Elastic Container Instance:Add a VNode (manual)

Prerequisites

• You have a Kubernetes cluster, version 1.16 to 1.30.

• If your Kubernetes cluster is deployed in an on-premises data center, make sure that the data center network is connected to the Alibaba Cloud network through Express Connect, Smart Access Gateway (SAG), or VPN Gateway. For more information, see the following topics:

  • Express Connect

  • Smart Access Gateway (SAG)

  • VPN Gateway

Before you begin

Before you create a VNode, gather the required parameters and review the required permissions. The following table describes the parameters you will need.

When you create a VNode, you must configure the required permissions. These include the standard permissions used by native Kubernetes nodes and additional permissions that are specific to VNodes, as described in the following table.

Configure the cluster

A VNode uses a kubeconfig file to connect to the cluster. Therefore, you must issue a certificate (kubeconfig) for the VNode before you create it.

1. Connect to the cluster.

2. Download and run the configuration script. Select TLS bootstrapping or ServiceAccount to generate a kubeconfig file.

   TLS Bootstrap

   For enhanced security, we recommend TLS bootstrapping. This method automatically deploys the vnode-approver component. This component signs CSRs submitted by VNodes and is open source on GitHub. For more information, see vnode-approver.

   curl -fsSL https://eci-docs.oss-cn-beijing.aliyuncs.com/vnode/vnode-deploy.sh | bash -s -- bootstrap

   ServiceAccount

   This method does not support certificate rotation. Ensure the token has a long or non-expiring validity period. This prevents the VNode from becoming unavailable due to an expired certificate.

   curl -fsSL https://eci-docs.oss-cn-beijing.aliyuncs.com/vnode/vnode-deploy.sh | bash -s -- common

3. Check the kubeconfig file.

   The generated kubeconfig file is named vnode-config. Run the following command to view the file:

   cat vnode-config

   When you check the file, verify the following:

   • Make sure that the VPC where the VNode will be created can reach the server address (for example, they are in the same VPC or connected through networking).

     • If the server address is an IP address, it must be accessible from the VNode's VPC.

     • If the server address is a domain name, it must be resolvable within the Alibaba Cloud VPC, and the resulting IP address must be accessible from the VNode's VPC.

   • If the certificate-authority-data parameter is empty, check whether the corresponding field in the ~/.kube/config file uses a file path.

   TLS Bootstrap

   apiVersion: v1
   kind: Config
   current-context: kubernetes-admin@kubernetes
   contexts:
   - name: kubernetes-admin@kubernetes
     context:
       cluster: kubernetes-admin@kubernetes
       user: vnode
       namespace: kube-system
   clusters:
   - name: kubernetes-admin@kubernetes
     cluster:
       certificate-authority-data: "*****************************************=="
       server: https://10.16.XX.XX:6443
   users:
   - name: vnode
     user:
       token: ******.****************

   ServiceAccount

   apiVersion: v1
   kind: Config
   current-context: kubernetes-admin@kubernetes
   contexts:
   - name: kubernetes-admin@kubernetes
     context:
       cluster: kubernetes-admin@kubernetes
       user: vnode
       namespace: kube-system
   clusters:
   - name: kubernetes-admin@kubernetes
     cluster:
       certificate-authority-data: "*****************************************=="
       server: https://10.16.XX.XX:6443
   users:
   - name: vnode
     user:
       token: ***********************************************

Create a VNode

Prevent DaemonSet scheduling to a VNode

A VNode is a virtual node and cannot run DaemonSets. After creating a VNode, you must add a nodeAffinity to the kube-proxy DaemonSet to prevent DaemonSets from being scheduled to the VNode.

1. Edit the DaemonSet configuration.

   kubectl -n kube-system edit ds kube-proxy

2. Configure nodeAffinity.

   Add the following YAML to spec.template.spec:

   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
         - matchExpressions:
           - key: type
             operator: NotIn
             values:
             - virtual-kubelet

Schedule pods to a VNode

After you create a VNode, you can use the following methods to schedule pods to run as ECI instances on the VNode.

• Manual scheduling

  You can manually schedule pods to a VNode by configuring nodeSelector and tolerations, or by specifying a nodeName. For more information, see Schedule pods to a VNode.

• Automatic scheduling

  After you deploy the eci-profile component, you can configure a custom selector to automatically schedule matching pods to the VNode. For more information, see Use eci-profile to schedule pods to a VNode.