├── _config.yml ├── manual-way ├── ansible │ ├── templates │ │ ├── 99-loopback.conf.j2 │ │ ├── kube-scheduler.service.j2 │ │ ├── 10-bridge.conf.j2 │ │ ├── kube-proxy.service.j2 │ │ ├── kube-controller-manager.service.j2 │ │ ├── kubelet.service.j2 │ │ ├── etcd.service.j2 │ │ └── kube-apiserver.service.j2 │ ├── inventory │ │ └── hosts │ ├── configureNetwork.yaml │ ├── configureContainerd.yaml │ ├── configureEtcd.yaml │ ├── configureSecurity.yaml │ ├── configureMasters.yaml │ └── configureNodes.yaml ├── scripts │ ├── install_kubectl.sh │ ├── install_cfssl.sh │ ├── configure_admin_client.sh │ ├── generate_node_certs.sh │ ├── generate_node_kubeconfig.sh │ ├── generate_kubeconfig.sh │ └── generate_certificates.sh ├── config │ ├── admin-csr.json │ ├── ca-csr.json │ ├── ca-config.json │ ├── kubernetes-csr.json │ ├── kube-proxy-csr.json │ └── kube-flannel-for-vagrant.yaml ├── README.md ├── k8s_run_old ├── setUpCluster.sh ├── kube-flannel-vagrant.yml └── kube-dns.yaml ├── vagrant ├── etc_hosts ├── Vagrantfile └── README.md ├── heapster ├── README.md ├── heapster-rbac.yaml ├── config │ ├── heapster-rbac.yaml │ ├── influxdb.yaml │ ├── heapster.yaml │ └── grafana.yaml ├── influxdb.yaml ├── heapster.yaml └── grafana.yaml ├── .gitignore ├── kubeadm-way ├── ansible │ ├── configureClient.yaml │ ├── installKubernetes.yaml │ ├── inventory │ │ └── hosts │ ├── installDocker.yaml │ └── bootstrapCluster.yaml ├── run.sh └── README.md ├── installKubeCtl.sh ├── README.md └── LICENSE /_config.yml: -------------------------------------------------------------------------------- 1 | theme: jekyll-theme-tactile -------------------------------------------------------------------------------- /manual-way/ansible/templates/99-loopback.conf.j2: -------------------------------------------------------------------------------- 1 | { 2 | "cniVersion": "0.3.1", 3 | "type": "loopback" 4 | } -------------------------------------------------------------------------------- /vagrant/etc_hosts: -------------------------------------------------------------------------------- 1 | 10.240.0.21 node1 2 | 10.240.0.22 node2 3 | 10.240.0.23 node3 4 | 10.240.0.24 node4 -------------------------------------------------------------------------------- /heapster/README.md: -------------------------------------------------------------------------------- 1 | ## Install Heapster in Kubernetes Cluster 2 | Run: 3 | ```bash 4 | kubectl create -f config/ 5 | ``` 6 | 7 | For more details visit: https://github.com/kubernetes/heapster -------------------------------------------------------------------------------- /manual-way/scripts/install_kubectl.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | wget https://storage.googleapis.com/kubernetes-release/release/v1.8.0/bin/linux/amd64/kubectl 4 | chmod +x kubectl 5 | sudo mv kubectl /usr/local/bin/ 6 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # IntelliJ project files 2 | .idea 3 | *.iml 4 | out 5 | gen 6 | 7 | # Vagrant files 8 | .vagrant/ 9 | 10 | # Log files 11 | *.log 12 | 13 | # Ansible files 14 | *.retry 15 | 16 | # Genereted files 17 | tmp/ 18 | node*-csr.json 19 | -------------------------------------------------------------------------------- /kubeadm-way/ansible/configureClient.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: master 3 | tasks: 4 | - name: Fetch configuration files from master node 5 | fetch: 6 | src: /home/ubuntu/.kube/config 7 | dest: ../tmp/ 8 | flat: yes 9 | become: true 10 | run_once: true -------------------------------------------------------------------------------- /manual-way/config/admin-csr.json: -------------------------------------------------------------------------------- 1 | { 2 | "CN": "admin", 3 | "key": { 4 | "algo": "rsa", 5 | "size": 2048 6 | }, 7 | "names": [ 8 | { 9 | "C": "PL", 10 | "L": "Krakow", 11 | "O": "system:masters", 12 | "OU": "Kubernetes The Hard Way" 13 | } 14 | ] 15 | } 16 | -------------------------------------------------------------------------------- /manual-way/config/ca-csr.json: -------------------------------------------------------------------------------- 1 | { 2 | "CN": "example.com", 3 | "key": { 4 | "algo": "rsa", 5 | "size": 2048 6 | }, 7 | "names": [ 8 | { 9 | "C": "PL", 10 | "L": "Krakow", 11 | "O": "JNC Certificate Authority", 12 | "OU": "RnD Department" 13 | } 14 | ] 15 | } 16 | -------------------------------------------------------------------------------- /manual-way/config/ca-config.json: -------------------------------------------------------------------------------- 1 | { 2 | "signing": { 3 | "default": { 4 | "expiry": "8760h" 5 | }, 6 | "profiles": { 7 | "kubernetes": { 8 | "usages": ["signing", "key encipherment", "server auth", "client auth"], 9 | "expiry": "8760h" 10 | } 11 | } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /heapster/heapster-rbac.yaml: -------------------------------------------------------------------------------- 1 | kind: ClusterRoleBinding 2 | apiVersion: rbac.authorization.k8s.io/v1beta1 3 | metadata: 4 | name: heapster 5 | roleRef: 6 | apiGroup: rbac.authorization.k8s.io 7 | kind: ClusterRole 8 | name: system:heapster 9 | subjects: 10 | - kind: ServiceAccount 11 | name: heapster 12 | namespace: kube-system 13 | -------------------------------------------------------------------------------- /manual-way/config/kubernetes-csr.json: -------------------------------------------------------------------------------- 1 | { 2 | "CN": "kubernetes", 3 | "key": { 4 | "algo": "rsa", 5 | "size": 2048 6 | }, 7 | "names": [ 8 | { 9 | "C": "US", 10 | "L": "Portland", 11 | "O": "Kubernetes", 12 | "OU": "Kubernetes The Hard Way", 13 | "ST": "Oregon" 14 | } 15 | ] 16 | } 17 | -------------------------------------------------------------------------------- /heapster/config/heapster-rbac.yaml: -------------------------------------------------------------------------------- 1 | kind: ClusterRoleBinding 2 | apiVersion: rbac.authorization.k8s.io/v1beta1 3 | metadata: 4 | name: heapster 5 | roleRef: 6 | apiGroup: rbac.authorization.k8s.io 7 | kind: ClusterRole 8 | name: system:heapster 9 | subjects: 10 | - kind: ServiceAccount 11 | name: heapster 12 | namespace: kube-system 13 | -------------------------------------------------------------------------------- /manual-way/config/kube-proxy-csr.json: -------------------------------------------------------------------------------- 1 | { 2 | "CN": "system:kube-proxy", 3 | "key": { 4 | "algo": "rsa", 5 | "size": 2048 6 | }, 7 | "names": [ 8 | { 9 | "C": "US", 10 | "L": "Portland", 11 | "O": "system:node-proxier", 12 | "OU": "Kubernetes The Hard Way", 13 | "ST": "Oregon" 14 | } 15 | ] 16 | } 17 | -------------------------------------------------------------------------------- /manual-way/ansible/templates/kube-scheduler.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Kubernetes Scheduler 3 | Documentation=https://github.com/kubernetes/kubernetes 4 | 5 | [Service] 6 | ExecStart=/usr/local/bin/kube-scheduler \ 7 | --leader-elect=true \ 8 | --master=http://127.0.0.1:8080 \ 9 | --v=2 10 | Restart=on-failure 11 | RestartSec=5 12 | 13 | [Install] 14 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /manual-way/scripts/install_cfssl.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | wget -q --show-progress --https-only --timestamping \ 4 | https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \ 5 | https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 6 | 7 | chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 8 | 9 | sudo mv cfssl_linux-amd64 /usr/local/bin/cfssl 10 | sudo mv cfssljson_linux-amd64 /usr/local/bin/cfssljson 11 | -------------------------------------------------------------------------------- /installKubeCtl.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | echo "Download latest kubectl" 3 | curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl 4 | chmod +x ./kubectl 5 | sudo mv ./kubectl /usr/local/bin/kubectl 6 | 7 | echo "Configure kubectl autocompletion" 8 | echo "source <(kubectl completion bash)" >> ~/.bashrc -------------------------------------------------------------------------------- /manual-way/ansible/templates/10-bridge.conf.j2: -------------------------------------------------------------------------------- 1 | { 2 | "cniVersion": "0.3.1", 3 | "name": "bridge", 4 | "type": "bridge", 5 | "bridge": "cnio0", 6 | "isGateway": true, 7 | "ipMasq": true, 8 | "ipam": { 9 | "type": "host-local", 10 | "ranges": [ 11 | [{"subnet": "{{ pod_cidr }}"}] 12 | ], 13 | "routes": [{"dst": "0.0.0.0/0"}] 14 | } 15 | } -------------------------------------------------------------------------------- /manual-way/ansible/templates/kube-proxy.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Kubernetes Kube Proxy 3 | Documentation=https://github.com/kubernetes/kubernetes 4 | 5 | [Service] 6 | ExecStart=/usr/local/bin/kube-proxy \ 7 | --cluster-cidr=10.244.0.0/16 \ 8 | --kubeconfig=/var/lib/kube-proxy/kubeconfig \ 9 | --proxy-mode=iptables \ 10 | --masquerade-all \ 11 | --v=2 12 | Restart=on-failure 13 | RestartSec=5 14 | 15 | [Install] 16 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Kubernetes Training Repository 2 | This repository contains Kubernetes training. 3 | 4 | ## Bootstrap a Kubernetes Cluster 5 | Following ways of bootsrapping a Kubernetes Cluster across Virtual Machines (Ubuntu) are covered: 6 | - [Kubeadm](kubeadm-way) - quick and simple solution to run a Cluster with separate Master and multiple Workers on different Virtual Machines 7 | - [Manual](manual-way) - complex way of running a Cluster from scratch with multiple Masters and Workers across different Virtual Machines 8 | 9 | ## Install Heapster 10 | TODO -------------------------------------------------------------------------------- /kubeadm-way/ansible/installKubernetes.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: kubeadm 3 | become: true 4 | 5 | tasks: 6 | - name: Add Kubernetes repository key 7 | apt_key: url=https://packages.cloud.google.com/apt/doc/apt-key.gpg 8 | 9 | - name: Add Kubernetes repository 10 | apt_repository: repo='deb http://apt.kubernetes.io/ kubernetes-xenial main' state=present 11 | 12 | - name: Install kubelet, kubeadm, kubectl 13 | apt: name={{item}} state=installed 14 | with_items: 15 | - kubelet 16 | - kubeadm 17 | - kubectl 18 | -------------------------------------------------------------------------------- /manual-way/scripts/configure_admin_client.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | kubectl config set-cluster $KUBERNETES_CLUSTER \ 4 | --certificate-authority=$CERTS_GEN_DIR/ca.pem \ 5 | --embed-certs=true \ 6 | --server=https://${KUBERNETES_PUBLIC_ADDRESS}:6443 7 | 8 | kubectl config set-credentials admin \ 9 | --client-certificate=$CERTS_GEN_DIR/admin.pem \ 10 | --client-key=$CERTS_GEN_DIR/admin-key.pem 11 | 12 | kubectl config set-context $KUBERNETES_CLUSTER \ 13 | --cluster=$KUBERNETES_CLUSTER \ 14 | --user=admin 15 | 16 | kubectl config use-context $KUBERNETES_CLUSTER -------------------------------------------------------------------------------- /kubeadm-way/ansible/inventory/hosts: -------------------------------------------------------------------------------- 1 | # Ansible inventory file 2 | 3 | [master] 4 | 10.240.0.21 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 5 | 6 | [worker] 7 | 10.240.0.22 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 8 | 10.240.0.23 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 9 | 10.240.0.24 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 10 | 11 | [docker:children] 12 | master 13 | worker 14 | 15 | [kubeadm:children] 16 | master 17 | worker 18 | 19 | [all:vars] 20 | MASTER_API_IP=10.240.0.21 21 | POD_NETWORK_CIDR=10.244.0.0/16 22 | SERVICE_CIDR=10.96.0.0/12 -------------------------------------------------------------------------------- /manual-way/ansible/inventory/hosts: -------------------------------------------------------------------------------- 1 | # Ansible inventory file 2 | 3 | [master] 4 | node1 ansible_host=10.240.0.21 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 pod_cidr=10.200.21.0/24 5 | node2 ansible_host=10.240.0.22 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 pod_cidr=10.200.22.0/24 6 | 7 | [node] 8 | node3 ansible_host=10.240.0.23 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 pod_cidr=10.200.23.0/24 9 | node4 ansible_host=10.240.0.24 ansible_user=ubuntu ansible_python_interpreter=/usr/bin/python3 pod_cidr=10.200.24.0/24 10 | 11 | [etcd:children] 12 | master 13 | 14 | [all:vars] 15 | master_api_ip=10.240.0.21 -------------------------------------------------------------------------------- /kubeadm-way/run.