Container Service for Kubernetes:Configure a static IP address, a separate vSwitch, and a separate security group for each pod

Step 2: Create a PodNetworking

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you want to manage and choose Workloads > Custom Resources in the left-side navigation pane.

3. On the Custom Resources page, click Create from YAML to create at least one PodNetworking to describe network configurations. The following code block shows a sample PodNetworking:

   Terway allows you to use custom resource definitions (CRDs) named PodNetworking to describe network configurations. You can create multiple PodNetworkings to design different network planes.

   apiVersion: network.alibabacloud.com/v1beta1
   kind: PodNetworking
   metadata:
     name: example
   spec:
     allocationType:
       type: Fixed # The policy that describes how IP addresses are allocated to pods. Valid values: Elastic and Fixed. 
       releaseStrategy: TTL # This parameter takes effect only if the PodNetworking uses the Fixed policy. If the PodNetworking uses the Elastic policy, you do not need to configure the releaseStrategy and releaseAfter parameters. 
       releaseAfter: "1h" # This parameter takes effect only if releaseStrategy is set to TTL. 
     selector:
       podSelector:
         matchLabels:
           foo: bar
       namespaceSelector:
         matchLabels:
           foo: bar
     securityGroupIDs:
     - sg-bpxxxx
     vSwitchOptions:
     - vsw-bpxxxx
   status:
     status: Ready
                   

   The following table describes the parameters in the preceding command.

   Parameter		Description
   allocationType (The policy that describes how IP addresses are allocated to pods)	type	Valid values: Elastic: Allocate elastic IP addresses (EIPs) to pods. The IP addresses are released after the pods are deleted. Fixed: Allocate static IP addresses to pods. A PodNetworking that uses the Fixed policy takes effect only on pods that are created by StatefulSets. For more information, see StatefulSets. If you use the Fixed policy, constraints are added to ensure that the zone where a pod is recreated is the same as the original zone.
   	releaseStrategy	The policy that describes how IP addresses are released. This parameter takes effect only if type is set to Fixed. Valid values: TTL: IP addresses are released with a delay. After a pod is deleted, the IP address of the pod is not released until the specified period of time ends. The minimum value is 5 minutes. Never: IP addresses are not released. If IP addresses are no longer used, you must manually delete PodENIs.
   	releaseAfter	The delay for releasing pod IP addresses. This parameter takes effect only if releaseStrategy is set to TTL. The value must be of the Go time type. Example: 2h45m or 5m0s. For more information, see Go time type.
   selector (Label selectors that are used to select pods to use the current PodNetworking)	podSelector	A selector that is used to match pod labels. Pods that match this selector use the current PodNetworking. If both podSelector and namespaceSelector are configured, only pods that match both selectors use the current PodNetworking. Make sure that the labels of a pod match the selectors of only one PodNetworking ConfigMap. If a pod matches multiple PodNetworking ConfigMaps, the pod uses the network configurations in an arbitrary PodNetworking ConfigMap.
   	namespaceSelector	A selector that is used to match namespace labels. Pods that match this selector use the current PodNetworking. If both podSelector and namespaceSelector are configured, only pods that match both selectors use the current PodNetworking. Make sure that the labels of a pod match the selectors of only one PodNetworking ConfigMap. If a pod matches multiple PodNetworking ConfigMaps, the pod uses the network configurations in an arbitrary PodNetworking ConfigMap.
   vSwitchOptions	-	Specifies the vSwitches used by pods. The logical relationship among multiple vSwitches is OR. Each pod can use only one vSwitch. Terway automatically selects a proper vSwitch for each pod. Constraints are added to ensure that the zones to which your pods can be scheduled are the same as the zones of the vSwitches that you specified in the vSwitchOptions parameter. Make sure that the zones of the vSwitches in vSwitchOptions are the same as those of the nodes to which pods are scheduled. In addition, make sure that these vSwitches can provide sufficient idle IP addresses. Otherwise, ACK fails to create pods.
   securityGroupIDs	-	Specifies the IDs of security groups. Multiple security groups take effect at the same time. You can specify at most five security groups.

4. Click Create.

   After the PodNetworking is created, Terway automatically synchronizes the network configurations. The PodNetworking takes effect on pods only after the status of the PodNetworking changes to Ready.

   You can run the following command to check whether the resource status is ready:

   kubectl describe PodNetworking example # Replace example with an actual custom resource name.

Step 3: Create a pod

When ACK creates a pod, the labels of the pod are matched against PodNetworkings. If a pod does not match a PodNetworking, the pod is assigned an IP address from a shared ENI by default. If a pod matches a PodNetworking, an IP address is assigned to the pod based on the configurations specified in the PodNetworking. For more information, see Labels and Selectors.

Terway automatically creates CRDs named PodENI for pods that match PodNetworkings. PodENIs are used to track the resource usage of pods. PodENIs are managed by Terway and cannot be modified.