Configure ACS pod parameters via eci-profile

Introduction

The eci-profile ConfigMap automatically injects pod configurations at the cluster level, including settings for vSwitches, security groups, and domain name resolution modes. You can update these settings as needed.

• You do not need to restart the acs-virtual-node component when you update the configuration.

• For existing ACS pods, the changes take effect after a rolling update.

Configuration

When you create a pod, the system reads the eci-profile configuration file, which is a ConfigMap named eci-profile in the kube-system namespace. The system then creates the pod based on the settings in this file. You can view the YAML file of the eci-profile ConfigMap by running the following command:

kubectl get cm -n kube-system eci-profile -o yaml

The following code shows an example of the YAML file:

apiVersion: v1
kind: ConfigMap
metadata:
  name: eci-profile
  namespace: kube-system
data:
  enablePrivateZone: "false"
  securityGroupId: sg-2zeeyaaxlkq9sppl****
  vSwitchIds: vsw-2ze23nqzig8inprou****,vsw-2ze94pjtfuj9vaymf****
  vpcId: vpc-2zeghwzptn5zii0w7****
  selectors: ""

You can modify the eci-profile ConfigMap in one of the following ways:

• Use the kubectl edit command

  kubectl edit configmap eci-profile -n kube-system

• Use the Container Service Management Console

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Configurations > ConfigMaps.

  3. On the ConfigMaps page, select kube-system from the Namespace drop-down list, find the eci-profile ConfigMap, and then click Edit YAML.

     Note

     If the eci-profile ConfigMap contains a format error after you modify a configuration, the changes do not take effect. The system records the specific error information in an event. You can view the event by running the following kubectl command:

     kubectl -n kube-system get event --field-selector involvedObject.namespace=kube-system,involvedObject.name=eci-profile

Update cluster configurations

The eci-profile ConfigMap contains cluster configurations such as vpcId and vSwitchIds, which correspond to resources like a Virtual Private Cloud (VPC) and vSwitches. You can update these configurations as needed. The changes take effect immediately through a hot update. The following table describes the configurations that you can update.

Configure selectors

When you create a pod, the system uses selectors to match the pod. If a pod's labels match a selector, the system automatically adds the specified annotations and labels to the pod. This process enables specific features for the ACS pod.

The selectors field contains a list of selector objects, each requiring a unique name. The following table describes the configuration format.

The following code provides a template for the selectors configuration:

apiVersion: v1
kind: ConfigMap
metadata:
  name: eci-profile
  namespace: kube-system
data:
  selectors: |
    [
      {
        "name": "selector-demo1",
        "namespaceSelector": {
          "matchLabels": {
            "kubernetes.io/metadata.name": "dev-ns"
          }
        },
        "objectSelector": {
          "matchLabels": {
            "acs": "true"
          },
          "matchExpressions": [
            {
              "key": "usage",
              "operator": "In",
              "values": ["testing"]
            }
          ]
        },
        "effect": {
          "annotations": {
            "network.alibabacloud.com/custom-dnsconfig": "{\"servers\":[\"114.114.114.114\",\"8.8.8.8\"],\"searches\":[\"xx.com\",\"yy.com\"],\"options\":[\"ndots:2\",\"edns0\"]}"
          },
          "labels": {
            "created-by-acs": "true"
          }
        }
      }
    ]

In the preceding template, the selector named selector-demo1 performs the following action:

If a Pod belongs to the dev-ns namespace and has the acs=true and usage=testing labels, the Pod is automatically updated with the network.alibabacloud.com/custom-dnsconfig="{\"servers\":[\"114.114.114.114\",\"8.8.8.8\"],\"searches\":[\"xx.com\",\"yy.com\"],\"options\":[\"ndots:2\",\"edns0\"]}" annotation and the created-by-acs=true label.

Example

1. Create a pod that matches the selector-demo1 selector by using the following YAML content.

   apiVersion: v1
   kind: Pod
   metadata:
     name: nginx
     namespace: dev-ns
     labels:
       alibabacloud.com/acs: 'true'
       alibabacloud.com/compute-class: general-purpose
       alibabacloud.com/compute-qos: default  
       acs: "true"
       usage: "testing"
   spec:
     containers:
     - name: nginx
       image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
       command: ["sleep", "infinity"]
       ports:
       - containerPort: 80

2. After the pod is created, you can inspect it to confirm that the injected labels and annotations have been added.