5 Essential Tips for Maximizing Your Experience at Nutanix .NEXT for Bloggers
Hello @Cecia ,Welcome to the Karbon Clusters community!The issue you mention above doesn’t look like it would be specific to a Kubernetes cluster deployed by Karbon Clusters.As far as I know, you should be able to pass those settings (the whole securityContext YAML block) in the Operator manifest (the YAML file you apply via “kubectl -f apply” to create that Operator object) and it is the job of the Operator to pick it up and honor the setting.Hope it helps,Best regards,Sylvain Huguet
Hello @abbasi , Welcome to the Nutanix Karbon community! Indeed, it is perfectly doable, all you need is a Nutanix Files clusters with an NFS share setup, and then you can use the Storage Class → Add Storage Class menu in Karbon UI to create an additional storage class that will use NFS.A bit of background:What makes a volumes usable (in R/W) by multiple pods (really, multiple Nodes) is the filesystem used.By default, the Storage Class we create out of the box uses Nutanix Volumes (iSCSI-based bock storage) to provide storage. This means we have to format those block-based devices with a filesystem. We offer the choice of ext4 (recommended) or xfs. None of those filesystems support shared access, in fact, there is very few filesystem that support shared access.On the other hand, as you pointed, NFS is essentially built for this type of usage pattern.Ee happen to have our world class NFS provider, Nutanix Files, available to us in the Nutanix portfolio, which supports NFS. And so we bui
Karbon Clusters (currently, working on it, depends on other parts of the platform too) doesn’t support certificate based authentication. We do support user-based token authentication as explained above (even with directory users, thanks to our integrated auth in Prism Central).We also support ServiceAccounts if you need longer/persistant token over 24h (for example to integrate with your CI/CD pipeline). In fact we haven’t changed anything related to token based authentication, we just added a “hook” to also enable us to auth users via Prism Central. That way, the “browsing account” credentials (the account used to check on the Directory if the credentials supplied by the user are correct) aren’t anywhere on the Kubernetes clusters, and are instead centrally managed inside Prism Central.We simply have not enabled Certificate Based authentication (or any kind of certificate issuance) in the Kubernetes clusters, until the platform is able to provide us with a secure source of certificate
Hey @Keith33 ,Your username is actually encoded in your token, so don’t worry about that part, Karbon/PC will take care of that in the background for you.As long as you are logged into PC with your AD user, the Kubeconfig you download from there is indeed “your own” and represent your own user. You can check that using (for example) the “whoami” plugin from Krew√ [shuguet @ mac:~] % ssh pcvm karbonctl cluster kubeconfig --cluster-name shu-prod-calico > ~/.kube/config√ [shuguet @ mac:~] % kubectl get nodesNAME STATUS ROLES AGE VERSIONkarbon-shu-prod-calico-a35db6-k8s-master-0 Ready master 35d v1.16.13karbon-shu-prod-calico-a35db6-k8s-master-1 Ready master 35d v1.16.13karbon-shu-prod-calico-a35db6-k8s-worker-0 Ready node 35d v1.16.13karbon-shu-prod-calico-a35db6-k8s-worker-1 Ready node 35d v1.16.13karbon-shu-prod-calico-a35db6-k8s-worker-2 Ready node 35d v1.16.13√ [shuguet @ mac:~] % kube
As of today, Karbon Clusters doesn’t support deployment on Bare Metal nodes, so baremetal isn’t possible in this context.If you need to run Kubernetes applications on Bare Metal nodes today, you might want to look at Karbon Platform Services (KPS) instead.Best regards,
Hello @Qirui ,The “SSH Access” on the Karbon UI is only to get access to one of the Karbon managed VMs (etcd, Master, worker) nodes, and only for support purposes.Generally speaking, there shouldn’t be any reason for you to log into one of those nodes outside of support scenarios.Best regards,
You can find the information in Karbon’s release notes.As of today, Karbon 2.1 is the latest release, and the notes are here: https://portal.nutanix.com/page/documents/details?targetId=Release-Notes-Karbon-v2_1:Release-Notes-Karbon-v2_1 Best regards,
Hello @Qirui ,Nutanix Karbon 2.0 does not support Windows nodes.If you need automation on Nutanix to deploy a Windows-based Kubernetes cluster, you could explore using Nutanix Calm to automate that.Best regards,
Oh, okay.Creating a cluster using the CLI is beyond the scope of the general Karbon documentation.However, we have the process documented in this KB article: https://portal.nutanix.com/kb/9601Best regards,
Hello @Assaf Katz ,Can you explain what you want to do exactly?Karbon Cluster does have APIs, you can find them documented here: https://www.nutanix.dev/reference/karbon/We also have a CLI called karbonctl that you can find on your Prism Central VM in the folder:~nutanix/karbon/
Hello @jmoro,Karbon Cluster doesn’t require Calm or App management enabled.Could you open a support case? There’s probably something in the karbon-core logs that support can use to figure out why the container wasn’t started.
