Deploy ECI Pods on ACK Virtual Nodes with ASM Sidecar Injection - Container Service for Kubernetes - Alibaba Cloud - Container Service for Kubernetes

Alibaba Cloud Container Service provides multiple serverless container offerings based on virtual nodes and Elastic Container Instance (ECI). For example, deploying the Container Service for Kubernetes (ACK) virtual node component seamlessly connects Kubernetes with ECI, enabling you to flexibly and dynamically create ECI pods on demand without cluster capacity planning.

Prerequisites

An ASM instance of v1.7.5.41 or later is created. For more information, see Create an ASM instance.
The ack-virtual-node component is deployed in the ACK cluster and runs as expected. For more information, see Step 1: Deploy the ack-virtual-node component.
The ACK cluster is added to the ASM instance.
The kubeconfig file of the cluster is obtained, and kubectl is used to connect to the cluster.

Step 1: Enable automatic sidecar injection for the target namespace

After you enable automatic sidecar injection for a namespace in the ASM console, an Envoy proxy is automatically injected as a sidecar into each pod that is created in the namespace. These Envoy proxies comprise the data plane of the ASM instance.

In this example, automatic sidecar injection is enabled for the default and vk namespaces. Method 1 uses the default namespace, and Method 2 uses the vk namespace. For more information, see Manage global namespaces.

Step 2: Create an ECI pod application

Note

After you create an ECI pod application, ASM can manage the application on the data plane through the injected sidecar.

The following two methods are alternatives. Choose one based on the scope that you want the alibabacloud.com/eci=true label to apply to:

Method 1: pod label — You specify the label when you create the pod, and the label applies to that pod only.
Method 2: namespace label — You add the label to the namespace before you create the pod, and the label applies to the pods that you create in that namespace.

Method 1: Create an ECI pod application by configuring pod labels

Specify the alibabacloud.com/eci=true label when you create the pod. The pod then runs as an ECI instance on a virtual node.

Run the following command to verify that the default namespace contains the istio-injection=enabled label:

kubectl get ns default --show-labels

Expected output:

NAME      STATUS   AGE   LABELS
default   Active   16d   istio-injection=enabled,kubernetes.io/metadata.name=default,provider=asm

Run the following command to deploy an Nginx application:

kubectl run nginx -n default --image nginx -l alibabacloud.com/eci=true

Expected output:

pod/nginx created

Run the following command to view the information of the pod on the virtual node:

kubectl get pod -n default -o wide|grep virtual-kubelet

Expected output:

nginx                             2/2     Running            0              8m49s    192.168.XXX.XXX   virtual-kubelet-cn-beijing-i   <none>           <none>

The 2/2 ready count in the output indicates that the injected sidecar runs alongside the application container. ASM manages the pod on the data plane.

Method 2: Create an ECI pod application by configuring namespace labels

Add the alibabacloud.com/eci=true label to the namespace before you create the pod. The pods that you then create in the namespace run as ECI instances on a virtual node.

Run the following command to verify that the vk namespace contains the istio-injection=enabled label:

kubectl get ns vk --show-labels

Expected output:

NAME   STATUS   AGE   LABELS
vk     Active   96m   istio-injection=enabled,kubernetes.io/metadata.name=vk,provider=asm

Run the following command to add the label to the vk namespace:
```
kubectl label namespace vk alibabacloud.com/eci=true
```
Expected output:
```
namespace/vk labeled
```
Run the following command to deploy an Nginx application:
```
kubectl -n vk run nginx --image nginx
```
Expected output:
```
pod/nginx created
```

Run the following command to view the information of the pod on the virtual node:

kubectl -n vk get pod -o wide|grep virtual-kubelet

Expected output:

nginx   2/2     Running   0          38s   192.168.XXX.XXX   virtual-kubelet-cn-beijing-i   <none>           <none>

The 2/2 ready count in the output indicates that the pod runs with the injected sidecar. ASM manages the pod on the data plane through this sidecar.