You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/contributing/01-Proposals/MEP18/README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ sidebar_position: 18
6
6
7
7
# Autonomous Control Plane
8
8
9
-
As described in the [deployment chapter](../../../docs/04-For%20Operators/03-deployment-guide.md), we strongly recommend Kubernetes as the target platform for running the metal-stack control plane.
9
+
As described in the [deployment chapter](../../../docs/04-For%20Operators/03-deployment-guide.mdx), we strongly recommend Kubernetes as the target platform for running the metal-stack control plane.
10
10
11
11
Kubernetes clusters for this purpose are readily available from hyperscalers, metalstack.cloud, or other cloud providers. Simply using a managed Kubernetes cluster greatly simplifies a metal-stack installation. However, sometimes it might be desirable to host the metal-stack control plane autonomously, without the help of another cloud provider. Reasons for this might include corporate policies that prohibit the use of external data center products, or network constraints.
Copy file name to clipboardExpand all lines: docs/contributing/03-contribution-guideline.md
+6-2Lines changed: 6 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Open a Github issue in the project you would like to contribute. Within the issu
21
21
When opening an issue please consider the following aspects:
22
22
23
23
1. Create a meaningful issue describing the WHY? of your contribution.
24
-
1. Try to set appropriate labels to the issue. For example, attach the `triage` label to your issue if you want it to be discussed in the next [planning meeting](./02-planning-meetings.md). It might be useful to attend the meeting if you want to emphasize it being worked on.
24
+
1. Try to set appropriate labels to the issue. For example, attach the `triage` label to your issue if you want it to be discussed in the next [planning meeting](./02-planning-meetings.mdx). It might be useful to attend the meeting if you want to emphasize it being worked on.
25
25
26
26
### Pull Requests
27
27
@@ -125,7 +125,7 @@ We want to share knowledge and keep things simple. If things cannot kept simple
125
125
126
126
- Document in short sentences[^4].
127
127
- Do not explain the HOW (this is already documented by your code and documenting the obvious is considered a defect).
128
-
- Explain the WHY. Add a "to" in your documentation line to force yourself to explain the reasonning (e.g. "`<THE WHAT> to <THE TO>`").
128
+
- Explain the WHY. Add a "to" in your documentation line to force yourself to explain the reasonning (e.g. "`<THE WHAT> to <THE TO>`").
129
129
130
130
### Python
131
131
@@ -137,7 +137,11 @@ Development follows the official guide to:
137
137
- If you want to add a Python microservice to the mix, consider [pyinstaller](https://github.com/pyinstaller/pyinstaller) on Alpine to achieve small image sizes
Copy file name to clipboardExpand all lines: docs/docs/04-For Operators/02-operating-systems.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ The supported images for firewalls are:
32
32
33
33
It is fully possible to build your own operating system images and provide them through the metal-stack.
34
34
35
-
There are some conventions though that you need to follow in order to make your image installable through the metal-hammer. You should understand the [machine provisioning sequence](../05-Concepts/01-architecture.md#machine-provisioning-sequence) before starting to write your own images.
35
+
There are some conventions though that you need to follow in order to make your image installable through the metal-hammer. You should understand the [machine provisioning sequence](../05-Concepts/01-architecture.mdx#machine-provisioning-sequence) before starting to write your own images.
36
36
37
37
1. Images need to be compressed to a tarball using the [lz4](https://de.wikipedia.org/wiki/LZ4) compression algorithm.
38
38
1. An `md5` checksum file with the same name as the image archive needs to be provided in the download path along with the actual os image.
Copy file name to clipboardExpand all lines: docs/docs/04-For Operators/03-deployment-guide.mdx
+26-24Lines changed: 26 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,9 +3,10 @@ slug: /deployment-guide
3
3
title: Deployment Guide
4
4
sidebar_position: 3
5
5
---
6
+
6
7
# Deployment Guide
7
8
8
-
We are bootstrapping the [metal control plane](../05-Concepts/01-architecture.md#metal-control-plane) as well as our [partitions](../05-Concepts/01-architecture.md#partitions) with [Ansible](https://www.ansible.com/) through CI.
