Accelerate cross-region ACK image pulls with GA - Container Service for Kubernetes

Prerequisites

An ACK managed Pro cluster of version 1.24 or later has been created. For more information about how to create a cluster, see Create an ACK managed cluster. If you need to upgrade the cluster, see Manually upgrade a cluster.

Usage notes

Ensure that your network access complies with all applicable laws and regulations. Access to websites with illegal content may be blocked.

Billing

In addition to the related fees for your ACK cluster, the GA instance also incurs charges. These charges include instance fees, CU (performance capacity unit) fees, and data transfer fees. For more information, see Billing overview.

Step 1: Create a standard GA instance

A standard GA instance provides a fully meshed network that connects multiple access regions and origin regions, and supports Layer 4 (TCP and UDP) and Layer 7 (HTTP and HTTPS) protocol acceleration. When you create a GA instance, configure parameters such as the overseas region that you want to accelerate and the access address of the image repository, for example, docker.io.

Log on to the GA console.

On the Instances page, click Create Standard Pay-as-you-go Instance and configure the parameters on the wizard pages. Read the on-screen instructions carefully, and then review and submit the configurations.

This topic describes how to create a pay-as-you-go standard GA instance and details the key parameters. For more information about the operations and parameters, see Create and manage a standard Global Accelerator instance.

Parameter	Description
Basic Instance Configuration
Billing Method	The default value is Pay-As-You-Go. A pay-as-you-go standard GA instance incurs these fees: instance fee, CU fee, and traffic fee.
Configure Acceleration Area
Acceleration Area	For the acceleration area, select the region where your ACK cluster is located. This example selects Hangzhou and Shanghai. Note For more information about the regions that GA supports, see Acceleration areas and regions.
Assign Bandwidth	Peak Bandwidth: The bandwidth of the acceleration region. In this example, the value is 200 Mbps. IP Protocol: The IP protocol for the IP addresses that are added to GA. In this example, the value is {value,select, IPv4 {IPv4} IPv6 {IPv6} PrefixList {Prefix List} SecurityGroup {Security Group} CrossSecurityGroup {Cross-account Security Group} other {{value}} }.
Configure Listeners
Protocol	The network transmission protocol used by the listener. This example uses TCP.
Port	Specify the listener port that is used to receive and forward requests to endpoints. The port number must be in the range of 1 to 65499. You can specify up to 30 ports for each listener. Separate multiple ports with commas (,), for example, `80,90,8080`. In this example, the value is set to `80,443`.
Configure an Endpoint Group
Region	The overseas region where network acceleration is required. This example uses US (Virginia).
Endpoint Configuration	Endpoints are the destination servers that process client requests. Configure the endpoints based on the following example: Backend service type: Select Custom Domain Name. Backend Service: The domain name of the image registry from which to pull images. In this example, it is set to `docker.io`. Weight (Valid values: 0 to 255): Enter an integer from 0 to 255. Global Accelerator routes traffic to endpoints based on their configured weights. Warning If the weight of an endpoint is set to 0, Global Accelerator stops distributing traffic to that endpoint. Proceed with caution. In this example, set the value to `255`.

After you complete the configuration, follow the on-screen instructions to go to the details page of the GA instance.

On the details page of the GA instance, click the Acceleration Area tab. In the Accelerated IP Address column, record the accelerated IP address for the region where your ACK cluster is deployed. You will use this IP address in Step 3: Configure DNS records.

Step 2: Configure the GA instance

On the details page of the GA instance, change the Transmission Network Quality Type to China Unicom Cross-Border Private Line.

Important
To use the China Unicom private line for cross-border network acceleration, you must complete cross-border compliance certification. Submit the required materials on the China Unicom cross-border cloud private line online application page to obtain the necessary qualifications.
(Optional) Add more virtual endpoints to the GA instance.

If you need to configure forwarding rules for other associated domain names for the target image, add another virtual endpoint group to the listener. This allows a single GA instance to accelerate access to multiple target endpoints.
1. Click the Listeners tab, and then click the ID of the listener in the ID and Name column to go to the details page of the Listeners.
2. Click the Endpoint Group tab and then click Add Virtual Endpoint Group. Follow the on-screen instructions to complete the configuration.
  
  The following example shows how to configure the Endpoint Configuration section:
  - Backend service type: Select Custom Domain.
  - Backend Service: The domain names of the image source to be pulled, such as production.cloudflare.docker.com.
  - Weight: Keep the value as 255.
3. On the listener configuration page, click the Routing Method tab and then click + Add Forwarding Rule. Follow the on-screen instructions to configure a new forwarding rule.
  
  For more information, see Add and manage forwarding rules.
  - Domain Name: Select Exact Match and Wildcard for the domain name matching rule. The forwarding domain is the domain name of the target image source, such as production.cloudflare.docker.com.
  - Forwarding Action: Configure traffic forwarding to a virtual endpoint group and select the virtual endpoint group that you added in the previous step.

Step 3: Configure DNS records

You can add DNS records to the /etc/hosts file on the ACK cluster nodes for local domain name resolution. Alternatively, you can configure DNS records in PrivateZone for internal DNS resolution. Using PrivateZone incurs charges after the configuration takes effect. For more information about billing, see Billing overview. The following table compares the two methods.