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | export ANSIBLE_HOST_KEY_CHECKING=False 3 | export ANSIBLE_INVENTORY="ansible/inventory/hosts" 4 | export PRIVATE_KEY="~/.ssh/id_rsa" 5 | 6 | echo "# Install Docker" 7 | ansible-playbook -i $ANSIBLE_INVENTORY --private-key $PRIVATE_KEY ansible/installDocker.yaml 8 | 9 | echo "# Install kubeadm" 10 | ansible-playbook -i $ANSIBLE_INVENTORY --private-key $PRIVATE_KEY ansible/installKubernetes.yaml 11 | 12 | echo "# Bootstrap cluster" 13 | ansible-playbook -i $ANSIBLE_INVENTORY --private-key $PRIVATE_KEY ansible/bootstrapCluster.yaml 14 | 15 | echo "# Configure local client" 16 | ansible-playbook -i $ANSIBLE_INVENTORY --private-key $PRIVATE_KEY ansible/configureClient.yaml 17 | -------------------------------------------------------------------------------- /manual-way/ansible/templates/kube-controller-manager.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Kubernetes Controller Manager 3 | Documentation=https://github.com/kubernetes/kubernetes 4 | 5 | [Service] 6 | ExecStart=/usr/local/bin/kube-controller-manager \ 7 | --address=0.0.0.0 \ 8 | --allocate-node-cidrs=true \ 9 | --cluster-cidr=10.244.0.0/16 \ 10 | --cluster-name=kubernetes \ 11 | --cluster-signing-cert-file=/var/lib/kubernetes/ca.pem \ 12 | --cluster-signing-key-file=/var/lib/kubernetes/ca-key.pem \ 13 | --leader-elect=true \ 14 | --master=http://127.0.0.1:8080 \ 15 | --root-ca-file=/var/lib/kubernetes/ca.pem \ 16 | --service-account-private-key-file=/var/lib/kubernetes/ca-key.pem \ 17 | --service-cluster-ip-range=10.32.0.0/24 \ 18 | --v=2 19 | Restart=on-failure 20 | RestartSec=5 21 | 22 | [Install] 23 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /manual-way/ansible/configureNetwork.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: node 3 | 4 | tasks: 5 | # - name: configure static route 6 | # shell: | 7 | # route add -net 10.200.23.0/24 gw 10.240.0.23 dev enp0s8 8 | # route add -net 10.200.24.0/24 gw 10.240.0.24 dev enp0s8 9 | # become: true 10 | # register: command_result 11 | # failed_when: "not(command_result.rc == 0 or 'SIOCADDRT: File exists' in command_result.stderr)" 12 | # 13 | 14 | - name: Create directories 15 | file: path={{ item }} state=directory 16 | become: true 17 | with_items: 18 | - "/opt/cni/bin/" 19 | 20 | - name: "Get CNI plugins" 21 | unarchive: 22 | src: https://github.com/containernetworking/plugins/releases/download/v0.6.0/cni-plugins-amd64-v0.6.0.tgz 23 | dest: /opt/cni/bin/ 24 | remote_src: yes 25 | become: true -------------------------------------------------------------------------------- /kubeadm-way/README.md: -------------------------------------------------------------------------------- 1 | # Bootstrapping a Kubernetes Cluster with kubeadm 2 | This scripts will run a Kubernetes Cluster with use of kubeadm tool. 3 | Three steps will be executed: 4 | 1. Docker installation on all nodes 5 | 2. Installation of Kubernetes binaries (_kubelet_, _kubectl_, _kubeadm_) 6 | 3. Bootstraping of the Cluster with `kubeadm init` and `kubeadm join` 7 | 8 | ## Prerequisites 9 | - [ ] [Ansible](http://docs.ansible.com/ansible/latest/intro_installation.html) installed on host machine 10 | - [ ] Virtual Machines up and running - use [Vagrant](../vagrant) to run preconfigured VMs 11 | 12 | ## Configuration 13 | Cluster configuration can be found in [Ansible inventory file](ansible/inventory/hosts). 14 | 15 | ## Run script to set up Kubernetes Cluster 16 | ```bash 17 | ./run.sh 18 | ``` 19 | 20 | ## Credits 21 | - [Kubernetes Documentation](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm) 22 | -------------------------------------------------------------------------------- /manual-way/scripts/generate_node_certs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | NODES_NUMBER=$1 3 | 4 | echo "Generate certificates for $NODES_NUMBER nodes" 5 | 6 | for i in $(seq 1 $NODES_NUMBER); 7 | do 8 | NODE=node$i 9 | 10 | echo "Generate cert for node: $NODE" 11 | cat > $CONFIG_DIR/$NODE-csr.json <> /etc/hosts" 26 | end 27 | end 28 | end 29 | -------------------------------------------------------------------------------- /manual-way/scripts/generate_node_kubeconfig.