FQDN and VIP for KubeAPI and Ingress
VIP (Virtual IP) is a virtual IP address that is used as a single entry point for KubeAPI or Ingress. VIP does not need to be pre-configured on any node in the cluster: Once deployed, it is managed by the Kube VIP module, which raises the address on eligible nodes and releases it when the service is removed.
One cluster requires two VIP addresses (in the absence of external balancers for KubeAPI and Ingress):
- VIP for KubeAPI - must belong to the same subnet as the Control Plane nodes;
- VIP for Ingress - must be used on a network load balancer.
Note: The VIP must not match the IP address of any node in the cluster. In a cluster with 1 Control Plane node, IP addresses are assigned in ascending order: Node IP → VIP API → VIP Ingress.
For more information about Kube VIP components, see the pages shturval-vip and shturval-vip-provider. The address pools for VIP selection are described on the IP Address Pool page.
KubeAPI
The KubeAPI address (VIP or FQDN) is specified when creating the cluster. It is used for cluster administration and interaction between Kubernetes components and the platform.
DNS records for KubeAPI
If you are using a DNS name instead of an IP address, create an A record for the API server:
| Cluster | Example entry |
|---|---|
| Management Cluster | api.<cluster_name>.<base_domain> |
| Client cluster | api.<client_cluster_name>.<base_domain> |
For ports and traffic directions, see open and closed loop requirements.
Ingress
VIP or FQDN for Ingress - entry point for HTTP/HTTPS traffic to applications in the cluster. The ingress controller directs traffic along the host/path to the required services. When incoming traffic is served by Gateway API, the same address is used by the Gateway.
Formation of FQDN Ingress
FQDNs in a cluster are formed according to one of the following options:
- if when creating a cluster the DNS record Ingress was specified:
*.<ingress-dns-record>; - if VIP address for Ingress is set:
*.<cluster-name>.ip-<VIP-Ingress>.shturval.link.
Example wildcard entry:
| Cluster | Example entry | Comment |
|---|---|---|
| Management Cluster | *.<cluster_name>.<base_domain> | Wildcard entry for access to application functions of the management cluster |
| Client cluster | *.<client_cluster_name>.<base_domain> | Wildcard entry for access to client cluster applications |
Common Name Limitation
To request certificates issued by cert-manager, commonName must be specified, the value of which is limited (not moremore than 64 characters). When creating a cluster, the length of the name (Common Name) is checked, which is formed according to:
- if DNS record Ingress is specified:
<prefix>.<ingress-dns-record>; - if VIP address for Ingress is specified:
<prefix>.<cluster-name>.ip-<VIP-Ingress>.shturval.link; - if the line with the Ingress VIP address and the cluster name exceeds the general limit, the cluster name is not added to the final Common Name, for example,
<prefix>.ip-<VIP-Ingress>.shturval.link.
In the GUI in the installation wizard of the cluster at the “Basic data” step, the Ingress DNS record is limited to 53 characters, which also takes into account the formation of the Common Name for certificates.
Configuration options by provider
| Provider | KubeAPI | Ingress |
|---|---|---|
| Shturval v2, oVirt, VMware vSphere | Internal (VIP) or external balancer | Internal (VIP) or external balancer |
| OpenStack, Basis Dynamix, Yandex Cloud, vCloud Director | External balancer only | External balancer only |
For details on the fields of the cluster installation wizard and provider features, see the instructions How to deploy a cluster. Requirements for the external balancer and the CoreHA scenario are described in the open and closed loop network requirements, as well as on the shturval-coreha page.
Additional
- For the internal Ingress balancer, configure the appropriate FQDN or use an automatically generated name;
- The firewall should not block connections to VIPs and balancers; the list of ports depends on the deployment type (open or closed loop) and balancing scenario;
- See the instructions How to change the domain name of a cluster.