Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing CCE cluster options: RBAC and Highavalability #94

Closed
Thomas999999 opened this issue Mar 19, 2019 · 17 comments · Fixed by #98
Closed

Missing CCE cluster options: RBAC and Highavalability #94

Thomas999999 opened this issue Mar 19, 2019 · 17 comments · Fixed by #98
Assignees
@niuzhenguo

Comments

@Thomas999999
Copy link

Hi there,

Affected Resource(s)

Please list the resources as a list, for example:

  • huaweicloud_cce_cluster_v3

Expected Behavior

I would expect to have parameter for huaweicloud_cce_cluster_v3 to define:

  • RBAC enablement
  • High Availability Setup (more than one master node)

Actual Behavior

Both options not seen from https://www.terraform.io/docs/providers/huaweicloud/r/cce_cluster_v3.html, but are available if creating cluster manually.

Steps to Reproduce

Check https://www.terraform.io/docs/providers/huaweicloud/r/cce_cluster_v3.html

References

none
@niuzhenguo
Copy link
Member

@Thomas999999 I'm sorry that I can't find the parameters exposed with the API that we can use :(
https://support.huaweicloud.com/en-us/api-cce/cce_02_0236.html

@Thomas999999
Copy link
Author

Hi niuzhenguo,
thanks for checking.
We need those possible configuration options for our business in order to create CCE cluster via terraform.
Thus my questions would be:

  • Despite that RBAC option is not configurable via terraform code, will a CCE cluster - created via terraform - then be created with RBAC by default?
  • To whom may I address a development request to adapt terraform for huawei-cloud with those options (RBAC & HA cluster)?

Thanks in advance!
Thomas

@niuzhenguo
Copy link
Member

niuzhenguo commented Mar 20, 2019 via email

@Thomas999999
Copy link
Author

With " create an issue on Cloud side" you mean to create a service ticket in Huawei Cloud?...I mean both options are available in Huawei cloud console if setting up an CCE cluster manually...or does the CCE team also deals with developing terraform code adaptions?

@niuzhenguo
Copy link
Member

niuzhenguo commented Mar 20, 2019 via email

@niuzhenguo
Copy link
Member

@Thomas999999 Regarding the HA for master node, please refer to the flavor_id argument at https://github.com/terraform-providers/terraform-provider-huaweicloud/blob/master/website/docs/r/cce_cluster_v3.html.md

@niuzhenguo niuzhenguo self-assigned this Mar 20, 2019
@Thomas999999
Copy link
Author

Thanks!..I really overlooked that...

@Thomas999999
Copy link
Author

Hi,
Huawei support now told me in ticket:
"....The parameter of RBAC is authentication: {mode: "rbac", authenticatingProxy: {}}. The document will be updated later. ...."

But I cannot add any comment/question now to this ticket, thus maybe you can help with syntax in terraform tf file about of how to transfer authentication: {mode: "rbac", authenticatingProxy: {}}:
is it like this:?
snip
.....
###CCE cluster creation
resource "huaweicloud_cce_cluster_v3" "cluster_1" {
name = "${var.cce_cluster_name}"
cluster_type = "VirtualMachine"
flavor_id = "${var.cce_flavor_id}"
vpc_id = "${var.vpc_id}"
subnet_id = "${huaweicloud_vpc_subnet_v1.subnet_2.id}"
cluster_version = "${cce_kubectl_version}"
container_network_type = "overlay_l2"

**authentication_mode {
  mode = "rbac",
  authenticatingProxy = {}
  }**

}

....

And for what purpose is the authenticatingProxy and what to enter here?

Thanks in advance!
Thomas

@niuzhenguo
Copy link
Member

niuzhenguo commented Mar 21, 2019 via email

@Thomas999999
Copy link
Author

Hi,
I got new message in my Huawei service ticket:

"Dear customer:
Sorry for the inconvinience ! here below are the advice from our engineers. For your reference. Thank you !
Authentication: {mode: " ", authenticatingProxy: {}},
Mode is in three forms. If mode: "rbac" or mode: "x509" is authenticatingProxy: {},
If mode: "authenticating_proxy" then authenticProxy: {ca: "Customer uploaded CA certificate"}
our engineer also found an extra ” -mode“ in your sentence. Please drop that and have a reference of our advice. Thank you in advance!"

Does this mean now in terraform?:
authentication {
mode = "rbac",
}

Sorry for bothering you, but I'm not quite sure how the process of adding feature/code into terraform is working: Do I need to moderate between Service Support and terraform development (you?), or is this an automated process?

Thanks

@niuzhenguo niuzhenguo reopened this Mar 28, 2019
@niuzhenguo
Copy link
Member

@Thomas999999 In fact, we don't know what's new/update on Cloud side, so an issue like this should be raised here then we can work on it. When we received the request, we will first check out the API docs to see if that's possible to add on terraform side, if not, a Service ticket should be raised to Service team.

I will work on RBAC support later, and it should be available on next release!

@niuzhenguo niuzhenguo mentioned this issue Mar 30, 2019
Merged
@Thomas999999
Copy link
Author

Hi,
you told above that it will be fixed in next release.
When is next release? already done or how will someone be informed about that?
I still see no information about syntax of how to activate RABC in https://www.terraform.io/docs/providers/huaweicloud/r/cce_cluster_v3.html

Or do I check the wrong URL?

Thanks,
Thomas

@niuzhenguo
Copy link
Member

niuzhenguo commented Apr 10, 2019 via email

@Thomas999999
Copy link
Author

Hi,

you wrote above: "next release will be cut by the end of this month,"

I tried today to use
authentication_mode = "rbac"

but is still not working:

  • provider.huaweicloud: version = "~> 1.4"
  • provider.null: version = "~> 2.1"

C:\Testinfo\AWS_Dathub_Vora\Huawei-Cluster\cluster-dev>terraform plan

Error: huaweicloud_cce_cluster_v3.cluster_1: : invalid or unknown key: authentication_mode

So when will this be productive?

@niuzhenguo
Copy link
Member

@Thomas999999 due to some CI issue, there will be some delay for 1.5 release, will cut it once the issue fixed.

@Thomas999999
Copy link
Author

Dear Niuzhenguo,

when do you think this 1.5 release may happen?
Thanks

@niuzhenguo
Copy link
Member

niuzhenguo commented May 15, 2019 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@niuzhenguo niuzhenguo

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add authentication mode option support for CCE cluster
2 participants
@niuzhenguo @Thomas999999