Skip to content

Commit 9968f21

Browse files
Added Remaining v0.3.0 release files. (#18)
* Added Remaining v0.3.0 release files. * Added omitted v0.3.0 clusterApi.zip
1 parent 07ebf4a commit 9968f21

File tree

4 files changed

+209
-0
lines changed

4 files changed

+209
-0
lines changed
Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# CloudStack Cluster API Provider (CAPC) Release v.0.3.0 Evaluation Deployment Guide
2+
3+
The CloudStack Cluster API Provider (CAPC) v0.3.0 is a pre-release of partial CAPC functionality for the purposes
4+
of stakeholder review. As an interim release, the process for deploying it is still under development. This document
5+
defines a manual deployment process suitable for evaluating this CAPC interim release.
6+
7+
## Evaluation Environment Pre-Requisites:
8+
9+
### - A running Kubernetes cluster for hosting CAPC
10+
11+
This should be an easily disposable/re-creatable cluster, such as a locally-running kind (Kuberetes in Docker) cluster.
12+
13+
Your KUBECONFIG file's *current-context* must be set to the cluster you want to use.
14+
15+
### - CAPI clusterctl v0.3.24 (https://github.com/kubernetes-sigs/cluster-api/releases/tag/v0.3.24)
16+
17+
The currently released CAPI clusterctl 1.x is not compatible with this pre-release.
18+
19+
### - A CloudStack Environment
20+
- Zone
21+
- Network
22+
- CAPI-compatible QEMU template (i.e., created with https://github.com/kubernetes-sigs/image-builder)
23+
- Machine Offerings (suitable for running Kubernetes nodes)
24+
- apikey and secretkey for a CloudStack user having domain administrative privileges
25+
- k8s Control Plane IP Address (Shared network: available IP address in the network range; isolated network: public IP address)
26+
27+
## Deployment Steps
28+
### Define Identity Environment Variable
29+
30+
An environment variable named CLOUDSTACK_B64ENCODED_SECRET must be defined, containing the base64 encoding of a
31+
cloud-config properties file. This file is of the form:
32+
33+
```
34+
[Global]
35+
api-url = <urlOfCloudStackAPI>
36+
api-key = <cloudstackUserApiKey>
37+
secret-key = <cloudstackUserSecretKey>
38+
```
39+
After defining this in a file named cloud-config, create the environment variable with:
40+
41+
```
42+
export CLOUDSTACK_B64ENCODED_SECRET=$(cat cloud-config | base64 | tr -d '\n')
43+
```
44+
45+
For security, delete this cloud-config file after creating this environment variable.
46+
47+
### Deploy the supplied container image archive (.tar.gz) to a suitable image registry.
48+
49+
*We use https://github.com/kubernetes-sigs/cluster-api/blob/main/hack/kind-install-for-capd.sh to launch a local
50+
docker registry integrated into a kind cluster for lightweight development and testing.*
51+
52+
- On a computer with docker, load the provided cluster-api-provider-capc.tar.gz to docker:
53+
```
54+
docker load --input cluster-api-provider-capc_v0.3.0.tar.gz
55+
```
56+
57+
This will create image *localhost:5000/cluster-api-provider-cloudstack:v0.3.0* in your local docker. This is suitable
58+
for pushing to a local registry.
59+
60+
- (Optional) Tag this image for your registry.
61+
```
62+
docker tag localhost:5000/cluster-api-provider-cloudstack:v0.3.0 <yourRepoFqdn>/cluster-api-provider-cloudstack:v0.3.0
63+
```
64+
65+
Push it to your registry (localhost:5000 if using local registry)
66+
```
67+
docker push <yourRepoFqdn>/cluster-api-provider-cloudstack:v0.3.0
68+
```
69+
70+
### Create clusterctl configuration files
71+
A cluster-api.zip file has been provided, containing the files and directory structure suitable for configuring
72+
clusterctl to work with this interim release of CAPC. It should be restored under $HOME/.cluster-api. It contains:
73+
74+
```
75+
Archive: /Users/jweite/Dev/cluster-api-cloudstack-v0.3.0-assets/cluster-api.zip
76+
* clusterctl.yaml
77+
* dev-repository/
78+
* dev-repository/infrastructure-cloudstack/
79+
* dev-repository/infrastructure-cloudstack/v0.3.0/
80+
* dev-repository/infrastructure-cloudstack/v0.3.0/cluster-template.yaml
81+
* dev-repository/infrastructure-cloudstack/v0.3.0/cluster-template-managed-ssh.yaml
82+
* dev-repository/infrastructure-cloudstack/v0.3.0/cluster-template-ssh-material.yaml
83+
