Skip to content

Commit bdd0540

Browse files
Rahul Sharmarahulait
Rahul Sharma
authored and
rahulait
committed
update dualstack flavor for kubeadm and k3s based clusters
1 parent 1bd9622 commit bdd0540

File tree

6 files changed

+225
-181
lines changed

6 files changed

+225
-181
lines changed

‎docs/src/SUMMARY.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
- [Etcd Backup](./topics/flavors/etcd-backup-restore.md)
2323
- [Etcd-disk](./topics/flavors/etcd-disk.md)
2424
- [Flatcar](./topics/flavors/flatcar.md)
25-
- [NodeIPAM CCM (kubeadm)](./topics/flavors/nodeipam-ccm.md)
2625
- [k3s](./topics/flavors/k3s.md)
2726
- [konnectivity (kubeadm)](./topics/flavors/konnectivity.md)
2827
- [rke2](./topics/flavors/rke2.md)

‎docs/src/topics/flavors/dual-stack.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
# Dual-Stack
2+
3+
This flavor enables allocating both IPv4 and IPv6 ranges to nodes within k8s cluster. This flavor disables nodeipam controller within kube-controller-manager and uses CCM specific nodeipam controller to allocate CIDRs to Nodes. IPv6 ranges are allocated to VPC, Subnets and Nodes attached to those subnets. Pods get both ipv4 and ipv6 addresses.
4+
25
## Specification
36
| Supported Control Plane | CNI | Default OS | Installs ClusterClass | IPv4 | IPv6 |
47
|-------------------------|--------|--------------|-----------------------|------|------|

‎docs/src/topics/flavors/nodeipam-ccm.md‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎templates/flavors/k3s/dual-stack/kustomization.yaml‎

Lines changed: 106 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,56 @@
11
apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
4-
- ../vpcless
4+
- ../default
55

