diff --git a/calico-enterprise/multicluster/federation/services-controller.mdx b/calico-enterprise/multicluster/federation/services-controller.mdx index 31206db2c2..63c3262169 100644 --- a/calico-enterprise/multicluster/federation/services-controller.mdx +++ b/calico-enterprise/multicluster/federation/services-controller.mdx @@ -206,4 +206,4 @@ subsets: ## Additional resources - [Cluster mesh example for AWS](aws.mdx) -- [Federated service controller](../../reference/component-resources/kube-controllers/configuration.mdx) +- [Federated services controller](../../reference/resources/kubecontrollersconfig.mdx#federatedservicescontroller) diff --git a/calico-enterprise/operations/decommissioning-a-node.mdx b/calico-enterprise/operations/decommissioning-a-node.mdx index e5c5224804..a21dfc3dcd 100644 --- a/calico-enterprise/operations/decommissioning-a-node.mdx +++ b/calico-enterprise/operations/decommissioning-a-node.mdx @@ -6,7 +6,7 @@ description: Manually remove a node from a cluster that is installed with Calico ## About decommissioning nodes -If you are running the [node controller](../reference/component-resources/kube-controllers/configuration.mdx) +If you are running the [node controller](../reference/resources/kubecontrollersconfig.mdx#nodecontroller) or using the Kubernetes API datastore in policy-only mode, you do not need to manually decommission nodes. In other configurations, you may need to manually decommission a node for one diff --git a/calico-enterprise/reference/component-resources/kube-controllers/configuration.mdx b/calico-enterprise/reference/component-resources/kube-controllers/configuration.mdx deleted file mode 100644 index a5846410ab..0000000000 --- a/calico-enterprise/reference/component-resources/kube-controllers/configuration.mdx +++ /dev/null @@ -1,91 +0,0 @@ ---- -description: Calico Enterprise Kubernetes controllers monitor the Kubernetes API and perform actions based on cluster state. ---- - -# Configuring the Calico Enterprise Kubernetes controllers - -import Tabs from '@theme/Tabs'; -import TabItem from '@theme/TabItem'; - -The $[prodname] Kubernetes controllers are deployed in a Kubernetes cluster. The different controllers monitor the Kubernetes API -and perform actions based on cluster state. - - - - -If you have installed Calico using the operator, see the [KubeControllersConfiguration](../../resources/kubecontrollersconfig.mdx) resource instead. - - - - -The controllers are primarily configured through environment variables. When running -the controllers as a Kubernetes pod, this is accomplished through the pod manifest `env` -section. - -## The $[imageNames.kubeControllers] container - -The `$[imageNames.kubeControllers]` container includes the following controllers: - -1. node controller: watches for the removal of Kubernetes nodes and removes corresponding data from $[prodname], and optionally watches for node updates to create and sync host endpoints for each node. -1. federation controller: watches Kubernetes services and endpoints locally and across all remote clusters, and programs - Kubernetes endpoints for any locally configured service that specifies a service federation selector annotation. - -### Configuring datastore access - -The datastore type can be configured via the `DATASTORE_TYPE` environment variable. Only supported value is `kubernetes`. - -#### kubernetes - -When running the controllers as a Kubernetes pod, Kubernetes API access is [configured automatically][in-cluster-config] and -no additional configuration is required. However, the controllers can also be configured to use an explicit [kubeconfig][kubeconfig] file override to -configure API access if needed. - -| Environment | Description | Schema | -| ------------ | ------------------------------------------------------------------ | ------ | -| `KUBECONFIG` | Path to a Kubernetes kubeconfig file mounted within the container. | path | - -### Other configuration - -:::note - -Whenever possible, prefer configuring the kube-controllers component using the [KubeControllersConfiguration](../../resources/kubecontrollersconfig.mdx) API resource, -Some configuration options may not be available through environment variables. - -::: - -The following environment variables can be used to configure