Use p2p acceleration in ACK or ACK Serverless clusters

Step 1: Grant ACR read permissions

1. Create a RAM role.

   When you create the RAM role, set Role Type to Normal Service Role and select ECS as the trusted service. For more information, see Create a service RAM role.

2. Configure a permission policy for the RAM role.

   Attach the AliyunContainerRegistryReadOnlyAccess policy to the RAM role. For more information, see Manage permissions for a RAM role.

Step 2: Obtain the instance ID

1. Log on to the Container Registry console.

2. In the top navigation bar, select a region.

3. In the navigation pane on the left, click Instances.

4. On the Instances page, click the Enterprise Edition instance that you want to manage.

5. On the Overview page, find the ID of the Container Registry instance in the upper-left corner.

Step 3: Install the p2p component

1. Log on to the Container Service Management Console.

2. In the navigation pane on the left, choose Marketplace > Marketplace.

3. On the App Catalog page, search for and click ack-acr-acceleration-p2p.

4. On the component page, click Quick Deployment.

5. In the Create pane, select a cluster and a namespace, and then click Next.

6. On the Parameters page, set the registryInstances parameter to the ID of your Container Registry instance.

   If you have multiple Container Registry instances, separate their IDs with commas (,) when you set the registryInstances parameter.

   Note

   By default, the p2p component uses port 65001 on nodes. If a port conflict occurs, change the port number based on your requirements.

   p2p:
     ...
     # Port of P2P Agent in host network
     port: 65001
   
     # ID of ACR registry instances. Multiple IDs are supported, for example, "cri-xxx,cri-yyy"
     registryInstances: <ACR instance Id>

7. Optional: Set the controller.ramRole parameter to the name of your RAM role.

   Note

   You are required to set the controller.ramRole parameter only for ACK Serverless clusters. You can skip this step for other clusters.

   controller:
     ...
     # Setting for an ACK Serverless cluster to access ACR OpenAPI(Get*, List*) for ECS.
     ramRole: <your ram role name>

8. Optional: Use the ratelimit parameter to configure the total bandwidth limit for the p2p component on a node, including download and upload bandwidth. The default value is 512 MB/s. Adjust this value based on the bandwidth of your node.

   p2p:
     # Total net rate limit (MBytes/s) for uploading and downloading
     ratelimit: "512M"

9. In the Create pane, select the cluster and then click Create.

Step 4: Enable p2p acceleration

• Add the p2p acceleration label to a workload.

  To add the label to a Deployment, run the following command to edit it:

  kubectl edit deploy <deployment-name>

  Add the label k8s.aliyun.com/image-accelerate-mode: p2p to the Deployment manifest.

  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: test
    labels:
      app: nginx
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: nginx
    template:
      metadata:
        labels:
          # enable P2P
          k8s.aliyun.com/image-accelerate-mode: p2p
          app: nginx
      spec:
        # your ACR instance image pull secret
        imagePullSecrets:
        - name: test-registry
        containers:
        # your ACR instance image
        - image: test-registry-vpc.cn-hangzhou.cr.aliyuncs.com/docker-builder/nginx:latest
          name: test
          command: ["sleep", "3600"]

• Add the p2p acceleration label to a namespace.

  • Add the p2p acceleration label in the console.

    1. Log on to the Container Service Management Console.

    2. In the navigation pane on the left, click Cluster.

    3. On the Clusters page, find the target cluster and click its name, or click Details in the Actions column.

    4. In the left-side navigation pane of the cluster management page, click Namespaces and Quotas.

    5. On the Namespace page, find the target namespace and click Edit in the Actions column.

    6. In the Edit the namespace dialog box, set the Tag's Variable Key to k8s.aliyun.com/image-accelerate-mode and the Tag's Variable Value to p2p, and then click Confirm.

  • Add the p2p acceleration label by using kubectl.

    kubectl label namespaces <your-namespace> k8s.aliyun.com/image-accelerate-mode=p2p

Verify p2p acceleration

Run the following command to view the Pod:

kubectl get po <pod-name> -oyaml

Expected output:

apiVersion: v1
kind: Pod
metadata:
  annotations:
    # inject p2p-annotations automatically
    k8s.aliyun.com/image-accelerate-mode: p2p
    k8s.aliyun.com/p2p-config: '...'
spec:
  containers:
   # inject image to p2p endpoint
   - image: test-registry-vpc.distributed.cn-hangzhou.cr.aliyuncs.com:65001/docker-builder/nginx:latest
  imagePullSecrets:
  - name: test-registry
  # inject image pull secret for p2p endpoint
  - name: acr-credential-test-registry-p2p

The output confirms that the p2p-related annotations, the p2p-accelerated image address, and the corresponding imagePullSecret have been injected into the Pod, which means p2p acceleration is enabled.