How to use an ASM serverless gateway to support elastic business scenarios - Alibaba Cloud Service Mesh

An ASM serverless gateway provides elastic, node-free operations by using virtual nodes and Elastic Container Instance (ECI). This topic describes how to use an ASM serverless gateway to support elastic workloads.

Prerequisites

An ACK cluster (including Basic, Pro, and Dedicated editions) has been added to your ASM instance. For more information, see Add a cluster to an ASM instance.
Note
When you create an ASM gateway on the ASM console for a Serverless Kubernetes (ASK) cluster, the gateway pods already run on ECI. You do not need to perform the steps in this topic. For more information about how to create a gateway, see Create an ingress gateway service.
The ack-virtual-node component has been deployed. For more information, see Deploy the virtual node controller and use it to create Elastic Container Instance-based pods.
An ingress gateway service has been deployed.

Key concepts

Concept	Description
Elastic Container Instance (ECI)	Alibaba Cloud Elastic Container Instance (ECI) is a serverless compute service that lets you run containers without managing servers. It provides a secure, isolated container runtime with fast startup times. With ECI, you can focus on your applications instead of the underlying infrastructure. You are billed per second for the resources your containers consume. For more information, see What is Elastic Container Instance? and Billing overview.
virtual node	Virtual nodes are ideal for workloads with fluctuating traffic patterns, helping reduce compute costs and improve resource elasticity.
taint	A taint on a node repels a set of pods. By default, virtual nodes in an ACK cluster have the`virtual-kubelet.io/provider=alibabacloud:NoSchedule` taint. This prevents pods from being unintentionally scheduled onto ECI resources.
toleration	A toleration allows a pod to be scheduled onto a node with a matching taint. To allow a pod in your ACK cluster to use ECI resources, you must configure the following`tolerations` to tolerate the`virtual-kubelet.io/provider=alibabacloud:NoSchedule` taint. For more information, see Deploy the virtual node controller and use it to create Elastic Container Instance-based pods. `tolerations: - key: virtual-kubelet.io/provider operator: Equal value: alibabacloud effect: NoSchedule` Note Taints and tolerations work together to ensure that pods are not scheduled onto inappropriate nodes. You can apply one or more taints to a node. If a pod does not tolerate a specific taint, it will not be scheduled on a node with that taint. If a pod tolerates a specific taint, it can be scheduled on a node with that taint, but it is not required to be. For more information, see the official Kubernetes documentation on Taints and Tolerations.
node affinity (nodeAffinity)	Node affinity specifies rules that influence where pods can be scheduled. These can be 'soft' preferences, which the scheduler tries to satisfy, or 'hard' requirements, which must be met for the pod to be scheduled on a node.

Step 1: Add a label to a node

Run the following command to query the node names in the cluster:

kubectl get nodes

Run the following command to add a label to the target node:

# Command format
kubectl label nodes <node-name> <label-key>=<label-value>

# Example
kubectl label nodes node1 mykey4pod=asmgateway

Step 2: Add a taint to a node

Run the following command to add a taint to a node:

kubectl taint nodes node1 mykey=myvalue:NoSchedule

This command adds a taint to the node named node1. The taint has the key mykey, the value myvalue, and the effect NoSchedule. Only pods that have a matching toleration can be scheduled to the node1 node.

Step 3: Configure node affinity and tolerations

Configure thenodeAffinity andtolerations parameters for your ASM gateway. The nodeAffinity rules ensure that the gateway pods are scheduled to specific nodes, while the tolerations allow the pods to be scheduled on nodes with the taint you created in Step 2.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the Ingress Gateway page, find the target gateway and click View YAML in the Actions column.

In the Edit dialog box, add the following content under thespec field, and then click OK.

   affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - preference:
            matchExpressions:
              - key: type
                operator: In
                values:
                  - virtual-kubelet
          weight: 20
        - preference:
            matchExpressions:
              - key: mykey4pod
                operator: In
                values:
                  - asmgateway
          weight: 80
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: mykey4pod
                operator: In
                values:
                  - asmgateway
          - matchExpressions:
              - key: type
                operator: In
                values:
                  - virtual-kubelet
  tolerations:
    - effect: NoSchedule
      key: virtual-kubelet.io/provider
      operator: Equal
      value: alibabacloud
    - effect: NoSchedule
      key: mykey
      operator: Equal
      value: myvalue

The following table describes the key parameters. For more information, see the official Kubernetes documentation on Assigning Pods to Nodes.

Parameter	Description
`preferredDuringSchedulingIgnoredDuringExecution`	The scheduler tries to find nodes that meet the rules. If no matching nodes are found, the scheduler still schedules the pod. This parameter is associated with two `matchExpressions`. The value of `weight` is relative. The scheduler prefers the rule with a larger value. A `weight` of `80` means the pod is preferred to run on ECS nodes with the specified label. A `weight` of `20` means the pod is preferred to run on ECI resources.
`requiredDuringSchedulingIgnoredDuringExecution`	The scheduler only schedules pods on nodes that meet this rule. This parameter is associated with two`matchExpressions` entries. One directs pods to the ECS node with the specified label, and the other directs pods to use ECI resources.
`tolerations`	This parameter allows the pod to tolerate the`virtual-kubelet.io/provider=alibabacloud:NoSchedule` taint, enabling it to be scheduled onto ECI resources.

Verify that the gateway pods are scheduled as expected.
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
3. At the top of the Pods page, select the istio-system namespace and check if the gateway pods are running on the expected nodes.
  If the pods are running on the target nodes, the node affinity and tolerations have been successfully configured for the ASM gateway.