Alibaba Cloud Service Mesh:Deploy an ASM ingress gateway on serverless infrastructure

Step 1: Label the target node

Add a label to the ECS node where gateway pods should run by default.

1. Get the node names in your cluster:

      kubectl get nodes

2. Add a label to the target node: Replace <node-name> with the actual node name from step 1.

      # Syntax
      kubectl label nodes <node-name> <label-key>=<label-value>
   
      # Example
      kubectl label nodes node1 mykey4pod=asmgateway

Step 2: Taint the node

Add a custom taint so that only pods with a matching toleration run on this node:

kubectl taint nodes node1 mykey=myvalue:NoSchedule

This taint uses key mykey, value myvalue, and effect NoSchedule. Only pods that explicitly tolerate this taint can be scheduled on node1.

Step 3: Add node affinity and tolerations to the gateway

Update the gateway YAML to direct pods to the labeled ECS node by default, with automatic overflow to ECI when the node is at capacity.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

3. Find the target gateway and click YAML.

4. In the Edit dialog box, add the following content to the spec field and click OK. The following table explains the scheduling behavior:

   Important

   Make sure the label key-value pair in matchExpressions matches the label you added in Step 1, and the toleration key-value pair matches the taint you added in Step 2. Mismatched values cause pods to remain in a Pending state.

   Field	What it does
   preferredDuringSchedulingIgnoredDuringExecution	Sets soft scheduling preferences with relative weights. The ECS node (weight 80) is strongly preferred over ECI (weight 20). When the ECS node has capacity, pods run there. When it is full, pods overflow to ECI via virtual nodes.
   requiredDuringSchedulingIgnoredDuringExecution	Defines hard constraints. Pods can only be scheduled on nodes matching either the custom label (mykey4pod=asmgateway) or the virtual node label (type=virtual-kubelet). This prevents pods from landing on unrelated nodes.
   tolerations[0]	Allows pods to run on virtual nodes by tolerating the default virtual-kubelet.io/provider=alibabacloud:NoSchedule taint. Without this toleration, pods cannot use ECI.
   tolerations[1]	Matches the custom taint (mykey=myvalue:NoSchedule) added in Step 2, allowing pods to run on the labeled ECS node.

      affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - preference:
                  matchExpressions:
                    - key: type
                      operator: In
                      values:
                        - virtual-kubelet
                weight: 20
              - preference:
                  matchExpressions:
                    - key: mykey4pod
                      operator: In
                      values:
                        - asmgateway
                weight: 80
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: mykey4pod
                      operator: In
                      values:
                        - asmgateway
                - matchExpressions:
                    - key: type
                      operator: In
                      values:
                        - virtual-kubelet
        tolerations:
          - effect: NoSchedule
            key: virtual-kubelet.io/provider
            operator: Equal
            value: alibabacloud
          - effect: NoSchedule
            key: mykey
            operator: Equal
            value: myvalue

Step 4: Verify the deployment

Confirm that gateway pods are running on the expected nodes.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left-side navigation pane, choose Workloads > Pods.

3. On the Pods page, select istio-system from the Namespace drop-down list.

4. Check the Node column for the gateway pods:

   • Under normal load, pods should appear on your labeled ECS node (node1).

   • When ECS capacity is exhausted, pods should appear on a virtual node.