Registering an Attached Cluster (Private Network Access)

Constraints

• A Huawei Cloud account must have the UCS FullAccess and VPCEndpoint Administrator permissions.
• If you are connecting a cluster outside the Chinese mainland to UCS, the connection and the subsequent actions you will take must comply with local laws and regulations.
• Registered Kubernetes clusters must pass the CNCF Certified Kubernetes Conformance Program and be between v1.19 and 1.29.
• For attached clusters connected to UCS over private networks, the image repository may be restricted due to network restrictions.

  For clusters that are connected to UCS over a private network, images cannot be downloaded from SWR. Ensure that your nodes where your workloads run can access the public network.

Prerequisites

• A cluster has been created and is running properly.
• A VPC has been created in the region where UCS provides services. For details, see Creating a VPC.
  

  The subnet CIDR block of the VPC cannot overlap with the subnet CIDR blocks of on-premises data centers or third-party clouds. If the CIDR blocks overlap, the cluster cannot be connected to UCS. For example, if the subnet of an on-premises data center is 192.168.1.0/24, the subnet of the Huawei Cloud VPC cannot be 192.168.1.0/24.

• You have obtained the kubeconfig file of the cluster. For guides of obtaining the kubeconfig file, see kubeconfig. For details about the kubeconfig file, see Organizing Cluster Access Using kubeconfig Files.

Preparing the Network Environment

After the on-premises network or the private network of the third party cloud and the cloud network are connected, you are advised to ping the private IP address of a server in the VPC from an on-premises server or a server of the third-party cloud to check network connectivity.

Connect the on-premises network or the private network of the third party cloud to the cloud network.

• VPN: See Connecting an On-Premises Data Center to a VPC Through a VPN.
• Direct Connect: See Accessing a VPC over a Single Connection Through Static Routes or Accessing a VPC over a Single Connection Through BGP Routes.

Registering a Cluster

1. Log in to the UCS console.
2. In the navigation pane, choose Fleets. In the card view of Attached cluster, click Register Cluster.
3. Configure the cluster parameters listed in Table 1. The parameters marked with an asterisk (*) are mandatory.

   Table 1 Basic information for registering a cluster

   Parameter	Description
   * Cluster Name	Enter a name, starting with a lowercase letter and not ending with a hyphen (-). Only lowercase letters, digits, and hyphens (-) are allowed.
   * Service Provider	Select a cluster service provider.
   * Region	Select a region where the cluster is deployed.
   Cluster Label	Optional. You can add labels in the form of key-value pairs to classify clusters. A key or value can contain a maximum of 63 characters starting and ending with a letter or digit. Only letters, digits, hyphens (-), underscores (_), and periods (.) are allowed.
   * kubeconfig	Upload the kubectl configuration file to complete cluster authentication. The file can be in JSON or YAML format. The procedure for obtaining the kubeconfig file varies according to vendors. For details, see kubeconfig.
   * Context	Select the corresponding context. After the kubeconfig file is uploaded, the option list automatically obtains the contexts field from the file. The default value is the context specified by the current-context field in the kubeconfig file. If the file does not contain this field, you need to manually select a context from the list.
   Fleets	Select the fleet that the cluster belongs to. A cluster can be added to only one fleet. Fleets are used for fine-grained access management. If you do not select a fleet, the cluster will be displayed on the Clusters Not in Fleet tab upon registration. You can add it to a fleet later. When registering a cluster, you cannot select a fleet with cluster federation enabled. To add your cluster to the fleet with cluster federation enabled, register your cluster with UCS first. For details about cluster federation, see Enabling Cluster Federation. For details about how to create a fleet, see Managing Fleets.

4. Click OK. After the registration is complete, Figure 2 is displayed. Connect the cluster to the network within 30 minutes. You can choose either the public or the private network access mode. For details about the network connection process, click in the upper right corner.

   If the cluster is not connected to UCS within 30 minutes, it will fail to be registered. In this case, click in the upper right corner to register it again. If the cluster has been connected to UCS but no data is displayed, wait for 2 minutes and refresh the cluster.

   Figure 2 Cluster waiting for network connection
   

Buying a VPC Endpoint

1. Log in to the UCS console and click Click to connect in the card view of the cluster. In the window that slides out from the right, select Private access.
2. In Create a VPC Endpoint., click to record the service name.
   Figure 3 Creating a VPC endpoint
   

3. Log in to the VPC Endpoint console and click Create VPC Endpoint to create a VPC endpoint for each service.
4. Select the region that the VPC endpoint belongs to.
5. Select Find a service by name, enter the service name recorded in 2, and click Verify.
   Figure 4 Buying a VPC endpoint
   

6. Select the VPC and subnet connected to the cluster network in Preparing the Network Environment.
7. Select Automatically assign IP address or Manually specify IP address for assigning the private IP address of the VPC endpoint.
8. After configuring other parameters, click Next and confirm the specifications.
   • If the configuration is correct, click Submit.
   • If any of the configurations is incorrect, click Previous to modify the parameters as needed, and click Next > Submit.

Connecting to a Cluster

1. Log in to the UCS console. In the card view of the target cluster in the Pending connection status, click Private access.
2. Select a project. Select the VPC endpoint created in Buying a VPC Endpoint.
   Figure 5 Selecting the VPC endpoint
   

3. Upload the agent configuration file in 2 to the node.
4. Click Configure Cluster Access and run commands in the cluster. You can click on the right to copy each command.
   Figure 6 Cluster agent installation configuration
   
   

   • For clusters that are connected to UCS over a private network, images cannot be downloaded from SWR. Ensure that your nodes where your workloads run can access the public network.
   • To pull the proxy-agent container image, the cluster must be able to access the public network, or the image can be uploaded to an image repository that can be accessed by the cluster. Otherwise, the image will fail to be deployed.

5. Go to the UCS console and refresh the cluster status. The cluster is in the Running state.