Deploy an MKE 4 vSphere child clusterNew#

The instructions herein assume that you are familiar with the k0rdent platform and the basics of how to deploy child clusters.

The sequence of the tutorial is as follows:

Ensure that the prerequsities are met.
Create the credentials objects and the resource template ConfigMap.
Set the child cluster configuration.
Verify child cluster readiness.
Connect to the cluster with the kubeconfig.
Connect directly to the child cluster.

Prerequisites#

A vSphere instance, version 6.7.0 or later.
A user assigned to the vSphere Provider with the following privileges:
```
Virtual machine: Full permissions are required
Network: Assign network is sufficient
Datastore: The user should be able to manipulate virtual machine files and metadata
```
In addition, specific CSI driver permissions are required. For more information on CSI-specific permissions, refer to the official vSphere documentation.
An image template. You can either use pre-built image templates from the CAPV project or you can build your own. If you opt to build your own image template, make sure that you have VMware tools and cloud-init installed and configured.
A vSphere network with the DHCP service. Make sure that a part of your network is out of the DHCP range to ensure that LoadBalancer services will not create any IP conflicts in the network.

Create the credentials objects#

Certain credentials objects are reqired to access vSphere resources, including:

Secret
VSphereClusterIdentity
Credential
ConfigMap

Create the vSphere credentials `Secret` object#

The vSphere credentials Secret stores the username and password for your vSphere instance.

Create the following vsphere-cluster-identity-secret.yaml file:

apiVersion: v1
kind: Secret
metadata:
  name: vsphere-cluster-identity-secret
  namespace: k0rdent
  labels:
    k0rdent.mirantis.com/component: "kcm"
stringData:
  username: <USERNAME>
  password: <PASSWORD>
type: Opaque

Warning

The username parameter must be configured for the vCenter username and the domain name, for example userName@domainName, or the vSphere Container Storage plugin will not function properly.

Apply the vsphere-cluster-identity-secret.yaml file to your cluster:
```
kubectl apply -f vsphere-cluster-identity-secret.yaml
```

Create the `VSphereClusterIdentity` object#

The VSphereClusterIdentity object defines the CAPV identity that is used to manage vSphere resources.

Create the following vsphere-cluster-identity.yaml file:

apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: VSphereClusterIdentity
metadata:
  name: vsphere-cluster-identity
  namespace: k0rdent
  labels:
    k0rdent.mirantis.com/component: "kcm"
spec:
  secretName: vsphere-cluster-identity-secret
  allowedNamespaces:
    selector:
      matchLabels: {}

Note

As the VSphereClusterIdentity object references the previously-created Secret object, its .spec.secretName field must match the .metadata.name field of the Secret.

Apply the vsphere-cluster-identity.yaml file to the cluster:
```
kubectl apply -f vsphere-cluster-identity.yaml
```

Create the `Credential` object#

Create the following vsphere-cluster-identity-cred.yaml file:

apiVersion: k0rdent.mirantis.com/v1beta1
kind: Credential
metadata:
  name: vsphere-cluster-identity-cred
  namespace: k0rdent
spec:
  identityRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: VSphereClusterIdentity
    name: vsphere-cluster-identity
    namespace: k0rdent

Note

As the Credential object references the previously-created VSphereClusterIdentity object, its .spec.identityRef.name field must match the .metadata.name field of the VSphereClusterIdentity.

Apply the vsphere-cluster-identity-cred.yaml file to the cluster:
```
kubectl apply -f vsphere-cluster-identity-cred.yaml
```

Create the resource-template `ConfigMap`#

Create the following vsphere-cluster-identity-resource-template.yaml file, containing the specification of the resource-template.

apiVersion: v1
kind: ConfigMap
metadata:
  name: vsphere-cluster-identity-resource-template
  namespace: k0rdent
  labels:
    k0rdent.mirantis.com/component: "kcm"
  annotations:
    projectsveltos.io/template: "true"
data:
  configmap.yaml: |
    {{- $cluster := .InfrastructureProvider -}}
    {{- $identity := (getResource "InfrastructureProviderIdentity") -}}
    {{- $secret := (getResource "InfrastructureProviderIdentitySecret") -}}
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: vsphere-cloud-secret
      namespace: kube-system
    type: Opaque
    data:
      {{ printf "%s.username" $cluster.spec.server }}: {{ index $secret.data "username" }}
      {{ printf "%s.password" $cluster.spec.server }}: {{ index $secret.data "password" }}
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: vcenter-config-secret
      namespace: kube-system
    type: Opaque
    stringData:
      csi-vsphere.conf: |
        [Global]
        cluster-id = "{{ $cluster.metadata.name }}"