* dev-repository/infrastructure-cloudstack/v0.3.0/infrastructure-components.yaml
84+
* dev-repository/infrastructure-cloudstack/v0.3.0/metadata.yaml
85+
```
86+
87+
*Note: If you already have a $HOME/.cluster-api we strongly suggest you delete or stash it.*
88+
89+
```
90+
cd ~
91+
mkdir .cluster-api
92+
cd .cluster-api
93+
unzip cluster-api.zip
94+
```
95+
96+
### Edit the clusterctl configuration files
97+
- **clusterctl.yaml:** in the *url* attribute replace \<USERID\> with your OS user id to form a valid absolute path to infrastructure-components.yaml.
98+
99+
- **dev-repository/infrastructure-cloudstack/v0.3.0/infrastructure-components.yaml:** if you're not using a local registry modify the capc-controller-manager deployment, changing the spec.template.spec.containers[0].image (line 617) to correctly reflect your container registry.
100+
101+
### Deploy CAPI and CAPC to your bootstrap Kubernetes cluster
102+
```
103+
clusterctl init --infrastructure cloudstack
104+
```
105+
106+
### Generate a manifest for the CAPI custom resources needed to allocate a workload cluster.
107+
108+
*Set the below environment variables as appropriate for your CloudStack environment.*
109+
110+
```
111+
CLOUDSTACK_ZONE_NAME=<MyZoneName> \
112+
CLOUDSTACK_NETWORK_NAME=<MyNetworkName> \
113+
CLOUDSTACK_TEMPLATE_NAME=<MyTemplateName> \
114+
CLOUDSTACK_CONTROL_PLANE_MACHINE_OFFERING=<MyServiceOfferingName> \
115+
CONTROL_PLANE_MACHINE_COUNT=1 \
116+
CLOUDSTACK_WORKER_MACHINE_OFFERING=<MyServiceOfferingName> \
117+
WORKER_MACHINE_COUNT=1 \
118+
CLUSTER_ENDPOINT_IP=<AvailableSharedOrPublicIP> \
119+
CLUSTER_ENDPOINT_PORT=6443 \
120+
KUBERNETES_VERSION=<KubernetesVersionOnTheImage> \
121+
CLUSTER_NAME=<MyClusterName> \
122+
clusterctl generate yaml --from ~/.cluster-api/dev-repository/infrastructure-cloudstack/v0.3.0/cluster-template.yaml > clusterTemplate.yaml
123+
```
124+
125+
### Review the generated clusterTemplate.yaml and adjust as necessary
126+
127+
128+
### Provision your workload cluster
129+
130+
```
131+
kubectl apply -f clusterTemplate.yaml
132+
```
133+
134+
Provisioning can take several minutes to complete. You will see a control plane VM created in CloudStack pretty quickly,
135+
but it takes a while for it to complete its cloud-init to install Kubernetes and become a functioning control plane.
136+
Allocation of the worker node(s) (with *md* in their VM names) won't occur until the control plane is operational.
137+
138+
You can monitor the CAPC controller as it conducts the provisioning process with:
139+
```
140+
# Get the full name of the CAPC controller pod
141+
kubectl -n capc-system get pods
142+
143+
# Tail its logs
144+
kubectl -n capc-system log -f <CAPCcontrollerPodFullName>
145+
```
146+
147+
### Fetch a kubeconfig to access your cluster
148+
```
149+
clusterctl get kubeconfig <clusterName> > <clusterName>_kubeconfig
150+
```
151+
152+
You can then either export a KUBECONFIG environment variable pointing to this file, or use kubectl's --kubeconfig=<filePath>
153+
flag.
154+
```
155+
export KUBECONFIG=<clusterName>_kubeconfig
156+
```
157+
158+
### Examine the provisioned Kubernetes Cluster's nodes
159+
```
160+
kubectl get nodes
161+
```
162+
Expect to see a control plane and a worker node reported by Kubernetes. Neither will report that they are ready
163+
because no CNI is installed yet.
164+
165+
### Install Cilium CNI
166+
```
167+
cilium install
168+
```
169+
The above command presumes that the cilium installer is present on the local workstation.
170+
171+
It will take a minute while it waits for cilium to become active.
172+
173+
### Confirm that Cluster is Ready for Work
174+
```
175+
kubectl get nodes
176+
```
177+
Expect now to see both nodes list as ready.
178+
179+
### Conclusion
180+
At this point the workload cluster is ready to accept workloads. Use it in the usual way via the kubeconfig generated
181+
earlier
182+
183+
### Cluster Deletion
184+
As mentioned in the preface, CAPC is not yet able to delete workload cluster. To do so manually we recommend
185+
simply tearing-down the kind bootstrap cluster, and then manually deleting the CloudStack VMs created for it
186+
using the CloudStack UI, API or similar facilities.

