Check for Kubernetes Cluster Feature Requirements

Opstella requires Kubernetes Clusters to be provisioned and ready to be use before proceed with installation and operations.

While Opstella Documentation WON’T go through how to provision a Kubernetes Cluster as Kubernetes Cluster can be provisioned in various ways.

Opstella supports any Kubernetes Cluster that meets the following requirements.

💡 It is recommended to use Reference Architecture as how you should setup Kubernetes Cluster(s).

"exposed" means reachable from outside the cluster

The Ingress Controller having a Service is not the same as it being reachable. Some managed platforms only publish the Kubernetes API endpoint and need an explicit request before ports 80 and 443 are routed to it.

If that is still pending, the rest of the installation can be carried out and verified from inside the cluster (curl --resolve <host>:443:<ingress-cluster-ip>), but every step that expects a browser — the Identity Provider login, the SSO tests, anything a user has to click — stays blocked until it is done. Get it resolved before starting rather than half-way through.

Re-check the default StorageClass, it can be reset

On clusters reconciled from a cluster-class or a managed control plane, the storageclass.kubernetes.io/is-default-class annotation can be dropped again by a later reconcile or upgrade. Treat it as something to re-check, not a one-time gate:

kubectl patch storageclass <name> \
  -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

Checklist

Management Kubernetes Cluster

🟢 Management

This is where Opstella, DevSecOps Tools, Observability Tools will be installed.

Ensure has Supported Ingress Service installed and exposed ; i.e Using NGINX Ingress Controller and Load Balancer(s) with HAProxy

Ensure has Supported Storage Service provided and ready to use with Storage Class (StorageClass Kubernetes Resource) ; i.e Using CSI Drivers

Ensure has RBAC Access as cluster-admin Cluster Role

How to check each item

Run these against the cluster you are checking (kubectl config current-context to confirm which one that is):

kubectl get ingressclass

💡 At least one IngressClass must exist, and one of them should be marked (default).

kubectl get svc -A --field-selector spec.type=LoadBalancer

💡 The Ingress Controller’s Service must have an EXTERNAL-IP, not <pending>.

kubectl get sc

💡 One StorageClass must be marked (default). Provisioning a PersistentVolumeClaim without a storageClassName fails otherwise.

kubectl auth can-i '*' '*' --all-namespaces

💡 Must return yes.

Application Workload Kubernetes Cluster

🟦 Non-Production Workload 🟥 Production Workload

Ensure has Supported Ingress Service installed and exposed ; i.e Using NGINX Ingress Controller and Load Balancer(s) with HAProxy

Ensure has Supported Storage Service provided and ready to use with Storage Class (StorageClass Kubernetes Resource) ; i.e Using CSI Drivers

Ensure has RBAC Access as cluster-admin Cluster Role

How to check each item

Run these against the cluster you are checking (kubectl config current-context to confirm which one that is):

kubectl get ingressclass

💡 At least one IngressClass must exist, and one of them should be marked (default).

kubectl get svc -A --field-selector spec.type=LoadBalancer

💡 The Ingress Controller’s Service must have an EXTERNAL-IP, not <pending>.

kubectl get sc

💡 One StorageClass must be marked (default). Provisioning a PersistentVolumeClaim without a storageClassName fails otherwise.

kubectl auth can-i '*' '*' --all-namespaces

💡 Must return yes.