Container Service for Kubernetes:Configure a static IP, dedicated vSwitch, and security group for a pod

Step 2: Create a PodNetworking custom resource

Terway uses a PodNetworking custom resource (CR) to describe network configurations. Create multiple PodNetworking objects to define different network planes.

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster, and then choose Workloads > Custom Resources in the left-side navigation pane.

3. On the Custom Resources page, click the CRDs tab, and then click Create from YAML.

   Sample PodNetworking YAML:

   apiVersion: network.alibabacloud.com/v1beta1
   kind: PodNetworking
   metadata:
     name: example
   spec:
     allocationType:
       type: Fixed # The pod IP address allocation policy. Valid values: Elastic and Fixed.
       releaseStrategy: TTL # This parameter is valid only when type is set to Fixed. If type is set to Elastic, you do not need to configure releaseStrategy and releaseAfter.
       releaseAfter: "1h" # This parameter is valid only when releaseStrategy is set to TTL.
     selector:
       podSelector:
         matchLabels:
           foo: bar
       namespaceSelector:
         matchLabels:
           foo: bar
     securityGroupIDs:
     - sg-bpxxxx
     vSwitchOptions:
     - vsw-bpxxxx
     eniOptions:
       eniType: Default

   Parameter descriptions:

   Parameter		Description
   allocationType (The pod IP address allocation policy)	type	Valid values: Elastic: IP resources are released after the pod is deleted. Fixed: The static IP address policy. When type is Fixed, this applies to pods with fixed names (StatefulSets and pods without ownerReferences by default). For custom workloads, configure terway-controlplane on the Add-ons page. Note With the static IP policy, recreated pods are constrained to the same zone as the original.
   	releaseStrategy	Valid only when type is Fixed. Valid values: TTL: Delayed release. IP released after a specified time post-pod-deletion. Minimum: 5 minutes. Never: IP never released. Manually delete the PodENI resource when no longer needed.
   	releaseAfter	The delayed release time. Valid only when releaseStrategy is TTL. Uses Go time type format with h and m units, such as 2h45m or 5m0s.
   selector (Label selector. Matched pods use this network configuration.)	podSelector	Matches pod labels. Matched pods use this network configuration. If both podSelector and namespaceSelector are configured, pods matching all rules use this configuration. Ensure a unique match. If a pod matches multiple PodNetworking configurations, the system arbitrarily applies one.
   	namespaceSelector	Labels to match a Namespace. Pods in matched Namespaces use this configuration. If both podSelector and namespaceSelector are configured, pods matching all rules use this configuration. Ensure a unique match. Multiple matches result in arbitrary selection.
   vSwitchOptions	-	The vSwitches for pods. If multiple IDs are provided, Terway selects one that meets conditions. Pods are constrained to the same zones as the specified vSwitches. The vSwitch zones must match the zones of the target nodes, and sufficient IP addresses must be available. Otherwise, pod creation fails. Note With auto scaling enabled, vSwitchOptions zone constraints may prevent node pool scale-out. See Auto scaling FAQ.
   vSwitchSelectOptions (Configures the vSwitch selection policy)	vSwitchSelectionPolicy	Valid values: ordered (default): Selects in the order entered. most: Prioritizes the vSwitch with the most available IPs. random: Randomly selects a vSwitch. Note Supported in Terway v1.11.0 and later.
   securityGroupIDs	-	Supports multiple security group IDs (all take effect). Maximum: 10. Note Terway v1.13.6 and later supports up to 10 security groups.
   eniOptions (Configures the ENI type used by the pod)	eniType	Valid values: Default: Trunk ENI for shared-ENI clusters, exclusive ENI for exclusive-ENI clusters. ENI: Uses an exclusive ENI. Trunk: Uses a Trunk ENI. Note Supported in Terway v1.11.0 and later.

4. Click Create.

   The PodNetworking takes effect only after its status becomes Ready.

   Check whether the resource status is ready:

   kubectl describe PodNetworking example # Replace example with the name of your custom resource.

