1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([[1283],{3905:(e,t,n)=>{n.d(t,{Zo:()=>u,kt:()=>d});var r=n(67294);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function l(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?o(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):o(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var s=r.createContext({}),c=function(e){var t=r.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},u=function(e){var t=c(e.components);return r.createElement(s.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,s=e.parentName,u=i(e,["components","mdxType","originalType","parentName"]),m=c(n),d=a,k=m["".concat(s,".").concat(d)]||m[d]||p[d]||o;return n?r.createElement(k,l(l({ref:t},u),{},{components:n})):r.createElement(k,l({ref:t},u))}));function d(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,l=new Array(o);l[0]=m;var i={};for(var s in t)hasOwnProperty.call(t,s)&&(i[s]=t[s]);i.originalType=e,i.mdxType="string"==typeof e?e:a,l[1]=i;for(var c=2;c<o;c++)l[c]=n[c];return r.createElement.apply(null,l)}return r.createElement.apply(null,n)}m.displayName="MDXCreateElement"},41015:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>s,contentTitle:()=>l,default:()=>p,frontMatter:()=>o,metadata:()=>i,toc:()=>c});var r=n(87462),a=(n(67294),n(3905));const o={description:"Configure a local cluster to pull endpoint data from a remote cluster."},l="Configure federated endpoint identity",i={unversionedId:"multicluster/federation/kubeconfig",id:"version-3.16/multicluster/federation/kubeconfig",title:"Configure federated endpoint identity",description:"Configure a local cluster to pull endpoint data from a remote cluster.",source:"@site/calico-enterprise_versioned_docs/version-3.16/multicluster/federation/kubeconfig.mdx",sourceDirName:"multicluster/federation",slug:"/multicluster/federation/kubeconfig",permalink:"/calico-enterprise/3.16/multicluster/federation/kubeconfig",draft:!1,editUrl:"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.16/multicluster/federation/kubeconfig.mdx",tags:[],version:"3.16",frontMatter:{description:"Configure a local cluster to pull endpoint data from a remote cluster."},sidebar:"calicoEnterpriseSidebar",previous:{title:"Overview",permalink:"/calico-enterprise/3.16/multicluster/federation/overview"},next:{title:"Configure federated services",permalink:"/calico-enterprise/3.16/multicluster/federation/services-controller"}},s={},c=[{value:"Big picture",id:"big-picture",level:2},{value:"Value",id:"value",level:2},{value:"Concepts",id:"concepts",level:2},{value:"Local and remote clusters",id:"local-and-remote-clusters",level:3},{value:"Configure access to remote clusters",id:"configure-access-to-remote-clusters",level:3},{value:"Before you begin",id:"before-you-begin",level:2},{value:"How to",id:"how-to",level:2},{value:"Create kubeconfig files",id:"create-kubeconfig-files",level:3},{value:"Create secrets",id:"create-secrets",level:3},{value:"Create access to secrets for clusters",id:"create-access-to-secrets-for-clusters",level:3},{value:"Add remote cluster configurations",id:"add-remote-cluster-configurations",level:3},{value:"Configure IP pool resources",id:"configure-ip-pool-resources",level:3},{value:"Use policy to reference pods on a remote cluster",id:"use-policy-to-reference-pods-on-a-remote-cluster",level:3}
1,{value:"Troubleshoot remote clusters",id:"troubleshoot-remote-clusters",level:3},{value:"Next steps",id:"next-steps",level:2}],u={toc:c};function p(e){let{components:t,...n}=e;return(0,a.kt)("wrapper",(0,r.Z)({},u,n,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("h1",{id:"configure-federated-endpoint-identity"},"Configure federated endpoint identity"),(0,a.kt)("h2",{id:"big-picture"},"Big picture"),(0,a.kt)("p",null,"Configure a local cluster to pull endpoint data from a remote cluster."),(0,a.kt)("h2",{id:"value"},"Value"),(0,a.kt)("p",null,"Federating endpoints allows teams to write policies in a local cluster that references/selects endpoints in remote clusters. This expands efficiency and self-service."),(0,a.kt)("h2",{id:"concepts"},"Concepts"),(0,a.kt)("h3",{id:"local-and-remote-clusters"},"Local and remote clusters"),(0,a.kt)("p",null,"Each cluster