Chapter 1. Add-ons overview
Red Hat Advanced Cluster Management for Kubernetes add-ons can improve some areas of performance and add functionality to enhance your applications. The following sections provide a summary of the add-ons that are available for Red Hat Advanced Cluster Management:
1.1. Enabling klusterlet add-ons on clusters for cluster management
After you install Red Hat Advanced Cluster Management for Kubernetes and then create or import clusters with multicluster engine operator you can enable the klusterlet add-ons for those managed clusters. The klusterlet add-ons are not enabled by default if you created or imported clusters unless you create or import with the Red Hat Advanced Cluster Management console. See the following available klusterlet add-ons:
- application-manager
- cert-policy-controller
- config-policy-controller
- iam-policy-controller
- governance-policy-framework
- search-collector
Complete the following steps to enable the klusterlet add-ons for the managed clusters after Red Hat Advanced Cluster Management is installed:
Create a YAML file that is similar to the following
KlusterletAddonConfig
, with thespec
value that represents the add-ons:apiVersion: agent.open-cluster-management.io/v1 kind: KlusterletAddonConfig metadata: name: <cluster_name> namespace: <cluster_name> spec: applicationManager: enabled: true certPolicyController: enabled: true iamPolicyController: enabled: true policyController: 1 enabled: true searchCollector: enabled: true
- 1
- The
policy-controller
add-on is divided into two add-ons: Thegovernance-policy-framework
and theconfig-policy-controller
. As a result, thepolicyController
controls thegovernance-policy-framework
and theconfig-policy-controller
managedClusterAddons
.
-
Save the file as
klusterlet-addon-config.yaml
. Apply the YAML by running the following command on the hub cluster:
oc apply -f klusterlet-addon-config.yaml
To verify whether the enabled
managedClusterAddons
are created after theKlusterletAddonConfig
is created, run the following command:oc get managedclusteraddons -n <cluster namespace>
1.2. Configuring nodeSelectors and tolerations for klusterlet add-ons
In Red Hat Advanced Cluster Management, you can configure nodeSelector and tolerations for the following klusterlet add-ons:
- application-manager
- cert-policy-controller
- cluster-proxy
- config-policy-controller
- governance-policy-framework
- hypershift-addon
- iam-policy-controller
- managed-serviceaccount
- observability-controller
- search-collector
- submariner
- volsync
- work-manager
Complete the following steps:
-
Use the
AddonDeploymentConfig
API to create a configuration to specify thenodeSelector
andtolerations
in the namespace that you used for your Red Hat Advanced Cluster Management installation. Create a file named
addondeploymentconfig.yaml
that is based on the following template:apiVersion: addon.open-cluster-management.io/v1alpha1 kind: AddOnDeploymentConfig metadata: name: config-name 1 namespace: config-name-space 2 spec: nodePlacement: nodeSelector: node-selector 3 tolerations: tolerations 4
A completed
AddOnDeployment
file might resemble the following example:apiVersion: addon.open-cluster-management.io/v1alpha1 kind: AddOnDeploymentConfig metadata: name: deploy-config namespace: open-cluster-management-hub spec: nodePlacement: nodeSelector: "node-dedicated": "acm-addon" tolerations: - effect: NoSchedule key: node-dedicated value: acm-addon operator: Equal
Run the following command to apply the file that you created:
oc apply -f addondeploymentconfig
Use the configuration that you created as the global default configuration for your add-on by running the following command:
oc patch clustermanagementaddons <addon-name> --type='json' -p='[{"op":"add", "path":"/spec/supportedConfigs", "value":[{"group":"addon.open-cluster-management.io","resource":"addondeploymentconfigs", "defaultConfig":{"name":"deploy-config","namespace":"open-cluster-management-hub"}}]}]'
-
Replace
addon-name
with your add-on name. -
Replace
config-name
with the name of theAddonDeploymentConfig
that you just created. -
Replace
config-namespace
with the namespace of theAddonDeploymentConfig
that you just created.
-
Replace
The nodeSelector
and tolerations
that you specified are applied to all of your add-on on each of the managed clusters.