the $[prodname] Kubernetes controllers. - -| Environment | Description | Schema | Default | -| --------------------- | --------------------------------------------------------------------------- | --------------------------------------------------------- | ----------------------------------------------------- | -| `DATASTORE_TYPE` | Which datastore type to use | etcdv3, kubernetes | kubernetes | -| `ENABLED_CONTROLLERS` | Which controllers to run | namespace, node, policy, serviceaccount, workloadendpoint | policy,namespace,serviceaccount,workloadendpoint,node | -| `LOG_LEVEL` | Minimum log level to be displayed. | debug, info, warning, error | info | -| `KUBECONFIG` | Path to a kubeconfig file for Kubernetes API access | path | -| `SYNC_NODE_LABELS` | When enabled, Kubernetes node labels will be copied to Calico node objects. | boolean | true | -| `AUTO_HOST_ENDPOINTS` | When set to enabled, automatically create a host endpoint for each node. | enabled, disabled | disabled | - -## About each controller - -### Node controller - -The node controller has several functions. - -- Garbage collects IP addresses. -- Automatically provisions host endpoints for Kubernetes nodes. - -### Federation controller - -The federation controller syncs Kubernetes federated endpoint changes to the $[prodname] datastore. -The controller must have read access to the Kubernetes API to monitor `Service` and `Endpoints` events, and must -also have write access to update `Endpoints`. - -The federation controller is disabled by default if `ENABLED_CONTROLLERS` is not explicitly specified. - -This controller is valid for all $[prodname] datastore types. For more details refer to the -[Configuring federated services](../../../multicluster/federation/services-controller.mdx) usage guide. - - - - -[in-cluster-config]: https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod -[kubeconfig]: https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/ diff --git a/calico-enterprise/reference/component-resources/kube-controllers/index.mdx b/calico-enterprise/reference/component-resources/kube-controllers/index.mdx index 303cb85423..2be1563165 100644 --- a/calico-enterprise/reference/component-resources/kube-controllers/index.mdx +++ b/calico-enterprise/reference/component-resources/kube-controllers/index.mdx @@ -1,11 +1,11 @@ --- -description: kube-controllers is a set of Kubernetes controllers for Calico +description: kube-controllers is a set of Kubernetes controllers for Calico Enterprise. hide_table_of_contents: true --- # kube-controllers -import DocCardList from '@theme/DocCardList'; -import { useCurrentSidebarCategory } from '@docusaurus/theme-common'; +The `$[imageNames.kubeControllers]` container runs a set of controllers that monitor the Kubernetes API and reconcile cluster state with the $[prodname] datastore. - +- To configure the controllers, see the [KubeControllersConfiguration](../../resources/kubecontrollersconfig.mdx) resource reference. +- For exported Prometheus metrics, see [Prometheus statistics](prometheus.mdx). diff --git a/calico-enterprise/reference/resources/kubecontrollersconfig.mdx b/calico-enterprise/reference/resources/kubecontrollersconfig.mdx index 0be1c62c15..5c282f2dd8 100644 --- a/calico-enterprise/reference/resources/kubecontrollersconfig.mdx +++ b/calico-enterprise/reference/resources/kubecontrollersconfig.mdx @@ -6,7 +6,13 @@ import Selectors from '@site/calico-enterprise/_includes/content/_selectors.mdx' # Kubernetes controllers configuration -A $[prodname] [Kubernetes controllers](../component-resources/kube-controllers/configuration.mdx) configuration resource (`KubeControllersConfiguration`) represents configuration options for the $[prodname] Kubernetes controllers. +A $[prodname] Kubernetes controllers configuration resource (`KubeControllersConfiguration`) configures the controllers that run inside the `$[imageNames.kubeControllers]` container. These controllers monitor the Kubernetes API and reconcile cluster state with the $[prodname] datastore. + +The `$[imageNames.kubeControllers]` container can run the following controllers; each is enabled by including a corresponding block under `spec.controllers`, and disabled by omitting the block. + +- **Node controller** — garbage collects