Data Planning

Firewalls

Firewalls must meet the requirements listed in the Table 1.

Resource Specifications

UCS on-premises clusters are installed in HA mode to meet DR requirements for commercial use. The following tables list resource specifications.

External Dependencies

Disk Volumes

Load Balancing

If master nodes in an on-premises cluster are deployed in HA mode for DR, a unified IP address is required for the access from cluster compute nodes and other external services. There are two ways to provide access: virtual IP address and load balancer.

• IP addresses

  An idle IP address must be planned as a virtual IP address that can be shared by the three master nodes. The virtual IP address is randomly bound to a master node. When the node becomes abnormal, the virtual IP address is automatically switched to another node to ensure HA.

  Table 6 IP addresses

  IP Type	IP Address	Used For
  Virtual IP address	10.10.11.10 (example)	An IP address used for HA. Plan the IP address based on site requirements.

• Load balancers

  If you have an external load balancer, on-premises clusters can connect to it for HA. Configurations are as follows:

  • Listeners: 3 TCP listeners with three different ports (80, 443, and 5443)
  • Backend server groups: 3 TCP backend server groups with three different ports (corresponding to ports 80, 443, and 5444 of the three master nodes)

    Table 7 lists the requirements for the TCP backend server groups associated with the listeners.

  Table 7 Listeners and TCP backend server groups

  Listener (Protocol/Port)	Backend Server Group	Backend Server and Port
  TCP/80	ingress-http	master-01-IP:80	master-02-IP:80	master-03-IP:80
  TCP/443	ingress-https	master-01-IP:443	master-02-IP:443	master-03-IP:443
  TCP/5443	kube-apiserver	master-01-IP:5444	master-02-IP:5444	master-03-IP:5444

  

  • The external load balancer configuration page varies depending on the load balancer. Configure the preceding mappings based on site requirements.

    If Transfer Client IP Address is enabled for Huawei Cloud ELB, a server cannot serve as both a backend server and a client.

    This is because the backend server will think the packet from the client is sent by itself and will not return a response packet to the load balancer. As a result, the return traffic will be interrupted.

    If Huawei Cloud ELB is used, perform the following operations:

    1. To enable IP as a Backend, click the name of the load balancer to access its details page. On the Summary tab, click Enable for IP as a Backend.
    2. To add backend servers in a VPC different from the VPC of the load balancer by using their IP addresses, click the name of the load balancer to access its details page. On the Listeners tab, click Add Listener. On the Add Backend Servers page, click the IP as Backend Server tab.
    3. Use the Huawei Cloud ELB configuration. For details, see Transfer Client IP Address.

    

    

  • Before installing on-premises clusters, configure the mappings between the TCP listeners and TCP backend server groups for the external load balancer and ensure that the external load balancer is available.
  • The load balancer can route traffic from processes (such as the kubelet process) on all nodes (including master nodes) to three master nodes. In addition, the load balancer can automatically detect and stop routing traffic to unavailable processes, which improves service capabilities and availability. You can also use load balancers provided by other cloud vendors or related hardware devices or use Keepalived and HAProxy to provide HA for master nodes.
  • Recommended configuration: Enable source IP transparency for the preceding listening ports and disable loop checking. If loop checking cannot be disabled separately, disable source IP transparency. To check whether loop checking exists, perform the following steps:
    1. Create an HTTP service on a server that can be accessed over external networks, change default listening port 80 to 88, and add the index.html file for testing.

       yum install -y httpd
       sed -i 's/Listen 80/Listen 88/g' /etc/httpd/conf/httpd.conf
       echo "This is a test page" > /var/www/html/index.html
       systemctl start httpd

       Enter ${IP address of the server}:88 in the address box of a browser. "This is a test page" is displayed.

    2. Configure a listening port, for example, 30088, for the load balancer to route traffic to port 88 of the server, and enable source IP transparency.
    3. Use the private IP address of the load balancer to access the HTTP service.

       curl -v ${ELB_IP}:30088

       Check whether the HTTP status code is 200. If the status code is not 200, loop checking exists.

Users