You can also override the global default AddonDeploymentConfig
configuration for your add-on on a certain managed cluster by using following steps:
-
Use the
AddonDeploymentConfig
API to create another configuration to specify thenodeSelector
andtolerations
on the hub cluster. Link the new configuration that you created to your add-on
ManagedClusterAddon
on a managed cluster.oc -n <managed-cluster> patch managedclusteraddons <addon-name> --type='json' -p='[{"op":"add", "path":"/spec/configs", "value":[ {"group":"addon.open-cluster-management.io","resource":"addondeploymentconfigs","namespace":"<config-namespace>","name":"<config-name>"} ]}]'
-
Replace
managed-cluster
with your managed cluster name -
Replace
addon-name
with your add-on name -
Replace
config-namespace
with the namespace of theAddonDeploymentConfig
that you just created -
Replace
config-name
with the name of theAddonDeploymentConfig
that you just created
-
Replace
The new configuration that you referenced in the add-on ManagedClusterAddon
overrides the global default configuration that you previously defined in the ClusterManagementAddon
add-on.
1.3. Enabling cluster-wide proxy on existing cluster add-ons
You can configure the KlusterletAddonConfig
in the cluster namespace to add the proxy environment variables to all the klusterlet add-on pods of the managed Red Hat OpenShift Container Platform clusters. Complete the following steps to configure the KlusterletAddonConfig
to add the three environment variables to the pods of the klusterlet add-ons:
Edit the
KlusterletAddonConfig
file that is in the namespace of the cluster that needs the proxy. You can use the console to find the resource, or you can edit from the terminal with the following command:oc -n <my-cluster-name> edit klusterletaddonconfig <my-cluster-name>
Note: If you are working with only one cluster, you do not need
<my-cluster-name>
at the end of your command. See the following command:oc -n <my-cluster-name> edit klusterletaddonconfig
Edit the
.spec.proxyConfig
section of the file so it resembles the following example. Thespec.proxyConfig
is an optional section:spec proxyConfig: httpProxy: "<proxy_not_secure>" 1 httpsProxy: "<proxy_secure>" 2 noProxy: "<no_proxy>" 3
- 1
- Replace
proxy_not_secure
with the address of the proxy server forhttp
requests. For example, usehttp://192.168.123.145:3128
. - 2
- Replace
proxy_secure
with the address of the proxy server forhttps
requests. For example, usehttps://192.168.123.145:3128
. - 3
- Replace
no_proxy
with a comma delimited list of IP addresses, hostnames, and domain names where traffic is not routed through the proxy. For example, use.cluster.local,.svc,10.128.0.0/14,example.com
.
If the OpenShift Container Platform cluster is created with cluster wide proxy configured on the hub cluster, the cluster wide proxy configuration values are added to the pods of the klusterlet add-ons as environment variables when the following conditions are met:
-
The
.spec.policyController.proxyPolicy
in theaddon
section is enabled and set toOCPGlobalProxy
. The
.spec.applicationManager.proxyPolocy
is enabled and set toCustomProxy
.Note: The default value of
proxyPolicy
in theaddon
section isDisabled
.See the following examples of
proxyPolicy
entries:apiVersion: agent.open-cluster-management.io/v1 kind: KlusterletAddonConfig metadata: name: clusterName namespace: clusterName spec: proxyConfig: httpProxy: http://pxuser:12345@10.0.81.15:3128 httpsProxy: http://pxuser:12345@10.0.81.15:3128 noProxy: .cluster.local,.svc,10.128.0.0/14, example.com applicationManager: enabled: true proxyPolicy: CustomProxy policyController: enabled: true proxyPolicy: OCPGlobalProxy searchCollector: enabled: true proxyPolicy: Disabled certPolicyController: enabled: true proxyPolicy: Disabled iamPolicyController: enabled: true proxyPolicy: Disabled
Important: Global proxy settings do not impact alert forwarding. To set up alert forwarding for Red Hat Advanced Cluster Management hub clusters with a cluster-wide proxy, see Forwarding alerts for more details.