You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The chart requires three distinct vSphere access secrets:
129
+
Cluster API Provider vSphere (CAPV) supports multiple methods to provide vCenter credentials and authorize clusters to use them:
131
130
132
-
1.**Cluster API Secret** (default name `vsphere-secret`)
133
-
- Used by Cluster API to provision VMs
134
-
- Contains vSphere credentials for infrastructure operations
131
+
-**Secrets**: credentials are provided via `secret` used by `VSphereCluster`. This will create a unique relationship between the `VSphereCluster` and `secret` and the `secret` cannot be utilized by other clusters.
135
132
136
-
2.**Cloud Controller Manager Secret** (default name `vsphere-config-secret`)
137
-
- Used by the vSphere Cloud Provider Interface
138
-
- Contains configuration for vCenter
133
+
-**VSphereClusterIdentity**: credentials are provided via `VSphereClusterIdentity`, a cluster scoped resource and enables multiple `VSphereClusters` to share the same set of credentials. The namespaces that are allowed to use the `VSphereClusterIdentity` can also be configured via a `LabelSelector`.
139
134
140
-
3.**CSI Controller Secret** (default name `csi-config-secret`)
141
-
- Used by the Storage Controller Manager
142
-
- Enables volume provisioning and attachment
135
+
More details on the CAPV documentation: [Cluster API Provider vSphere](https://github.com/kubernetes-sigs/cluster-api-provider-vsphere)
143
136
144
-
You can leave the chart to create these secrets or reference existing ones:
137
+
### Credentials through Secrets
138
+
The chart creates three secrets by default, one for each component that requires vSphere credentials. These secrets are created in the same namespace as the `Cluster` resource and are labeled with the cluster name:
145
139
146
140
```yaml
147
-
# Using existing secrets
148
-
vsphere:
149
-
secret:
150
-
create: false
151
-
name: vsphere-secret
141
+
# Create the vsphere-secret for Cluster API
142
+
cat <<EOF | kubectl apply -f -
143
+
apiVersion: v1
144
+
kind: Secret
145
+
metadata:
146
+
name: vsphere-secret
147
+
namespace: my-cluster
148
+
labels:
149
+
cluster.x-k8s.io/cluster-name: "my-cluster"
150
+
stringData:
151
+
username: "administrator@vsphere.local"
152
+
password: "YOUR_PASSWORD"
153
+
EOF
154
+
```
152
155
153
-
vSphereCloudControllerManager:
154
-
secret:
155
-
create: false
156
-
name: vsphere-config-secret
157
-
158
-
vSphereStorageControllerManager:
159
-
secret:
160
-
create: false
161
-
name: csi-config-secret
156
+
```yaml
157
+
# Create the vsphere-config-secret for Cloud Controller Manager
158
+
cat <<EOF | kubectl apply -f -
159
+
apiVersion: v1
160
+
kind: Secret
161
+
metadata:
162
+
name: vsphere-config-secret
163
+
namespace: my-cluster
164
+
labels:
165
+
cluster.x-k8s.io/cluster-name: "my-cluster"
166
+
stringData:
167
+
vsphere.conf: |
168
+
global:
169
+
port: 443
170
+
insecure-flag: false
171
+
password: "YOUR_PASSWORD"
172
+
user: "administrator@vsphere.local"
173
+
thumbprint: "YOUR_VCENTER_THUMBPRINT"
174
+
vcenter:
175
+
vcenter.example.com:
176
+
datacenters:
177
+
- "YOUR_DATACENTER"
178
+
server: "vcenter.example.com"
179
+
EOF
162
180
```
163
181
164
-
### Create Cluster API Secret
182
+
```yaml
183
+
# Create the csi-config-secret for Storage Controller
184
+
cat <<EOF | kubectl apply -f -
185
+
apiVersion: v1
186
+
kind: Secret
187
+
metadata:
188
+
name: csi-config-secret
189
+
namespace: my-cluster
190
+
labels:
191
+
cluster.x-k8s.io/cluster-name: "my-cluster"
192
+
stringData:
193
+
csi-vsphere.conf: |
194
+
[Global]
195
+
cluster-id = "namespace/my-cluster"
196
+
thumbprint = "YOUR_VCENTER_THUMBPRINT"
197
+
insecure-flag = false
198
+
[VirtualCenter "vcenter.example.com"]
199
+
user = "administrator@vsphere.local"
200
+
password = "YOUR_PASSWORD"
201
+
datacenters = "YOUR_DATACENTER"
202
+
EOF
203
+
```
165
204
166
-
```bash
205
+
### Credentials through VSphereClusterIdentity
206
+
The chart can also be configured to use `VSphereClusterIdentity` for managing vSphere credentials. This allows multiple clusters to share the same credentials.