in the federation acts as both a local and remote cluster."),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Local clusters retrieve endpoint data from remote clusters"),(0,a.kt)("li",{parentName:"ul"},"Remote clusters allow local clusters to retrieve endpoint data")),(0,a.kt)("h3",{id:"configure-access-to-remote-clusters"},"Configure access to remote clusters"),(0,a.kt)("p",null,"To allow a local cluster to access resources on a remote cluster, you create a ",(0,a.kt)("strong",{parentName:"p"},"RemoteClusterConfiguration"),". This configuration contains the information required for the local cluster to establish connection to the remote cluster. The connection in a remote cluster configuration is one-way: information flows only from the remote cluster to the local cluster. If you want to share information from a local cluster to a remote cluster, you must create a remote cluster configuration resource on the remote cluster."),(0,a.kt)("p",null,"In the following example, we federate three clusters with each other: ",(0,a.kt)("inlineCode",{parentName:"p"},"cluster-a"),", ",(0,a.kt)("inlineCode",{parentName:"p"},"cluster-b"),", and ",(0,a.kt)("inlineCode",{parentName:"p"},"cluster-c"),":"),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("p",{parentName:"li"},(0,a.kt)("strong",{parentName:"p"},"cluster a")),(0,a.kt)("p",{parentName:"li"},"Create two RemoteClusterConfiguration resources: 1 for cluster-b, 1 for cluster-c")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("p",{parentName:"li"},(0,a.kt)("strong",{parentName:"p"},"cluster b")),(0,a.kt)("p",{parentName:"li"},"Create two RemoteClusterConfiguration resources: 1 for cluster-a, 1 for cluster-c")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("p",{parentName:"li"},(0,a.kt)("strong",{parentName:"p"},"cluster c")),(0,a.kt)("p",{parentName:"li"},"Create two RemoteClusterConfiguration resources: 1 for cluster-a, 1 for cluster-b"))),(0,a.kt)("admonition",{type:"note"},(0,a.kt)("p",{parentName:"admonition"},"Although this example applies remote cluster configurations symmetrically across clusters, this is not required; add RemoteClusterConfiguration resources only where needed.")),(0,a.kt)("h2",{id:"before-you-begin"},"Before you begin"),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Supported networking")),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Calico Enterprise with BGP"),(0,a.kt)("li",{parentName:"ul"},"AKS/Azure, EKS/AWS, and GKE with VPC")),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Required")),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"/calico-enterprise/3.16/getting-started/install-on-clusters/kubernetes/"},"Install Calico Enterprise")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"/calico-enterprise/3.16/operations/clis/calicoq/installing"},"Install and configure calicoq"))),(0,a.kt)("h2",{id:"how-to"},"How to"),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#create-kubeconfig-files"},"Create kubeconfig files")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#create-secrets"},"Create secrets")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#create-access-to-secrets-for-clusters"}
1,"Create access to secrets for clusters")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#add-remote-cluster-configurations"},"Add remote cluster configurations")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#configure-ip-pool-resources"},"Configure IP pool resources")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#use-policy-to-reference-pods-on-a-remote-cluster"},"Use policy to reference pods on a remote cluster")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("a",{parentName:"li",href:"#troubleshoot-remote-clusters"},"Troubleshoot remote clusters"))),(0,a.kt)("h3",{id:"create-kubeconfig-files"},"Create kubeconfig files"),(0,a.kt)("p",null,"For each cluster in the federation, we will create a kubeconfig. This kubeconfig will be used by other clusters in the federation to establish remote cluster connections to the cluster specified in the kubeconfig. To create the required kubeconfigs, follow these steps for each cluster in the federation."),(0,a.kt)("ol",null,(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Access the cluster using a ",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig")," with administrative privileges.")