Learn KOP - Provision EKS Cluster - Rafay Product Documentation

Part 1: Provision

This is Part 1 of a multi-part, self-paced quick start exercise that will focus on provisioning an EKS cluster in AWS using the web console, RCTL CLI, or Terraform.

What Will You Do

In part 1, you will:

Watch a video of this exercise.

Step 1: Create Cloud Credential

Cloud credentials provide the controller with the privileges required to programmatically interact with your Amazon AWS account to manage the lifecycle of infrastructure associated with the Amazon EKS cluster.

Step 2: Configure EKS Cluster

In this step, you will configure and provision an Amazon EKS Cluster with the following configuration:

The following will be automatically selected by default:

Select a method to provision and manage your EKS cluster from the tabs below.

Web Console RCTL CLI Terraform

Login into the controller's web console and into your Org.

In the cluster configuration wizard,

In the node group settings,

Click on "Save Changes" and Click on "Provision" to start provisioning the EKS Cluster in your AWS account.

You can monitor the progress of your Amazon EKS cluster being provisioned step by step right in the web console.

Note
It can take 30-40 minutes to fully provision the EKS Control plane, the worker nodes, the cluster blueprint's resources.

Once provisioning is complete, you should see a healthy EKS cluster with a worker node and all the resources associated with the cluster blueprint.

In this step, we will provide the RCTL CLI with a "declarative cluster specification" for our Amazon EKS Cluster. We will then use the RCTL CLI to send a suitable command to the controller to initiate provisioning or future lifecycle operations.

Save the cluster specification file below to your computer as "eks-cluster-basic.yaml"

apiVersion: infra.k8smgmt.io/v3
kind: Cluster
metadata:
  name: demo-eks-testing
  project: defaultproject
spec:
  blueprintConfig:
    name: minimal
    version: latest
  cloudCredentials: demo
  config:
    addons:
    - name: kube-proxy
      version: latest
    - name: vpc-cni
      version: latest
    - name: coredns
      version: latest
    iam:
      withOIDC: true
    managedNodeGroups:
    - amiFamily: AmazonLinux2
      desiredCapacity: 1
      instanceType: t3.large
      maxSize: 2
      minSize: 1
      name: ng-1
    metadata:
      name: demo-eks-testing
      region: us-west-2
      tags:
        email: user@rafay.co
        env: qa
      version: latest
    vpc:
      autoAllocateIPv6: false
      clusterEndpoints:
        privateAccess: true
        publicAccess: false
      cidr: 192.168.0.0/16
  type: aws-eks

Update the following sections of the specification file with details to match your environment.

Execute the following command to provision the cluster from the specification file previously defined

./rctl apply -f eks-cluster-testing.yaml

If there are no obvious issues with the cluster specification file, the RCTL CLI will initiate provisioning and return the user with a "Task ID". The user can then use the CLI and the task id to check and monitor status.

Example Output

Cluster: demo-eks-testing
{
  "taskset_id": "d2wg4k8",
  "operations": [
    {
      "operation": "NodegroupCreation",
      "resource_name": "ng-1",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "ClusterCreation",
      "resource_name": "demo-eks-testing",
      "status": "PROVISION_TASK_STATUS_PENDING"
    }
  ],
  "comments": "The status of the operations can be fetched using taskset_id",
  "status": "PROVISION_TASKSET_STATUS_PENDING"
}

To retrieve the status of the CLI operation, enter the below command with the generated "task id"

./rctl status apply <d2wg4k8>

This should provide with current status of the operation. An illustrative example is shown below.

{
  "taskset_id": "d2wg4k8",
  "operations": [
    {
      "operation": "NodegroupCreation",
      "resource_name": "ng-1",
      "status": "PROVISION_TASK_STATUS_PENDING"
    },
    {
      "operation": "ClusterCreation",
      "resource_name": "demo-eks-testing",
      "status": "PROVISION_TASK_STATUS_INPROGRESS"
    }
  ],
  "comments": "Configuration is being applied to the cluster",
  "status": "PROVISION_TASKSET_STATUS_INPROGRESS"
}

Make sure the following are installed or available.

Make sure you have the following information. You may need to create these in your AWS environment or in the console.

To provision a cluster using Terraform:

It can take 20 minutes to provision the cluster. Check the console for the provisioning status.

Step 3: Zero Trust Kubectl

Important
Provisioning an EKS cluster's control plane, configured nodes and applying the cluster blueprint can take 30-40 mins of time.

In the cluster specification, we specified our Amazon EKS Cluster's API Server to be private and secure (i.e. cloaked and not directly reachable on the Internet).

Once provisioning is complete and the cluster blueprint has been synchronized, we will attempt to perform Kubectl operations against our "cloaked" EKS cluster operating "behind a firewall".

The controller provides a zero trust kubectl channel for authorized users.

Note
Learn more about Zero Trust Access.

Step 4: Kubernetes Resource Dashboards

The cluster dashboard also comes with an integrated "Kubernetes Resources" dashboard.

Note
Learn more about the Integrated Kubernetes Dashboard.

Recap

Congratulations! At this point, you have