Deckhouse Virtualization Platform for bare metal

# General cluster parameters.
# https://deckhouse.io/products/kubernetes-platform/documentation/v1/reference/api/cr.html#clusterconfiguration
apiVersion: deckhouse.io/v1
kind: ClusterConfiguration
clusterType: Static
# Address space of the cluster Pods.
# You might consider changing this. Ensure that there are no overlaps with other subnets.
podSubnetCIDR: <POD_SUBNET_CIDR>
# Address space of the cluster services.
# You might consider changing this. Ensure that there are no overlaps with other subnets.
serviceSubnetCIDR: <SERVICE_SUBNET_CIDR>
kubernetesVersion: "Automatic"
# Cluster domain (used for local routing).
clusterDomain: "internal.cluster.local"
# Default container runtime on cluster nodes (NodeGroups).
defaultCRI: "ContainerdV2"
---
# Deckhouse module settings.
# https://deckhouse.io/modules/deckhouse/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: deckhouse
spec:
  version: 1
  enabled: true
  settings:
    bundle: Default
    # Deckhouse release channel. Early Access is stable enough for test environments.
    # More info: https://deckhouse.io/products/kubernetes-platform/documentation/v1/reference/release-channels.html
    releaseChannel: EarlyAccess
    logLevel: Info
    # Settings for accessing the container registry with Deckhouse images.
    registry:
      mode: Unmanaged
      unmanaged:
        imagesRepo: registry.deckhouse.io/deckhouse/ce
---
# Global Deckhouse settings.
# https://deckhouse.io/products/kubernetes-platform/documentation/v1/reference/api/global.html#parameters
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: global
spec:
  version: 2
  settings:
    # StorageClass used for cluster PVCs when none is specified explicitly.
    defaultClusterStorageClass: nfs-storage-class
    modules:
      # Template for system application URLs in the cluster.
      # E.g., Grafana for `%s.example.com` is available at `grafana.example.com`, the DVP web interface — at `console.example.com`.
      # The domain MUST NOT match the cluster domain (`clusterDomain`).
      # You might consider changing this.
      publicDomainTemplate: "<PUBLIC_DOMAIN_TEMPLATE>"
      # The HTTPS implementation used by Deckhouse modules.
      # https://deckhouse.io/products/kubernetes-platform/documentation/v1/reference/api/global.html#parameters-modules-https
      https:
        certManager:
          # Self-signed certificates: Let's Encrypt cannot validate a domain that is not published on the internet.
          clusterIssuerName: selfsigned
---
# cert-manager module settings.
# https://deckhouse.io/modules/cert-manager/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: cert-manager
spec:
  version: 1
  enabled: true
  settings:
    # Let's Encrypt ClusterIssuers are not created: the cluster domain is not published on the internet.
    disableLetsencrypt: true
---
# user-authn module settings.
# https://deckhouse.io/modules/user-authn/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: user-authn
spec:
  version: 2
  enabled: true
  settings:
    # Enabling access to the API server through Ingress.
    # https://deckhouse.io/modules/user-authn/configuration.html#parameters-publishapi
    publishAPI:
      enabled: true
      https:
        mode: Global
        global:
          kubeconfigGeneratorMasterCA: ""
---
# cni-cilium module settings.
# https://deckhouse.io/modules/cni-cilium/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: cni-cilium
spec:
  version: 1
  # Enable cni-cilium module.
  enabled: true
  settings:
    tunnelMode: VXLAN
---
# admission-policy-engine module settings.
# https://deckhouse.io/modules/admission-policy-engine/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: admission-policy-engine
spec:
  version: 1
  enabled: true
---
# multitenancy-manager module settings (projects, quotas).
# https://deckhouse.io/modules/multitenancy-manager/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: multitenancy-manager
spec:
  version: 1
  enabled: true
---
# Static cluster settings (internal node networks).
# https://deckhouse.io/products/kubernetes-platform/documentation/v1/reference/api/cr.html#staticclusterconfiguration
apiVersion: deckhouse.io/v1
kind: StaticClusterConfiguration
# Internal node networks for Kubernetes components (kube-apiserver, kubelet, etc.).
# Required for static clusters with virtualization and when nodes use multiple interfaces.
# Must include master and worker node IP addresses.
internalNetworkCIDRs:
  # You might consider changing this. Ensure that there are no overlaps with other subnets.
  - <INTERNAL_NETWORK_CIDRS>
---
# Worker NodeGroup for static machines.
# https://deckhouse.io/modules/node-manager/cr.html#nodegroup
apiVersion: deckhouse.io/v1
kind: NodeGroup
metadata:
  name: worker
spec:
  nodeType: Static
  staticInstances:
    # Single worker StaticInstance in this quick start.
    count: 1
    labelSelector:
      matchLabels:
        role: worker
  # Labels applied to every node of this group.
  nodeTemplate:
    labels:
      storage: "true"
---
# SSH credentials for Cluster API Provider Static (CAPS) to connect to the worker node (private key is generated in the browser on step 2).
