Deckhouse Documentation

The user-authn module provides a unified authentication system integrated with Kubernetes and Deckhouse web interfaces (such as Grafana and Dashboard).

It consists of three main components:

• Dex: A federated OpenID Connect (OIDC) provider that supports static users and external providers (SAML, GitLab, GitHub, etc.).
• kubeconfig-generator (also known as dex-k8s-authenticator): A web application that generates kubectl configuration commands after a user authenticates via Dex.
• dex-authenticator (also known as oauth2-proxy): An application that handles authentication requests from the NGINX Ingress component (via auth_request) using the Dex service.

Management of static users is performed using User and Group resources.

The metallb module implements the LoadBalancer mechanism for services in bare metal clusters. It provides two primary operating modes for exposing services to the network:

• Layer 2 Mode: An improved load-balancing mechanism that allows the use of multiple "public" IP addresses for cluster services by having nodes respond to ARP (IPv4) or NDP (IPv6) requests. It works on any Ethernet network without specialized hardware.
• BGP Mode: A scalable solution based on the standard BGP protocol that integrates with existing network infrastructure (like Top-of-Rack switches) to announce service IP addresses. Note: BGP mode is only available in the Enterprise Edition.

Deckhouse Kubernetes Platform (DKP) includes a built-in monitoring system for observing infrastructure and application states. Out of the box, DKP provides predefined Grafana dashboards and Prometheus alerts.

Users can extend this system by:

• Collecting metrics from their own applications.
• Creating custom dashboards.
• Configuring custom alerts or overriding existing alert thresholds.

For advanced management of dashboards and metrics, refer to the observability module documentation.

The Node Controller is a standalone Kubernetes controller used in Deckhouse to manage NodeGroup resources. It is a native controller-runtime based implementation that replaces legacy shell and Go hooks from the 040-node-manager module.

It ensures the integrity of NodeGroup resources through two primary mechanisms:

1. Validation Webhook: Enforces complex business logic and constraints that cannot be captured by standard CRD OpenAPI schemas.
2. Conversion Webhook: Handles version migrations (e.g., converting between v1, v1alpha1, and v1alpha2) by mapping different nodeType values based on the current cluster state.

The keepalived module is used to manage keepalived clusters on Deckhouse Kubernetes Platform nodes. Configuration is performed via custom resources.

Important Compatibility Note: This module is incompatible with the cilium module. Do not attempt to use both simultaneously.

The openvpn module provides certificate-based authentication for peers to connect to the Deckhouse Kubernetes Platform cluster. It includes a web interface (accessible via the openvpn-admin web interface) that allows administrators to:

• Issue new certificates.
• Revoke existing certificates.
• Cancel certificate revocations.
• Download ready-to-use custom configuration files.

For access control to the web interface, you can integrate this module with the user-authn module.

The node-manager module is responsible for managing cluster nodes within the Deckhouse Kubernetes Platform. The specific architecture and component composition of the module depend on the type of nodes being managed.

To understand how to use or configure the module for your specific environment, you must identify your node type and refer to its dedicated documentation. Common node types include:

• CloudEphemeral nodes: Managed via cloud provider ephemeral instances.
• CloudPermanent nodes: Managed via cloud provider persistent instances.
• CloudStatic nodes: Managed via cloud provider static instances.
• Static nodes: Managed as standalone or non-cloud-managed nodes.
• Hybrid node groups and clusters: Managed in environments combining different node types.

The cloud-provider-azure module manages Microsoft Azure cloud resources to support the Deckhouse Kubernetes Platform. It enables the node-manager module to provision nodes for defined NodeGroup entities by interacting with Azure-specific infrastructure.

Key responsibilities include:

• Resource Management via CCM: Using the cloud-controller-manager (CCM) to create network routes for PodNetwork, provision LoadBalancer services, update node metadata, and manage node lifecycle (deleting nodes removed from Azure).
• Node Provisioning: Utilizing the CSI storage component for provisioning.
• Networking: Enabling the required CNI plugin (typically via cni-cilium).
• Node Manager Integration: Registering with the node-manager to allow the use of AzureInstanceClasses when defining NodeGroup configurations.

The cloud-provider-openstack module enables Deckhouse Kubernetes Platform to interact with OpenStack cloud resources. It facilitates node provisioning by allowing the node-manager module to use OpenStack resources for specific NodeGroup configurations.

Key responsibilities include:

• Resource Management: Uses the cloud-controller-manager (CCM) module to synchronize metadata between OpenStack Servers and Kubernetes Nodes, and to clean up nodes that have been deleted in OpenStack.
• Storage Provisioning: Provisions block storage via OpenStack Cinder using the CSI storage component. Note that Manilla (shared filesystem service) is currently not supported.
• Node Integration: Registers with the node-manager module to enable the use of OpenStackInstanceClasses when defining a NodeGroup.

The network-gateway module is used to build a network gateway using Deckhouse Kubernetes Platform cluster nodes. It provides two primary networking functions:

1. DHCP Server: Manages IP address assignment for the network.
2. SNAT Configuration: Configures Source Network Address Translation (SNAT) to manage traffic flow.