Cluster configuration in a YAML manifest

Common steps to configure the permanent cluster:

  1. Get a YAML manifest template by running ./shtil-2.13.1 install INFRASTRUCTURE-PROVIDER-TYPE example. The template includes infrastructure provider and management cluster configuration.
  2. Fill in the template with your data and save it as a YAML file.
  3. Run the cluster creation command with the YAML manifest installation flag: ./shtil-2.13.1 install INFRASTRUCTURE-PROVIDER-TYPE --yaml-path=PATH-TO-YAML-MANIFEST

You can install the permanent management cluster with the provider:

Installing a cluster with the Shturval v2 provider

Command to request the manifest template:

./shtil-2.13.1 install shturvalv2 example
YAML manifest template

---
# YAML manifest template for platform installation with the Shturval v2 provider

type: CapsmProviderConfig

name: cluster-management-provider       # [OPTIONAL] Provider instance name. Default: cluster-management-provider

# [REQUIRED] Shared credentials for SSH connections to hosts

credentials:
  SSH:
    privateKey:                         # [REQUIRED] Path to the user private key for SSH connections
    userName:                           # [REQUIRED] Username for SSH connections to the specified hosts

# Host list for cluster nodes

hosts:
  - address:                            # [REQUIRED] Host IP address or FQDN (for example, 11.12.13.14)
    labelsSelector:                     # [REQUIRED] Selector must include a host role label with key `role`. Recommended host roles: controlplane, worker, infra, ingress, other
      role: controlplane
    credentials: null                   # A null value means shared SSH credentials are used for the host
#     SSH:                              # [OPTIONAL] Override shared SSH credentials for the host. When overriding, remove null from the credentials field
#       userName: admin
#       privateKey: c2RzZHNk

#ingressCerts:                         # Cluster certificate. By default the cluster is installed with a self-signed certificate. Only one certificate subtype can be selected
#  ca:
#    crtPath:                          # [OPTIONAL] Path to the certificate chain (your intermediate certificate -> corporate CA certificate) in PEM format. Must be set together with `ca.keyPath`
#    keyPath:                          # [OPTIONAL] Path to the intermediate CA private key. Must be set together with `ca.crtPath`
#  tls:
#    crtPath:                          # [OPTIONAL] Path to the corporate certificate (PEM file) issued by the CA (in this case the file contains the certificate chain) or self-signed for the Ingress domain name. Must be set together with `tls.keyPath`
#    keyPath:                          # [OPTIONAL] Path to the Ingress corporate certificate private key. Must be set together with `tls.crtPath`
#  acme:
#    rootPath: </some/path>            # [OPTIONAL] Path to the ACME CA root certificate file. Must be set together with `acme.url`
#    url: example.com                  # [OPTIONAL] ACME server address with port and resource path, for example: https://acme.corp.lan:8443/directory. Must be set together with `acme.rootPath`
#    email: user@domain.com            # [OPTIONAL] Email associated with the Let's Encrypt account

---
type: CapsmClusterConfig
# Management cluster configuration

cluster:
  apiEndpoint:                          # [REQUIRED] Cluster API server address (IP or FQDN without port or protocol, for example, 192.168.1.100)
  clusterName: cluster-management       # [OPTIONAL] Name of the management cluster being created. Default: cluster-management
  enabledServices: []                   # [OPTIONAL] List of enabled services from the shturval repository. By default (if not set), the cluster installs services critical for platform operation plus monitoring and logging services. If minimal: true, values of this parameter are ignored
  externalKubeAPILB: false              # [OPTIONAL] Use an external load balancer for the API server. Default: false
  externalingresslb: false              # [OPTIONAL] Use an external load balancer for Ingress. Default: false
  ingress: ''                           # [REQUIRED if ingressvip is not set] Wildcard DNS record for ingress (for example, <cluster_name>.<base_domain>). To set a DNS record for ingress, set externalingresslb to true
  controlPlaneNodesCount: 1             # [OPTIONAL] Number of Control Plane nodes. Must be at least 1. Default: 1
  ingressvip:                           # [REQUIRED if externalingresslb: false] VIP address for the Ingress controller. To set an Ingress VIP, externalingresslb must be false
  podSubnet: 172.16.0.0/16              # [OPTIONAL] Pod subnet. Default: 172.16.0.0/16
  secure: false                         # [OPTIONAL] Enable advanced security settings. Default: false
  serviceSubnet: 10.96.0.0/12           # [OPTIONAL] Service subnet. Default: 10.96.0.0/12
  shturvalVersion: 2.13.1               # [OPTIONAL] Platform version. Matches the shtil utility version. The provided value is ignored
  minimal: false                        # [OPTIONAL] Installs the management cluster with a minimal service set. If set to true, only services critical for platform operation are installed. Services in enabledServices are ignored

