├── README.md
├── _config.yml
├── install_k8s.sh
├── install_new_node.sh
└── resources
    ├── glusterfs-volumeStore
        ├── glusterfs-enpoints.json
        ├── glusterfs-svc.json
        └── mysql-depl-example.yaml
    └── heapster
        ├── grafana-ingress.yaml
        ├── grafana-service.yaml
        ├── heapster-controller.yaml
        ├── heapster-service.yaml
        ├── influxdb-grafana-controller.yaml
        └── influxdb-service.yaml


/README.md:
--------------------------------------------------------------------------------
  1 | # THIS PROJECT IS DEPRECATED
  2 | 
  3 | I deprecated it because I can't maintain Kubernetes updates (and test them all). 
  4 | Currently I am focused on maintaining https://github.com/valentin2105/Kubernetes-Saltstack which 
  5 | allows the creation of a single node cluster, too. Using Saltstack is more generally flexible, and
  6 | also allows the creation of a production cluster.
  7 | 
  8 | **Other tools like Simplekube**: **[Minikube](https://github.com/kubernetes/minikube)**, **[k9s](https://k9ss.io/)**, **[microk8s](https://github.com/ubuntu/microk8s)**, etc. - these all focus on simple node installation.
  9 | 
 10 | ----
 11 | 
 12 | <img src="https://i.imgur.com/gMGVimd.png" width="500">
 13 | 
 14 | > Simple as a shell script. It allow you to deploy easily k8s for tests or learn purposes.
 15 | 
 16 | With Simplekube, you can install Kubernetes on Linux servers without have to plug with any cloud provider.
 17 | 
 18 | Just take a Linux empty box, clone the git repo, launch the script and have fun with k8s ! 
 19 | It come with few things like Kube-DNS, Calico, Helm, Firewall and IPv6 !
 20 | 
 21 | If you need, you can easily add new workers (from multi-clouds) !
 22 | 
 23 | ## How-to use it ?
 24 | 
 25 | #### 1- Tweak the head of `install_k8s.sh`
 26 |  
 27 | ```
 28 | # please change this value :
 29 | hostIP="__PUBLIC_OR_PRIVATE_IPV4__"
 30 | # -----------------------
 31 | k8sVersion="v1.8.1"
 32 | etcdVersion="v3.2.9"
 33 | dockerVersion="17.05.0-ce"
 34 | cniVersion="v0.6.0"
 35 | calicoCNIVersion="v1.11.0"
 36 | calicoctlVersion="v1.6.1"
 37 | cfsslVersion="v1.2.0"
 38 | helmVersion="v2.6.2"
 39 | ```
 40 | #### 2- Launch the script as user (with sudo power)
 41 | 
 42 | `./install_k8s.sh --master`
 43 | 
 44 | #### 3- You can now play with k8s (...)
 45 | ```
 46 | $- kubectl get cs 
 47 | NAME                 STATUS    MESSAGE              ERROR
 48 | controller-manager   Healthy   ok
 49 | scheduler            Healthy   ok
 50 | etcd-0               Healthy   {"health": "true"}
 51 | 
 52 | $- kubectl get pod --all-namespaces
 53 | NAMESPACE     NAME                                        READY     STATUS    RESTARTS   AGE
 54 | kube-system   calico-policy-controller-4180354049-63p5v   1/1       Running   0          4m
 55 | kube-system   kube-dns-1822236363-zzkdq                   4/4       Running   0          4m
 56 | kube-system   kubernetes-dashboard-3313488171-lff6h       1/1       Running   0          4m
 57 | kube-system   tiller-deploy-1884622320-0glqq              1/1       Running   0          4m
 58 | 
 59 | $- calicoctl get ippool
 60 | CIDR
 61 | 192.168.0.0/16
 62 | fd80:24e2:f998:72d6::/64
 63 | 
 64 | $- kubectl run -i -t alpine --image=alpine --restart=Never
 65 | / # ping6 google.com
 66 | PING google.com (2404:6800:4003:80d::200e): 56 data bytes
 67 | 64 bytes from 2404:6800:4003:80d::200e: seq=0 ttl=57 time=2.129 ms
 68 | ```
 69 | #### 4- Cluster's integrated components :
 70 | 
 71 |   - KubeDNS
 72 |   - HELM ready
 73 |   - KubeDashboard
 74 |   - RBAC only by default
 75 |   - Calico CNI plugin
 76 |   - Calico Policy controller 
 77 |   - Calicoctl tool
 78 |   - UFW to secure access (can be disabled)
 79 |   - ECDSA cluster certs w/ CFSSL
 80 |   - IPv4/IPv6
 81 | 
 82 | #### 5- Expose services :
 83 | 
 84 | You can expose easily your services with :
 85 | 
 86 |   - Only reachable on the machine : `ClusterIP`
 87 |   - Expose on high TCP ports : `NodePort`
 88 |   - Expose publicly : Service's `ExternalIPs`
 89 | 
 90 | 
 91 | #### 6- Add new nodes :
 92 | 
 93 | You can easily add new nodes to your cluster by launching `./install_new_worker.sh`
 94 | 
 95 | Before launch the script, be sure to tweak the head of the script :
 96 | ```
 97 | nodeIP="__PUBLIC_OR_PRIVATE_IPV4__"
 98 | sshUser="root"
 99 | setupFirewall="True"
100 | CAcountry="US"
101 | ```
102 | 
103 | ## Requirements
104 | 
105 | This script download each k8s components with `wget` and launch k8s with `systemd units`. 
106 | 
107 | You will need `socat`, `conntrack`, `sudo` and `git` on your servers. 
108 | 
109 | To add a node, you will need to setup `key-based` SSH authentification between master & workers.
110 | 
111 | If you want IPv6 on pods side, you need working IPv6 on hosts.
112 | 
113 | Simplekube is tested on `Debian 8/9` and `Ubuntu 16.x/17.x`.
114 | 
115 | Feel free to open an Issue if you need assistance !