IP addresses, cleans up $[prodname] node data when Kubernetes nodes are removed, and optionally creates and syncs host endpoints for each node. +- **Federated services controller** — watches Kubernetes services and endpoints locally and across all remote clusters defined through [RemoteClusterConfigurations](remoteclusterconfiguration.mdx), and programs Kubernetes endpoints for any locally-configured service that specifies a federation selector annotation. See [Configuring federated services](../../multicluster/federation/services-controller.mdx) for the usage guide. +- **Load balancer controller** — manages IPAM for Services of type `LoadBalancer`. ## Sample YAML @@ -64,6 +70,7 @@ spec: | ----------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------- | | node | Enable and configure the node controller | omit to disable, or [NodeController](#nodecontroller) | | federatedservices | Enable and configure the federated services controller | omit to disable, or [FederatedServicesController](#federatedservicescontroller) | +| loadbalancer | Enable and configure the load balancer controller | omit to disable, or [LoadBalancerController](#loadbalancercontroller) | ### NodeController @@ -100,7 +107,7 @@ The node controller automatically cleans up configuration for nodes that no long ### FederatedServicesController -The federated services controller syncs Kubernetes services from remote clusters defined through [RemoteClusterConfigurations](remoteclusterconfiguration.mdx). +The federated services controller syncs Kubernetes services from remote clusters defined through [RemoteClusterConfigurations](remoteclusterconfiguration.mdx). It must have read access to the Kubernetes API to monitor `Service` and `Endpoints` events, and write access to update `Endpoints`. For the usage guide, see [Configuring federated services](../../multicluster/federation/services-controller.mdx). | Field | Description | Schema | Default | | ---------------- | ---------------------------------------------------------------- | --------------------------------- | ------- | diff --git a/sidebars-calico-enterprise.js b/sidebars-calico-enterprise.js index 9dc3f911ad..5c9e7a3f73 100644 --- a/sidebars-calico-enterprise.js +++ b/sidebars-calico-enterprise.js @@ -829,7 +829,6 @@ module.exports = { label: 'Calico Enterprise Kubernetes controllers', link: { type: 'doc', id: 'reference/component-resources/kube-controllers/index' }, items: [ - 'reference/component-resources/kube-controllers/configuration', 'reference/component-resources/kube-controllers/prometheus', ], }, diff --git a/static/_redirects b/static/_redirects index f0c966faf5..029c2c0a0a 100644 --- a/static/_redirects +++ b/static/_redirects @@ -129,6 +129,8 @@ /calico-enterprise/latest/threat/suspicious-external-ips /calico-cloud/latest/threat 301 /calico-enterprise/3.19/threat/suspicious-external-ips /calico-cloud/3.19/threat 301 /calico-cloud/threat/suspicious-external-ips /calico-cloud/threat 301 +# kube-controllers configuration page collapsed into the resource page (DOCS-2914) +/calico-enterprise/latest/reference/component-resources/kube-controllers/configuration /calico-enterprise/latest/reference/resources/kubecontrollersconfig 301 # Redirect rules for old permalinks. @@ -205,7 +207,7 @@ /reference/host-endpoints/donottrack https://docs.tigera.io/calico-enterprise/latest/reference/host-endpoints 301 /reference/host-endpoints/tutorial https://docs.tigera.io/calico-enterprise/latest/reference/host-endpoints 301 /reference/kube-controllers/ https://docs.tigera.io/calico-enterprise/latest/reference/component-resources/kube-controllers/ 301 -/reference/kube-controllers/configuration https://docs.tigera.io/calico-enterprise/latest/reference/component-resources/kube-controllers/configuration 301 +/reference/kube-controllers/configuration https://docs.tigera.io/calico-enterprise/latest/reference/resources/kubecontrollersconfig 301 /reference/kube-controllers/prometheus https://docs.tigera.io/calico-enterprise/latest/reference/component-resources/kube-controllers/prometheus 301 /reference/legal/ https://docs.tigera.io/calico-enterprise/latest/reference/attribution 301 /reference/node/ https://docs.tigera.io/calico-enterprise/latest/reference/component-resources/node/ 301