Alibaba Cloud Service Mesh (ASM) allows you to manage multiple clusters on the data plane. When you add a cluster to an ASM instance, the ASM instance checks the pod CIDR blocks, service CIDR blocks, and vSwitch CIDR blocks of the cluster. The cluster can be added to the ASM instance only if no CIDR block conflict occurs. This ensures normal communications among clusters on the data plane. This topic describes how to plan the virtual private cloud (VPC) CIDR blocks, vSwitch CIDR blocks, pod CIDR blocks, and service CIDR blocks for multiple clusters when the clusters use the Flannel or Terway network plug-in.
Clusters on the data plane use Flannel
Precautions
-
A cluster's service CIDR block must not overlap with the service, pod, or vSwitch CIDR blocks of any other cluster.
-
A cluster's pod CIDR block must not overlap with the pod, service, or vSwitch CIDR blocks of any other cluster.
-
A cluster's vSwitch CIDR block must not overlap with the vSwitch, service, or pod CIDR blocks of any other cluster.
-
Do not use CIDR blocks that start with
7. This address range is reserved for ACK managed clusters. -
If the cluster and Service Mesh are not in the same VPC, the cluster's VPC CIDR cannot conflict with the Service Mesh's VPC CIDR.
Planning rule for CIDR blocks
We recommend using the following address ranges to plan the CIDR blocks for your VPCs, vSwitches, and other resources.
|
Type |
Description |
|
VPC |
We recommend using CIDR blocks in the |
|
vSwitch |
We recommend using CIDR blocks in the |
|
ACK cluster |
|
Examples
Example 1: The Service Mesh and clusters are in the same VPC
|
Object |
VPC |
vSwitch |
Pod |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
/ |
|
Cluster 1 |
192.168.0.0/16 |
192.168.0.0/24 |
10.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
192.168.0.0/16 |
192.168.0.0/24 |
10.1.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
192.168.0.0/16 |
192.168.0.0/24 |
10.2.0.0/16 |
172.18.0.0/16 |
Example 2: All clusters are in the same VPC, but the Service Mesh is in a different VPC
Before adding clusters to the ASM instance, you must connect the VPCs of the clusters and the VPC of the Service Mesh by using Cloud Enterprise Network (CEN). For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Pod |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
/ |
|
Cluster 1 |
20.0.0.0/8 |
20.0.0.0/16 |
10.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
20.0.0.0/8 |
20.0.0.0/16 |
10.1.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
20.0.0.0/8 |
20.0.0.0/16 |
10.2.0.0/16 |
172.18.0.0/16 |
Example 3: All clusters are in different VPCs, and the Service Mesh is in the same VPC as one of the clusters
Before adding clusters to the ASM instance, you must use Cloud Enterprise Network (CEN) to connect the cluster VPCs to each other and to the VPC of the Service Mesh. For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Pod |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
/ |
|
Cluster 1 |
192.168.0.0/16 |
192.168.0.0/24 |
10.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
21.0.0.0/8 |
21.0.0.0/16 |
10.1.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
22.0.0.0/8 |
22.0.0.0/16 |
10.2.0.0/16 |
172.18.0.0/16 |
Example 4: The Service Mesh and all clusters are in different VPCs
Before adding clusters to the ASM instance, you must use Cloud Enterprise Network (CEN) to connect the cluster VPCs to each other and to the VPC of the Service Mesh. For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Pod |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
/ |
|
Cluster 1 |
20.0.0.0/8 |
20.0.0.0/16 |
10.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
21.0.0.0/8 |
21.0.0.0/16 |
10.1.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
22.0.0.0/8 |
22.0.0.0/16 |
10.2.0.0/16 |
172.18.0.0/16 |
Clusters on the data plane use Terway
Precautions
-
The service CIDR blocks of different clusters must not overlap.
-
The service CIDR block of a cluster must not overlap with the VPC CIDR block of the ASM instance.
-
The VPC CIDR block of a cluster must not overlap with the VPC CIDR block of the ASM instance.
Planning rule for CIDR blocks
We recommend that you use the following rule to plan the VPC CIDR blocks, vSwitch CIDR blocks, pod CIDR blocks, and service CIDR blocks:
|
Type |
Description |
|
VPC |
We recommend using CIDR blocks in the |
|
vSwitch |
We recommend using CIDR blocks in the |
|
ACK cluster |
|
Examples
Example 1: The Service Mesh and clusters are in the same VPC
|
Object |
VPC |
vSwitch |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
|
Cluster 1 |
192.168.0.0/16 |
192.168.1.0/24 |
172.16.0.0/16 |
|
Cluster 2 |
192.168.0.0/16 |
192.168.2.0/24 |
172.17.0.0/16 |
|
Cluster 3 |
192.168.0.0/16 |
192.168.3.0/24 |
172.18.0.0/16 |
Example 2: All clusters are in the same VPC, but the Service Mesh is in a different VPC
Before adding clusters to the ASM instance, you must connect the VPCs of the clusters and the VPC of the Service Mesh by using Cloud Enterprise Network (CEN). For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
|
Cluster 1 |
20.0.0.0/8 |
20.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
20.0.0.0/8 |
20.1.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
20.0.0.0/8 |
20.2.0.0/16 |
172.18.0.0/16 |
Example 3: All clusters are in different VPCs, and the Service Mesh is in the same VPC as one of the clusters
Before adding clusters to the ASM instance, you must use Cloud Enterprise Network (CEN) to connect the cluster VPCs to each other and to the VPC of the Service Mesh. For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Service |
|
Service Mesh |
20.0.0.0/8 |
20.0.0.0/16 |
/ |
|
Cluster 1 |
20.0.0.0/8 |
20.1.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
21.0.0.0/8 |
21.0.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
22.0.0.0/8 |
22.0.0.0/16 |
172.18.0.0/16 |
Example 4: The Service Mesh and all clusters are in different VPCs
Before adding clusters to the ASM instance, you must use Cloud Enterprise Network (CEN) to connect the cluster VPCs to each other and to the VPC of the Service Mesh. For more information, see Connect networks across regions by using CEN.
|
Object |
VPC |
vSwitch |
Service |
|
Service Mesh |
192.168.0.0/16 |
192.168.0.0/24 |
/ |
|
Cluster 1 |
20.0.0.0/8 |
20.0.0.0/16 |
172.16.0.0/16 |
|
Cluster 2 |
21.0.0.0/8 |
21.0.0.0/16 |
172.17.0.0/16 |
|
Cluster 3 |
22.0.0.0/8 |
22.0.0.0/16 |
172.18.0.0/16 |