Configure node affinity and tolerations to schedule ASM gateway pods to specified nodes - Alibaba Cloud Service Mesh - Alibaba Cloud - Alibaba Cloud Service Mesh

Schedule ASM (Alibaba Cloud Service Mesh) gateway pods to specific nodes in your Kubernetes cluster to improve gateway high availability and isolate gateway pods from application pods. For example, distribute gateway pods across nodes in different failure domains for redundancy, or dedicate specific nodes to gateway workloads.

Prerequisites

Key concepts

The following table describes the Kubernetes scheduling concepts used in this topic:

Concept	Description
node label	A key-value pair attached to a node. Node labels are used to tag nodes for pod scheduling. Node affinity rules reference these labels through `matchExpressions` to determine which nodes a pod can be scheduled to.
taint	A key-value-effect attribute applied to a node that causes the node to repel pods that do not have a matching toleration. For example, a taint with key `mykey`, value `myvalue`, and effect `NoSchedule` prevents pods without a matching toleration from being scheduled to that node.
toleration	A key-value-effect attribute applied to a pod that allows the pod to be scheduled to a node with a matching taint. Taints and tolerations work together to control which pods can run on which nodes. Each node can have one or more taints applied.
node affinity	A set of scheduling rules that determine which nodes a pod can be scheduled to based on node labels. Node affinity supports two types of rules. A required rule (`requiredDuringSchedulingIgnoredDuringExecution`) is a hard constraint that must be met for the pod to be scheduled. A preferred rule (`preferredDuringSchedulingIgnoredDuringExecution`) is a soft preference that the scheduler tries to satisfy but does not require. If a preferred constraint cannot be met, the pod is still scheduled to another available node.

Step 1: Add a label to a node

Run the following command to query the node names in the cluster:

kubectl get nodes

Run the following command to add a label to the target node:

# Command format
kubectl label nodes <node-name> <label-key>=<label-value>

# Example
kubectl label nodes node1 mykey4pod=asmgateway

Step 2: Add a taint to a node

Run the following command to add a taint to a node:

kubectl taint nodes node1 mykey=myvalue:NoSchedule

This command adds a taint to the node named node1. The taint has the key mykey, the value myvalue, and the effect NoSchedule. Only pods that have a matching toleration can be scheduled to the node1 node.

Step 3: Configure node affinity and tolerations for the ASM gateway

Configure the nodeAffinity parameter to distribute the ASM gateway pods to the specified nodes. Configure the tolerations parameter to match the taint that you created in Step 2 so that the gateway pods can be scheduled to the specified nodes.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the right side of the Ingress Gateway page, click View YAML for the target gateway.

In the Edit dialog box, add the following content under the spec field, and then click OK.

  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: mykey4pod
            operator: In
            values:
            - asmgateway
  tolerations:
  - key: "mykey"
    operator: "Equal"
    value: "myvalue"
    effect: "NoSchedule"

Check whether the gateway pods run on the expected nodes.
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
3. At the top of the Pods page, select the istio-system namespace and check whether the gateway pods run on the expected nodes.
If the gateway pods run on the target nodes, you have configured node affinity and tolerations for the ASM gateway.