Remote cluster configuration

A remote cluster configuration resource (RemoteClusterConfiguration) represents a cluster in a federation of clusters. Each remote cluster needs a configuration to be specified to allow the local cluster to access resources on the remote cluster. The connection is one-way: the information flows only from the remote to the local cluster. To share information from the local cluster to the remote one a remote cluster configuration resource must be created on the remote cluster.

A remote cluster configuration causes Typha and calicoq to retrieve the following resources from a remote cluster:

• Workload endpoints
• Host endpoints

When using the Kubernetes API datastore with RBAC enabled on the remote cluster, the RBAC rules must be configured to allow access to these resources.

For more details on the federation feature refer to the Overview.

This resource is not supported in kubectl.

Sample YAML

For a remote Kubernetes datastore cluster:

apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
  name: cluster1
spec:
  datastoreType: kubernetes
  kubeconfig: /etc/tigera-federation-remotecluster/kubeconfig-rem-cluster-1

For a remote etcdv3 cluster:

apiVersion: projectcalico.org/v3
kind: RemoteClusterConfiguration
metadata:
  name: cluster1
spec:
  datastoreType: etcdv3
  etcdEndpoints: 'https://10.0.0.1:2379,https://10.0.0.2:2379'

RemoteClusterConfiguration Definition

Metadata

Field	Description	Accepted Values	Schema
name	The name of this remote cluster configuration.	Lower-case alphanumeric with optional -	string

Spec

Field	Secret key	Description	Accepted Values	Schema	Default
clusterAccessSecret		Reference to a Secret that contains connection information		Kubernetes ObjectReference	none
datastoreType	datastoreType	The datastore type of the remote cluster.	etcdv3 kubernetes	string	none
etcdEndpoints	etcdEndpoints	A comma separated list of etcd endpoints.		string	none
etcdUsername	etcdUsername	Username for RBAC.		string	none
etcdPassword	etcdPassword	Password for the given username.		string	none
etcdKeyFile	etcdKey	Path to the etcd key file.		string	none
etcdCertFile	etcdCert	Path to the etcd certificate file.		string	none
etcdCACertFile	etcdCACert	Path to the etcd CA certificate file.		string	none
kubeconfig	kubeconfig	Location of the kubeconfig file.		string	none
k8sAPIEndpoint		Location of the kubernetes API server.		string	none
k8sKeyFile		Location of a client key for accessing the Kubernetes API.		string	none
k8sCertFile		Location of a client certificate for accessing the Kubernetes API.		string	none
k8sCAFile		Location of a CA certificate.		string	none
k8sAPIToken		Token to be used for accessing the Kubernetes API.		string	none

When using the clusterAccessSecret field, all other fields in the RemoteClusterconfiguration resource must be empty. When the clusterAccessSecret reference is used, all datastore configuration will be read from the referenced Secret using the "Secret key" fields named in the above table as the data key in the Secret. The fields read from a Secret that were file path or locations in a RemoteClusterConfiguration will be expected to be the file contents when read from a Secret.

All of the fields that start with etcd are only valid when the DatastoreType is etcdv3 and the fields that start with k8s or kube are only valid when the datastore type is kubernetes. The kubeconfig field and the fields that end with File must be accessible to Typha and calicoq, this does not apply when the data is coming from a Secret referenced by clusterAccessSecret.

When the DatastoreType is kubernetes, the kubeconfig file is optional but since it can contain all of the authentication information needed to access the Kubernetes API server it is generally easier to use than setting all the individual k8s fields. The other kubernetes fields can be used by themselves though or to override specific kubeconfig values.

Supported operations

Datastore type	Create/Delete	Update	Get/List	Notes
etcdv3	Yes	Yes	Yes
Kubernetes API server	Yes	Yes	Yes