Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add troubleshooting section to pod-to-pod-multicluster for required metadata in secret #1705

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Majkel1999
Copy link

@Majkel1999 Majkel1999 commented Nov 5, 2023

Adding Troubleshooting section to the pod-to-pod-multicluster task, as the required metadata for secrets in control plane namespace is not documented.

References:

Signed-off-by: @Majkel1999 [email protected]

@alpeb
Copy link
Member

alpeb commented Nov 7, 2023

The linkerd multicluster link command should be used to retrieve the Link resource and the other associated resources (including those Secrets) to have multicluster communication properly work. I understand it's not always possible to plug a call to this command in all deployment pipelines, but the manifests to use should still be sourced from this command which provides the ultimate source of truth. So I don't see why we need to single out specific metadata that is already provided, and that is required just like many other pieces of metadata in other linkerd resources.

Copy link
Member

@kflynn kflynn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Majkel1999, thanks for digging into this! I left some comments about how I think this could be improved. 🙂

1. `cluster-credentials-<remote-cluster-name>` residing in `linkerd-multicluster` namespace (default, it may be different if you have changed it, during installation of `linkerd-multicluster` extension).
2. `cluster-credentials-<remote-cluster-name>` residing in the LinkerD control-plane namespace -- usually `linkerd`.

The second secret (in `linkerd` namespace) has a specific metadata requirements. Labels and annotations shown below are neccessary for the control plane, to be able to retrieve the remote cluster credentials. Assuming we are linking `east` cluster to `west` cluster, the secret would have to contain below metadata:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Majkel1999, to @alpeb's point, I think it's very important to say here that these Secrets are meant to be managed by the linkerd multicluster link command. I'm OK with providing more details, but I feel that the real core thing we need to make sure people understand is that this error generally means that they haven't properly used linkerd multicluster link. 🙂

Multicluster setup requires 2 secrets on the `source` cluster to function correctly.

1. `cluster-credentials-<remote-cluster-name>` residing in `linkerd-multicluster` namespace (default, it may be different if you have changed it, during installation of `linkerd-multicluster` extension).
2. `cluster-credentials-<remote-cluster-name>` residing in the LinkerD control-plane namespace -- usually `linkerd`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Linkerd" instead of "LinkerD". 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants