Import Aliyun ACK cluster

Integrate the deployed Alibaba Cloud ACK Managed Kubernetes or Alibaba Cloud ACK Dedicated Kubernetes clusters into the platform for unified management.

Tip: For an introduction to ACK Managed Clusters or Alibaba Cloud ACK Dedicated Clusters, please refer to the official documentation .

Prerequisites

• The Kubernetes version and parameters on the cluster meet the requirements of Access Standard Kubernetes Cluster Component Versions and Parameter Requirements .

Get Image Registry Address

• To use the repository for deploying the platform globally, execute the following command on the control node of the global cluster to obtain the address:

  if [ "$(kubectl get productbase -o jsonpath='{.items[].spec.registry.preferPlatformURL}')" = 'false' ]; then
      REGISTRY=$(kubectl get cm -n kube-public global-info -o jsonpath='{.data.registryAddress}')
  else
      REGISTRY=$(kubectl get cm -n kube-public global-info -o jsonpath='{.data.platformURL}' | awk -F \// '{print $NF}')
  fi
  echo "repositoryAddress is：$REGISTRY"

• If you need to use an external repository, please manually set the REGISTRY variable.

  REGISTRY=<externalrepositoryaddress>  # valid examples such as：registry.example.cn:60080 or 192.168.134.43
  echo "repositoryaddress is：$REGISTRY"

Determine if Additional Configuration Needed for Image Registry

1. Execute the following command to determine if the specified repository supports HTTPS access and uses a certificate issued by a trusted CA authority:

   REGISTRY=<“GetrepositoryAddress”Obtained in sectionrepositoryAddress>
   
   if curl -s -o /dev/null --retry 5 --retry-delay 10 -- "https://${REGISTRY}/v2/"; then
       echo 'Passed the test：repositoryUsing trusted CA Certificate issued by the certification authority。No need to execute“Trust non-securerepository”Content of section。'
   else
       echo 'Failed the test：repositoryNot supported HTTPS，Or certificate is not trusted。Please refer to“Trust non-securerepository”Configure in section。'
   fi

2. If the test fails, please refer to the common question How to trust an insecure repository? .

Get KubeConfig

1. Log in to the Alibaba Cloud Container Service Management Platform.

2. Click Cluster of clusters in the left navigation bar of the console.

3. On the Cluster List page, click on the target cluster name or the Details button under the Actions column on the right side of the target cluster.

4. On the Cluster Information page, click on the Connection Information tab, and then click on Generate Temporary KubeConfig.

5. In the Temporary KubeConfig dialog box, set the expiration period and access method for the temporary credentials (including public network access and intranet access) to access the cluster.

6. Click on Generate Temporary KubeConfig, then click on Copy to save the content to the KubeConfig file on your local machine.

7. After the cluster is successfully connected, the temporary Secret can be revoked.

Cluster of access

1. In the left navigation pane, click Clusters > Cluster of clusters.

2. Click on Cluster of access.

3. Configure the relevant parameters according to the following instructions.

   Parameter	Description
   repository	The repository that stores the images of the platform components required by the cluster. - Default: The repository configured when deploying global. - Private repository: A pre-built repository that stores the platform components. You need to enter the private repository address, port, username, and password to access the repository. - Public repository: Use a repository service located on the public network. Before using it, you need to refer to Updating public network repository cloud credentials to obtain repository authentication permissions.
   Cluster Information	Note: You can manually fill in or upload the KubeConfig file for the platform to automatically parse and fill in. Parse KubeConfig file: After uploading the obtained KubeConfig file, the platform will automatically parse and fill in the Cluster Information, and you can modify the automatically filled information. Cluster Address: The access address of the API Server exposed by the cluster, used for the platform to access the cluster’s API Server. CA Certificate: The CA certificate of the cluster. Note: When manually entering, you need to enter the decoded certificate in Base64. Authentication Method: The authentication method used to access the cluster, which requires using a token or certificate authentication (client certificate and key) with cluster management permissions.