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | NODES_NUMBER=$1 3 | 4 | echo "Generate config for $NODES_NUMBER nodes" 5 | 6 | for i in $(seq 1 $NODES_NUMBER); 7 | do 8 | echo "Generate config for node: $i" 9 | 10 | kubectl config set-cluster $KUBERNETES_CLUSTER \ 11 | --certificate-authority=$CERTS_GEN_DIR/ca.pem \ 12 | --embed-certs=true \ 13 | --server=https://$KUBERNETES_PUBLIC_ADDRESS:6443 \ 14 | --kubeconfig=$KUBECONFIG_DIR/node$i.kubeconfig 15 | 16 | kubectl config set-credentials system:node:node$i \ 17 | --client-certificate=$CERTS_GEN_DIR/node$i.pem \ 18 | --client-key=$CERTS_GEN_DIR/node$i-key.pem \ 19 | --embed-certs=true \ 20 | --kubeconfig=$KUBECONFIG_DIR/node$i.kubeconfig 21 | 22 | kubectl config set-context default \ 23 | --cluster=$KUBERNETES_CLUSTER \ 24 | --user=system:node:node$i \ 25 | --kubeconfig=$KUBECONFIG_DIR/node$i.kubeconfig 26 | 27 | kubectl config use-context default --kubeconfig=$KUBECONFIG_DIR/node$i.kubeconfig 28 | 29 | done -------------------------------------------------------------------------------- /manual-way/scripts/generate_kubeconfig.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | NODES_NUMBER=$1 3 | 4 | mkdir -p $KUBECONFIG_DIR/ && cd $KUBECONFIG_DIR/ 5 | 6 | # kube-proxy configuration file 7 | echo "Generate kube-proxy configuration file" 8 | 9 | kubectl config set-cluster $KUBERNETES_CLUSTER \ 10 | --certificate-authority=$CERTS_GEN_DIR/ca.pem \ 11 | --embed-certs=true \ 12 | --server=https://$KUBERNETES_PUBLIC_ADDRESS:6443 \ 13 | --kubeconfig=$KUBECONFIG_DIR/kube-proxy.kubeconfig 14 | 15 | kubectl config set-credentials kube-proxy \ 16 | --client-certificate=$CERTS_GEN_DIR/kube-proxy.pem \ 17 | --client-key=$CERTS_GEN_DIR/kube-proxy-key.pem \ 18 | --embed-certs=true \ 19 | --kubeconfig=$KUBECONFIG_DIR/kube-proxy.kubeconfig 20 | 21 | kubectl config set-context default \ 22 | --cluster=$KUBERNETES_CLUSTER \ 23 | --user=kube-proxy \ 24 | --kubeconfig=$KUBECONFIG_DIR/kube-proxy.kubeconfig 25 | 26 | kubectl config use-context default --kubeconfig=$KUBECONFIG_DIR/kube-proxy.kubeconfig 27 | 28 | # GENERATE NODES CERTS 29 | echo "## GENERATE NODES CERTS" 30 | $SCRIPTS_DIR/generate_node_kubeconfig.sh $NODES_NUMBER 31 | -------------------------------------------------------------------------------- /manual-way/ansible/templates/kubelet.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Kubernetes Kubelet 3 | Documentation=https://github.com/kubernetes/kubernetes 4 | After=cri-containerd.service 5 | Requires=cri-containerd.service 6 | 7 | [Service] 8 | ExecStart=/usr/local/bin/kubelet \ 9 | --allow-privileged=true \ 10 | --anonymous-auth=false \ 11 | --authorization-mode=Webhook \ 12 | --client-ca-file=/var/lib/kubernetes/ca.pem \ 13 | --cloud-provider="" \ 14 | --cluster-dns=10.32.0.10 \ 15 | --cluster-domain=cluster.local \ 16 | --node-ip={{ ansible_host }} \ 17 | --container-runtime=remote \ 18 | --container-runtime-endpoint=unix:///var/run/cri-containerd.sock \ 19 | --runtime-request-timeout=15m \ 20 | --image-pull-progress-deadline=2m \ 21 | --kubeconfig=/var/lib/kubelet/kubeconfig \ 22 | --network-plugin=cni \ 23 | --pod-cidr={{ pod_cidr }} \ 24 | --register-node=true \ 25 | --tls-cert-file=/var/lib/kubelet/{{ inventory_hostname }}.pem \ 26 | --tls-private-key-file=/var/lib/kubelet/{{ inventory_hostname }}-key.pem \ 27 | --v=2 28 | Restart=on-failure 29 | RestartSec=5 30 | 31 | [Install] 32 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /heapster/influxdb.