Installing the Agent in a Third-Party Private Network Cluster

Scenario

Install the agent on a third-party private network cluster that cannot access the public network. After the configuration is complete, HSS automatically installs the agent on existing cluster nodes, installs the agent on new nodes when the cluster is scaled out, and uninstalls the agent from removed nodes when the cluster is scaled in.

Prerequisites

A Direct Connect connection has been created between the third-party private network cluster and the VPC on the cloud. For details about how to create a Direct Connect connection, see Getting Started with Direct Connect.

Constraints and Limitations

• Supported cluster orchestration platforms: Kubernetes 1.19 or later
• Supported node OS: Linux
• Node specifications: at least 2 vCPUs, 4 GiB memory, 40 GiB system disk, and 100 GiB data disk

• Constraints on private clusters to access regions: Currently, only CN North-Beijing1, CN North-Beijing4, CN East-Shanghai1, CN East-Shanghai2, CN South-Guangzhou, AP-Hong Kong, AP-Singapore, CN Southwest-Guiyang1, and AP-Jakarta allow third-party cloud clusters or on-premises clusters to access HSS through private networks.
• The agent is incompatible with clusters using Galera 3.34 and MySQL 5.6.51.

Step 1: Create an ECS

1. Log in to the ECS console and buy an ECS.
2. Configure ECS parameters as prompted.

   You are advised to configure some parameters by referring to Table 1 and configure other parameters based on site requirements.

   Table 1 Parameters for purchasing an ECS

   Parameter	Description	Example Value
   Billing Mode	ECS billing mode. Yearly/Monthly: Prepaid mode. Yearly/monthly ECSs are billed by the purchased duration specified in the order. Pay-per-use: Postpaid billing mode. You pay as you go and just pay for what you use. Pay-per-use ECSs are billed by the second and settled by the hour. Spot price: Spot pricing is a postpaid billing mode. You pay as you go and just pay for what you use. In Spot pricing billing mode, your purchased ECS is billed at a lower price than that of a pay-per-use ECS with the same specifications. In Spot pricing billing mode, you can select Spot or Spot block for the Spot Type. Spot ECSs and Spot block ECSs are billed by the second and settled by the hour.	Pay-per-use
   CPU Architecture	Select a CPU architecture. The value can be x86 or Kunpeng.	x86
   Instance	Select vCPUs and memory, or enter a keyword to search for ECS specifications. You can search for ECS flavors when you select By Type. Select ECS specifications by instance family and generation from the list.	General computing, 2 vCPUs, 4 GiB
   Image	An image is an ECS template that contains an OS. It may also contain proprietary software and application software. You can use images to create ECSs.	Public image, EulerOS 2.5 64 bit (40 GiB)
   System Disk	Stores the OS of an ECS, and is automatically created and initialized upon ECS creation.	Ultra-high I/O

3. Click Create. In the displayed dialog box, click Agree and Create. After the payment is complete, the ECS will be automatically created and started by default.
4. In the ECS list, view the created ECS and record the private IP address.

Step 2: Set Up Nginx

1. Log in to the server created in Step 1: Create an ECS.
2. Go to the temp directory.

   cd /temp

3. Run the following command to create the install_nginx.sh file:

   vi install_nginx.sh

4. Press i to enter the editing mode and copy the following content to the install_nginx.sh file:

   #!/bin/bash
   
   yum -y install pcre-devel zlib-devel popt-devel openssl-devel openssl
   wget http://www.nginx.org/download/nginx-1.21.0.tar.gz
   tar zxf nginx-1.21.0.tar.gz -C /usr/src/
   cd /usr/src/nginx-1.21.0/
   useradd -M -s /sbin/nologin nginx
   ./configure \
   --prefix=/usr/local/nginx \
   --user=nginx \
   --group=nginx \
   --with-file-aio \
   --with-http_stub_status_module \
   --with-http_gzip_static_module \
   --with-http_flv_module \
   --with-http_ssl_module \
   --with-stream \
   --with-pcre && make && make install
   ln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/
   nginx

5. Enter ECS, run the following command, and press Enter to exit.

   :wq!

