Elastic Container Instance:Use VNodectl to deploy a VNode in a self-managed Kubernetes cluster

Prerequisites

• A Kubernetes cluster of version 1.16 to 1.30 is deployed.

• If your Kubernetes cluster is deployed in a data center, make sure that the data center and the virtual private cloud (VPC) to which the Elastic Container Instance-based pods belong are connected with each other by using Express Connect, Smart Access Gateway, or VPN Gateway. For more information, see the following topics:

  • What is Express Connect?

  • What is SAG?

  • What is VPN Gateway?

Preparations

Before you deploy a VNode in a self-managed Kubernetes cluster, prepare the parameter information that is required for creating a VNode and understand the permissions that are required to deploy the VNode in the cluster. The following table describes the parameters that are required to create a VNode.

To create a VNode, you must configure standard permissions for native Kubernetes nodes and additional permissions for the VNode, as shown in the following table.

Install VNodectl

Before you use VNodectl, install the CLI. Obtain the installation package for your environment and install VNodectl.

We recommend that you install VNodectl on the master node of your Kubernetes cluster. To install VNodectl, perform the following steps:

1. Connect to your cluster.

2. Download the installation package.

   wget https://eci-docs.oss-cn-beijing.aliyuncs.com/vnode/vnodectl_0.0.5-beta_linux_amd64.tar.gz -O vnodectl.tar.gz 

3. Extract the package.

   tar xvf vnodectl.tar.gz 

4. Copy vnodectl to a directory.

   cp vnodectl /usr/local/bin/vnode

Configure the cluster

VNodes use a kubeconfig file to connect to the cluster. Before you create a VNode, generate a kubeconfig file for it. You can generate the kubeconfig file in TLS Bootstrap mode or ServiceAccount mode.

Configure the ~/.vnode/config file

The ~/.vnode/config file contains the VNode configuration. VNodectl reads this file when it runs. Configure this file before you create a VNode.

1. Print the configuration required to run the VNode.

   vnode config default

   The following table describes the fields under contexts in the configuration.

   Field	Required	Description
   name	Yes	The name of the context.
   vnode-name	No	The name of the VNode. Do not set this field. The system generates a unique name automatically.
   region-id	Yes	The ID of the region where the VNode resides. For information about how to select a region, see Preparations.
   access-key-id	Yes	Use an AccessKey pair to complete identity verification when you call Alibaba Cloud API operations. An AccessKey pair consists of an AccessKey ID and an AccessKey secret. For more information, see Create an AccessKey pair.
   access-key-secret	Yes
   vswitch-id	Yes	The ID of the vSwitch associated with the VNode. You can specify multiple vSwitches. For information about how to create a vSwitch, see Preparations.
   security-group-id	Yes	The ID of the security group to which the VNode belongs. For information about how to create a security group, see Preparations.
   resource-group-id	No	The resource group to which the VNode belongs. A resource group is a mechanism for grouping resources in an Alibaba Cloud account. Each account has a default resource group. For more information, see Resource Management. If you do not specify a resource group, the VNode joins the default resource group.
   kubeconfig	Yes	The path of the kubeconfig file required to connect the VNode to the cluster. This path is generated automatically after you configure the cluster. By default, the kubeconfig file is saved to ~/.vnode/deploy/kubeconfig.
   taints	No	The taints bound to the VNode.
   tags	No	The tags bound to the VNode. Tags help manage split bills. After you bind a custom tag to the VNode, you can filter the instance fees charged to the VNode in cost analysis. For more information, see View split bills by tag.
   network-type	No	The network type used by VNodectl to access the ECI control service endpoint. Leave this field empty to use the Internet endpoint. If VNodectl runs in a VPC, set this field to vpc to use the VPC endpoint.

2. Redirect the configuration to the ~/.vnode/config file and configure the fields.

   vnode config default > ~/.vnode/config
   vim ~/.vnode/config

   Modify the ~/.vnode/config file based on your needs. The following example shows only the required fields.

   kind: vnode
   contexts:
       - name: default
         region-id: cn-guangzhou
         access-key-id: <yourAccessKeyID>
         access-key-secret: <yourAccessKeySecret>
         vswitch-id: vsw-7xv2yk45qp5etidgf****
         security-group-id: sg-7xv5tcch4kjdr65t****
         kubeconfig: ~/.vnode/deploy/kubeconfig
   current-context: default

3. Verify the configuration that the VNode reads at runtime.

   vnode config

4. Switch the context so the VNode loads the configuration in that context.

   vnode config set-context <context-name>

Create a VNode

1. Create a VNode.

   vnode create

   Note

   The VNode is created using the configuration in the ~/.vnode/config file. You can add parameters to configure customResources, clusterDNS, and clusterDomain. For more information, see Manage VNodes.

   The following sample output appears. The value of VirtualNodeId is the ID of the new VNode.

   {"RequestId":"AB772F9D-2FEF-5BFD-AAFB-DA3444851F29","VirtualNodeId":"vnd-7xvetkyase7gb62u****"}

2. View the status of the VNode.

   vnode list

   The following sample output appears. If STATUS is Ready, the VNode is created successfully.

   VNODE ID                    VNODE NAME                                   CREATED          STATUS    SCHEDULABLE ZONES
   vnd-7xvetkyase7gb62u****    vnode-cn-guangzhou-a-7xvetkyase7gb62u****    2 minutes ago    Ready     cn-guangzhou-a

3. View node information.

   kubectl get node

   The following sample output appears. It shows that the VNode is connected to the cluster.

   NAME                                    STATUS     ROLES                  AGE    VERSION
   cn-guangzhou.vnd-7xvetkyase7gb62u****   Ready      agent                  174m   v1.20.6
   vnode-test001                           Ready      control-plane,master   23h    v1.20.6
   vnode-test002                           Ready      <none>                 22h    v1.20.6

Prevent DaemonSets from being scheduled to the VNode

DaemonSets cannot run on VNodes because VNodes are not real nodes. After you create a VNode, you need to modify the DaemonSet in kube-proxy and configure nodeAffinity to prevent DaemonSets from being scheduled to the VNode.

1. Modify the configurations of the DaemonSet.

   kubectl -n kube-system edit ds kube-proxy

2. Configure nodeAffinity.

   Add the following YAML content to spec.template.spec.

   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
         - matchExpressions:
           - key: type
             operator: NotIn
             values:
             - virtual-kubelet

Schedule pods to the VNode

After you create a VNode, you can use one of the following methods to schedule pods to the VNode. Then, you can run the pods as elastic container instances in the VNode.

• Manual scheduling

  You can configure the nodeSelector and tolerations parameters or specify the nodeName parameter to schedule pods to the VNode. For more information, see Schedule pods to a VNode.

• Automatic Scheduling

  After you deploy the eci-profile component, you can specify the Selector parameter. This way, the system automatically schedules pods that meet the conditions specified by Selector to the VNode. For more information, see Use eci-profile to schedule pods to a VNode.

References

• Common VNodectl commands