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: extensions/v1beta1 2 | kind: Deployment 3 | metadata: 4 | name: monitoring-influxdb 5 | namespace: kube-system 6 | spec: 7 | replicas: 1 8 | template: 9 | metadata: 10 | labels: 11 | task: monitoring 12 | k8s-app: influxdb 13 | spec: 14 | containers: 15 | - name: influxdb 16 | image: k8s.gcr.io/heapster-influxdb-amd64:v1.3.3 17 | volumeMounts: 18 | - mountPath: /data 19 | name: influxdb-storage 20 | volumes: 21 | - name: influxdb-storage 22 | emptyDir: {} 23 | --- 24 | apiVersion: v1 25 | kind: Service 26 | metadata: 27 | labels: 28 | task: monitoring 29 | # For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons) 30 | # If you are NOT using this as an addon, you should comment out this line. 31 | kubernetes.io/cluster-service: 'true' 32 | kubernetes.io/name: monitoring-influxdb 33 | name: monitoring-influxdb 34 | namespace: kube-system 35 | spec: 36 | ports: 37 | - port: 8086 38 | targetPort: 8086 39 | selector: 40 | k8s-app: influxdb 41 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2018 Jakub Nowakowski 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /heapster/config/influxdb.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: extensions/v1beta1 2 | kind: Deployment 3 | metadata: 4 | name: monitoring-influxdb 5 | namespace: kube-system 6 | spec: 7 | replicas: 1 8 | template: 9 | metadata: 10 | labels: 11 | task: monitoring 12 | k8s-app: influxdb 13 | spec: 14 | containers: 15 | - name: influxdb 16 | image: k8s.gcr.io/heapster-influxdb-amd64:v1.3.3 17 | volumeMounts: 18 | - mountPath: /data 19 | name: influxdb-storage 20 | volumes: 21 | - name: influxdb-storage 22 | emptyDir: {} 23 | --- 24 | apiVersion: v1 25 | kind: Service 26 | metadata: 27 | labels: 28 | task: monitoring 29 | # For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons) 30 | # If you are NOT using this as an addon, you should comment out this line. 31 | kubernetes.io/cluster-service: 'true' 32 | kubernetes.io/name: monitoring-influxdb 33 | name: monitoring-influxdb 34 | namespace: kube-system 35 | spec: 36 | ports: 37 | - port: 8086 38 | targetPort: 8086 39 | selector: 40 | k8s-app: influxdb 41 | -------------------------------------------------------------------------------- /kubeadm-way/ansible/installDocker.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: docker 3 | become: true 4 | 5 | vars: 6 | dockerPackage: "docker-ce" 7 | dockerVersion: "17.03.2~ce-0~ubuntu-xenial" 8 | lsbRelease: "xenial" 9 | 10 | handlers: 11 | - name: Restart server 12 | shell: sleep 5 && shutdown -r now "Reboot triggered by Ansible script" 13 | async: 1 14 | poll: 0 15 | - name: Wait for server to restart 16 | wait_for_connection: 17 | args: 18 | delay: 15 19 | timeout: 120 20 | 21 | tasks: 22 | - name: Add Docker repository key 23 | apt_key: url=https://download.docker.com/linux/ubuntu/gpg 24 | 25 | - name: Add Docker repository 26 | apt_repository: repo='deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ lsbRelease }} stable' state=present 27 | 28 | - name: Install docker-ce 29 | apt: name={{dockerPackage}}={{dockerVersion}} state=present update_cache=yes 30 | 31 | - name: Add user to docker group 32 | user: 33 | name: "{{ansible_user}}" 34 | append: yes 35 | groups: docker 36 | notify: 37 | - Restart server 38 | - Wait for server to restart 39 | -------------------------------------------------------------------------------- /manual-way/README.md: -------------------------------------------------------------------------------- 1 | # Bootstrapping a Kubernetes Cluster from Scratch 2 | This scripts will run a Kubernetes Cluster from scratch. 3 | 4 | IN PROGRESS... 5 | 6 | ## Prerequisites 7 | - [X] [Ansible](http://docs.ansible.com/ansible/latest/intro_installation.html) installed on host machine 8 | - [X] Virtual Machines up and running - use [Vagrant](../vagrant) to run preconfigured VMs 9 | 10 | 11 | ## Run script to set up Kubernetes Cluster 12 | ```bash 13 | ./setUpCluster.sh 14 | ``` 15 | 16 | ## Credits 17 | - [Kubernetes The Hard Way Tutorial](https://github.com/kelseyhightower/kubernetes-the-hard-way) by @kelseyhightower 18 | - Kubernetes Documentation - [Creating a Custom Cluster from Scratch](https://kubernetes.io/docs/getting-started-guides/scratch) 19 | 20 | 21 | ## Run E2E tests 22 | 23 | IN PROGRESS... 24 | 25 | - [Install golang](https://golang.org/doc/install) 26 | 27 | https://github.com/kubernetes/community/blob/master/contributors/devel/e2e-tests.md#testing-against-local-clusters 28 | ```bash 29 | export KUBECONFIG=/etc/kubernetes/admin.conf 30 | export KUBE_MASTER_IP="127.0.0.1:6443" 31 | export KUBE_MASTER=local 32 | go run hack/e2e.go -- --provider=local -v --test 33 | ``` 34 | -------------------------------------------------------------------------------- /manual-way/ansible/templates/etcd.