116 | 


--------------------------------------------------------------------------------
/_config.yml:
--------------------------------------------------------------------------------
1 | theme: jekyll-theme-architect


--------------------------------------------------------------------------------
/install_k8s.sh:
--------------------------------------------------------------------------------
   1 | #! /bin/bash
   2 | # -----------------------
   3 | # please change this value :
   4 | hostIP="__PUBLIC_OR_PRIVATE_IPV4__"
   5 | # -----------------------
   6 | k8sVersion="v1.8.1"
   7 | etcdVersion="v3.2.9"
   8 | dockerVersion="17.05.0-ce"
   9 | cniVersion="v0.6.0"
  10 | calicoCNIVersion="v1.11.0"
  11 | calicoctlVersion="v1.6.1"
  12 | cfsslVersion="v1.2.0"
  13 | helmVersion="v2.6.2"
  14 | # -----------------------
  15 | clusterDomain="cluster.local" # Default k8s domain
  16 | enableIPv6="true" # Enable IPv6 on pod side (need IPv6 on host)
  17 | IPv6Pool="fd80:24e2:f998:72d6::/64" # Default Calico NAT IPv6 Pool
  18 | setupFirewall="True" # Setup UFW 
  19 | enableIPinIP="True" # IPinIP is needed if VMs are not in the same LAN
  20 | CAcountry="US"
  21 | # -----------------------
  22 | # -----------------------
  23 | adminToken=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)
  24 | kubeletToken=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)
  25 | 
  26 | hostname=$(hostname)
  27 | 
  28 | ## Let's go :
  29 | if [[ "$1" == "--master" ]]; then
  30 |         apt-get update && apt-get -y install socat conntrack
  31 | 
  32 | if [[ "$setupFirewall" == "True" ]]; then
  33 |         apt-get -y install ufw
  34 | 	ufw allow ssh
  35 |         ufw allow 6443/tcp
  36 |         ufw enable
  37 |         sed -i -- 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/g' /etc/default/ufw
  38 |         service ufw restart
  39 | fi
  40 | 
  41 | ## Resolv.conf
  42 | echo "$hostIP	$hostname" >> /etc/hosts
  43 | 
  44 | ## Certs
  45 | wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
  46 | chmod +x cfssl_linux-amd64
  47 | sudo mv cfssl_linux-amd64 /usr/local/bin/cfssl
  48 | wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
  49 | chmod +x cfssljson_linux-amd64
  50 | sudo mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
  51 | 
  52 | echo '{
  53 |   "signing": {
  54 |     "default": {
  55 |       "expiry": "8760h"
  56 |     },
  57 |     "profiles": {
  58 |       "kubernetes": {
  59 |         "usages": ["signing", "key encipherment", "server auth", "client auth"],
  60 |         "expiry": "8760h"
  61 |       }
  62 |     }
  63 |   }
  64 | }' > ca-config.json
  65 | 
  66 | 
  67 | cat > ca-csr.json <<EOF
  68 | {
  69 |   "CN": "Kubernetes",
  70 |   "key": {
  71 |     "algo": "ecdsa",
  72 |     "size": 256
  73 |   },
  74 |   "names": [
  75 |     {
  76 |       "C": "$CAcountry",
  77 |       "L": "Cloud",
  78 |       "O": "Kubernetes",
  79 |       "OU": "CA"
  80 |     }
  81 |   ]
  82 | }
  83 | EOF
  84 | 
  85 | 
  86 | cfssl gencert -initca ca-csr.json | cfssljson -bare ca
  87 | 
  88 | 
  89 | cat > kubernetes-csr.json <<EOF
  90 | {
  91 |   "CN": "kubernetes",
  92 |   "hosts": [
  93 |     "$hostIP",
  94 |     "$hostname",
  95 |     "10.32.0.1",
  96 |     "kubernetes.default",
  97 |     "127.0.0.1"
  98 |   ],
  99 |   "key": {
 100 |     "algo": "ecdsa",
 101 |     "size": 256
 102 |   },
 103 |   "names": [
 104 |     {
 105 |       "C": "$CAcountry",
 106 |       "L": "Cloud",
 107 |       "O": "Kubernetes",
 108 |       "OU": "Cluster"
 109 |     }
 110 |   ]
 111 | }
 112 | EOF
 113 | 
 114 | cfssl gencert \
 115 |   -ca=ca.pem \
 116 |   -ca-key=ca-key.pem \
 117 |   -config=ca-config.json \
 118 |   -profile=kubernetes \
 119 |   kubernetes-csr.json | cfssljson -bare kubernetes
 120 | 
 121 | ## ETCD
 122 | sudo mkdir -p /etc/etcd/
 123 | sudo cp ca.pem kubernetes-key.pem kubernetes.pem /etc/etcd/
 124 | 
 125 | wget https://github.com/coreos/etcd/releases/download/"$etcdVersion"/etcd-"$etcdVersion"-linux-amd64.tar.gz
 126 | tar -xvf etcd-"$etcdVersion"-linux-amd64.tar.gz
 127 | sudo mv etcd-"$etcdVersion"-linux-amd64/etcd* /usr/bin/
 128 | 
 129 | sudo mkdir -p /var/lib/etcd
 130 | 
 131 | cat > etcd.service <<EOF
 132 | [Unit]
 133 | Description=etcd
 134 | Documentation=https://github.com/coreos
 135 | 
 136 | [Service]
 137 | ExecStart=/usr/bin/etcd --name etcd0 \
 138 |   --cert-file=/etc/etcd/kubernetes.pem \
 139 |   --key-file=/etc/etcd/kubernetes-key.pem \
 140 |   --peer-cert-file=/etc/etcd/kubernetes.pem \
 141 |   --peer-key-file=/etc/etcd/kubernetes-key.pem \
 142 |   --trusted-ca-file=/etc/etcd/ca.pem \
 143 |   --peer-trusted-ca-file=/etc/etcd/ca.pem \
 144 |   --initial-advertise-peer-urls https://$hostIP:2380 \
 145 |   --listen-peer-urls https://$hostIP:2380 \
 146 |   --listen-client-urls https://$hostIP:2379,http://127.0.0.1:2379 \
 147 |   --advertise-client-urls https://$hostIP:2379 \
 148 |   --initial-cluster-token etcd-cluster-0 \
 149 |   --initial-cluster etcd0=https://$hostIP:2380 \
 150 |   --initial-cluster-state new \
 151 |   --data-dir=/var/lib/etcd
 152 | Restart=on-failure
 153 | RestartSec=5
 154 | 
 155 | [Install]
 156 | WantedBy=multi-user.target
 157 | EOF
 158 | 
 159 | sudo mv etcd.service /etc/systemd/system/
 160 | 
 161 | sudo systemctl daemon-reload
 162 | sudo systemctl enable etcd
 163 | sudo systemctl start etcd
 164 | 
 165 | sleep 3
 166 | etcdctl --ca-file=/etc/etcd/ca.pem cluster-health
 167 | 
 168 | 
 169 | ## K8 Master
 170 | sudo mkdir -p /var/lib/kubernetes
 171 | sudo cp ca.pem kubernetes-key.pem kubernetes.pem ca-key.pem /var/lib/kubernetes/
 172 | 
 173 | wget https://storage.googleapis.com/kubernetes-release/release/"$k8sVersion"/bin/linux/amd64/kube-apiserver
 174 | wget https://storage.googleapis.com/kubernetes-release/release/"$k8sVersion"/bin/linux/amd64/kube-controller-manager
 175 | wget https://storage.googleapis.com/kubernetes-release/release/"$k8sVersion"/bin/linux/amd64/kube-scheduler
 176 | wget https://storage.googleapis.com/kubernetes-release/release/"$k8sVersion"/bin/linux/amd64/kubectl
 177 | 
 178 | 
 179 | chmod +x kube-apiserver kube-controller-manager kube-scheduler kubectl
 180 | sudo mv kube-apiserver kube-controller-manager kube-scheduler kubectl /usr/bin/
 181 | 
 182 | cat > token.csv <<EOF
 183 | $adminToken,admin,admin,"cluster-admin,system:masters"
 184 | $kubeletToken,kubelet,kubelet,"cluster-admin,system:masters"
 185 | EOF
 186 | sudo mv token.csv /var/lib/kubernetes
 187 | 
