Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AM-10879: Slice VPN Key Rotation #121

Merged
merged 29 commits into from
Jul 28, 2023
Merged
Show file tree
Hide file tree
Changes from 28 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
d899e14
added the v1.2.0 folder /sidebar
uma-kt Jul 20, 2023
242a86d
added the release notes
uma-kt Jul 20, 2023
3858381
update the slice creation doc and the release notes
uma-kt Jul 20, 2023
6e54b30
udpated the standard qos profile parameter description in the slice …
uma-kt Jul 20, 2023
84d79a6
udpated the standard qos profile parameter description in the slice …
uma-kt Jul 20, 2023
3478914
updated the release notes/ k8s version / std qos profile parameters
uma-kt Jul 21, 2023
1746494
update the version folder
uma-kt Jul 21, 2023
5e24245
updated the cross references
uma-kt Jul 21, 2023
c6c539a
updated the version.json file
uma-kt Jul 21, 2023
a68fce6
udpated the release notes
uma-kt Jul 21, 2023
6c8447f
added warning for renewBefore
uma-kt Jul 21, 2023
56b69dd
fixed typos
uma-kt Jul 21, 2023
257baef
udpated the vpnConfig description
uma-kt Jul 21, 2023
d998a84
updated the release notes
uma-kt Jul 21, 2023
d3b24bd
correct the parameter description
uma-kt Jul 21, 2023
bfff2c3
Merge branch 'master' of https://github.com/kubeslice/docs into AM-10879
uma-kt Jul 24, 2023
9cd14fa
fixed the hyerlinks in the sandbox doc
uma-kt Jul 24, 2023
25b1b0d
removed spec parameter from the yaml file
uma-kt Jul 24, 2023
2c1e90b
updated the release notes
uma-kt Jul 26, 2023
05688ed
update the output and the release notes
uma-kt Jul 28, 2023
b342293
update the output and the release notes
uma-kt Jul 28, 2023
19099a7
updated the release notes
uma-kt Jul 28, 2023
5e6b5ec
removed the image pull secrets /license info from the controller topic
uma-kt Jul 28, 2023
f9423f5
added url
uma-kt Jul 28, 2023
5c272a7
removed license related parameters
uma-kt Jul 28, 2023
5033ab7
corrected the output / removed image pull parameters
uma-kt Jul 28, 2023
0507671
udpated the command output
uma-kt Jul 28, 2023
e662f2f
rephrased in the release notes
uma-kt Jul 28, 2023
190a246
updated the order in the release notes
uma-kt Jul 28, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docusaurus.config.js
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,11 @@ const config = {
* }
*
*/
'1.1.0':{
label: '1.1.0',
path: '1.1.0',
banner: 'none'
},
'1.0.0':{
label: '1.0.0',
path: '1.0.0',
Expand Down
Binary file added images/version1.1.0/monitor/add-to-slack.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ monitoring and observability within Kubernetes environments.
Add the helm repository information to your local system.

```
helm repo add kubeslice
helm repo add kubeslice https://kubeslice.github.io/kubeslice/
```

**Expected Output**
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,9 @@ These parameters are related to the QoS profile for the slice inter-cluster traf
| bandwidthGuaranteedKbps | Integer | The guaranteed bandwidth in Kbps for the slice traffic. | Mandatory |
| dscpClass | Alphanumeric | DSCP marking code for the slice inter-cluster traffic. | Mandatory |




#### Namespace Isolation Profile Parameters

These parameters are related to onboarding namespaces, isolating the slice, and allowing external namespaces to
Expand Down Expand Up @@ -109,6 +112,36 @@ These parameters are related to external gateways, which are configured in the
| gatewayType | String | The type of ingress/egress gateways that need to be provisioned for the slice. It can either be `none` or `istio`.If set to `istio`, - The ingress gateway is created for a slice when `ingress` is enabled. - The egress gateway is created for a slice when `egress` is enabled. If set to `istio`, and ingress and egress are set to `false` then Istio gateways are not created. | Mandatory |
| clusters | List of Strings | Names of the clusters to which the `externalGateway` configuration should be applied. ### Create Slice YAML | Optional |

### Standard QOS Profile Parameters
These parameters are related to the QoS profile for the slice inter-cluster traffic configured in the standard QoS profile configuration
YAML file.