9
+
We are bootstrapping the [metal control plane](../05-Concepts/01-architecture.mdx#metal-control-plane) as well as our [partitions](../05-Concepts/01-architecture.mdx#partitions) with [Ansible](https://www.ansible.com/) through CI.
9
10
10
11
In order to build up your deployment, we recommend to make use of the same Ansible roles that we are using by ourselves in order to deploy the metal-stack. You can find them in the repository called [metal-roles](https://github.com/metal-stack/metal-roles).
11
12
@@ -30,7 +31,7 @@ You can use the [mini-lab](https://github.com/metal-stack/mini-lab) as a templat
30
31
The metal control plane is typically deployed in a Kubernetes cluster. Therefore, this document will assume that you have a Kubernetes cluster ready for getting deployed. Even though it is theoretically possible to deploy metal-stack without Kubernetes, we strongly advise you to use the described method because we believe that Kubernetes gives you a lot of benefits regarding the stability and maintainability of the application deployment.
31
32
32
33
:::tip
33
-
For metal-stack it does not matter where your control plane Kubernetes cluster is located. You can of course use a cluster managed by a hyperscaler. This has the advantage of not having to setup Kubernetes by yourself and could even become beneficial in terms of fail-safe operation. However, we also describe a solution of how to setup metal-stack with a self-hosted, [Autonomous Control Plane](../../contributing/01-Proposals/MEP18/README.md) cluster. The only requirement from metal-stack is that your partitions can establish network connections to the metal control plane. If you are interested, you can find a reasoning behind this deployment decision [here](../05-Concepts/01-architecture.md#target-deployment-platforms).
34
+
For metal-stack it does not matter where your control plane Kubernetes cluster is located. You can of course use a cluster managed by a hyperscaler. This has the advantage of not having to setup Kubernetes by yourself and could even become beneficial in terms of fail-safe operation. However, we also describe a solution of how to setup metal-stack with a self-hosted, [Autonomous Control Plane](../../contributing/01-Proposals/MEP18/README.md) cluster. The only requirement from metal-stack is that your partitions can establish network connections to the metal control plane. If you are interested, you can find a reasoning behind this deployment decision [here](../05-Concepts/01-architecture.mdx#target-deployment-platforms).
34
35
:::
35
36
36
37
Let's start off with a fresh folder for your deployment:
@@ -77,10 +78,10 @@ You can already define the `inventories/group_vars/all/images.yaml` file. It con
@@ -232,7 +233,7 @@ metal_control_plane_ingress_dns: <your-dns-domain> # if you do not have a DNS en
232
233
233
234
We have several components in our stack that communicate over encrypted gRPC just like Kubernetes components do.
234
235
235
-
For the very basic setup you will need to create self-signed certificates for the communication between the following components (see [architecture](../05-Concepts/01-architecture.md) document):
236
+
For the very basic setup you will need to create self-signed certificates for the communication between the following components (see [architecture](../05-Concepts/01-architecture.mdx) document):
236
237
237
238
- [metal-api](https://github.com/metal-stack/metal-api) and [masterdata-api](https://github.com/metal-stack/masterdata-api) (in-cluster traffic communication)
238
239
- [metal-api](https://github.com/metal-stack/metal-api) and [metal-hammer](https://github.com/metal-stack/metal-hammer) (partition to control plane communication)
@@ -448,15 +449,16 @@ For the actual communication between the metal-api and the user clients (REST AP
448
449
Finally, it should be possible to run the deployment through a Docker container. Make sure to have the [Kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) of your cluster and set the path in the following command accordingly:
Copy file name to clipboardExpand all lines: docs/docs/05-Concepts/04-Kubernetes/01-gardener.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,7 +59,7 @@ Every Kubernetes cluster that is fully provisioned and managed by Gardener is ca
59
59
60
60
During the provisioning flow of a cluster, Gardener emits resources that are expected to be reconciled by controllers of a cloud provider. This section briefly describes the controllers implemented by metal-stack to allow the creation of a Kubernetes cluster on metal-stack infrastructure.
61
61
62
-
If you want to learn how to deploy metal-stack with Gardener, please check out the corresponding [deployment-guide section](../../04-For%20Operators/03-deployment-guide.md#gardener-with-metal-stack).