 188 | cat > kube-apiserver.service <<EOF
 189 | [Unit]
 190 | Description=Kubernetes API Server
 191 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 192 | 
 193 | [Service]
 194 | ExecStart=/usr/bin/kube-apiserver \
 195 |   --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
 196 |   --advertise-address=$hostIP \
 197 |   --allow-privileged=true \
 198 |   --apiserver-count=1 \
 199 |   --authorization-mode=RBAC \
 200 |   --bind-address=0.0.0.0 \
 201 |   --enable-swagger-ui=true \
 202 |   --etcd-cafile=/var/lib/kubernetes/ca.pem \
 203 |   --insecure-bind-address=127.0.0.1 \
 204 |   --kubelet-certificate-authority=/var/lib/kubernetes/ca.pem \
 205 |   --etcd-servers=https://$hostIP:2379 \
 206 |   --service-account-key-file=/var/lib/kubernetes/ca-key.pem \
 207 |   --service-cluster-ip-range=10.32.0.0/16 \
 208 |   --service-node-port-range=30000-32767 \
 209 |   --tls-cert-file=/var/lib/kubernetes/kubernetes.pem \
 210 |   --tls-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \
 211 |   --token-auth-file=/var/lib/kubernetes/token.csv \
 212 |   --v=2
 213 | Restart=on-failure
 214 | RestartSec=5
 215 | 
 216 | [Install]
 217 | WantedBy=multi-user.target
 218 | EOF
 219 | 
 220 | sudo mv kube-apiserver.service /etc/systemd/system/
 221 | sudo systemctl daemon-reload
 222 | sudo systemctl enable kube-apiserver
 223 | sudo systemctl start kube-apiserver
 224 | 
 225 | cat > kube-controller-manager.service <<EOF
 226 | [Unit]
 227 | Description=Kubernetes Controller Manager
 228 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 229 | 
 230 | [Service]
 231 | ExecStart=/usr/bin/kube-controller-manager \
 232 |   --cluster-name=kubernetes \
 233 |   --leader-elect=true \
 234 |   --master=http://127.0.0.1:8080 \
 235 |   --root-ca-file=/var/lib/kubernetes/ca.pem \
 236 |   --service-cluster-ip-range=10.32.0.0/16 \
 237 |   --pod-eviction-timeout 30s \
 238 |   --service-account-private-key-file=/var/lib/kubernetes/ca-key.pem \
 239 |   --cluster-name=kubernetes \
 240 |   --cluster-signing-cert-file=/var/lib/kubernetes/ca.pem \
 241 |   --cluster-signing-key-file=/var/lib/kubernetes/ca-key.pem \
 242 |   --service-cluster-ip-range=10.32.0.0/16 \
 243 |   --v=2
 244 | Restart=on-failure
 245 | RestartSec=5
 246 | 
 247 | [Install]
 248 | WantedBy=multi-user.target
 249 | EOF
 250 | 
 251 | sudo mv kube-controller-manager.service /etc/systemd/system/
 252 | sudo systemctl daemon-reload
 253 | sudo systemctl enable kube-controller-manager
 254 | sudo systemctl start kube-controller-manager
 255 | 
 256 | cat > kube-scheduler.service <<EOF
 257 | [Unit]
 258 | Description=Kubernetes Scheduler
 259 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 260 | 
 261 | [Service]
 262 | ExecStart=/usr/bin/kube-scheduler \
 263 |   --leader-elect=true \
 264 |   --master=http://127.0.0.1:8080 \
 265 |   --v=2
 266 | Restart=on-failure
 267 | RestartSec=5
 268 | 
 269 | [Install]
 270 | WantedBy=multi-user.target
 271 | EOF
 272 | 
 273 | sudo mv kube-scheduler.service /etc/systemd/system/
 274 | sudo systemctl daemon-reload
 275 | sudo systemctl enable kube-scheduler
 276 | sudo systemctl start kube-scheduler
 277 | 
 278 | sleep 3
 279 | kubectl get cs
 280 | 
 281 | 
 282 | ## Worker
 283 | wget https://get.docker.com/builds/Linux/x86_64/docker-"$dockerVersion".tgz
 284 | tar -xvf docker-"$dockerVersion".tgz
 285 | sudo cp docker/docker* /usr/bin/
 286 | 
 287 | cat > docker.service <<EOF
 288 | [Unit]
 289 | Description=Docker Application Container Engine
 290 | Documentation=http://docs.docker.io
 291 | 
 292 | [Service]
 293 | ExecStart=/usr/bin/docker daemon \
 294 |   --iptables=false \
 295 |   --ip-masq=false \
 296 |   --host=unix:///var/run/docker.sock \
 297 |   --log-level=error \
 298 |   --storage-driver=overlay2
 299 | Restart=on-failure
 300 | RestartSec=5
 301 | 
 302 | [Install]
 303 | WantedBy=multi-user.target
 304 | EOF
 305 | 
 306 | sudo mv docker.service /etc/systemd/system/
 307 | sudo systemctl daemon-reload
 308 | sudo systemctl enable docker
 309 | sudo systemctl start docker
 310 | sleep 2
 311 | sudo docker version
 312 | 
 313 | sudo mkdir -p /etc/cni/net.d
 314 | wget https://github.com/containernetworking/plugins/releases/download/"$cniVersion"/cni-plugins-amd64-"$cniVersion".tgz
 315 | sudo tar -xvf cni-plugins-amd64-"$cniVersion".tgz -C /etc/cni/net.d
 316 | 
 317 | cat >  10-calico.conf <<EOF
 318 | {
 319 |     "name": "calico-k8s-network",
 320 |     "type": "calico",
 321 |     "etcd_endpoints": "http://127.0.0.1:2379",
 322 |     "etcd_ca_cert_file": "/var/lib/kubernetes/ca.pem",
 323 |     "ipam": {
 324 |         "type": "calico-ipam",
 325 |         "assign_ipv4": "true",
 326 |         "assign_ipv6": "$enableIPv6"
 327 | 
 328 |     },
 329 |     "policy": {
 330 |         "type": "k8s"
 331 |     },
 332 |     "kubernetes": {
 333 |         "kubeconfig": "/var/lib/kubelet/kubeconfig"
 334 |     }
 335 | }
 336 | 
 337 | EOF
 338 | 
 339 | sudo mv 10-calico.conf /etc/cni/net.d/
 340 | 
 341 | cat > calico.service  <<EOF
 342 | [Unit]
 343 | Description=calico node
 344 | After=docker.service
 345 | Requires=docker.service
 346 | 
 347 | [Service]
 348 | User=root
 349 | PermissionsStartOnly=true
 350 | Environment=ETCD_ENDPOINTS=http://127.0.0.1:2379
 351 | Environment=ETCD_CA_CERT_FILE=/var/lib/kubernetes/ca.pem
 352 | ExecStart=/usr/bin/docker run --net=host --privileged --name=calico-node --rm -e CALICO_NETWORKING_BACKEND=bird  \
 353 | 	-e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali  \
 354 | 	-e ETCD_AUTHORITY= -e ETCD_SCHEME= -e ETCD_CA_CERT_FILE=/etc/calico/certs/ca_cert.crt \
 355 | 	-e IP=$hostIP \
 356 |         -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true  \
 357 | 	-e ETCD_ENDPOINTS=http://127.0.0.1:2379  \
 358 | 	-v /var/lib/kubernetes/ca.pem:/etc/calico/certs/ca_cert.crt  \
 359 | 	-e NODENAME=$hostname -e CALICO_NETWORKING_BACKEND=bird  \
 360 | 	-v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico  \
 361 | 	-v /run/docker/plugins:/run/docker/plugins -v /var/run/docker.sock:/var/run/docker.sock  \
 362 | 	calico/node:latest
 363 | ExecStop=/usr/bin/docker rm -f calico-node
 364 | Restart=always
 365 | RestartSec=10
 366 | 
 367 | [Install]
 368 | WantedBy=multi-user.target
 369 | 
 370 | EOF
 371 | 
 372 | sudo mv calico.service /etc/systemd/system/
 373 | 
 374 | sudo systemctl daemon-reload
 375 | sudo systemctl enable calico
 376 | sudo systemctl start calico
 377 | 
 378 | wget https://github.com/projectcalico/calicoctl/releases/download/$calicoctlVersion/calicoctl