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"If RBAC is enabled, apply this manifest."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl apply -f \\\nhttps://downloads.tigera.io/ee/v3.16.5/manifests/federation-rem-rbac-kdd.yaml\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Apply the following manifest to create a service account called ",(0,a.kt)("inlineCode",{parentName:"p"},"tigera-federation-remote-cluster"),"."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl apply -f \\\nhttps://downloads.tigera.io/ee/v3.16.5/manifests/federation-remote-sa.yaml\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Create a secret for service Account manually."),(0,a.kt)("admonition",{parentName:"li",type:"note"},(0,a.kt)("p",{parentName:"admonition"},"This step is needed if your k8s version is 1.24 or above. From K8s 1.24, K8s won\u2019t generate Secrets automatically for ServiceAccounts and need be created manually.")),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},'kubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\ntype: kubernetes.io/service-account-token\nmetadata:\n name: tigera-federation-remote-cluster\n namespace: kube-system\n annotations:\n kubernetes.io/service-account.name: "tigera-federation-remote-cluster"\nEOF\n')),(0,a.kt)("p",{parentName:"li"},"Use the following command to retrieve the token of the service account."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl describe secret tigera-federation-remote-cluster -n kube-system\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Use the following command to retrieve the name of the secret containing the token associated\nwith the ",(0,a.kt)("inlineCode",{parentName:"p"},"tigera-federation-remote-cluster")," service account."),(0,a.kt)("admonition",{parentName:"li",type:"note"},(0,a.kt)("p",{parentName:"admonition"},"This step is applicable only if your k8s version is less than 1.24.")),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl describe serviceaccounts tigera-federation-remote-cluster -n kube-system\n")),(0,a.kt)("p",{parentName:"li"},"It should return something like the following."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},'Name: tigera-federation-remote-cluster\nNamespace: kube-system\nLabels: <none>\nAnnotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"remote-cluster","namespace":"kube-system"}}\n\nImage pull secrets: <none>\nMountable secrets: tigera-federation-remote-cluster-token-wzdgp\nTokens: tigera-federation-remote-cluster-wzdgp\nEvents: <none>\n')),(0,a.kt)("p",{parentName:"li"},"The value of ",(0,a.kt)("inlineCode",{parentName:"p"}
1,"Tokens")," is the name of the secret containing the service account's token."),(0,a.kt)("p",{parentName:"li"},"Use the following command to retrieve the token of the service account."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl describe secrets tigera-federation-remote-cluster-token-wzdgp -n kube-system\n")),(0,a.kt)("p",{parentName:"li"},"It should return something like the following."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"Name: tigera-federation-remote-cluster-token-wzdgp\nNamespace: kube-system\nLabels: <none>\nAnnotations: kubernetes.io/service-account.name=tigera-federation-remote-cluster\n kubernetes.io/service-account.uid=b3044d23-96b5-11e8-ac9b-42010a80000e\n\nType: kubernetes.io/service-account-token\n\nData\n====\nca.crt: 1025 bytes\nnamespace: 11 bytes\ntoken: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJyZW1vdGUtY2x1c3Rlci10b2tlbi13emRncCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJyZW1vdGUtY2x1c3RlciIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImIzMDQ0ZDIzLTk2YjUtMTFlOC1hYzliLTQyMDEwYTgwMDAwZSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTpyZW1vdGUtY2x1c3RlciJ9.h8ngEwzjzHLMnaRANiXoqrSAWGxycVqq7cO54RM56qyyy_KlAbLpjbhHiaQBNAqJ_LTvjSZ23r2vZn-ZUbTDcoHninD4N2GXKygyVxoBeBzBJinbHWTPp6BYnLvM1pifnj5QNrQanqb0Nwy_p9T1CBMr7NmTsJ5HvRHASCMImjLToCC251kL5oIVM6MWdty_dKGvCzO1rUQhCqcwQyq4Bg6cTFNCLejFpgH0p7XdVcqSsd2uYUpPeS85q5paEKza630Dxg8jdwa5VhYAb_LZfklPOVwHAgNx9OT-z_ZRLYfWoBVlkgazXiiEz9kDweK8hESGLQdW7996C0vdeVx21A\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Save the ",(0,a.kt)("inlineCode",{parentName:"p"},"token")," value for later steps.")