Create a managed cluster

This section describes how to create a managed cluster that is based on Equinix Metal with private networking using the Mirantis Container Cloud web UI of the Equinix Metal management cluster with private networking.

To create a managed cluster based on Equinix Metal with private networking:

  1. Log in to the Container Cloud web UI with the m:kaas:namespace@operator or m:kaas:namespace@writer permissions.

  2. Switch to the required non-default project using the Switch Project action icon located on top of the main left-side navigation panel.

    To create a project, refer to Create a project for managed clusters.

  3. In the SSH Keys tab, click Add SSH Key to upload the public SSH key(s) that will be used to create the Equinix Metal devices.

  4. In the Credentials tab:

    1. Click Add Credential to add your Equinix Metal credential.

    2. Configure the following parameters:

      Credential configuration

      Parameter

      Description

      Credential Name

      Credential name.

      Provider

      Select Equinix.

      Region

      From the drop-down list, select the region for the managed cluster. For example, region-one.

      Project ID

      Equinix Metal project ID located in the Equinix Metal console in the Project Settings > General section.

      API Token

      Equinix Metal user-level API token located in the Equinix Metal console in the Profile Settings > Personal API Keys section.

      If you do not have an API token, create one using the Equinix Metal console:

      1. In the Profile Settings > Personal API Keys section, click Add New Key.

      2. Fill in the Description and select Read/Write permissions.

      3. Click Add Key.

    3. Click Create.

    4. Verify that the new credential status is Ready. If the status is Error, hover over the status to determine the reason.

  5. In the Clusters tab, click Create Cluster and fill out the form with the following parameters as required:

    1. Configure general settings and Kubernetes parameters:

      Managed cluster configuration

      Section

      Parameter

      Description

      General settings

      Name

      Cluster name.

      Provider

      Select Equinix Metal.

      Provider Credential

      From the drop-down list, select the Equinix Metal credential name that you have previously added.

      Caution

      Select credentials of the specific region where the related regional cluster is deployed.

      To decrease network traffic cost and not to complicate the network infrastructure, you must deploy managed clusters in the same region as the regional cluster to have both clusters deployed in the same metro.

      For example, if you have a management cluster with region-one in Frankfurt and a regional cluster with region-two in Silicon Valley, create all Frankfurt-based managed clusters in region-one and all Silicon Valley based managed clusters in region-two.

      Manual Ceph Configuration

      Enables manual Ceph configuration. Select to manually configure Ceph roles on each cluster machine. For Ceph configuration options, see Ceph advanced configuration.

      If unset, the Ceph roles will be configured automatically.

      Caution

      • Switching from manual to automatic configuration of Ceph roles is forbidden.

      • Switching from automatic to manual configuration is available after the cluster creation through the Configure Cluster menu.

      Release Version

      The Container Cloud version.

      SSH keys

      From the drop-down list, select the SSH key name(s) that you have previously added for SSH access to VMs.

      Provider

      Facility

      The location in which the Equinix Metal server will be deployed.

      VLAN ID

      ID of the VLAN created in the corresponding Equinix Metal Metro that the cluster nodes should be attached to. One VLAN can be used only for one cluster.

      Network CIDR

      Network address in CIDR notation. For example, 192.168.1.0/24.

      Gateway IP

      IP address of a gateway attached to this VLAN that provides necessary external connectivity.

      Kubernetes API Server IP

      IP address that will be used for the MKE and Kubernetes API endpoints of the cluster.

      Node IP Ranges

      List of IP ranges in the 192.168.1.51-192.168.1.128 format separated by commas. IP addresses from these ranges will be allocated as permanent addresses of machines in this cluster. Should include at least one address for each machine in the cluster.

      Services IP Ranges

      List of IP ranges in the 192.168.1.129-192.168.1.200 format separated by commas that will be used for Kubernetes LoadBalancer services. For example, on a managed cluster, these services include OpenSearch Dashboards and Prometheus. This list should include at least 5 addresses per managed cluster.

      DHCP Ranges

      List of IP ranges in the 192.168.1.10-192.168.1.50 format separated by commas. IP addresses from these ranges will be allocated to nodes that boot from DHCP during provisioning. Should include at least one address for each machine in the cluster.

      DNS Name Servers

      Optional list of IP addresses of DNS servers to configure on machines. These servers must be accessible through the Gateway IP from the provided VLAN.

      Equinix Project SSH Keys

      List of Equinix Project SSH key names to be attached to cluster machines. Required for access to the Equinix Metal out-of-band console Serial Over SSH (SOS) to debug provisioning failures. We recommend adding at least one project SSH key per cluster.

      To create an SSH key in an Equinix Metal project:

      1. Log in to the Equinix Metal console.

      2. Select the project that you want to use for the Container Cloud deployment.

      3. In the Project Settings tab, select Project SSH Keys and click Add New Key.

      4. Enter the Key Name and Public Key values and click Add.

      Kubernetes

      Node CIDR

      The Kubernetes nodes CIDR block. For example, 10.10.10.0/24.

      Services CIDR Blocks

      The Kubernetes Services CIDR block. For example, 172.21.0.0/18.

      Pods CIDR Blocks

      The Kubernetes Pods CIDR block. For example, 172.21.128.0/18.

