컨테이너 보안을 위해 SELinux를 사용 설정하려면 모든 호스트 머신에서 SELinux가 Enforced 모드로 사용 설정되었는지 확인해야 합니다. Google Distributed Cloud 출시 버전 1.9.0 이상부터는 클러스터 만들기 또는 클러스터 업그레이드 전후에 SELinux를 사용 설정 또는 사용 중지할 수 있습니다. SELinux는 기본적으로 Red Hat Enterprise Linux(RHEL)에서 사용 설정됩니다. SELinux가 호스트 머신에 사용 중지되었거나 확실하지 않으면 SELinux를 사용하여 컨테이너 보안에서 이를 사용 중지하는 방법에 대한 안내를 참조하세요.
Google Distributed Cloud는 RHEL 시스템에서만 SELinux를 지원합니다.
gcloud에 로그인하고 클러스터 구성 파일 만들기
gcloud auth application-default login을 사용하여 gcloud CLI에 사용자로 로그인합니다.
gcloudauthapplication-defaultlogin
다음 섹션에서 설명하는 자동 API 사용 설정 및 서비스 계정 생성 기능을 사용하려면 프로젝트 소유자 또는 편집자 역할이 있어야 합니다.
# bmctl configuration variables. Because this section is valid YAML but not a valid Kubernetes# resource, this section can only be included when using bmctl to# create the initial admin/hybrid cluster. Afterwards, when creating user clusters by directly# applying the cluster and node pool resources to the existing cluster, you must remove this# section.gcrKeyPath:bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-gcr.jsonsshPrivateKeyPath:/path/to/your/ssh_private_keygkeConnectAgentServiceAccountKeyPath:bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-connect.jsongkeConnectRegisterServiceAccountKeyPath:bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-register.jsoncloudOperationsServiceAccountKeyPath:bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-cloud-ops.json
클러스터를 Fleet에 등록합니다. bmctl create config 명령어에 지정한 프로젝트 ID는 클러스터 구성 파일의 gkeConnect.projectID 필드에 자동으로 추가됩니다. 이 프로젝트를 Fleet 호스트 프로젝트라고 합니다.
자동 API 사용 설정 및 서비스 계정 생성 기능을 사용하여 구성 파일을 만든 경우 이 단계를 건너뛸 수 있습니다.
자동 API 사용 설정 및 서비스 계정 생성 기능을 사용하지 않고 구성 파일을 만든 경우 클러스터 구성 파일의 해당 gkeConnectAgentServiceAccountKeyPath 및 gkeConnectRegisterServiceAccountKeyPath 필드에서 다운로드한 서비스 계정 JSON 키를 참조하세요.
admin 대신 hybrid 클러스터 유형을 지정하도록 구성을 변경합니다.
spec:# Cluster type. This can be:# 1) admin: to create an admin cluster. This can later be used to create user clusters.# 2) user: to create a user cluster. Requires an existing admin cluster.# 3) hybrid: to create a hybrid cluster that runs admin cluster components and user workloads.# 4) standalone: to create a cluster that manages itself, runs user workloads, but does not manage other clusters.type:hybrid
멀티 노드, 고가용성, 제어 영역을 지정하도록 구성을 변경합니다.
대부분의 HA 쿼럼을 가질 수 있도록 노드를 홀수로 지정하려고 합니다.
# Control plane configurationcontrolPlane:nodePoolSpec:nodes:# Control plane node pools. Typically, this is either a single machine# or 3 machines if using a high availability deployment.-address:10.200.0.4-address:10.200.0.5-address:10.200.0.6
클러스터 노드의 포드 밀도를 지정합니다.
....# NodeConfig specifies the configuration that applies to all nodes in the cluster.nodeConfig:# podDensity specifies the pod density configuration.podDensity:# maxPodsPerNode specifies at most how many pods can be run on a single node.maxPodsPerNode:250....
하이브리드 클러스터의 경우 maxPodsPerNode에 허용되는 값은 HA 클러스터의 경우 32-250, 비 HA 클러스터의 경우 64-250입니다. 지정되지 않은 경우 maxPodsPerNode의 기본값은 110입니다. 클러스터가 생성된 후에는 이 값을 업데이트할 수 없습니다.
또한 포드 밀도는 클러스터의 사용 가능한 IP 리소스에 따라서도 제한됩니다. 자세한 내용은 포드 네트워킹을 참조하세요.