# https://deckhouse.io/modules/node-manager/cr.html#sshcredentials
apiVersion: deckhouse.io/v1alpha2
kind: SSHCredentials
metadata:
  name: caps
spec:
  user: caps
  privateSSHKey: <CAPS_SSH_PRIVATE_KEY_BASE64>
---
# Static worker instance for CAPS (address from step 2 cluster parameters).
# https://deckhouse.io/modules/node-manager/cr.html#staticinstance
apiVersion: deckhouse.io/v1alpha2
kind: StaticInstance
metadata:
  name: dvp-worker-1
  labels:
    role: worker
spec:
  address: "<WORKER_NODE_IP>"
  credentialsRef:
    kind: SSHCredentials
    name: caps
---
# csi-nfs module settings.
# https://deckhouse.io/modules/csi-nfs/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: csi-nfs
spec:
  version: 1
  enabled: true
---
# virtualization module settings (Deckhouse Virtualization Container Registry (DVCR), VM networks).
# https://deckhouse.io/modules/virtualization/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: virtualization
spec:
  version: 1
  enabled: true
  settings:
    dvcr:
      storage:
        persistentVolumeClaim:
          # Size of the DVCR image storage.
          size: 50Gi
        type: PersistentVolumeClaim
    # CIDRs for virtual machine traffic (must not overlap with pod/service subnets).
    virtualMachineCIDRs:
      # You might consider changing this. Ensure that there are no overlaps with other subnets.
      - <VIRTUAL_MACHINE_CIDRS>
---
# NFS StorageClass for cluster and virtualization storage.
# https://deckhouse.io/modules/csi-nfs/cr.html#nfsstorageclass
apiVersion: storage.deckhouse.io/v1alpha1
kind: NFSStorageClass
metadata:
  name: nfs-storage-class
spec:
  connection:
    # You might consider changing this.
    host: <NFS_HOST>
    # You might consider changing this.
    share: <NFS_SHARE>
    nfsVersion: "4.1"
  reclaimPolicy: Delete
  volumeBindingMode: WaitForFirstConsumer
  # Nodes allowed to mount volumes of this StorageClass.
  workloadNodes:
    nodeSelector:
      matchLabels:
        storage: "true"
---
# ingress-nginx module settings.
# https://deckhouse.io/modules/ingress-nginx/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: ingress-nginx
spec:
  version: 1
  enabled: true
---
# Ingress NGINX Controller (HostPort on control-plane / master for this quick start).
# https://deckhouse.io/modules/ingress-nginx/cr.html
apiVersion: deckhouse.io/v1
kind: IngressNginxController
metadata:
  name: nginx
spec:
  ingressClass: nginx
  # HostPort exposes HTTP/HTTPS on the master node (ports 80 and 443).
  inlet: HostPort
  hostPort:
    httpPort: 80
    httpsPort: 443
  # You might consider changing this. How long NGINX waits for worker processes to finish on a configuration reload.
  config:
    worker-shutdown-timeout: 300s
  nodeSelector:
    node-role.kubernetes.io/control-plane: ""
  tolerations:
    - effect: NoSchedule
      key: node-role.kubernetes.io/control-plane
      operator: Exists
---
# snapshot-controller module settings.
# https://deckhouse.io/modules/snapshot-controller/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: snapshot-controller
spec:
  version: 1
  enabled: true
---
# console module settings.
# https://deckhouse.io/modules/console/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: console
spec:
  version: 2
  enabled: true
---
# prometheus module settings (metrics, Grafana).
# https://deckhouse.io/modules/prometheus/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: prometheus
spec:
  version: 2
  enabled: true
  settings:
    # Long-term metric storage is not started; the main Prometheus keeps metrics for 15 days.
    longtermRetentionDays: 0
---
# upmeter module settings (availability metrics, status page).
# https://deckhouse.io/modules/upmeter/configuration.html
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: upmeter
spec:
  enabled: true
---
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: local-path-provisioner
spec:
  enabled: false
---
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: pod-reloader
spec:
  enabled: false
---
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: secret-copier
spec:
  enabled: false
---
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: namespace-configurator
spec:
  enabled: false
---
# Project for multitenancy-manager (resource quota and admins).
# https://deckhouse.io/modules/multitenancy-manager/cr.html#project
apiVersion: deckhouse.io/v1alpha2
kind: Project
metadata:
  name: test-project
spec:
  description: test-project
  projectTemplateName: default
  parameters:
    resourceQuota:
      requests:
        cpu: 20
        memory: 20Gi
      limits:
        cpu: 20
        memory: 20Gi
    # You might consider changing this. With `Isolated` (the template default) VM images cannot be downloaded over HTTP and VMs get no internet access.
    networkPolicy: NotRestricted
    administrators:
      - subject: User
        name: admin@deckhouse.io
---
# Cluster-wide admin access for Dex / web interfaces (required for the DVP web interface).
# https://deckhouse.io/modules/user-authz/cr.html#clusterauthorizationrule
apiVersion: deckhouse.io/v1
kind: ClusterAuthorizationRule
metadata:
  name: admin
spec:
  # Kubernetes RBAC accounts list.
  subjects:
    - kind: User
      name: admin@deckhouse.io
  # Pre-defined access template.
  accessLevel: SuperAdmin
  # Allow kubectl port-forward.
  portForwarding: true
---
# Static user for Dex sign-in (DVP web interface and other web UIs).
# https://deckhouse.io/modules/user-authn/cr.html#user
apiVersion: deckhouse.io/v1
kind: User
metadata:
  name: admin
spec:
  # User e-mail (login).
  email: admin@deckhouse.io
  # You might consider changing this. Generated automatically.
  # Password hash for `<GENERATED_PASSWORD>`.
  # echo -n '<GENERATED_PASSWORD>' | htpasswd -BinC 10 "" | cut -d: -f2 | tr -d '\n' | base64 -w0; echo
  password: '<GENERATED_PASSWORD_HASH>'