📖 Exposing the control plane endpoint #1757
Conversation
✅ Deploy Preview for kubernetes-sigs-cluster-api-openstack ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mdbooth, mnaser The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
|
||
| ### Bugs | ||
|
|
||
| While Cluster API specifies that `controlPlaneEndpoint.host` may be either a hostname or an IP address, there are still several uses of it in CAPO which assume it is an IP address and will break if it is not. |
There was a problem hiding this comment.
@EmilienM maybe you can check this and update it after your RP merge :)
| The control plane endpoint can be provided by a floating IP connected directly to one of the control plane machines. | ||
|
|
||
| ```mermaid | ||
| flowchart TD |
There was a problem hiding this comment.
I don't remember clearly but I only tried with 1 control plane and 1 FIP
not sure how we can set 3 control plan + 1 FIP ? and maybe we don't need talk in our doc about not recommended settings, instead, talking about 1 control plane + 1 FIP as if there is no Octavia support?
| - [Exposing the control plane endpoint](control-plane-endpoint.md) | ||
| - [CRD changes](crd-changes/index.md) | ||
| - [External cloud provider](external-cloud-provider.md) | ||
| - [Mover](mover.md) | ||
| - [Troubleshooting](troubleshooting.md) |
There was a problem hiding this comment.
I think we should keep this in sync with the summary (side bar). Alternatively have the sub-sections in only one place. For the other pages it seems like we don't have the sub-sections in the summary, so perhaps that would make sense here too. I don't have a strong opinion on which way we do it though 🙂
For some reason the link does not work for the control plane endpoint in the rendered page. Not sure why.
|
|
||
| ### Exposing additional control plane services running on other ports | ||
|
|
||
| If the control plane machines are hosting services other than the kubernetes API server, these may also be exposed via the API server loadbalancer by specifying their ports in `apiServerLoadBalancer.additionalPorts`. If using managed security groups, these ports will be automatically added to the control plane security group. |
There was a problem hiding this comment.
with hardcoded proto tcp/udp
|
really nice work |
|
|
||
| ### Restricting access to the loadbalancer endpoint | ||
|
|
||
| It is possible to restrict access to the control plane endpoint to certain source address ranges by specifying them in `apiServerLoadBalancer.allowedCIDRs`. When setting this list, the following additional CIDRs will be automatically added to the allowed list: |
There was a problem hiding this comment.
Might be worth to redirect user to the configuration section of this field for further information:
https://cluster-api-openstack.sigs.k8s.io/clusteropenstack/configuration#restrict-access-to-the-api-server
| - [Specifying an alternate primary API server port](#specifying-an-alternate-primary-api-server-port) | ||
| - [Alternate Octavia provider (e.g. OVN)](#alternate-octavia-provider-eg-ovn) | ||
| - [Bugs](#bugs) | ||
| - [Floating IP](#floating-ip) |
There was a problem hiding this comment.
Should Floating IP and No loadbalancer sections have the same indentation of the Octavia section?
|
The Kubernetes project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
k8s-ci-robot
added
the
lifecycle/stale
|
The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten |
k8s-ci-robot
added
lifecycle/rotten
|
/remove-lifecycle rotten |
k8s-ci-robot
removed
the
lifecycle/rotten
Adds a new docs section on exposing the control plane endpoint. Covers some of the same ground as the configuration doc, but from a higher level.