VCI supports the in-place restart of VCI pods based on the in-place upgrade feature of OpenKruise. This topic describes how to use OpenKruise to perform in-place upgrades for VCI pods.

Background information

OpenKruise is an extension suite based on Kubernetes, which mainly focuses on the automation of cloud-native applications, such as deployment, release, operation and maintenance, and availability protection. You can perform in-place upgrades for pods within workloads by deploying OpenKruise in VKE. For more details, see OpenKruise in-place upgrade.

Usage instructions

The in-place upgrade feature applies to container images and part of metadata, such as annotation and label.

The in-place upgrade feature applies to the following workloads:

CloneSet

Advanced StatefulSet

Advanced DaemonSet

SidecarSet

Prerequisites

A cluster that uses VCI has been created. For details, see Using VCI in VPC-CNI clusters and Using VCI in Flannel clusters.

The cluster has been connected using kubectl. For details, see Connecting to clusters.

Procedure

Scenario 1: Updating container images

Install OpenKruise in the VCI business cluster. The name of the application template for OpenKruise is Kruise. For details, see Application templates.

Use kubectl to create a workload for OpenKruise and deploy it to VCI. The following vci-openkruise.yaml file serves as an example:

apiVersion: apps.kruise.io/v1alpha1
kind: CloneSet
metadata:
labels:
app: vci-cloneset
name: vci-cloneset
spec:
replicas: 5 # The number of replicas for the CloneSet.
selector:
matchLabels:
app: vci-cloneset
template:
metadata:
annotations:
vke.volcengine.com/burst-to-vci: enforce # Force deployment to VCI.
labels:
app: vci-cloneset
spec:
containers:
- name: nginx
image: doc-cn-beijing.cr.volces.com/vke/nginx-demo:v1.0 # The address and version of the container image. Replace the value with your actual information.

Run the following command to create a workload for OpenKruise. In this example, a CloneSet is created.

kubectl apply -f ${CloneSet YAML file path}

The command in this example is as follows:

kubectl apply -f vci-openkruise.yaml

After you create the workload, view and record the pod name and VCI ID.

Run the following command to obtain the pod name under CloneSet.

kubectl get pods -l ${CloneSet-related label key}=${label value}

The command in this example is as follows:

kubectl get pods -l cloneset=vci-cloneset

Obtain the pod name from the NAME field in the returned information.

Run the following command to view pod details and obtain the VCI ID.

kubectl describe pod ${Pod name}

The command in this example is as follows:

kubectl describe pod vci-cloneset-79886764b9-fm7tn

Obtain the VCI ID from the annotation vci.vke.volcengine.com/instance-id in the returned information.

Modify the YAML file of the workload to verify the in-place pod restart capability. Replace the value of the image field with a container image of another version. The following sample code shows the YAML content.

apiVersion: apps.kruise.io/v1alpha1
kind: CloneSet
metadata:
labels:
app: vci-cloneset
name: vci-cloneset
spec:
replicas: 5
selector:
matchLabels:
app: vci-cloneset
template:
metadata:
annotations:
vke.volcengine.com/burst-to-vci: enforce # Force deployment to VCI.
labels:
app: vci-cloneset
spec:
containers:
- name: nginx
image: doc-cn-beijing.cr.volces.com/vke/nginx-demo:v2.0 # The address and version of the container image. Replace the value with your actual information. In this example, the original image tag 1.0 is replaced with 2.0.

View the update status of the workload (CloneSet is used in this example) and wait for the pod restart to complete.

kubectl get cloneset -n ${CloneSet namespace} ${CloneSet name}

The expected output is as follows, which indicates that the pod is restarted.

NAME DESIRED UPDATED UPDATED_READY READY TOTAL AGE
vci-cloneset 1 1 0 0 1 2d5h

Run the command described in Step 4 to view and record the pod name and VCI ID in the workload again.

The pod will pull the image again, but the pod name and VCI ID will not change.

Scenario 2: Updating container metadata

Install OpenKruise in the VCI business cluster. The name of the application template for OpenKruise is Kruise. For details, see Application templates.

