Skip to content

Kubernetes Client Provider Installation#

This guide provides detailed instructions for installing the Kubernetes Client Provider.

Prerequisites#

Before you deploy the Kubernetes Client Provider, ensure that:

  • The Services application is installed
  • The Cloud Connect Core and Kubernetes plugin are installed on the target cluster
  • kubernetes-nmstate is installed on the target cluster
  • You have a token that can read pods, nodes, NetworkAttachmentDefinitions, and NMState NodeNetworkState

Installation Steps#

To deploy the Kubernetes Client Provider, complete the following tasks:

  1. Deploy the Kubernetes Client Provider app
  2. Create a Secret for the cluster token
  3. Create a K8sClientProviderInstance

Step 1: Kubernetes Client Provider App Deployment#

The Kubernetes Client Provider is an application in the EDA app ecosystem. You can install it from the EDA Store UI.

Installation Using EDA Store UI#

  1. Navigate to the EDA Store in the EDA UI
  2. Locate the K8s Client Provider app
  3. Click Install
  4. Complete the installation

Installation Using Kubernetes API#

If you prefer installing the app using the Kubernetes API, you can do so by creating the following Workflow resource:

apiVersion: appstore.eda.nokia.com/v1
kind: AppInstaller
metadata:
  name: k8s-client-provider
  namespace: eda-system
spec:
  operation: install
  apps:
    - appId: k8s-client-provider.eda.nokia.com
      catalog: eda-catalog-builtin-apps
      version:
        type: alias
        value: latest
kubectl apply -f - <<EOF
apiVersion: appstore.eda.nokia.com/v1
kind: AppInstaller
metadata:
  name: k8s-client-provider
  namespace: eda-system
spec:
  operation: install
  apps:
    - appId: k8s-client-provider.eda.nokia.com
      catalog: eda-catalog-builtin-apps
      version:
        type: alias
        value: latest

EOF

Step 2: Create a Secret for the Cluster Token#

Create a Kubernetes Secret in the eda-system namespace.

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: my-k8s-creds
  namespace: eda-system
  labels:
    "eda.nokia.com/backup": "true"
stringData:
  usertoken: "..." # Token that can read Pods, nodes, NADs, and NodeNetworkState
kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: my-k8s-creds
  namespace: eda-system
  labels:
    "eda.nokia.com/backup": "true"
stringData:
  usertoken: "..." # Token that can read Pods, nodes, NADs, and NodeNetworkState

EOF

mandatory label

The secrets used by EDA must have the eda.nokia.com/backup: "true" label.

Step 3: Create the Kubernetes Client Provider Instance#

Create the K8sClientProviderInstance in the EDA UI under System Administration > Client Providers > K8s Client Providers.

You can also create the same resource using the Kubernetes API. Replace the example values with values for your deployment.

apiVersion: k8s-client-provider.core.eda.nokia.com/v1alpha1
kind: K8sClientProviderInstance
metadata:
  name: my-k8s-client-provider # A unique name for the instance
  namespace: eda-system # The EDA core namespace
spec:
  namespace: eda # The namespace that holds the fabric, BridgeDomains, and client table
  k8sClusterURI: https://kubernetes.example:6443 # The Kubernetes API URL
  authSecretRef: my-k8s-creds # Secret in eda-system that contains the usertoken
  k8sClusterTLSEnabled: true
  k8sClusterSkipTLSVerify: false
kubectl apply -f - <<EOF
apiVersion: k8s-client-provider.core.eda.nokia.com/v1alpha1
kind: K8sClientProviderInstance
metadata:
  name: my-k8s-client-provider # A unique name for the instance
  namespace: eda-system # The EDA core namespace
spec:
  namespace: eda # The namespace that holds the fabric, BridgeDomains, and client table
  k8sClusterURI: https://kubernetes.example:6443 # The Kubernetes API URL
  authSecretRef: my-k8s-creds # Secret in eda-system that contains the usertoken
  k8sClusterTLSEnabled: true
  k8sClusterSkipTLSVerify: false

EOF
Namespaces

Create the K8sClientProviderInstance in eda-system. Set spec.namespace to the namespace that holds the fabric where the Kubernetes resources are created.

TLS certificate

When TLS is enabled and skip verify is false, you can set spec.k8sClusterTLSCertificate to the CA certificate of the target API server if it is self-signed.

Configuration Parameters#

The K8sClientProviderInstance resource supports the following fields:

Field Description Required
name Name of the instance in EDA. Yes
k8sClusterURI Kubernetes API URL, including the scheme and optional port. Yes
authSecretRef Name of the Kubernetes Secret in eda-system that contains the usertoken. Yes
k8sClusterTLSEnabled Enables TLS to the cluster API. Default is true. Yes
k8sClusterSkipTLSVerify Skips verification of the API server certificate. Default is false. Yes
namespace Namespace that holds the fabric where Kubernetes resources are scheduled. Yes
k8sClusterTLSCertificate CA certificate used to verify the API server. No

Post-Installation Verification#

After you create the instance, verify that the operator pod is running:

kubectl get pods -n eda-system | grep k8s-client-provider

Check the instance status:

kubectl get k8sclientproviderinstances -n eda-system

Next Steps#

After installation, proceed to:

  • Check the .namespace.clienttables.networks client table for Kubernetes entries.