| Parameter | Parameter Type | Description | Required |
|------------|----------------|-------------|----------|
| apiVersion | String | The KubeSlice Controller API version. A set of resources that are exposed together, along with the version. The value must be networking.kubeslice.io/v1beta1. Mandatory
| kind | String | The name of a particular object schema. The value must be SliceQoSConfig. Mandatory
| [metadata](#standard-qos-profile-metadata-parameter) | Object | The metadata describes parameters (names and types) and attributes that have been applied. Mandatory
| [spec](#standard-qos-profile-specification-parameters) | Object | The specification of the desired state of an object. Mandatory

#### Standard QoS Profile Metadata Parameter

| Parameter | Parameter Type | Description | Required |
|-----------|----------------|--------------|----------|
| name | String | It is the name of the QoS profile. | Mandatory |
|namespace | String | The project namespace on which you apply the slice configuration file. | Mandatory |

#### Standard QoS Profile Specification Parameters
| Parameter | Parameter Type | Description | Required |
|-----------|----------------|--------------|----------|
| queueType | String | It is the slice traffic control queue type. The value must be Hierarchical Token Bucket (HTB). HTB facilitates guaranteed bandwidth for the slice traffic. | Mandatory |
| priority | Integer | QoS profiles allows traffic management within a slice as well as prioritization across slices. The value range is 0-3. 0 represents the highest priority and 3 represents the lowest priority. | Mandatory |
| tcType | String | It is the traffic control type. The value must be BANDWIDTH_CONTROL. | Mandatory |
| bandwidthCeilingKbps | Integer | The maximum bandwidth in Kbps that is allowed for the slice traffic.| Mandatory |
| bandwidthGuaranteedKbps | Integer | The guaranteed bandwidth in Kbps for the slice traffic. | Mandatory |
| dscpClass | Alphanumeric | DSCP marking code for the slice inter-cluster traffic. | Mandatory |



## Slice Creation
Create the slice configuration `.yaml` file using the following template.

Expand Down Expand Up @@ -422,6 +455,129 @@ Perform these steps:
kubectl apply -f <slice configuration>.yaml -n <project namespace>
```

### Create a Standard QoS Profile
The slice configuration file contains a QoS profile object. To apply a QoS profile to multiple slices, you can create a separate QOS profile YAML file and call it out in other slice configuration.

#### Create a Standard QoS Profile YAML File
Use the following template to create a standard sliceqosconfig file.

:::info
To understand more about the configuration parameters, see Standard QoS Profile Parameters.
:::

```
apiVersion: controller.kubeslice.io/v1alpha1
kind: SliceQoSConfig
metadata:
name: profile1
spec:
queueType: HTB
priority: 1
tcType: BANDWIDTH_CONTROL
bandwidthCeilingKbps: 5120
bandwidthGuaranteedKbps: 2562
dscpClass: AF11
```

#### Apply the Standard QOS Profile YAML File
Apply the slice-qos-config file using the following command.

```
kubectl apply -f <full path of slice-qos-config.yaml> -n project-namespace
```

:::info
You can only add the filename if you are on the project namespace using the following command.
:::

```
kubectl apply slice-qos-config.yaml -n project-namespace
```

### Validate the Standard QoS Profile
To validate the standard QoS profile that you created, use the following command:

```
kubectl get sliceqosconfigs.controller.kubeslice.io -n project-namespace
```

Expected Output

```
NAME AGE
profile1 33s
```

After applying the slice-qos-config.yaml file, add the profile name in a slice configuration. You must add the name of the QoS
profile for the standardQosProfileName parameter in a slice configuration YAML file as illustrated in the following examples.

:::info
In a slice configuration YAML file, the standardQosProfileName parameter and the qosProfileDetails object are mutually exclusive.
:::


#### Example of using the standard QoS Profile without Istio

```
apiVersion: controller.kubeslice.io/v1alpha1
kind: SliceConfig
metadata:
name: red
spec:
sliceSubnet: 10.1.0.0/16
maxClusters: <2 - 32> #Ex: 5. By default, the maxClusters value is set to 16
sliceType: Application
sliceGatewayProvider:
sliceGatewayType: OpenVPN
sliceCaType: Local
sliceIpamType: Local
clusters:
- cluster-1
- cluster-2
standardQosProfileName: profile1
```

#### Example of using the standard QoS Profile with Istio

