Access standard Kubernetes clusters

Supports the integration of standard native Kubernetes clusters deployed through kubeadm into the platform for unified management.

Explanation of nouns

Prerequisites

• The versions and parameters of Kubernetes components on the cluster meet the requirements of the Access Standard for Kubernetes Cluster Component Versions and Parameters .

• If the runtime component of the cluster is Containerd, you need to modify the Containerd configuration before connecting to the cluster to ensure the successful deployment of distributed storage.

Get Image Registry Address

• If you need to use the repository for platform deployment when deploying globally, execute the following command on the control node of the global to obtain the address:

  if [ "$(kubectl get productbase -o jsonpath='{.items[].spec.registry.preferPlatformURL}')" = 'false' ]; then
      REGISTRY=$(kubectl get cm -n kube-public global-info -o jsonpath='{.data.registryAddress}')
  else
      REGISTRY=$(kubectl get cm -n kube-public global-info -o jsonpath='{.data.platformURL}' | awk -F \// '{print $NF}')
  fi
  echo "repositoryAddress is：$REGISTRY"

• If you need to use an external repository, please manually set the REGISTRY variable.

  REGISTRY=<externalrepositoryaddress>  # valid examples such as：registry.example.cn:60080 or 192.168.134.43
  echo "repositoryaddress is ：$REGISTRY"

Determine if Additional Configuration Needed for Image Registry

1. Execute the following command to determine if the specified repository supports HTTPS access and uses a certificate issued by a trusted CA authority:

   REGISTRY=<“GetrepositoryAddress”Obtained in SectionrepositoryAddress>
   
   if curl -s -o /dev/null --retry 5 --retry-delay 10 -- "https://${REGISTRY}/v2/"; then
       echo 'Passed the Check：repositoryUsing Trusted CA Certificate Issued by Certification Authority。No Need to Execute“Trust Non-Securerepository”Content of Section。'
   else
       echo 'Failed the Check：repositoryNot Supported HTTPS，Or Certificate is Not Trusted。Please Refer to“Trust Non-Securerepository”Configure in Section。'
   fi

2. If the verification fails, please refer to the common problem How to trust an insecure repository? .

Get cluster information

Please refer to the FAQ How to fetch cluster information? .

Cluster of access

1. In the left navigation pane, click Clusters > Cluster of clusters.

2. Click on Cluster of access.

3. Configure the relevant parameters according to the following instructions.

1. Click on Check Connectivity to test the network connectivity with the connected cluster and automatically identify the type of the connected cluster. The cluster type will be displayed as a badge in the top right corner of the form.

2. After passing the connectivity check, click on Connect and confirm.

   Tips:

   • Click on the icon on the right side of the cluster in the In Progress state to view the execution progress of the cluster (status.conditions) in the popped-up Execution Progress dialog box.

   • After successful cluster access, you can view key information about the cluster in the cluster list. The status of the cluster is displayed as normal, and you can perform cluster-related operations.

Network Configuration

To ensure global connectivity with the connected cluster network, please refer to the configuration for accessing the cluster network .

What’s next

Deployment plugins

After successfully accessing the cluster, you can go to Plugin Management to select the necessary plugins for cluster deployment, including monitoring components, Log Agent, log storage components, etc.

Configure cluster audit capabilities

After successfully accessing the cluster, it is necessary to modify the audit-related configuration on the cluster in order to collect the audit data of the cluster through the platform. For specific operations, please refer to How to configure the audit function of a standard Kubernetes cluster accessed by the platform? .

Enable Pod Debug

After successfully accessing the cluster, if you need to use the Pod Debug feature, please refer to How to enable Pod Debug feature in the accessed cluster? .

Namespace under the tube cluster

After successfully accessing the cluster, you can add the cluster to an existing project by creating a project based on the cluster or by adding a cluster to an existing project , thus associating the newly accessed cluster with the project.

Furthermore, by performing the import namespace operation, existing Kubernetes namespaces within the cluster can be included and managed under the platform’s project.

FAQ

The Add node button is grayened after accessing the cluster. How to add nodes?

Both Managed Kubernetes Cluster and Unmanaged Kubernetes Cluster do not support adding nodes in the platform interface. Please add nodes in the background or contact the cluster provider to add them.

Which certificates are supported by the certificate management function of the access cluster?

1. Kubernetes certificate: All access to the cluster only supports viewing the APIServer certificate information in the platform’s certificate management interface. It does not support viewing other Kubernetes certificates and does not support automatic rotation.

2. Platform Component Certificate: All access to the cluster can view the platform component certificate information in the platform certificate management interface and support automatic rotation.

What features do not support connected Kubernetes clusters?

• Managed Kubernetes clusters do not support retrieving audit data.

• Managed Kubernetes clusters do not support monitoring information related to ETCD, Scheduler, and Controller Manager, but they do support monitoring charts for the APIServer.

• Managed Kubernetes clusters and unmanaged Kubernetes clusters do not support obtaining cluster certificate-related information other than the Kubernetes APIServer certificate.

How to Solve Distributed Storage Deployment Failure Issue when Access Cluster Runtime is Containerd?

When the runtime component connected to the cluster is Containerd, the deployment of distributed storage will fail. To resolve this issue, you need to manually modify the Containerd configuration information on all nodes of the cluster and restart Containerd.

Note: If you perform the following steps to modify the Containerd configuration before deploying distributed storage, you do not need to perform step four.

1. Log in to the cluster node and edit the /etc/systemd/system/containerd.service file. Modify the value of the LimitNOFILE parameter to 1048576.

2. Execute the command systemctl daemon-reload to reload the configuration.

3. Execute the command systemctl restart containerd to restart Containerd.

4. Execute the command kubectl delete pod --all -n rook-ceph on the cluster control node to restart all Pods within the rook-ceph namespace and apply the configuration.