6. Run the following command to install Nginx:

   bash /tmp/install_nginx.sh

7. Run the following command to modify the Nginx configuration file:

   cat <<END >> /usr/local/nginx/conf/nginx.conf
   stream {
     upstream backend_hss_anp {
       server {{ANP_proxy_address}}:8091 weight=5 max_fails=3 fail_timeout=30s;
     }
     server {
       listen 8091 so_keepalive=on;
       proxy_connect_timeout 10s;
       proxy_timeout 300s;
       proxy_pass backend_hss_anp ;
     }
   }
   END

   Replace {{ANP_proxy_address}} with the actual address and then run the command. For details, see Table 2.

   Table 2 ANP proxy address

   Region	ANP proxy address
   Guiyang1, Bangkok, Shanghai2, Guangzhou, Beijing4, Beijing2, and Shanghai1	hss-proxy.RegionCode.myhuaweicloud.com
   Other	hss-anp.RegionCode.myhuaweicloud.com
   For details about region codes, see Regions and Endpoints.

8. Run the following command to make the Nginx configuration take effect:

   nginx -s reload

Step 3: Prepare the kubeconfig File

The kubeconfig file specifies the cluster permissions assigned to HSS. The kubeconfig file configured using method 1 contains the cluster administrator permissions, whereas the file generated using method 2 contains only the permissions required by HSS. If you want to minimize HSS permissions, prepare the file using method 2.

• Method 1: configuring the default kubeconfig file
  The default kubeconfig file is in the $HOME/.kube/config directory. Perform the following operations to create a dedicated namespace for HSS:]

  1. Log in to a cluster node.
  2. Create the hss.yaml file and copy the following content to the file:

     {"metadata":{"name":"hss"},"apiVersion":"v1","kind":"Namespace"}

  3. Run the following command to create a namespace:

     kubectl apply -f hss.yaml

• Method 2: generating a kubeconfig file dedicated to HSS
  1. Create a dedicated namespace and an account for HSS.
     1. Log in to a cluster node.
     2. Create the hss-account.yaml file and copy the following content to the file:

        {"metadata":{"name":"hss"},"apiVersion":"v1","kind":"Namespace"}{"metadata":{"name":"hss-user","namespace":"hss"},"apiVersion":"v1","kind":"ServiceAccount"}{"metadata":{"name":"hss-user-token","namespace":"hss","annotations":{"kubernetes.io/service-account.name":"hss-user"}},"apiVersion":"v1","kind":"Secret","type":"kubernetes.io/service-account-token"}

     3. Run the following command to create a namespace and an account:

        kubectl apply -f hss-account.yaml

  2. Generate the kubeconfig file.
     1. Create the gen_kubeconfig.sh file and copy the following content to the file:

        #!/bin/bash
        
        KUBE_APISERVER=`kubectl config view  --output=jsonpath='{.clusters[].cluster.server}' | head -n1 `
        CLUSTER_NAME=`kubectl config view -o jsonpath='{.clusters[0].name}'`
        kubectl get secret hss-user-token -n hss -o yaml |grep ca.crt: | awk '{print $2}' |base64 -d >hss_ca_crt
        
        kubectl config set-cluster ${CLUSTER_NAME} --server=${KUBE_APISERVER}  --certificate-authority=hss_ca_crt  --embed-certs=true --kubeconfig=hss_kubeconfig.yaml
        kubectl config set-credentials hss-user --token=$(kubectl describe secret hss-user-token -n hss | awk '/token:/{print $2}') --kubeconfig=hss_kubeconfig.yaml
        kubectl config set-context hss-user@kubernetes --cluster=${CLUSTER_NAME} --user=hss-user --kubeconfig=hss_kubeconfig.yaml
        kubectl config use-context hss-user@kubernetes --kubeconfig=hss_kubeconfig.yaml

     2. Run the following command to generate the kubeconfig file named hss_kubeconfig.yaml:

        bash gen_kubeconfig.sh

Step 4: Install the Agent for a Third-Party Private Network Cluster

The image repositories used by a cluster are classified into public image repositories and private image repositories.

• Public network image repository: An image repository that can be accessed as long as it can connect to the Internet. It is usually provided by a third party and paid by enterprises.
• Private image repository: an image repository deployed and maintained by an enterprise. Only authorized users can access the image repository.

Install the agent for the cluster based on the image repository type.