releases/v0.3.0/clusterApi.zip

8.54 KB
Binary file not shown.

releases/v0.3.0/security_findings.csv

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Component,Vulnerability,AWS Assessment
2+
cloud.google.com/go/storage:1.10.0,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Astorage_project&cpe_product=cpe%3A%2F%3Astorage_project%3Astorage&cpe_version=cpe%3A%2F%3Astorage_project%3Astorage%3A1.10.0,No exploitable issue. This finding only affects applications unpacking container Image manifests.
3+
github.com/coreos/etcd:3.3.13+incompatible,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aetcd&cpe_product=cpe%3A%2F%3Aetcd%3Aetcd&cpe_version=cpe%3A%2F%3Aetcd%3Aetcd%3A3.3.13,"No exploitable issue. etcd is unused in Kubernetes CAPI controllers, only the Kubernetes API server interacts with an etcd database."
4+
github.com/docker/distribution:2.7.1+incompatible,cpe:2.3:a:docker:docker:2.7.1,No exploitable issue. The Docker API and client are unused in a Kubernetes CAPI controller.
5+
github.com/docker/go-units:0.4.0,cpe:2.3:a:docker:docker:0.4.0,"No exploitable issue. The Docker API and client are unused in a Kubernetes CAPI controller. All mentioned vulnerabilities relate to the Docker engine, not this package."
6+
github.com/grpc-ecosystem/go-grpc-middleware:1.3.0,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A1.3.0,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
7+
github.com/grpc-ecosystem/go-grpc-prometheus:1.2.0,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A1.2.0,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
8+
github.com/grpc-ecosystem/grpc-gateway:1.16.0,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A1.16.0,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
9+
github.com/hashicorp/consul/api:1.1.0,cpe:2.3:a:hashicorp:consul:1.1.0,No exploitable issue. Consul is unused by a Kubernetes CAPI controller.
10+
github.com/hashicorp/consul/sdk:0.1.1,cpe:2.3:a:hashicorp:consul:0.1.1,No exploitable issue. Consul is unused by a Kubernetes CAPI controller.
11+
github.com/matttproud/golang_protobuf_extensions:1.0.2-0.20181231171920-c182affec369,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agolang&cpe_product=cpe%3A%2F%3Agolang%3Aprotobuf&cpe_version=cpe%3A%2F%3Agolang%3Aprotobuf%3A1.0.2.0.20181231171920.c182.fec369,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
12+
github.com/miekg/dns:1.0.14,cpe:2.3:a:miekg-dns_project:miekg-dns:1.0.14,No exploitable issue. Kubernetes controllers do not handle or programmatically craft DNS request.
13+
github.com/prometheus/client_golang:1.11.0,cpe:2.3:a:prometheus:prometheus:1.11.0,No exploitable issue. The mentioned vulnerability is related to the Prometheus UI.
14+
github.com/prometheus/client_model:0.2.0,cpe:2.3:a:prometheus:prometheus:0.2.0,No exploitable issue. The mentioned vulnerability is related to the Prometheus UI.
15+
github.com/prometheus/common:0.32.1,cpe:2.3:a:prometheus:prometheus:0.32.1,No exploitable issue. The mentioned vulnerability is related to the Prometheus UI.
16+
github.com/prometheus/procfs:0.7.3,cpe:2.3:a:prometheus:prometheus:0.7.3,No exploitable issue. The mentioned vulnerability is related to the Prometheus UI.
17+
github.com/prometheus/tsdb:0.7.1,cpe:2.3:a:prometheus:prometheus:0.7.1,No exploitable issue. The mentioned vulnerability is related to the Prometheus UI.
18+
github.com/tmc/grpc-websocket-proxy:0.0.0-20201229170055-e5319fda7802 ,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A0.0.0.20201229170055.e5319.fda7802,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
19+
go.etcd.io/etcd/client/v2:2.305.0,cpe:2.3:a:etcd:etcd:2.305.0,"No exploitable issue. etcd is unused in Kubernetes CAPI controllers, only the Kubernetes API server interacts with an etcd database."
20+
go.etcd.io/etcd:0.5.0-alpha.5.0.20200910180754-dd1b699fc489,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aetcd&cpe_product=cpe%3A%2F%3Aetcd%3Aetcd&cpe_version=cpe%3A%2F%3Aetcd%3Aetcd%3A0.5.0.5.0.20200910180754.dd1.b699.fc489,"No exploitable issue. etcd is unused in Kubernetes CAPI controllers, only the Kubernetes API server interacts with an etcd database."
21+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:0.20.0 ,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A0.20.0,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.
22+
google.golang.org/grpc/cmd/protoc-gen-go-grpc:1.1.0,https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Agrpc&cpe_product=cpe%3A%2F%3Agrpc%3Agrpc&cpe_version=cpe%3A%2F%3Agrpc%3Agrpc%3A1.1.0,No exploitable issue. Kubernetes controllers do not make or issue gRPC calls.

releases/v0.3.0/sha1sum.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
798157ee495591e08bdd70a546ce37625d3e3f6c cluster-api-provider-cloudstack-v0.3.0.tar.gz

0 commit comments

Comments
 (0)