@@ -19,9 +19,12 @@ and learn how to spin up a Kubernetes cluster managed by Google Cloud Platform (
...
@@ -19,9 +19,12 @@ and learn how to spin up a Kubernetes cluster managed by Google Cloud Platform (
in a few clicks.
in a few clicks.
TIP: **Tip:**
TIP: **Tip:**
Every new Google Cloud Platform (GCP) account receives [$300 in credit upon sign up](https://console.cloud.google.com/freetrial),
Every new Google Cloud Platform (GCP) account receives
and in partnership with Google, GitLab is able to offer an additional $200 for new GCP accounts to get started with GitLab's
[$300 in credit upon sign up](https://console.cloud.google.com/freetrial).
Google Kubernetes Engine Integration. All you have to do is [follow this link](https://cloud.google.com/partners/partnercredit/?pcn_code=0014M00001h35gDQAQ#contact-form) and apply for credit.
In partnership with Google, GitLab is able to offer an additional $200 for new GCP
accounts to get started with GitLab's Google Kubernetes Engine Integration.
[Follow this link](https://cloud.google.com/partners/partnercredit/?pcn_code=0014M00001h35gDQAQ#contact-form)
to apply for credit.
## Before you begin
## Before you begin
...
@@ -30,7 +33,7 @@ Before [adding a Kubernetes cluster](#create-new-cluster) using GitLab, you need
...
@@ -30,7 +33,7 @@ Before [adding a Kubernetes cluster](#create-new-cluster) using GitLab, you need
- GitLab itself. Either:
- GitLab itself. Either:
- A [GitLab.com account](https://about.gitlab.com/pricing/#gitlab-com).
- A [GitLab.com account](https://about.gitlab.com/pricing/#gitlab-com).
- A [self-managed installation](https://about.gitlab.com/pricing/#self-managed) with GitLab version
- A [self-managed installation](https://about.gitlab.com/pricing/#self-managed) with GitLab version
12.5 or later. This will ensure the GitLab UI can be used for cluster creation.
12.5 or later. This ensures the GitLab UI can be used for cluster creation.
- The following GitLab access:
- The following GitLab access:
-[Maintainer access to a project](../../permissions.md#project-members-permissions) for a
-[Maintainer access to a project](../../permissions.md#project-members-permissions) for a
project-level cluster.
project-level cluster.
...
@@ -41,14 +44,12 @@ Before [adding a Kubernetes cluster](#create-new-cluster) using GitLab, you need
...
@@ -41,14 +44,12 @@ Before [adding a Kubernetes cluster](#create-new-cluster) using GitLab, you need
## Access controls
## Access controls
When creating a cluster in GitLab, you will be asked if you would like to create either:
When creating a cluster in GitLab, you are asked if you would like to create either:
- A [Role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) cluster.
- A [Role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
cluster, which is the GitLab default and recommended option.
- An [Attribute-based access control (ABAC)](https://kubernetes.io/docs/reference/access-authn-authz/abac/) cluster.
- An [Attribute-based access control (ABAC)](https://kubernetes.io/docs/reference/access-authn-authz/abac/) cluster.
NOTE: **Note:**
[RBAC](#rbac-cluster-resources) is recommended and the GitLab default.
GitLab creates the necessary service accounts and privileges to install and run
GitLab creates the necessary service accounts and privileges to install and run
[GitLab managed applications](index.md#installing-applications). When GitLab creates the cluster,
[GitLab managed applications](index.md#installing-applications). When GitLab creates the cluster,
a `gitlab` service account with `cluster-admin` privileges is created in the `default` namespace
a `gitlab` service account with `cluster-admin` privileges is created in the `default` namespace
...
@@ -59,10 +60,10 @@ Restricted service account for deployment was [introduced](https://gitlab.com/gi
...
@@ -59,10 +60,10 @@ Restricted service account for deployment was [introduced](https://gitlab.com/gi
The first time you install an application into your cluster, the `tiller` service
The first time you install an application into your cluster, the `tiller` service
account is created with `cluster-admin` privileges in the
account is created with `cluster-admin` privileges in the
`gitlab-managed-apps` namespace. This service account will be used by Helm to
`gitlab-managed-apps` namespace. This service account is used by Helm to
install and run [GitLab managed applications](index.md#installing-applications).
install and run [GitLab managed applications](index.md#installing-applications).
Helm will also create additional service accounts and other resources for each
Helm also creates additional service accounts and other resources for each
installed application. Consult the documentation of the Helm charts for each application
installed application. Consult the documentation of the Helm charts for each application
for details.
for details.
...
@@ -77,7 +78,7 @@ Note the following about access controls:
...
@@ -77,7 +78,7 @@ Note the following about access controls:
- Environment-specific resources are only created if your cluster is
- Environment-specific resources are only created if your cluster is
[managed by GitLab](index.md#gitlab-managed-clusters).
[managed by GitLab](index.md#gitlab-managed-clusters).
- If your cluster was created before GitLab 12.2, it will use a single namespace for all project
- If your cluster was created before GitLab 12.2, it uses a single namespace for all project
environments.
environments.
### RBAC cluster resources
### RBAC cluster resources
...
@@ -181,7 +182,7 @@ To add a Kubernetes cluster to your project, group, or instance:
...
@@ -181,7 +182,7 @@ To add a Kubernetes cluster to your project, group, or instance:
1.**CA certificate** (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We will use the certificate created by default.
1.**CA certificate** (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.
1. List the secrets with `kubectl get secrets`, and one should be named similar to
1. List the secrets with `kubectl get secrets`, and one should be named similar to
`default-token-xxxxx`. Copy that token name for use below.
`default-token-xxxxx`. Copy that token name for use below.
1. Get the certificate by running this command:
1. Get the certificate by running this command:
...
@@ -193,17 +194,17 @@ To add a Kubernetes cluster to your project, group, or instance:
...
@@ -193,17 +194,17 @@ To add a Kubernetes cluster to your project, group, or instance:
NOTE: **Note:**
NOTE: **Note:**
If the command returns the entire certificate chain, you must copy the Root CA
If the command returns the entire certificate chain, you must copy the Root CA
certificate and any intermediate certificates at the bottom of the chain.
certificate and any intermediate certificates at the bottom of the chain.
A chain file has following structure:
A chain file has following structure:
```plaintext
```plaintext
-----BEGIN MY CERTIFICATE-----
-----BEGIN MY CERTIFICATE-----
-----END MY CERTIFICATE-----
-----END MY CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN ROOT CERTIFICATE-----
-----BEGIN ROOT CERTIFICATE-----
-----END ROOT CERTIFICATE-----
-----END ROOT CERTIFICATE-----
```
```
1.**Token** -
1.**Token** -
...
@@ -241,10 +242,10 @@ To add a Kubernetes cluster to your project, group, or instance:
...
@@ -241,10 +242,10 @@ To add a Kubernetes cluster to your project, group, or instance: