Automatically attach or detach secondary ENIs that have EIPs to or from ECS instances during scaling events - Auto Scaling

If you need to build a high availability cluster, implement low-cost failover, and achieve fine-grained network management while providing public network access, you can automatically attach secondary elastic network interfaces (ENIs) with elastic IP addresses (EIPs) to new Elastic Compute Service (ECS) instances during scale-out events. If the ECS instances in a scaling group already have secondary ENIs with EIPs attached, but you need to release ECS resources in a timely manner (for example, when your business enters an off-peak period) or no longer require public network access, you can automatically release the secondary ENIs and EIPs that are no longer needed during scale-in events to optimize resource usage and reduce costs.

An ENI is a virtual network card that can be attached to an ECS instance in a virtual private cloud (VPC). ENIs are classified as primary ENIs and secondary ENIs. For more information, see Overview.
An EIP is a public IP address resource that can be independently purchased and owned, and is used to retain a public IP address over the long term. You can associate EIPs with resources such as ECS instances and ENIs, or disassociate EIPs from these resources based on your business requirements. For more information, see Associate an EIP with a cloud resource.

Prerequisites

Create a scaling group and ensure it is in the Enable state. For more information, see Create a scaling group.
Grant CloudOps Orchestration Service (OOS) permissions to access other cloud services. For more information, see Set a RAM role and grant permissions to OOS.
1. Create a RAM role.
  
  Set the trusted service for the RAM role to OOS. This topic uses OOSServiceRole as the RAM role name.
2. Attach policies to the RAM role.
  
  When OOS runs a task, it requires access to ECS, Auto Scaling, and EIP resources. Therefore, attach the following system policies to the OOSServiceRole role:
  - AliyunECSFullAccess
  - AliyunESSFullAccess
  - AliyunEIPFullAccess

Automatically attach secondary ENIs with EIPs to ECS instances during scale-out events

Create a lifecycle hook.

The following table describes the main configuration items. Keep the default values for the configuration items that are not described. For more information, see Configure a lifecycle hook.

Configuration item	Description
Name	Enter `ESSHookForAttachNicWithEip`.
Applicable scaling activity type	Select Scale-out Event.
Timeout Period	Enter an appropriate timeout period, for example, 300 seconds. Important This parameter specifies the time allowed for performing custom operations. If the timeout period is too short, the custom operations may fail. Evaluate the time required by the custom operations and set an appropriate timeout period.
Action to perform during the hook period	Select OOS Template as the action. Perform the following steps: Select Public Templates for the OOS template type. Select the OOS public template `ACS-ESS-LifeCycleCreateNetworkInterfaceAndEipAndAttachToInstance` to automatically attach a secondary ENI with an EIP to an ECS instance during scale-out events. Click Parameter Settings after the `ACS-ESS-LifeCycleCreateNetworkInterfaceAndEipAndAttachToInstance` template. The following parameters are used as examples. Keep the default values for the parameters that are not described. EIP metering method: `PayByBandwidth` indicates pay-by-bandwidth and `PayByTraffic` indicates pay-by-data-transfer. This tutorial uses `PayByBandwidth` as an example. Maximum EIP bandwidth: This tutorial uses `5` as an example, which indicates that the maximum bandwidth of the EIP is 5 Mbit/s. RAM role assumed by OOS: Select `OOSServiceRole`.

Auto Scaling triggers a scale-out event.
This step uses manually executing a scaling rule to add one ECS instance as an example. You can also trigger a scale-out event by using a scheduled task or an event-triggered task. For more information, see Configure scaling rules.
When you manually execute a scaling rule to trigger a scale-out event, the lifecycle hook takes effect. However, when you manually add an existing ECS instance, the lifecycle hook does not take effect.
After the scale-out event is successfully triggered, the scaling group automatically scales out one ECS instance. Because the lifecycle hook ESSHookForAttachNicWithEip is created in the scaling group, the ECS instance is suspended, and OOS is automatically notified to perform the O&M operation, that is, to create a secondary ENI, automatically allocate an EIP to the ENI, and attach the ENI to the ECS instance.
If the scaling activity is in the Failed state and the following error is reported, go to the OOS console to view the execution status of the O&M task. For more information, see (Optional) View the OOS execution status. The scaling activity details page shows that the activity status is Failed, the total number of instances after the change is -, and the activity is triggered because the lifecycle hook returns the Abandon result and the instance is rolled back.
Check whether a secondary ENI with an EIP is automatically attached to the scaled-out ECS instance.
1. On the Auto Created tab of the Instances section of the scaling group, click the instance ID in the ECS Instance ID/Name column of the automatically created ECS instance.
2. On the ECS instance details page, click the ENIs tab to view the ENIs that are attached to the ECS instance.
  Confirm that one secondary ENI is automatically attached to the ECS instance and that an EIP is allocated to the secondary ENI. In the ENI list, confirm that the allocated EIP address is displayed in the Public IP Address column of the secondary ENI, which indicates that the EIP is successfully attached to the secondary ENI.
  If the ECS instance is successfully created but no secondary ENI or EIP is automatically attached to it, go to the OOS console to view the execution status of the O&M task.
(Optional) View the OOS execution status.
View the execution information on the task execution details page. You can view the execution ID and the execution status in the Basic Information section, and view the execution details and the corresponding logs in the Execution Steps and Results section. For more information, see Execution details.
Important
If the execution fails, the related error information is also displayed on the execution details page.
(Optional) Configure the secondary ENI.
After a secondary ENI is attached to an ECS instance, some images may fail to automatically recognize the IP address of the secondary ENI and add routes, which causes the secondary ENI to be unavailable. For more information, see Configure a secondary ENI.

