In GKE on Bare Metal, you set up admin clusters to manage other clusters securely. You can create, update, upgrade, or delete user clusters from admin clusters. The user clusters run workloads separately from administration, so sensitive information is protected.
Admin clusters managing multi-cluster workloads can provide highly available (HA) reliability. In a HA cluster, if one control plane node fails, other nodes will continue to work.
An admin cluster in a multi-cluster environment provides the best fundamental security. Because access to administration data is separated from workloads, those who access user workloads have no access to sensitive administrative data, like SSH keys and service account data. As a result, there is some trade-off between security and the resources required, since a separate admin cluster means you need dedicated resources for management and workloads.
You create an admin cluster using the
bmctl command. After you create
an admin cluster, you create
to run workloads.
bmctlis downloaded (
gs://anthos-baremetal-release/bmctl/1.11.8/linux-amd64/bmctl) from Cloud Storage.
- Workstation running
bmctlhas network connectivity to all nodes in the target user clusters.
- Workstation running
bmctlhas network connectivity to the cluster API server (control plane VIP).
- SSH key used to create the Admin cluster is available to root, or there is SUDO user access on all nodes in the target admin cluster.
- Connect-register service account is configured for use with Connect.
See the GKE on Bare Metal quickstart for expanded step-by-step instructions for creating a hybrid cluster. Creating an admin cluster is similar to creating a hybrid cluster, except you don't run workloads on the admin cluster.
If you want to enable SELinux to secure your containers, you must make sure that
SELinux is enabled in
Enforced mode on all your host machines. Starting with
GKE on Bare Metal release 1.9.0 or later, you can enable or disable SELinux
before or after cluster creation or cluster upgrades. SELinux is enabled by
default on Red Hat Enterprise Linux (RHEL) and CentOS. If SELinux is disabled on
your host machines or you aren't sure, see
Securing your containers using SELinux
for instructions on how to enable it.
GKE on Bare Metal supports SELinux in only RHEL and CentOS systems.
Log into gcloud CLI and create an admin cluster config file
Set the default credentials that GKE on Bare Metal can use to create the cluster with the following command:
gcloud auth application-default login
To use the automatic API enablement and service account creation features in this page, grant the Project Owner role to that principal. If the principal can't have the Project Owner role, complete the next step.
To ensure the cluster creation can succeed without granting the Project Owner role, add the following IAM roles to the principal:
- Service Account Admin
- Service Account Key Admin
- Project IAM Admin
- Compute Viewer
- Service Usage Admin
If the principal is a service account with those roles, you can run:
JSON_KEY_FILEwith the path to your service account's JSON key file.
Get the ID of your Google Cloud project and store it in an environment variable to use it for cluster creation:
export CLOUD_PROJECT_ID=$(gcloud config get-value project)
Create an admin cluster config with
After you've logged into gcloud and have your project set up, you can create the
cluster config file with the
In the following example, all service accounts are automatically created by
bmctl create config command:
bmctl create config -c ADMIN_CLUSTER_NAME --enable-apis \ --create-service-accounts --project-id=CLOUD_PROJECT_ID
Replace the following:
- ADMIN_CLUSTER_NAME: the name of the new cluster.
- CLOUD_PROJECT_ID: your Google Cloud project ID or the
Here's an example to create a config file for a admin cluster
admin1 associated with project ID
bmctl create config -c admin1 --create-service-accounts --enable-apis --project-id=my-gcp-project
The file is written to
As an alternative to automatically enabling APIs and creating service accounts,
you can also provide your existing service accounts with proper
IAM permissions. This means you can skip the automatic service account creation
in the previous example in the
bmctl create config -c admin1
Edit the cluster config file
Now that you have a cluster config file, edit it to make the following changes:
Provide the SSH private key to access the admin cluster nodes:
# bmctl configuration variables. Because this section is valid YAML but not a valid Kubernetes # resource, this section can only be included when using bmctl to # create the initial admin/admin cluster. Afterwards, when creating user clusters by directly # applying the cluster and node pool resources to the existing cluster, you must remove this # section. gcrKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-gcr.json sshPrivateKeyPath: /path/to/your/ssh_private_key gkeConnectAgentServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-connect.json gkeConnectRegisterServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-register.json cloudOperationsServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-cloud-ops.json
For 1.7.0 and later versions, you must register your clusters with Connect to your project environ.
- If you created your config file, using the automatic API enablement and Service Account creation features, you can skip this step.
- If you created the config file without using the automatic API enablement
and Service Account creation features, reference the downloaded service
account JSON keys in the corresponding
gkeConnectRegisterServiceAccountKeyPathfields of the cluster config file.
Check to make sure the config specifies a cluster type of
admin(the default value):
spec: # Cluster type. This can be: # 1) admin: to create an admin cluster. This can later be used to create user clusters. # 2) user: to create a user cluster. Requires an existing admin cluster. # 3) hybrid: to create a hybrid cluster that runs admin cluster components and user workloads. # 4) standalone: to create a cluster that manages itself, runs user workloads, but does not manage other clusters. type: admin
Change the configuration file to specify a multi-node, high availability, control plane. Specify an odd number of nodes to have a majority quorum for HA:
# Control plane configuration controlPlane: nodePoolSpec: nodes: # Control plane node pools. Typically, this is either a single machine # or 3 machines if using a high availability deployment. - address: 10.200.0.4 - address: 10.200.0.5 - address: 10.200.0.6
Specify the pod density of cluster nodes and the container runtime:
.... # NodeConfig specifies the configuration that applies to all nodes in the cluster. nodeConfig: # podDensity specifies the pod density configuration. podDensity: # maxPodsPerNode specifies at most how many pods can be run on a single node. maxPodsPerNode: 250 # containerRuntime specifies which container runtime to use for scheduling containers on nodes. # containerd and docker are supported. containerRuntime: containerd ....
For admin clusters, allowable values for
32-250for HA clusters and
64-250for non-HA clusters. The default value if unspecified is
110. Once the cluster is created, this value cannot be updated.
The default container runtime is containerd. Alternatively, you can use Docker. For more information about changing your runtime, see our Change your container runtime guide.
Pod density is also limited by your cluster's available IP resources. For details, see Pod networking.
Create the admin cluster with the cluster config
bmctl command to deploy the cluster:
bmctl create cluster -c ADMIN_CLUSTER_NAME
ADMIN_CLUSTER_NAME specifies the cluster name created in the previous section.
The following shows an example of the command to create a cluster
bmctl create cluster -c admin1
Sample admin cluster configurations
For example admin cluster configurations, see Admin clusters in the Cluster configuration samples.