클러스터 구성으로 하이브리드 클러스터 만들기
bmctl 명령어를 사용하여 클러스터를 만듭니다.
bmctlcreatecluster-cCLUSTER_NAME
CLUSTER_NAME을 이전 섹션에서 클러스터 구성 파일을 만들 때 사용한 이름으로 바꿉니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-05(UTC)"],[],[],null,["In Google Distributed Cloud, hybrid clusters perform the dual role of an admin\ncluster and a user cluster. They run workloads, and at the same time, manage\nother clusters, and themselves.\n\nHybrid clusters eliminate the need to run a separate admin cluster in\nresource-constrained scenarios, and can provide highly available (HA)\nreliability. In an HA hybrid cluster, if one node fails, then others will take\nits place.\n\nHybrid clusters are different from standalone clusters in that they can also\nmanage other clusters. Standalone clusters can't create or manage other\nclusters.\n\nWhen you create hybrid clusters, there is some tradeoff between flexibility and\nsecurity, however. Since hybrid clusters manage themselves, running workloads on\nthe same cluster increases the risk of security exposure to sensitive\nadministrative data, like SSH keys.\n\nYou create a hybrid cluster with a high availability (HA) control plane using\nthe `bmctl` command. The `bmctl` command can be run on a separate workstation or\non one of the hybrid cluster nodes.\n\nPrerequisites\n\n- Latest `bmctl` is downloaded (`gs://anthos-baremetal-release/bmctl/1.32.400-gke.68/linux-amd64/bmctl`) from Cloud Storage.\n- Workstation running `bmctl` has network connectivity to all nodes in the target hybrid cluster.\n- Workstation running `bmctl` has network connectivity to the control plane VIP of the target hybrid cluster.\n- SSH key used to create the hybrid cluster is available to root, or there is SUDO user access on all nodes in the target hybrid cluster.\n- Connect-register service account is configured for use with Connect.\n\nSee the [Google Distributed Cloud quickstart](/kubernetes-engine/distributed-cloud/bare-metal/docs/quickstart) for\nexpanded step-by-step instructions for creating a hybrid cluster.\n\nEnable SELinux\n\nIf you want to enable SELinux to secure your containers, you must make sure that\nSELinux is enabled in `Enforced` mode on all your host machines. Starting with\nGoogle Distributed Cloud release 1.9.0 or later, you can enable or disable SELinux\nbefore or after cluster creation or cluster upgrades. SELinux is enabled by\ndefault on Red Hat Enterprise Linux (RHEL). If SELinux is disabled on\nyour host machines or you aren't sure, see\n[Securing your containers using SELinux](/kubernetes-engine/distributed-cloud/bare-metal/docs/installing/configure-selinux)\nfor instructions on how to enable it.\n\nGoogle Distributed Cloud supports SELinux in only RHEL systems.\n\nLog into gcloud and create a cluster configuration file\n\n1. Log into the gcloud CLI as a user using `gcloud auth application-default login`:\n\n gcloud auth application-default login\n\n You need to have a Project Owner or Editor role to use the automatic API\n enablement and Service Account creation features, described in the following\n sections.\n\n You can also add the following IAM roles to the user:\n - Service Account Admin\n - Service Account Key Admin\n - Project IAM Admin\n - Compute Viewer\n - Service Usage Admin\n\n Alternatively, if you already have a service account with those roles, run: \n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar label=\"path of the JSON key file\" translate=\"no\"\u003eJSON_KEY_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eJSON_KEY_FILE\u003c/var\u003e with the path of your service\n account JSON key file.\n2. Get your Google Cloud project ID to use with cluster creation:\n\n export CLOUD_PROJECT_ID=$(gcloud config get-value project)\n\nCreate the cluster configuration file with `bmctl`\n\nAfter you've logged into the gcloud CLI and have your project set up,\nyou can create the cluster configuration file with the `bmctl` command.\n\nTo create a cluster configuration file:\n\n1. Run the following command creates the cluster configuration file, creates\n all needed service accounts, and enables all required APIs:\n\n bmctl create config -c \u003cvar label=\"name of the cluster to be created\" translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\u003c/var\u003e --enable-apis \\\n --create-service-accounts --project-id=\u003cvar label=\"\" translate=\"no\"\u003eCLOUD_PROJECT_ID\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the cluster you're creating.\n - \u003cvar translate=\"no\"\u003eCLOUD_PROJECT_ID\u003c/var\u003e: the ID of your Google Cloud project.\n\n By default, the configuration file is written to\n `bmctl-workspace/`\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e`/`\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e`.yaml`.