You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This documentation explains how to deploy Outscale Cloud Controller Manager.
1
+
# 🚀 Deploying the Outscale Cloud Controller Manager (CCM)
2
2
3
-
# Prerequisites
3
+
This documentation explains how to deploy Outscale Cloud Controller Manager (CCM).
4
+
5
+
## ✅ Requirements
4
6
5
7
You will need a Kubernetes cluster on the 3DS Outscale cloud.
6
8
9
+
### Controller Manager and Kubelet configuration
10
+
11
+
When running Kubernetes in the cloud, the `--cloud-provider external` flag is required on the following components:
12
+
*`kube-controller-manager`
13
+
*`kubelet`
14
+
*`kube-apiserver` (up to v1.33)
15
+
16
+
The flag has been removed from `kube-apiserver` in v1.33.
17
+
18
+
The configuration of this flag depends on the bootstrapping tool you use to deploy your cluster.
19
+
When using Cluster-API, the required configuration is:
20
+
21
+
```yaml
22
+
clusterConfiguration:
23
+
apiServer:
24
+
extraArgs:
25
+
cloud-provider: "external"
26
+
controllerManager:
27
+
extraArgs:
28
+
cloud-provider: "external"
29
+
[...]
30
+
initConfiguration:
31
+
nodeRegistration:
32
+
kubeletExtraArgs:
33
+
cloud-provider: external
34
+
[...]
35
+
joinConfiguration:
36
+
nodeRegistration:
37
+
kubeletExtraArgs:
38
+
cloud-provider: external
39
+
```
40
+
41
+
More details can be found in the [Cloud Controller Manager Administration](https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager) documentation.
42
+
43
+
### Nodes
44
+
45
+
Nodes should have a `spec.providerID` set with the following structure `osc:///<subregion>/<VM ID>`
46
+
(for compatibility purposes, `aws:///<subregion>/<VM ID>` is also supported).
47
+
48
+
### Networking
49
+
50
+
The CCM needs to access the [metadata server](https://docs.outscale.com/en/userguide/Accessing-the-Metadata-and-User-Data-of-an-Instance.html) in order to get information about nodes.
51
+
52
+
Access to `169.254.169.254/32` using TCP on port 80 (http) must be allowed from the control-plane nodes.
53
+
54
+
### Configuring Cloud Credentials
55
+
56
+
The CCM needs to access the Outscale API.
57
+
58
+
It is recommended to use a specific [Access Key](https://docs.outscale.com/en/userguide/About-Access-Keys.html) and create an [EIM user](https://docs.outscale.com/en/userguide/About-EIM-Users.html) with limited access. Check the [EIM policy example](eim-policy.example.json) to apply to such EIM user.
59
+
60
+
## ⚙️ Installation
61
+
7
62
> Each major Kubernetes release requires a specific version of the CCM. You will need to install the CCM version tailored for your Kubernetes version.
The tag key must be `OscK8sClusterID/[cluster-id]` (`[cluster-id]` being the ID of a cluster) and tag value can be one of the following values:
20
102
-`shared`: resource is shared between multiple clusters, and should not be destroyed,
21
103
-`owned`: the resource is considered owned and managed by the cluster.
22
104
23
105
The CCM will fetch the `OscK8sClusterID` tag of the node it is running on and will expect to find the other resources with matching tag keys.
24
106
25
-
The Cluster API Provider for Outscale (CAPOSC) sets the `OscK8sClusterID`tag, no need to do anything.
107
+
When using Cluster API Provider for Outscale (CAPOSC), the tag is automatically set, no additional steps are required.
26
108
27
-
##Instances Tagging
109
+
### VM Tagging
28
110
29
-
The CCM is usually able to find instances.
111
+
The CCM is usually able to find VM instances using the `spec.providerID` value.
30
112
31
-
In some rare cases, the CCM needs a `OscK8sNodeName` tag on the VM, with the node name as a value.
113
+
In some rare cases, the CCM will need a `OscK8sNodeName` tag on the VM, with the node name as a value.
32
114
33
-
The Cluster API Provider for Outscale (CAPOSC) sets the tag, no need to do anything.
115
+
When using Cluster API Provider for Outscale (CAPOSC), the tag is automatically set, no additional steps are required.
34
116
35
-
# Creating load-balancers
117
+
## 🚀 Creating load-balancers
36
118
37
-
## Subnets
119
+
###Subnets
38
120
39
121
The CCM will look for a subnet having one of the following tags:
40
122
*`OscK8sRole/service.internal` is service is internal,
41
123
*`OscK8sRole/service` is service is not internal or if no `OscK8sRole/service.internal` subnet is found,
42
124
*`OscK8sRole/loadbalancer` if no subnet found.
43
125
44
-
The Cluster API Provider for Outscale (CAPOSC) automatically sets the `OscK8sRole/loadbalancer` tag to the subnet where the Kubernetes API load-balancer is configured.
126
+
When using Cluster API Provider for Outscale (CAPOSC), the tags are automatically set, no additional steps are required.
45
127
46
-
## Security Groups
128
+
###Security Groups
47
129
48
-
### Ingress
130
+
####Ingress
49
131
50
132
By default, the service controller will automatically create a Security Group for each Load Balancer Unit (LBU) and will attach it to nodes in a VPC setup.
51
133
@@ -57,7 +139,7 @@ The CCM will automatically add manage ingress rules to allow traffic to the load
57
139
58
140
You can set `service.Spec.LoadBalancerSourceRanges` to restrict trafic to a list of IP ranges.
59
141
60
-
### Load-balancer to nodes
142
+
####Load-balancer to nodes
61
143
62
144
The CCM will add rules to allow trafic from the load-balancer to nodes.
63
145
@@ -67,48 +149,7 @@ Within node security groups, it will search for a security group having one of t
67
149
68
150
The Cluster API Provider for Outscale (CAPOSC) sets a `OscK8sRole/worker` tag on all worker nodes, and allows you to add custom roles if needed.
69
151
70
-
## Networking
71
-
72
-
Node controller is deployed as a daemon set on control-plane nodes and will need to access [metadata server](https://docs.outscale.com/en/userguide/Accessing-the-Metadata-and-User-Data-of-an-Instance.html) in order to get information about its node (cpu, memory, addresses, hostname).
73
-
To do this, node controller need to be able to access `169.254.169.254/32` through TCP port 80 (http).
74
-
75
-
## Kubelet
76
-
77
-
Kubelet must be run with `--cloud-provider=external`, (more details in [Cloud Controller Manager Administration](https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager) documentation).
78
-
79
-
## Configuring Cloud Credentials
80
-
81
-
Outscale Cloud Controller Manager needs to access the Outscale API.
82
-
83
-
It is recommended to use a specific [Access Key](https://docs.outscale.com/en/userguide/About-Access-Keys.html) and create an [EIM user](https://docs.outscale.com/en/userguide/About-EIM-Users.html) with limited access. Check [EIM policy example](eim-policy.example.json) to apply to such EIM user.
0 commit comments