All Products
Search

This Product

    Container Service for Kubernetes:Raven overview

    Document Center

    Container Service for Kubernetes:Raven overview

    Last Updated:Aug 27, 2026

    In ACK Edge clusters, Raven provides cross-network-domain communication for efficient multi-region cloud-edge O&M. This topic describes Raven concepts, how it works, and its capabilities.

    Raven supports proxy mode (Layer 7, handles IP conflicts) and tunnel mode (Layer 3, container-level connectivity).

    Background

    ACK Edge clusters use a cloud-edge architecture: control plane components run on the cloud, while workloads run at edge data centers or devices. Edge nodes connect to the control plane's public endpoint over the Internet.

    image

    Edge nodes are grouped into node pools, each representing a distinct network domain. Nodes in different node pools cannot communicate directly and may have overlapping IP addresses. This isolation is by design — but it prevents cloud-side components from reaching edge workloads for monitoring and operations.

    How it works

    Raven works in two phases: establishing tunnels between gateway nodes, then forwarding cross-domain traffic through those tunnels.

    Phase 1: Initialization

    • Each node pool elects one node as the edge gateway. Solo nodes act as their own gateway.

    • The raven-agent-ds DaemonSet runs on every node in host network mode. On gateway nodes, it establishes encrypted tunnels to the cloud gateway.

    • The ack-edge-yurt-manager control plane component divides nodes into network domains by node pool membership and creates a gateway custom resource for each domain.

    Phase 2: Request forwarding

    • Cross-domain requests from cloud-side components are routed through the cloud gateway node to the appropriate edge gateway node.

    • The edge gateway node forwards requests to the target host, container, or service within its network domain.

    image

    Choose a communication mode

    Choose based on whether your node pools have IP address conflicts.

    Mode Traffic type Supports IP conflicts Use when
    Proxy mode Host-level (Layer 7) Yes Node pools have IP conflicts, or you need kubectl logs/exec/attach/top
    Tunnel mode Container-level (Layer 3) No Node pools have inter-node connectivity and no IP conflicts

    Proxy mode

    Proxy mode creates an encrypted reverse channel between the edge gateway node and the cloud gateway node. The cloud gateway forwards cross-domain requests to the edge gateway at Layer 7, identifying targets by NodeName+Port. A solo node acts as its own gateway and tunnels directly to the cloud gateway.

    Proxy mode supports:

    • Host network communication for the APIServer, MetricsServer, and Prometheus

    • kubectl logs, kubectl exec, kubectl attach, and kubectl top

    • Node pools with conflicting IP address ranges

    In IP conflict scenarios, use proxy mode — tunnel mode cannot route host-level traffic when IP addresses overlap between network domains.

    Tunnel mode

    Tunnel mode creates IPsec-VPN tunnels between the edge gateway node and the cloud gateway node. Within each network domain, Raven creates a Virtual Extensible LAN (VXLAN) overlay using Flannel VXLAN, and all cross-domain container traffic routes through the VPN tunnel via the VXLAN.

    Tunnel mode supports:

    • Container-to-container communication across network domains

    • Metrics collection from edge containers by Prometheus

    Tunnel mode requires direct inter-node connectivity within each node pool.

    Important

    Data loss may occur during cross-domain communication over the Internet. Do not use tunnel mode to transmit business-critical data. For issues or suggestions, submit a ticket to contact the ACK technical team.

    Component architecture

    Raven consists of two components:

    Component Type Role
    ack-edge-yurt-manager Control plane Divides nodes into network domains based on node pools and creates gateway custom resources
    raven-agent-ds Data plane (DaemonSet) Runs on every node; configures routes or VPN tunnels between gateway nodes

    Raven requires a gateway custom cluster resource to store node and configuration data for each network domain.

    Prerequisites

    Before you begin, ensure that you have:

    • An ACK Edge cluster running Kubernetes 1.26.3 or later

    • At least one Elastic Compute Service (ECS) instance designated as the cloud gateway node (during cluster creation)

    • If edge hosts reach the control plane over the Internet: a Classic Load Balancer (CLB) instance, an elastic IP address (EIP), and configured network access control lists (ACLs)

    Next steps