4. Click on Check Connectivity to verify the network connectivity with the connected cluster and automatically identify the type of the connected cluster. The cluster type will be displayed as a badge in the top right corner of the form.

5. After passing the connectivity check, click on Connect and confirm.

   Tip:

6. Use the kubectl command to interact with the Kubernetes cluster.

7. Use the kubectl get command to retrieve information about resources in the cluster.

8. Use the kubectl describe command to get detailed information about a specific resource.

9. Use the kubectl create command to create a new resource in the cluster.

10. Use the kubectl apply command to apply changes to existing resources.

11. Use the kubectl delete command to delete a resource from the cluster.

12. Use the kubectl edit command to edit a resource in the cluster.

13. Use the kubectl logs command to view the logs of a specific pod.

14. Use the kubectl exec command to execute a command in a specific pod.

15. Use the kubectl port-forward command to forward a local port to a port on a specific pod.

16. Use the kubectl scale command to scale the number of replicas of a specific resource.

17. Use the kubectl rollout command to manage rollouts and rollbacks of deployments.

18. Use the kubectl label command to add or remove labels from a specific resource.

19. Use the kubectl annotate command to add or remove annotations from a specific resource.

20. Use the kubectl get events command to view events in the cluster.

21. Use the kubectl top command to view resource usage in the cluster.

22. Use the kubectl config command to manage Kubernetes configuration.

23. Use the kubectl cluster-info command to view information about the cluster.

24. Use the kubectl version command to view the version of the Kubernetes client and server.

25. Use the kubectl explain command to view detailed information about Kubernetes resources and their fields.

    • Click on the icon on the right side of the cluster in the In Progress state to view the cluster’s execution progress (status.conditions) in the popped-up Execution Progress dialog box.

    • After successful cluster access, you can view key information about the cluster in the cluster list. The status of the cluster will be displayed as normal, and you can perform cluster-related operations.

Network Configuration

To ensure global connectivity with the accessed cluster network, please refer to the configuration related to accessing the cluster network .

What’s next

Deployment plugins

After the cluster is successfully connected, you can go to Plugin Management to select the necessary plugins for cluster deployment, including Log Agent, log storage components, etc.

Namespace under the tube cluster

After accessing the cluster, you can add the cluster to an existing project by creating a project based on the cluster or by adding a cluster associated with the project , and associate the newly accessed cluster with the project.

Furthermore, by performing the import namespace operation, existing Kubernetes namespaces within the cluster can be included and managed under the platform’s project.

FAQ

How to deal with the port conflict between Ali Cloud monitoring and platform monitoring components?

When both the monitoring components provided by Alibaba Cloud cluster and the platform monitoring are present, there may be port conflicts. It is recommended to uninstall Alibaba Cloud monitoring and only keep the platform monitoring.

How to use the public network to access Aliyun group?

If you want to access the Alibaba Cloud cluster from the public network, you can bind a public IP on Alibaba Cloud.

The Add node button is grayened after accessing the cluster. How to add nodes?

Alibaba Cloud ACK Managed Cluster and ACK Dedicated Cluster do not support adding nodes in the platform interface. Please add nodes in the background or contact the cluster supplier to add them.

Which certificates are supported by the certificate management function of the access cluster?

1. Kubernetes certificate: All access to the cluster only supports viewing the APIServer certificate information in the platform’s certificate management interface. It does not support viewing other Kubernetes certificates and does not support automatic rotation.

2. Platform Component Certificate: All access to the cluster can view the platform component certificate information in the platform certificate management interface and support automatic rotation.

What other functions do not support access to ** Aliyun ACK hosted cluster ** and **ACK proprietary cluster **?

• Alibaba Cloud ACK Managed Cluster does not support retrieving audit data.

• Alibaba Cloud ACK Managed Cluster does not support monitoring information for ETCD, Scheduler, and Controller Manager, but it does support monitoring charts for APIServer.

• Both Alibaba Cloud ACK Managed Cluster and ACK Dedicated Cluster do not support obtaining cluster certificate-related information other than the Kubernetes APIServer certificate.