# Node configurations
# By default, Control Plane and Worker group configuration is pre-filled. Creating additional Worker groups is not supported

#provider:
#
# ## Control Plane node configuration
#  controlPlaneNodeConfig:
#    controlPlaneSelector:
#      matchExpressions: []                             # [OPTIONAL] Matching host expressions for the Control Plane node group
#      matchLabels:
#        role: controlplane                             # [OPTIONAL] Host label for Control Plane group nodes. [Do not override] Role for the Control Plane group must be controlplane
#    nodeConfig:
#      groupName: control-plane                         # [Do not override] Control Plane node group name
#      roles:
#        - name: node-role.kubernetes.io/control-plane  # [Do not override] Control Plane node group role
#    name: cluster-management-provider                  # [OPTIONAL] Must match the provider instance name. Default name: cluster-management-provider
#
# ## Worker node configuration
#  workerNodeConfigs:
#    - nodeConfig:
#        groupName: default                            # [Do not override] Default Worker node group name
#        roles:
#          - name: node-role.kubernetes.io/workers     # [Do not override] Worker node group role
#      workersCount: 3                                 # [OPTIONAL] Number of nodes in the default Worker group. Default: 3
#      workerSelector:
#        matchExpressions: []                          # [OPTIONAL] Matching host expressions for Worker group nodes
#        matchLabels:                                  # Matching labels
#          role: workers                               # [OPTIONAL] Matching host role label for default Worker group nodes. Recommended and default: workers
YAML manifest configuration example
type: CapsmProviderConfig
name: myprovidername
credentials:
  SSH:
    privateKey: /home/username/.ssh/id_ed25519
    userName: shturval
hosts:
  - address: 10.11.11.11
    labelsSelector:
      role: controlplane
    credentials: null
  - address: 10.11.12.12
    labelsSelector:
      role: workers
    credentials: null

---

type: CapsmClusterConfig
cluster:
  apiEndpoint: 10.11.12.13
  clusterName: myclustername
  controlPlaneNodesCount: 1
  ingressvip: 10.11.12.14
provider:
  controlPlaneNodeConfig:
    controlPlaneSelector:
      matchExpressions: []
      matchLabels:
        role: controlplane
    nodeConfig:
      groupName: control-plane
      roles:
        - name: node-role.kubernetes.io/control-plane
  workerNodeConfigs:
    - nodeConfig:
        groupName: default
        roles:
          - name: node-role.kubernetes.io/workers
      workersCount: 1
      workerSelector:
        matchExpressions: []
        matchLabels:
          role: workers
Example command to create the permanent management cluster
./shtil-2.13.1 install shturvalv2 --yaml-path=PATH-TO-YAML-MANIFEST

Installing a cluster with the oVirt/zVirt/HostVM/RED Virtualization/ROSA Virtualization provider

Command to request the manifest template

./shtil-2.13.1 install ovirt example
YAML manifest template
---
# YAML manifest template for platform installation with the oVirt provider
# Provider configuration
type: CapovProviderConfig

#name: cluster-management-provider # [OPTIONAL] Provider instance name. Default: cluster-management-provider

credentials:                                                 # [REQUIRED] Credentials for connecting to the oVirt Engine API
  oVirt:
    url: <https://ovirt-engine.example.com/ovirt-engine/api> # [REQUIRED] URL for connecting to the oVirt Engine API. Specify the full Engine address and append /ovirt-engine/api
    username: <admin@internal>                               # [REQUIRED] Username for oVirt API authentication
    password: <password>                                     # [REQUIRED] Password for oVirt API authentication

