how to manage MSE multi-cluster gateways-Container Service for Kubernetes(ACK)-阿里云帮助中心

This topic describes how to enable and disable the multi-cluster gateway feature in an ACK One Fleet instance, and how to add associated clusters to a multi-cluster gateway.

Billing

You are charged for using multi-cluster gateways. For more information about the billing of multi-cluster gateways, see Billing of general-purpose instances.

Prerequisites

You have been authorized to use Microservices Engine (MSE) cloud-native gateways.

You have attached the AliyunAdcpManagedMseRolePolicy policy to the AliyunAdcpManagedMseRole RAM role. The following is the policy document for AliyunAdcpManagedMseRolePolicy.

Policy details

{
    "Statement": [
        {
            "Action": [
                "mse:AddBlackWhiteList",
                "mse:AddGateway",
                "mse:AddServiceSource",
                "mse:CreateApplication",
                "mse:DeleteGateway",
                "mse:DeleteServiceSource",
                "mse:GetBlackWhiteList",
                "mse:GetGateway",
                "mse:GetGatewayDetail",
                "mse:GetGatewayOption",
                "mse:ListServiceSource",
                "mse:ListTagResources",
                "mse:ModifyLosslessRule",
                "mse:TagResources",
                "mse:UntagResources",
                "mse:UpdateBlackWhiteList",
                "mse:UpdateGatewayOption",
                "mse:UpdateServiceSource"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "log:CloseProductDataCollection",
                "log:OpenProductDataCollection",
                "log:GetProductDataCollection"
            ],
            "Resource": [
                "acs:mse:*:*:instance/*",
                "acs:log:*:*:project/*/logstore/mse_*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "audit.log.aliyuncs.com"
                    ]
                }
            },
            "Effect": "Allow"
        }
    ],
    "Version": "1"
}

The Fleet management feature is enabled. You have obtained the kubeconfig file for your Fleet instance from the ACK One console and connected to the Fleet instance using kubectl.
Associated clusters have been added and are in the same VPC as the ACK One Fleet instance.
(Optional) The latest version of Alibaba Cloud CLI is installed and configured.

Enable the multi-cluster gateway

Console

Log on to the ACK One console. In the navigation pane on the left, choose Fleet > Multi-cluster Gateway.
On the Multi-cluster Gateway page, click the Create a multi-cluster gateway drop-down list, select Enable MSE multi-cluster gateway, and then click OK in the dialog box.

CLI

Ensure that you are using the latest version of Alibaba Cloud CLI. Then, run the following command to enable the multi-cluster gateway feature.

Replace <YOUR_FLEET_CLUSTERID> with the ID of your Fleet instance.
```
aliyun adcp UpdateHubClusterFeature --ClusterId <YOUR_FLEET_CLUSTERID> --GatewayEnabled true
```

Run the following command to check the status of the multi-cluster gateway feature.

aliyun adcp DescribeHubClusterDetails --ClusterId <YOUR_FLEET_CLUSTERID> |grep -B4 -A1 EnabledMSE

Expected output: If the value of Status is True, the multi-cluster gateway feature is enabled.

			{
				"Message": "",
				"Reason": "",
				"Status": "True",
				"Type": "EnabledMSE"
			},

Create a multi-cluster gateway

Console

Log on to the ACK One console. In the navigation pane on the left, choose Fleet > Multi-cluster Gateway.
In the upper-right corner of the Multi-cluster Gateway page, click the Create a multi-cluster gateway drop-down list and select MSE multi-cluster gateways.
In the panel, modify the YAML file for the multi-cluster gateway based on your requirements, and then click Create.

CLI

Obtain and record a VSwitch ID of the ACK One Fleet instance.
1. Run the following command to obtain the VSwitch ID.
```
aliyun adcp DescribeHubClusterDetails --ClusterId <YOUR_FLEET_CLUSTERID>
```
1. From the VSwitches field in the output, copy a VSwitch ID.

Create a file named mseingressconfig.yaml with the following content.

Replace ${vsw-id1} with the VSwitch ID from the previous step. You can also specify the associated clusters to add to the multi-cluster gateway by adding an annotation when you create the gateway.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: ackone-gateway
  # Add associated clusters to the MSE gateway.
  #annotations:
  #  mse.alibabacloud.com/remote-clusters: ${cluster1},${cluster2}
spec:
  common:
    instance:
      replicas: 3
      spec: 2c4g
    network:
      # You can configure both an internet-facing SLB and an internal-facing SLB. If neither field is configured, an internet-facing SLB is used by default.
      #publicSLBSpec: slb.s2.small
      #privateSLBSpec: slb.s2.small
      vSwitches:
      - ${vsw-id1}
  ingress:
    local:
      ingressClass: mse
  name: mse-ingress

Run the following command to create a gateway named mse-ingress in the ACK One Fleet instance.
```
kubectl apply -f mseingressconfig.yaml
```
Run the following command to verify that the gateway was created.
```
kubectl get mseingressconfig ackone-gateway
```
Expected output:
```
NAME             STATUS      AGE
ackone-gateway   Listening   3m15s
```
In the expected output, a status of Listening indicates that the cloud-native gateway has been created, is running, and is automatically listening for Ingress resources in the cluster with an IngressClass of mse.

The status of a multi-cluster gateway created from an MseIngressConfig object transitions in the following order: Pending, Running, and Listening. The following describes each status:
- Pending: The cloud-native gateway is being created. This process takes about three minutes.
- Running: The cloud-native gateway has been created and is running.
- Listening: The cloud-native gateway is running and listening for Ingress resources in the cluster.
- Failed: The cloud-native gateway is in an abnormal state. You can check the Message in the Status field for details.

Add or remove associated clusters

Console

Log on to the ACK One console. In the navigation pane on the left, choose Fleet > Multi-cluster Gateway.
From the drop-down list at the top of the Multi-cluster Gateway page, select the target multi-cluster gateway. Then, in the upper-right corner of the page, click Edit.
In the panel, modify the cluster IDs in the annotations parameter and click Update.
Example:
```
annotations:
  mse.alibabacloud.com/remote-clusters: ${cluster1-id},${cluster2-id}
```
- ${cluster1-id} and ${cluster2-id} represent the IDs of the associated clusters to add. Separate multiple cluster IDs with a comma (,). You can modify the cluster IDs to add or remove associated clusters.
- If you create a multi-cluster gateway without associating a cluster, the annotations parameter is not included in the YAML content. Therefore, when you add an associated cluster, you need to add the preceding example to the metadata object in the YAML content, and then add or modify the cluster ID.

CLI

In the ACK One Fleet instance, use an annotation in the MseIngressConfig object to add or remove associated clusters from the multi-cluster gateway. Replace ${cluster1-id} and ${cluster2-id} with the IDs of the associated clusters that you want to add. Separate multiple cluster IDs with a comma (,).
```
annotations:
  mse.alibabacloud.com/remote-clusters: ${cluster1-id},${cluster2-id}
```
If you create a multi-cluster gateway without associating a cluster, the annotations parameter is not included in the YAML content. Therefore, when you add an associated cluster, you need to add the preceding example to the metadata object in the YAML content, and then add or modify the cluster ID.
Run the following command to check whether the associated clusters have been successfully added to the multi-cluster gateway.
```
kubectl get mseingressconfig ackone-gateway -ojsonpath="{.status.remoteClusters}"
```
Expected output:
```
[{"clusterId":"c7fb82****"},{"clusterId":"cd3007****"}]
```
If the output contains the specified cluster IDs and no failure messages are returned, it indicates that the associated clusters were successfully added to the multi-cluster gateway.
Run the following command to view the clusters currently associated with the multi-cluster gateway.
```
kubectl get mseingressconfig ackone-gateway
```
Run the following command to overwrite the list of associated clusters.

mse.alibabacloud.com/remote-clusters=${cluster1},${cluster2} specifies the new, complete list of clusters to associate with the multi-cluster gateway, which overwrites the existing list.
```
kubectl annotate mseingressconfig ackone-gateway mse.alibabacloud.com/remote-clusters=${cluster1},${cluster2} --overwrite=true
```

Disable the multi-cluster gateway

Important

Deleting a multi-cluster gateway impacts your workloads. Proceed with caution.
If you no longer need the multi-cluster gateway feature, delete all multi-cluster gateways first and then disable the feature to prevent incurring unnecessary costs.

Console

Log on to the ACK One console. In the navigation pane on the left, choose Fleet > Multi-cluster Gateway.
On the Multi-cluster Gateway page, select MSE from the Gateway Type drop-down list. Choose the gateway to delete from the Select a gateway drop-down list, and then click Delete in the upper-right corner.
In the confirmation dialog box, enter the name of the multi-cluster gateway to delete and click Delete.
Confirm that all multi-cluster gateways in the ACK One Fleet instance are deleted. Then, in the upper-right corner of the page, click Disable MSE Ingresses and click OK in the confirmation dialog box.

CLI

Run the following command to delete the multi-cluster gateway.
```
kubectl delete mseingressconfig ackone-gateway
```

Run the following command to disable the multi-cluster gateway feature.

aliyun adcp UpdateHubClusterFeature --ClusterId <YOUR_FLEET_CLUSTERID> --GatewayEnabled false