Container Service for Kubernetes:Configure service discovery for virtual nodes with PrivateZone

Background information

Alibaba Cloud DNS PrivateZone (internal DNS resolution) resolves private domain names within Virtual Private Clouds (VPCs) for Elastic Compute Service (ECS) instances, containers, and other clients. PrivateZone is a paid service. See Product Billing.

Enable PrivateZone

1. Modify the eci-profile ConfigMap to enable PrivateZone.

   1. Log on to the ACK console. In the left navigation pane, click Clusters.

   2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Configurations > ConfigMaps.

   3. From the Namespace list, select kube-system. Find the eci-profile ConfigMap and click Edit.

   4. Set enablePrivateZone to true and click OK.

2. Confirm that PrivateZone is enabled.

   1. In the Alibaba Cloud DNS console, click Private Zone.

   2. On the Authoritative Zone tab, select the User Defined Zones tab. Verify that a zone named svc.cluster.local.<cluster-id> exists.

Sync Service DNS records to PrivateZone

1. Create a Deployment and Services for testing.

   1. Save the following YAML as test-pz.yaml.

      This manifest creates one Deployment and three Services: Headless, ClusterIP, and internal LoadBalancer.

      Important

      Service DNS records are not synced by default. Add the service.beta.kubernetes.io/alibaba-cloud-private-zone-enable: "true" annotation to a Service manifest to enable sync. The virtual node controller then automatically syncs DNS records to PrivateZone.

      apiVersion: v1
      kind: Service
      metadata:
        name: nginx-headless-service
        annotations:
           service.beta.kubernetes.io/alibaba-cloud-private-zone-enable: "true"
      spec:
        ports:
        - port: 80
          protocol: TCP
        selector:
          app: nginx
        clusterIP: None
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: nginx-clusterip-service
        annotations:
           service.beta.kubernetes.io/alibaba-cloud-private-zone-enable: "true"
      spec:
        ports:
        - port: 80
          protocol: TCP
        selector:
          app: nginx
        type: ClusterIP
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: nginx-intranet-service
        annotations:
          service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "intranet"
          service.beta.kubernetes.io/alibaba-cloud-private-zone-enable: "true"
      spec:
        ports:
        - port: 80
          protocol: TCP
        selector:
          app: nginx
        type: LoadBalancer
      ---  
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: nginx-deployment
        labels:
          app: nginx
      spec:
        replicas: 3
        selector:
          matchLabels:
            app: nginx
        template:
          metadata:
            labels:
              app: nginx
              alibabacloud.com/eci: "true"          # Add this label to schedule the Pod on ECI.
          spec:
            containers:
            - name: nginx
              image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
              ports:
              - containerPort: 80

   2. Create the Deployment and Services.

      kubectl create -f test-pz.yaml

2. Verify that the Service DNS records are synced to PrivateZone.

   1. In the Alibaba Cloud DNS console, click Private Zone.

   2. On the Authoritative Zone tab, select the User Defined Zones tab. Find the zone named svc.cluster.local.<cluster-id> and click Settings.

   3. On the Settings tab, verify that the Service DNS records are automatically synced.

      DNS records use the format <service-name>.<namespace> and resolve to corresponding IP addresses:

      • Headless Service: One DNS record per backend Pod IP.

      • ClusterIP Service: Resolves to the cluster-internal virtual IP of the Service.

      • Internal LoadBalancer Service: Resolves to the internal Server Load Balancer (SLB) IP.

      After sync, access Services within your VPC by private domain name:

      • Short domain name: Within the cluster, use <service-name> for same-namespace access, or <service-name>.<namespace> for cross-namespace access.

      • Fully qualified domain name (FQDN): From outside the cluster but within the VPC, use <service-name>.<namespace>.svc.cluster.local.<cluster-id>. Applies to Headless Services only.