Creating a Managed Service for Kubernetes cluster

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To create a cluster:

1. Specify the Managed Service for Kubernetes cluster parameters in the create command (the example below does not list all possible parameters):

   yc managed-kubernetes cluster create \
     --name test-k8s \
     --network-name default \
     --zone ru-central1-a \
     --subnet-name default-a \
     --public-ip \
     --release-channel regular \
     --version 1.27 \
     --cluster-ipv4-range 10.1.0.0/16 \
     --service-ipv4-range 10.2.0.0/16 \
     --security-group-ids enpe5sdn7vs5********,enpj6c5ifh75******** \
     --service-account-name default-sa \
     --node-service-account-name default-sa \
     --daily-maintenance-window start=22:00,duration=10h
   

   Where:

   • --name: Managed Service for Kubernetes cluster name.

   • --network-name: Network name.

     Note

     If you select a cloud network from another folder, assign the resource service account the following roles in this folder:

     • vpc.privateAdmin
     • vpc.user
     • vpc.bridgeAdmin

     To use a public IP address, also assign the vpc.publicAdmin role.

   • --zone: Availability zone.

   • --subnet-name: Subnet name.

   • --public-ip: Flag indicating that the Managed Service for Kubernetes cluster needs a public IP address.

   • --release-channel: Release channel.

   • --version: Kubernetes version. Specify a version available for the selected release channel.

   • --cluster-ipv4-range: Range of IP addresses for allocating pod addresses.

   • --service-ipv4-range: Range of IP addresses for allocating service addresses.

   • --security-group-ids: List of Managed Service for Kubernetes cluster security group IDs.

     Warning

     The configuration of security groups determines cluster performance, availability, and services running in the cluster.

   • --service-account-id: Unique ID of the service account for the resources. This service account will be used to create the resources required for the Managed Service for Kubernetes cluster.

   • --node-service-account-id: Unique ID of the service account for the nodes. Nodes will pull the required Docker images from the registry on behalf of this account.

   • --daily-maintenance-window: Maintenance window settings.

   Result:

   done (5m47s)
   id: cathn0s6qobf********
   folder_id: b1g66jflru0e********
   ...
     service_account_id: aje3932acd0c********
     node_service_account_id: aje3932acd0c********
     release_channel: REGULAR
   

2. To enable the Calico network policy controller, set the --enable-network-policy flag in the Managed Service for Kubernetes cluster create command:

   yc managed-kubernetes cluster create \
   ...
     --enable-network-policy
   

3. To use the Yandex Key Management Service encryption key for protecting sensitive data, provide the key name or ID in the Managed Service for Kubernetes cluster creation command:

   yc managed-kubernetes cluster create \
   ...
     --kms-key-name <encryption_key_name> \
     --kms-key-id <encryption_key_ID>
   

   Warning

   You cannot edit this setting after you create a cluster.

4. To enable sending logs to Yandex Cloud Logging, provide the logging settings in the --master-logging property of the Managed Service for Kubernetes cluster create command:

   yc managed-kubernetes cluster create \
   ...
     --master-logging enabled=<send_logs>,`
       `log-group-id=<log_group_ID>,`
       `folder-id=<folder_ID>,`
       `kube-apiserver-enabled=<send_kube-apiserver_logs>,`
       `cluster-autoscaler-enabled=<send_cluster-autoscaler_logs>,`
       `events-enabled=<send_Kubernetes_events>`
       `audit-enabled=<send_audit_events>
   

   Where:

   • enabled: Flag that enables log sending, true or false.
   • log-group-id: ID of the log group to send the logs to.
   • folder-id: ID of the folder to send the logs to. The logs will be sent to the log group of the default folder.
   • kube-apiserver-enabled: Flag that enables kube-apiserver log sending, true or false.
   • cluster-autoscaler-enabled: Flag that enables cluster-autoscaler log sending, true or false.
   • events-enabled: Flag that enables Kubernetes event sending, true or false.
   • audit-enabled: Flag that enables audit event sending, true or false.

   If log sending is enabled but neither log-group-id nor folder-id is specified, the logs will be sent to the default log group of the folder with the Managed Service for Kubernetes cluster. You cannot set both log-group-id and folder-id at the same time.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the documentation on the Terraform website or mirror website.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To create a Managed Service for Kubernetes cluster:

1. In the configuration file, describe the parameters of the resources you want to create:

   • Managed Service for Kubernetes cluster: Cluster description.

   • Network: Description of the cloud network to host the Managed Service for Kubernetes cluster. If you already have a suitable network, you do not need to describe it again.

