Skip to main content
Version: Next

Configure your cluster

info

This recording presents the essence of this page. It's recommended to read it in full for the motivation and all details.

Loading asciinema cast...

Before you can create your cluster, you need to configure the identity and access management (IAM) for your cloud service provider (CSP) and choose machine types for the nodes.

Creating the configuration file​

You can generate a configuration file for your CSP by using the following CLI command:

constellation config generate aws

This creates the file constellation-conf.yaml in the current directory.

Choosing a VM type​

Constellation supports the following VM types:

By default, Constellation uses m6a.xlarge VMs (4 vCPUs, 16 GB RAM) to create your cluster. Optionally, you can switch to a different VM type by modifying instanceType in the configuration file. If you are using the default attestation variant awsSEVSNP, you can use the instance types described in AWS's AMD SEV-SNP docs. Please mind the region restrictions mentioned in the Getting started section.

If you are using the attestation variant awsNitroTPM, you can choose any of the nitroTPM-enabled instance types.

The Constellation CLI can also print the supported instance types with: constellation config instance-types.

Fill the desired VM type into the instanceType fields in the constellation-conf.yml file.

Creating additional node groups​

By default, Constellation creates the node groups control_plane_default and worker_default for control-plane nodes and workers, respectively. If you require additional control-plane or worker groups with different instance types, zone placements, or disk sizes, you can add additional node groups to the constellation-conf.yml file. Each node group can be scaled individually.

Consider the following example for AWS:

nodeGroups:
  control_plane_default:
    role: control-plane
    instanceType: c6a.xlarge
    stateDiskSizeGB: 30
    stateDiskType: gp3
    zone: eu-west-1c
    initialCount: 3
  worker_default:
    role: worker
    instanceType: c6a.xlarge
    stateDiskSizeGB: 30
    stateDiskType: gp3
    zone: eu-west-1c
    initialCount: 2
  high_cpu:
    role: worker
    instanceType: c6a.24xlarge
    stateDiskSizeGB: 128
    stateDiskType: gp3
    zone: eu-west-1c
    initialCount: 1

This configuration creates an additional node group high_cpu with a larger instance type and disk.

You can use the field zone to specify what availability zone nodes of the group are placed in. On Azure, this field is empty by default and nodes are automatically spread across availability zones. STACKIT currently offers SEV-enabled CPUs in the eu01-1, eu01-2, and eu01-3 zones. Consult the documentation of your cloud provider for more information:

Choosing a Kubernetes version​

To learn which Kubernetes versions can be installed with your current CLI, you can run constellation config kubernetes-versions. See also Constellation's Kubernetes support policy.

Creating an IAM configuration​

You can create an IAM configuration for your cluster automatically using the constellation iam create command. If you already have a Constellation configuration file, you can add the --update-config flag to the command. This writes the needed IAM fields into your configuration. Furthermore, the flag updates the zone/region of the configuration if it hasn't been set yet.

You must be authenticated with the AWS CLI in the shell session with a user that has the required permissions for IAM creation.

constellation iam create aws --zone=us-east-2a --prefix=constellTest

This command creates IAM configuration for the AWS zone us-east-2a using the prefix constellTest for all named resources being created.

Constellation OS images are currently replicated to the following regions:

  • eu-central-1
  • eu-west-1
  • eu-west-3
  • us-east-2
  • ap-south-1

If you require the OS image to be available in another region, let us know.

You can find a list of all regions in AWS's documentation.

Paste the output into the corresponding fields of the constellation-conf.yaml file.

Alternatively, you can manually create the IAM configuration on your CSP.

The following describes the configuration fields and how you obtain the required information or create the required resources.

  • region: The name of your chosen AWS data center region, e.g., us-east-2.

    Constellation OS images are currently replicated to the following regions:

    • eu-central-1
    • eu-west-1
    • eu-west-3
    • us-east-2
    • ap-south-1

    If you require the OS image to be available in another region, let us know.

    You can find a list of all regions in AWS's documentation.

  • zone: The name of your chosen AWS data center availability zone, e.g., us-east-2a.

    Learn more about availability zones in AWS's documentation.

  • iamProfileControlPlane: The name of an IAM instance profile attached to all control-plane nodes.

    You can create the resource with Terraform. For that, use the provided Terraform script to generate the necessary profile. The profile name will be provided as Terraform output value: control_plane_instance_profile_name.

    Alternatively, you can create the AWS profile with a tool of your choice. Use the JSON policy in main.tf in the resource aws_iam_policy.control_plane_policy.

  • iamProfileWorkerNodes: The name of an IAM instance profile attached to all worker nodes.

    You can create the resource with Terraform. For that, use the provided Terraform script to generate the necessary profile. The profile name will be provided as Terraform output value: worker_nodes_instance_profile_name.

    Alternatively, you can create the AWS profile with a tool of your choice. Use the JSON policy in main.tf in the resource aws_iam_policy.worker_node_policy.

Now that you've configured your CSP, you can create your cluster.

Deleting an IAM configuration​

You can keep a created IAM configuration and reuse it for new clusters. Alternatively, you can also delete it if you don't want to use it anymore.

Delete the IAM configuration by executing the following command in the same directory where you executed constellation iam create (the directory that contains constellation-iam-terraform as a subdirectory):

constellation iam destroy
caution

For Azure, deleting the IAM configuration by executing constellation iam destroy will delete the whole resource group created by constellation iam create. This also includes any additional resources in the resource group that weren't created by Constellation.