diff --git a/docs/08-bootstrapping-kubernetes-controllers.md b/docs/08-bootstrapping-kubernetes-controllers.md index 1c2883b..abc327b 100644 --- a/docs/08-bootstrapping-kubernetes-controllers.md +++ b/docs/08-bootstrapping-kubernetes-controllers.md @@ -4,22 +4,23 @@ In this lab you will bootstrap the Kubernetes control plane across three compute ## Prerequisites -The commands in this lab must be run on each controller instance: `controller-0`, `controller-1`, and `controller-2`. Login to each controller instance using the `gcloud` command. Example: +The commands in this lab must be run on each controller instance: `controller-1`, `controller-2`, and `controller-3`. Login to each controller instance: ``` -gcloud compute ssh controller-0 +$ ssh -i ~/.ssh/id_rsa-k8s.pub 10.240.0.11 ``` ### Running commands in parallel with tmux [tmux](https://github.com/tmux/tmux/wiki) can be used to run commands on multiple compute instances at the same time. See the [Running commands in parallel with tmux](01-prerequisites.md#running-commands-in-parallel-with-tmux) section in the Prerequisites lab. + ## Provision the Kubernetes Control Plane Create the Kubernetes configuration directory: ``` -sudo mkdir -p /etc/kubernetes/config +$ sudo mkdir -p /etc/kubernetes/config ``` ### Download and Install the Kubernetes Controller Binaries @@ -27,7 +28,7 @@ sudo mkdir -p /etc/kubernetes/config Download the official Kubernetes release binaries: ``` -wget -q --show-progress --https-only --timestamping \ +$ wget -q --show-progress --https-only --timestamping \ "https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kube-apiserver" \ "https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kube-controller-manager" \ "https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kube-scheduler" \ @@ -37,7 +38,7 @@ wget -q --show-progress --https-only --timestamping \ Install the Kubernetes binaries: ``` -{ +$ { chmod +x kube-apiserver kube-controller-manager kube-scheduler kubectl sudo mv kube-apiserver kube-controller-manager kube-scheduler kubectl /usr/local/bin/ } @@ -46,7 +47,7 @@ Install the Kubernetes binaries: ### Configure the Kubernetes API Server ``` -{ +$ { sudo mkdir -p /var/lib/kubernetes/ sudo mv ca.pem ca-key.pem kubernetes-key.pem kubernetes.pem \ @@ -55,17 +56,16 @@ Install the Kubernetes binaries: } ``` -The instance internal IP address will be used to advertise the API Server to members of the cluster. Retrieve the internal IP address for the current compute instance: +The instance internal IP address will be used to advertise the API Server to members of the cluster. Get the internal IP address for the current compute instance: ``` -INTERNAL_IP=$(curl -s -H "Metadata-Flavor: Google" \ - http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip) +$ INTERNAL_IP=$(ip a s | grep 'inet 10' | awk '{ print $2 }' | awk -F"/" '{ print $1 }') ``` Create the `kube-apiserver.service` systemd unit file: ``` -cat < Allow up to 10 seconds for the Kubernetes API Server to fully initialize. -### Enable HTTP Health Checks - -A [Google Network Load Balancer](https://cloud.google.com/compute/docs/load-balancing/network) will be used to distribute traffic across the three API servers and allow each API server to terminate TLS connections and validate client certificates. The network load balancer only supports HTTP health checks which means the HTTPS endpoint exposed by the API server cannot be used. As a workaround the nginx webserver can be used to proxy HTTP health checks. In this section nginx will be installed and configured to accept HTTP health checks on port `80` and proxy the connections to the API server on `https://127.0.0.1:6443/healthz`. - -> The `/healthz` API server endpoint does not require authentication by default. - -Install a basic web server to handle HTTP health checks: - -``` -sudo apt-get install -y nginx -``` - -``` -cat > kubernetes.default.svc.cluster.local < Remember to run the above commands on each controller node: `controller-0`, `controller-1`, and `controller-2`. ## RBAC for Kubelet Authorization @@ -284,13 +224,13 @@ In this section you will configure RBAC permissions to allow the Kubernetes API > This tutorial sets the Kubelet `--authorization-mode` flag to `Webhook`. Webhook mode uses the [SubjectAccessReview](https://kubernetes.io/docs/admin/authorization/#checking-api-access) API to determine authorization. ``` -gcloud compute ssh controller-0 +$ ssh -i ~/.ssh/id_rsa-k8s.pub 10.240.0.11 ``` Create the `system:kube-apiserver-to-kubelet` [ClusterRole](https://kubernetes.io/docs/admin/authorization/rbac/#role-and-clusterrole) with permissions to access the Kubelet API and perform most common tasks associated with managing pods: ``` -cat <