#connection:         # [OPTIONAL] TLS connection settings for the oVirt API
  #tlsInsecure: true # [OPTIONAL] Disable TLS certificate verification. Default: true. Set to false for production with valid certificates
  #tlsCertPath: ''   # [OPTIONAL] Path to the CA certificate file for TLS verification. Used when tlsInsecure: false. Example: /path/to/ca-bundle.crt

providerConfig:                      # [REQUIRED] oVirt provider configuration
  #subtype: zvirt                    # [OPTIONAL] oVirt-like provider subtype. One of: zvirt, hostvm, redvirt, rosavirt
  datacenter: <Default>              # [REQUIRED] oVirt datacenter name where VMs will be created
  datacenterCluster: <Default>       # [REQUIRED] oVirt cluster name within the datacenter
  vnicProfile: <ovirtmgmt/ovirtmgmt> # [REQUIRED] oVirt VNIC profile name for VM network interfaces
  template: <rocky9-template>        # [REQUIRED] VM template name in the selected datacenter (base image for cluster nodes)
  #csiStorage: ''                    # [OPTIONAL] Storage domain name for dynamic persistent volumes via the CSI driver. Leave empty to disable CSI
  #vmType: server                    # [OPTIONAL] VM type for created virtual machines. Default: server. Do not override unless required
  #templateNetInterface: eth0        # [OPTIONAL] Network interface name in the template. Default: eth0. Do not override unless the template uses a different interface

ingressCerts:                         # Cluster certificate. By default the cluster is installed with a self-signed certificate. Only one certificate subtype can be selected
  ca:
    crtPath:                          # [OPTIONAL] Path to the certificate chain (your intermediate certificate -> corporate CA certificate) in PEM format. Must be set together with `ca.keyPath`
    keyPath:                          # [OPTIONAL] Path to the intermediate CA private key. Must be set together with `ca.crtPath`
  tls:
    crtPath:                          # [OPTIONAL] Path to the corporate certificate (PEM file) issued by the CA (in this case the file contains the certificate chain) or self-signed for the Ingress domain name. Must be set together with `tls.keyPath`
    keyPath:                          # [OPTIONAL] Path to the Ingress corporate certificate private key. Must be set together with `tls.crtPath`
  acme:
    rootPath: </some/path>            # [OPTIONAL] Path to the ACME CA root certificate file. Must be set together with `acme.url`
    url: example.com                  # [OPTIONAL] ACME server address with port and resource path, for example: https://acme.corp.lan:8443/directory. Must be set together with `acme.rootPath`
    email: user@domain.com            # [OPTIONAL] Email associated with the Let's Encrypt account

---
type: CapovClusterConfig           # Management cluster configuration
cluster:                            # [REQUIRED] Management cluster configuration
  apiEndpoint: <192.168.1.100>      # [REQUIRED] Cluster API server address (IP or FQDN)
  #clusterName: cluster-management  # [OPTIONAL] Name of the management cluster being created. Default: cluster-management
  #enabledServices: []              # [OPTIONAL] Comma-separated list of enabled services. By default (if not set), the cluster installs services critical for platform operation plus monitoring and logging services. If minimal: true, values of this parameter are ignored
  #externalingresslb: false         # [OPTIONAL] Use an external load balancer for Ingress. Default: false
  #ingress: ''                      # [REQUIRED if ingressvip is not set] Wildcard DNS record for ingress (for example, <cluster_name>.<base_domain>)
  #controlPlaneNodesCount: 1        # [OPTIONAL] Number of Control Plane nodes. Must be at least 1. Default: 1
  ingressvip: <192.168.1.101>       # [OPTIONAL] VIP address for the Ingress controller. To set an Ingress VIP, externalingresslb must be false
  #podSubnet: 172.16.0.0/16         # [OPTIONAL] Pod subnet CIDR. Default: 172.16.0.0/16
  #secure: false                    # [OPTIONAL] Enable advanced security settings. Default: false
  #serviceSubnet: 10.96.0.0/12      # [OPTIONAL] Service subnet CIDR. Default: 10.96.0.0/12
  #shturvalVersion: 2.13.1          # [OPTIONAL] Platform version. Must match the shtil utility version
  #minimal: false                   # [OPTIONAL] Installs the management cluster with a minimal service set. If set to true, only services critical for platform operation are installed. Services in enabledServices are ignored

#provider:                                             # [OPTIONAL] Node configurations. By default, Control Plane and Worker group configuration is pre-filled. Creating additional Worker groups is not supported
  #name: cluster-management-provider                   # [OPTIONAL] Must match the provider instance name. Default: cluster-management-provider