62
+
If you want to learn how to deploy metal-stack with Gardener, please check out the corresponding [deployment-guide section](../../04-For%20Operators/03-deployment-guide.mdx#gardener-with-metal-stack).
63
63
64
64
### gardener-extension-provider-metal
65
65
@@ -93,9 +93,9 @@ Some suggestions for the initial K8s cluster are:
93
93
94
94
Suggestions for default values are:
95
95
96
-
-`gcp_machine_type`: e2-standard-8
97
-
-`gcp_autoscaling_min_nodes`: 1
98
-
-`gcp_autoscaling_max_nodes`: 3
96
+
-`gcp_machine_type`: e2-standard-8
97
+
-`gcp_autoscaling_min_nodes`: 1
98
+
-`gcp_autoscaling_max_nodes`: 3
99
99
100
100
### Initial Cluster on metalstack.cloud
101
101
@@ -118,13 +118,13 @@ After setting up the initial K8s cluster and metal-stack, Gardener can be deploy
118
118
119
119
This deploys the following components:
120
120
121
-
- virtual garden
122
-
- Gardener control plane components
123
-
- soil cluster
124
-
- managed seed cluster (into the metal-stack partition)
121
+
- virtual garden
122
+
- Gardener control plane components
123
+
- soil cluster
124
+
- managed seed cluster (into the metal-stack partition)
125
125
126
126
In summary, this results in the following:
127
127
128
-
-`Garden cluster` created in the initial cluster
129
-
-`soil cluster` created in the initial cluster. This will be the `initial seed` used for spinning up `shooted seeds` in the metal-stack partition
130
-
-`shooted seed` inside the metal-stack partition, where all `shoots` are derived from
128
+
-`Garden cluster` created in the initial cluster
129
+
-`soil cluster` created in the initial cluster. This will be the `initial seed` used for spinning up `shooted seeds` in the metal-stack partition
130
+
-`shooted seed` inside the metal-stack partition, where all `shoots` are derived from
Copy file name to clipboardExpand all lines: docs/docs/06-For CISOs/Security/03-cryptography.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ metal-stack incorporates multiple layers of cryptographic protection and secure
10
10
11
11
### TLS Certificate Management
12
12
13
-
TLS certificates used by metal-stack components - as outlined in the [architecture section](../../05-Concepts/01-architecture.md) - can be generated using either RSA 4096-bit or ECDSA 256-bit keys. We recommend RSA 4096.
13
+
TLS certificates used by metal-stack components - as outlined in the [architecture section](../../05-Concepts/01-architecture.mdx) - can be generated using either RSA 4096-bit or ECDSA 256-bit keys. We recommend RSA 4096.
14
14
15
15
By default, in-cluster communication is not encrypted. If encryption is required within the cluster, it must be configured manually using a service mesh (e.g., Istio or Linkerd) or a similar mechanism.
16
16
For outbound traffic, we recommend integrating cert-manager in combination with Let's Encrypt to handle certificate issuance and enable automated certificate rotation for ingress domains. In offline environments where Let's Encrypt cannot be used, the certificates must be issued and managed manually or via an internal CA.
Copy file name to clipboardExpand all lines: docs/docs/08-References/Storage/duros-controller/MULTITENANCY.md
+2-3Lines changed: 2 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ Multi tenancy in metal-stack and gardener are based on projects. In metal-stack,
20
20
21
21
Lightbits storage has also the notion of a project, once a cluster is created, a new project is created in the lightos storage API, the project there matches the project from the gardener/metal-stack perspective. For every cluster an authentication token in the JWT format is created, this token is able to create/update/list/delete volumes in the lightos cluster in the given project, resp. lightos project. For every kubernetes cluster, even in the same project, an individual JWT token is created. The token is also set to have a 8 day validity, 1 day before the token will get invalid and the cluster still exists, a new token is issued.