 379 | chmod +x calicoctl
 380 | sudo mv calicoctl /usr/local/bin
 381 | 
 382 | wget https://github.com/projectcalico/cni-plugin/releases/download/$calicoCNIVersion/calico
 383 | wget https://github.com/projectcalico/cni-plugin/releases/download/$calicoCNIVersion/calico-ipam
 384 | chmod +x calico calico-ipam
 385 | sudo mv calico /etc/cni/net.d
 386 | sudo mv calico-ipam /etc/cni/net.d
 387 | 
 388 | wget https://storage.googleapis.com/kubernetes-release/release/$k8sVersion/bin/linux/amd64/kubelet
 389 | wget https://storage.googleapis.com/kubernetes-release/release/$k8sVersion/bin/linux/amd64/kube-proxy
 390 | 
 391 | wget https://storage.googleapis.com/kubernetes-helm/helm-$helmVersion-linux-amd64.tar.gz
 392 | tar -zxvf helm-$helmVersion-linux-amd64.tar.gz
 393 | mv linux-amd64/helm /usr/local/bin
 394 | 
 395 | chmod +x  kube-proxy kubelet
 396 | sudo mv kube-proxy kubelet /usr/bin/
 397 | sudo mkdir -p /var/lib/kubelet/
 398 | 
 399 | cat > kubeconfig  <<EOF
 400 | apiVersion: v1
 401 | kind: Config
 402 | clusters:
 403 | - cluster:
 404 |     certificate-authority: /var/lib/kubernetes/ca.pem
 405 |     server: https://$hostIP:6443
 406 |   name: kubernetes
 407 | contexts:
 408 | - context:
 409 |     cluster: kubernetes
 410 |     user: kubelet
 411 |   name: kubelet
 412 | current-context: kubelet
 413 | users:
 414 | - name: kubelet
 415 |   user:
 416 |     token: $kubeletToken
 417 | EOF
 418 | 
 419 | sudo mv kubeconfig /var/lib/kubelet/
 420 | 
 421 | cat > kubelet.service  <<EOF
 422 | [Unit]
 423 | Description=Kubernetes Kubelet
 424 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 425 | After=docker.service
 426 | Requires=docker.service
 427 | 
 428 | [Service]
 429 | ExecStart=/usr/bin/kubelet \
 430 |   --allow-privileged=true \
 431 |   --cloud-provider= \
 432 |   --cluster-dns=10.32.0.10 \
 433 |   --cluster-domain=$clusterDomain \
 434 |   --container-runtime=docker \
 435 |   --docker=unix:///var/run/docker.sock \
 436 |   --network-plugin=cni \
 437 |   --network-plugin-dir=/etc/cni/net.d \
 438 |   --kubeconfig=/var/lib/kubelet/kubeconfig \
 439 |   --serialize-image-pulls=false \
 440 |   --tls-cert-file=/var/lib/kubernetes/kubernetes.pem \
 441 |   --tls-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \
 442 |   --runtime-cgroups=/systemd/system.slice \
 443 |   --kubelet-cgroups=/systemd/system.slice \
 444 |   --v=2
 445 | 
 446 | Restart=on-failure
 447 | RestartSec=5
 448 | 
 449 | [Install]
 450 | WantedBy=multi-user.target
 451 | EOF
 452 | 
 453 | sudo mv kubelet.service /etc/systemd/system/
 454 | 
 455 | sudo systemctl daemon-reload
 456 | sudo systemctl enable kubelet
 457 | sudo systemctl start kubelet
 458 | mkdir /opt/cni/ && ln -s /etc/cni/net.d /opt/cni/bin
 459 | 
 460 | cat > kube-proxy.service  <<EOF
 461 | [Unit]
 462 | Description=Kubernetes Kube Proxy
 463 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
 464 | 
 465 | [Service]
 466 | ExecStart=/usr/bin/kube-proxy \
 467 |   --master=http://127.0.0.1:8080 \
 468 |   --kubeconfig=/var/lib/kubelet/kubeconfig \
 469 |   --proxy-mode=iptables \
 470 |   --v=2
 471 | 
 472 | Restart=on-failure
 473 | RestartSec=5
 474 | 
 475 | [Install]
 476 | WantedBy=multi-user.target
 477 | EOF
 478 | 
 479 | sudo mv kube-proxy.service /etc/systemd/system/
 480 | 
 481 | sudo systemctl daemon-reload
 482 | sudo systemctl enable kube-proxy
 483 | sudo systemctl start kube-proxy
 484 | 
 485 | sleep 5
 486 | kubectl get cs ; echo "" ;  kubectl get nodes
 487 | 
 488 | sysctl -w net.ipv4.ip_forward=1
 489 | echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/81-ipv4-forward.conf
 490 | 
 491 | 
 492 | if [[ "$enableIPv6" == "true" ]]; then
 493 | echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
 494 | echo "net.ipv6.conf.all.forwarding=1" > /etc/sysctl.d/80-ipv6-forward.conf
 495 | calicoctl delete ippool fd80:24e2:f998:72d6::/64
 496 | sleep 2
 497 | cat <<EOF | calicoctl create -f -
 498 | - apiVersion: v1
 499 |   kind: ipPool
 500 |   metadata:
 501 |     cidr: $IPv6Pool
 502 |   spec:
 503 |     nat-outgoing: true
 504 | EOF
 505 | fi
 506 | 
 507 | # IP-in-IP
 508 | if [[ "$enableIPinIP" == "True" ]]; then
 509 | calicoctl delete ippool 192.168.0.0/16
 510 | cat <<EOF | calicoctl create -f -
 511 | - apiVersion: v1
 512 |   kind: ipPool
 513 |   metadata:
 514 |     cidr: 192.168.0.0/16
 515 |   spec:
 516 |     nat-outgoing: true
 517 |     ipip:
 518 |       enabled: true
 519 |       mode: always
 520 | EOF
 521 | fi
 522 | 
 523 | # Calico Policy-controller
 524 | cat <<EOF | kubectl create -f -
 525 | 
 526 | # Create this manifest using kubectl to deploy
 527 | # the Calico policy controller on Kubernetes.
 528 | # It deploys a single instance of the policy controller.
 529 | apiVersion: extensions/v1beta1
 530 | kind: Deployment
 531 | metadata:
 532 |   name: calico-policy-controller
 533 |   namespace: kube-system
 534 |   labels:
 535 |     k8s-app: calico-policy
 536 | spec:
 537 |   # Only a single instance of the policy controller should be
 538 |   # active at a time.  Since this pod is run as a Deployment,
 539 |   # Kubernetes will ensure the pod is recreated in case of failure,
 540 |   # removing the need for passive backups.
 541 |   replicas: 1
 542 |   strategy:
 543 |     type: Recreate
 544 |   template:
 545 |     metadata:
 546 |       name: calico-policy-controller
 547 |       namespace: kube-system
 548 |       labels:
 549 |         k8s-app: calico-policy
 550 |     spec:
 551 |       hostNetwork: true
 552 |       containers:
 553 |         - name: calico-policy-controller
 554 |           # Make sure to pin this to your desired version.
 555 |           image: calico/kube-policy-controller:v0.7.0
 556 |           env:
 557 |             # Configure the policy controller with the location of
 558 |             # your etcd cluster.
 559 |             - name: ETCD_ENDPOINTS
 560 |               value: "https://$hostIP:2379"
 561 |             # Location of the Kubernetes API - this shouldn't need to be
 562 |             # changed so long as it is used in conjunction with
 563 |             # CONFIGURE_ETC_HOSTS="true".
 564 |             - name: K8S_API
 565 |               value: "https://$hostIP:6443"
 566 |             # Configure /etc/hosts within the container to resolve
 567 |             # the kubernetes.default Service to the correct clusterIP
 568 |             # using the environment provided by the kubelet.
 569 |             # This removes the need for KubeDNS to resolve the Service.
