Alauda Service Mesh v2 Docs

Alauda Service Mesh v2.2

Alauda Service Mesh v2.2 is built on the Istio project and is installed using a new Istio Operator derived from the Sail Operator (hosted in the istio-ecosystem GitHub organization). The Operator provides an expanded set of custom resource definitions (CRDs) to manage Istio components.

TOC

Alauda Service Mesh v2.2.0Supported component versionsIstio FeaturesUpgrade considerationsKiali Features

Alauda Service Mesh v2.2.0

Supported component versions

Istio Features

  • Updated Istio to version 1.30.3.
    • Ambient: CIDR addresses in ServiceEntry, optional XFCC synthesis at waypoints, configurable HBONE window sizing, ztunnel runtime metrics, and DNS capture enabled by default.
    • Gateway API: TLSRoute termination and mixed mode, TLS passthrough listeners on east-west gateways, and attached ListenerSets reported in the Gateway status.
    • Traffic management: Namespace-level traffic distribution, configurable DNS upstream timeout and failover priority, and the new TrafficExtension API as a unified extension mechanism for Wasm and Lua.
    • Security: XDS debug endpoint authentication enabled by default, certificate revocation list (CRL) support in ztunnel, and optional NetworkPolicy resources for istiod, istio-cni, and ztunnel.
    • Multi-cluster: Multi-network multicluster ambient promoted to beta, with improved telemetry and peer metadata exchange.
    • Install & ops: Helm v4 server-side apply support, configurable network gateway service ports, and istiod setting GOMEMLIMIT automatically to reduce the risk of out-of-memory failures.
  • References

Upgrade considerations

The following Istio 1.29 and 1.30 changes affect existing meshes when you update from Istio 1.28:

  • Kubernetes: Istio 1.30 requires Kubernetes 1.32 or later. Upgrade the cluster before you update the control plane if it runs Kubernetes 1.30 or 1.31, which are valid versions for Istio 1.28.
  • Gateway API TLSRoute: Istio 1.30 reads TLSRoute at gateway.networking.k8s.io/v1 and ignores the CRD below bundle version v1.5.0, whereas Istio 1.28.6 reads it at v1alpha2 and ignores the CRD above bundle version v1.4.0. No bundle version serves both, so TLSRoute stays unavailable until Istio 1.30 runs on Alauda Container Platform 4.4, and TLS passthrough listeners report attachedRoutes: 0 while the CRD is ignored. Gateway and HTTPRoute are not affected.
  • Gateway API ListenerSet: Istio 1.28 read the experimental XListenerSet resource (gateway.networking.x-k8s.io/v1alpha1); Istio 1.30 reads ListenerSet (gateway.networking.k8s.io/v1) instead. These are separate CRDs, so a newer Gateway API bundle does not migrate existing objects: Istio 1.30 ignores every XListenerSet and stops programming the listeners it contributed. After you update Alauda Container Platform to 4.4, which provides the ListenerSet CRD, recreate each object as a ListenerSet, set spec.listeners[].port, which is now a required field, and update the parentRefs of the routes that attach to it. Gateway.spec.allowedListeners is unchanged.
  • Ambient tracing: waypoint proxies report spans under the waypoint service name instead of the destination service name. Set external_services.tracing.use_waypoint_name to true in the Kiali resource, otherwise Kiali shows no traces for ambient workloads. See Updating the Kiali tracing configuration.
  • Ambient CNI: the Istio CNI agent now honors values.cni.excludeNamespaces. Ambient workloads in an excluded namespace are removed from the mesh.
  • Ambient DNS: DNS capture is enabled by default for ambient workloads, and the Istio CNI reconciles the in-pod rules of existing workloads when it starts.
  • Metrics: the sidecar.istio.io/statsCompression annotation was removed; use the statsCompression option in proxyConfig instead. Circuit breaker remaining metrics are no longer tracked by default; set DISABLE_TRACK_REMAINING_CB_METRICS=false to restore them.
  • Service selection: when a hostname exists in several namespaces, sidecars now prefer a Kubernetes Service over other service types. Set PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE to false, or set spec.values.compatibilityVersion to 1.28, to restore the previous behavior.
  • Debug endpoints: XDS debug endpoints on port 15010 now require authentication, and debug endpoints on port 15014 are restricted per namespace. Set ENABLE_DEBUG_ENDPOINT_AUTH=false to restore the previous behavior.
  • Istio CNI: CNI configuration files are written with 0600 permissions. Set values.cni.env.CNI_CONF_GROUP_READ to true if a non-root group must read them.

Kiali Features

  • Updated Kiali to version 2.27.
    • Overview and namespaces: New Overview and Namespaces pages, a dedicated namespace detail page, service insights that incorporate L4 metrics, and ambient and sidecar badges. Detail pages follow the same style.
    • Ambient: Trace overlay for ambient traffic, improved inter-cluster telemetry, and fixes for ztunnel dump errors and missing heatmaps in ambient tracing namespaces.
    • Validation: Multi-primary support for validations and MeshConfig, and removal of the Istio service registry dependency for validations.
    • Mesh page: Multi-mesh control plane donut chart.
    • Deployment: Prometheus can be enabled or disabled (external_services.prometheus.enabled), a pod disruption budget can be configured (deployment.pod_disruption_budget), and Prometheus is re-enabled automatically after an initial health check failure.
    • Observability: The kiali_health_status metric was redefined to produce a lower cardinality of time series and is now opt-in (server.observability.metrics.health_status.enabled).
    • Performance: Faster traffic animation, istio graph appender, health cache memory usage, and workload fetching for single namespaces.
    • Deprecated fields: spec.istio_labels.egress_gateway_label, spec.istio_labels.ingress_gateway_label, spec.istio_labels.injection_label_name, and spec.istio_labels.injection_label_rev are ignored and replaced by standard constant values.
    • For the configuration changes that affect an upgrade, see Upgrading Alauda Build of Kiali.
  • References