  #  # Control Plane node configuration
  #controlPlaneNodeConfig:                             # [OPTIONAL] Control Plane node configuration
  #  nodeConfig:
  #    groupName: control-plane                        # [Do not override] Control Plane node group name
  #    roles:
  #      - name: node-role.kubernetes.io/control-plane # [Do not override] Control Plane node group role; must be control-plane
  #  capovNodeConfig:
  #    cpu:
  #      cores: 4                                      # [OPTIONAL] Number of CPU cores per Control Plane node. Default: 4
  #      sockets: 1                                    # [OPTIONAL] Number of CPU sockets per Control Plane node. Default: 1
  #      threads: 1                                    # [OPTIONAL] Number of CPU threads per socket. Default: 1
  #    memory:
  #      sizeMB: 16000                                 # [OPTIONAL] Memory size in MB per Control Plane node. Default: 16000
  #      guaranteedMB: 16000                           # [OPTIONAL] Guaranteed memory in MB. Must match sizeMB. Default: 16000
  #    osDiskSizeGB: 100                               # [OPTIONAL] OS disk size in GB per Control Plane node. Default: 100

  #  # Worker node configuration
  #workerNodeConfigs:                                  # [OPTIONAL] Worker node configuration
  #  - nodeConfig:                                     # [OPTIONAL] Create the default Worker node group
  #      groupName: default                            # [Do not override] Default Worker node group name
  #      roles:
  #        - name: node-role.kubernetes.io/workers     # [OPTIONAL] Worker node group role
  #    workersCount: 3                                 # [OPTIONAL] Number of nodes in the default Worker group. Default: 3
  #    capovNodeConfig:
  #      cpu:
  #        cores: 8                                    # [OPTIONAL] Number of CPU cores per Worker node. Default: 8
  #        sockets: 1                                  # [OPTIONAL] Number of CPU sockets per Worker node. Default: 1
  #        threads: 1                                  # [OPTIONAL] Number of CPU threads per socket. Default: 1
  #      memory:
  #        sizeMB: 32000                               # [OPTIONAL] Memory size in MB per Worker node. Default: 32000
  #        guaranteedMB: 32000                         # [OPTIONAL] Guaranteed memory in MB. Must match sizeMB. Default: 32000
  #      osDiskSizeGB: 300                             # [OPTIONAL] OS disk size in GB per Worker node. Default: 300
YAML manifest configuration example
type: CapovProviderConfig
credentials:
  oVirt:
    url: https://rhv-mg.example.su/ovirt-engine/api
    username: myname@internal
    password: password
connection:
  tlsInsecure: true
providerConfig:
  subtype: zvirt
  datacenter: ND
  datacenterCluster: RHV
  vnicProfile: LAN_3245
  template: my-template-ubuntu734-2.13.1
  csiStorage: Pure_VM_Store

---

type: CapovClusterConfig  
cluster:
  apiEndpoint: 11.11.12.12
  clusterName: myclustername
  controlPlaneNodesCount: 1
  ingressvip: 11.11.12.13
provider:
  controlPlaneNodeConfig:
    nodeConfig:
      groupName: control-plane
    roles:
      - name: node-role.kubernetes.io/control-plane
    capovNodeConfig:
      cpu:
        cores: 4
        sockets: 1
        threads: 1
      memory:
        sizeMB: 9000
      osDiskSizeGB: 60
  workerNodeConfigs:
    - nodeConfig:
        groupName: default
      roles:
        - name: node-role.kubernetes.io/workers
      workersCount: 2
      capovNodeConfig:
        cpu:
          cores: 8
          sockets: 1
          threads: 1
        memory:
          sizeMB: 10000
        osDiskSizeGB: 60
Create command
./shtil-2.13.1 install ovirt --yaml-path=PATH-TO-YAML-MANIFEST

Installing a cluster with the vSphere provider

Command to request the manifest template

./shtil-2.13.1 install vsphere example
YAML manifest template
---
# YAML manifest template for platform installation with the vSphere provider
type: CapvsProviderConfig           # Provider configuration
# name: cluster-management-provider # [OPTIONAL] Provider instance name. Default: cluster-management-provider

