Container Service for Kubernetes:Cross-region disaster recovery with multiple ACK clusters in different VPCs (using CEN to connect VPC networks)

Network planning

• vSwitch and VPC network planning

  • VPC network planning

    Object	VPC name	Region	IPv4 CIDR block
    Cluster	vpc-hangzhou	cn-hangzhou	20.0.0.0/8
    	vpc-shanghai	cn-shanghai	21.0.0.0/8
    Service Mesh	vpc-hangzhou2	cn-hangzhou	192.168.0.0/16

  • vSwitch network planning

    Important

    To avoid route conflicts after connecting VPCs using CEN, ensure that the two vSwitches do not use overlapping CIDR blocks.

    Object	vSwitch name	VPC	IPv4 CIDR block
    Cluster	vpc-hangzhou-switch-1	vpc-hangzhou	20.0.0.0/16
    	vpc-shanghai-switch-1	vpc-shanghai	21.0.0.0/16
    Service Mesh	vpc-hangzhou-switch-2	vpc-hangzhou2	192.168.0.0/24

• Pod and Service network planning for clusters

  Cluster name	Region	VPC	Pod CIDR	Service CIDR
  ack-hangzhou	cn-hangzhou	vpc-hangzhou	10.0.0.0/16	172.16.0.0/16
  ack-shanghai	cn-shanghai	vpc-shanghai	10.1.0.0/16	172.17.0.0/16

Step 1: Create clusters in different regions

1. Create VPCs and vSwitches in the China (Hangzhou) and China (Shanghai) regions according to the preceding plan. For more information, see Create a vSwitch and Create a VPC and a vSwitch.

2. Create clusters in the China (Hangzhou) and China (Shanghai) regions using the VPCs and network plan described earlier. For more information, see Create an ACK managed cluster.

3. Create an ASM instance in the China (Hangzhou) region according to the preceding plan. For more information, see Create an ASM instance.

Step 2: Use CEN to connect VPCs across regions

Use CEN to connect the VPC networks between clusters and between clusters and the Service Mesh.

1. Log on to the Cloud Enterprise Network console and create a CEN instance. For more information, see Create a Cloud Enterprise Network instance.

2. Create transit routers.

   1. On the Cloud Enterprise Network instances page, click the CEN instance created in Step 1. Then, under the Basic Information tab, click Create Transit Router.

   2. In the Create Transit Router dialog box, select a Region, enter a Name, and then click Confirm.

   This example creates two transit routers:

   • Region: China (Shanghai), Name: shanghai-router.

   • Region: China (Hangzhou), Name: hangzhou-router.

3. Add VPCs to the transit routers. Repeat the following steps for both the Shanghai and Hangzhou transit routers to connect their respective VPCs.

   1. On the Cloud Enterprise Network instances page, click the CEN instance created in Step 1. Then, under the Basic Information tab, click the ID of the newly created transit router to go to its details page.

   2. Click the Intra-region Connections tab, and then click Create Network Instance Connection. Set Instance Type to Virtual Private Cloud (VPC), and select the VPC instance corresponding to the region for Network Instance.

   3. Keep other settings at their default values and click Create.

4. Configure cross-region bandwidth.

   1. Click the transit router created in Step 2. On the right side of the page, click Create Network Instance Connection.

   2. In the Connect Network Instance dialog box, configure the settings and click Create.

      The following example shows the configuration for Hangzhou to Shanghai. Region refers to the current region, and Peer Region refers to the destination region. For more information about configuration options, see Inter-region connection. Configure the following settings: set Instance Type to Inter-region Connection, Region to China (Hangzhou), Connection Name to to-shanghai, Peer Region to China (Shanghai), Bandwidth Allocation Method to Pay-by-Data-Transfer, and Bandwidth to 1 Mbps. Expand Advanced Configuration and select the following check boxes: Automatically Associate with Default Route Table of Transit Router, Automatically Propagate System Routes to Default Route Table of Transit Router, and Automatically Publish Routes to Peer Region.

      After creation, you can view the new instance on the Inter-region Connections tab.

5. Add security group rules.

   The following example uses the Flannel network plug-in. Add the Pod CIDR block of the peer cluster to the security group of each cluster.

   Note

   If you use the Terway network plug-in, use the vSwitch CIDR block of the cluster. You can log on to the VPC console and find the vSwitch CIDR block in the vSwitch page under the IPv4 CIDR column.