        [VirtualCenter "{{ $cluster.spec.server }}"]
        insecure-flag = "true"
        user = "{{ index $secret.data "username" | b64dec }}"
        password = "{{ index $secret.data "password" | b64dec }}"
        port = "443"
        datacenters = <VSPHERE_DATACENTER_NAME>
    ---
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: cloud-config
      namespace: kube-system
    data:
      vsphere.conf: |
        global:
          insecureFlag: true
          port: 443
          secretName: vsphere-cloud-secret
          secretNamespace: kube-system
        labels:
          region: k8s-region
          zone: k8s-zone
        vcenter:
          {{ $cluster.spec.server }}:
            datacenters:
              - <VSPHERE_DATACENTER_NAME>
            server: {{ $cluster.spec.server }}

Apply the vsphere-cluster-identity-resource-template.yaml file to your cluster:
```
kubectl apply -f vsphere-cluster-identity-resource-template.yaml
```

Set the child cluster configuration#

Obtain the mkechild.yaml file.

Set the required MKE version, cloud provider, and the name of the installed k0rdent Credential and infrastructure configuration.

Note

spec.version must be set to the same MKE 4 version on which you are running the management cluster.

apiVersion: mke.mirantis.com/v1alpha1
kind: MkeChildConfig
metadata:
  name: my-mke-child
  namespace: k0rdent
spec:
  version: <MANAGEMENT_CLUSTER_MKE_VERSION>
  registries:
    chartRegistry:
      url: oci://registry.mirantis.com/mke
    imageRegistry:
      url: registry.mirantis.com/mke
  infrastructure:
    provider: vsphere
    credential: vsphere-cluster-identity-cred
    configuration:
      controlPlaneEndpointIP: <VSPHERE_CONTROL_PLANE_ENDPOINT>
      vsphere:
        server: <VSPHERE_SERVER>
        thumbprint: <VSPHERE_THUMBPRINT>
        datacenter: <VSPHERE_DATACENTER_NAME>
        datastore: <VSPHERE_DATASTORE>
        resourcePool: <VSPHERE_RESOURCEPOOL>
        folder: <VSPHERE_FOLDER>
      controlPlane:
        network: <VSPHERE_NETWORK>
        vmTemplate: <VSPHERE_VM_TEMPLATE>
        ssh:
          user: "ubuntu"
          publicKey: <VSPHERE_SSH_KEY>
      worker:
        network: <VSPHERE_NETWORK>
        vmTemplate: <VSPHERE_VM_TEMPLATE>
        ssh:
          user: "ubuntu"
          publicKey: <VSPHERE_SSH_KEY>

Refer to Infrastructure options for descriptions of every supported field in spec.infrastructure and the provider-specific spec.infrastructure.configuration block.

Apply the child cluster:
```
kubectl apply -f mkechild.yaml
```

Verify child cluster readiness#

Check the created object ensure that it is ready:

kubectl -n k0rdent get mkechildconfig

Example output:

kubectl -n k0rdent get mkechildconfig
NAME                    READY   VERSION         LICENSE      STATUS            AGE
my-mke-child            True    v4.2.0          unlicensed   Object is ready   3m36s

Connect to the cluster with the kubeconfig#

View the status of the applied MkeChildConfig to obtain the name of the secret that contains the kubeconfig:

kubectl -n k0rdent get mkechildconfig my-mke-child -o yaml

Example status, with secret:

status:
  clusterID: kube-system:20d005f3-d8c5-4c88-a8d9-7e97e6a1a8ca
  kubeConfigSecret: my-mke-child-kubeconfig
  externalAddress: <CHILD_CLUSTER_EXTERNAL_ADDRESS>
  licenseStatus:
    licenseType: unlicensed

Use the secret to obtain the kubeconfig:

kubectl -n k0rdent get secret my-mke-child-kubeconfig -o jsonpath='{ .data.value }' | base64 -d > kubeconfig.yaml

Use the obtained kubeconfig to connect to the cluster:
```
KUBECONFIG=kubeconfig.yaml kubectl get no
```

Access the child cluster external address#

Retrieve the external address, which is the child cluster ingress of the child cluster. This is the address that you will use to interact with the child cluster.

To view the external address in short form, with the collumn in o-wide output:
```
kubectl -n k0rdent get mkechildconfig my-mke-child -o wide
```
To read the external address from the resource status:
```
kubectl -n k0rdent get mkechildconfig my-mke-child -o yaml
```
In the resulting -o yaml file, the external address is the value of thestatus.externalAddress field.

Deploy an MKE 4 vSphere child clusterNew#

Prerequisites#

Create the credentials objects#

Create the vSphere credentials Secret object#

Create the VSphereClusterIdentity object#

Create the Credential object#

Create the resource-template ConfigMap#

Set the child cluster configuration#

Verify child cluster readiness#

Connect to the cluster with the kubeconfig#

Access the child cluster external address#

Create the vSphere credentials `Secret` object#

Create the `VSphereClusterIdentity` object#

Create the `Credential` object#

Create the resource-template `ConfigMap`#