Provides encrypted cloud-to-edge access in ACK Edge clusters. After cluster creation, edge-tunnel-server and edge-tunnel-agent are deployed by default to build the cloud-edge O&M channel. This topic covers the component overview, usage notes, and release history.edge-tunnel-server and edge-tunnel-agent.
How it works
edge-tunnel uses a reverse tunnel in a client-server architecture:
-
edge-tunnel-server runs on the cloud as the server.
-
edge-tunnel-agent runs on each edge node as the client.
Tunnel establishment
A Server Load Balancer (SLB) instance fronts the edge-tunnel-server Service. Each edge-tunnel-agent establishes an encrypted tunnel to edge-tunnel-server through this SLB instance.
Automatic request forwarding
When cloud components such as kube-apiserver and metrics-server send requests to ports 10250 and 10255 on edge nodes, edge-tunnel intercepts and forwards them through the tunnel. No cloud component changes are required.
Network modes
Edge node pools support three cloud connection modes, each with different edge-tunnel behavior.
| Mode | How the node pool connects | How cloud requests reach edge nodes | Label automatically applied |
|---|---|---|---|
| Internet | Over the Internet | Via the cloud-edge tunnel (forward proxy) | alibabacloud.com/interconnection-mode = normal |
| Express Connect | Via Express Connect | Directly to node ports (e.g., 10250 and 10255) | alibabacloud.com/interconnection-mode = private |
| CCN | Via a Cloud Connect Network (CCN) instance | Directly to node ports (e.g., 10250 and 10255) | alibabacloud.com/interconnection-mode = improved |
edge-tunnel-agent runs only on nodes in Internet-mode edge node pools. In Express Connect and CCN modes, cloud components reach edge nodes directly.
Usage notes
See Cloud-edge tunneling.
Release notes
June 2023
| Version | Image address | Description | Release date | Impact |
|---|---|---|---|---|
| v0.22.1 | edge-tunnel-server: registry-cn-hangzhou-vpc.ack.aliyuncs.com/acs/edge-tunnel-server:v0.22.1 edge-tunnel-agent: registry-cn-hangzhou.ack.aliyuncs.com/acs/edge-tunnel-agent:v0.22.1 |
- Optimized edge-tunnel and API server communication to resolve restart failures from unstable networks. - Optimized cloud-to-edge request forwarding to reduce URL leak risk from unstable connections. - Disabled the iptables module. CoreDNS now handles name resolution for cloud-edge forwarding. | 2023-06-28 | No impact on workloads |
December 2022
| Version | Image address | Description | Release date | Impact |
|---|---|---|---|---|
| v0.10.3 | edge-tunnel-server: registry.cn-hangzhou.aliyuncs.com/acs/edge-tunnel-server:v0.10.3 edge-tunnel-agent: registry.cn-hangzhou.aliyuncs.com/acs/edge-tunnel-agent:v0.10.3 |
- Added multiple network modes for cloud-edge communication. See Network modes. - DNS records update dynamically based on whether tunnel-agent is deployed on edge nodes. - Cloud component requests (from kube-apiserver and Prometheus) now use port 10263 of x-tunnel-server-internal-svc instead of x-tunnel-server-svc. | 2022-12-14 | No impact on workloads |
January 2022
| Version | Image address | Description | Release date | Impact |
|---|---|---|---|---|
| v0.10.0 | edge-tunnel-server: registry.cn-hangzhou.aliyuncs.com/acs/edge-tunnel-server:v0.10.0 edge-tunnel-agent: registry.cn-hangzhou.aliyuncs.com/acs/edge-tunnel-agent:v0.10.0 |
First edge-tunnel version for ACK edge clusters running 1.20.11-aliyunedge.1. Request forwarding: requests to {nodeName:Port} and localhost endpoints can now be forwarded from cloud to edge nodes. To forward localhost requests, configure localhost-proxy-ports in the edge-tunnel-server-cfg ConfigMap. For ports other than 10250 and 10255, configure http-proxy-ports (HTTP) or https-proxy-ports (HTTPS) in edge-tunnel-server-cfg. The dnat-ports-pair field is retained but not recommended. Certificate management: the TLS server certificate for edge-tunnel-server updates automatically when the edge-tunnel-server-svc IP address changes (for example, when associated with a new SLB instance). |
2022-01-27 | No impact on workloads |