Primeros pasos con kubernetes: kubeadm

En nuestro escenario, el controlador será la máquina gru y los “minions” serán los equipos bob y stuart.

INSTALAR DOCKER

Lo primero es instalar docker en todas las máquinas.

sudo apt install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common

sudo add-apt-repository \
 "deb [arch=amd64] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
 $(lsb_release -cs) \
 stable"

sudo curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | sudo apt-key add -

sudo apt update

sudo apt install -y docker-ce

INSTALAR KUBEADM

Hay que instalar kubeadm, kubelet y kubectl en todas las máquinas

sudo curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
sudo add-apt-repository "deb http://apt.kubernetes.io/ kubernetes-xenial main"
sudo apt update
sudo apt install -y kubelet kubeadm kubectl

INICIAR KUBEADM

Este paso es solo necesario en gru.

debian@gru:~$ sudo kubeadm init --pod-network-cidr=10.0.0.0/16
[init] Using Kubernetes version: v1.9.2
[init] Using Authorization modes: [Node RBAC]
[preflight] Running pre-flight checks.
 [WARNING SystemVerification]: docker version is greater than the most recently validated version. Docker version: 17.12.0-ce. Max validated version: 17.03
 [WARNING FileExisting-crictl]: crictl not found in system path
[preflight] Starting the kubelet service
[certificates] Generated ca certificate and key.
[certificates] Generated apiserver certificate and key.
[certificates] apiserver serving cert is signed for DNS names [gru kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.0.0.19]
[certificates] Generated apiserver-kubelet-client certificate and key.
[certificates] Generated sa key and public key.
[certificates] Generated front-proxy-ca certificate and key.
[certificates] Generated front-proxy-client certificate and key.
[certificates] Valid certificates and keys now exist in "/etc/kubernetes/pki"
[kubeconfig] Wrote KubeConfig file to disk: "admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "kubelet.conf"
[kubeconfig] Wrote KubeConfig file to disk: "controller-manager.conf"
[kubeconfig] Wrote KubeConfig file to disk: "scheduler.conf"
[controlplane] Wrote Static Pod manifest for component kube-apiserver to "/etc/kubernetes/manifests/kube-apiserver.yaml"
[controlplane] Wrote Static Pod manifest for component kube-controller-manager to "/etc/kubernetes/manifests/kube-controller-manager.yaml"
[controlplane] Wrote Static Pod manifest for component kube-scheduler to "/etc/kubernetes/manifests/kube-scheduler.yaml"
[etcd] Wrote Static Pod manifest for a local etcd instance to "/etc/kubernetes/manifests/etcd.yaml"
[init] Waiting for the kubelet to boot up the control plane as Static Pods from directory "/etc/kubernetes/manifests".
[init] This might take a minute or longer if the control plane images have to be pulled.
[apiclient] All control plane components are healthy after 33.503883 seconds
[uploadconfig] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[markmaster] Will mark node gru as master by adding a label and a taint
[markmaster] Master gru tainted and labelled with key/value: node-role.kubernetes.io/master=""
[bootstraptoken] Using token: 25e3b8.fbb6254cf30e2416
[bootstraptoken] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstraptoken] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstraptoken] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstraptoken] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[addons] Applied essential addon: kube-dns
[addons] Applied essential addon: kube-proxy
Your Kubernetes master has initialized successfully!

To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
 sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
 sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
 https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of machines by running the following on each node
as root:
kubeadm join --token 25e3b8.fbb6254cf30e2416 10.0.0.19:6443 --discovery-token-ca-cert-hash sha256:fe555f0b0c7a3aff11ed7c7667ab428710d667d79482c2318ce1e38eee6fd8fc

Ejecutamos los comandos que nos indica:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Podemos ver los token con el siguiente comando:

sudo kubeadm token list

INSTALAR RED DE PODS

Hay que instalar un add-on para que los pods se puedan conectar a través de la red. En este caso voy a usar Calico.