# [REQUIRED] Credentials for connecting to vCenter

credentials:
  vSphere:
    addressVcenter: <https://vcenter.example.com>  # [REQUIRED] IP address or FQDN of the provider Engine
    usernameVcenter: <administrator@vsphere.local>     # [REQUIRED] Account username for connecting to the provider Engine
    passwordVcenter: <password>                        # [REQUIRED] Account password for connecting to the provider Engine

# TLS connection settings for vCenter

# connection:
#   tlsInsecure: true       # [OPTIONAL] Disable TLS certificate verification. Default: true.
#   tlsCertPath: ''         # [OPTIONAL] Path to the CA certificate file for TLS verification. Used when tlsInsecure: false
#                           # Example: /path/to/ca-bundle.crt

# vSphere provider configuration

providerConfig:
  datacenter: <Datacenter>          # [REQUIRED] vSphere datacenter name where virtual machines will be created (for example, /MyCloud)
  datastore: <datastore1>           # [REQUIRED] Datastore in the provider Engine datacenter (for example, MyCloud-example)
  resourcePool: <ResourcePool>      # [REQUIRED] Resource pool path for virtual machines (for example, /Datacenter/host/Cluster/Resources/ResourcePool)
  network: <VM Network>             # [REQUIRED] Network name for virtual machine interfaces (for example, /Datacenter/network/dvPG-example-3245)
  folder: <vm-folder>               # [REQUIRED] Virtual machine folder path in the vCenter inventory (for example, /Datacenter/vm/folder)
  template: <rocky9-template>       # [REQUIRED] Virtual machine template name in the selected datacenter (base image for cluster nodes)
  # cloneMode: linkedClone          # [OPTIONAL] Clone mode for creating virtual machines. Default: linkedClone.
  #                                 # linkedClone is faster and uses less space; fullClone creates independent virtual machines
  # storagePolicy: ''               # [OPTIONAL] Storage policy name for virtual machine disks. Leave empty to use default storage settings
  # enableCSI: true                 # [OPTIONAL] Enable the vSphere CSI driver for dynamic persistent volumes. Default: true
  # templateNetInterface: eth0      # [OPTIONAL] Network interface name in the template. Default: eth0. Do not override unless the template uses a different interface

ingressCerts:                         # Cluster certificate. By default the cluster is installed with a self-signed certificate. Only one certificate subtype can be selected
  ca:
    crtPath:                          # [OPTIONAL] Path to the certificate chain (your intermediate certificate -> corporate CA certificate) in PEM format. Must be set together with `ca.keyPath`
    keyPath:                          # [OPTIONAL] Path to the intermediate CA private key. Must be set together with `ca.crtPath`
  tls:
    crtPath:                          # [OPTIONAL] Path to the corporate certificate (PEM file) issued by the CA (in this case the file contains the certificate chain) or self-signed for the Ingress domain name. Must be set together with `tls.keyPath`
    keyPath:                          # [OPTIONAL] Path to the Ingress corporate certificate private key. Must be set together with `tls.crtPath`
  acme:
    rootPath: </some/path>            # [OPTIONAL] Path to the ACME CA root certificate file. Must be set together with `acme.url`
    url: example.com                  # [OPTIONAL] ACME server address with port and resource path, for example: https://acme.corp.lan:8443/directory. Must be set together with `acme.rootPath`
    email: user@domain.com            # [OPTIONAL] Email associated with the Let's Encrypt account

---
type: CapvsClusterConfig            # Management cluster configuration
cluster:
  apiEndpoint: <192.168.1.100>      # [REQUIRED] Cluster API server address (IP or FQDN without port or protocol, for example, 192.168.1.100)
  # clusterName: cluster-management # [OPTIONAL] Name of the management cluster being created. Default: cluster-management
  # enabledServices: []             # [OPTIONAL] Comma-separated list of enabled services. By default (if not set), the cluster installs services critical for platform operation plus monitoring and logging services. If minimal: true, values of this parameter are ignored
  # externalingresslb: false        # [OPTIONAL] Use an external load balancer for Ingress. Default: false
  # ingress: ''                     # [REQUIRED if ingressvip is not set] Wildcard DNS record for ingress (for example, <cluster_name>.<base_domain>)
  # controlPlaneNodesCount: 1       # [OPTIONAL] Number of Control Plane nodes. Must be at least 1. Default: 1
  ingressvip: <192.168.1.101>       # [REQUIRED if externalingresslb: false] VIP address for the Ingress controller
  # podSubnet: 172.16.0.0/16        # [OPTIONAL] Pod subnet CIDR. Default: 172.16.0.0/16
  # secure: false                   # [OPTIONAL] Enable advanced security settings. Default: false
  # serviceSubnet: 10.96.0.0/12     # [OPTIONAL] Service subnet CIDR. Default: 10.96.0.0/12
  # shturvalVersion: 2.13.1         # [OPTIONAL] Platform version. Must match the shtil utility version
  # minimal: false                  # [OPTIONAL] Installs the management cluster with a minimal service set. If set to true, only services critical for platform operation are installed. Services in enabledServices are ignored

