Kubernetes on ServerPlus: launching a cluster and kubeconfig

Kubernetes on ServerPlus

Kubernetes on ServerPlus is a managed service based on OpenStack Magnum. You order a cluster (from the panel or via the API), and the platform brings up the control plane and worker nodes as virtual machines in your project. All you need is the kubeconfig — a file with the address and access keys — and you work with the cluster using the familiar kubectl.

Creating a cluster

A cluster can be created from the web panel (easier the first time) or via the API:

openstack coe cluster create my-cluster --cluster-template <template> --master-count 1 --node-count 2 --keypair <ssh-key>

# status (wait for CREATE_COMPLETE)
openstack coe cluster list

Important note about networking. Cluster nodes need internet access — they pull container images and Kubernetes components. So the cluster network must have a router with an external gateway. On an isolated network without egress the cluster will not build. The easiest option is to let the panel's creation wizard configure the network.

Getting the kubeconfig

The kubeconfig is a file containing the cluster API address, the root certificate and your client key. It is how kubectl knows where and as whom to connect.

In the panel: the cluster card has a kubeconfig download button. Via the CLI:

openstack coe cluster config my-cluster
# creates ./config and prints the export KUBECONFIG=... line

kubeconfig = full access to the cluster. Keep it like a password: chmod 600, never commit it to git.

Installing kubectl

# Linux
curl -LO "https://dl.k8s.io/release/$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -m 0755 kubectl /usr/local/bin/kubectl

# macOS
brew install kubectl

Connecting the kubeconfig

Option A. Once per shell session

export KUBECONFIG=$PWD/config
kubectl get nodes

Option B. Make it the default config

mkdir -p ~/.kube
cp ./config ~/.kube/config
chmod 600 ~/.kube/config

Option C. Multiple clusters (merge)

If you already have ~/.kube/config, do not overwrite it — merge instead:

KUBECONFIG=~/.kube/config:$PWD/config kubectl config view --flatten > /tmp/merged
mv /tmp/merged ~/.kube/config
kubectl config get-contexts
kubectl config use-context <context-name>

First commands

kubectl cluster-info
kubectl get nodes -o wide     # wait for Ready
kubectl get pods -A

Deploy a test app and expose it:

kubectl create deployment web --image=nginx
kubectl expose deployment web --port=80 --type=LoadBalancer
kubectl get svc web -w        # wait for EXTERNAL-IP

A LoadBalancer service creates an Octavia load balancer and assigns an external address reachable from the internet.

FAQ

kubectl will not connect / times out. Check that the control plane has an external (floating) IP and that the address in the kubeconfig is the external one, not an internal 10.x. An internal address is not reachable from your laptop.

Nodes NotReady, cluster stuck building. Almost always the cluster network has no internet access — nodes cannot pull images. You need a network with a router and external gateway.

x509 certificate error. Usually a stale kubeconfig (the cluster was recreated). Regenerate it: openstack coe cluster config my-cluster --force.

Change the number of nodes: openstack coe cluster resize my-cluster 3. Delete the cluster: openstack coe cluster delete my-cluster.

Security

• kubeconfig is a secret: one file grants admin access to the cluster. chmod 600, out of git and messengers.
• Do not hand everyone the same admin kubeconfig — create separate ServiceAccounts and roles (RBAC) with limited permissions.
• Expose only the services that need it; keep the rest inside the cluster (ClusterIP type).