Preflight Checks

Results

The result of running a collection of preflight checks is represented as a single aggregated value that lets you know whether it is safe to proceed with your actions. Each individual validation which was run is included in the response.

A preflight validation contains information concerning what it was checking for and what the result of that check was. For example, this is a very simple check to ensure that the type of node pool image is valid in the region:

PASSED

The validation successfully passed all criteria.

WARNING

The validation was either unable to fully check all of its criteria or it found a potential issue which could affect the success of the operation. This type of failure will not stop a cluster from being created or modified, but it does require further investigation.

SKIPPED

The validation was skipped because it does not apply to the current request. This can happen for many reasons, such as using a cloud provider that is not applicable to the preflight check.

FAILED

The validation failed its expected criteria and provisioning or updating of a cluster cannot proceed. In this case, there’s an identified problem that needs resolution before continuing.

List of Preflight Checks

Node / Agent Pools

The following preflight validation checks pertain to the node / agent instance groups which are created to launch new nodes inside of the Kubernetes cluster.

Infrastructure

The following preflight validation checks pertain to Cloudera’s control plane infrastructure and your specific account within that control plane.

Networking

The following preflight validation checks pertain to specific network configurations inside of the cloud provider.

Example

{
   "result": "PASSED",
   "summary": {
       "passed": 8,
       "warning": 0,
       "failed": 0,
       "skipped": 10,
       "total": 18
   },
   "message": "The cluster validation has passed, but some checks were skipped",
   "validations": [
       {
           "name": "Instance Count",
           "description": "Each instance count must be between minInstance and maxInstance inclusively. The minInstance and maxInstance of infrastructure group should comply with minimum number of infra nodes and maximum number of infra nodes.",
           "category": "COMMON",
           "status": "PASSED",
           "message": "The minimum and maximum instance counts are correct for all instance groups.",
           "detailedMessage": "The minimum and maximum instance counts are correct for all instance groups.",
           "duration": "1µs"
       },
       {
           "name": "Instance Group Count",
           "description": "Total instance group count must be less than or equal to maximum instance group limit.",
           "category": "COMMON",
           "status": "PASSED",
           "message": "The number of instance groups in the request is less than or equal to the maximum allowed.",
           "detailedMessage": "The total instance group count of 2 is within the limit.",
           "duration": "3µs"
       },
       {
           "name": "Instance Group Naming",
           "description": "Each instance group name must conform the restrictions of the cloud provider. This includes using valid characters and adhering to length restrictions.",
           "category": "COMMON",
           "status": "PASSED",
           "message": "All instance groups meet the naming restrictions for Azure.",
           "detailedMessage": "All instance groups meet the naming restrictions for Azure.",
           "duration": "12µs"
       },
       {
           "name": "Instance Type",
           "description": "Instance groups must have an instance type that exists in the region in which they will be created. For EKS, there is additional verifiation for EKS support and usage class.",
           "category": "COMMON",
           "status": "PASSED",
           "message": "All instance groups have valid instance types.",
           "detailedMessage": "The following instance types were validated for westus2: Standard_B2s",
           "duration": "599ms"
       },
       {
           "name": "Kubernetes Version",
           "description": "Each cloud provider (Amazon, Azure, Google, etc) supports different versions of Kubernetes.",
           "category": "COMMON",
           "status": "PASSED",
           "message": "The specified Kubernetes version 1.18 has been resolved to 1.18.17 and is valid on Azure",
           "detailedMessage": "The specified Kubernetes version 1.18 has been resolved to 1.18.17 and is valid on Azure",
           "duration": "388ms"
       },
       {
           "name": "Placement Rule",
           "description": "Instance Types must be allowed by the placement rule.",
           "category": "COMMON",
           "status": "SKIPPED",
           "message": "Skipping validation since the cloud platform is Azure.",
           "detailedMessage": "Skipping validation since the cloud platform is Azure.",
           "duration": "6µs"
       },
       {
           "name": "Entitlement Check",
           "description": "When the entitlement LIFTIE_USE_PRECREATED_IAM_RESOURCES is enabled, the expected profile (cdp-liftie-instance-profile) should exist and it needs to have the necessary roles attached to it. ",
           "category": "ENTITLEMENTS",
           "status": "SKIPPED",
           "message": "IAM Resource Entitlement validation skipped for Cloud Provider azure.",
           "detailedMessage": "IAM Resource Entitlement validation skipped for Cloud Provider azure.",
           "duration": "14µs"
       },
       {
           "name": "Cluster Proxy Connectivity",
           "description": "Verifies connectivity to the cluster proxy service which is used to register private cluster endpoints.",
           "category": "CONTROL_PLANE",
           "status": "SKIPPED",
           "message": "Connectivity to the cluster connectivity manager will be skipped since this is not a private cluster.",
           "detailedMessage": "The cluster being provisioned is not marked as private in the provisioning request.",
           "duration": "1µs"
       },
       {
           "name": "Cluster Proxy Enabled",
           "description": "Verifies that the environment was created with the cluster proxy service enabled.",
           "category": "CONTROL_PLANE",
           "status": "SKIPPED",
           "message": "Skipping the environment check for cluster proxy connectivity since the cluster is public.",
           "detailedMessage": "Skipping the environment check for cluster proxy connectivity since the cluster is public.",
           "duration": "1µs"
       },
       {
           "name": "DataLake Connectivity",
           "description": "Validates whether DataLake connection is reachable and if FreeIPA is available.",
           "category": "CONTROL_PLANE",
           "status": "PASSED",
           "message": "DataLake validation succeeded.",
           "detailedMessage": "Data lake is healthy and reachable. Service Discovery Feature is enabled, verified DNS entries retrieved for Data Lakes. Datalake URL : localhost:8081  Service discovery URL : localhost:8082 "
       },
       {
           "name": "AWS Shared VPC Access",
           "description": "When a shared VPC is used, proper access should be granted.",
           "category": "NETWORK",
           "status": "SKIPPED",
           "message": "Skipping validation since the cloud platform is Azure.",
           "detailedMessage": "Skipping validation since the cloud platform is Azure.",
           "duration": "3µs"
       },
       {
           "name": "AWS Subnet Availability Zones",
           "description": "When existing AWS subnets are provided for provisioning an EKS cluster, the subnets must be in at least 2 different Availability Zones.",
           "category": "NETWORK",
           "status": "SKIPPED",
           "message": "Skipping validation since the cloud platform is Azure.",
           "detailedMessage": "Skipping validation since the cloud platform is Azure.",
           "duration": "2µs"
       },
       {
           "name": "AWS Subnet Tagging",
           "description": "In order for load balancers to choose subnets correctly a subnet needs to have either the public or private ELB tags defined.",
           "category": "NETWORK",
           "status": "SKIPPED",
           "message": "Skipping validation since the cloud platform is Azure.",
           "detailedMessage": "Skipping validation since the cloud platform is Azure.",
           "duration": "26µs"
       },
       {
           "name": "Azure API Access Parameters",
           "description": "Verifies that the security parameters for locking down access to the Azure Kubernetes API Server are correct.",
           "category": "NETWORK",
           "status": "PASSED",
           "message": "The API server access parameters specified in the cluster request are valid.",
           "detailedMessage": "The cluster will be provisioned as public with the following whitelist CIDRs: ",
           "duration": "48µs"
       },
       {
           "name": "Azure Available Subnets",
           "description": "When an existing Azure subnet is chosen for provisioning an AKS cluster, the subnet must not be in use by any other cluster. This is a restriction of Kubenet, which is the CNI used on the new cluster. Although the subnet may have a routing table, it may not have any existing IP address associations.",
           "category": "NETWORK",
           "status": "PASSED",
           "message": "At least 1 valid subnet was found and can be used for cluster creation.",
           "detailedMessage": "The cluster can be provisioned using subnet liftie-dev.internal.2.westus2 in virtual network liftie-dev and resource group liftie-test",
           "duration": "917ms"
       },
       {
           "name": "Kubernetes API Server CIDR Security",
           "description": "CIDR blocks for whitelisting access to the Kubernetes API Server must not overlap restricted IP ranges.",
           "category": "NETWORK",
           "status": "SKIPPED",
           "message": "Skipping CIDR validation for whitelisting because it is not enabled.",
           "detailedMessage": "The ability to secure access the Kubernetes API server via a list of allowed CIDRs is not enabled. This can be enabled either in the controlplane (currently false) or via the provisioning request (currently false).",
           "duration": "11µs"
       },
       {
           "name": "Service CIDR Validation",
           "description": "CIDR blocks that Kubernetes assigns service IP addresses from should not overlap with any other networks that are peered or connected to existing VPC.",
           "category": "NETWORK",
           "status": "SKIPPED",
           "message": "Service CIDR is missing in Network Profile.",
           "detailedMessage": "VPC validation is executed only if the VPC already exists and a service CIDR is specified in the network profile.",
           "duration": "426µs"
       },
       {
           "name": "Azure Autoscale Parameters",
           "description": "The following autoscale parameters for Azure, which are specified during provisioning and update, need to be in multiples of 60s. Autoscale parameters: scaleDownDelayAfterAdd, scaleDownDelayAfterFailure, scaleDownUnneededTime, scaleDownUnreadyTime.",
           "category": "DEPLOYMENT",
           "status": "SKIPPED",
           "message": "There are no autoscale parameters specified in the request.",
           "detailedMessage": "The request did not contain an Autoscaler structure.",
           "duration": "0s"
       }
   ]
}