This tutorial describes how to use an Auto Scaling lifecycle hook to suspend an ECS instance and a CloudOps Orchestration Service (OOS) template to automatically mount a NAS file system to a Linux ECS instance.
Prerequisites
A scaling group is created and is in the Enabled state.
-
A NAS file system is created and a mount target is added. For more information, see Manage mount targets. The mount target must meet the following conditions:
-
If the scaling group uses a virtual private cloud (VPC), the mount target must also use a VPC. The mount target and the scaling group must be in the same VPC.
-
If the scaling group uses the classic network, the mount target must also use the classic network.
-
The mount protocol is NFS.
-
A Resource Access Management (RAM) role is created for OOS. The trusted entity of the RAM role must be Alibaba Cloud Service, the trusted service must be CloudOps Orchestration Service, and the RAM role must have the permissions to perform operations on the OOS template. For more information, see Create a RAM role for OOS and grant permissions.
NoteIn this topic, the OOSServiceRole RAM role is used as an example. You can also use other roles.
Background information
A NAS file system is a file storage instance. After you mount the file system to an ECS instance, you can use the file storage just like a local file system. This improves data security and operational fault tolerance. You cannot associate a NAS file system when you create a scaling configuration. However, you can use a lifecycle hook and an OOS template to automatically mount a NAS file system to an ECS instance. This method is more efficient than creating an ECS instance and then manually mounting the file system.
Procedure
This tutorial uses the public OOS template ACS-ESS-LifeCycleAttachNASFileSystemToInstance as an example to show how to automatically mount a NAS file system to a Linux ECS instance during a scale-out event. The procedure is as follows:
Step 1: Grant OOS service permissions to the RAM role
You must have the required permissions to execute OOS templates. The operations and maintenance (O&M) operations defined in the ACS-ESS-LifeCycleAttachNASFileSystemToInstance template involve resources from Elastic Compute Service (ECS), Auto Scaling, and NAS.
Log on to the RAM console.
-
Create an access policy.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
-
On the Create Policy page, select Script Editor as the configuration mode, set the other parameters, and then click OK.
The following table describes the parameters used in this tutorial. Keep the default values for other parameters.
Configuration item
Description
Name
Enter ESSHookPolicyForAttachNAS.
Policy Document
Enter the following content:
{ "Version": "1", "Statement": [ { "Action": [ "ecs:DescribeInvocations", "ecs:RunCommand", "ecs:DescribeInvocationResults", "ecs:DescribeInstances" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ess:CompleteLifecycleAction" ], "Resource": "*", "Effect": "Allow" } ] }
-
Grant the access policy to OOSServiceRole.
In the left-side navigation pane, choose .
Find the OOSServiceRole RAM role and click Grant Permission in the Actions column.
Add the required permissions for the OOSServiceRole RAM role that is assumed by OOS to complete the authorization.
-
On the Grant Permission page, specify the resource scope and permission configuration, and then click Confirm Add Authorization.
The following table describes the parameters used in this tutorial. Keep the default values for other parameters.
Configuration item
Description
Resource Scope
Select the Account level.
Policies
Add the custom policy ESSHookPolicyForAttachNAS.
Step 2: Create a lifecycle hook for scale-out activities and trigger a scale-out
Log on to the Auto Scaling console.
In the navigation pane on the left, click Scaling Groups.
In the top navigation bar, select a region.
Find the scaling group that you want to manage and open its details page in one of the following ways:
In the Scaling Group Name/ID column, click the ID of the scaling group.
In the Actions column, click Details.
-
Create a lifecycle hook for scale-out activities.
At the top of the page, click the Event and adhesive hook tab.
-
Click Create Lifecycle Hook.
-
Specify the lifecycle hook configuration and click OK.
The following table describes the parameters used in this tutorial. Keep the default values for other parameters.
Configuration item
Description
Name
Enter ESSHookForAttachNAS.
Scaling Activity Type
Select Scale-Out.
Timeout Period
Enter an appropriate timeout period, such as 300 seconds.
NoteThe timeout period is the time allowed for custom operations. If the timeout period is too short, the custom operations may fail. Evaluate the time required for your custom operations and set an appropriate timeout period.
Default Execution Policy
Select Continue.
Send Notification When Lifecycle Hook Takes Effect
Send notifications or automatically perform more operations in a specified way. The template settings are as follows:
-
Notification method: Select OOS Template.
-
OOS Template Type: Select Public Templates.
-
Public Template: Select ACS-ESS-LifeCycleAttachNASFileSystemToInstance.
The execution parameters for ACS-ESS-LifeCycleAttachNASFileSystemToInstance are configured as follows:
-
Mount Target Domain Name: Enter the mount target domain name of the NAS file system.
-
Mount Directory: The directory on the ECS instance where the file system is mounted, which defaults to /mnt.
-
File System Version: 0 indicates that the NFS v4 protocol is used to mount the file system, and 1 indicates that the NFS v3 protocol is used. In this example, 0 is used.
