ApiServer Configuration

This guide outlines the steps to configurate the apiserver in the cluster using the cluster-values.yaml.

Requires one of the following licenses:

CM: Standard, Professional, Enterprise

Prerequisites

yq must be installed on all controle planes. For more infomration refer yq installation guide.
jq must be installed on all controle planes.

1. Create or edit the cluster-values.yaml configuration file

⚠ Warning This file has to be adapted to your values before usage. Inserting invalid values into the ConfigMap can cause the cluster to become unavailable.

Note If Kubeops-Dashboard is deployed into the cluster the oidc-entries must be set in cluster-values.yaml.

Note changeCluster must be set to true. The advanced values are just for demonstration purposes and can be changed or swapped according to your needs.

# file cluster-values.yaml
apiVersion: kubeops/kubeopsctl/cluster/beta/v1
imagePullRegistry: registry.kubeops.net/kubeops/kubeops
airgap: false
clusterName: <your cluster name>
clusterUser: <your user name>
kubernetesVersion: <your kubernetesversion>
kubeVipEnabled: false
virtualIP: <your master1 ip>
firewall: nftables
pluginNetwork: calico
containerRuntime: containerd
kubeOpsRoot: <your kubeopsroot path>
serviceSubnet: 192.168.128.0/17
podSubnet: 192.168.0.0/17
debug: true
packageRepository: local                    # If you have incorporated package repository, replace “local” with "kubeops-repo"
changeCluster: true

advanced:
  apiServer:
    extraArgs:
      oidc-issuer-url: https://<domain>/keycloak/realms/kubeops-dashboards
      oidc-client-id: kubeops-dashboard
      oidc-username-claim: preferred_username
      oidc-groups-claim: groups
      oidc-username-prefix: '"oidc:"'
      oidc-groups-prefix: '"oidc:"'
      audit-policy-file: <path-to-audit-policy-file>
      audit-log-path: <path-to-audit-log-file>
      audit-log-maxage: '"30"'
      audit-log-maxbackup: '"10"'
      audit-log-maxsize: '"100"'
    extraVolumes:
    - name: audit-policy
      hostPath: <path-to-audit-policy-file>
      mountPath: <path-to-audit-policy-file>
      readOnly: true
      pathType: File
    - name: audit-log
      hostPath: /var/log/kubernetes
      mountPath: /var/log/kubernetes
      readOnly: false
      pathType: DirectoryOrCreate

zones:
- name: zone1
  nodes:
  - name: <your master1 hostname>
    iPAddress: <your master1 ip>
    type: controlplane
    kubeVersion: <kubernetesversion from above>
  - name: <your worker1 hostname>
    iPAddress: <your worker1 ip>
    type: worker
    kubeVersion: <kubernetesversion from above>
- name: zone2
  nodes:
  - name: <your master2 hostname>
    iPAddress: <your master2 ip>
    type: controlplane
    kubeVersion: <kubernetesversion from above>
  - name: <your worker2 hostname>
    iPAddress: <your worker2 ip>
    type: worker
    kubeVersion: <kubernetesversion from above>
- name: zone3
  nodes:
  - name: <your master3 hostname>
    iPAddress: <your master3 ip>
    type: controlplane
    kubeVersion: <kubernetesversion from above>
  - name: <your worker3 hostname>
    iPAddress: <your worker3 ip>
    type: worker
    kubeVersion: <kubernetesversion from above>

2. Configuring the configmap

Depending on the way you want to configure the API server, follow the guides linked above. To only update the ConfigMap, simply run the command on the updated cluster-values.yaml.

kubeopsctl apply -f cluster-values.yaml

Removing entries from the ConfigMap

Important: The cluster-values.yaml should always represent the state of the Kubernetes cluster

To remove entrys from the config map delete them from the cluster-values.yaml and run

kubeopsctl apply -f cluster-values.yaml

Note Removing all advanced entries will set the ConfigMap back to default.