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Use the following command to retrieve the certificate authority and server data."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl config view --flatten --minify\n")),(0,a.kt)("p",{parentName:"li"},"It should return something like the following."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"apiVersion: v1\nclusters:\n- cluster:\n certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRFNE1EY3lOVEUyTURjek4xb1hEVEk0TURjeU1qRTJNRGN6TjFvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTU9FCjc1ZWtxbmdMdjZKZW9IaGhFLy9iVU0rdnNRMyt3cUZ1eHp5NDlReFk1cmtZaGJ4WWt1TFl0c3ZBVTgycjVnNlYKbUVwbDRlOHJMQjRnTnFpRnVDcVplcmMwWWxqZDVQNllKcW5PN3A1b1J3SG5BWXA3dnZwczJRZjFTemNsTVNjSAo3Qk9XbkF4aEFFZTUzKytPSkhaVmZzL2tlTWtlK3F4b01IZ0R1eGxUb2xXU2dDV0YvbCt3eFk3ZTcyNmozYWZnClRXL0lxSk9GNTN6YTVHR05MMGRIQndFR0gzSU5CVllXa1V5TjEycXZJYlh3RzJReElCU1hEbTcvV1dvNUphMHkKeVNSWkx4L3FZSHBld1hsOU5Od3ZYaXNOZ2xvVVVsZFJ4OGtSWmJOdmViZkpad2FqQVBlRytNRkYwYVJVNHF0Zgo5NVYzdHZ5RHYxaHNJdytGQiswQ0F3RUFBYU1qTUNFd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFaFJBNmEzUUNBRGVGalNOeFM1Qi9NZVo4dTIKenNvV2F0c21pdm81YUREUUIwUnRUUWFLTUEwU2ZlaGNLd3ZUdTJjVW5CaVJHZlZMSnJ3REwvUzUvRHBhemdBbgozVlZuWERlbGRzcjVKa3dpTElhQUZCSzg5K3BaLzVybXpuZmZpMldKS0JvY2t3N015REplb05FdklkSjVtb2t0ClMxL0pKYlcvbExZU054RjYxOXJxOE9LVVZ2YStwTmczZ2JEbGlFSUZNUmpobWdtU01tUEthRnMvaE1GcDlzdVMKV3VDd1czY2lQVXlUZXV6bnRYbzY5K3NpUGYyLzFxYUFmRWtmSHp3NS9QeG8xM1dOWnEzSzI0dDNoNXh1QjFvRwpwaXRDbEZPSGFLSnNLZ0g1UkFOSWt3dkNIOXgySG9oTzR2M3ZoOXd1KzlOMEt1K3FLVWJIODRENkVpMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n server: https://10.128.0.14:6443\n name: kubernetes\ncontexts:\n- context:\n cluster: kubernetes\n user: kubernetes-admin\n name: kubernetes-admin@kubernetes\ncurrent-context: kubernetes-admin@kubernetes\nkind: Config\npreferences: {}\nusers:\n- name: kubernetes-admin\n user:\n client-certificate-d
1ata: ...\n client-key-data: ...\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Save the ",(0,a.kt)("inlineCode",{parentName:"p"},"certificate-authority-data")," and the ",(0,a.kt)("inlineCode",{parentName:"p"},"server")," values for the next step.")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Open a new file in your favorite editor."),(0,a.kt)("admonition",{parentName:"li",type:"tip"},(0,a.kt)("p",{parentName:"admonition"},"We recommend coming up with a naming scheme for your clusters that makes sense for your\nspecific use case. For example, if you have four remote clusters that are similar except that they\nare serving web pages in different languages, you can name the files ",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig-rem-cluster-en"),",\n",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig-rem-cluster-es"),", ",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig-rem-cluster-ja"),", and ",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig-rem-cluster-sw"),". This will\nmake the installation procedure easier to follow."))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Paste the following into your new file."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-yaml"},"apiVersion: v1\nkind: Config\nusers:\n - name: tigera-federation-remote-cluster\n user:\n token: <YOUR-SERVICE-ACCOUNT-TOKEN>\nclusters:\n - name: tigera-federation-remote-cluster\n cluster:\n certificate-authority-data: <YOUR-CERTIFICATE-AUTHORITY-DATA>\n server: <YOUR-SERVER-ADDRESS>\ncontexts:\n - name: tigera-federation-remote-cluster-ctx\n context:\n cluster: tigera-federation-remote-cluster\n user: tigera-federation-remote-cluster\ncurrent-context: tigera-federation-remote-cluster-ctx\n"))),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Replace ",(0,a.kt)("inlineCode",{parentName:"p"},"<YOUR-SERVICE-ACCOUNT-TOKEN>"),", ",(0,a.kt)("inlineCode",{parentName:"p"},"<YOUR-CERTIFICATE-AUTHORITY-DATA>"),",\nand ",(0,a.kt)("inlineCode",{parentName:"p"},"<YOUR-SERVER-ADDRESS>")," with the values obtained in the previous steps.")