```
apiVersion: controller.kubeslice.io/v1alpha1
kind: SliceConfig
metadata:
name: red
spec:
sliceSubnet: 10.1.0.0/16
sliceType: Application
sliceGatewayProvider:
sliceGatewayType: OpenVPN
sliceCaType: Local
sliceIpamType: Local
clusters:
- cluster-1
- cluster-2
standardQosProfileName: profile1
externalGatewayConfig:
- ingress:
enabled: false
egress:
enabled: false
nsIngress:
enabled: false
gatewayType: none
clusters:
- "*"
- ingress:
enabled: true
egress:
enabled: true
nsIngress:
enabled: true
gatewayType: istio
clusters:
- cluster-2

```


### Validate the Slice on the Controller Cluster

To validate the slice configuration on the controller cluster, use the following command:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ The following tables describe the configuration parameters used to install the K
| Parameter | Parameter Type | Description | Required |
| ------------------------------------------------------------ | -------------- | ---------------------------------------------------------------------------- | --------- |
| Kubeslice | Object | The cluster where the KubeSlice Controller is installed. | Mandatory |
| [imagePullSecrets](#controller-image-pull-secret-parameters) | Object | This contains the configuration to pull the Kubernetes dashboard image from. | Mandatory |


#### KubeSlice Parameters

Expand All @@ -61,7 +61,7 @@ This parameter contains the configuration object used in the
| Parameter | Parameter Type | Description | Required |
| ------------------------------------ | -------------- | ---------------------------------------------------------------------- | --------- |
| [controller](#controller-parameters) | Object | The cluster where the KubeSlice Controller is installed. | Mandatory |
| [license](#license-parameters) | Object | This object describes the type of the license and its activation mode. | Optional |


#### Controller Parameters
This object contains the different parameters used in the [KubeSlice Controller YAML file](#create-controller-yaml).
Expand All @@ -73,30 +73,7 @@ This object contains the different parameters used in the [KubeSlice Controller
| projectnsPrefix | String | The project namespace prefix. | Optional |
| endpoint | AlphaNumeric | The URL of the Kubernetes control plane. | Mandatory |

#### Controller License Parameters
This object contains the different parameters used in the
[KubeSlice Controller YAML file](#create-controller-yaml).

| Parameter | Parameter Type | Description | Required |
| ------------ | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| type | String | The type of the license for installing KubeSlice. The value must be always `kubeslice-trial-license`. Currently, we support only trial license. | Mandatory |
| mode | String | This is the license activation mode. For installing the KubeSlice Controller online, the value is `auto`, which is default. For installing the KubeSlice Controller on an airgap cluster, the value is `manual`. | Optional |
| customerName | String | Enter a name of the user or organization to easily identify. | Optional |

#### Controller Image Pull Secret Parameters

:::note
The values required for this section were supplied during the registration process. Refer to your registration email.
:::
These parameters are required to access the repository to pull the image. They are configured in the
[KubeSlice Controller YAML file](#create-controller-yaml).

| **Parameter** | **Parameter Type** | **Description** | **Required** |
| ------------- | ------------------ | --------------------------------------------------------------------------------------------------------- | ------------ |
| repository | String | This is the repository URL to pull the image from.Its value must always be `https://index.docker.io/v1/`. | Mandatory |
| username | String | This is your username to log in to the repository. | Mandatory |
| password | String | This is your user access token/password to log in to the repository. | Mandatory |
| email | String | This is your email address to log into the repository. | Mandatory |
| Optional |

### Create Controller YAML
Create the `controller.yaml` file using the following template.
Expand All @@ -112,20 +89,6 @@ kubeslice:
rbacResourcePrefix: kubeslice-rbac
projectnsPrefix: kubeslice
endpoint: <endpoint of your cluster>

license:
# possible license type values ["kubeslice-trial-license"]
type: kubeslice-trial-license
# possible license mode - ["auto", "manual"]
mode: auto
# please give company-name or user-name as customerName
customerName: ""

imagePullSecrets:
repository: https://index.docker.io/v1/
username: <Provide from Registration Email>
password: <Provide from Registration Email>
email: <Provide from Registration Email>
```

