-
Notifications
You must be signed in to change notification settings - Fork 65
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #102 from rancherfederal/fix-examples
Fix examples
- Loading branch information
Showing
20 changed files
with
440 additions
and
113 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| # examples | ||
|
|
||
| [cloud-enabled](./cloud-enabled/): Shows a cluster with nodepools having the appropriate IAM policies and tags to enable using `cloud-provider-aws`, `cluster-autoscaler`, and `ebs-csi-driver` with KMS volume encryption. | ||
|
|
||
| [public-lb](./public-lb/): Shows a cluster with nodepools in private VPC subnets with the API server fronted by an Internet-facing load balancer. | ||
|
|
||
| [quickstart](./quickstart/): Minimal deployment with automated kubeconfig fetching and ssh to cluster nodes allowed from anywhere on the Internet. | ||
|
|
||
| ## AMI queries | ||
|
|
||
| The Terraform data resource `aws_ami` constructs an API query such that the block of hcl below: | ||
|
|
||
| ```hcl | ||
| data "aws_ami" "rhel9" { | ||
| most_recent = true | ||
| owners = ["219670896067"] | ||
| filter { | ||
| name = "name" | ||
| values = ["RHEL-9*"] | ||
| } | ||
| filter { | ||
| name = "architecture" | ||
| values = ["x86_64"] | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| Is equivalent to the AWS CLI call: | ||
|
|
||
| ```sh | ||
| aws ec2 describe-images \ | ||
| --owners 219670896067 \ | ||
| --filter "Name=name,Values=RHEL-9*" \ | ||
| --filter "Name=architecture,Values=x86_64" \ | ||
| --query "reverse(sort_by(Images, &CreationDate))[0]" | ||
| ``` | ||
|
|
||
| ## Interacting with your cluster | ||
|
|
||
| The `cloud-init` user-data scripts provided with this module always upload the default admin kubeconfig from `/etc/rancher/rke2/rke2.yaml` to the S3 statestore bucket upon successful startup of the `rke2-server` service on the first cluster node, editing the localhost server URL to use the DNS name of the load balancer. Some examples demonstrate a Terraform null resource to download this. To download using AWS CLI and then use it: | ||
|
|
||
| ```sh | ||
| aws s3 cp s3://public-lb-gkw-rke2/rke2.yaml . | ||
| chmod 0600 rke2.yaml | ||
| export KUBECONFIG="$(pwd)/rke2.yaml" | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,37 @@ | ||
| # AWS Cloud Enabled RKE2 | ||
|
|
||
| This example demonstrates configuring `rke2` with the in tree AWS Cloud Controller Manager (CCM). | ||
| This example demonstrates configuring `rke2` with the Kubernetes `cloud-provider-aws`. | ||
|
|
||
| The `rke2` configuration file option is used to configure `cloud-provider-name: aws`. | ||
| The in-tree provider is now deprecated and removed completely as of Kubernetes v1.27. The flag to the kubelet to provide a cloud-provider name at all has also been deprecated since v1.24 and is subject to removal at any time. Thus, we will show how to install the out-of-tree provider and autoscaler instead. | ||
|
|
||
| Now, however, that until [cloud-provider-aws/746](https://github.com/kubernetes/cloud-provider-aws/issues/746) is fixed, we need to continue passing `cloud-provider-name: external` to `rke2`, which will still work as of Kubernetes v1.28. | ||
|
|
||
| Note that resource tagging is extremely important when enabling the AWS CCM, as it is how the controller identifies resources for things such as autoprovisioning load balancers. | ||
|
|
||
| Regardless of the aws provider being explicitly declared, all resources created by `rke2-aws-tf` are tagged appropriately. However, there are resources not owned by `rke2-aws-tf` proper, such as VPC's and Subnets. This example explicitly declares VPCs and Subnets with the appropriate tags so you can get a feel for all the required resources in your own environment. | ||
|
|
||
| Also see [kubernetes/website/42770](https://github.com/kubernetes/website/issues/42770). We need to tell the Kubernetes Controller Manager here not to try and configure node CIDRs and cloud routes because Calico does not need these. All of the supported CNIs for `rke2` should be using vxlan or something equivalent, not setting routes in the VPC route table directly. | ||
|
|
||
| ## `cloud-provider-aws` | ||
|
|
||
| ```sh | ||
| helm repo add aws-cloud-controller-manager https://kubernetes.github.io/cloud-provider-aws | ||
| helm repo update | ||
| helm install aws-cloud-controller-manager aws-cloud-controller-manager/aws-cloud-controller-manager \ | ||
| --namespace kube-system \ | ||
| --set-json 'args=["--v=2", "--cloud-provider=aws", "--allocate-node-cidrs=false", "--configure-cloud-routes=false"]' \ | ||
| --set-string 'nodeSelector.node-role\.kubernetes\.io/control-plane=true' | ||
| ``` | ||
|
|
||
| ## `cluster-autoscaler` | ||
|
|
||
| Match region to your actual region, but it is `us-gov-west-1` in this example. | ||
|
|
||
| ```sh | ||
| helm repo add autoscaler https://kubernetes.github.io/autoscaler | ||
| helm repo update | ||
| helm install autoscaler autoscaler/cluster-autoscaler \ | ||
| --namespace kube-system \ | ||
| --set autoDiscovery.clusterName=cloud-enabled-zjl \ | ||
| --set awsRegion=us-gov-west-1 | ||
| ``` |
Oops, something went wrong.