(Optional) Step 3: Add matching labels to a namespace

To apply PodNetworking rules via label matching, add the corresponding labels to the target namespace.

1. Create a test namespace named example:

   kubectl create ns example

2. Add the foo=bar label to the namespace:

   kubectl label namespaces example foo=bar  # Replace example with your target namespace name.

3. View the labels of the namespace:

   kubectl get namespace example --show-labels  # Replace example with your target namespace name.

   Expected output:

    NAME      STATUS   AGE   LABELS
   example   Active   24s   foo=bar,kubernetes.io/metadata.name=example

(Optional) Step 4: Create an application pod

When a pod is created, the system matches its labels against PodNetworking resources. Matched pods receive an ENI per the matched configuration; unmatched pods use the default ENI.

Terway creates a PodENI custom resource to track each matched pod's network resources. See Labels and Selectors.

1. Create a file named my-nginx.yaml with the following YAML content:

   apiVersion: apps/v1
   kind: StatefulSet
   metadata:
     name: my-nginx    # The name of the sample application.
     namespace: example   # Specify the namespace as example.
     labels:
       app: nginx
   spec:
     serviceName: "nginx-service"  
     replicas: 1    
     selector:
       matchLabels:
         app: nginx 
     template:
       metadata:
         labels:
           app: nginx
           foo: bar  # Add the foo:bar label to the pod.
       spec:
         containers:
         - name: nginx
           image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
           ports:
           - containerPort: 80  
   
   #  If the StatefulSet requires persistent storage, you must define volumeClaimTemplates.
   #  Example:
   #  volumeClaimTemplates:
   #  - metadata:
   #      name: nginx-storage
   #    spec:
   #      accessModes: ["ReadWriteOnce"]
   #      storageClassName: "my-storage-class"
   #      resources:
   #        requests:
   #          storage: 1Gi

2. Deploy the my-nginx sample application. After deployment, see Verify PodNetworking usage to verify the network configuration.

   kubectl apply -f my-nginx.yaml

Verify PodNetworking usage

1. After creation, the pod's annotations include k8s.aliyun.com/pod-networking to indicate PodNetworking usage.

   apiVersion: v1
   kind: Pod
   metadata:
     annotations:
       k8s.aliyun.com/pod-eni: "true"
       k8s.aliyun.com/pod-networking: podnetworking
     labels:
       app: example
       pod-ip: elastic

2. Terway creates a PodENI resource (same name/namespace as the pod) to record its network configuration.

   kubectl get podenis.network.alibabacloud.com <my-nginx-0> -n <example> -o yaml # Replace <my-nginx-0> with the pod name and <example> with the pod's namespace.

   Expected output showing PodNetworking in use:

   apiVersion: network.alibabacloud.com/v1beta1
   kind: PodENI
   metadata:
     finalizers:
     - pod-eni
     generation: 1
     name: <my-nginx-0>
     namespace: default
   spec:
     allocations:
     - allocationType:
         type: Elastic
       eni:
         id: eni-bp1xxxx
         mac: 00:16:xx:xx:xx:xx
         securityGroupIDs:
         - sg-bp1xxxx
         vSwitchID: vsw-bp1xxxx
         zone: cn-hangzhou-h
       ipv4: 192.168.x.x
       ipv4CIDR: 192.168.x.x/19
       ipv6: 2408:x:x:x:x:x:x:x
       ipv6CIDR: 2408:x:x:x::/64
     zone: cn-hangzhou-h
   status:
     eniInfos:
       eni-bp1xxxx:
         id: eni-bp1xxxx
         status: Bind
         vid: 1001
     instanceID: i-bp1xxxx
     phase: Bind
     podLastSeen: "2021-xx-xxT00:00:00Z"
     trunkENIID: eni-bp1xxxx

Pod does not use the PodNetworking configuration

1. Verify the PodNetworking status is Ready.

2. Verify the pod's labels uniquely match the PodNetworking selector.

3. The static IP policy applies only to StatefulSet-managed pods.