Managing Kubernetes clusters

Kubernetes clusters are created and managed by self-service users, as described in "Managing Kubernetes clusters" in the Self-Service Guide. As an administrator, you can view Kubernetes cluster details, view master and worker groups, renew cluster certificates, change service parameters, update the Kubernetes version, and delete Kubernetes clusters.

Virtuozzo Infrastructure uses the soft anti-affinity policy for Kubernetes cluster nodes. According to this policy, Kubernetes nodes are distributed across compute nodes by groups: master nodes are distributed separately from workers. In this case, a compute node can host both a master node and a worker node. However, if there are not enough compute nodes to evenly distribute Kubernetes nodes from the same group, some of them can be placed on one compute node.

For Kubernetes service users to be able to use cluster autoscaling, the cluster must have a valid certificate issued by a trusted certificate authority, instead of a self-signed certificate.

Limitations

When a Kubernetes cluster is created, its configuration files contain the IP address or DNS name of the compute API endpoint. Modifying this IP address or DNS name will lead to inability to perform Kubernetes management operations. You can have one of the following scenarios:
- If the high availability for the management node is disabled
  
  The compute API is accessed via the IP address of the management node. In this case, changing this IP address or creating the management node HA is prohibited.
- If the high availability for the management node is enabled
  
  The compute API is accessed via the virtual IP address. In this case, changing this virtual IP address or destroying the management node HA is prohibited.
- If a DNS name for the compute API is configured
  
  Changing the DNS name is prohibited.
Kubernetes cluster certificates are issued for five years. To renew the certificates, use the vinfra service compute k8saas rotate-ca command. Alternatively, you can use the openstack coe ca rotate command, as described in the OpenStack documentation.
Starting with version 1.31.x, Envoy proxy can be installed automatically with Cilium if SELinux is disabled on Kubernetes nodes.

Prerequisites

The compute cluster is created, as described in Creating the compute cluster.
The Kubernetes service is installed during the compute cluster deployment or later, as described in Provisioning Kubernetes clusters.