# Node configurations
# By default, Control Plane and Worker group configuration is pre-filled. Creating additional Worker groups is not supported

# provider:
#   name: cluster-management-provider # [OPTIONAL] Must match the provider instance name. Default: cluster-management-provider

  # Control Plane node configuration

#   controlPlaneNodeConfig:
#     nodeConfig:
#       groupName: control-plane      # [Do not override] Control Plane node group name
#       roles:
#         - name: node-role.kubernetes.io/control-plane # [Do not override] Control Plane node role
#     capvsNodeConfig:
#       cpu:
#         cores: 4                    # [OPTIONAL] Number of CPU cores per control plane node. Default: 4
#       memory:
#         sizeMB: 16000               # [OPTIONAL] Memory size in MB per control plane node. Default: 16000
#       osDiskSizeGB: 100             # [OPTIONAL] OS disk size in GB per control plane node. Default: 100

  # Worker node configuration

#   workerNodeConfigs:

    # Create the default Worker node group

#     - nodeConfig:
#         groupName: default                            # [Do not override] Default Worker node group name
#         roles:
#           - name: node-role.kubernetes.io/workers     # [Do not override] Worker node group role
#       workersCount: 3                                 # [OPTIONAL] Number of nodes in the default Worker group. Default: 3
#       capvsNodeConfig:
#         cpu:
#           cores: 8                  # [OPTIONAL] Number of CPU cores per Worker node. Default: 8
#         memory:
#           sizeMB: 32000             # [OPTIONAL] Memory size in MB per Worker node. Default: 32000
#         osDiskSizeGB: 300           # [OPTIONAL] OS disk size in GB per Worker node. Default: 300
Create command
./shtil-2.13.1 install vsphere --yaml-path=PATH-TO-YAML-MANIFEST

Installing a cluster with the OpenStack/VK Cloud/Selectel provider

Command to request the manifest template

./shtil-2.13.1 install openstack example

Command to request the VK Cloud manifest template

./shtil-2.13.1 install vkcloud example

Command to request the Selectel manifest template

./shtil-2.13.1 install selectel example
YAML manifest template
---
# YAML manifest template for platform installation with the OpenStack/VK Cloud/Selectel provider
type: CaposProviderConfig                               # Provider configuration
#name: my-openstack-provider                            # [OPTIONAL] Provider instance name. Default: cluster-management-provider
cloudName: vkcloud                                      # [REQUIRED] Cloud name, for example vkcloud, openstack, etc.

connection:                                             # [REQUIRED] Credentials for connecting to OpenStack
  authURL: https://openstack.example.com:5000/v3        # [REQUIRED] OpenStack authorization service (Keystone) URL. Port is required, for example, http://10.11.111.111:5000
  projectID: project-id                                 # [REQUIRED] OpenStack project ID
  projectDomainID: project-domain-id                    # [REQUIRED] OpenStack project domain ID
#  tlsInsecure: false                                   # [OPTIONAL] Skip TLS certificate verification for the OpenStack API
#  tlsCertPath: /path/to/cert                           # [OPTIONAL] Path to the CA certificate file in PEM format for the OpenStack API
#  region: RegionOne                                    # [OPTIONAL] OpenStack region name
#  interface: public                                    # [OPTIONAL] OpenStack endpoint interface (for example, public, internal)
#  identityAPIVersion: "3"                              # [OPTIONAL] OpenStack Identity API version. Default: 3
#  token:                                               # [OPTIONAL] Authentication token. Cannot be used together with login and password. Available only for OpenStack
#  login: username                                      # [OPTIONAL] Service account name with heat_stack_owner and admin roles. Must be set together with password
#  password: password                                   # [OPTIONAL] Service account password. Must be set together with login
#  userDomainName: users                                # [OPTIONAL] User domain name. Required for OpenStack and VK Cloud