Automatically release secondary ENIs with EIPs from ECS instances during scale-in events

Create a lifecycle hook.

The following table describes the main configuration items. Keep the default values for the configuration items that are not described. For more information, see Configure a lifecycle hook.

Configuration item	Description
Name	Enter `ESSHookForDeleteNicAndEip`.
Applicable scaling activity type	Select scale-in event.
Timeout Period	Enter an appropriate timeout period, for example, 300 seconds. Important The timeout period specifies the time allowed for performing custom operations. If the timeout period is too short, the custom operations may fail. Evaluate the time required by the custom operations and set an appropriate timeout period.
Action to perform during the hook period	Select OOS Template as the action. Perform the following steps: Select Public Templates for the OOS template type. Select the OOS public template `ACS-ESS-LifeCycleDetachNetworkInterfaceAndDeleteEip` to automatically release the secondary ENI with an EIP from an ECS instance during scale-out events. Click Parameter Settings after the `ACS-ESS-LifeCycleDetachNetworkInterfaceAndDeleteEip` template. Set RAM role assumed by OOS to `OOSServiceRole` and keep the default values for the other parameters.

Auto Scaling triggers a scale-in event.
This step uses manually executing a scaling rule to remove one ECS instance as an example. You can also trigger a scale-out event by using a scheduled task or an event-triggered task. For more information, see Configure scaling rules.
When you manually execute a scaling rule to trigger a scale-in event, the lifecycle hook takes effect. However, when you manually remove an existing ECS instance, the lifecycle hook does not take effect.
After the scale-in event is successfully triggered, the scaling group automatically removes one ECS instance. Because the lifecycle hook ESSHookForDeleteNicAndEip is created in the scaling group, the ECS instance is suspended, and OOS is automatically notified to perform the O&M operation, that is, to release the secondary ENI and the EIP from the ECS instance.
Check whether the secondary ENI and the EIP are automatically released from the scaled-in ECS instance.
You can go to the Elastic Network Interfaces page and the Elastic IP Addresses page to view the corresponding secondary ENI and EIP. If they no longer exist, the secondary ENI and the EIP are released.
If the ECS instance is successfully deleted but the secondary ENI and the EIP are not released at the same time, go to the OOS console to view the execution status of the O&M task.
(Optional) View the OOS execution status.
View the execution information on the task execution details page. You can view the execution ID and the execution status in the Basic Information section, and view the execution details and the corresponding logs in the Execution Steps and Results section. For more information, see Execution details.
Important
If the execution fails, the related error information is also displayed on the execution details page.

FAQ

If you fail to execute an O&M task, troubleshoot the issue based on the error message in the execution result. For more information, see FAQ.

The following table describes the common error message.

Error message	Cause	Solution
Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.	You have not authorized Auto Scaling to perform the current action.	Check whether the OOSServiceRole RAM role has the required permissions.
Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.	The RAM user or RAM role does not have the permissions to operate the corresponding resources.	Check whether the OOSServiceRole RAM role has the required permissions. For example, you can grant the OOS permissions to the RAM role. Before OOS can manage the resources that are declared in the OOS template, you must grant the required permissions to the RAM role.
LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.	The ongoing lifecycle hook action has ended or been stopped.	Assess the timeout period of the lifecycle hook to make sure that the O&M tasks specified in the OOS template can be complete within the allotted time limit.

References

The billing items of an EIP include the public network fee, the EIP configuration fee (public IP retention fee), and the EIP binding fee. For more information, see EIP billing overview.
You can automatically attach EIPs to new ECS instances during scale-out events to keep your services accessible, and automatically release the EIPs that are no longer required during scale-in events to optimize resource usage and reduce costs. For more information, see Automatically attach and release EIPs.