 570 |             - name: CONFIGURE_ETC_HOSTS
 571 |               value: "false"
 572 |             - name: ETCD_CA_CERT_FILE
 573 |               value: "/ca.pem"
 574 |           volumeMounts:
 575 |           - name: etcd-ca
 576 |             mountPath: /ca.pem
 577 |       volumes:
 578 |       - name: etcd-ca
 579 |         hostPath:
 580 |           path: /var/lib/kubernetes/ca.pem
 581 | 
 582 | ---
 583 | kind: ClusterRole
 584 | apiVersion: rbac.authorization.k8s.io/v1beta1
 585 | metadata:
 586 |   name: calico-policy-controller
 587 |   namespace: kube-system
 588 | rules:
 589 |   - apiGroups:
 590 |     - ""
 591 |     - extensions
 592 |     resources:
 593 |       - pods
 594 |       - namespaces
 595 |       - networkpolicies
 596 |     verbs:
 597 |       - watch
 598 |       - list
 599 | ---
 600 | kind: ClusterRoleBinding
 601 | apiVersion: rbac.authorization.k8s.io/v1beta1
 602 | metadata:
 603 |   name: calico-policy-controller
 604 | roleRef:
 605 |   apiGroup: rbac.authorization.k8s.io
 606 |   kind: ClusterRole
 607 |   name: calico-policy-controller
 608 | subjects:
 609 | - kind: ServiceAccount
 610 |   name: calico-policy-controller
 611 |   namespace: kube-system
 612 | ---
 613 | kind: ClusterRole
 614 | apiVersion: rbac.authorization.k8s.io/v1beta1
 615 | metadata:
 616 |   name: calico-node
 617 |   namespace: kube-system
 618 | rules:
 619 |   - apiGroups: [""]
 620 |     resources:
 621 |       - pods
 622 |       - nodes
 623 |     verbs:
 624 |       - get
 625 | ---
 626 | apiVersion: rbac.authorization.k8s.io/v1beta1
 627 | kind: ClusterRoleBinding
 628 | metadata:
 629 |   name: calico-node
 630 | roleRef:
 631 |   apiGroup: rbac.authorization.k8s.io
 632 |   kind: ClusterRole
 633 |   name: calico-node
 634 | subjects:
 635 | - kind: ServiceAccount
 636 |   name: calico-node
 637 |   namespace: kube-system
 638 | 
 639 | EOF
 640 | 
 641 | 
 642 | # RBAC kube-system
 643 | cat <<EOF | kubectl create -f -
 644 | 
 645 | apiVersion: rbac.authorization.k8s.io/v1beta1
 646 | kind: ClusterRole
 647 | metadata:
 648 |   name: kube-system-serviceaccounts-role
 649 | rules:
 650 | - apiGroups:
 651 |   - "*"
 652 |   - extensions
 653 |   resources:
 654 |   - pods
 655 |   - namespaces
 656 |   - networkpolicies
 657 |   - configmaps
 658 |   - endpoints
 659 |   - services
 660 |   verbs:
 661 |   - watch
 662 |   - list
 663 |   - get
 664 | ---
 665 | apiVersion: rbac.authorization.k8s.io/v1beta1
 666 | kind: ClusterRoleBinding
 667 | metadata:
 668 |   name: kube-system-serviceaccounts-rolebinding
 669 | roleRef:
 670 |   apiGroup: rbac.authorization.k8s.io
 671 |   kind: ClusterRole
 672 |   name: kube-system-serviceaccounts-role
 673 | subjects:
 674 | - kind: Group
 675 |   name: system:serviceaccounts:kube-system
 676 |   apiGroup: rbac.authorization.k8s.io
 677 | 
 678 | EOF
 679 | 
 680 | 
 681 | # KubeDNS
 682 | cat <<EOF | kubectl create -f -
 683 | 
 684 | apiVersion: extensions/v1beta1
 685 | kind: Deployment
 686 | metadata:
 687 |   name: kube-dns
 688 |   namespace: kube-system
 689 |   labels:
 690 |     k8s-app: kube-dns
 691 |     kubernetes.io/cluster-service: "true"
 692 | spec:
 693 |   # replicas: not specified here:
 694 |   # 1. In order to make Addon Manager do not reconcile this replicas parameter.
 695 |   # 2. Default is 1.
 696 |   # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
 697 |   strategy:
 698 |     rollingUpdate:
 699 |       maxSurge: 10%
 700 |       maxUnavailable: 0
 701 |   selector:
 702 |     matchLabels:
 703 |       k8s-app: kube-dns
 704 |   template:
 705 |     metadata:
 706 |       labels:
 707 |         k8s-app: kube-dns
 708 |       annotations:
 709 |         scheduler.alpha.kubernetes.io/critical-pod: ''
 710 |         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
 711 |     spec:
 712 |       containers:
 713 |       - name: kubedns
 714 |         image: gcr.io/google_containers/kubedns-amd64:1.9
 715 |         resources:
 716 |           # TODO: Set memory limits when we've profiled the container for large
 717 |           # clusters, then set request = limit to keep this container in
 718 |           # guaranteed class. Currently, this container falls into the
 719 |           # "burstable" category so the kubelet doesn't backoff from restarting it.
 720 |           limits:
 721 |             memory: 170Mi
 722 |           requests:
 723 |             cpu: 100m
 724 |             memory: 70Mi
 725 |         livenessProbe:
 726 |           httpGet:
 727 |             path: /healthz-kubedns
 728 |             port: 8080
 729 |             scheme: HTTP
 730 |           initialDelaySeconds: 60
 731 |           timeoutSeconds: 5
 732 |           successThreshold: 1
 733 |           failureThreshold: 5
 734 |         readinessProbe:
 735 |           httpGet:
 736 |             path: /readiness
 737 |             port: 8081
 738 |             scheme: HTTP
 739 |           # we poll on pod startup for the Kubernetes master service and
 740 |           # only setup the /readiness HTTP server once that's available.
 741 |           initialDelaySeconds: 3
 742 |           timeoutSeconds: 5
 743 |         args:
 744 |         - --domain=$clusterDomain
 745 |         - --dns-port=10053
 746 |         # This should be set to v=2 only after the new image (cut from 1.5) has
 747 |         # been released, otherwise we will flood the logs.
 748 |         - --v=0
 749 |         env:
 750 |         - name: PROMETHEUS_PORT
 751 |           value: "10055"
 752 |         ports:
 753 |         - containerPort: 10053
 754 |           name: dns-local
 755 |           protocol: UDP
 756 |         - containerPort: 10053
 757 |           name: dns-tcp-local
 758 |           protocol: TCP
 759 |         - containerPort: 10055
 760 |           name: metrics
 761 |           protocol: TCP
 762 |       - name: dnsmasq
 763 |         image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4
 764 |         livenessProbe:
 765 |           httpGet:
 766 |             path: /healthz-dnsmasq
 767 |             port: 8080
 768 |             scheme: HTTP
 769 |           initialDelaySeconds: 60
 770 |           timeoutSeconds: 5
 771 |           successThreshold: 1
 772 |           failureThreshold: 5
 773 |         args:
 774 |         - --cache-size=1000
 775 |         - --no-resolv
 776 |         - --server=127.0.0.1#10053
 777 |         - --log-facility=-
 778 |         ports:
 779 |         - containerPort: 53
 780 |           name: dns
 781 |           protocol: UDP
 782 |         - containerPort: 53
 783 |           name: dns-tcp
 784 |           protocol: TCP
 785 |         # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
 786 |         resources:
 787 |           requests:
 788 |             cpu: 150m
 789 |             memory: 10Mi
 790 |       - name: dnsmasq-metrics
 791 |         image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
 792 |         livenessProbe:
 793 |           httpGet:
 794 |             path: /metrics
 795 |             port: 10054
 796 |             scheme: HTTP
 797 |           initialDelaySeconds: 60
 798 |           timeoutSeconds: 5
 799 |           successThreshold: 1
 800 |           failureThreshold: 5
 801 |         args:
 802 |         - --v=2
 803 |         - --logtostderr
 804 |         ports:
 805 |         - containerPort: 10054
 806 |           name: metrics
 807 |           protocol: TCP
 808 |         resources:
 809 |           requests:
 810 |             memory: 10Mi
 811 |       - name: healthz
 812 |         image: gcr.io/google_containers/exechealthz-amd64:1.2
 813 |         resources:
 814 |           limits:
 815 |             memory: 50Mi
 816 |           requests:
 817 |             cpu: 10m
 818 |             # Note that this container shouldn't really need 50Mi of memory. The
 819 |             # limits are set higher than expected pending investigation on #29688.