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=etcd 3 | Documentation=https://github.com/coreos 4 | 5 | [Service] 6 | ExecStart=/usr/local/bin/etcd \ 7 | --name {{ inventory_hostname }} \ 8 | --cert-file=/etc/etcd/kubernetes.pem \ 9 | --key-file=/etc/etcd/kubernetes-key.pem \ 10 | --peer-cert-file=/etc/etcd/kubernetes.pem \ 11 | --peer-key-file=/etc/etcd/kubernetes-key.pem \ 12 | --trusted-ca-file=/etc/etcd/ca.pem \ 13 | --peer-trusted-ca-file=/etc/etcd/ca.pem \ 14 | --peer-client-cert-auth \ 15 | --client-cert-auth \ 16 | --initial-advertise-peer-urls https://{{ ansible_host }}:2380 \ 17 | --listen-peer-urls https://{{ ansible_host }}:2380 \ 18 | --listen-client-urls https://{{ ansible_host }}:2379,http://127.0.0.1:2379 \ 19 | --advertise-client-urls https://{{ ansible_host }}:2379 \ 20 | --initial-cluster-token etcd-cluster-0 \ 21 | --initial-cluster {% for host in groups['etcd'] %}{{ hostvars[host].inventory_hostname }}=https://{{ hostvars[host].ansible_host }}:2380{% if not loop.last %},{% endif %}{% endfor %} \ 22 | --initial-cluster-state new \ 23 | --data-dir=/var/lib/etcd 24 | Restart=on-failure 25 | RestartSec=5 26 | 27 | [Install] 28 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /manual-way/ansible/configureContainerd.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: node 3 | 4 | tasks: 5 | - name: Install dependencies 6 | apt: name={{ item }} state=installed update_cache=yes 7 | become: yes 8 | with_items: 9 | - "libseccomp2" 10 | # - "libapparmor" 11 | # - "btrfs-tools" 12 | # - "nsenter" 13 | 14 | # The socat binary enables support for the kubectl port-forward command. 15 | - name: Install socat 16 | apt: name=socat state=installed update_cache=yes 17 | become: yes 18 | 19 | 20 | - name: "Get CRI containerd" 21 | unarchive: 22 | src: https://github.com/containerd/cri-containerd/releases/download/v1.0.0-beta.1/cri-containerd-1.0.0-beta.1.linux-amd64.tar.gz 23 | dest: / 24 | remote_src: yes 25 | become: true 26 | 27 | - name: Create directories 28 | file: path={{ item }} state=directory 29 | with_items: 30 | - "/opt/cni/bin/" 31 | - "/etc/cni/net.d/" 32 | become: true 33 | 34 | - name: "Start systemd services" 35 | systemd: 36 | state: restarted 37 | daemon_reload: yes 38 | enabled: yes 39 | name: "{{ item }}" 40 | with_items: 41 | - "containerd" 42 | - "cri-containerd" 43 | become: true -------------------------------------------------------------------------------- /heapster/heapster.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ServiceAccount 3 | metadata: 4 | name: heapster 5 | namespace: kube-system 6 | --- 7 | apiVersion: extensions/v1beta1 8 | kind: Deployment 9 | metadata: 10 | name: heapster 11 | namespace: kube-system 12 | spec: 13 | replicas: 1 14 | template: 15 | metadata: 16 | labels: 17 | task: monitoring 18 | k8s-app: heapster 19 | spec: 20 | serviceAccountName: heapster 21 | containers: 22 | - name: heapster 23 | image: k8s.gcr.io/heapster-amd64:v1.4.2 24 | imagePullPolicy: IfNotPresent 25 | command: 26 | - /heapster 27 | - --source=kubernetes:https://kubernetes.default 28 | - --sink=influxdb:http://monitoring-influxdb.kube-system.svc:8086 29 | --- 30 | apiVersion: v1 31 | kind: Service 32 | metadata: 33 | labels: 34 | task: monitoring 35 | # For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons) 36 | # If you are NOT using this as an addon, you should comment out this line. 37 | kubernetes.io/cluster-service: 'true' 38 | kubernetes.io/name: Heapster 39 | name: heapster 40 | namespace: kube-system 41 | spec: 42 | ports: 43 | - port: 80 44 | targetPort: 8082 45 | selector: 46 | k8s-app: heapster 47 | -------------------------------------------------------------------------------- /heapster/config/heapster.