207
+
208
+
Deploy a secret with the credentials in the CAPV manager namespace (capv-system by default):
209
+
210
+
```yaml
167
211
# Create the vsphere-secret for Cluster API
168
212
cat <<EOF | kubectl apply -f -
169
213
apiVersion: v1
170
214
kind: Secret
171
215
metadata:
172
216
name: vsphere-secret
217
+
namespace: capv-system
173
218
labels:
174
219
cluster.x-k8s.io/cluster-name: "my-cluster"
175
220
stringData:
@@ -178,15 +223,32 @@ stringData:
178
223
EOF
179
224
```
180
225
181
-
### Create Cloud Controller Manager Secret
226
+
Deploy a `VSphereClusterIdentity` that references the secret above. The `allowedNamespaces` selector can also be used to control which namespaces are allowed to use the identity:
| cluster.controlPlane.kubelet.preferredAddressTypes | list |`["InternalIP","ExternalIP","Hostname"]`| kubelet preferredAddressTypes order |
331
-
| cluster.controlPlane.labels | object |`{"cni":"calico"}`| Labels to add to the control plane |
332
-
| cluster.controlPlane.network.certSANs | list |`[]`| List of additional Subject Alternative Names to use for the API Server serving certificate |
333
-
| cluster.controlPlane.network.serviceAddress | string |`""`| Address used to expose the Kubernetes API server. If not set, the service will be exposed on the first available address. |
334
-
| cluster.controlPlane.network.serviceAnnotations | object |`{}`| Annotations to use for the control plane service |
335
-
| cluster.controlPlane.network.serviceLabels | object |`{}`| Labels to use for the control plane service |
336
-
| cluster.controlPlane.network.serviceType | string |`"LoadBalancer"`| Type of service used to expose the Kubernetes API server |
337
-
| cluster.controlPlane.replicas | int |`2`| Number of control plane replicas |
338
-
| cluster.controlPlane.version | string |`"v1.31.0"`| Kubernetes version |
339
-
| cluster.metrics.enabled | bool |`false`| Enable metrics collection. ServiceMonitor custom resource definition must be installed on the Management cluster. |
340
-
| cluster.metrics.serviceAccount | object |`{"name":"kube-prometheus-stack-prometheus","namespace":"monitoring-system"}`| ServiceAccount for scraping metrics |
341
-
| cluster.metrics.serviceAccount.name | string |`"kube-prometheus-stack-prometheus"`| ServiceAccount name used for scraping metrics |
| nodePools[0].autoscaling.labels.autoscaling | string |`"enabled"`| Labels to use for autoscaling: make sure to use the same labels on the autoscaler configuration |
352
-
| nodePools[0].autoscaling.maxSize | string |`"6"`| Maximum number of instances in the pool |
353
-
| nodePools[0].autoscaling.minSize | string |`"2"`| Minimum number of instances in the pool |
354
-
| nodePools[0].dataStore | string |`"datastore"`| VSphere datastore to use |
355
-
| nodePools[0].dhcp4 | bool |`false`| Use dhcp for ipv4 configuration |
356
-
| nodePools[0].diskGiB | int |`40`| Disk size of VM in GiB |
357
-
| nodePools[0].folder | string |`"default-pool"`| VSphere folder to store VMs |
358
-
| nodePools[0].memoryMiB | int |`4096`| Memory to allocate to worker VMs |
359
-
| nodePools[0].name | string |`"default"`||
360
-
| nodePools[0].nameServers | list |`["8.8.8.8"]`| Nameservers for VMs DNS resolution if required |
361
-
| nodePools[0].network | string |`"network"`| VSphere network for VMs and CSI |
362
-
| nodePools[0].numCPUs | int |`2`| Number of vCPUs to allocate to worker instances |
363
-
| nodePools[0].replicas | int |`3`| Number of worker VMs instances |
364
-
| nodePools[0].resourcePool | string |`"*/Resources"`| VSphere resource pool to use |
365
-
| nodePools[0].staticRoutes | list |`[]`| Static network routes for VMs if required |
366
-
| nodePools[0].storagePolicyName | string |`""`| VSphere storage policy to use |
367
-
| nodePools[0].template | string |`"ubuntu-2204-kube-v1.31.0"`| VSphere template to clone |
368
-
| nodePools[0].users | list |`[{"name":"ubuntu","sshAuthorizedKeys":[],"sudo":"ALL=(ALL) NOPASSWD:ALL"}]`| Search domains suffixes if required searchDomains: [] # -- VM network domain if required domain: "" # -- IPv4 gateway if required gateway: "" # -- users to create on machines |
369
-
| vSphere.dataCenter | string |`"datacenter"`| Datacenter to use |
370
-
| vSphere.insecure | bool |`false`| If vCenter uses a self-signed cert |
| vSphereCloudControllerManager.version | string |`"v1.31.0"`| Version of the vsphere-cloud-controller-manager to install. The major and minor versions of releases should be equivalent to the compatible upstream Kubernetes release. |
385
-
| vSphereStorageControllerManager.enabled | bool |`false`| Installs vsphere-storage-controller-manager on the management cluster. NB: CSI node drivers are always installed on the workload cluster. |
386
-
| vSphereStorageControllerManager.logLevel | string |`"PRODUCTION"`| log level for the CSI components |
387
-
| vSphereStorageControllerManager.namespace | string |`"kube-system"`| Target namespace for the vSphere CSI node drivers on the workload cluster |
0 commit comments