 820 |             # The extra memory was stolen from the kubedns container to keep the
 821 |             # net memory requested by the pod constant.
 822 |             memory: 50Mi
 823 |         args:
 824 |         - --cmd=nslookup kubernetes.default.svc.$clusterDomain 127.0.0.1 >/dev/null
 825 |         - --url=/healthz-dnsmasq
 826 |         - --cmd=nslookup kubernetes.default.svc.$clusterDomain 127.0.0.1:10053 >/dev/null
 827 |         - --url=/healthz-kubedns
 828 |         - --port=8080
 829 |         - --quiet
 830 |         ports:
 831 |         - containerPort: 8080
 832 |           protocol: TCP
 833 |       dnsPolicy: Default  # Don't use cluster DNS.
 834 | ---
 835 | 
 836 | apiVersion: v1
 837 | kind: Service
 838 | metadata:
 839 |   name: kube-dns
 840 |   namespace: kube-system
 841 |   labels:
 842 |     k8s-app: kube-dns
 843 |     kubernetes.io/cluster-service: "true"
 844 |     kubernetes.io/name: "KubeDNS"
 845 | spec:
 846 |   selector:
 847 |     k8s-app: kube-dns
 848 |   clusterIP: 10.32.0.10
 849 |   ports:
 850 |     - name: dns
 851 |       port: 53
 852 |       protocol: UDP
 853 |     - name: dns-tcp
 854 |       port: 53
 855 |       protocol: TCP
 856 | 
 857 | EOF
 858 | 
 859 | 
 860 | # KubeDashboard
 861 | kubectl create -f https://git.io/kube-dashboard  
 862 | 
 863 | # Init HELM
 864 | kubectl create serviceaccount tiller --namespace kube-system
 865 | 
 866 | cat <<EOF | kubectl create -f -
 867 |   kind: ClusterRoleBinding
 868 |   apiVersion: rbac.authorization.k8s.io/v1beta1
 869 |   metadata:
 870 |     name: tiller-clusterrolebinding
 871 |   subjects:
 872 |   - kind: ServiceAccount
 873 |     name: tiller
 874 |     namespace: kube-system
 875 |   roleRef:
 876 |     kind: ClusterRole
 877 |     name: cluster-admin
 878 |     apiGroup: ""
 879 | EOF
 880 | helm init --service-account tiller --upgrade
 881 | echo ""
 882 | echo ""
 883 | echo "Created files/folder :
 884 | 
 885 | /etc/systemd/system/kube-apiserver.service
 886 | /etc/systemd/system/kube-controller-manager.service
 887 | /etc/systemd/system/kube-scheduler.service
 888 | /etc/systemd/system/kube-proxy.service
 889 | /etc/systemd/system/kubelet.service
 890 | /etc/systemd/system/docker.service
 891 | /etc/systemd/system/calico.service
 892 | /var/lib/etcd
 893 | /var/lib/kubernetes
 894 | /var/lib/kubelet
 895 | /var/lib/docker
 896 | /etc/etcd
 897 | "
 898 | 
 899 | echo ""
 900 | sleep 3
 901 | kubectl get pod,svc --all-namespaces
 902 | echo ""
 903 | tput bold && echo "Your cluster is up and running !" && tput sgr0
 904 | exit 0
 905 | 
 906 | fi
 907 | 
 908 | 
 909 | if [[ "$1" == "--worker" ]]; then
 910 | 
 911 | echo "$hostIP	$hostname" >> /etc/hosts
 912 | 
 913 | if [[ "$setupFirewall" == "True" ]]; then
 914 |         apt-get update && apt-get -y install ufw
 915 |         ufw allow ssh
 916 | 	ufw allow from $hostIP
 917 |         ufw enable
 918 | fi
 919 | 
 920 | wget https://get.docker.com/builds/Linux/x86_64/docker-"$dockerVersion".tgz
 921 | tar -xvf docker-"$dockerVersion".tgz
 922 | sudo cp docker/docker* /usr/bin/
 923 | 
 924 | cat > docker.service <<EOF
 925 | [Unit]
 926 | Description=Docker Application Container Engine
 927 | Documentation=http://docs.docker.io
 928 | 
 929 | [Service]
 930 | ExecStart=/usr/bin/docker daemon \
 931 |   --iptables=false \
 932 |   --ip-masq=false \
 933 |   --host=unix:///var/run/docker.sock \
 934 |   --log-level=error \
 935 |   --storage-driver=overlay2
 936 | Restart=on-failure
 937 | RestartSec=5
 938 | 
 939 | [Install]
 940 | WantedBy=multi-user.target
 941 | EOF
 942 | 
 943 | sudo mv docker.service /etc/systemd/system/
 944 | sudo systemctl daemon-reload
 945 | sudo systemctl enable docker
 946 | sudo systemctl start docker
 947 | sleep 2
 948 | sudo docker version
 949 | 
 950 | sudo mkdir -p /etc/cni/net.d
 951 | wget https://github.com/containernetworking/plugins/releases/download/"$cniVersion"/cni-plugins-amd64-"$cniVersion".tgz
 952 | sudo tar -xvf cni-plugins-amd64-"$cniVersion".tgz -C /etc/cni/net.d
 953 | 
 954 | cat >  10-calico.conf <<EOF
 955 | {
 956 |     "name": "calico-k8s-network",
 957 |     "type": "calico",
 958 |     "etcd_endpoints": "https://$hostIP:2379",
 959 |     "etcd_ca_cert_file": "/var/lib/kubernetes/ca.pem",
 960 |     "ipam": {
 961 |         "type": "calico-ipam",
 962 |         "assign_ipv4": "true",
 963 |         "assign_ipv6": "$enableIPv6"
 964 | 
 965 |     },
 966 |     "policy": {
 967 |         "type": "k8s"
 968 |     },
 969 |     "kubernetes": {
 970 |         "kubeconfig": "/var/lib/kubelet/kubeconfig"
 971 |     }
 972 | }
 973 | 
 974 | EOF
 975 | 
 976 | sudo mv 10-calico.conf /etc/cni/net.d/
 977 | 
 978 | #	-e IP=$hostIP \
 979 | $IP=$(cat /tmp/IP)
 980 | cat > calico.service  <<EOF
 981 | [Unit]
 982 | Description=calico node
 983 | After=docker.service
 984 | Requires=docker.service
 985 | 
 986 | [Service]
 987 | User=root
 988 | PermissionsStartOnly=true
 989 | Environment=ETCD_ENDPOINTS=https://$hostIP:2379
 990 | Environment=ETCD_CA_CERT_FILE=/var/lib/kubernetes/ca.pem
 991 | ExecStart=/usr/bin/docker run --net=host --privileged --name=calico-node --rm -e CALICO_NETWORKING_BACKEND=bird  \
