Elastic Container Instance:FAQ

Accessing on-premises pod IPs from the cloud

If you use Express Connect (a dedicated line) to connect your on-premises and cloud networks, your on-premises data center (IDC) and cloud services can exchange routes using Border Gateway Protocol (BGP). Your on-premises IDC can advertise pod IP routes to cloud services through BGP, allowing cloud services to access the pod IPs in your on-premises IDC. For more information, see Configure BGP.

On-premises access to cloud pod IPs

If you use Express Connect (a dedicated line) to connect your on-premises and cloud networks and have configured BGP, your on-premises data center and cloud services can exchange routes. You can deploy the Cloud Controller Manager (CCM) to automatically synchronize cloud pod IP routes. For more information about CCM, see Cloud Controller Manager.

After you deploy CCM in your self-managed Kubernetes cluster, you can synchronize the Kubernetes pod IP routes to the VPC route table. When you deploy CCM, note the following:

• You must change the providerID of each Kubernetes cluster node to the <region-id>.<ecs-id> format, such as cn-shanghai.i-ankb8zjh2nzchf*******.

• Ensure that the IP address of each pod is within the podCIDR range of its node. For example, Calico IPAM must be configured as host-local to ensure the pod IP matches the node's pod CIDR.

  You can view the pod CIDR range in the node's spec:

  spec:
    podCIDR: 172.23.XX.0/26
    podCIDRs:
    - 172.23.XX.0/26
    providerID: cn-shanghai.i-ankb8zjh2nzchfxxxxxxx

Internal domain names cannot be resolved

On-premises access to cloud services

Image pull failure from self-managed repository

Failed to pull image "harbor.xxx.com/default/nginx:latest": rpc error: code = Unknown
desc = failed to pull and unpack image "harbor.xxx.com/default/nginx:latest": failed
to resolve reference "harbor.xxx.com/default/nginx:latest": failed to do request: Head
"https://harbor.xxx.com/default/nginx/manifests/latest": x509: certificate is valid
for ingress.local, not harbor-beta.cm.service.163.org

"k8s.aliyun.com/insecure-registry": "<host-name>"

How do I schedule Pods to a VNode?

You can schedule Pods to a VNode, which runs them on ECI, using one of the following common methods:

• Manual scheduling

  You can manually schedule pods to a VNode by configuring nodeSelector and tolerations, or by specifying a nodeName. For more information, see Schedule pods to a VNode.

• Automatic scheduling

  After you deploy the eci-profile component, you can configure a custom selector to automatically schedule matching pods to the VNode. For more information, see Use eci-profile to schedule pods to a VNode.

DaemonSet Pods pending on a VNode

VNodes are virtual nodes and do not support DaemonSets. Therefore, when you create a DaemonSet, you must configure a node anti-affinity policy to prevent its Pods from being scheduled to VNodes. The following is a sample configuration:

spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: type
            operator: NotIn
            values:
            - virtual-kubelet

Pod label scheduling failure on VNode

When you schedule a Pod to a VNode using a pod label, ensure that your Kubernetes version is 1.16 or later.

// MutatingAdmissionWebhook does not support ObjectSelector if the Kubernetes version is less than 1.16.

NAS directory mount times out

Collecting logs for Log Service (SLS)

You can install the Logtail component on your self-managed Kubernetes cluster to collect logs and send them to SLS. The installation process automatically performs the following actions:

1. Creates the alibaba-log-configuration ConfigMap, which contains configuration information for Log Service, such as the Project name.

2. (Optional) Creates the AliyunLogConfig Custom Resource Definition (CRD).

3. (Optional) Deploys the alibaba-log-controller Deployment, which watches for changes to the AliyunLogConfig CRD and creates Logtail collection configurations.

4. Deploys the logtail-ds DaemonSet, which collects logs from the nodes.

For more information, see Install the Logtail component.

metrics-server returns a 404 error

VNode currently supports metrics-server 0.5.x and earlier. If you encounter a 404 error, try downgrading the metrics-server version.

Typically, the startup arguments for metrics-server are as follows:

        - --cert-dir=/tmp
        - --secure-port=4443
        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
        - --kubelet-use-node-status-port
        - --kubelet-insecure-tls