Container Service for Kubernetes:Use onectl to manage registered clusters

Communicate with the external cluster

When you use onectl to connect a registered cluster to an external cluster, onectl deploys a registered cluster agent in the external cluster. Then, onectl attempts to use the corresponding kubeconfig file to communicate with the external cluster by using the following methods in sequence:

1. The kubeconfig parameter

   For example, onectl runs the following command to use the ~/.kube/config file to communicate with the external cluster and connects the external cluster to the registered cluster:

   onectl cluster connect --cluster-id **** --kubeconfig ~/.kube/config

2. The KUBECONFIG environment variable

   If no kubeconfig file is specified in the preceding command, onectl uses the kubeconfig file specified in the KUBECONFIG environment variable.

3. The Kubeconfig Path parameter in the ~/.onectl/config.json file

   If the kubeconfig parameter and KUBECONFIG environment variable are not configured, onectl uses the kubeconfig file specified in the Kubeconfig Path parameter. For more information about this parameter, see Step 2: Grant permissions to the RAM user for onectl.

4. ~/.kube/config

   If none of the preceding parameters is configured, onectl uses the ~/.kube/config file.

Connect to the registered cluster

onectl performs the following steps when connecting to the registered cluster:

1. Obtains the connection information of the registered cluster and saves the information to a local file named agent.yaml.

2. Deploys a registered cluster agent in the external cluster based on the connection information.

For example, onectl runs the following command to connect the registered cluster and external cluster:

onectl cluster connect --cluster-id ****

Expected output:

Agent information saved as agent.yaml.
Installing ACK One agent using kubeconfig file **** to connect to registered cluster ****.
Confirm? [Y/n]: y
ACK One agent deployed successfully.
Check the running status of deployment ack-cluster-agent to confirm the connection status of registered cluster ****.

RAM users for cluster components

Components that run in a registered cluster need to use the AccessKey pair of a RAM user to access resources in the cloud. For example, the logtail-ds component needs to access Simple Log Service resources such as projects and Logstores. The AccessKey pair of the RAM user for the logtail-ds component is stored in the Secret named alibaba-addon-secret in the kube-system namespace of the cluster.

• If the Secret already exists in the cluster, onectl uses the AccessKey pair in the Secret to run cluster components.

• If the Secret does not exist, onectl automatically creates a RAM user named ack-one-user-[cluster id prefix] to run cluster components. For example, if the Secret does not exist, you can run the following command to create a RAM user and grant the permissions required by the terway-eniip component to the RAM user.

  onectl ram-user grant --addon terway-eniip

  Expected output:

  Ram user ack-one-user-ce313528c3 created successfully.
  Ram policy ack-one-registered-cluster-policy-terway-eniip granted to ram user ack-one-user-ce313528c3 successfully.
  Secret alibaba-addon-secret created under namespace kube-system in the cluster, it stores the access key and secret of ram user ack-one-user-ce313528c3.

Install cluster components

You need administrator permissions if you use onectl to install cluster components. onectl will check whether the service account of the registered cluster agent has administrator permissions before installing the component. If the service account does not have permissions, onectl automatically creates a temporary admin role, grants administrator permissions to the role, and assigns to the role to the service account. After the component is installed, onectl automatically deletes the temporary admin role to revoke permissions from the service account.

For example, if the registered cluster agent does not have administrator permissions, you can run the following command to grant temporary permissions to the service account of the agent, and then revoke the permissions after the component is installed:

onectl addon install logtail-ds

Expected output:

Cluster role ack-admin-tmp created.
Cluster role binding ack-admin-binding-tmp created.
Addon logtail-ds, version **** installed.
Cluster role ack-admin-tmp deleted.
Cluster role binding ack-admin-binding-tmp deleted.

The following code block shows the ClusterRole and ClusterRoleBinding of the temporary admin role:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ack-admin-tmp
  labels:
    ack/creator: "ack"
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ack-admin-binding-tmp
  namespace: kube-system
  labels:
    ack/creator: "ack"
subjects:
- kind: ServiceAccount
  name: ack
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: ack-admin-tmp
  apiGroup: rbac.authorization.k8s.io