 992 | 	-e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali  \
 993 | 	-e ETCD_AUTHORITY= -e ETCD_SCHEME= -e ETCD_CA_CERT_FILE=/etc/calico/certs/ca_cert.crt \
 994 |         -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true  \
 995 | 	-e ETCD_ENDPOINTS=https://$hostIP:2379  \
 996 | 	-v /var/lib/kubernetes/ca.pem:/etc/calico/certs/ca_cert.crt  \
 997 | 	-e NODENAME=$hostname -e CALICO_NETWORKING_BACKEND=bird  \
 998 | 	-v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico  \
 999 | 	-v /run/docker/plugins:/run/docker/plugins -v /var/run/docker.sock:/var/run/docker.sock  \
1000 | 	calico/node:latest
1001 | ExecStop=/usr/bin/docker rm -f calico-node
1002 | Restart=always
1003 | RestartSec=10
1004 | 
1005 | [Install]
1006 | WantedBy=multi-user.target
1007 | 
1008 | EOF
1009 | 
1010 | sudo mv calico.service /etc/systemd/system/
1011 | 
1012 | sudo systemctl daemon-reload
1013 | sudo systemctl enable calico
1014 | sudo systemctl start calico
1015 | 
1016 | wget https://github.com/projectcalico/calicoctl/releases/download/$calicoctlVersion/calicoctl
1017 | chmod +x calicoctl
1018 | sudo mv calicoctl /usr/local/bin
1019 | 
1020 | wget https://github.com/projectcalico/cni-plugin/releases/download/$calicoCNIVersion/calico
1021 | wget https://github.com/projectcalico/cni-plugin/releases/download/$calicoCNIVersion/calico-ipam
1022 | chmod +x calico calico-ipam
1023 | sudo mv calico /etc/cni/net.d
1024 | sudo mv calico-ipam /etc/cni/net.d
1025 | 
1026 | wget https://storage.googleapis.com/kubernetes-release/release/$k8sVersion/bin/linux/amd64/kubelet
1027 | wget https://storage.googleapis.com/kubernetes-release/release/$k8sVersion/bin/linux/amd64/kube-proxy
1028 | 
1029 | 
1030 | chmod +x  kube-proxy kubelet
1031 | sudo mv kube-proxy kubelet /usr/bin/
1032 | 
1033 | 
1034 | cat > kubelet.service  <<EOF
1035 | [Unit]
1036 | Description=Kubernetes Kubelet
1037 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
1038 | After=docker.service
1039 | Requires=docker.service
1040 | 
1041 | [Service]
1042 | ExecStart=/usr/bin/kubelet \
1043 |   --allow-privileged=true \
1044 |   --cloud-provider= \
1045 |   --cluster-dns=10.32.0.10 \
1046 |   --cluster-domain=$clusterDomain \
1047 |   --container-runtime=docker \
1048 |   --docker=unix:///var/run/docker.sock \
1049 |   --network-plugin=cni \
1050 |   --network-plugin-dir=/etc/cni/net.d \
1051 |   --kubeconfig=/var/lib/kubelet/kubeconfig \
1052 |   --serialize-image-pulls=false \
1053 |   --tls-cert-file=/var/lib/kubernetes/$hostname.pem \
1054 |   --tls-private-key-file=/var/lib/kubernetes/$hostname-key.pem \
1055 |   --runtime-cgroups=/systemd/system.slice \
1056 |   --kubelet-cgroups=/systemd/system.slice \
1057 |   --v=2
1058 | 
1059 | Restart=on-failure
1060 | RestartSec=5
1061 | 
1062 | [Install]
1063 | WantedBy=multi-user.target
1064 | EOF
1065 | 
1066 | sudo mv kubelet.service /etc/systemd/system/
1067 | 
1068 | sudo systemctl daemon-reload
1069 | sudo systemctl enable kubelet
1070 | sudo systemctl start kubelet
1071 | mkdir /opt/cni/ && ln -s /etc/cni/net.d /opt/cni/bin
1072 | 
1073 | cat > kube-proxy.service  <<EOF
1074 | [Unit]
1075 | Description=Kubernetes Kube Proxy
1076 | Documentation=https://github.com/GoogleCloudPlatform/kubernetes
1077 | 
1078 | [Service]
1079 | ExecStart=/usr/bin/kube-proxy \
1080 |   --master=https://$hostIP:6443 \
1081 |   --kubeconfig=/var/lib/kubelet/kubeconfig \
1082 |   --proxy-mode=iptables \
1083 |   --v=2
1084 | 
1085 | Restart=on-failure
1086 | RestartSec=5
1087 | 
1088 | [Install]
1089 | WantedBy=multi-user.target
1090 | EOF
1091 | 
1092 | sudo mv kube-proxy.service /etc/systemd/system/
1093 | 
1094 | sudo systemctl daemon-reload
1095 | sudo systemctl enable kube-proxy
1096 | sudo systemctl start kube-proxy
1097 | 
1098 | sysctl -w net.ipv4.ip_forward=1
1099 | echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/81-ipv4-forward.conf
1100 | 
1101 | if [[ "$enableIPv6" == "true" ]]; then
1102 | 	echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
1103 |         echo "net.ipv6.conf.all.forwarding=1" > /etc/sysctl.d/80-ipv6-forward.conf
1104 | fi
1105 | 
1106 | sleep 2
1107 | #kubectl get node -o wide
1108 | exit 0
1109 | fi
1110 | 


--------------------------------------------------------------------------------
/install_new_node.sh:
--------------------------------------------------------------------------------
 1 | #! /bin/bash
 2 | # -----------------------
 3 | # Set ip up :
 4 | # -----------------------
 5 | nodeIP="__PUBLIC_OR_PRIVATE_IPV4__"
 6 | sshUser="root"
 7 | setupFirewall="True"
 8 | CAcountry="US"
 9 | 
10 | nodeHostname=$(ssh $sshUser@$nodeIP 'hostname')
11 | 
12 | echo "$nodeIP	$nodeHostname" >> /etc/hosts
13 | 
14 | if [ ! -f ca.pem ]; then
15 |         echo "ca.pem don't exist, lauch ./install_k8s --master before !"
16 | 	exit 1
17 | fi
18 | 
19 | if [ ! -f ca-key.pem ]; then
20 |         echo "ca-key.pem don't exist, lauch ./install_k8s --master before !"
21 | 	exit 1
22 | fi
23 | 
24 | if [ ! -f ca-config.json ]; then
25 |         echo "ca-config.json don't exist, lauch ./install_k8s --master before !"