-
Rate Control: Two types of rate control are available: Concurrency Control and Batch Control. This tutorial uses the default type, Concurrency Control, as an example.
-
RAM Role For OOS: Select Specify RAM Role and Use Permissions Granted to This Role, and then select OOSServiceRole. In the Procedure, the OOSServiceRole RAM role is granted permissions to manage ECS, Auto Scaling, and NAS file system resources. The OOS service assumes this role to obtain the required permissions.
-
-
Trigger a scale-out.
This tutorial uses manual execution of a scaling rule as an example. You can also trigger a scale-out using a scheduled task or an event-triggered task.
NoteIf scaling activities are triggered when you manually execute scaling rules, lifecycle hooks take effect. Lifecycle hooks do not take effect when you manually add or remove ECS instances to or from a scaling group.
-
At the top of the page, click the Scaling Rules and Event-triggered Tasks tab.
-
On the Scaling Rules tab, click Create Scaling Rule.
-
Set the properties of the scaling rule, and then click OK.
The following table describes the parameters used in this tutorial. Keep the default values for other parameters.
Configuration item
Description
Rule Name
Enter Add1.
Rule Type
Select Simple Scaling Rule.
Operation
Set to add 1 instance.
-
In the list of scaling rules, find the newly created scaling rule Add1, and in the Actions column, click Recurrently.
-
Click OK.
After the scaling rule is executed, one ECS instance is automatically created. Because the ESSHookForAttachNAS lifecycle hook is created in the scaling group, the ECS instance is suspended. The OOS service is automatically notified to perform the O&M operations defined in the ACS-ESS-LifeCycleAttachNASFileSystemToInstance template.
-
-
Check if the automatically created ECS instance works as expected.
At the top of the page, click the Instance Management tab.
-
Find the automatically created ECS instance, and in the ECS Instance ID/Name column, click the instance ID.
-
In the Basic Information area, click Remote Connection.
-
After you log on to the ECS instance, run a command to check the mount result.
df -h | grep aliyunThe result contains the mount path of the NAS file system. This indicates that the automatic mount is successful. You can also run
nfsstat -cto view the protocol version used.Client nfs v4indicates that the protocol version is v4.[root@iz xxx ~]# df -h | grep aliyun 0a7faxxx-tek1.cn-hangzhou.nas.aliyuncs.com:/ 10P 0 10P 0% /mnt [root@iz xxx ~]# nfsstat -c Client rpc stats: calls retrans authrefrsh 36 0 36 Client nfs v4: null read write commit open open_conf 1 2% 0 0% 0 0% 0 0% 0 0% 0 0% open_noat open_dgrd close setattr fsinfo renew 0 0% 0 0% 0 0% 0 0% 2 5% 18 50% setclntid confirm lock lockt locku access 2 5% 2 5% 0 0% 0 0% 0 0% 0 0% getattr lookup lookup_root remove rename link 3 8% 0 0% 1 2% 0 0% 0 0% 0 0% symlink create pathconf statfs readlink readdir 0 0% 0 0% 1 2% 3 8% 0 0% 0 0% server_caps delegreturn getacl setacl fs_locations rel_lkowner 3 8% 0 0% 0 0% 0 0% 0 0% 0 0% secinfo exchange_id create_ses destroy_ses sequence get_lease_t 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% reclaim_comp layoutget getdevinfo layoutcommit layoutreturn getdevlist 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% (null) 0 0%If an ECS instance is created but the NAS file system is not mounted, you can go to the OOS console to view the task execution status. For more information, see (Optional) Step 3: View the OOS execution status.
(Optional) Step 3: View the OOS execution status
Log on to the OOS console.
In the left-side navigation pane, choose .
Find the execution task by time and click Details in the Actions column.
-
On the execution details page, view the execution information.
For example, you can view information such as the execution ID and execution status in the Basic Information section, or click a task node in the Execution Result section to view the execution details. For more information, see View task execution details.
NoteIf the execution fails, the related error message is also displayed on the execution details page.
FAQ
If you fail to execute an O&M task, troubleshoot the issue based on the error message in the execution result. For more information, see FAQ.
The following table describes the common error message.
Error message | Cause | Solution |
Forbidden.Unauthorized message: A required authorization for the specified action is not supplied. | You have not authorized Auto Scaling to perform the current action. | Check whether the OOSServiceRole RAM role has the required permissions. |
Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM. | The RAM user or RAM role does not have the permissions to operate the corresponding resources. | Check whether the OOSServiceRole RAM role has the required permissions. For example, you can grant the OOS permissions to the RAM role. Before OOS can manage the resources that are declared in the OOS template, you must grant the required permissions to the RAM role. |
LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action. | The ongoing lifecycle hook action has ended or been stopped. | Assess the timeout period of the lifecycle hook to make sure that the O&M tasks specified in the OOS template can be complete within the allotted time limit. |