Container Service for Kubernetes:Migrate applications from a third-party Kubernetes cluster to ACK

Limitations

Review these constraints before starting — violations mid-migration block progress.

• CSI plugin required in the restore cluster. Clusters using FlexVolume, or using csi-compatible-controller with FlexVolume, do not support restoration.

• Kubernetes version requirements. Source cluster: Kubernetes 1.16+. ACK restore cluster: Kubernetes 1.18+.

• One-time vault association. Each backup vault can be associated with a restore cluster only once.

How it works

1. Connect your third-party Kubernetes cluster to a registered cluster in ACK One.

2. Back up the application and its volumes to an OSS bucket via Cloud Backup.

3. Associate the backup vault with the target ACK cluster.

4. Restore the application in the ACK cluster, with automatic StorageClass conversion to an Alibaba Cloud-native storage class.

Prerequisites

Ensure the following:

• A registered cluster in ACK One connected to a third-party Kubernetes cluster (Kubernetes 1.16+).

• An ACK managed cluster or ACK dedicated cluster (Kubernetes 1.18+) in the same region as the registered cluster.

• Cluster backup enabled on both clusters.

• Cloud Backup activated.

• If the registered cluster connects via CEN, Express Connect, or VPN: a route to the OSS bucket's regional internal network is configured. See Internal OSS endpoints and VIP ranges.

Usage notes

• When backing up local volumes, create PVs and PVCs to mount them.

• When backing up third-party object, file, or block storage, mount volumes with PVs and PVCs via the CSI plug-in.

Preparations

Verify these before running the backup.

In the registered cluster

A RAM user with OSS and Cloud Backup permissions exists, and a Secret named alibaba-addon-secret with that user's AccessKey ID and Secret is present in the csdr namespace. Confirm:

kubectl get secret alibaba-addon-secret -n csdr

Expected output:

alibaba-addon-secret   Opaque   2      5d22h

In the ACK cluster

• ACK managed cluster: Cloud Backup is activated and an OSS bucket named cnfs-oss-**** exists.

• ACK dedicated cluster: The worker RAM role has OSS and Cloud Backup permissions. See Install migrate-controller and grant permissions.

Step 1: Deploy the application in the external Kubernetes cluster

Run all commands against the external Kubernetes cluster (source cluster connected to your registered cluster).

This example uses a MySQL application with a PVC named mysql-pvc, a PV named mysql-pv, and a mount path of /mnt.

1. Create a namespace named test1:

   kubectl create namespace test1

2. Mount the MySQL application's volume with a PV and PVC using the CSI plug-in. Check your cloud provider's CSI documentation. If CSI is not supported, connect to the registered cluster to use the Alibaba Cloud CSI plug-in instead.

3. Confirm the application is running:

   kubectl -n test1 get pod | grep mysql-sts

   Expected output:

   mysql-sts-0   1/1     Running   0         1m02s

4. Verify the PV includes CSI fields:

   kubectl -n test1 get pv mysql-pv -oyaml

   Expected output (excerpt):

   csi:
     driver: ****
     volumeAttributes:
       xxxx: xxxx
       xxxx: xxxx
     volumeHandle: mysql-pv

5. Log in to the MySQL container:

   kubectl -n test1 exec -it mysql-sts-0 -- /bin/bash

6. Create test files to verify restoration later:

   cd /mnt && touch test && ls

   Expected output:

   test

Step 2: Back up the application in the registered cluster

Run all operations against the registered cluster in the ACK console.

1. If no backup vault exists, create one. See Create a backup vault.

2. Create an on-demand backup task named mysql-backup in the registered cluster. See Create a backup task.

   Parameter	Value
   Name	mysql-backup
   Backup Vaults	Select the vault you created
   Backup Namespaces	test1
   Volume Backup	Select Volume Backup to include persistent data

3. On the Application Backup page, click Backup Records. Wait until mysql-backup changes from InProgress to Completed.

Step 3: Associate the backup vault with the ACK cluster

Run all operations against the ACK cluster in the ACK console.

If you use a newly created backup vault or have not associated it with this ACK cluster before, associate the vault before restoring. Each vault can be associated only once — after initialization, backups sync automatically.

1. On the Application Backup page, click Restore.

2. In the Restore panel, enter a Name, select Backup Vaults, and click Initialize Backup Vault.

3. After initialization, select the restore task from the backup vault and click OK.

4. On the Backup Records tab, wait for mysql-backup to appear in the list.

Step 4: Restore the application in the ACK cluster

Run all operations against the ACK cluster in the ACK console.

During restore, the ACK cluster dynamically mounts a PVC with StorageClass alibabacloud-cnfs-nas (Alibaba Cloud NAS) for the MySQL application and restores data to the associated volume.

1. Create a restore task named mysql-restore. See Restore applications and volumes.

   Parameter	Value
   Name	mysql-restore
   Backup Vaults	Select the vault you created
   Select Backup	mysql-backup
   Reset Namespace	Change test1 to test2
   StorageClass Conversion	For mysql-pvc, select alibabacloud-cnfs-nas

2. Click View Restoration Records. Wait until mysql-restore changes from InProgress to Completed.

3. Verify the application is running:

   kubectl -n test2 get pod | grep mysql-sts

   Expected output:

   mysql-sts-0   1/1     Running   0          4s

4. Verify the data is restored:

   1. Verify the PVC's StorageClass is alibabacloud-cnfs-nas:

      kubectl -n test2 get pvc | grep mysql-pvc

      Expected output:

      mysql-pvc   Bound    nas-****   25Gi       RWO            alibabacloud-cnfs-nas   3m24s

   2. Confirm the PVC is mounted to the MySQL pod:

      kubectl -n test2 describe pvc mysql-pvc | grep "Used By"

      Expected output:

      Used By:       mysql-sts-0

   3. Log in to the MySQL container and check the test data:

      kubectl -n test2 exec -it mysql-sts-0 -- /bin/bash

      cd /mnt && ls

      Expected output:

      test

      The test file confirms successful data restoration.

Next steps

• See Overview of registered clusters for detailed backup and restore operations.

• Configure additional ACK system components for application compatibility. See Install migrate-controller and grant permissions.