26 | 	exit 1
27 | fi
28 | 
29 | if [[ "$setupFirewall" == "True" ]]; then
30 |        # apt-get update && apt-get -y install ufw
31 | 	ufw allow from $nodeIP
32 | fi
33 | 
34 | 
35 | cat > $nodeHostname-csr.json <<EOF
36 | {
37 |   "CN": "kubernetes",
38 |   "hosts": [
39 |     "$nodeIP",
40 |     "$nodeHostname",
41 |     "10.32.0.1",
42 |     "$clusterDomain",
43 |     "127.0.0.1"
44 |   ],
45 |   "key": {
46 |     "algo": "ecdsa",
47 |     "size": 256
48 |   },
49 |   "names": [
50 |     {
51 |       "C": "$CAcountry",
52 |       "L": "Cloud",
53 |       "O": "Kubernetes",
54 |       "OU": "Cluster"
55 |     }
56 |   ]
57 | }
58 | EOF
59 | 
60 | 
61 | cfssl gencert \
62 |   -ca=ca.pem \
63 |   -ca-key=ca-key.pem \
64 |   -config=ca-config.json \
65 |   -profile=kubernetes \
66 |   $nodeHostname-csr.json | cfssljson -bare $nodeHostname
67 | 
68 | ssh $sshUser@$nodeIP 'mkdir /var/lib/kubernetes && mkdir /var/lib/kubelet && mkdir /opt/Simplekube'
69 | 
70 | scp $nodeHostname.pem $sshUser@$nodeIP:/var/lib/kubernetes/
71 | scp $nodeHostname-key.pem $sshUser@$nodeIP:/var/lib/kubernetes/
72 | scp ca.pem $sshUser@$nodeIP:/var/lib/kubernetes/
73 | scp install_k8s.sh $sshUser@$nodeIP:/opt/Simplekube/
74 | scp /var/lib/kubelet/kubeconfig $sshUser@$nodeIP:/var/lib/kubelet/
75 | ssh $sshUser@$nodeIP 'echo $nodeIP > /tmp/IP'
76 | ssh $sshUser@$nodeIP 'echo "$nodeIP	$nodeHostname" >> /etc/hosts'
77 | 
78 | ssh $sshUser@$nodeIP  '/opt/Simplekube/install_k8s.sh --worker'
79 | 


--------------------------------------------------------------------------------
/resources/glusterfs-volumeStore/glusterfs-enpoints.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "kind": "Endpoints",
 3 |   "apiVersion": "v1",
 4 |   "metadata": {
 5 |     "name": "glusterfs-cluster"
 6 |   },
 7 |   "subsets": [
 8 |     {
 9 |       "addresses": [
10 |         {
11 |           "ip": "gluster_IP01"
12 |         }
13 |       ],
14 |       "ports": [
15 |         {
16 |           "port": 1
17 |         }
18 |       ]
19 |     },
20 |     {
21 |       "addresses": [
22 |         {
23 |           "ip": "gluster_IP02"
24 |         }
25 |       ],
26 |       "ports": [
27 |         {
28 |           "port": 1
29 |         }
30 |       ]
31 |     }
32 |   ]
33 | }
34 | 


--------------------------------------------------------------------------------
/resources/glusterfs-volumeStore/glusterfs-svc.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "kind": "Service",
 3 |   "apiVersion": "v1",
 4 |   "metadata": {
 5 |     "name": "glusterfs-cluster"
 6 |   },
 7 |   "spec": {
 8 |     "ports": [
 9 |       {"port": 1}
10 |     ]
11 |   }
12 | }
13 | 


--------------------------------------------------------------------------------
/resources/glusterfs-volumeStore/mysql-depl-example.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: extensions/v1beta1
 2 | kind: Deployment
 3 | metadata:
 4 |   annotations:
 5 |     deployment.kubernetes.io/revision: "1"
 6 |   generation: 1
 7 |   labels:
 8 |     run: glusterdb
 9 |   name: glusterdb
10 |   namespace: default
11 | spec:
12 |   replicas: 1
13 |   selector:
14 |     matchLabels:
15 |       run: glusterdb
16 |   strategy:
17 |     rollingUpdate:
18 |       maxSurge: 1
19 |       maxUnavailable: 0
20 |     type: RollingUpdate
21 |   template:
22 |     metadata:
23 |       creationTimestamp: null
24 |       labels:
25 |         run: glusterdb
26 |     spec:
27 |       containers:
28 |         - image: mysql:latest
29 |           name: glusterdb
30 |           env:
31 |           - name: MYSQL_ROOT_PASSWORD
32 |           # Change this password!
33 |             value: pAssw0rd
34 |           ports:
35 |             - containerPort: 80
36 |               name: glusterdb
37 |           volumeMounts:
38 |             - name: glusterdb
39 |               mountPath: /var/lib/mysql
40 |       volumes:
41 |         - name: glusterdb
42 |           glusterfs:
43 |             endpoints: glusterfs-cluster
44 |             path: kubernetes (gluster:/kubernetes)
45 |             readOnly: false
46 | 
47 | 


--------------------------------------------------------------------------------
/resources/heapster/grafana-ingress.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: extensions/v1beta1
 2 | kind: Ingress
 3 | metadata:
 4 |   name: monitoring-grafana
 5 |   namespace: kube-system
 6 | spec:
 7 |   rules:
 8 |   - host: graphs.kubecluster.ouvrard.it
 9 |     http:
10 |       paths:
11 |       - backend:
12 |           serviceName: monitoring-grafana
13 |           servicePort: 80
14 | 


--------------------------------------------------------------------------------
/resources/heapster/grafana-service.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   labels:
 5 |     kubernetes.io/cluster-service: 'true'
 6 |     kubernetes.io/name: monitoring-grafana
 7 |   name: monitoring-grafana
 8 |   namespace: kube-system
 9 | spec:
10 |   # In a production setup, we recommend accessing Grafana through an external Loadbalancer
11 |   # or through a public IP. 
12 |   # type: LoadBalancer
13 |   ports:
14 |   - port: 80
15 |     targetPort: 3000
16 |   selector:
17 |     name: influxGrafana
18 | 


--------------------------------------------------------------------------------
/resources/heapster/heapster-controller.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: ReplicationController
 3 | metadata:
 4 |   labels:
 5 |     k8s-app: heapster
 6 |     name: heapster
 7 |     version: v6
 8 |   name: heapster
 9 |   namespace: kube-system
10 | spec:
11 |   replicas: 1
12 |   selector:
13 |     k8s-app: heapster
14 |     version: v6
15 |   template:
16 |     metadata:
17 |       labels:
18 |         k8s-app: heapster
19 |         version: v6
20 |     spec:
21 |       containers:
22 |       - name: heapster
23 |         image: kubernetes/heapster:canary
24 |         imagePullPolicy: Always
25 |         command:
26 |         - /heapster
27 |         - --source=kubernetes:https://kubernetes.default
28 |         - --sink=influxdb:http://monitoring-influxdb:8086
29 | 


--------------------------------------------------------------------------------
/resources/heapster/heapster-service.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   labels:
 5 |     kubernetes.io/cluster-service: 'true'
 6 |     kubernetes.io/name: Heapster
 7 |   name: heapster
 8 |   namespace: kube-system
 9 | spec:
10 |   ports:
11 |   - port: 80
12 |     targetPort: 8082
13 |   selector:
14 |     k8s-app: heapster
15 | 


--------------------------------------------------------------------------------
/resources/heapster/influxdb-grafana-controller.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: ReplicationController
 3 | metadata:
 4 |   labels:
 5 |     name: influxGrafana
 6 |   name: influxdb-grafana
 7 |   namespace: kube-system
 8 | spec:
 9 |   replicas: 1
10 |   selector:
11 |     name: influxGrafana
12 |   template:
13 |     metadata:
14 |       labels:
15 |         name: influxGrafana
16 |     spec:
17 |       containers:
18 |       - name: influxdb
19 |         image: kubernetes/heapster_influxdb:v0.5
20 |         volumeMounts:
21 |         - mountPath: /data
22 |           name: influxdb-storage
23 |       - name: grafana
24 |         image: gcr.io/google_containers/heapster_grafana:v2.6.0-2
25 |         env:
26 |           - name: INFLUXDB_SERVICE_URL
27 |             value: http://monitoring-influxdb:8086
28 |             # The following env variables are required to make Grafana accessible via
29 |             # the kubernetes api-server proxy. On production clusters, we recommend
30 |             # removing these env variables, setup auth for grafana, and expose the grafana
31 |             # service using a LoadBalancer or a public IP.
32 |           - name: GF_AUTH_BASIC_ENABLED
33 |             value: "true"
34 |           - name: GF_AUTH_ANONYMOUS_ENABLED
35 |             value: "false"
36 |           - name: GF_AUTH_ANONYMOUS_ORG_ROLE
37 |             value: Admin
38 |           - name: GF_SERVER_ROOT_URL
39 |             value: /
40 |             #value: /api/v1/proxy/namespaces/kube-system/services/monitoring-grafana/
41 |         volumeMounts:
42 |         - mountPath: /var
43 |           name: grafana-storage
44 |       volumes:
45 |       - name: influxdb-storage
46 |         emptyDir: {}
47 |       - name: grafana-storage
48 |         emptyDir: {}
49 | 


--------------------------------------------------------------------------------
/resources/heapster/influxdb-service.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   labels: null
 5 |   name: monitoring-influxdb
 6 |   namespace: kube-system
 7 | spec:
 8 |   ports:
 9 |   - name: http
10 |     port: 8083
11 |     targetPort: 8083
12 |   - name: api
13 |     port: 8086
14 |     targetPort: 8086
15 |   selector:
16 |     name: influxGrafana
17 | 


--------------------------------------------------------------------------------