resources:                                              # [REQUIRED] OpenStack provider configuration
  sshKeyName: ssh-key-name                              # [REQUIRED] SSH key pair name for VM access over SSH
  nodeCIDR: 10.0.0.0/24                                 # [REQUIRED] Node subnet. For example, 10.0.0.0/24. Must not overlap with the pod subnet (podSubnet) or service subnet (serviceSubnet)
  externalNetworkID: external-network-id                # [REQUIRED] External network ID for floating IP and external access
  flavors:                                              # [REQUIRED] List of VM types
    - flavor-name
  volumeTypes:                                          # [REQUIRED] List of disk types
    - volume-type
#  availabilityZones:                                   # [OPTIONAL] List of availability zones
#    - zone
#  managedSecurityGroups: true                          # [OPTIONAL] Security group management. Default: true
#  disablePortSecurity: false                           # [OPTIONAL] Disable port security. Default: false
#  dns:                                                 # [OPTIONAL] DNS servers 
  machineImageName: image-name                          # [REQUIRED] Virtual machine template name. The Kubernetes version of the VM template must match the Shturval and shtil version
#  enableCSI:                                           # [OPTIONAL] Enable CSI integration. Default: false

ingressCerts:                                           # [OPTIONAL] Cluster certificate. By default the cluster is installed with a self-signed certificate. Only one certificate subtype can be selected
   ca:
     crtPath:                                           # [OPTIONAL] Path to the certificate chain (your intermediate certificate -> corporate CA certificate) in PEM format. Must be set together with `ca.keyPath`
     keyPath:                                           # [OPTIONAL] Path to the intermediate CA private key. Must be set together with `ca.crtPath`
   tls:
     crtPath:                                           # [OPTIONAL] Path to the corporate certificate (PEM file) issued by the CA (in this case the file contains the certificate chain) or self-signed for the Ingress domain name. Must be set together with `tls.keyPath`
     keyPath:                                           # [OPTIONAL] Path to the Ingress corporate certificate private key. Must be set together with `tls.crtPath`
   acme:
     rootPath: /some/path                               # [OPTIONAL] Path to the ACME CA root certificate file. Must be set together with `acme.url`
     url: example.com                                   # [OPTIONAL] ACME server address with port and resource path, for example: https://acme.corp.lan:8443/directory. Must be set together with `acme.rootPath`
     email: user@domain.com                             # [OPTIONAL] Email associated with the Let's Encrypt account

---

type: CaposClusterConfig                                 # Management cluster configuration
cluster:
  clusterName: cluster-name                             # [OPTIONAL] Name of the management cluster being created. Default: cluster-management
#  enabledServices: []                                  # [OPTIONAL] Comma-separated list of enabled services. By default (if not set), the cluster installs services critical for platform operation plus monitoring and logging services. If minimal: true, values of this parameter are ignored
#  externalingresslb: false                             # [OPTIONAL] Use an external load balancer for Ingress. Default: false
#  ingress: ''                                          # [OPTIONAL] Wildcard DNS record for ingress (for example, <cluster_name>.<base_domain>)
#  controlPlaneNodesCount: 1                            # [OPTIONAL] Number of Control Plane nodes. At least 1. Default: 1
#  podSubnet: 172.16.0.0/16                             # [OPTIONAL] Pod subnet CIDR. Default: 172.16.0.0/16
#  secure: false                                        # [OPTIONAL] Enable advanced security settings. Default: false
#  serviceSubnet: 10.96.0.0/12                          # [OPTIONAL] Service subnet CIDR. Default: 10.96.0.0/12
#  shturvalVersion: 2.13.1                              # [OPTIONAL] Platform version. Must match the shtil utility version
#  minimal: false                                       # [OPTIONAL] Installs the management cluster with a minimal service set. If set to true, only services critical for platform operation are installed. Services in enabledServices are ignored

# Node configurations
# By default, Control Plane and Worker group configuration is pre-filled. Creating additional Worker groups is not supported

#provider:
#  name: my-openstack-provider                          # [OPTIONAL] Provider instance name. Default: cluster-management-provider