Hello @AlanC75 ,First of all thank you for being a Karbon user!We’re working on a few things in the background to facilitate just what you have in mind.The first step is to finish converging Karbon/Kubernetes alerts into PC Alerts.Once that will be done, you’ll be able to apply alert rules from PC that will be honoured for all alerts, including the ones from your Karbon Clusters.Those things are currently in our backlog and prioritised.Best regards,Sylvain HuguetSr. Product Manager - Karbon & Kubernetes
2 weeks isn’t enough time to implement a new feature, test it properly and release it, while we have other development in flight, for sure. We can however look at it for futur releases. I haven’t deployed GitLab intergation with Kubernetes in a while, but I’m pretty sure some of our other customers have, so there ought to be a way to do that without a PodPreset, I’m just not exactly sure how. Are you using the OpenSource version of GitLab or do you have support from them? If you have support from them you could reach out and explore other options with them.
Where are you pulling your pod/containers images from? Internet or an internal repo? If you’re pulling them from the Internet, then I don’t see the need for a proxy, so I’m assuming it is from an internal repo? If so, then you could “build” a container image internally that would “bake in” those settings (assuming env variables like “http_proxy” and “https_proxy”?) then use those to deploy, so that you do not need a PodPreset? We can look at enabling PodPreset for a future version of Karbon. Could you open a Request For Enhancement (RFE) ticket on your support portal so that we can track this appropriately? Best regards,
Hello @Anibal Ulisses , Karbon deploys “Managed” Kubernetes environments. What we mean by that is those environments are setup by Nutanix using our best practices and supported by us. The tradeoff is that no manual customization is possible unless instructed by Nutanix Support. If you are looking for a customizable Kubernets solution that you intend to maintain on your own, then I would suggest getting in touch with your Nutanix account team and looking into Nutanix Calm, which by default has a Kubernetes blueprint that you can customize. You’ll be responsible for supporting your Kubernetes cluster after that, but it gives you a fast start that is easily customizable to your needs. Best regards,
Hello @KeoNaane ,PVC in Karbon can be backed by 2 types of medium:* Nutanix Volumes (block-based iSCSI volume groups) with either ext4 or xfs filesystem.* Nutanix Files (file-based NFS shares)As such, you can always present the VG, or mount the share, from a different environment, such as another VM on your Nutanix cluster.If you are using Volumes (the default storage class on a Nutanix Karbon deployed Kubernetes cluster), then make absolutely sure no other VMs or Pod has mounted or is using the VG before you expose it to another VM. Also, make sure you use an OS that can actually read ext4 or xfs. Most Linux distributions can do that. Windows VMs cannot without 3rd party software.Best regards,Sylvain Huguet.
To give you an idea, PE (Prism Element) is our single cluster management plane. It is where we started years ago, but it's also limited in terms of roles/RBAC features. PC (Prism Central), our multi-cluster management plane, is where we're moving all of our management features and also where all of our new products integrate. It has advanced RBAC capabilities. The current situation is born because of that transition period of moving functionalities that used to live in PE, up to PC.
Hello [user=96089]wfhartford[/user] , The long term solution (no dates/times, as all of those things changes) is to bring the Volumes API, which is what the CSI driver uses to provision a PVC, up to Prism Central level, and add RBAC to that. Until that happen, we're using what is available on PE, which in this case is Cluster Admin.
Hi 6373, Sorry for the delay, I was travelling. I've put together a quick GitHub Gist with 3 files you can use to showcase the 3 steps you'd need to achieve your goal: [url=https://gist.github.com/shuguet/6cb4577414357c25dbeb3d018a4b7373]https://gist.github.com/shuguet/6cb4577414357c25dbeb3d018a4b7373[/url] Step 1: the "create_key.ps1" file in there is just used to create the encryption key. Step 2: the "encrypt_password.ps1" file is used for you to encrypt you password and store that in a file. Those 2 steps you'll most likely do once, and never again until you have to change the password. Step 3: In file"get_ntnx_vms_with_crypted_passwd.ps1" is an exemple of using this to connect to a Nutanix Cluster and get the list of VMs names. You can re-use that with whatever you want to do using the Nutanix Cmdlets.
Already have an account? Login
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
