Remote cluster configuration
A remote cluster configuration resource (RemoteClusterConfiguration) represents a cluster in a federation of clusters. Each remote cluster needs a configuration to be specified to allow the local cluster to access resources on the remote cluster. The connection is one-way: the information flows only from the remote to the local cluster. To share information from the local cluster to the remote one a remote cluster configuration resource must be created on the remote cluster.
A remote cluster configuration causes Typha and calicoq to retrieve the following resources from a remote cluster:
When using the Kubernetes API datastore with RBAC enabled on the remote cluster, the RBAC rules must be configured to allow access to these resources.
For more details on the federation feature refer to the Overview.
This resource is not supported in kubectl.
Sample YAML
For a remote Kubernetes datastore cluster:
apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
name: cluster1
spec:
datastoreType: kubernetes
kubeconfig: /etc/tigera-federation-remotecluster/kubeconfig-rem-cluster-1
For a remote etcdv3 cluster:
apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
name: cluster1
spec:
datastoreType: etcdv3
etcdEndpoints: 'https://10.0.0.1:2379,https://10.0.0.2:2379'
RemoteClusterConfiguration Definition
Metadata
| Field | Description | Accepted Values | Schema |
|---|---|---|---|
| name | The name of this remote cluster configuration. | Lower-case alphanumeric with optional - | string |
Spec
| Field | Secret key | Description | Accepted Values | Schema | Default |
|---|---|---|---|---|---|
| clusterAccessSecret | Reference to a Secret that contains connection information | Kubernetes ObjectReference | none | ||
| datastoreType | datastoreType | The datastore type of the remote cluster. | etcdv3 kubernetes | string | none |
| etcdEndpoints | etcdEndpoints | A comma separated list of etcd endpoints. | string | none | |
| etcdUsername | etcdUsername | Username for RBAC. | string | none | |
| etcdPassword | etcdPassword | Password for the given username. | string | none | |
| etcdKeyFile | etcdKey | Path to the etcd key file. | string | none | |
| etcdCertFile | etcdCert | Path to the etcd certificate file. | string | none | |
| etcdCACertFile | etcdCACert | Path to the etcd CA certificate file. | string | none | |
| kubeconfig | kubeconfig | Location of the kubeconfig file. | string | none | |
| k8sAPIEndpoint | Location of the kubernetes API server. | string | none | ||
| k8sKeyFile | Location of a client key for accessing the Kubernetes API. | string | none | ||
| k8sCertFile | Location of a client certificate for accessing the Kubernetes API. | string | none | ||
| k8sCAFile | Location of a CA certificate. | string | none | ||
| k8sAPIToken | Token to be used for accessing the Kubernetes API. | string | none |
When using the clusterAccessSecret field, all other fields in the RemoteClusterconfiguration resource must be empty.
When the clusterAccessSecret reference is used, all datastore configuration will be read from the referenced Secret
using the "Secret key" fields named in the above table as the data key in the Secret. The fields read from a Secret
that were file path or locations in a RemoteClusterConfiguration will be expected to be the file contents when read
from a Secret.
All of the fields that start with etcd are only valid when the DatastoreType is etcdv3 and the fields that start with k8s or kube are only valid when the datastore type is kubernetes.
The kubeconfig field and the fields that end with File must be accessible to Typha and calicoq, this does not apply when the data is coming from a Secret referenced by clusterAccessSecret.
When the DatastoreType is kubernetes, the kubeconfig file is optional but since it can contain all of the authentication information needed to access the Kubernetes API server it is generally easier to use than setting all the individual k8s fields. The other kubernetes fields can be used by themselves though or to override specific kubeconfig values.
Supported operations
| Datastore type | Create/Delete | Update | Get/List | Notes |
|---|---|---|---|---|
| etcdv3 | Yes | Yes | Yes | |
| Kubernetes API server | Yes | Yes | Yes |