Docs

Code Pipeline

Create a hosted application (other)

Create and deploy managed app (container image)

Deploy managed app using container images, not restricted by technology stack or language. This article describes how to quickly create a managed app using container images and deploy it to a Kubernetes cluster.

Prerequisites

The container image to be used is ready. Please prepare the image address in advance, or upload the image to the Volcano Engine Container Registry. For specific operations, see Getting started with pushing and pulling images.

The Kubernetes cluster to be deployed has been connected. For specific operations, see Connecting deployment resources.

warning

To deploy the app using VCI, the deployment resource must be a VKE cluster, and the vci-virtual-kubelet addon must be installed in the cluster in advance.

(Optional) The NAS file system and mount point have been created. The NAS and the VKE cluster to be deployed must be in the same VPC. For specific operations, see Getting started with file storage.

(Optional) To use the IRSA authentication feature, please first complete VKE cluster creation, IAM role creation, and authorization. For operation details, see Using IRSA capability in the cluster. In the IAM role Trust policy Statement, {serviceaccount} corresponds to {App ID-sa} in CP, for example appname-sa.

"Condition": {
"StringLike": {
"oidc:aud": "sts.volcengine.com", // The fixed value of the audience in OIDC.
"oidc:iss": "https://oidc-vke-cn-beijing.tos-cn-beijing.volces.com/ccog93v********", // Set the value to the provider URL displayed in the console after you enable the IRSA feature for your cluster.
"oidc:sub": "system:serviceaccount:oidc-ns:oidc-sa" // Required format: system:serviceaccount:{namespace}:{serviceaccount}, where {namespace} and {serviceaccount} are the namespace and service account in the Kubernetes cluster.
}
},

Procedure

In the left navigation bar, select Workspace.

Click the target workspace name to enter the current workspace.

In the left navigation bar, select App delivery > App management.

On the app management page, click Create app.

On the create app page, select Managed app, and fill in the relevant configuration information as required.

Fill in App information. After completion, click Next: Basic configuration.

Parameter	Description
App ID	According to the interface tips, enter the App ID. The App ID is the unique logo of the App and cannot be changed after creation.
App display name	Customize the application's display name.
App deployment Type	In this scene, select Container.
App technology stack	In this scene, select Others.
Description	Enter notes for the current App. This field can be left blank.
Member management	Quickly configure the members of the current App and assign different permissions to each member to meet the needs of multi-role collaboration for App delivery. Add members: Add multiple members to the current App. Only users with visible permissions in the current workspace can be selected. The system will add the Volcano Engine root user (root user) and the App creator as administrators by default. Permission: The system provides two built-in roles, administrator and Read only. Each member can be assigned one or more role permissions. tip It is not allowed to cancel the administrator permission of the root user, nor to delete the root user.

Fill in Environment configuration. After completion, click Next: Basic configuration.

Parameter	Description
deployment resource	warning To deploy using the VCI Method, the deployment resource must be a VKE Cluster, AND In the cluster, Install the vci-virtual-kubelet addon in advance. select the actual deployment location for the App, for example, Kubernetes Cluster, cloud server, virtual machine, Physical server, and so on. Currently, only Kubernetes Cluster type deployment resource is supported.
Namespace	Select the specific Namespace. Kubernetes uses Namespaces for logical isolation, allowing different groups to share Resources across the entire Cluster while still being managed separately.
Environment ID	Set the unique identifier for the current environment. The default is ${App ID}-prod, custom values are supported. After the environment ID is created successfully, modification is not supported.

Fill in Basic configuration. After completion, click Next: Advanced settings.

Parameter	Description
Deployment method	This scenario selects image deployment.
Image selection	Set application image. Supports CR repository image and custom images methods. Please select as needed. CR repository image: Select container image from your Volcano Engine container registry. Please select the region, instance, namespace, OCI repository, and tag where the target image is located: Region, Instance, Namespace, OCI repository, Tag. Custom images: Directly enter the image address used by the App. The image address format is host/namespace/repo:tag.
Image pull authentication	To Use a Private Image, turn on the Image pull authentication switch and enter the correct Container Registry username and Password.
Version	Custom App version number. You can click Version number uses timestamp on the right to automatically generate the version number.
VCI	warning If you select VCI Deploy application, the deployment resource must be a VKE Cluster, AND you must Install the vci-virtual-kubelet addon in the Cluster in advance. VCI does Not support Pod IRSA (IAM Roles for Service Accounts) OIDC (OpenID Connect) feature. IRSA is a security mechanism that allows applications in a VKE cluster to use Volcano Engine IAM roles through Kubernetes service accounts. For details about IRSA, see IRSA overview. Whether to Deploy application using the VCI method. Deploying application using this method does not require Management of underlying cloud servers or other infrastructure. You only need to provide the Image to run the Container and pay for the Actual Resources consumed. For Billing details, see VCI Instructions. If checked, the App will be deployed using the VCI method. If not checked, the App will be deployed using the standard Kubernetes method.
Service specifications	Define the App's Service specifications according to business requirements, including: Number of instances, CPU and Memory specifications for each Instance. Support Default Specifications and Custom specification. Default Specifications: Support Custom Number of instances and provide common CPU and Memory combinations. Please select the appropriate combination according to business needs. In Default Specifications, CPU request = CPU limit; Memory request = Memory limit. Custom specification: If Default Specifications cannot meet your requirements, Custom specification is supported, including: Custom Number of instances, CPU request, CPU limit, Memory request, Memory limit. Among them, CPU request ≤ CPU limit; Memory request ≤ Memory limit. tip For deployments using the VCI Method, only the upper limit for CPU and Memory needs to be defined. System will provide the closest VCI Instance specification based on the upper limit you select. For deployments using the standard Kubernetes Method, CPU and Memory are allowed to have No limit on Resources.

