Introduction
Component Introduction
The tke-eni-ip-webhook is a hook component used by Tencent Kubernetes Engine (TKE) in VPC-CNI network mode for Pod creation. Upon creation of each Pod, the component receives requests from kube-apiserver as a hook and adds appropriate network resource requests for the newly created Pod, thereby achieving network resource scheduling without the user's perception.
Kubernetes Objects Deployed in the Cluster
The following objects are only deployed in TKE self-deployed clusters (Master&Etcd are under user self-maintenance), while in TKE managed clusters (Master&Etcd are under platform management), the following objects are also managed by the platform and will not be deployed to user clusters.
|
add-pod-eni-ip-limit-webhook | ServiceAccount | - | tke-eni-ip-webhook |
add-pod-eni-ip-limit-webhook | ClusterRole | - | - |
add-pod-eni-ip-limit-webhook | ClusterRoleBinding | - | - |
add-pod-eni-ip-limit-webhook | Service | - | tke-eni-ip-webhook |
add-pod-eni-ip-limit-webhook | Deployment | 0.01 CPU core, 30 MB memory | tke-eni-ip-webhook |
Usage Scenario and Limitation
TKE standard cluster applicable to VPC-CNI network mode.
Component Principle
Background
In TKE VPC-CNI network mode, each node has a quota limit on network resources (for details, see Limits on the Number of Pods in VPC-CNI Mode). To implement network resource scheduling and ensure Pods can obtain IP and other network resources after scheduling, TKE VPC-CNI network mode adds expanded network resources (such as tke.cloud.tencent.com/eni-ip, tke.cloud.tencent.com/eip) to each node and configures corresponding resource requests for Pods. Manually configuring network resources for each Pod is relatively complex. The tke-eni-ip-webhook component can automatically set suitable network resource requests for Pods based on the current cluster network mode and desired network resources, and bind it to the resources.requests and resources.limits fields of the first container.
Working Principles
The tke-eni-ip-webhook component implements the Kubernetes MutatingAdmissionWebhook. Upon startup, it creates a user-created MutatingWebhookConfiguration named add-pod-eni-ip-limit-webhook. This configuration hooks into pod creation. Every time a pod is created, the component receives the hook request from kube-apiserver, then adds the request for corresponding network resources to the newly created pod based on the cluster's network mode and pod network configuration. For example, in shared eni mode, the first container will have the following configurations added: resources:
requests:
tke.cloud.tencent.com/eni-ip: "1"
limits:
tke.cloud.tencent.com/eni-ip: "1"
The latest version currently supports automatically adding network resources:
Shared ENI: tke.cloud.tencent.com/eni-ip
Dedicated ENI: tke.cloud.tencent.com/direct-eni
Trunking ENI: tke.cloud.tencent.com/sub-eni
Elastic IP: tke.cloud.tencent.com/eip