### Apply Controller YAML
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -133,14 +133,23 @@ metadata:
name: worker-1
namespace: kubeslice-avesha
spec:
networkInterface: eth0
clusterProperty:
geoLocation:
cloudProvider: "GCP"
cloudRegion: "europe-west3"
---
apiVersion: controller.kubeslice.io/v1alpha1
kind: Cluster
metadata:
name: worker-2
namespace: kubeslice-avesha
spec:

networkInterface: eth0
clusterProperty:
geoLocation:
cloudProvider: "GCP"
cloudRegion: "europe-west3"
```

### Apply the Cluster Registration YAML File
Expand Down Expand Up @@ -464,7 +473,7 @@ These parameters are related to the worker cluster that are configured in the
| Parameter | Parameter Type | Description | Required |
| --------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
| name | String | The name of the cluster that is registered with the KubeSlice controller. The cluster name must be `unique` in the project. | Mandatory |
| endpoint | String | The control plane's kube-apiserver endpoint of the worker cluster that you get in the output after running the `kubectl cluster-info` command. | Mandatory |
| endpoint | String | The control plane's `kube-apiserver` endpoint of the worker cluster that you get in the output after running the `kubectl cluster-info` command. | Mandatory |


#### Network Operator Parameter
Expand All @@ -476,18 +485,6 @@ This parameter is related to network operations such as enforcing the QoS profil
| ---------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| networkInterface | AlphaNumeric | The name of the network interface on the gateway nodes that is the egress interface for external traffic. It may be obtained by doing a route lookup on a well-known public IP address like the Google public DNS IP address `8.8.8.8`. | Mandatory |

#### Slice Operator Image Pull Secret Parameters

These parameters are required to pull the image and they are configured in the
[Slice Operator YAML file](#create-the-slice-operator-yaml).

| **Parameter** | **Parameter Type** | **Description** | **Required** |
| ------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| repository | String | This is the repository URL to pull the image from.Its value must always be `https://index.docker.io/v1/`. | Mandatory |
| username | String | This is your username to log in to the repository from your KubeSlice Registration email. | Mandatory |
| password | String | This is your user access token/password to log in to the repository for your KubeSlice Registration email. | Mandatory |
| email | String | This is your email address to log into the repository use in your KubeSlice Registration. | Mandatory |

## Create the Slice Operator YAML

Use base64 encoded values of the `namespace`, `endpoint`, `ca.crt`, and
Expand All @@ -511,13 +508,6 @@ cluster:

netop:
networkInterface: <network interface value>

# Provide your username, password & email values from the KubeSlice Registration email under imagePullSecrets to create a secret
imagePullSecrets:
repository: https://index.docker.io/v1/
username: <username from KubeSlice Registration email>
password: <accesstoken from KubeSlice Registration email>
email: <KubeSlice Registration email ID>
```


Expand Down Expand Up @@ -547,7 +537,6 @@ cluster:

netop:
networkInterface: eth0

```

### Apply the Slice Operator YAML
Expand Down Expand Up @@ -583,15 +572,18 @@ kubectl get pods -n kubeslice-system
**Example Output**

```
NAME READY STATUS RESTARTS AGE
forwarder-kernel-jx5wm 1/1 Running 0 3m5s
kubeslice-dns-6bbd47bbb9-jcgsv 1/1 Running 0 3m6s
kubeslice-netop-8n9vh 1/1 Running 0 3m6s
kubeslice-operator-59657fb5f7-nzsth 2/2 Running 0 3m5s
nsm-admission-webhook-k8s-7745c9c4d7-cd9sw 1/1 Running 0 3m5s
nsm-install-crds-h29qp 0/1 Completed 0 3m18s
nsmgr-b4gnt 2/2 Running 0 3m4s
registry-k8s-86667b6cd9-4hzg7 1/1 Running 0 3m6s
NAME READY STATUS RESTARTS AGE
forwarder-kernel-4cwvc 1/1 Running 0 95s
kubeslice-dns-54698f7cd-bdsxw 1/1 Running 0 95s
kubeslice-install-crds-zjvww 0/1 Completed 0 2m37s
kubeslice-netop-65jbq 1/1 Running 0 95s
kubeslice-operator-74b9f67548-zt2hd 2/2 Running 0 95s
nsm-admission-webhook-k8s-9bf7d8b5-b6cd7 1/1 Running 0 95s
nsm-install-crds-482cn 0/1 Completed 0 2m10s
nsmgr-fghdh 2/2 Running 0 95s
registry-k8s-5b5679ff54-lhs9k 1/1 Running 0 95s
spire-install-clusterid-cr-klqzj 0/1 Completed 0 112s
spire-install-crds-pl2m2 0/1 Completed 0 2m1s
```

You can also validate the spire installation using the following command:
Expand Down
Loading
Loading