(Optional) Fill in Advanced settings.

Start command

Parameter

Description

Start method

Configure the app's start method. The following two start methods are supported. Please select as needed.

Cloud-native command: Specify the start command and start parameters according to business requirements. If not filled in, the app will be started according to the image ENTRYPOINT configuration.

Custom script: If a series of initialization scripts need to be executed before the app starts, it is recommended to start the app by writing a custom script.

Container permission and IAM

1 parameter	Description
Pod IRSA OIDC	After enabling, the IRSA (IAM Role for Service Account) mechanism is supported at the pod level. The IRSA mechanism associates a specific IAM role with a service account. This enables pods running in a VKE cluster to obtain the permissions granted to the role through the service account. In this way, the pods can access corresponding cloud service resources. For a detailed introduction to IRSA, see IRSA overview.
IAM role	Select the IAM role associated with this App. For details about IAM role creation and authorization Actions, see Use IRSA capability in the cluster. In the IAM role trust policy Statement, {serviceaccount} corresponds to {App ID-sa} in CP, for example, appname-sa.
Credential file address	IAM credential file path, default is /var/run/secrets/iam/credential. After specifying the value, it will be automatically written into the app deployment YAML to support IRSA identity authorization.

Environment variable

Parameter	Description
Environment variable	Configure environment variables as needed. The information of environment variables will be injected into the app's runtime environment to dynamically configure the application during runtime. Click + Environment variable and enter the key and value of the environment variable.

Health check

The current setting is a liveness check: checks whether the Container is running. If the probe fails, the Container will be restarted.

Parameter	Description
Check method	HTTP request check: Use the HTTP or HTTPS protocol to send an HTTP GET request to the Container. Pass the response to confirm the Container state. You need to check the following items: Protocol: Select HTTP or HTTPS. Request header: Custom request headers (HTTP Headers) in the HTTP request. Click Add, then enter the key and value for the request header. Path: Enter the access path in your business code for health check. Default is /. Modify is supported. Port: Enter the access port of the App. Default is 8080. Modify is supported. TCP port check: Send a TCP socket to the App to detect whether a normal connection can be established. You need to check the following items: Port: Enter the access port of the App. Default is 8080. Modify is supported.
Time setting	Specify the time parameters for the check. Valid values: Initial wait time: Refers to the time to wait before the first probe after the app starts. The default is 1 s. Timeout: The amount of time that you wait for a response after you send a check request. Exceeding this time indicates the App is unresponsive. The Default is 1 s. Check interval: the time interval at which checks are performed. Default value: 10 seconds.
Threshold setting	Configure the result threshold for the check, including: Success threshold: The number of successful responses that indicates the system runs as expected after a check request is sent. Default value: 1. This parameter cannot be specified. Failure threshold: The number of consecutive failed responses that indicate the system is abnormal after a check request is sent. Default value: 3. If the App does not respond to the request 3 times, the application status is considered abnormal.

Storage configuration

Click add storage mount to mount storage configuration for the current App instance. Supports mounting multiple storage.

Parameter	Description
Type	Currently supports NAS mount.
File system type	Select the file system type. Support Extreme speed and Capacity type. NAS and the to be deployed VKE Cluster must be in the same VPC.
Mount point	select the File system and Mount point to mount.
Subdirectory	Enter the subdirectory information of the file system to be mounted. The default is the root directory /.
Mount path	Path mounted to the managed app instance.

Custom labels

Parameter	Description
Tag	App Tag (Label). After you add key-value pairs, other resources can easily identify this App.
Annotation	App annotation (Annotation). After adding annotation key-value pairs, they can be used to store app configuration and other additional information.

App monitoring

Click add storage mount to mount storage configuration for the current App instance. Supports mounting multiple storage.

Parameter	Description
APMPlus	After turning on APMPlus Monitoring metrics, Support Pass Trace for link tracing to locate business link issues, and Support to view the App's related Runtime metrics. For the cost of APMPlus Monitoring Service, see Monitor Billing Description.
Monitor application type	Select the corresponding Monitoring Type according to your App programming language. According to the configuration in App information > App technology stack, the selectable language types are as follows: When Java is selected, Java is automatically selected. When Others is selected, Java, Python, and Node.js are supported.
Monitor Service Name	Configure the monitoring service Name. This Name will be used as the current App Name and shown in the service list of the APMPlus server Console, making it easier to distinguish between different monitoring tasks. If this Name is not specified, the Default App ID will be used.

Click confirm to start deploying the App. You can view the App's deployment progress in the environment tab.

Operation result

After deploy is complete, the deployment state will change to Completed. You can view the deployed instance information in the list of instances tab. A running state of running indicates deploy success.

View real-time log: Click real-time log to view real-time log information for the instance, which is helpful for operations and troubleshooting.

View event: Click event to view event information that occurred within the past hour for the instance.

Subsequent operations

Create Service resources for the App to enable public network and private network access. For specific operations, see Access method.

Last updated: 2026.03.30 17:43:36