Installation guide for KubeLB

Installation

Prerequisites for KubeLB

KubeLB is an enterprise offering by Kubermatic. To use KubeLB, you need to have a valid license. Please contact sales for more information.

Consumer cluster

  • KubeLB manager cluster API access.
  • Registered as a tenant in the KubeLB manager cluster.

Load balancer cluster

  • Service type LoadBalancer implementation. This can be a cloud solution or a self-managed implementation like MetalLB.
  • Network access to the consumer cluster nodes with node port range (default: 30000-32767). This is required for the envoy proxy to be able to connect to the consumer cluster nodes.

Installation for KubeLB manager

KubeLB manager is deployed as a Kubernetes application. It can be deployed using the KubeLB manager Helm chart in the following way:

Prerequisites

  • Create a namespace kubelb for the CCM to be deployed in.
  • Create imagePullSecrets for the chart to pull the image from the registry.

At this point a minimal values.yaml should look like this:

imagePullSecrets:
  - name: <imagePullSecretName>

Install helm chart for KubeLB manager

Now, we can install the helm chart:

helm registry login quay.io --username ${REGISTRY_USER} --password ${REGISTRY_PASSWORD}
helm pull oci://quay.io/kubermatic/helm-charts/kubelb-manager --version=v0.4.0 --untardir "kubelb-manager" --untar
## Create and update values.yaml with the required values.
helm install kubelb-manager kubelb-manager --namespace kubelb -f values.yaml

Values

KeyTypeDefaultDescription
affinityobject{}
autoscaling.enabledboolfalse
autoscaling.maxReplicasint10
autoscaling.minReplicasint1
autoscaling.targetCPUUtilizationPercentageint80
autoscaling.targetMemoryUtilizationPercentageint80
fullnameOverridestring""
image.pullPolicystring"IfNotPresent"
image.repositorystring"quay.io/kubermatic/kubelb-manager-ee"
image.tagstring"v0.4.0"
imagePullSecretslist[]
kubelb.debugboolfalse
kubelb.enableLeaderElectionbooltrue
kubelb.envoyProxyReplicasint3
kubelb.envoyProxySinglePodPerNodebooltrue
kubelb.envoyProxyTopologystring"shared"
kubelb.envoyProxyUseDaemonsetboolfalse
nameOverridestring""
nodeSelectorobject{}
podAnnotationsobject{}
podLabelsobject{}
podSecurityContext.runAsNonRootbooltrue
podSecurityContext.seccompProfile.typestring"RuntimeDefault"
rbac.allowLeaderElectionRolebooltrue
rbac.allowMetricsReaderRolebooltrue
rbac.allowProxyRolebooltrue
rbac.enabledbooltrue
replicaCountint1
resources.limits.cpustring"100m"
resources.limits.memorystring"128Mi"
resources.requests.cpustring"100m"
resources.requests.memorystring"128Mi"
securityContext.allowPrivilegeEscalationboolfalse
securityContext.capabilities.drop[0]string"ALL"
securityContext.runAsUserint65532
service.portint8001
service.protocolstring"TCP"
service.typestring"ClusterIP"
serviceAccount.annotationsobject{}
serviceAccount.createbooltrue
serviceAccount.namestring""
serviceMonitor.enabledboolfalse
tolerationslist[]

Installation for KubeLB CCM

Pre-requisites

  • Create a namespace kubelb for the CCM to be deployed in.
  • Create imagePullSecrets for the chart to pull the image from the registry.
  • The agent expects a Secret with a kubeconf file named kubelb to access the load balancer cluster. To create such run: kubectl --namespace kubelb create secret generic kubelb-cluster --from-file=<path to kubelb kubeconf file>. The name of secret can’t be overridden using .Values.kubelb.clusterSecretName
  • Update the tenantName in the values.yaml to a unique identifier for the tenant. This is used to identify the tenant in the manager cluster. This can be any unique string that follows lower case RFC 1123.

At this point a minimal values.yaml should look like this:

imagePullSecrets:
  - name: <imagePullSecretName>
kubelb:
    clusterSecretName: kubelb-cluster
    tenantName: <unique-identifier-for-tenant>

Install helm chart for KubeLB CCM

Now, we can install the helm chart:

helm registry login quay.io --username ${REGISTRY_USER} --password ${REGISTRY_PASSWORD}
helm pull oci://quay.io/kubermatic/helm-charts/kubelb-ccm --version=v0.4.0 --untardir "kubelb-ccm" --untar
## Create and update values.yaml with the required values.
helm install kubelb-ccm kubelb-ccm --namespace kubelb -f values.yaml

Values

KeyTypeDefaultDescription
affinityobject{}
autoscaling.enabledboolfalse
autoscaling.maxReplicasint10
autoscaling.minReplicasint1
autoscaling.targetCPUUtilizationPercentageint80
autoscaling.targetMemoryUtilizationPercentageint80
extraVolumeMountslist[]
extraVolumeslist[]
fullnameOverridestring""
image.pullPolicystring"IfNotPresent"
image.repositorystring"quay.io/kubermatic/kubelb-manager-ee"
image.tagstring"v0.4.0"
imagePullSecretslist[]
kubelb.clusterSecretNamestring"kubelb-cluster"
kubelb.enableLeaderElectionbooltrue
kubelb.nodeAddressTypestring"InternalIP"
kubelb.tenantNamestringnil
nameOverridestring""
nodeSelectorobject{}
podAnnotationsobject{}
podLabelsobject{}
podSecurityContext.runAsNonRootbooltrue
podSecurityContext.seccompProfile.typestring"RuntimeDefault"
rbac.allowLeaderElectionRolebooltrue
rbac.allowMetricsReaderRolebooltrue
rbac.allowProxyRolebooltrue
rbac.enabledbooltrue
replicaCountint1
resources.limits.cpustring"100m"
resources.limits.memorystring"128Mi"
resources.requests.cpustring"100m"
resources.requests.memorystring"128Mi"
securityContext.allowPrivilegeEscalationboolfalse
securityContext.capabilities.drop[0]string"ALL"
securityContext.runAsUserint65532
service.portint8443
service.protocolstring"TCP"
service.typestring"ClusterIP"
serviceAccount.annotationsobject{}
serviceAccount.createbooltrue
serviceAccount.namestring""
serviceMonitor.enabledboolfalse
tolerationslist[]