Understanding preflight checks

This page is for infrastructure operators or platform administrators.

In Anthos private mode you can run preflight checks for different situations:

  • Anthos private mode runs preflight checks when you create or update admin or user clusters and nodepool resources with actl. If the checks fail, no changes are made. You can also bypass these checks.
  • Anthos private mode runs internal preflight checks when you apply Kubernetes resources to user clusters from an admin cluster. The checks are run before changes are actually applied to affected user clusters. If the checks fail, no changes are made. You can also bypass these checks, or run them explicitly.

Preflight checks when creating clusters using actl

When you create admin or user clusters with the actl command, Anthos private mode automatically runs preflight checks before any changes are made.

When the checks pass, Anthos private mode will create the clusters.

Ignoring the results of automated preflight checks

If you want to bypass these automated preflight checks, you can use the optional --force flag in the command.

Running preflight checks independently

You can also run preflight checks by themselves, before you create a cluster. This can help save time by ensuring your machine and node resources pass checks.

This command checks whether the machines and network are ready for cluster creation:

actl clusters baremetal check preflight CLUSTER_NAME

Preflight checks for user cluster creation

User clusters are created from an existing admin cluster. Anthos private mode automatically runs preflight checks before making any changes. You can also run preflight checks with kubectl before you create a cluster.

  1. Create a user cluster config file following the sample user config file.

  2. Create a namespace for the new user cluster. For example, to create a new user cluster named user1, you can create a namespace named cluster-user1. Here is the kubectl command to create the namespace, where ADMIN_KUBECONFIG specifies the path to the admin cluster kubeconfig file:

    kubectl --kubeconfig ADMIN_KUBECONFIG create namespace cluster-user1
    

  3. Upload your SSH private key file into the new namespace as a secret to establish your credentials. Here's the sample command, where ADMIN_KUBECONFIG specifies the path to the admin cluster kubeconfig file, and SSH_PRIVATE_KEY_FILE_PATH specifies the path to the SSH private key file:

    kubectl --kubeconfig ADMIN_KUBECONFIG create secret generic ssh-key -n cluster-user1 --from-file=id_rsa=SSH_PRIVATE_KEY_FILE_PATH
    

  4. Create a new preflight check YAML file, with the following structure. In the configYAML field, enter the text content of the user cluster config file you created in step 1:

    apiVersion: baremetal.cluster.gke.io/v1
    kind: PreflightCheck
    metadata:
    generateName: preflightcheck-
    namespace: cluster-user1
    spec:
    configYAML: |
    # insert user cluster config file content here.
    
  5. The following kubectl command runs the preflight check for the user cluster, where ADMIN_KUBECONFIG specifies the path to the admin cluster kubeconfig file, and USER_CLUSTER_PREFLIGHT_CHECK_CONFIG specifies the path to the preflight check YAML file you created in the previous step:

    kubectl --kubeconfig ADMIN_KUBECONFIG create -f USER_CLUSTER_PREFLIGHT_CHECK_CONFIG
    
    For example, for a user cluster preflight check config named user1-preflight.yaml, the command is:
    kubectl --kubeconfig ADMIN_KUBECONFIG create -f user1-preflight.yaml
    
    The system returns the following message, with the job ID of the preflight check:
    preflightcheck.baremetal.cluster.gke.io/preflightcheck-g7hfo4 created

  6. Query the preflight check job status using kubectl command:

    kubectl --kubeconfig ADMIN_KUBECONFIG -n cluster-user1 get preflightchecks preflightcheck-g7hfo4
    

If the preflight check job fails, check its status, and then check the detailed job logs to see which check failed. Fix the issues mentioned in the jobs accordingly, and run the checks again.

Internal preflight checks on existing clusters

Anthos private mode also performs internal preflight checks when you apply Cluster Kubernetes resources to an existing admin cluster. If any checks fail, Anthos private mode will not make any changes to the related nodes unless you've specifically bypassed the checks.

Bypassing preflight checks when applying Kubernetes resources

To ignore the internal preflight checks when applying Cluster resources to an existing admin cluster, you need to set the BypassPreflightCheck field to true in the cluster resource.

Here is a fragment of a cluster config YAML file, showing the bypassPreflightCheck field set to true.

# Sample cluster config to bypass preflight check errors:

apiVersion: v1
kind: Namespace
metadata:
  name: cluster-user1
---
apiVersion: baremetal.cluster.gke.io/v1
kind: Cluster
metadata:
  name: user1
  namespace: cluster-user1
spec:
  type: user
  bypassPreflightCheck: true
  # Anthos cluster version.
  anthosBareMetalVersion: 1.8.0
....

Re-enabling preflight checks

You can explicitly trigger a new round of preflight checks so Anthos private mode can update or create new clusters after the preflight check is successful.

  1. Create a new preflight check YAML file with the following content. Fill in the namespace and clusterName fields with the cluster name you are creating:

    apiVersion: baremetal.cluster.gke.io/v1
    kind: PreflightCheck
    metadata:
    generateName: preflightcheck-
    namespace: CLUSTER_NAMESPACE
    spec:
    clusterName: CLUSTER_NAME
    

  2. Issue the kubectl command to run the preflight check for the cluster, where ADMIN_KUBECONFIG specifies the path to the admin cluster kubeconfig file, and CLUSTER_PREFLIGHT_CHECK_CONFIG specifies the path to the preflight check YAML file you created previously:

    kubectl --kubeconfig ADMIN_KUBECONFIG create -f CLUSTER_PREFLIGHT_CHECK_CONFIG
    
    For example, for a user cluster preflight check config named user1-preflight.yaml, the command is:
    kubectl --kubeconfig ADMIN_KUBECONFIG create -f user1-preflight.yaml
    
    The system responds with the job ID of the preflight check:
    preflightcheck.baremetal.cluster.gke.io/preflightcheck-g7hfo4 created
    

  3. Query the preflight check job status ID using kubectl command:

    kubectl --kubeconfig ADMIN_KUBECONFIG -n cluster-cluster1 get preflightchecks preflightcheck-g7hfo4
    

Once the preflight check job finished successfully, Anthos private mode creates the cluster and its resources.

Installation preflight check details

Anthos private mode checks a variety of operating system, software, and machine prerequisite conditions when running preflight checks.

For more detailed information, see Requirements.

Authentication preflight checks

For authentication purposes, preflight checks verify the OpenID Connect (OIDC) configuration to prevent applying an incorrect OIDC profile.

These checks include pinging the OIDC endpoint using the OIDC discovery mechanism at /.well-known/openid-configuration.