How to use the multi-cluster proxy service-Container Service for Kubernetes(ACK)-阿里云帮助中心

Managing multiple clusters typically requires switching between kubeconfig files, which is time-consuming and error-prone. With Distributed Cloud Container Platform for Kubernetes (ACK One), a single Fleet instance kubeconfig gives you access to all associated clusters — deploy workloads, check pod status, and stream logs across clusters without switching contexts.

This topic shows how to use a Fleet instance as a proxy to manage multiple clusters using the CLI or the Kubernetes API.

Prerequisites

Before you begin, ensure that you have:

The kubeconfig of the Fleet instance downloaded from the ACK One console, with kubectl connected to the Fleet instance
The Fleet management feature enabled. For more information, see Enable multi-cluster management
Two clusters (service provider cluster and service consumer cluster) associated with the Fleet instance. For more information, see Associate clusters with a Fleet instance
The AMC command-line tool installed. For more information, see Use AMC

How it works

The Fleet instance acts as a proxy gateway. Resources you create through the Fleet instance apply only to the clusters associated with it. All CLI commands use the kubectl amc plugin, which routes requests to the target managed cluster via the -m flag.

Deploy an application across multiple clusters using the CLI

Step 1: List associated clusters

kubectl get managedclusters

Expected output:

NAME                     HUB ACCEPTED   MANAGED CLUSTER URLS   JOINED   AVAILABLE   AGE
managedcluster-c5***z9   true                                  True     True        12d
managedcluster-c1***e5   true                                  True     True        12d

Step 2: Create the application manifest

Create a file named app.yaml with the following content:

View the app.yaml file

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
spec:
  minReadySeconds: 5
  revisionHistoryLimit: 5
  progressDeadlineSeconds: 60
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9797"
      labels:
        app: demo
    spec:
      containers:
      - name: demo
        image: registry.cn-hangzhou.aliyuncs.com/acs/rollouts-demo:red
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        readinessProbe:
          tcpSocket:
            port: 8080
          initialDelaySeconds: 5
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 2000m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 64Mi
---
apiVersion: v1
kind: Service
metadata:
  name: demo-svc
  namespace: demo
spec:
  selector:
    app: demo
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
spec:
  rules:
    - host: app.demo.example.com
      http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: demo-svc
              port:
                number: 80

Step 3: Deploy the application to a managed cluster

Use -m to target a specific managed cluster. The following command deploys the demo application to managedcluster-c1***e5:

kubectl amc apply -f app.yaml -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
deployment.apps/demo created
service/demo-svc created
ingress.networking.k8s.io/demo created

Step 4: Verify the deployment

All status queries use the same -m flag to target the cluster. Run the following commands to check the status of each resource:

Deployment:

kubectl amc get deployment -n demo -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
NAME   READY   UP-TO-DATE   AVAILABLE   AGE
demo   1/1     1            1           2m48s

Pod:

kubectl amc get pod -n demo -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
NAME                   READY   STATUS    RESTARTS   AGE
demo-fdf4b6b7d-vthqj   1/1     Running   0          6m55s

Pod logs:

kubectl amc logs demo-fdf4b6b7d-vthqj -n demo -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
2021-12-16 24:00:00 Started server on :8080

Service:

kubectl amc get service -n demo -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
NAME       TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
demo-svc   ClusterIP   172.16.17.29   <none>        80/TCP    3m55s

Ingress:

kubectl amc get ingress -n demo -m managedcluster-c1***e5

Expected output:

Run on ManagedCluster managedcluster-c1***e5
NAME   CLASS    HOSTS                  ADDRESS        PORTS   AGE
demo   <none>   app.demo.example.com   123.56.XX.XX   80      4m10s

Manage multiple clusters using the Kubernetes API

Use the Fleet instance's Kubernetes API and the cluster gateway proxy endpoint to access resources on any managed cluster directly via curl or REST clients.

Step 1: Extract credentials from the kubeconfig

Run the following commands to extract the client certificate, client key, and API server address from $KUBECONFIG:

cat $KUBECONFIG | grep client-certificate-data | awk -F ' ' '{print $2}' | base64 -d > client-cert.pem
cat $KUBECONFIG | grep client-key-data | awk -F ' ' '{print $2}' | base64 -d > client-key.pem
APISERVER=`cat $KUBECONFIG | grep server | awk -F ' ' '{print $2}'`

Step 2: List managed clusters

Call the Fleet instance's Kubernetes API to list all associated clusters:

curl --cert client-cert.pem --key client-key.pem -k $APISERVER/apis/cluster.open-cluster-management.io/v1/managedclusters

Note

The ManagedCluster list endpoint is /apis/cluster.open-cluster-management.io/v1/managedclusters.

Step 3: Query resources on a managed cluster via the proxy

Use the cluster gateway proxy endpoint to send any Kubernetes API request to a specific managed cluster. The following command lists pods in the demo namespace:

curl --cert client-cert.pem --key client-key.pem -k \
  $APISERVER/apis/cluster.core.oam.dev/v1alpha1/clustergateways/<cluster-name>/proxy/api/v1/namespaces/demo/pods

Replace <cluster-name> with the name of the target managed cluster (for example, managedcluster-c1***e5).

Note

The proxy URL pattern is /apis/cluster.core.oam.dev/v1alpha1/clustergateways/<cluster-name>/proxy/<Kubernetes API path>. Append any valid Kubernetes API path after /proxy/ to access resources in the managed cluster.