  # Control Plane node configuration
#  controlPlaneNodeConfig:
#    nodeConfig:
#      groupName: control-plane                         # [Do not override] Control Plane node group name
#      roles:
#        - name: control-plane                          # [Do not override] Control Plane node role
#    caposNodeConfig:
#      openstackFlavorName: flavor-name                 # [OPTIONAL] Virtual machine type for Control Plane nodes. If omitted, the first value from flavors in the provider configuration is used
#      volumeSize: 100                                  # [OPTIONAL] Root volume size in GB. Default: 100
#      volumeType: volume-type                          # [OPTIONAL] Disk type for Control Plane nodes. If omitted, the first value from volumeTypes is used
#      availabilityZone: zone                           # [OPTIONAL] Availability zone for Control Plane nodes. If omitted, the first value from availabilityZones is used

  # Worker node configuration
#  workerNodeConfigs:                                   # Create the default Worker node group
#    - nodeConfig:
#        groupName: default                             # [Do not override] Default Worker node group name
#        roles:
#          - name: worker                               # [Do not override] Worker node group role
#      workersCount: 3                                  # [OPTIONAL] Number of nodes in the default Worker group. Default: 3
#      caposNodeConfig:
#        openstackFlavorName: flavor-name               # [OPTIONAL] Virtual machine type for Worker nodes. If omitted, the first value from flavors in the provider configuration is used
#        volumeSize: 100                                # [OPTIONAL] Root volume size in GB. Default: 300
#        volumeType: volume-type                        # [OPTIONAL] Disk type for Worker nodes. If omitted, the first value from volumeTypes is used
#        availabilityZone: zone                         # [OPTIONAL] Availability zone for Worker nodes. If omitted, the first value from availabilityZones is used
YAML manifest configuration example with the VK Cloud provider
type: CaposProviderConfig
name: mgmtvk-prov
cloudName: vkcloud
connection:
  authURL: https://ex.mail.ru:35357/v3/
  projectID: c30c
  projectDomainID: 384
  tlsInsecure: true
  region: RegionOne
  interface: public
  identityAPIVersion: 3
  login: "user@example.ru"
  password: "mypassw"
  userDomainName: users
resources:
  sshKeyName: ssh-rsa
  nodeCIDR: 10.0.0.0/24
  externalNetworkID: eddd4
  flavors:
    - STD2-8-8
  volumeTypes:
    - ceph-ssd
  availabilityZones:
    - ME1
  managedSecurityGroups: true
  machineImageName: mymachine-2130

---

type: CaposClusterConfig
cluster:
  clusterName: myclustername
  externalingresslb: true
  controlPlaneNodesCount: 1
provider:
  controlPlaneNodeConfig:
   nodeConfig:
     groupName: control-plane
     roles:
       - name: control-plane
   caposNodeConfig:
     openstackFlavorName: STD2-8-8
     volumeSize: 40
     volumeType: ceph-ssd
     availabilityZone: ME1
  workerNodeConfigs:
    - nodeConfig:
        groupName: default
        roles:
          - name: worker
      workersCount: 1
      caposNodeConfig:
        openstackFlavorName: STD2-8-8
        volumeSize: 50
        volumeType: ceph-ssd
        availabilityZone: ME1
OpenStack create command
./shtil-2.13.1 install openstack --yaml-path=PATH-TO-YAML-MANIFEST
VK Cloud create command
./shtil-2.13.1 install vkcloud --yaml-path=PATH-TO-YAML-MANIFEST
Selectel create command
./shtil-2.13.1 install selectel --yaml-path=PATH-TO-YAML-MANIFEST

Platform installation command examples

To install the platform in one command, specify the required temporary cluster creation parameters and the YAML manifest path parameter --yaml-path=PATH-TO-YAML-MANIFEST in the permanent management cluster installation command for one of the providers.

After the temporary cluster starts successfully, permanent cluster installation starts automatically.

Example platform creation command with the Shturval v2 provider via YAML manifest in an open environment
./shtil-2.13.1 install shturvalv2 --yaml-path=PATH-TO-YAML-MANIFEST --bootstrap-license="ENTER-YOUR-LICENSE"
Example platform creation command with the oVirt provider via YAML manifest in a closed environment
./shtil-2.13.1 install ovirt --yaml-path=PATH-TO-YAML-MANIFEST --bootstrap-registry="ENTER-YOUR-REGISTRY-ADDRESS" --bootstrap-license="ENTER-YOUR-LICENSE"
← Graphical interface installation
Cluster configuration with command-line flags →