Difference between revisions of "Kubernetes/the-hard-way"
From Christoph's Personal Wiki
(→Install the client tools) |
(→Provisioning compute resources) |
||
| Line 65: | Line 65: | ||
$ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom | $ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom | ||
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way]. | Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way]. | ||
| + | |||
| + | $ gcloud compute networks list --filter="name~'.*hard.*'" | ||
NAME SUBNET_MODE BGP_ROUTING_MODE IPV4_RANGE GATEWAY_IPV4 | NAME SUBNET_MODE BGP_ROUTING_MODE IPV4_RANGE GATEWAY_IPV4 | ||
kubernetes-the-hard-way CUSTOM REGIONAL | kubernetes-the-hard-way CUSTOM REGIONAL | ||
| + | </pre> | ||
| + | |||
| + | A [https://cloud.google.com/compute/docs/vpc/#vpc_networks_and_subnets subnet] must be provisioned with an IP address range large enough to assign a private IP address to each node in the Kubernetes cluster. | ||
| + | |||
| + | * Create the kubernetes subnet in the kubernetes-the-hard-way VPC network: | ||
| + | <pre> | ||
| + | $ gcloud compute networks subnets create kubernetes \ | ||
| + | --network kubernetes-the-hard-way \ | ||
| + | --range 10.240.0.0/24 | ||
| + | Created [https://www.googleapis.com/compute/v1/projects/<project-name>/regions/us-west1/subnetworks/kubernetes]. | ||
| + | |||
| + | $ gcloud compute networks subnets list --filter="network ~ kubernetes-the-hard-way" | ||
| + | NAME REGION NETWORK RANGE | ||
| + | kubernetes us-west1 kubernetes-the-hard-way 10.240.0.0/24 | ||
| + | </pre> | ||
| + | |||
| + | Note: The <code>10.240.0.0/24</code> IP address range can host up to 254 compute instances. | ||
| + | |||
| + | ; Firewall rules | ||
| + | |||
| + | * Create a firewall rule that allows internal communication across all protocols: | ||
| + | <pre> | ||
| + | $ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-internal \ | ||
| + | --allow tcp,udp,icmp \ | ||
| + | --network kubernetes-the-hard-way \ | ||
| + | --source-ranges 10.240.0.0/24,10.200.0.0/16 | ||
| + | </pre> | ||
| + | |||
| + | * Create a firewall rule that allows external SSH, ICMP, and HTTPS: | ||
| + | <pre> | ||
| + | $ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-external \ | ||
| + | --allow tcp:22,tcp:6443,icmp \ | ||
| + | --network kubernetes-the-hard-way \ | ||
| + | --source-ranges 0.0.0.0/0 | ||
| + | </pre> | ||
| + | |||
| + | <pre> | ||
| + | $ gcloud compute firewall-rules list --filter=network=kubernetes-the-hard-way | ||
| + | NAME NETWORK DIRECTION PRIORITY ALLOW DENY DISABLED | ||
| + | kubernetes-the-hard-way-allow-external kubernetes-the-hard-way INGRESS 1000 tcp:22,tcp:6443,icmp False | ||
| + | kubernetes-the-hard-way-allow-internal kubernetes-the-hard-way INGRESS 1000 tcp,udp,icmp False | ||
</pre> | </pre> | ||
Revision as of 00:31, 7 August 2019
This article will show how to setup Kubernetes The Hard Way, as originally developed by Kelsey Hightower. I will add my own additions, changes, alterations, etc. to the process (and this will be continually expanded upon).
Contents
Install the client tools
Note: See here for how to install on other OSes.
In this section, we will install the command line utilities required to complete this tutorial:
- Install CFSSL
The cfssl and cfssljson command line utilities will be used to provision a PKI Infrastructure and generate TLS certificates.
- Download and install cfssl and cfssljson from the cfssl repository:
$ wget -q --show-progress --https-only --timestamping \
https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
$ chmod +x cfssl_linux-amd64 cfssljson_linux-amd64
$ sudo mv cfssl_linux-amd64 /usr/local/bin/cfssl
$ sudo mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
- Verify cfssl version 1.2.0 or higher is installed:
$ cfssl version Version: 1.2.0 Revision: dev Runtime: go1.6
Note: The cfssljson command line utility does not provide a way to print its version.
- Install kubectl
The kubectl command line utility is used to interact with the Kubernetes API Server.
- Download and install kubectl from the official release binaries:
$ K8S_VERSION=$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)
$ curl -LO https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl
$ chmod +x kubectl
$ sudo mv kubectl /usr/local/bin/
- Verify kubectl version 1.12.0 or higher is installed:
$ kubectl version --client
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:40:16Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
Provisioning compute resources
Networking
- Virtual Private Cloud Network (VPC)
In this section, a dedicated Virtual Private Cloud (VPC) network will be setup to host the Kubernetes cluster.
- Create the kubernetes-the-hard-way custom VPC network:
$ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way]. $ gcloud compute networks list --filter="name~'.*hard.*'" NAME SUBNET_MODE BGP_ROUTING_MODE IPV4_RANGE GATEWAY_IPV4 kubernetes-the-hard-way CUSTOM REGIONAL
A subnet must be provisioned with an IP address range large enough to assign a private IP address to each node in the Kubernetes cluster.
- Create the kubernetes subnet in the kubernetes-the-hard-way VPC network:
$ gcloud compute networks subnets create kubernetes \ --network kubernetes-the-hard-way \ --range 10.240.0.0/24 Created [https://www.googleapis.com/compute/v1/projects/<project-name>/regions/us-west1/subnetworks/kubernetes]. $ gcloud compute networks subnets list --filter="network ~ kubernetes-the-hard-way" NAME REGION NETWORK RANGE kubernetes us-west1 kubernetes-the-hard-way 10.240.0.0/24
Note: The 10.240.0.0/24 IP address range can host up to 254 compute instances.
- Firewall rules
- Create a firewall rule that allows internal communication across all protocols:
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-internal \ --allow tcp,udp,icmp \ --network kubernetes-the-hard-way \ --source-ranges 10.240.0.0/24,10.200.0.0/16
- Create a firewall rule that allows external SSH, ICMP, and HTTPS:
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-external \ --allow tcp:22,tcp:6443,icmp \ --network kubernetes-the-hard-way \ --source-ranges 0.0.0.0/0
$ gcloud compute firewall-rules list --filter=network=kubernetes-the-hard-way NAME NETWORK DIRECTION PRIORITY ALLOW DENY DISABLED kubernetes-the-hard-way-allow-external kubernetes-the-hard-way INGRESS 1000 tcp:22,tcp:6443,icmp False kubernetes-the-hard-way-allow-internal kubernetes-the-hard-way INGRESS 1000 tcp,udp,icmp False
See also
External links
- Kubernetes the Hard Way — on GitHub
- CFSSL — CloudFlare's PKI/TLS toolkit on GitHub
