Connecting to a node over SSH

1. Run cmd.exe or powershell.exe.

2. Use the ssh-keygen command to create a new key. Run this command:

   ssh-keygen -t ed25519
   

   After running this command, the system will prompt you to specify the names of files to store the keys and enter the password for the private key. The default name is id_ed25519. Keys are created in the C:\Users\<username>\.ssh\ directory.

   The public part of the key will be saved to a file named <key_name>.pub.

Create keys using PuTTY:

1. Download and install PuTTY.

2. Add the folder with PuTTY to the PATH variable:

   1. Click Start and type Change system environment variables in the Windows search bar.
   2. Click Environment Variables... at the bottom right.
   3. In the window that opens, find the PATH parameter and click Edit.
   4. Add your folder path to the list.
   5. Click OK.

3. Launch the PuTTYgen application.

4. Select Ed25519 as the pair type to generate. Click Generate and move the cursor in the field above it until the key is created.

   

5. In Key passphrase, enter a strong password. Enter it again in the field below.

6. Click Save private key and save the private key. Do not share its key phrase with anyone.

7. Save the key in a text file in a single line. To do this, copy the public key from the text field to a text file named id_ed25519.pub.

Metadata with credentials for connecting over SSH is provided to the Managed Service for Kubernetes node group as key=value pairs.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

To create a Managed Service for Kubernetes node group and provide user credentials for connecting over SSH, run this command:

yc managed-kubernetes node-group create \
  --name <node_group_name> \
  --cluster-name <cluster_name> \
  --fixed-size <number_of_nodes_in_group> \
  --network-interface security-group-ids=[<list_of_security_groups>],subnets=<subnet_name>,ipv4-address=nat \
  --metadata-from-file ssh-keys=<path_to_credentials_file>

Where --metadata-from-file is the parameter to provide metadata to the node group as key=value pairs. In ssh-keys, specify the path to the file with credentials for connecting over SSH.

Metadata with credentials for connecting over SSH is provided to the Managed Service for Kubernetes node group as key=value pairs.

1. Create a Terraform configuration file describing the Managed Service for Kubernetes node group by following the steps described in Creating a node group.

2. In the node group description, set the ssh-keys metadata key value for the instance_template.metadata parameter:

   resource "yandex_kubernetes_node_group" "<node_group_name>" {
     cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
     ...
     instance_template {
       metadata = {
         "ssh-keys" = file("<path_to_credentials_file>")
         ...
       }
       ...
     }
     ...
   }
   

3. Make sure the configuration files are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   Timeouts

   The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:

   • Creating and editing: 60 minutes.
   • Deleting: 20 minutes.

   Operations in excess of this time will be interrupted.

   How do I modify these limits?

   Add the timeouts section to the cluster node group description, e.g.:

   resource "yandex_kubernetes_node_group" "<node_group_name>" {
     ...
     timeouts {
       create = "1h30m"
       update = "1h30m"
       delete = "60m"
     }
   }
   

For more information, see this Terraform provider guide.

Metadata with credentials for connecting over SSH is provided to the Managed Service for Kubernetes node group as key=value pairs.

To provide multiple credentials for connecting over SSH, convert the contents of the credentials file to a single line and separate the credentials from each other with a sequence of special CRLF characters (\r\n). You cannot use multiline messages in an API request with a JSON body.

Example of converted credentials:

testuser1:ssh-ed25519 AAAAB3NzaC***********lP1ww testuser1\r\ntestuser2:ssh-ed25519 ONEMOREkey***********avEHw testuser2

Use the create REST API method for the NodeGroup resource or the NodeGroupService/Create gRPC API call.

Credentials for connecting over SSH are provided in the nodeTemplate.metadata parameter in ssh-keys.

1. View the description of the CLI command for adding and updating the Managed Service for Kubernetes node group metadata:

   yc managed-kubernetes node-group add-metadata --help
   

2. Run this command:

   yc managed-kubernetes node-group add-metadata \
     --name <node_group_name> \
     --metadata-from-file ssh-keys=<path_to_credentials_file>
   

   You can get the node group name with the list of node groups in the folder.

1. Open the Terraform configuration file describing the Managed Service for Kubernetes node group.

   For more information about creating this file, see Creating a node group.

2. In the node group description, change the value of the ssh-keys metadata key for the instance_template.metadata parameter:

   resource "yandex_kubernetes_node_group" "<node_group_name>" {
     cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
     ...
     instance_template {
       metadata = {
         "ssh-keys" = file("<path_to_credentials_file>")
         ...
       }
       ...
     }
     ...
   }
   

3. Make sure the configuration files are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

1. To provide multiple credentials for connecting over SSH, convert the contents of the credentials file to a single line and separate the credentials from each other with a sequence of special CRLF characters (\r\n). You cannot use multiline messages in an API request with a JSON body.

   Example of converted credentials:

   testuser1:ssh-ed25519 AAAAB3NzaC***********lP1ww testuser1\r\ntestuser2:ssh-ed25519 ONEMOREkey***********avEHw testuser2
   

2. Get all the existing metadata for the node group using the get REST API method for the NodeGroup resource, and provide the node group ID in the nodeGroupId request parameter.

   You can request the name of a node group with a list of node groups in the folder.

