Deckhouse Platform on built-in virtualization in Deckhouse Platform: Preparing environment

To deploy Deckhouse Platform on built-in virtualization environment and enable integration (for example, ordering nodes for a nested cluster within the virtualization environment), you must perform some preliminary configuration. Create a user (ServiceAccount), assign permissions, and obtain a kubeconfig.

The resources of the new cluster are created in a single namespace of the virtualization cluster, and the ServiceAccount gets permissions only in this namespace. If the virtualization cluster is shared with other teams, choose the namespace of your project. To create the ServiceAccount and assign a role to it, you need administrator permissions in the chosen namespace.

1. Create a user (ServiceAccount and token) by running:

   d8 k create -f -<<EOF
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sa-demo
     namespace: <NAMESPACE>
   ---
   apiVersion: v1
   kind: Secret
   metadata:
     name: sa-demo-token
     namespace: <NAMESPACE>
     annotations:
       kubernetes.io/service-account.name: sa-demo
   type: kubernetes.io/service-account-token
   EOF
   

   Replace <NAMESPACE> with the chosen namespace. Specify the same namespace in the provider.namespace parameter of the config.yml file at the “Installation” step.

2. Assign a role to the user by running:

   d8 k create -f -<<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: sa-demo-rb
     namespace: <NAMESPACE>
   subjects:
     - kind: ServiceAccount
       name: sa-demo
       namespace: <NAMESPACE>
   roleRef:
     kind: ClusterRole
     name: d8:use:role:manager
     apiGroup: rbac.authorization.k8s.io
   EOF
   

3. Enable kubeconfig issuance via API. Open the user-authn module settings (create a ModuleConfig resource named user-authn if it does not exist):

   d8 k edit mc user-authn
   

4. Add the following section to the settings block and save:

   publishAPI:
     enabled: true
   

5. Generate a kubeconfig to be used in the cluster initial configuration file in the next step:

   cat <<EOF > kubeconfig
   apiVersion: v1
   clusters:
   - cluster:
       server: https://<KUBE-APISERVER-URL>   # Replace this with the actual API server address for the cluster.
     name: <CLUSTER-NAME>                     # Replace with the cluster name.
   contexts:
   - context:
       cluster: <CLUSTER-NAME>                # Replace with the cluster name.
       user: sa-demo
       namespace: <NAMESPACE>
     name: sa-demo-context
   current-context: sa-demo-context
   kind: Config
   preferences: {}
   users:
   - name: sa-demo
     user:
       token: $(d8 k get secret sa-demo-token -n <NAMESPACE> -o json | jq -rc .data.token | base64 -d)
   EOF
   

   Encode the generated kubeconfig file using Base64 encoding (it appears in the initial configuration file as follows):

   base64 kubeconfig | tr -d '\n'