22
22
23
-
The duros-controller is responsible to create such tokens, it is deployed in the seed's shoot namespace (find details on gardener architecture [here](../../../05-Concepts/01-architecture.md)). This namespace is fully managed by the provider and invisible for the cluster user. Once the token has been created, the token is stored in a secret in the actual user cluster alongside with the deployment of the lightbits CSI driver and storage classes. This CSI driver will then be responsible to create/update/delete volumes based on the manifests deployed in the cluster.
23
+
The duros-controller is responsible to create such tokens, it is deployed in the seed's shoot namespace (find details on gardener architecture [here](../../../05-Concepts/01-architecture.mdx)). This namespace is fully managed by the provider and invisible for the cluster user. Once the token has been created, the token is stored in a secret in the actual user cluster alongside with the deployment of the lightbits CSI driver and storage classes. This CSI driver will then be responsible to create/update/delete volumes based on the manifests deployed in the cluster.
In the upcoming lightos release the performance aspects of multi tenancy are addressed. This is achieved that it will be possible to cap the maximum throughput possible per volume. This will ensure that no single tenant is able to saturate the whole lightos cluster and impact other tenants using this lightos cluster.
128
+
In the upcoming lightos release the performance aspects of multi tenancy are addressed. This is achieved that it will be possible to cap the maximum throughput possible per volume. This will ensure that no single tenant is able to saturate the whole lightos cluster and impact other tenants using this lightos cluster.
Copy file name to clipboardExpand all lines: versioned_docs/version-v0.21.10/contributing/01-Proposals/MEP18/README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ sidebar_position: 18
6
6
7
7
# Autonomous Control Plane
8
8
9
-
As described in the [deployment chapter](../../../docs/04-For%20Operators/03-deployment-guide.md), we strongly recommend Kubernetes as the target platform for running the metal-stack control plane.
9
+
As described in the [deployment chapter](../../../docs/04-For%20Operators/03-deployment-guide.mdx), we strongly recommend Kubernetes as the target platform for running the metal-stack control plane.
10
10
11
11
Kubernetes clusters for this purpose are readily available from hyperscalers, metalstack.cloud, or other cloud providers. Simply using a managed Kubernetes cluster greatly simplifies a metal-stack installation. However, sometimes it might be desirable to host the metal-stack control plane autonomously, without the help of another cloud provider. Reasons for this might include corporate policies that prohibit the use of external data center products, or network constraints.
Copy file name to clipboardExpand all lines: versioned_docs/version-v0.21.10/contributing/03-contribution-guideline.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -125,7 +125,7 @@ We want to share knowledge and keep things simple. If things cannot kept simple
125
125
126
126
- Document in short sentences[^4].
127
127
- Do not explain the HOW (this is already documented by your code and documenting the obvious is considered a defect).
128
-
- Explain the WHY. Add a "to" in your documentation line to force yourself to explain the reasonning (e.g. "`<THE WHAT> to <THE TO>`").
128
+
- Explain the WHY. Add a "to" in your documentation line to force yourself to explain the reasonning (e.g. "`<THE WHAT> to <THE TO>`").
129
129
130
130
### Python
131
131
@@ -137,7 +137,11 @@ Development follows the official guide to:
137
137
- If you want to add a Python microservice to the mix, consider [pyinstaller](https://github.com/pyinstaller/pyinstaller) on Alpine to achieve small image sizes
Copy file name to clipboardExpand all lines: versioned_docs/version-v0.21.10/docs/04-For Operators/02-operating-systems.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ The supported images for firewalls are:
32
32
33
33
It is fully possible to build your own operating system images and provide them through the metal-stack.
34
34
35
-
There are some conventions though that you need to follow in order to make your image installable through the metal-hammer. You should understand the [machine provisioning sequence](../05-Concepts/01-architecture.md#machine-provisioning-sequence) before starting to write your own images.
35
+
There are some conventions though that you need to follow in order to make your image installable through the metal-hammer. You should understand the [machine provisioning sequence](../05-Concepts/01-architecture.mdx#machine-provisioning-sequence) before starting to write your own images.
36
36
37
37
1. Images need to be compressed to a tarball using the [lz4](https://de.wikipedia.org/wiki/LZ4) compression algorithm.
38
38
1. An `md5` checksum file with the same name as the image archive needs to be provided in the download path along with the actual os image.
0 commit comments