   The metadata will be listed as key=value pairs in the nodeTemplate.metadata field of the response.

3. Use the update REST API method for the NodeGroup resource and provide the following in the request:

   • Node group ID in the nodeGroupId parameter.

   • updateMask parameter set to nodeTemplate.metadata.

     Warning

     The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   • nodeTemplate.metadata listing all existing node group metadata as key=value pairs without any changes.

     For ssh-keys, replace the current value with the line with credentials you created.

     Example of listing metadata in a parameter

     • Existing metadata keys in a node group:

       "nodeTemplate": {
           "metadata": {
               "ssh-keys": "<existing_credentials_in_single_line>",
               "<existing_key_1>": "<existing_value_1>",
               "<existing_key_2>": "<existing_value_2>"
           },
           ...
       }
       

     • Metadata keys to provide in an API request:

       "nodeTemplate": {
           "metadata": {
               "ssh-keys": "<new_credentials_in_single_line>",
               "<existing_key_1>": "<existing_value_1>",
               "<existing_key_2>": "<existing_value_2>"
           }
       }
       

     Alert

     Any metadata not listed in the nodeTemplate.metadata parameter will be deleted.

     Then the node group status will temporarily change to Reconciling: all the nodes in the group will be recreated for the changes to apply.

1. Find out the ID of the VM group that matches the Managed Service for Kubernetes node group.

   The ID is shown in the INSTANCE GROUP ID column.

   yc managed-kubernetes node-group list
   

   Result:

   +----------------------+----------------------+----------------+----------------------+---------------------+---------+------+
   |          ID          |      CLUSTER ID      |      NAME      |  INSTANCE GROUP ID   |     CREATED AT      | STATUS  | SIZE |
   +----------------------+----------------------+----------------+----------------------+---------------------+---------+------+
   | cat684ojo3ir******** | cata9ertn6tc******** | test-nodegroup | cl17i6943n92******** | 2019-04-12 12:38:35 | RUNNING |    2 |
   +----------------------+----------------------+----------------+----------------------+---------------------+---------+------+
   

2. View the list of Managed Service for Kubernetes nodes that belong to this group.

   The public IP address of the Managed Service for Kubernetes node is shown in the IP column after ~.

   yc compute instance-group list-instances cl17i6943n92********
   

   Result:

   +----------------------+---------------------------+--------------------------+---------------+----------------+
   |     INSTANCE ID      |           NAME            |            IP            |    STATUS     | STATUS MESSAGE |
   +----------------------+---------------------------+--------------------------+---------------+----------------+
   | ef31h24k03pg******** | cl17i6943n92********-itif | 10.0.0.27~84.201.145.251 | RUNNING [53m] |                |
   | ef37ddhg9i7j******** | cl17i6943n92********-ovah | 10.0.0.22~84.201.149.184 | RUNNING [53m] |                |
   +----------------------+---------------------------+--------------------------+---------------+----------------+
   

1. Install kubect and configure it to work with the new cluster.

2. Run this command:

   kubectl get nodes -o wide
   

   Result:

   NAME                       STATUS  ROLES   AGE  VERSION  INTERNAL-IP  EXTERNAL-IP     OS-IMAGE            KERNEL-VERSION     CONTAINER-RUNTIME
   cl17i6943n92********-itif  Ready   <none>  31m  v1.13.3  10.0.0.27    84.201.145.251  Ubuntu 18.04.1 LTS  4.15.0-29-generic  docker://18.6.2
   cl17i6943n92********-ovah  Ready   <none>  31m  v1.13.3  10.0.0.22    84.201.149.184  Ubuntu 18.04.1 LTS  4.15.0-29-generic  docker://18.6.2
   

   The public IP address is listed in the EXTERNAL-IP column.

In Windows, a connection is established using PuTTY.

1. Run Pageant.
   1. Right-click the Pageant icon in the task bar.
   2. In the context menu, select Add key.
   3. Select a PuTTY-generated private key in .ppk format. Enter the password for this key, if any.
2. Run PuTTY.

   1. In the Host Name (or IP address) field, enter the public IP address of the VM you want to connect to. Specify port 22 and SSH connection type.

      

   2. In the tree on the left, select Connection - SSH - Auth.

   3. Enable Allow agent forwarding.

   4. In the Private key file for authentication field, select the private key file.

      

   5. Go back to the Sessions menu. In the Saved sessions field, enter any name for the session and click Save. This will save the session settings under the specified name. You can use this session profile to connect with Pageant.

      

   6. Click Open. If this is your first time connecting to the Managed Service for Kubernetes node, you may get the unknown host warning:

      

      Click Yes. This will open a terminal window prompting you to enter the username to use for connection.

      Enter the username:

      • If you provided SSH connection credentials when you created the node group using the management console, enter the username you specified in the Login field.
      • If you provided SSH connection credentials when you created the node group using the CLI, Terraform, API, or updated the credentials, enter the username that you specified in the SSH connection credentials file.

      Press Enter. If everything is configured correctly, a connection to the server will be established.

      

If you saved the session profile in PuTTY, you can use Pageant for future connections:

1. Right-click the Pageant icon in the task bar.
2. Select Saved sessions.
3. In the saved sessions list, select the session you need.