Para instalarno ejecutamos el siguiente comando:

ubuntu@gru:~$ kubectl apply -f https://docs.projectcalico.org/v2.6/getting-started/kubernetes/installation/hosted/kubeadm/1.6/calico.yaml
configmap "calico-config" created
daemonset "calico-etcd" created
service "calico-etcd" created
daemonset "calico-node" created
deployment "calico-kube-controllers" created
deployment "calico-policy-controller" created
clusterrolebinding "calico-cni-plugin" created
clusterrole "calico-cni-plugin" created
serviceaccount "calico-cni-plugin" created
clusterrolebinding "calico-kube-controllers" created
clusterrole "calico-kube-controllers" created
serviceaccount "calico-kube-controllers" created

 

CONECTAR LOS CLIENTES

Cuando ejecutamos el init en los pasos anteriores nos daba un comando para conectar los clientes. Basta con ejecutarlo en el equipo a conectar para que se vean:

debian@bob:~$ sudo kubeadm join --token f1fcad.94555d403a307ae7 10.0.0.17:6443 --discovery-token-ca-cert-hash sha256:b0c52b3e8be3c84f1eec78bd53959939bd6ad42032dd40ad75b1faeead2ffae6
[preflight] Running pre-flight checks.
 [WARNING SystemVerification]: docker version is greater than the most recently validated version. Docker version: 17.12.0-ce. Max validated version: 17.03
 [WARNING FileExisting-crictl]: crictl not found in system path
[discovery] Trying to connect to API Server "10.0.0.17:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://10.0.0.17:6443"
[discovery] Requesting info from "https://10.0.0.17:6443" again to validate TLS against the pinned public key
[discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "10.0.0.17:6443"
[discovery] Successfully established connection with API Server "10.0.0.17:6443"

This node has joined the cluster:
* Certificate signing request was sent to master and a response
 was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the master to see this node join the cluster.

En el master ejecutamos:

ubuntu@gru:~$ sudo kubectl get nodes
NAME STATUS ROLES AGE VERSION
bob NotReady <none> 10s v1.9.2
gru Ready master 3m v1.9.2

AUTOCOMPLETADO EN BASH

Para que cuando tabulemos nos autocomplete el comando, ejecutamos:

ubuntu@gru:~$ echo "source <(kubectl completion bash)" >> ~/.bashrc
ubuntu@gru:~$ source .bashrc

EJEMPLO

ubuntu@gru:~$ sudo kubectl run webserver --image=nginx --replicas=1 --port=80
sudo: unable to resolve host gru
deployment "webserver" created

ubuntu@gru:~$ sudo kubectl get deploy
sudo: unable to resolve host gru
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
webserver 1 1 1 0 21s

ubuntu@gru:~$ sudo kubectl get deploy
sudo: unable to resolve host gru
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
webserver 1 1 1 0 21s

ubuntu@gru:~$ kubectl get rs
NAME DESIRED CURRENT READY AGE
webserver-5c8cff6796 1 1 0 29s
ubuntu@gru:~$ kubectl get pods
NAME READY STATUS RESTARTS AGE
webserver-5c8cff6796-s86sn 0/1 Pending 0 34s

ubuntu@gru:~$ kubectl describe rs
Name: webserver-5c8cff6796
Namespace: default
Selector: pod-template-hash=1747992352,run=webserver
Labels: pod-template-hash=1747992352
 run=webserver
Annotations: deployment.kubernetes.io/desired-replicas=1
 deployment.kubernetes.io/max-replicas=2
 deployment.kubernetes.io/revision=1
Controlled By: Deployment/webserver
Replicas: 1 current / 1 desired
Pods Status: 0 Running / 1 Waiting / 0 Succeeded / 0 Failed
Pod Template:
 Labels: pod-template-hash=1747992352
 run=webserver
 Containers:
 webserver:
 Image: nginx
 Port: 80/TCP
 Environment: <none>
 Mounts: <none>
 Volumes: <none>
Events:
 Type Reason Age From Message
 ---- ------ ---- ---- -------
 Normal SuccessfulCreate 1m replicaset-controller Created pod: webserver-5c8cff6796-s86sn

ubuntu@gru:~$ kubectl get pods
NAME READY STATUS RESTARTS AGE
webserver-5c8cff6796-s86sn 0/1 Pending 0 34s

Un comentario sobre “Primeros pasos con kubernetes: kubeadm

Deja un comentario

Tu dirección de correo electrónico no será publicada. Los campos obligatorios están marcados con *