Use ALB multi-cluster gateways to implement hybrid disaster recovery in ACK One

ACK One lets you route traffic across a cloud cluster and an on-premises cluster (or a cluster on a third-party platform) from a single control plane. When one zone fails, traffic automatically shifts to the other. This topic covers the full setup: networking, cluster registration, application distribution, and gateway configuration.

Architecture

The system has three core components: a Fleet instance (with optional GitOps), an ACK cluster in the cloud, and a registered cluster connected to your on-premises environment.

How the components connect:

All Alibaba Cloud resources share a single virtual private cloud (VPC). An ACK cluster runs in availability zone 1 (AZ 1) and a registered cluster is provisioned in AZ 2.
Your on-premises Kubernetes cluster (or a cluster on a third-party platform) connects to the registered cluster over a leased line that links the data center to the VPC.
Both the ACK cluster and the registered cluster are associated with the Fleet instance. ACK One GitOps distributes the application to both clusters.
On the Fleet instance, an AlbConfig creates an ALB multi-cluster gateway. An Ingress on the Fleet instance defines traffic routing rules that control north-south traffic and enable zone-disaster recovery.

Prerequisites

Before you begin, ensure that you have:

A Fleet instance, an ACK cluster, and a registered cluster in the same VPC but in different availability zones
Non-overlapping node and pod CIDR blocks between the ACK cluster and the on-premises Kubernetes cluster — see Network design for Fleet management for planning guidance
A leased line connecting your on-premises data center to the VPC
A decision on whether your on-premises cluster uses an underlay or overlay container network — this determines the Service type required in Step 3

Network type	Required Service type	When to use
Underlay	ClusterIP	Pod IPs are directly routable from the on-premises network
Overlay	NodePort	Pod IPs are not routable; traffic must enter through node ports

Step 1: Design the network and create clusters

Create a Fleet instance, an ACK cluster, and a registered cluster in the same VPC. Place the ACK cluster and the registered cluster in different availability zones.
Confirm that the node and pod CIDR blocks of the ACK cluster do not overlap with those of the on-premises Kubernetes cluster.

Step 2: Connect to Alibaba Cloud

Connect the on-premises Kubernetes cluster to the registered cluster. For details, see Create a registered cluster.
To migrate workloads to Alibaba Cloud using elastic resources, see Build a hybrid cloud cluster and add ECS instances to the cluster and Schedule pods to elastic container instances that are deployed as virtual nodes. To improve availability against unexpected traffic spikes, see Create ECIs across zones.
Connect the on-premises network to the VPC. For an overview, see Network connectivity and Overview of hybrid networks.
Associate both the registered cluster and the ACK cluster with the Fleet instance. For details, see Manage associated clusters.

Step 3: Distribute the application to multiple clusters

The ApplicationSet examples below use the web-demo app. For more on ApplicationSets, see Create a multi-cluster application.

Underlay network

All clusters use ClusterIP Services. Apply the following ApplicationSet:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: appset-web-demo-undelay
  namespace: argocd
spec:
  template:
    metadata:
      name: '{{.metadata.annotations.cluster_id}}-web-demo'
      namespace: argocd
    spec:
      destination:
        name: '{{.name}}'
        namespace: gateway-demo
      project: default
      source:
        repoURL: https://github.com/AliyunContainerService/gitops-demo.git
        path: manifests/helm/web-demo
        targetRevision: main
        helm:
          valueFiles:
            - values.yaml
          parameters:
            - name: envCluster
              value: '{{.metadata.annotations.cluster_name}}'
      syncPolicy:
        automated: {}
        syncOptions:
          - CreateNamespace=true
  generators:
    - clusters:
        selector:
          matchExpressions:
            - values:
                - cluster
              key: argocd.argoproj.io/secret-type
              operator: In
            - values:
                - in-cluster
              key: name
              operator: NotIn
  goTemplateOptions:
    - missingkey=error
  syncPolicy:
    preserveResourcesOnDeletion: false
  goTemplate: true

Overlay network

The on-premises cluster uses NodePort Services; the ACK cluster uses ClusterIP Services. Label each cluster accordingly before applying the ApplicationSet.

In the Argo CD UI, go to Settings > Clusters and add these labels:
- On-premises cluster: cluster: idc
- ACK cluster: cluster: ack
Apply the following ApplicationSet:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: appset-web-demo-overlay
  namespace: argocd
spec:
  template:
    metadata:
      name: '{{.metadata.annotations.cluster_id}}-web-demo-overlay'
      namespace: argocd
    spec:
      destination:
        name: '{{.name}}'
        namespace: gateway-demo
      project: default
      source:
        repoURL: https://github.com/AliyunContainerService/gitops-demo.git
        path: manifests/helm/web-demo
        targetRevision: main
        helm:
          valueFiles:
            - values.yaml
          parameters:
            - name: isNodePort
              value: "{{.values.isNodePort}}"
            - name: envCluster
              value: '{{.metadata.annotations.cluster_name}}'
      syncPolicy:
        automated: {}
        syncOptions:
          - CreateNamespace=true
  generators:
    - clusters:
        selector:
          matchLabels:
            cluster: 'idc'
        # A key-value map for arbitrary parameters
        values:
          isNodePort: "true"
    - clusters:
        selector:
          matchLabels:
            cluster: 'ack'
        values:
          isNodePort: "false"
  goTemplateOptions:
    - missingkey=error
  syncPolicy:
    preserveResourcesOnDeletion: false
  goTemplate: true

Step 4: Configure the ALB multi-cluster gateway

With both clusters running the application, configure the gateway to manage traffic routing and failover:

On the Fleet instance, create an AlbConfig to provision the ALB multi-cluster gateway and add both the ACK cluster and the registered cluster to it.
Create routing rules and Ingresses on the Fleet instance to implement active zone-redundancy.

For the full configuration walkthrough, see Build a zone-disaster recovery system.

What's next

Build a zone-disaster recovery system — detailed AlbConfig and Ingress configuration for traffic routing and failover
Network design for Fleet management — CIDR planning and network topology guidance
Create a multi-cluster application — advanced ApplicationSet configuration options