Use kubectl to create a workload for OpenKruise and deploy it to VCI. The following vci-openkruise-demo.yaml file serves as an example:

apiVersion: apps.kruise.io/v1alpha1
kind: CloneSet
metadata:
labels:
app: env001
name: env001
namespace: long123
spec:
replicas: 1
selector:
matchLabels:
app: env001
template:
metadata:
annotations:
aaa: ooo
vci.volcengine.com/tls-enable: "false" # Disable log collection.
vke.volcengine.com/burst-to-vci: enforce # Force deployment to VCI.
labels:
app: env001
ccc: hhh
eee: ggg
spec:
containers:
- env:
- name: vci-c1
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.annotations['aaa']
- name: vci-c2
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.labels['ccc']
image: vci-cn-beijing.cr.volces.com/vci_qa_20220506/debian-long:1.0.4 # The address and version of the container image. Replace the value with your actual information.
imagePullPolicy: IfNotPresent
name: c1
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
args:
- -c
- sleep 3000
command:
- /bin/bash
- env:
- name: vci-c1
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.annotations['aaa']
- name: vci-c2
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.labels['ccc']
image: vci-cn-beijing.cr.volces.com/vci_qa_20220506/debian-long:1.0.4 # The address and version of the container image. Replace the value with your actual information.
imagePullPolicy: IfNotPresent
name: c2
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30

Run the following command to create a workload for OpenKruise. In this example, a CloneSet is created.

kubectl apply -f ${CloneSet YAML file path}

The command in this example is as follows:

kubectl apply -f vci-openkruise-demo.yaml

After you create the workload, view and record the pod name and VCI ID.

Run the following command to obtain the pod name under CloneSet.

kubectl get pods -l ${CloneSet-related label key}=${label value}

The command in this example is as follows:

kubectl get pods -l cloneset=venv001

Obtain the pod name from the NAME field in the returned information.

Run the following command to view pod details and obtain the VCI ID.

kubectl describe pod ${Pod name}

The command in this example is as follows:

kubectl describe pod vci-cloneset-98346566b9-a3htn

Obtain the VCI ID from the annotation vci.vke.volcengine.com/instance-id in the returned information.

Modify the YAML file of the workload to verify the in-place pod restart capability. Update annotation and label under the metadata of the container based on the following example.

apiVersion: apps.kruise.io/v1alpha1
kind: CloneSet
metadata:
labels:
app: env001
name: env001
namespace: long123
spec:
replicas: 1
selector:
matchLabels:
app: env001
template:
metadata:
annotations:
aaa: abc # Modify the label value. For example, change ooo to abc.
vci.volcengine.com/tls-enable: "false"
vke.volcengine.com/burst-to-vci: enforce
labels:
app: env001
ccc: def # Modify the label value. For example, change hhh to def.
eee: ggg
spec:
containers:
- env:
- name: vci-c1 # The container name.
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.annotations['aaa']
- name: vci-c2 # The container name.
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.labels['ccc']
image: vci-cn-beijing.cr.volces.com/vci_qa_20220506/debian-long:1.0.4 # The address and version of the container image. Replace the value with your actual information.
imagePullPolicy: IfNotPresent
name: c1
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
args:
- -c
- sleep 3000
command:
- /bin/bash
- env:
- name: vci-c1
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.annotations['aaa']
- name: vci-c2
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.labels['ccc']
image: vci-cn-beijing.cr.volces.com/vci_qa_20220506/debian-long:1.0.4 # The address and version of the container image. Replace the value with your actual information.
imagePullPolicy: IfNotPresent
name: c2
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30

View the update status of the workload (CloneSet is used in this example) and wait for the pod restart to complete.

kubectl get cloneset -n ${CloneSet namespace} ${CloneSet name}

The expected output is as follows, which indicates that the pod is restarted.

NAME DESIRED UPDATED UPDATED_READY READY TOTAL AGE
env001 1 1 0 0 1 1d5h

Access the corresponding container to check whether the env information of the container has been updated.

kubectl exec ${Pod name} -n ${Pod namespace} -c ${Container name} --env

The label value of the container has changed, but the pod name and VCI ID will not change.

Volcengine Kubernetes Engine