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ServiceAccount 3 | metadata: 4 | name: heapster 5 | namespace: kube-system 6 | --- 7 | apiVersion: extensions/v1beta1 8 | kind: Deployment 9 | metadata: 10 | name: heapster 11 | namespace: kube-system 12 | spec: 13 | replicas: 1 14 | template: 15 | metadata: 16 | labels: 17 | task: monitoring 18 | k8s-app: heapster 19 | spec: 20 | serviceAccountName: heapster 21 | containers: 22 | - name: heapster 23 | image: k8s.gcr.io/heapster-amd64:v1.4.2 24 | imagePullPolicy: IfNotPresent 25 | command: 26 | - /heapster 27 | - --source=kubernetes:https://kubernetes.default 28 | - --sink=influxdb:http://monitoring-influxdb.kube-system.svc:8086 29 | --- 30 | apiVersion: v1 31 | kind: Service 32 | metadata: 33 | labels: 34 | task: monitoring 35 | # For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons) 36 | # If you are NOT using this as an addon, you should comment out this line. 37 | kubernetes.io/cluster-service: 'true' 38 | kubernetes.io/name: Heapster 39 | name: heapster 40 | namespace: kube-system 41 | spec: 42 | ports: 43 | - port: 80 44 | targetPort: 8082 45 | selector: 46 | k8s-app: heapster 47 | -------------------------------------------------------------------------------- /manual-way/scripts/generate_certificates.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | NODES_NUMBER=$1 3 | 4 | mkdir -p $CERTS_GEN_DIR/ && cd $CERTS_GEN_DIR/ 5 | 6 | ## GENERATE CA 7 | echo "## GENERATE CA" 8 | cfssl gencert -initca $CONFIG_DIR/ca-csr.json | cfssljson -bare ca 9 | 10 | ## GENERATE ADMIN CLIENT CERT 11 | echo "## GENERATE ADMIN CLIENT CERT" 12 | cfssl gencert \ 13 | -profile=kubernetes \ 14 | -ca=$CERTS_GEN_DIR/ca.pem \ 15 | -ca-key=$CERTS_GEN_DIR/ca-key.pem \ 16 | -config=$CONFIG_DIR/ca-config.json \ 17 | $CONFIG_DIR/admin-csr.json | cfssljson -bare admin 18 | 19 | # GENERATE NODES CERTS 20 | echo "## GENERATE NODES CERTS" 21 | $SCRIPTS_DIR/generate_node_certs.sh $NODES_NUMBER 22 | 23 | # GENERATE KUBE-PROXY CERT 24 | echo "## GENERATE KUBE-PROXY CERT" 25 | cfssl gencert \ 26 | -profile=kubernetes \ 27 | -ca=$CERTS_GEN_DIR/ca.pem \ 28 | -ca-key=$CERTS_GEN_DIR/ca-key.pem \ 29 | -config=$CONFIG_DIR/ca-config.json \ 30 | $CONFIG_DIR/kube-proxy-csr.json | cfssljson -bare kube-proxy 31 | 32 | echo "## GENERATE API SERVER CERT" 33 | cfssl gencert \ 34 | -profile=kubernetes \ 35 | -ca=$CERTS_GEN_DIR/ca.pem \ 36 | -ca-key=$CERTS_GEN_DIR/ca-key.pem \ 37 | -config=$CONFIG_DIR/ca-config.json \ 38 | -hostname=10.32.0.1,10.240.0.21,10.240.0.22,$KUBERNETES_PUBLIC_ADDRESS,127.0.0.1,kubernetes.default \ 39 | $CONFIG_DIR/kubernetes-csr.json | cfssljson -bare kubernetes 40 | 41 | -------------------------------------------------------------------------------- /manual-way/ansible/configureEtcd.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: etcd 3 | 4 | vars: 5 | certGenDir: "{{ lookup('env','CERTS_GEN_DIR') }}" 6 | 7 | tasks: 8 | - stat: path=/usr/local/bin/etcd 9 | register: etcd_exists 10 | 11 | - name: "Get etcd" 12 | unarchive: 13 | src: https://github.com/coreos/etcd/releases/download/v3.2.11/etcd-v3.2.11-linux-amd64.tar.gz 14 | dest: . 15 | remote_src: yes 16 | when: etcd_exists.stat.exists == false 17 | 18 | - name: "Copy etcd to bin" 19 | copy: src="etcd-v3.2.11-linux-amd64/{{ item }}" dest="/usr/local/bin/" remote_src="yes" mode="+x" 20 | with_items: 21 | - "etcd" 22 | - "etcdctl" 23 | become: true 24 | 25 | - name: Create directories 26 | file: path={{ item }} state=directory 27 | with_items: 28 | - "/etc/etcd" 29 | - "/var/lib/etcd" 30 | become: true 31 | 32 | - name: "Copy certificates to etcd" 33 | copy: src={{ item }} dest="/etc/etcd/" 34 | with_items: 35 | - "{{ certGenDir }}/kubernetes-key.pem" 36 | - "{{ certGenDir }}/kubernetes.pem" 37 | - "{{ certGenDir }}/ca.pem" 38 | become: true 39 | 40 | - name: "Generate etcd.service file" 41 | template: 42 | src: templates/etcd.service.j2 43 | dest: /etc/systemd/system/etcd.service 44 | become: true 45 | 46 | - name: "Start etcd service" 47 | systemd: 48 | state: started 49 | daemon_reload: yes 50 | enabled: yes 51 | name: etcd 52 | become: true -------------------------------------------------------------------------------- /manual-way/ansible/configureSecurity.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: master 3 | 4 | tasks: 5 | - name: "Configure RBAC for Kubelet authorization - part 1" 6 | shell: 7 | cmd: | 8 | cat < $KUBECONFIG_DIR/encryption-config.yaml <