66
patches:
77
- target:
88
group: infrastructure.cluster.x-k8s.io
99
version: v1alpha2
10-
kind: LinodeCluster
10+
kind: LinodeVPC
1111
patch: |-
1212
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
13-
kind: LinodeCluster
13+
kind: LinodeVPC
1414
metadata:
1515
name: ${CLUSTER_NAME}
1616
spec:
17-
nodeBalancerFirewallRef: null
17+
ipv6Range:
18+
- range: auto
19+
subnets:
20+
- ipv4: ${VPC_NETWORK_CIDR:=10.0.0.0/8}
21+
label: default
22+
ipv6Range:
23+
- range: auto
1824
- target:
19-
group: cluster.x-k8s.io
20-
version: v1beta1
21-
kind: Cluster
25+
group: infrastructure.cluster.x-k8s.io
26+
version: v1alpha2
27+
kind: LinodeMachineTemplate
2228
patch: |-
23-
apiVersion: cluster.x-k8s.io/v1beta1
24-
kind: Cluster
29+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
30+
kind: LinodeMachineTemplate
2531
metadata:
26-
name: ${CLUSTER_NAME}
32+
name: ${CLUSTER_NAME}-control-plane
2733
spec:
28-
clusterNetwork:
29-
pods:
30-
cidrBlocks:
31-
- 10.192.0.0/10
32-
- fd02::/80
33-
services:
34-
cidrBlocks:
35-
- 10.96.0.0/12
36-
- fd03::/108
34+
template:
35+
spec:
36+
ipv6Options:
37+
enableSLAAC: true
38+
isPublicIPv6: true
39+
- target:
40+
group: infrastructure.cluster.x-k8s.io
41+
version: v1alpha2
42+
kind: LinodeMachineTemplate
43+
patch: |-
44+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
45+
kind: LinodeMachineTemplate
46+
metadata:
47+
name: ${CLUSTER_NAME}-md-0
48+
spec:
49+
template:
50+
spec:
51+
ipv6Options:
52+
enableSLAAC: true
53+
isPublicIPv6: true
3754
- target:
3855
group: controlplane.cluster.x-k8s.io
3956
version: v1beta2
@@ -47,9 +64,7 @@ patches:
4764
kthreesConfigSpec:
4865
serverConfig:
4966
kubeControllerManagerArgs:
50-
- "node-cidr-mask-size-ipv6=96"
51-
clusterCidr: "10.192.0.0/10,fd02::/80"
52-
serviceCidr: "10.96.0.0/12,fd03::/108"
67+
- "allocate-node-cidrs=false"
5368
- target:
5469
group: controlplane.cluster.x-k8s.io
5570
version: v1beta2
@@ -65,18 +80,29 @@ patches:
6580
namespace: kube-system
6681
spec:
6782
targetNamespace: kube-system
68-
version: ${CILIUM_VERSION:=1.15.4}
83+
version: ${CILIUM_VERSION:=1.16.10}
6984
chart: cilium
7085
repo: https://helm.cilium.io/
7186
bootstrap: true
7287
valuesContent: |-
7388
bgpControlPlane:
7489
enabled: true
90+
routingMode: native
91+
kubeProxyReplacement: true
92+
ipv4NativeRoutingCIDR: ${VPC_NETWORK_CIDR:=10.0.0.0/8}
93+
ipv6NativeRoutingCIDR: ::/0
94+
tunnelProtocol: ""
95+
enableIPv4Masquerade: true
96+
enableIPv6Masquerade: false
7597
policyAuditMode: ${FW_AUDIT_ONLY:=true}
7698
hostFirewall:
7799
enabled: true
78100
extraConfig:
79101
allow-localhost: policy
102+
k8sServiceHost: 10.0.0.2
103+
k8sServicePort: 6443
104+
extraArgs:
105+
- --nodeport-addresses=0.0.0.0/0
80106
ipam:
81107
mode: kubernetes
82108
ipv4:
@@ -85,36 +111,68 @@ patches:
85111
enabled: true
86112
k8s:
87113
requireIPv4PodCIDR: true
114+
requireIPv6PodCIDR: true
88115
hubble:
89116
relay:
90117
enabled: true
91118
ui:
92119
enabled: true
93120
- target:
94-
group: controlplane.cluster.x-k8s.io
95-
version: v1beta2
96-
kind: KThreesControlPlane
97-
patch: |-
98-
- op: replace
99-
path: /spec/kthreesConfigSpec/preK3sCommands
100-
value:
101-
- |
102-
mkdir -p /etc/rancher/k3s/config.yaml.d/
103-
echo "node-ip: $(ip a s eth0 |grep -E 'inet ' |cut -d' ' -f6|cut -d/ -f1 | grep -E '192.168'),$(ip a s eth0 |grep -E 'inet6 ' |cut -d' ' -f6|cut -d/ -f1 | grep -vE 'fe80')" >> /etc/rancher/k3s/config.yaml.d/capi-config.yaml
104-
- sed -i '/swap/d' /etc/fstab
105-
- swapoff -a
106-
- hostnamectl set-hostname '{{ ds.meta_data.label }}' && hostname -F /etc/hostname
107-
- target:
108-
group: bootstrap.cluster.x-k8s.io
109-
version: v1beta2
110-
kind: KThreesConfigTemplate
121+
kind: HelmChartProxy
122+
name: .*-linode-cloud-controller-manager
111123
patch: |-
112124
- op: replace
113-
path: /spec/template/spec/preK3sCommands
114-
value:
115-
- |
116-
mkdir -p /etc/rancher/k3s/config.yaml.d/
117-
echo "node-ip: $(ip a s eth0 |grep -E 'inet ' |cut -d' ' -f6|cut -d/ -f1 | grep -E '192.168'),$(ip a s eth0 |grep -E 'inet6 ' |cut -d' ' -f6|cut -d/ -f1 | grep -vE 'fe80')" >> /etc/rancher/k3s/config.yaml.d/capi-config.yaml
118-
- sed -i '/swap/d' /etc/fstab
119-
- swapoff -a
120-
- hostnamectl set-hostname '{{ ds.meta_data.label }}' && hostname -F /etc/hostname
125+
path: /spec/valuesTemplate
126+
value: |
127+
routeController:
128+
vpcNames: {{ .InfraCluster.spec.vpcRef.name }}
129+
clusterCIDR: ${VPC_NETWORK_CIDR:=10.192.0.0/10}
130+
configureCloudRoutes: true
131+
secretRef:
132+
name: "linode-token-region"
133+
image:
134+
tag: v0.9.0
135+
pullPolicy: IfNotPresent
136+
enableNodeIPAM: true
137+
tolerations:
138+
# The CCM can run on Nodes tainted as masters
139+
- key: "node-role.kubernetes.io/control-plane"
140+
effect: "NoSchedule"
141+
# The CCM is a "critical addon"
142+
- key: "CriticalAddonsOnly"
143+
operator: "Exists"
144+
# This taint is set on all Nodes when an external CCM is used
145+
- key: node.cloudprovider.kubernetes.io/uninitialized
146+
value: "true"
147+
effect: NoSchedule
148+
- key: node.kubernetes.io/not-ready
149+
operator: Exists
150+
effect: NoSchedule
151+
- key: node.kubernetes.io/unreachable
152+
operator: Exists
153+
effect: NoSchedule
154+
- key: node.cilium.io/agent-not-ready
155+
operator: Exists
156+
effect: NoSchedule
157+
env:
158+
- name: LINODE_EXTERNAL_SUBNET
159+
value: ${LINODE_EXTERNAL_SUBNET:=""}
160+
- name: LINODE_URL
161+
value: ${LINODE_URL:="https://api.linode.com"}
162+
- name: SSL_CERT_DIR
163+
value: "/tls"
164+
- name: LINODE_API_VERSION
165+
value: v4beta
166+
- name: KUBERNETES_SERVICE_HOST
167+
value: "{{ .InfraCluster.spec.controlPlaneEndpoint.host }}"
168+
- name: KUBERNETES_SERVICE_PORT
169+
value: "{{ .InfraCluster.spec.controlPlaneEndpoint.port }}"
170+
volumeMounts:
171+
- name: cacert
172+
mountPath: /tls
173+
readOnly: true
174+
volumes:
175+
- name: cacert
176+
secret:
177+
secretName: linode-ca
178+
defaultMode: 420

0 commit comments

Comments
 (0)