      Note

      The network subnet size of Kubernetes pods influences the number of nodes that can be deployed in the cluster. The default subnet size /18 is enough to create a cluster with up to 256 nodes. Each node uses the /26 address blocks (64 addresses), at least one address block is allocated per node. These addresses are used by the Kubernetes pods with hostNetwork: false. The cluster size may be limited further when some nodes use more than one address block.

    2. Configure StackLight:

      StackLight configuration

      Section

      Parameter name

      Description

      StackLight

      Enable Monitoring

      Selected by default. Deselect to skip StackLight deployment.

      Note

      You can also enable, disable, or configure StackLight parameters after deploying a managed cluster. For details, see Change a cluster configuration or Configure StackLight.

      Enable Logging

      Select to deploy the StackLight logging stack. For details about the logging components, see Deployment architecture.

      Note

      The logging mechanism performance depends on the cluster log load. In case of a high load, you may need to increase the default resource requests and limits for fluentdLogs. For details, see StackLight configuration parameters: Resource limits.

      HA Mode

      Select to enable StackLight monitoring in the HA mode. For the differences between HA and non-HA modes, see Deployment architecture.

      StackLight Default Logs Severity Level

      Log severity (verbosity) level for all StackLight components. The default value for this parameter is Default component log level that respects original defaults of each StackLight component. For details about severity levels, see Log verbosity.

      StackLight Component Logs Severity Level

      The severity level of logs for a specific StackLight component that overrides the value of the StackLight Default Logs Severity Level parameter. For details about severity levels, see Log verbosity.

      Expand the drop-down menu for a specific component to display its list of available log levels.

      OpenSearch

      Logstash Retention Time Available since 2.17.0

      Available if you select Enable Logging. Specifies the logstash-* index retention time.

      Events Retention Time Available since 2.17.0

      Available if you select Enable Logging. Specifies the kubernetes_events-* index retention time.

      Notifications Retention Time Available since 2.17.0

      Available if you select Enable Logging. Specifies the notification-* index retention time and is used for Mirantis OpenStack for Kubernetes.

      Retention Time Removed since 2.17.0

      Available if you select Enable Logging. The OpenSearch logs retention period.

      Persistent Volume Claim Size

      Available if you select Enable Logging. The OpenSearch persistent volume claim size.

      Collected Logs Severity Level

      Available if you select Enable Logging. The minimum severity of all Container Cloud components logs collected in OpenSearch. For details about severity levels, see Logging.

      Prometheus

      Retention Time

      The Prometheus database retention period.

      Retention Size

      The Prometheus database retention size.

      Persistent Volume Claim Size

      The Prometheus persistent volume claim size.

      Enable Watchdog Alert

      Select to enable the Watchdog alert that fires as long as the entire alerting pipeline is functional.

      Custom Alerts

      Specify alerting rules for new custom alerts or upload a YAML file in the following exemplary format:

      - alert: HighErrorRate
        expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5
        for: 10m
        labels:
          severity: page
        annotations:
          summary: High request latency
      

      For details, see Official Prometheus documentation: Alerting rules. For the list of the predefined StackLight alerts, see Operations Guide: Available StackLight alerts.

      StackLight Email Alerts

      Enable Email Alerts

      Select to enable the StackLight email alerts.

      Send Resolved

      Select to enable notifications about resolved StackLight alerts.

      Require TLS

      Select to enable transmitting emails through TLS.

      Email alerts configuration for StackLight

      Fill out the following email alerts parameters as required:

      • To - the email address to send notifications to.

      • From - the sender address.

      • SmartHost - the SMTP host through which the emails are sent.

      • Authentication username - the SMTP user name.

      • Authentication password - the SMTP password.

      • Authentication identity - the SMTP identity.

      • Authentication secret - the SMTP secret.

      StackLight Slack Alerts

      Enable Slack alerts

      Select to enable the StackLight Slack alerts.

      Send Resolved

      Select to enable notifications about resolved StackLight alerts.

      Slack alerts configuration for StackLight

      Fill out the following Slack alerts parameters as required:

      • API URL - The Slack webhook URL.

      • Channel - The channel to send notifications to, for example, #channel-for-alerts.

  6. Click Create.

    To monitor the cluster readiness, hover over the status icon of a specific cluster in the Status column of the Clusters page.

    Once the orange blinking status icon is green and Ready, the cluster deployment or update is complete.

    You can monitor live deployment status of the following cluster components:

    Component

    Description

    Bastion

    For the OpenStack and AWS-based clusters, the Bastion node IP address status that confirms the Bastion node creation

    Helm

    Installation or upgrade status of all Helm releases

    Kubelet

    Readiness of the node in a Kubernetes cluster, as reported by kubelet

    Kubernetes

    Readiness of all requested Kubernetes objects

    Nodes

    Equality of the requested nodes number in the cluster to the number of nodes having the Ready LCM status

    OIDC

    Readiness of the cluster OIDC configuration

    StackLight

    Health of all StackLight-related objects in a Kubernetes cluster

    Swarm

    Readiness of all nodes in a Docker Swarm cluster

    LoadBalancer

    Readiness of the Kubernetes API load balancer

    ProviderInstance

    Readiness of all machines in the underlying infrastructure (virtual or bare metal, depending on the provider type)

  7. Proceed with Add a machine.