Elastic Container Instance:Use VNodectl to connect a VNode to a self-managed Kubernetes cluster

Prerequisites

• A Kubernetes cluster whose version is from 1.13 to 1.22 is deployed.

• If your Kubernetes cluster is deployed in a data center, make sure that the data center and the virtual private cloud (VPC) are connected with each other by using Express Connect, Smart Access Gateway, or VPN Gateway. For more information, see the following topics:

  • What is Express Connect?

  • What is SAG?

  • What is VPN Gateway?

Make preparations

Before you connect a VNode to a self-managed Kubernetes cluster, prepare the parameter information that is required for creating a VNode and understand the permissions that are required to connect the VNode to the cluster. The following table describes the parameter information that is required for creating a VNode.

To create a VNode, you must configure standard permissions for native Kubernetes nodes and additional permissions for the VNode, as shown in the following table.

Install VNodectl

Before you use VNodectl to connect a VNode to a self-managed Kubernetes cluster, you must install VNodectl. Obtain the installation package based on your cluster environment and install VNodectl.

We recommend that you install VNodectl on the master node of your Kubernetes cluster. To install VNodectl, perform the following operations:

1. Connect to your Kubernetes cluster.

2. Download the installation package of VNodectl.

   wget https://eci-docs.oss-cn-beijing.aliyuncs.com/vnode/vnodectl_0.0.4-beta_linux_amd64.tar.gz -O vnodectl.tar.gz 

3. Extract the downloaded package files of VNodectl.

   tar xvf vnodectl.tar.gz 

4. Copy the extracted package files to a specified directory.

   cp vnodectl /usr/local/bin/vnode

Configure the cluster

Before you create a VNode, you must generate a kubeconfig certificate for the VNode. Then, you can use the kubeconfig to connect the VNode to your self-managed Kubernetes cluster. You can generate the kubeconfig in TLS Bootstrap mode or ServiceAccount mode.

Configure the ~/.vnode/config file

The ~/.vnode/config file contains the configuration information of the VNode. VNodectl reads the file when VNodectl runs. Before you create a VNode, you must configure the file.

1. Execute the configuration information that is required for the VNode to run.

   vnode config default

   The following table describes the parameters of contexts in the configuration information.

   Parameter	Required	Description
   name	Yes	The name of the context.
   vnode-name	No	The name of the VNode. We recommend that you do not configure the parameter to allow the system to generate a unique value.
   region-id	Yes	The ID of the region in which the VNode resides. For information about how to select a region, see Make preparations in this topic.
   access-key-id	Yes	When you call API operations, you must use the AccessKey pair to complete identity verification. An AccessKey pair consists of an AccessKey ID and an AccessKey secret. For more information, see Create an AccessKey pair.
   access-key-secret	Yes
   vswitch-id	Yes	The ID of the vSwitch with which the VNode is associated. You can specify multiple vSwitches. For information about how to create a vSwitch, see Make preparations in this topic.
   security-group-id	Yes	The ID of the security group to which the VNode belongs. For information about how to create a security group, see Make preparations in this topic.
   resource-group-id	No	The resource group to which the VNode belongs. A resource group is a mechanism in which resources are managed by groups in an Alibaba Cloud account. Each Alibaba Cloud account is assigned a default resource group. For more information, see What is Resource Management? If you do not specify a resource group, the VNode is added to the default resource group.
   kubeconfig	Yes	The path of the kubeconfig certificate that is required to connect the VNode to the cluster. The path is automatically generated after you configure the cluster. By default, the kubeconfig certificate is saved in ~/.vnode/deploy/kubeconfig.
   taints	No	The taints that are bound to the VNode.
   tags	No	The tags that are bound to the VNode. Tags can be used to manage split bills. After you bind a custom tag to the VNode, you can use the tag to filter the charged fees of instances in the VNode when you view the fee analysis. For more information, see View split bills based on tags.

2. Redirect the configuration information to the ~/.vnode/config file and configure parameters in the file.

   vnode config default > ~/.vnode/config
   vim ~/.vnode/config

   Modify the content of the ~/.vnode/config file based on your business requirements. In the following example, only the required parameters are configured.

   kind: vnode
   contexts:
       - name: default
         region-id: cn-guangzhou
         access-key-id: LTAI5tJbBkHcHBUmuP7C****
         access-key-secret: 5PlpKJT6sgLcD4f9y5pACNDbEg****
         vswitch-id: vsw-7xv2yk45qp5etidgf****
         security-group-id: sg-7xv5tcch4kjdr65t****
         kubeconfig: ~/.vnode/deploy/kubeconfig
   current-context: default

3. Verify the configuration information that is read by the VNode when the VNode runs.

   vnode config

4. Switch the context to allow the VNode to load the configuration in the context when the VNode runs.

   vnode config set-context <context-name>

Create a VNode

1. Create a VNode.

   vnode create

   Note

   The VNode is created based on the configurations in the ~/.vnode/config file. You can add parameters to configure customResources, clusterDNS, and clusterDomain. For more information, see Manage VNodes.

   The following sample output is returned. The value of VirtualNodeId is the ID of the generated VNode.

   {"RequestId":"AB772F9D-2FEF-5BFD-AAFB-DA3444851F29","VirtualNodeId":"vnd-7xvetkyase7gb62u****"}

2. View the status of the VNode.

   vnode list

   The following sample output is returned. If the STATUS value is Ready, the VNode is created.

   VNODE ID                    VNODE NAME                                   CREATED          STATUS    SCHEDULABLE ZONES
   vnd-7xvetkyase7gb62u****    vnode-cn-guangzhou-a-7xvetkyase7gb62u****    2 minutes ago    Ready     cn-guangzhou-a

3. View the information about nodes.

   kubectl get node

   The following sample output is returned, which indicates that the VNode is connected to the cluster.

   NAME                                    STATUS     ROLES                  AGE    VERSION
   cn-guangzhou.vnd-7xvetkyase7gb62u****   Ready      agent                  174m   v1.20.6
   vnode-test001                           Ready      control-plane,master   23h    v1.20.6
   vnode-test002                           Ready      <none>                 22h    v1.20.6

Configure an anti-affinity policy

DaemonSets cannot run on VNodes because VNodes are not real nodes. After you create a VNode, you need to modify the DaemonSet in kube-proxy and configure nodeAffinity to prevent DaemonSets from being scheduled to the VNode.

1. Modify the configurations of the DaemonSet.

   kubectl -n kube-system edit ds kube-proxy

2. Configure nodeAffinity.

   Add the following YAML content to spec > template > spec:

   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
         - matchExpressions:
           - key: type
             operator: NotIn
             values:
             - virtual-kubelet

What to do next

After you create a VNode, you can use one of the following methods to schedule pods to the VNode. Then, you can run the pods as elastic container instances in the VNode.

• Manual scheduling

  You can configure the nodeSelector and tolerations parameters or specify the nodeName parameter to schedule pods to the VNode. For more information, see Schedule pods to a VNode.

• Automatic Scheduling

  After you deploy the eci-profile component, you can specify the Selector parameter. This way, the system automatically schedules pods that meet the conditions specified by Selector to the VNode. For more information, see Use eci-profile to schedule pods to a VNode.

References

Common commands for VNodectl