Container Service for Kubernetes:Configure a static IP address, a separate vSwitch, and a separate security group for each pod

Step 2: Create a PodNetworking

Terway allows you to use custom resource definitions (CRDs) named PodNetworking to describe network configurations. You can create multiple PodNetworkings to design different network planes.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you want to manage and choose Workloads > Custom Resources in the left-side navigation pane.

3. On the Custom Resources page, click Create from YAML.

   The following code block shows a sample PodNetworking:

   apiVersion: network.alibabacloud.com/v1beta1
   kind: PodNetworking
   metadata:
     name: example
   spec:
     allocationType:
       type: Fixed # The policy that describes how IP addresses are allocated to pods. Valid values: Elastic and Fixed. 
       releaseStrategy: TTL # This parameter takes effect only if the PodNetworking uses the Fixed policy. If the PodNetworking uses the Elastic policy, you do not need to configure the releaseStrategy and releaseAfter parameters. 
       releaseAfter: "1h" # This parameter takes effect only if releaseStrategy is set to TTL. 
     selector:
       podSelector:
         matchLabels:
           foo: bar
       namespaceSelector:
         matchLabels:
           foo: bar
     securityGroupIDs:
     - sg-bpxxxx
     vSwitchOptions:
     - vsw-bpxxxx
   status:
     status: Ready               

   The following table describes the parameters.

   Parameter		Description
   allocationType (The policy that describes how IP addresses are allocated to pods)	type	Valid values: Elastic: Allocate elastic IP addresses (EIPs) to pods. The IP addresses are released after the pods are deleted. Fixed: Allocate static IP addresses to pods. A PodNetworking that uses the Fixed policy takes effect only on pods that are created by StatefulSets. For more information about StatefulSets, see Kubernetes StatefulSet best practice. Note If you use the Fixed policy, constraints are added to ensure that the zone where a pod is recreated is the same as the original zone.
   	releaseStrategy	The policy that describes how IP addresses are released. This parameter takes effect only if type is set to Fixed. Valid values: TTL: IP addresses are released with a delay. After a pod is deleted, the IP address of the pod is not released until the specified period of time ends. The minimum value is 5 minutes. Never: IP addresses are not released. If IP addresses are no longer used, you must manually delete PodENIs.
   	releaseAfter	The delay for releasing pod IP addresses. This parameter takes effect only if releaseStrategy is set to TTL. The value must be of the Go time type. Example: 2h45m or 5m0s. For more information, see Go time type.
   selector (Label selectors that are used to select pods to use the current PodNetworking)	podSelector	A selector that is used to match pod labels. Pods that match this selector use the current PodNetworking. If both podSelector and namespaceSelector are configured, only pods that match both selectors use the current PodNetworking. Make sure that the labels of a pod match the selectors of only one PodNetworking ConfigMap. If a pod matches multiple PodNetworking ConfigMaps, the pod uses the network configurations in an arbitrary PodNetworking ConfigMap.
   	namespaceSelector	A selector that is used to match namespace labels. Pods that match this selector use the current PodNetworking. If both podSelector and namespaceSelector are configured, only pods that match both selectors use the current PodNetworking. Make sure that the labels of a pod match the selectors of only one PodNetworking ConfigMap. If a pod matches multiple PodNetworking ConfigMaps, the pod uses the network configurations in an arbitrary PodNetworking ConfigMap.
   vSwitchOptions	-	Specifies the vSwitches used by pods. The logical relationship among multiple vSwitches is OR. Each pod can use only one vSwitch. Terway automatically selects a proper vSwitch for each pod. Constraints are added to ensure that the zones to which your pods can be scheduled are the same as the zones of the vSwitches that you specified in the vSwitchOptions parameter. Make sure that the zones of the vSwitches in vSwitchOptions are the same as those of the nodes to which pods are scheduled. In addition, make sure that these vSwitches can provide sufficient idle IP addresses. Otherwise, ACK fails to create pods.
   vSwitchSelectOptions (The policy that determines the vSwitch to use)	vSwitchSelectionPolicy	Valid values: ordered: This is the default value. vSwitches are used in the order they are filled in. most: Prioritizes the vSwitch with the most available IP addresses for use. random: vSwitches are selected randomly. Note Supported in Terway v1.11.0 and later.
   securityGroupIDs	-	Specifies the IDs of security groups. Multiple security groups take effect at the same time. You can specify at most five security groups.
   eniOptions (The ENI type that is used by the pod)	eniType	Valid values: Default: This is the default mode. In clusters that run in Terway shared ENI mode, the Trunk ENI mode is used. In clusters that run in Terway ENI exclusive mode, the exclusive ENI mode is used. ENI: Use the exclusive ENI mode. Trunk: Use the Trunk ENI mode. Note Supported in Terway v1.11.0 and later.

4. Click Create.

   After the PodNetworking is created, Terway automatically synchronizes the network configurations. The PodNetworking takes effect on pods only after the status of the PodNetworking changes to Ready.

   Run the following command to check whether the resource status is ready:

   kubectl describe PodNetworking example # Replace example with an actual custom resource name.

(Optional) Step 1: Add labels to the namespace

After you deploy the PodNetworking, you must add labels to the specified namespace to ensure that the resources match the policy of the PodNetworking.

1. Run the following command to create a test namespace named example:

   kubectl create ns example

2. Run the following command to add the foo=bar label to the namespace:

   kubectl label namespaces example foo=bar # Replace example with the actual namespace name.

3. Run the following command to query the labels of the namespace:

   kubectl get namespace example --show-labels # Replace example with the actual namespace name.

   Expected output:

    NAME      STATUS   AGE   LABELS
   example   Active   24s   foo=bar,kubernetes.io/metadata.name=example

(Optional) Step 2: Create a pod

When ACK creates a pod, the labels of the pod are matched against PodNetworkings. If the pod does not match a PodNetworking, the pod is assigned an IP address from a shared ENI by default. If the pod matches a PodNetworking, an IP address is assigned to the pod based on the configurations specified in the PodNetworking.

Terway automatically creates CRDs named PodENI for pods that match PodNetworkings. PodENIs are used to track the resource usage of pods. PodENIs are managed by Terway. For more information about pod labels, see Labels and Selectors.

1. Create a my-nginx.yaml file with the following YAML template:

   apiVersion: apps/v1
   kind: StatefulSet
   metadata:
     name: my-nginx # The name of the application. 
     namespace: example # Specify the namespace name as example. 
     labels:
       app: nginx
   spec:
     serviceName: "nginx-service"  
     replicas: 1    
     selector:
       matchLabels:
         app: nginx 
     template:
       metadata:
         labels:
           app: nginx
           foo: bar # Add the foo: bar label to the pod. 
       spec:
         containers:
         - name: nginx
           image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
           ports:
           - containerPort: 80  
   
   If the StatefulSet requires persistent storage, you must set the volumeClaimTemplates parameter. 
   # Example:
   #  volumeClaimTemplates:
   #  - metadata:
   #      name: nginx-storage
   #    spec:
   #      accessModes: ["ReadWriteOnce"]
   #      storageClassName: "my-storage-class"
   #      resources:
   #        requests:
   #          storage: 1Gi

2. Run the following command to deploy the example application named my-nginx: After the pod is deployed, verify the configuration. For more information, see How do I check whether a pod uses the network configurations specified in a PodNetworking ConfigMap?

   kubectl apply -f my-nginx.yaml