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("p",{parentName:"li"},"Verify that the ",(0,a.kt)("inlineCode",{parentName:"p"},"kubeconfig")," file works by issuing the following command."),(0,a.kt)("pre",{parentName:"li"},(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl --kubeconfig=kubeconfig-rem-cluster-n get services\n")),(0,a.kt)("p",{parentName:"li"},"You should see your cluster listed."))),(0,a.kt)("h3",{id:"create-secrets"},"Create secrets"),(0,a.kt)("p",null,"We'll now create secrets in each local cluster that contain the created kubeconfig for a given remote cluster that we wish to connect to. The simplest method to create a secret for a remote cluster is to use the ",(0,a.kt)("inlineCode",{parentName:"p"},"kubectl")," command because it correctly encodes the data and formats the file."),(0,a.kt)("p",null,"Within a local cluster, create a secret for a remote cluster with a command like the following."),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl create secret generic remote-cluster-secret-name -n <namespace> \\\n --from-literal=datastoreType=kubernetes \\\n --from-file=kubeconfig=<kubeconfig file>\n")),(0,a.kt)("p",null,"Additional arguments:"),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("inlineCode",{parentName:"li"},"--from-literal=<key>=<value>")," to add literal values"),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("inlineCode",{parentName:"li"},"--from-file=<key>=<file>")," to add values with file contents")),(0,a.kt)("h3",{id:"create-access-to-secrets-for-clusters"},"Create access to secrets for clusters"),(0,a.kt)("p",null,"Calico Enterprise does not generally have access to all secrets in a cluster so it is necessary to create a Role and RoleBinding for each namespace where the secrets for RemoteClusterConfigurations are created. You can reduce the number of Role and RoleBindings needed by putting the remote cluster Secrets in a dedicated namespace."),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-bash"},'kubectl create -f - <<EOF\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: remote-cluster-secret-access\n namespace: <namespace>\nrules:\n- apiGroups: [""]\n resources: ["secrets"]\n verbs: ["watch", "list", "get"]\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: remote-cluster-secret-access\n namespace: <namespace>\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: remote-cluster-secret-access\nsubjects:\n- kind: ServiceAccount\n name: calico-typha\n namespace: calico-system\nEOF\n')),(0,a.kt)("h3",{id:"add-remote-cluster-configurations"},"Add remote cluster configurations"),(0,a.kt)("p",null,"Add remote cluster configuration where needed. Each instance of the ",(0,a.kt)("a",{parentName:"p",href:"/calico-enterprise/3.16/reference/resources/remoteclusterconfiguration"},"Remote Cluster Configuration"),"\nresource represents a single remote cluster from which the local cluster can retrieve endpoint information. We reference the kubeconfig secret
1created above to specify how to connect to this remote cluster."),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-yaml"},"apiVersion: projectcalico.org/v3\nkind: RemoteClusterConfiguration\nmetadata:\n name: cluster-n\nspec:\n clusterAccessSecret:\n name: remote-cluster-secret-name\n namespace: <namespace>\n kind: Secret\n")),(0,a.kt)("h3",{id:"configure-ip-pool-resources"},"Configure IP pool resources"),(0,a.kt)("p",null,"For local clusters with ",(0,a.kt)("inlineCode",{parentName:"p"},"NATOutgoing")," configured on your IP pools, verify the following:"),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Configure additional IP pools to cover the IP ranges of your remote clusters. This ensures that outgoing NAT is not performed on packets bound for the remote clusters."),(0,a.kt)("li",{parentName:"ul"},"On the new IP pools, ensure that ",(0,a.kt)("inlineCode",{parentName:"li"},"disabled")," is set to ",(0,a.kt)("inlineCode",{parentName:"li"},"true")," to ensure the pools are not used for IP assignment on the local cluster."),(0,a.kt)("li",{parentName:"ul"},"Verify that the IP pool CIDR used for pod IP allocation does not overlap with any of the IP ranges used by the pods and nodes of any other federated cluster.")),(0,a.kt)("p",null,"For example, you can configure the following on your