Spinnaker – Kubernetes V2 Provider

Docs: Alibaba Cloud Container Service for Kubernetes (ACK) Setup

Mon, 01 Jan 0001 00:00:00 +0000

This page describes how to set up a Kubernetes cluster on ACK to be used with Spinnaker’s Kubernetes provider.

Create a cluster

You can create a Kubernetes cluster on ACK using console as shown in the official documentation . You can also use Alibaba Cloud CLI or Terraform tools to automate provisioning your clusters.

Download kubectl configuration file on hal node

Run the following command on the hal node:

mkdir $HOME/.kube
scp root@$MASTER:/etc/kubernetes/kube.conf $HOME/.kube/config

Next Steps

Follow the setup instructions for adding a Kubernetes account in Spinnaker .

Docs: Set up the Kubernetes provider for Amazon EKS

Mon, 01 Jan 0001 00:00:00 +0000

Before you proceed further with this setup, we strongly recommend that you familiarize yourself with Amazon EKS concepts . Also, visit the AWS global infrastructure region table for the most up-to-date information on Amazon EKS regional availability.

These instructions assume that you have AWS CLI installed and configured on an Ubuntu machine running on AWS EC2.

Preparing to install Spinnaker on EKS

The following steps describes how to the tools you need to install and manage Spinnaker and EKS.

1. Install and configure kubectl

Install kubectl to manage Kubernetes and aws-iam-authenticator to manage cluster authentication:

# Download and install kubectl
curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin/kubectl

# Verify the installation of kubectl
kubectl help

# Download and install aws-iam-authenticator
curl -o aws-iam-authenticator https://amazon-eks.s3-us-west-2.amazonaws.com/1.13.7/2019-06-11/bin/linux/amd64/aws-iam-authenticator
chmod +x ./aws-iam-authenticator
mkdir -p $HOME/bin && cp ./aws-iam-authenticator $HOME/bin/aws-iam-authenticator && export PATH=$HOME/bin:$PATH
echo 'export PATH=$HOME/bin:$PATH' >> ~/.bashrc

#Verify the installation of aws-iam-authenticator
aws-iam-authenticator help

The commands return the help information for kubectl and aws-iam-authenticator respectively. If the help for either tool does not get returned, verify that you have installed the tool.

2. Install awscli

# Install the awscli
sudo apt install python-pip awscli

# Verify the installation
aws --version

The command returns the awscli version.

3. Install eksctl

Install eksctl to manage EKS clusters from the command line. Current versions and installation instructions are available here: https://github.com/eksctl-io/eksctl

4. Create the Amazon EKS cluster for Spinnaker

eksctl create cluster --name=eks-spinnaker --nodes=2 --region=us-west-2 --write-kubeconfig=false

Install and configure Spinnaker

This section walks you through the process of installing and configuring Spinnaker for use with Amazon EKS.

1. Retrieve Amazon EKS cluster kubectl contexts

aws eks update-kubeconfig --name eks-spinnaker --region us-west-2 --alias eks-spinnaker

2. Add and configure deployment accounts

See https://spinnaker.io/docs/setup/install/providers/ for instructions

3. Enable artifact support

Add artifacts which allow loading from a git repository to do helm/kustomize bakes, fetching a single manifest file from git APIs or other resources used for deployments

4. Deploy spinnaker

See the instructions around a kubernetes installation using kustomize

5. Verify the Spinnaker installation

kubectl -n spinnaker get svc

The command returns the Spinnaker services that are in the spinnaker namespace.

9. Expose Spinnaker using Elastic Load Balancer

Expose the Spinnaker API (Gate) and the Spinnaker UI (Deck) using Load Balancers by running the following commands to create the spin-gate-public and spin-deck-public services:

export NAMESPACE=spinnaker
# Expose Gate and Deck
kubectl -n ${NAMESPACE} expose service spin-gate --type LoadBalancer \
  --port 80 --target-port 8084 --name spin-gate-public

kubectl -n ${NAMESPACE} expose service spin-deck --type LoadBalancer \
  --port 80 --target-port 9000 --name spin-deck-public

export API_URL=$(kubectl -n $NAMESPACE get svc spin-gate-public \
 -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

export UI_URL=$(kubectl -n $NAMESPACE get svc spin-deck-public \
 -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

Configure the URL for Gate in deck by adding an entry in settings-local.js

window.settings.gateUrl = 'https://spinnaker.example.com:8084';

Configure the URL for Deck in gate-local.yml:

services:
  deck:
    baseUrl: http://spinnaker.example.com:9000

Apply your changes to Spinnaker

kubectl kustomize -o spinnaker.yaml
kubectl apply -f spinnaker.yaml
kubectl -n spinnaker get pods

10. Re-verify the Spinnaker installation

Run the following command to verify that the Spinnaker services are present in the cluster:

kubectl -n spinnaker get svc

11. Log in to Spinnaker console

Get the URL to Deck, the UI.

kubectl -n $NAMESPACE get svc spin-deck-public -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

Point this to the URL OR adjust the gate URls to use the above hostnames. Navigate to the URL in a supported browser and log in.

Docs: Google Kubernetes Engine (GKE) Setup

Mon, 01 Jan 0001 00:00:00 +0000

This page describes how to set up a Kubernetes cluster on GKE to be used with Spinnaker’s Kubernetes provider. The process is very simple, but you need to do some specific things to allow Spinnaker to authenticate against your cluster.

Note: To manage and create clusters in a given project, you need the roles/container.admin role as described here .

Create a cluster

If you don’t already have a cluster for this purpose, you can create a Kubernetes cluster on GKE using either gcloud or the the Cloud Console as shown in the official documentation . Third party tools like Terraform work too, and can be used to automate provisioning your clusters.

Download credentials

Follow the instructions shown in the official documentation to download credentials.

Warning! The credentials you’ve downloaded probably rely on calling gcloud to generate a token and authenticate against your cluster. This means that the user (e.g. a.employee@example.org) you’ve configured gcloud to authenticate as is making requests against the cluster, instead of a fixed Kubernetes service account making these requests.

This is a good thing because it prevents authenticating from a different machine that hasn’t already authenticated with gcloud. But it also complicates configuring Spinnaker because each machine running Spinnaker needs its own service account. gcloud checks the permissions of that service account in order to generate an authentication token.

Given that all pods on GKE share the same service account, granting Spinnaker on GKE permission also grants permission to all pods running alongside Spinnaker. For this reason, we recommend configuring a Kubernetes service account for Spinnaker to authenticate as.

TL;DR Use the credentials you’ve downloaded to create a Kubernetes service account for Spinnaker to authenticate as.

Next steps

Follow the setup instructions for adding a Kubernetes account in Spinnaker .

Docs: Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Setup

Mon, 01 Jan 0001 00:00:00 +0000

This page describes how to set up a Kubernetes cluster on OKE to be used with Spinnaker’s Kubernetes provider.

Create a cluster

If you don’t already have a cluster for this purpose, you can create a Kubernetes cluster on OKE by following this tutorial .

Download kubectl configuration file

Follow the instructions to download kubectl configuration file.

Store the config file in a secret that spinnaker can reference

kubectl create secret generic my-secret --from-file=kubeconfig-my-account=./kubeconfig

For additional entries you may need to determine an alternative strategy or use an external secrets manager instead of directly mounting secrets onto pods.

Enable Kubernetes Cloud provider

Like any other kubernetes account, add the configuration to clouddriver-local.yml

kubernetes:
  enabled: true
  accounts:
    - name: my-k8s-acct
      kubeconfig: /mnt/kubeconfigs/kubeconfig-my-accoun

Finally, enable artifact support .