Install KubeLB CCM and set up the tenant cluster

Prerequisites

• Access to the Kubernetes API of the KubeLB management cluster.
• A tenant registered in the KubeLB management cluster.

See Requirements for the full port and resource sizing reference.

• Create a kubelb namespace for KubeLB CCM.

• KubeLB CCM expects a Secret named kubelb-cluster by default. Its kubelb data key must contain the kubeconfig for the management cluster.

  • First register the tenant by following the tenant registration guide.
  • Fetch the generated kubeconfig from the management cluster, switch to the tenant cluster, and create the Secret:

  # Replace with the tenant cluster kubeconfig path
  TENANT_KUBECONFIG=~/.kube/<tenant-cluster>
  # Replace with the tenant name
  TENANT_NAME=tenant-shroud
  KUBELB_KUBECONFIG_B64=$(kubectl get secret kubelb-ccm-kubeconfig --namespace "$TENANT_NAME" --template='{{ .data.kubelb }}')
  # Switch to the tenant cluster.
  export KUBECONFIG="$TENANT_KUBECONFIG"
  kubectl --namespace kubelb create secret generic kubelb-cluster \
    --from-literal=kubelb="$(printf '%s' "$KUBELB_KUBECONFIG_B64" | base64 -d)"
  

• Override the Secret name with .Values.kubelb.clusterSecretName if required. Otherwise, the Secret is named kubelb-cluster and looks like this:

  kubectl get secret kubelb-cluster --namespace kubelb -o yaml
  

  apiVersion: v1
  data:
    kubelb: xxx-base64-encoded-xxx
  kind: Secret
  metadata:
    name: kubelb-cluster
    namespace: kubelb
  type: Opaque
  

• Set tenantName in values.yaml to the tenant’s unique identifier. The management cluster stores tenant namespaces with a tenant- prefix; for example, my-tenant becomes tenant-my-tenant. KubeLB accepts the name with or without this prefix.

At this point a minimal values.yaml should look like this:

kubelb:
  clusterSecretName: kubelb-cluster
  tenantName: <unique-identifier-for-tenant>

kubectl get nodes -o wide

NAME     STATUS   ROLES           AGE    VERSION   INTERNAL-IP    EXTERNAL-IP   OS-IMAGE          KERNEL-VERSION       CONTAINER-RUNTIME
node-x   Ready    control-plane   208d   v1.29.9   10.66.99.222   <none>        Ubuntu            5.15.0-121-generic   containerd://1.6.33

kubelb:
  # -- Address type to use for routing traffic to node ports. Values are ExternalIP, InternalIP, or Hostname.
  nodeAddressType: InternalIP

Install KubeLB CCM

kubelb:
  enableGatewayAPI: true
  installGatewayAPICRDs: true

imagePullSecrets:
  - name: <imagePullSecretName>
kubelb:
    clusterSecretName: kubelb-cluster
    tenantName: <unique-identifier-for-tenant>

helm pull oci://quay.io/kubermatic/helm-charts/kubelb-ccm-ee --version=v1.5.0 --untardir "." --untar
## Apply CRDs
kubectl apply -f kubelb-ccm-ee/crds/
## Create and update values.yaml with the required values.
helm upgrade --install kubelb-ccm kubelb-ccm-ee --namespace kubelb -f kubelb-ccm-ee/values.yaml --create-namespace

helm pull oci://quay.io/kubermatic/helm-charts/kubelb-ccm --version=v1.5.0 --untardir "." --untar
## Apply CRDs
kubectl apply -f kubelb-ccm/crds/
## Create and update values.yaml with the required values.
helm upgrade --install kubelb-ccm kubelb-ccm --namespace kubelb -f kubelb-ccm/values.yaml --create-namespace

Verify the installation

Check that the CCM is running:

kubectl get pods -n kubelb

NAME                          READY   STATUS    RESTARTS   AGE
kubelb-ccm-7c9f7d6b8d-4qk2n   2/2     Running   0          1m

The kubelb-ccm pod must be in Running state before load balancer services are reconciled.

Set up the tenant cluster

Install Gateway API CRDs

Starting from KubeLB v1.2.0, the Gateway API CRDs can be installed using the installGatewayAPICRDs flag.

imagePullSecrets:
  - name: <imagePullSecretName>
kubelb:
    clusterSecretName: kubelb-cluster
    tenantName: <unique-identifier-for-tenant>
    # This will install the experimental channel of the Gateway API CRDs
    installGatewayAPICRDs: true
    enableGatewayAPI: true

kubelb:
    clusterSecretName: kubelb-cluster
    tenantName: <unique-identifier-for-tenant>
    # This will install the standard channel of the Gateway API CRDs
    installGatewayAPICRDs: true
    enableGatewayAPI: true