We are bringing the best of Tectonic to Red Hat OpenShift to build the most secure, hybrid Kubernetes application platform.
The Tectonic Installer creates bare-metal Tectonic clusters within networks with PXE infrastructure and the matchbox
service.
For more information about matchbox
, reference the matchbox
documentation.
Bare-metal Tectonic clusters are provisioned in a PXE network environment. Cluster nodes will PXE boot from the matchbox
service running on a provisioner node. Familiarity with your network topology is required.
Tectonic bare metal clusters store credentials in user-data
, and etcd peer to peer communication is not currently encrypted with TLS. To restrict access to sensitive information, provision bare metal machines within a trusted network and ensure that a firewall exists between cluster controllers and the public internet.
Ensure DHCP, TFTP and DNS services are available on your network. CoreOS provides a dnsmasq container, if you wish to use rkt or Docker for this.
Familiarize yourself with PXE booting. Cluster nodes should PXE boot from the network and delegate to the matchbox
service which serves configs to provision clusters. At a high level, you will need to:
matchbox
iPXE HTTP endpoint (e.g. http://matchbox.example.com:8080/boot.ipxe
)The installer will prompt for "Controller" and "Tectonic" DNS names. For the controller DNS name, add a record which resolves to the node you plan to use as a controller.
By default, Tectonic Ingress runs as a [Kubernetes Daemon Set][daemonset] across workers. For the Tectonic DNS name, add a record which resolves to any node(s) you plan to use as workers.
matchbox.example.com
)k8s.example.com
)tectonic.example.com
)node3.example.com
)Cluster nodes will need to be able to pull docker images from quay.io and gcr.io. Be sure to whitelist these domains.
A minimum of 3 machines are required to run Tectonic.
Tectonic clusters consist of two types of nodes:
etcd
and the control plane of the cluster.Each node should meet the following tech-specs.
Requirement | Value |
---|---|
RAM | 8GB / node |
CPU | 2 cores / node |
Storage | 30GB / node |
Configure cluster nodes to favor booting from disk, and use IPMI to request a PXE boot during installation and re-provisioning. Booting from disk allows Container Linux automatic updates to function normally and is the recommended configuration after provisioning.
Sites where cluster nodes always boot from PXE must plan to regularly update the Container Linux image served to clients.
Client machines:
A provisioner node (or Kubernetes cluster) runs the matchbox
network boot and provisioning service, along with PXE services if you don't already run them elsewhere. You may use CoreOS or any Linux distribution for this node. It serves provisioning configs to nodes, but does not join Tectonic clusters.
The provisioner must:
matchbox
matchbox.example.com
)The Tectonic Installer app runs on a user's laptop as a GUI for creating new clusters and pushing the right configs to matchbox
.
User machines:
matchbox.example.com
)node3.example.com
)tectonic.com