Example output:

   NAME                       READY   STATUS    RESTARTS   AGE
   httpbin-6fcb98998c-46qhr   2/2     Running   0          22m

2. Dump the sidecar proxy configuration:

   Replace httpbin-6fcb98998c-46qhr with the actual pod name from the previous step.

   kubectl exec -it httpbin-6fcb98998c-46qhr -c istio-proxy -n ns-in-mesh -- curl -s localhost:15000/config_dump > config_dump.json

3. Search for httpbin.ns-not-in-mesh in config_dump.json. If found, this confirms that sidecar proxies store service configurations from ns-not-in-mesh even though automatic sidecar proxy injection is not enabled for that namespace.

4. (Optional) Verify through control plane logs:

   1. Enable control plane log collection. For ASM versions earlier than 1.17.2.35, see Enable control-plane log collection and log-based alerting. For ASM versions 1.17.2.35 or later, see Use Log Center.

   2. Deploy the sleep application in the ns-not-in-mesh namespace to trigger a push event:

      Show the sleep.yaml file

      apiVersion: v1
      kind: Service
      metadata:
        name: sleep
        labels:
          app: sleep
      spec:
        ports:
        - port: 80
          name: http
        selector:
          app: sleep
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: sleep
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: sleep
        template:
          metadata:
            labels:
              app: sleep
          spec:
            containers:
            - name: sleep
              image: pstauffer/curl
              command: ["/bin/sleep", "3650d"]
              imagePullPolicy: IfNotPresent

      kubectl apply -f sleep.yaml -n ns-not-in-mesh

   3. Open the control plane logs (set Time Range to 5 Minutes). Log entries similar to the following confirm that the control plane pushes configurations for the ns-not-in-mesh namespace:

      Full push, new service ns-not-in-mesh/sleep.ns-not-in-mesh.svc.cluster.local

Step 4: Apply the service discovery selector

Follow the steps in Configure a service discovery selector to configure a selector that includes only the ns-in-mesh namespace.

Step 5: Confirm the selector works

1. Dump the sidecar proxy configuration again:

   kubectl exec -it <pod-name> -c istio-proxy -n ns-in-mesh -- curl -s localhost:15000/config_dump > config_dump.json

   Search for httpbin.ns-not-in-mesh. If no match is found, sidecar proxies no longer store configurations from the excluded namespace.

2. Delete the sleep application from ns-not-in-mesh to trigger a service change:

   kubectl delete -f sleep.yaml -n ns-not-in-mesh

   Check the control plane logs (set Time Range to 15 Minutes). If no push logs appear for the ns-not-in-mesh namespace, the selector is working as expected. The control plane ignores service changes in namespaces that fall outside the selector criteria.