Skip to main content

vSphere FIPS Air-gapped: Create the Management Cluster

Deploying a Cluster in FIPS mode

In order to create a cluster in FIPS mode, we must inform the bootstrap controllers of the appropriate image repository and version tags of the official D2iQ FIPS builds of Kubernetes.

Supported FIPS Builds

Component

Repository

Version

Kubernetes

docker.io/mesosphere

v1.25.4+fips.0

etcd

docker.io/mesosphere

3.5.5+fips.0

Name your cluster

  1. Give your cluster a unique name suitable for your environment.

  2. Set the CLUSTER_NAME environment variable with the command:

    CODE
    export CLUSTER_NAME=<my-vsphere-cluster>

DKP uses local static provisioner as the default storage provider. However, localvolumeprovisioner is not suitable for production use. You should use a Kubernetes CSI compatible storage that is suitable for production.

  • You can choose from any of the storage options available for Kubernetes. To disable the default that Konvoy deploys, set the default StorageClasslocalvolumeprovisioner as non-default. Then set your newly created StorageClass to be the default by following the commands in the Kubernetes documentation called Changing the Default Storage Class.

Create a new vSphere Kubernetes cluster

Use the following steps to create a new, air-gapped vSphere cluster.

  1. Configure your cluster to use an existing registry as a mirror when attempting to pull images:
    IMPORTANT: The image must be created by Konvoy Image Builder in order to use the registry mirror feature.

    CODE
    export REGISTRY_URL=<https/http>://<registry-address>:<registry-port>
    export REGISTRY_CA=<path to the CA on the bastion>
    export REGISTRY_USERNAME=<username>
    export REGISTRY_PASSWORD=<password>
    • REGISTRY_URL: the address of an existing registry accessible in the VPC that the new cluster nodes will be configured to use a mirror registry when pulling images.

    • REGISTRY_CA: (optional) the path on the bastion machine to the registry CA. Konvoy will configure the cluster nodes to trust this CA. This value is only needed if the registry is using a self-signed certificate and the AMIs are not already configured to trust this CA.

    • REGISTRY_USERNAME: optional, set to a user that has pull access to this registry.

    • REGISTRY_PASSWORD: optional if username is not set.

  2. Load the container image:

    CODE
    docker load -i konvoy-bootstrap-image-v2.5.1.tar
    CODE
    podman load -i konvoy-bootstrap-image-v2.5.1.tar
  3. Create a Kubernetes cluster by copying the following command and substituting the valid values for your environment:

CODE
dkp create cluster vsphere
  --cluster-name ${CLUSTER_NAME} \
  --network <NETWORK_NAME> \
  --control-plane-endpoint-host <CONTROL_PLANE_IP> \
  --data-center <DATACENTER_NAME> \
  --data-store <DATASTORE_NAME> \
  --folder <FOLDER_NAME> \
  --server <VCENTER_API_SERVER_URL> \
  --ssh-public-key-file </path/to/key.pub> \
  --resource-pool <RESOURCE_POOL_NAME> \
  --vm-template konvoy-ova-vsphere-os-release-k8s_release-vsphere-timestamp \
  --virtual-ip-interface <ip_interface_name> \
  --extra-sans "127.0.0.1" \
  --registry-mirror-url=${DOCKER_REGISTRY_URL} \
  --registry-mirror-cacert=${DOCKER_REGISTRY_CA} \
  --registry-mirror-username=${DOCKER_REGISTRY_USERNAME} \
  --registry-mirror-password=${DOCKER_REGISTRY_PASSWORD} \
  --kubernetes-version=v1.25.4+fips.0 \
  --kubernetes-image-repository=docker.io/mesosphere \
  --etcd-image-repository=docker.io/mesosphere --etcd-version=3.5.5+fips.0 \
  --self-managed 

A self-managed cluster refers to one in which the CAPI resources and controllers that describe and manage it are running on the same cluster they are managing.

Cluster Verification

If you want to monitor or verify the installation of your clusters, refer to:

Verify your Cluster and DKP Installation.

As they progress, the controllers create Events, which you can also monitor using the command:

CODE
kubectl get events | grep ${CLUSTER_NAME}

For brevity, this example uses grep. You can also use separate commands to get Events for specific objects, such as kubectl get events --field-selector involvedObject.kind="VSphereCluster" and kubectl get events --field-selector involvedObject.kind="VSphereMachine".

Next Step:

vSphere FIPS Air-gapped: Configure MetalLB

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.