\n\n If you've already enabled APIs and created service accounts, you can create\n configuration files without enabling APIs and creating service accounts. You\n also aren't required to use the `--project-id` flag. However, you'll need to\n specify credentials in your configuration file manually.\n\n For more information about command options, see\n [create config](/kubernetes-engine/distributed-cloud/bare-metal/docs/reference/bmctl#create_config).\n\nEdit the cluster configuration file\n\nNow that you have a cluster configuration file, edit it to make the following changes:\n\n1. Provide the SSH private key to access the hybrid cluster nodes:\n\n # bmctl configuration variables. Because this section is valid YAML but not a valid Kubernetes\n # resource, this section can only be included when using bmctl to\n # create the initial admin/hybrid cluster. Afterwards, when creating user clusters by directly\n # applying the cluster and node pool resources to the existing cluster, you must remove this\n # section.\n gcrKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-gcr.json\n sshPrivateKeyPath: /path/to/your/ssh_private_key\n gkeConnectAgentServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-connect.json\n gkeConnectRegisterServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-register.json\n cloudOperationsServiceAccountKeyPath: bmctl-workspace/.sa-keys/my-gcp-project-anthos-baremetal-cloud-ops.json\n\n2. Register your clusters to a\n [fleet](/kubernetes-engine/fleet-management/docs). The project ID that you specified\n in the `bmctl create config` command is automatically added to the\n `gkeConnect.projectID` field in the cluster configuration file. This project is\n referred to as the\n [fleet host project](/kubernetes-engine/fleet-management/docs/fleet-concepts#fleet-host-project).\n\n - If you created your configuration file, using the automatic API enablement and Service Account creation features, you can skip this step.\n - If you created the configuration file without using the automatic API enablement and Service Account creation features, reference the downloaded service account JSON keys in the corresponding `gkeConnectAgentServiceAccountKeyPath` and `gkeConnectRegisterServiceAccountKeyPath` fields of the cluster configuration file.\n3. Change the config to specify a cluster type of `hybrid` instead of `admin`:\n\n spec:\n # Cluster type. This can be:\n # 1) admin: to create an admin cluster. This can later be used to create user clusters.\n # 2) user: to create a user cluster. Requires an existing admin cluster.\n # 3) hybrid: to create a hybrid cluster that runs admin cluster components and user workloads.\n # 4) standalone: to create a cluster that manages itself, runs user workloads, but does not manage other clusters.\n type: hybrid\n\n4. Change the config to specify a multi-node, high availability control plane.\n You want to specify an odd number of nodes to be able to have a majority\n quorum for HA:\n\n # Control plane configuration\n controlPlane:\n nodePoolSpec:\n nodes:\n # Control plane node pools. Typically, this is either a single machine\n # or 3 machines if using a high availability deployment.\n - address: 10.200.0.4\n - address: 10.200.0.5\n - address: 10.200.0.6\n\n | **Note:** If you have an even number of nodes temporarily while adding or removing nodes for maintenance or replacement, your deployment maintains HA as long as you have enough quorum.\n5. Specify the pod density of cluster nodes:\n\n ....\n # NodeConfig specifies the configuration that applies to all nodes in the cluster.\n nodeConfig:\n # podDensity specifies the pod density configuration.\n podDensity:\n # maxPodsPerNode specifies at most how many pods can be run on a single node.\n maxPodsPerNode: 250\n ....\n\n For hybrid clusters, allowable values for `maxPodsPerNode` are `32-250` for\n HA clusters and `64-250` for non-HA clusters. The default value for\n `maxPodsPerNode` if unspecified is `110`. Once the cluster is created, this\n value cannot be updated.\n\n Pod density is also limited by your cluster's available IP resources. For details,\n see\n [Pod networking](/kubernetes-engine/distributed-cloud/bare-metal/docs/concepts/network-reqs#pod_networking).\n\nCreate the hybrid cluster with the cluster configuration\n\nUse the `bmctl` command to create the cluster: \n\n bmctl create cluster -c \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\n\nReplace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with the name you used when you\ncreated the cluster configuration file the previous section.\n\nThe following shows an example of the command to create a cluster named\n`hybrid1`: \n\n bmctl create cluster -c hybrid1\n\nSample hybrid cluster configurations\n\nFor example hybrid cluster configurations, see\n[Hybrid clusters](/kubernetes-engine/distributed-cloud/bare-metal/docs/reference/config-samples#hybrid_clusters) in the\nCluster configuration samples."]]
