Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of docs: K8s secondary DC requirements into release/1.15.x #18385

Merged
merged 3 commits into from
Sep 18, 2023
Merged

Backport of docs: K8s secondary DC requirements into release/1.15.x #18385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
720418e
backport of commit 317585c9651eb9604a89eef5107ea4e6f9f36ce0
boruszak Jul 25, 2023
701f03f
backport of commit 7ca2a5681a78676bf88e63fca3e373c383cd5196
boruszak Jul 25, 2023
c02508a
Merge branch 'release/1.15.x' into backport/docs/k8s-federation-requi…
trujillo-adam Sep 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions website/content/docs/k8s/deployment-configurations/multi-cluster/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ description: >-

-> Looking for a step-by-step guide? Complete the [Secure and Route Service Mesh Communication Across Kubernetes](/consul/tutorials/kubernetes/kubernetes-mesh-gateways?utm_source=docs) tutorial to learn more.

This page describes how to federate multiple Kubernetes clusters. See [Multi-Cluster Overview](/consul/docs/k8s/deployment-configurations/multi-cluster)
for more information on use-cases and how it works.
This page describes how to federate multiple Kubernetes clusters. Refer to [Multi-Cluster Overview](/consul/docs/k8s/deployment-configurations/multi-cluster)
for more information, including [networking requirements](/consul/docs/k8s/deployment-configurations/multi-cluster#network-requirements).

## Primary Datacenter

Expand Down Expand Up @@ -81,18 +81,17 @@ Modifications:

1. The Consul datacenter name is `dc1`. The datacenter name in each federated
cluster **must be unique**.
1. ACLs are enabled in the above config file. They can be disabled by setting:

1. ACLs are enabled in the template configuration. When ACLs are enabled, primary clusters must be able to make requests to the Kubernetes API URLs of secondary clusters. To disable ACLs for testing purposes, change the following settings:

```yaml
global:
acls:
manageSystemACLs: false
createReplicationToken: false
```

ACLs secure Consul by requiring every API call to present an ACL token that
is validated to ensure it has the proper permissions. If you are only testing Consul,
this is not required.
is validated to ensure it has the proper permissions.
1. Gossip encryption is enabled in the above config file. To disable it, comment
out or delete the `gossipEncryption` key:

Expand Down
11 changes: 6 additions & 5 deletions ...content/docs/k8s/deployment-configurations/multi-cluster/vms-and-kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,15 @@ description: >-

~> This topic requires familiarity with [Mesh Gateways](/consul/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters) and [WAN Federation Via Mesh Gateways](/consul/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways).

This page describes how to federate Consul clusters separately deployed in VM and Kubernetes runtimes. Refer to [Multi-Cluster Overview](/consul/docs/k8s/deployment-configurations/multi-cluster)
for more information, including [Kubernetes networking requirements](/consul/docs/k8s/deployment-configurations/multi-cluster#network-requirements).

Consul datacenters running on non-kubernetes platforms like VMs or bare metal can
be federated with Kubernetes datacenters. Just like with Kubernetes, one datacenter
must be the [primary](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#primary-datacenter).
be federated with Kubernetes datacenters.

## Kubernetes as the Primary

If your primary datacenter is running on Kubernetes, use the Helm config from the
[Primary Datacenter](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#primary-datacenter) section to install Consul.
One Consul datacenter must be the [primary](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#primary-datacenter). If your primary datacenter is running on Kubernetes, use the Helm config from the [Primary Datacenter](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#primary-datacenter) section to install Consul.

Once installed on Kubernetes, and with the `ProxyDefaults` [resource created](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#proxydefaults),
you'll need to export the following information from the primary Kubernetes cluster:
Expand Down Expand Up @@ -210,7 +211,7 @@ ports {

If you're running your primary datacenter on VMs then you'll need to manually
construct the [Federation Secret](/consul/docs/k8s/deployment-configurations/multi-cluster/kubernetes#federation-secret) in order to federate
Kubernetes clusters as secondaries.
Kubernetes clusters as secondaries. In addition, primary clusters must be able to make requests to the Kubernetes API URLs of secondary clusters when ACLs are enabled.

-> Your VM cluster must be running mesh gateways, and have mesh gateway WAN
federation enabled. See [WAN Federation via Mesh Gateways](/consul/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways).
Expand Down