Container Service for Kubernetes:Configure an eci-profile

How it works

eci-profile provides three capabilities:

• ECI Scheduler — Automatically schedules pods to ECI based on pod labels or namespace labels, using a mutating webhook. No manual toleration or node-selector changes are needed in your workload YAML.

• ECI Effect — Automatically injects annotations and labels into pods that match your selector criteria. Use this to enable ECI features such as specifying ECS instance types, enabling image caches, or configuring Network Time Protocol (NTP)—without modifying each workload.

• Hot updates — Changes to cluster-level parameters (such as vpcId and vSwitchIds) take effect immediately for newly created ECI pods. You do not need to restart the ack-virtual-node component. Existing ECI pods pick up the new settings only after rolling updates are performed.

Prerequisites

Before you begin, make sure that:

• The ack-virtual-node component in your cluster is updated to the latest version. See Manage components.

• Mutating webhooks are enabled in your cluster (required for ECI Scheduler). Pods in ACK Serverless clusters are automatically scheduled to ECI and do not need ECI Scheduler.

View the eci-profile

Run the following command to inspect the current eci-profile ConfigMap:

kubectl get cm -n kube-system eci-profile -o yaml

The output includes a data section similar to this:

apiVersion: v1
data:
  enableClusterIp: "true"
  enableHybridMode: "false"
  enableLinuxArm64Node: "false"
  enableLogController: "false"
  enablePVCController: "false"
  enablePrivateZone: "false"
  enableReuseSSLKey: "false"
  featureGates: "WaitForFirstConsumer=false"
  securityGroupId: sg-2zeeyaaxlkq9sppl****
  selectors: ""
  slsMachineGroup: ""
  vSwitchIds: vsw-2ze23nqzig8inprou****,vsw-2ze94pjtfuj9vaymf****
  vpcId: vpc-2zeghwzptn5zii0w7****
kind: ConfigMap
metadata:
  creationTimestamp: "2023-01-11T08:28:14Z"
  name: eci-profile
  namespace: kube-system
  resourceVersion: "356"
  uid: b345fa8c-919e-41fc-a981-57864b1a****

The data section contains two types of parameters:

Edit the eci-profile

Choose one of the following methods:

kubectl:

kubectl edit configmap eci-profile -n kube-system

ACK console:

1. Log on to the Container Service ACK console.

2. On the Clusters page, click the name of the target cluster.

3. In the left navigation pane, choose Configurations > ConfigMaps.

4. Select kube-system from the namespace drop-down list.

5. Find eci-profile and click Edit YAML in the Actions column.

Configure selectors

The selectors parameter controls both scheduling (ECI Scheduler) and annotation or label injection (ECI Effect).

data:
  selectors: |
    [
      {
        "name": "selector-demo1",         # required
        "namespaceSelector": {            # optional; filters by namespace labels
          "matchLabels": {                # AND logic among multiple labels
            "eci": "true"
          }
        },
        "objectSelector": {               # optional; filters by pod labels
          "matchLabels": {                # AND logic among multiple labels
            "eci": "true"
          }
        },
        "effect": {                       # optional; annotations and labels to inject
          "annotations": {
            "k8s.aliyun.com/eci-use-specs": "ecs.c6.xlarge"
          },
          "labels": {
            "created-by-eci": "true"
          }
        }
      },
      {
        "name": "selector-demo2",
        "objectSelector": {
          "matchLabels": {
            "eci": "test"
          }
        }
      }
    ]

kubectl get mutatingwebhookconfigurations -o yaml vk-webhook

data:
  selectors: |
    [
      {
        "name":"eci-selector",
        "namespaceSelector":{
          "matchLabels":{
            "type":"eci"
          }
        },
        "objectSelector":{
          "matchLabels":{
            "created-by-eci":"true"
          }
        }
      }
    ]

data:
  selectors: |
    [
      {
        "name":"gpu-namespace-selector",
        "namespaceSelector":{
          "matchLabels":{
            "gpu":"true"
          }
        },
        "effect": {
          "annotations": {
            "k8s.aliyun.com/eci-use-specs":"ecs.gn6v-c8g1.2xlarge"
          },
          "labels":{
            "gpu":"test"
          }
        }
      }
    ]

data:
  selectors: |
    [
      {
        "name":"autoimc-object-selector",
        "objectSelector":{
          "matchLabels":{
            "imc":"auto"
          }
        },
        "effect": {
          "annotations": {
            "k8s.aliyun.com/eci-auto-imc": "true"
          }
        }
      }
    ]

Update cluster-level parameters

The following parameters in the data section define cluster-level defaults for ECI pod creation. If a pod does not specify these values explicitly, the eci-profile values are used. All changes take effect immediately for new pods without restarting ack-virtual-node.

The following shows a complete data section example:

data:
  enableClusterIp: "true"
  enableHybridMode: "false"
  enableLinuxArm64Node: "false"
  enableLogController: "false"
  enablePVCController: "false"
  enablePrivateZone: "false"
  enableReuseSSLKey: "false"
  securityGroupId: sg-2zeeyaaxlkq9sppl****
  selectors: ""
  slsMachineGroup: ""
  vSwitchIds: vsw-2ze23nqzig8inprou****,vsw-2ze94pjtfuj9vaymf****
  vpcId: vpc-2zeghwzptn5zii0w7****

What's next

• To annotate ECI pods for advanced features such as instance type selection and image caching, see ECI Pod Annotation.

• To schedule pods to an ARM-based virtual node, see Schedule pods to an ARM-based virtual node.