Difference between revisions of "Kubernetes/the-hard-way"

From Christoph's Personal Wiki
Jump to: navigation, search
(Install the client tools)
(Provisioning compute resources)
Line 65: Line 65:
 
$ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom
 
$ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom
 
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way].
 
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way].
 +
 +
$ gcloud compute networks list --filter="name~'.*hard.*'"
 
NAME                    SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4
 
NAME                    SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4
 
kubernetes-the-hard-way  CUSTOM      REGIONAL
 
kubernetes-the-hard-way  CUSTOM      REGIONAL
 +
</pre>
 +
 +
A [https://cloud.google.com/compute/docs/vpc/#vpc_networks_and_subnets subnet] must be provisioned with an IP address range large enough to assign a private IP address to each node in the Kubernetes cluster.
 +
 +
* Create the kubernetes subnet in the kubernetes-the-hard-way VPC network:
 +
<pre>
 +
$ gcloud compute networks subnets create kubernetes \
 +
  --network kubernetes-the-hard-way \
 +
  --range 10.240.0.0/24
 +
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/regions/us-west1/subnetworks/kubernetes].
 +
 +
$ gcloud compute networks subnets list --filter="network ~ kubernetes-the-hard-way"
 +
NAME        REGION    NETWORK                  RANGE
 +
kubernetes  us-west1  kubernetes-the-hard-way  10.240.0.0/24
 +
</pre>
 +
 +
Note: The <code>10.240.0.0/24</code> IP address range can host up to 254 compute instances.
 +
 +
; Firewall rules
 +
 +
* Create a firewall rule that allows internal communication across all protocols:
 +
<pre>
 +
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-internal \
 +
  --allow tcp,udp,icmp \
 +
  --network kubernetes-the-hard-way \
 +
  --source-ranges 10.240.0.0/24,10.200.0.0/16
 +
</pre>
 +
 +
* Create a firewall rule that allows external SSH, ICMP, and HTTPS:
 +
<pre>
 +
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-external \
 +
  --allow tcp:22,tcp:6443,icmp \
 +
  --network kubernetes-the-hard-way \
 +
  --source-ranges 0.0.0.0/0
 +
</pre>
 +
 +
<pre>
 +
$ gcloud compute firewall-rules list --filter=network=kubernetes-the-hard-way
 +
NAME                                    NETWORK                  DIRECTION  PRIORITY  ALLOW                DENY  DISABLED
 +
kubernetes-the-hard-way-allow-external  kubernetes-the-hard-way  INGRESS    1000      tcp:22,tcp:6443,icmp        False
 +
kubernetes-the-hard-way-allow-internal  kubernetes-the-hard-way  INGRESS    1000      tcp,udp,icmp                False
 
</pre>
 
</pre>
  

Revision as of 00:31, 7 August 2019

This article will show how to setup Kubernetes The Hard Way, as originally developed by Kelsey Hightower. I will add my own additions, changes, alterations, etc. to the process (and this will be continually expanded upon).

Install the client tools

Note: See here for how to install on other OSes.

In this section, we will install the command line utilities required to complete this tutorial:

Install CFSSL

The cfssl and cfssljson command line utilities will be used to provision a PKI Infrastructure and generate TLS certificates.

$ wget -q --show-progress --https-only --timestamping \
    https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \
    https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64

$ chmod +x cfssl_linux-amd64 cfssljson_linux-amd64
$ sudo mv cfssl_linux-amd64 /usr/local/bin/cfssl
$ sudo mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
  • Verify cfssl version 1.2.0 or higher is installed:
$ cfssl version
Version: 1.2.0
Revision: dev
Runtime: go1.6

Note: The cfssljson command line utility does not provide a way to print its version.

Install kubectl

The kubectl command line utility is used to interact with the Kubernetes API Server.

  • Download and install kubectl from the official release binaries:
$ K8S_VERSION=$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)
$ curl -LO https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl
$ chmod +x kubectl
$ sudo mv kubectl /usr/local/bin/
  • Verify kubectl version 1.12.0 or higher is installed:
$ kubectl version --client
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:40:16Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}

Provisioning compute resources

Networking

Virtual Private Cloud Network (VPC)

In this section, a dedicated Virtual Private Cloud (VPC) network will be setup to host the Kubernetes cluster.

  • Create the kubernetes-the-hard-way custom VPC network:
$ gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/global/networks/kubernetes-the-hard-way].

$ gcloud compute networks list --filter="name~'.*hard.*'"
NAME                     SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4
kubernetes-the-hard-way  CUSTOM       REGIONAL

A subnet must be provisioned with an IP address range large enough to assign a private IP address to each node in the Kubernetes cluster.

  • Create the kubernetes subnet in the kubernetes-the-hard-way VPC network:
$ gcloud compute networks subnets create kubernetes \
  --network kubernetes-the-hard-way \
  --range 10.240.0.0/24
Created [https://www.googleapis.com/compute/v1/projects/<project-name>/regions/us-west1/subnetworks/kubernetes].

$ gcloud compute networks subnets list --filter="network ~ kubernetes-the-hard-way"
NAME        REGION    NETWORK                  RANGE
kubernetes  us-west1  kubernetes-the-hard-way  10.240.0.0/24

Note: The 10.240.0.0/24 IP address range can host up to 254 compute instances.

Firewall rules
  • Create a firewall rule that allows internal communication across all protocols:
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-internal \
  --allow tcp,udp,icmp \
  --network kubernetes-the-hard-way \
  --source-ranges 10.240.0.0/24,10.200.0.0/16
  • Create a firewall rule that allows external SSH, ICMP, and HTTPS:
$ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-external \
  --allow tcp:22,tcp:6443,icmp \
  --network kubernetes-the-hard-way \
  --source-ranges 0.0.0.0/0
$ gcloud compute firewall-rules list --filter=network=kubernetes-the-hard-way
NAME                                    NETWORK                  DIRECTION  PRIORITY  ALLOW                 DENY  DISABLED
kubernetes-the-hard-way-allow-external  kubernetes-the-hard-way  INGRESS    1000      tcp:22,tcp:6443,icmp        False
kubernetes-the-hard-way-allow-internal  kubernetes-the-hard-way  INGRESS    1000      tcp,udp,icmp                False

See also

External links