local cluster, referring to the ",(0,a.kt)("inlineCode",{parentName:"p"},"IPPool")," on a remote cluster:"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-yaml"},"apiVersion: projectcalico.org/v3\nkind: IPPool\nmetadata:\n name: cluster1-main-pool\nspec:\n cidr: 192.168.0.0/18\n disabled: true\n")),(0,a.kt)("p",null,"Congratulations! You have completed configuration of federated endpoint identity."),(0,a.kt)("h3",{id:"use-policy-to-reference-pods-on-a-remote-cluster"},"Use policy to reference pods on a remote cluster"),(0,a.kt)("p",null,"For federated clusters, use labels to reference pods on a remote cluster in the local policy rules, rather than referencing them by IP address. The main policy selector still refers only to local endpoints; and that selector chooses which local endpoints to apply the policy."),(0,a.kt)("p",null,"For policy rule selectors on the local cluster to correctly reference endpoints across all of the clusters, you must align the following between clusters."),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Namespace names"),(0,a.kt)("li",{parentName:"ul"},"Host endpoint label names and values"),(0,a.kt)("li",{parentName:"ul"},"Pod label names and values within the namespace"),(0,a.kt)("li",{parentName:"ul"},"Service accounts (if you configure Calico Enterprise federated services)")),(0,a.kt)("h3",{id:"troubleshoot-remote-clusters"},"Troubleshoot remote clusters"),(0,a.kt)("p",null,"To verify that remote clusters are accessible, use the following command."),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-bash"},'$ calicoq eval "all()"\n')),(0,a.kt)("p",null,"If all remote clusters are accessible, ",(0,a.kt)("inlineCode",{parentName:"p"},"calicoq")," returns something like the following. In this example, the ",(0,a.kt)("inlineCode",{parentName:"p"},"remote-cluster-1")," prefix indicates the remote cluster endpoints (as configured in the RemoteClusterConfiguration resource)."),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre"},"Endpoints matching selector all():\n Workload endpoint remote-cluster-1/host-1/k8s/kube-system.kube-dns-5fbcb4d67b-h6686/eth0\n Workload endpoint remote-cluster-1/host-2/k8s/kube-system.cnx-manager-66c4dbc5b7-6d9xv/eth0\n Workload endpoint host-a/k8s/kube-system.kube-dns-5fbcb4d67b-7wbhv/eth0\n Workload endpoint host-b/k8s/kube-system.cnx-manager-66c4dbc5b7-6ghsm/eth0\n")),(0,a.kt)("p",null,"If a remote cluster is inaccessible, (network failure or a misconfiguration), the ",(0,a.kt)("inlineCode",{parentName:"p"},"calicoq")," output includes details about the error."),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Example"),": Remote-cluster-secret is not accessible"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre"},'E0615 12:24:04.895079 30873 reflector.go:153] github.com/projectcalico/libcalico-go/lib/backend/syncersv1/remotecluster/secret_watcher.go:111: Failed to list *v1.Secret: secrets "remote-cluster-secret" is forbidden: User "system:serviceaccount:policy-demo:limited-sa" cannot list resource "secrets" in API group "" in the namespace "remote-cluster-ns"\nEndpoints matching selector all():\n Workload endpoint host-a/k8s/kube-system.kube-dns-5fbcb4d67b-7wbhv/eth0\n Workload endpoint host-b/k8s/kube-system.cnx-manager-66c4dbc5b7-6ghsm/eth0\n')),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Example"),": Incorrect connection information in the Remote Cluster Configuration"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre"},"Endpoints matching selector all():\n Workload endpoint host-a/k8s/kube-system.kube-dns-5fbcb4d67b-7wbhv/eth0\n Workload endpoint host-b/k8s/kube-system.cnx-manager-66c4dbc5b7-6ghsm/eth0\nThe following problems were encountered connecting to the remote cluster
1s\nwhich may have resulted in incomplete data:\n- RemoteClusterConfiguration(remote-cluster-1): connection to remote cluster failed: Get https://192.168.0.55:6443/api/v1/pods: dial tcp 192.168.0.55:6443: i/o timeout\n")),(0,a.kt)("h2",{id:"next-steps"},"Next steps"),(0,a.kt)("p",null,(0,a.kt)("a",{parentName:"p",href:"/calico-enterprise/3.16/multicluster/federation/services-controller"},"Configure federated services")))}p.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.