     Note

     If you select a cloud network from another folder, assign the resource service account the following roles in this folder:

     • vpc.privateAdmin
     • vpc.user
     • vpc.bridgeAdmin

     To use a public IP address, also assign the vpc.publicAdmin role.

   • Subnets: Description of the subnets to connect the Managed Service for Kubernetes cluster hosts to. If you already have suitable subnets, you do not need to describe them again.

   • Service account for the Managed Service for Kubernetes cluster and nodes and role settings for this account. Create separate service accounts for the Managed Service for Kubernetes cluster and nodes, as required. If you already have a suitable service account, you do not need to describe it again.

   Here is an example of the configuration file structure:

   resource "yandex_kubernetes_cluster" "<Managed_Service_for_Kubernetes_cluster_name>" {
    network_id = yandex_vpc_network.<network_name>.id
    master {
      master_location {
        zone      = yandex_vpc_subnet.<subnet_name>.zone
        subnet_id = yandex_vpc_subnet.<subnet_name>.id
      }
    }
    service_account_id      = yandex_iam_service_account.<service_account_name>.id
    node_service_account_id = yandex_iam_service_account.<service_account_name>.id
      depends_on = [
        yandex_resourcemanager_folder_iam_member.editor,
        yandex_resourcemanager_folder_iam_member.images-puller
      ]
   }
   
   resource "yandex_vpc_network" "<network_name>" { name = "<network_name>" }
   
   resource "yandex_vpc_subnet" "<subnet_name>" {
    v4_cidr_blocks = ["<subnet_IP_address_range>"]
    zone           = "<availability_zone>"
    network_id     = yandex_vpc_network.<network_name>.id
   }
   
   resource "yandex_iam_service_account" "<service_account_name>" {
    name        = "<service_account_name>"
    description = "<service_account_description>"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "editor" {
    # The service account gets the editor role.
    folder_id = "<folder_ID>"
    role      = "editor"
    member    = "serviceAccount:${yandex_iam_service_account.<service_account_name>.id}"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "images-puller" {
    # The service account gets the "container-registry.images.puller" role.
    folder_id = "<folder_ID>"
    role      = "container-registry.images.puller"
    member    = "serviceAccount:${yandex_iam_service_account.<service_account_name>.id}"
   }
   

   To enable sending logs to Yandex Cloud Logging, add the master_logging section to the Managed Service for Kubernetes cluster description:

   resource "yandex_kubernetes_cluster" "<cluster_name>" {
    ...
    master {
      ...
      master_logging {
        enabled                    = <log_sending>
        log_group_id               = "<log_group_ID>"
        folder_id                  = "<folder_ID>"
        kube_apiserver_enabled     = <kube-apiserver_log_sending>
        cluster_autoscaler_enabled = <cluster-autoscaler_log_sending>
        events_enabled             = <Kubernetes_event_sending>
        audit_enabled              = <audit_event_sending>
      }
    }
   }
   

   Where:

   • enabled: Flag that enables log sending, true or false.
   • log_group_id: ID of the log group to send the logs to.
   • folder_id: ID of the folder to send the logs to. The logs will be sent to the log group of the default folder.
   • kube_apiserver_enabled: Flag that enables kube-apiserver log sending, true or false.
   • cluster_autoscaler_enabled: Flag that enables cluster-autoscaler log sending, true or false.
   • events_enabled: Flag that enables Kubernetes event sending, true or false.
   • audit_enabled: Flag that enables audit event sending, true or false.

   If log sending is enabled but neither log_group_id nor folder_id is specified, the logs will be sent to the default log group of the folder with the Managed Service for Kubernetes cluster. You cannot set both log_group_id and folder_id at the same time.

   For more information, see the Terraform provider documentation.

2. Make sure the configuration files are correct.

   1. In the command line, go to the folder where you created the configuration file.

   2. Run a check using this command:

      terraform plan
      

   If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out. This is a test step; no resources will be created.

3. Create a Managed Service for Kubernetes cluster.

   1. If the configuration does not contain any errors, run this command:

      terraform apply
      

   2. Confirm that you want to create the resources.

   After this, all required resources will be created in the specified folder and the IP addresses of the VMs will be displayed in the terminal. You can check the new resources and their configuration using the management console.

To create a Managed Service for Kubernetes cluster, use the create method for the Cluster resource.

To use a Yandex Key Management Service encryption key to protect secrets, provide its ID in the kmsProvider.keyId parameter.

To enable sending logs to Yandex Cloud Logging, provide the logging settings in the masterSpec.masterLogging parameter.