   1. Log on to the ACK console. In the left navigation pane, click Clusters.

   2. Obtain the Pod CIDR blocks.

      1. On the Clusters page, select the China (Shanghai) region, click the ack-shanghai cluster name, and then on the Cluster Information page, go to the Basic Information tab to obtain the Pod CIDR block for the ack-shanghai cluster.

      2. Return to the Clusters page, select the China (Hangzhou) region, click the ack-hangzhou cluster name, and then on the Cluster Information page, go to the Basic Information tab to obtain the Pod CIDR block for the ack-hangzhou cluster.

   3. Configure security groups.

      1. On the Cluster Information page for each cluster, go to the Basic Information tab and click the security group ID next to Control Plane Security Group.

      2. On the Security Group Details tab, under Inbound, click Add Rule.

      3. Set Protocol Type to All, set Source to the Pod CIDR block of the peer cluster, keep other settings at their defaults, and then click Actions → Save.

   4. Log on to nodes in both clusters and use the ping command to test connectivity between the clusters. For more information, see Log on to a node.

Step 3: Add clusters to the ASM instance and create a managed ingress gateway

1. Add the clusters in the China (Hangzhou) and China (Shanghai) regions to the ASM instance. For more information, see Add a cluster to an ASM instance.

2. Create an ingress gateway.

   apiVersion: istio.alibabacloud.com/v1beta1
   kind: IstioGateway
   metadata:
     annotations:
       asm.alibabacloud.com/managed-by-asm: 'true'
     name: ingressgateway
     namespace: istio-system
   spec:
     gatewayType: ingress
     dnsPolicy: ClusterFirst
     externalTrafficPolicy: Local
     hostNetwork: false
     ports:
     - name: http
       port: 80
       protocol: TCP
       targetPort: 80
     - name: https
       port: 443
       protocol: TCP
       targetPort: 443
     replicaCount: 1
     resources:
       limits:
         cpu: '2'
         memory: 2G
       requests:
         cpu: 200m
         memory: 256Mi
     rollingMaxSurge: 100%
     rollingMaxUnavailable: 25%
     runAsRoot: true
     serviceType: LoadBalancer

Step 4: Deploy the Bookinfo demo application

1. Deploy the Bookinfo application in both the ack-hangzhou and ack-shanghai clusters.

   kubectl apply -f bookinfo.yaml

2. Connect to the ASM instance using kubectl and create routing rules.

   1. Create asm.yaml with the following content.

      Expand to view YAML content

      apiVersion: networking.istio.io/v1alpha3
      kind: Gateway
      metadata:
        name: bookinfo-gateway
      spec:
        selector:
          istio: ingressgateway # use istio default controller
        servers:
        - port:
            number: 80
            name: http
            protocol: HTTP
          hosts:
          - "*"
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: bookinfo
      spec:
        hosts:
        - "*"
        gateways:
        - bookinfo-gateway
        http:
        - match:
          - uri:
              exact: /productpage
          - uri:
              prefix: /static
          - uri:
              exact: /login
          - uri:
              exact: /logout
          - uri:
              prefix: /api/v1/products
          route:
          - destination:
              host: productpage
              port:
                number: 9080
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: productpage
      spec:
        host: productpage
        subsets:
        - name: v1
          labels:
            version: v1
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: reviews
      spec:
        host: reviews
        subsets:
        - name: v1
          labels:
            version: v1
        - name: v2
          labels:
            version: v2
        - name: v3
          labels:
            version: v3
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: ratings
      spec:
        host: ratings
        subsets:
        - name: v1
          labels:
            version: v1
        - name: v2
          labels:
            version: v2
        - name: v2-mysql
          labels:
            version: v2-mysql
        - name: v2-mysql-vm
          labels:
            version: v2-mysql-vm
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: details
      spec:
        host: details
        subsets:
        - name: v1
          labels:
            version: v1
        - name: v2
          labels:
            version: v2
      ---
      	  

   2. Create the routing rules.

      kubectl apply -f asm.yaml

3. Verify that the Bookinfo application is deployed successfully.

   1. Obtain the ingress gateway address.

   2. In the address bar of your browser, enter http://{IP address of the ingress gateway}/productpage and refresh the page several times to observe the default round-robin routing.

      Each time you refresh the page, you access one of the v1, v2, or v3 versions of the reviews service. You will notice that traffic to the three versions of the reviews service is distributed in an approximately 1:1:1 ratio.

      The reviews-v1 page displays only text reviews with no star ratings, the reviews-v2 page displays black star ratings, and the reviews-v3 page displays red star ratings.

Step 5: Use cross-region failover and cross-region traffic distribution

FAQ