Feature	Local /etc/hosts records	PrivateZone records
Configuration location	In the `/etc/hosts` file on each target node.	In Alibaba Cloud DNS PrivateZone.
Scope	The settings apply only to the specified nodes. To make them effective for pods, you must configure custom hosts.	The settings apply to all nodes and pods within the virtual private cloud (VPC).
Maintenance	Requires manual configuration and maintenance on each node.	Centralized management simplifies maintenance and updates.
Use cases	Suitable for quick fixes for specific nodes or small-scale deployments.	Suitable for unified domain name resolution in large-scale clusters to ensure long-term stability.
Update speed	Changes take effect immediately but require manual updates on multiple nodes.	Update speed depends on the configured TTL. Changes are propagated automatically without requiring manual updates.
Time to Live (TTL)	Configurations are stored in a local file and take effect immediately without caching delays.	The default value is 1 minute. The TTL value affects how long it takes for DNS record updates to propagate. You can change the TTL value as required.

Local /etc/hosts records

After you create forwarding rules, you must add DNS records to the ACK cluster nodes. This allows the nodes to access the domain names of the image sources by using the accelerated IP address of the GA instance.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Nodes > Nodes.
Configure local resolution.
- Existing nodes: In the node list, select the nodes from which you want to pull images. At the bottom of the page, click Batch Operations. Select Run Shell Scripts as the operation type and click OK.
- Add a node: In the left navigation bar, select Nodes > Node Pools. Click Edit in the Actions column of the target node pool, then in the Advanced Options (Optional) section, enter the following Shell script in the User Data field, and click OK.
```
echo "47.XX.XX.5  production.cloudflare.docker.com" >> /etc/hosts
echo "47.XX.XX.5  docker.io" >> /etc/hosts
echo "47.XX.XX.5  registry-1.docker.io" >> /etc/hosts    # Docker registry domain.
echo "47.XX.XX.5  auth.docker.io"  >> /etc/hosts         # Docker authentication service domain.
```
Select ACS-ECS-BulkyRunCommand as the template. This template allows you to run Cloud Assistant commands on multiple ECS instances in batches. Keep the default values for other parameters and continue.
Follow the on-screen instructions to enter a shell script. This script adds A records to the /etc/hosts file on the nodes in batches. Set the IP addresses to the accelerated IP addresses that you obtained in Step 1: Create a standard GA instance. Set the domain names to the related domain names of the target image sources. After you configure the parameters, create the task.

For example, you can run the echo command to enable domain name resolution:
```
echo "47.xxx.xxx.5 production.cloudflare.docker.com" >> /etc/hosts
echo "47.xxx.xxx.5 docker.io" >> /etc/hosts
echo "47.xxx.xxx.5 registry-1.docker.io" >> /etc/hosts
echo "47.xxx.xxx.5 auth.docker.io"  >> /etc/hosts
```
After the task is complete, log on to an ECS instance, check whether the corresponding DNS records are added to the node, and then test whether the node can pull container images from the overseas sources.

PrivateZone records

After you create the forwarding rules, you must also configure DNS records in PrivateZone. This allows nodes to access the domain names of the image sources by using the accelerated CNAME of the GA instance.

Obtain the CNAME of the target GA instance.
1. Log on to the GA console.
2. In the navigation pane on the left, select Standard Instances.
3. On the Instances page, find the target Global Accelerator instance and click its ID.
4. On the Instance Information tab, obtain the CNAME of the GA instance.
Obtain the VPC ID of the VPC to which the ACK cluster nodes belong.
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.
3. On the Cluster Information page, click the Basic Information tab and obtain the VPC ID from the Network section.

Configure DNS records in PrivateZone.

Configure CNAME records for the access domain names to point to the accelerated CNAME of the GA instance. In this example, you need to create records for docker.io and production.cloudflare.docker.com. Because their top-level domains are different, you must create two built-in authoritative zones: io and cloudflare.docker.com. The following steps describe how to create a built-in authoritative zone for cloudflare.docker.com as an example.

Log on to the Alibaba Cloud DNS console.
In the navigation pane on the left, click PrivateZone. Click the Built-in Authoritative tab and then click the User Defined Zones tab.
On the User Domain tab, click Add Domain (Zone), enter cloudflare.docker.com in the Built-in Authoritative Domain (Zone) text box, enable Subdomain Recursive Resolution Proxy, select Built-in Authoritative Acceleration Zone for Domain Type, and then click OK.
On the User Domain tab, click Resolution Settings in the Actions column for cloudflare.docker.com. Then, on the Resolution Records tab, click Add Record.

In the Add Record dialog box, select Form. After you configure the parameters, click OK.

Parameter	Configuration
Record Type	Select CNAME to point a domain name to another domain name.
Hostname	When the built-in authoritative zone is `cloudflare.docker.com`, enter `production`. When the built-in authoritative domain (Zone) is `io`, enter the following domain names in order. `docker`: `docker.io` is the main domain name for Docker. `registry-1.docker`: `registry-1.docker.io` is the Docker registry domain name. `auth.docker`: `auth.docker.io` is the Docker authentication service domain name.
Record Value	Enter the CNAME acceleration domain name that you obtained in Step 1.
TTL	The cache duration for the record. A smaller value means that record updates take effect faster. The default value is 1 minute.

On the User Domain tab, click Scope Settings in the Actions column for cloudflare.docker.com.
In the Scope Management panel, for Effective in Alibaba Cloud VPC, select Current Account, then select Standard VPC. Select the region where the cluster is deployed. Select the VPC ID that you obtained in Step 2. You can hover over a VPC name to view its ID. Then, click OK.

After you complete the configuration, log on to an ECS instance and test whether the node can pull container images from the overseas sources.