Skip to content

Commit 5e130f1

Browse files
github-actions[bot]updatecli-bot
andauthored
chore: Set latest docusaurus version (#224)
Made with ❤️️ by updatecli Co-authored-by: updatecli-bot <[email protected]>
1 parent c45db1a commit 5e130f1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+6458
-0
lines changed
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Architecture
2+
3+
Fleet has two primary components. The Fleet controller and the cluster agents. These
4+
components work in a two-stage pull model. The Fleet controller will pull from git and the
5+
cluster agents will pull from the Fleet controller.
6+
7+
## Fleet Controller
8+
9+
The Fleet controller is a set of Kubernetes controllers running in any standard Kubernetes
10+
cluster. The only API exposed by the Fleet controller is the Kubernetes API, there is no
11+
custom API for the fleet controller.
12+
13+
## Cluster Agents
14+
15+
One cluster agent runs in each cluster and is responsible for talking to the Fleet controller.
16+
The only communication from cluster to Fleet controller is by this agent and all communication
17+
goes from the managed cluster to the Fleet controller. The fleet manager does not initiate
18+
connections to downstream clusters. This means managed clusters can run in private networks and behind
19+
NATs. The only requirement is the cluster agent needs to be able to communicate with the
20+
Kubernetes API of the cluster running the Fleet controller. The one exception to this is if you use
21+
the [manager initiated](./cluster-registration.md#manager-initiated) cluster registration flow. This is not required, but
22+
an optional pattern.
23+
24+
The cluster agents are not assumed to have an "always on" connection. They will resume operation as
25+
soon as they can connect. Future enhancements will probably add the ability to schedule times of when
26+
the agent checks in, as it stands right now they will always attempt to connect.
27+
28+
## Security
29+
30+
The Fleet controller dynamically creates service accounts, manages their RBAC and then gives the
31+
tokens to the downstream clusters. Clusters are registered by optionally expiring cluster registration tokens.
32+
The cluster registration token is used only during the registration process to generate a credential specific
33+
to that cluster. After the cluster credential is established the cluster "forgets" the cluster registration
34+
token.
35+
36+
The service accounts given to the clusters only have privileges to list `BundleDeployment` in the namespace created
37+
specifically for that cluster. It can also update the `status` subresource of `BundleDeployment` and the `status`
38+
subresource of it's `Cluster` resource.
39+
40+
## Component Overview
41+
42+
An overview of the components and how they interact on a high level.
43+
44+
![Components](/img/FleetComponents.svg)
Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Create a Bundle Resource
2+
3+
Bundles are automatically created by Fleet when a `GitRepo` is created. In most cases `Bundles` should not be created
4+
manually by the user. If you want to deploy resources from a git repository use a
5+
[GitRepo](https://fleet.rancher.io/gitrepo-add) instead.
6+
7+
If you want to deploy resources without a git repository follow this guide to create a `Bundle`.
8+
9+
When creating a `GitRepo` Fleet will fetch the resources from a git repository, and add them to a Bundle.
10+
When creating a `Bundle` resources need to be explicitly specified in the `Bundle` Spec.
11+
Resources can be compressed with gz. See [here](https://github.com/rancher/rancher/blob/v2.7.3/pkg/controllers/provisioningv2/managedchart/managedchart.go#L149-L153)
12+
an example of how Rancher uses compression in go code.
13+
14+
If you would like to deploy in downstream clusters, you need to define targets. Targets work similarly to targets in `GitRepo`.
15+
See [Mapping to Downstream Clusters](https://fleet.rancher.io/gitrepo-targets#defining-targets).
16+
17+
The following example creates a nginx `Deployment` in the local cluster:
18+
19+
```yaml
20+
kind: Bundle
21+
apiVersion: fleet.cattle.io/v1alpha1
22+
metadata:
23+
# Any name can be used here
24+
name: my-bundle
25+
# For single cluster use fleet-local, otherwise use the namespace of
26+
# your choosing
27+
namespace: fleet-local
28+
spec:
29+
resources:
30+
# List of all resources that will be deployed
31+
- content: |
32+
apiVersion: apps/v1
33+
kind: Deployment
34+
metadata:
35+
name: nginx-deployment
36+
labels:
37+
app: nginx
38+
spec:
39+
replicas: 3
40+
selector:
41+
matchLabels:
42+
app: nginx
43+
template:
44+
metadata:
45+
labels:
46+
app: nginx
47+
spec:
48+
containers:
49+
- name: nginx
50+
image: nginx:1.14.2
51+
ports:
52+
- containerPort: 80
53+
name: nginx.yaml
54+
targets:
55+
- clusterName: local
56+
57+
```
58+
59+
## Targets
60+
61+
The bundle can target multiple clusters. It uses the same [targeting as the GitRepo](gitrepo-targets#target-matching).
62+
Additional [customization options](gitrepo-targets#supported-customizations) can be specified per target:
63+
64+
```yaml
65+
targets:
66+
- clusterSelector:
67+
matchLabels:
68+
env: dev
69+
defaultNamespace: lab-1
70+
helm:
71+
values:
72+
replicas: 1
73+
```
74+
75+
## Limitations
76+
77+
Helm options related to downloading the helm chart will be ignored. The helm chart is downloaded by the fleet-cli, which creates the bundles. The bundle has to contain all the resources from the chart. Therefore the bundle will ignore:
78+
79+
* `spec.helm.repo`
80+
* `spec.helm.charts`
81+
82+
You can't use a `fleet.yaml` in resources, it is only used by the fleet-cli to create bundles.
83+
84+
The `spec.targetRestrictions` field is not useful, as it is an allow list for targets specified in `spec.targets`. It is not needed, since `targets` are explicitly given in a bundle and an empty `targetRestrictions` defaults to allow.
85+
86+
## Convert a Helm Chart into a Bundle
87+
88+
You can use the Fleet CLI to convert a Helm chart into a bundle.
89+
90+
For example, you can download and convert the "external secrets" operator chart like this:
91+
```
92+
cat > targets.yaml <<EOF
93+
targets:
94+
- clusterSelector: {}
95+
EOF
96+
97+
mkdir app
98+
cat > app/fleet.yaml <<EOF
99+
defaultNamespace: external-secrets
100+
helm:
101+
repo: https://charts.external-secrets.io
102+
chart: external-secrets
103+
EOF
104+
105+
fleet apply --compress --targets-file=targets.yaml -n fleet-default -o - external-secrets app > eso-bundle.yaml
106+
107+
kubectl apply -f eso-bundle.yaml
108+
```
109+
110+
Make sure you use a cluster selector in `targets.yaml`, that matches all clusters you want to deploy to.
111+
112+
The blog post on [Fleet: Multi-Cluster Deployment with the Help of External Secrets](https://www.suse.com/c/rancher_blog/fleet-multi-cluster-deployment-with-the-help-of-external-secrets/) has more information.

0 commit comments

Comments
 (0)