From 3b1700d85e9de1ff6a6f20eb3d01353e8b5810c4 Mon Sep 17 00:00:00 2001 From: Kelsey Hightower Date: Thu, 23 Mar 2017 19:48:14 -0700 Subject: [PATCH] update to Kubernetes 1.6 --- README.md | 4 +- docs/01-infrastructure-gcp.md | 16 +- docs/02-certificate-authority.md | 79 ++++++++-- docs/03-etcd.md | 77 +++++---- docs/04-kubernetes-controller.md | 257 ++++++++++++++++++------------- docs/05-kubernetes-worker.md | 146 ++++++++++-------- docs/06-kubectl.md | 15 +- 7 files changed, 355 insertions(+), 239 deletions(-) diff --git a/README.md b/README.md index bb8d14c..1f46638 100644 --- a/README.md +++ b/README.md @@ -17,9 +17,9 @@ The target audience for this tutorial is someone planning to support a productio ## Cluster Details -* Kubernetes 1.5.1 +* Kubernetes 1.6.0 * Docker 1.12.1 -* etcd 3.0.10 +* etcd 3.1.4 * [CNI Based Networking](https://github.com/containernetworking/cni) * Secure communication between all components (etcd, control plane, workers) * Default Service Account and Secrets diff --git a/docs/01-infrastructure-gcp.md b/docs/01-infrastructure-gcp.md index 7309b35..e813f79 100644 --- a/docs/01-infrastructure-gcp.md +++ b/docs/01-infrastructure-gcp.md @@ -33,6 +33,7 @@ gcloud config set compute/region us-central1 ``` gcloud config set compute/zone us-central1-f ``` + Create a Kubernetes network: ``` @@ -104,13 +105,14 @@ gcloud compute firewall-rules list --filter "network=kubernetes" ``` ``` -NAME NETWORK SRC_RANGES RULES SRC_TAGS TARGET_TAGS -kubernetes-allow-api-server kubernetes 0.0.0.0/0 tcp:6443 -kubernetes-allow-healthz kubernetes 130.211.0.0/22 tcp:8080 -kubernetes-allow-icmp kubernetes 0.0.0.0/0 icmp -kubernetes-allow-internal kubernetes 10.240.0.0/24 tcp:0-65535,udp:0-65535,icmp -kubernetes-allow-rdp kubernetes 0.0.0.0/0 tcp:3389 -kubernetes-allow-ssh kubernetes 0.0.0.0/0 tcp:22 +NAME NETWORK SRC_RANGES RULES SRC_TAGS TARGET_TAGS +kubernetes-allow-api-server kubernetes 0.0.0.0/0 tcp:6443 +kubernetes-allow-healthz kubernetes 130.211.0.0/22 tcp:8080 +kubernetes-allow-icmp kubernetes 0.0.0.0/0 icmp +kubernetes-allow-internal kubernetes 10.240.0.0/24 tcp:0-65535,udp:0-65535,icmp +kubernetes-allow-internal-podcidr kubernetes 10.200.0.0/16 tcp:0-65535,udp:0-65535,icmp +kubernetes-allow-rdp kubernetes 0.0.0.0/0 tcp:3389 +kubernetes-allow-ssh kubernetes 0.0.0.0/0 tcp:22 ``` ### Kubernetes Public Address diff --git a/docs/02-certificate-authority.md b/docs/02-certificate-authority.md index 80f7572..9a7f4ed 100644 --- a/docs/02-certificate-authority.md +++ b/docs/02-certificate-authority.md @@ -139,6 +139,49 @@ KUBERNETES_PUBLIC_ADDRESS=$(aws elb describe-load-balancers \ --- +Create the `admin-csr.json` file: + +``` +cat > admin-csr.json < kubernetes-csr.json < etcd.service <<"EOF" -[Unit] -Description=etcd -Documentation=https://github.com/coreos - -[Service] -ExecStart=/usr/bin/etcd --name ETCD_NAME \ - --cert-file=/etc/etcd/kubernetes.pem \ - --key-file=/etc/etcd/kubernetes-key.pem \ - --peer-cert-file=/etc/etcd/kubernetes.pem \ - --peer-key-file=/etc/etcd/kubernetes-key.pem \ - --trusted-ca-file=/etc/etcd/ca.pem \ - --peer-trusted-ca-file=/etc/etcd/ca.pem \ - --initial-advertise-peer-urls https://INTERNAL_IP:2380 \ - --listen-peer-urls https://INTERNAL_IP:2380 \ - --listen-client-urls https://INTERNAL_IP:2379,http://127.0.0.1:2379 \ - --advertise-client-urls https://INTERNAL_IP:2379 \ - --initial-cluster-token etcd-cluster-0 \ - --initial-cluster controller0=https://10.240.0.10:2380,controller1=https://10.240.0.11:2380,controller2=https://10.240.0.12:2380 \ - --initial-cluster-state new \ - --data-dir=/var/lib/etcd -Restart=on-failure -RestartSec=5 - -[Install] -WantedBy=multi-user.target -EOF -``` - ### Set The Internal IP Address The internal IP address will be used by etcd to serve client requests and communicate with other etcd peers. @@ -116,14 +84,37 @@ Each etcd member must have a unique name within an etcd cluster. Set the etcd na ETCD_NAME=controller$(echo $INTERNAL_IP | cut -c 11) ``` -Substitute the etcd name and internal IP address: +The etcd server will be started and managed by systemd. Create the etcd systemd unit file: ``` -sed -i s/INTERNAL_IP/${INTERNAL_IP}/g etcd.service -``` +cat > etcd.service < token.csv < bootstrap.kubeconfig < kube-apiserver.service <<"EOF" +cat > kube-apiserver.service < kube-controller-manager.service <<"EOF" +cat > kube-controller-manager.service < kube-scheduler.service <<"EOF" +cat > kube-scheduler.service < docker.service < /etc/systemd/system/docker.service' +WantedBy=multi-user.target +EOF +``` + +``` +sudo mv docker.service /etc/systemd/system/docker.service ``` ``` @@ -90,24 +121,24 @@ sudo mkdir -p /opt/cni ``` ``` -wget https://storage.googleapis.com/kubernetes-release/network-plugins/cni-07a8a28637e97b22eb8dfe710eeae1344f69d16e.tar.gz +wget https://storage.googleapis.com/kubernetes-release/network-plugins/cni-amd64-0799f5732f2a11b329d9e3d51b9c8f2e3759f2ff.tar.gz ``` ``` -sudo tar -xvf cni-07a8a28637e97b22eb8dfe710eeae1344f69d16e.tar.gz -C /opt/cni +sudo tar -xvf cni-amd64-0799f5732f2a11b329d9e3d51b9c8f2e3759f2ff.tar.gz -C /opt/cni ``` Download and install the Kubernetes worker binaries: ``` -wget https://storage.googleapis.com/kubernetes-release/release/v1.5.1/bin/linux/amd64/kubectl +wget https://storage.googleapis.com/kubernetes-release/release/v1.6.0-beta.4/bin/linux/amd64/kubectl ``` ``` -wget https://storage.googleapis.com/kubernetes-release/release/v1.5.1/bin/linux/amd64/kube-proxy +wget https://storage.googleapis.com/kubernetes-release/release/v1.6.0-beta.4/bin/linux/amd64/kube-proxy ``` ``` -wget https://storage.googleapis.com/kubernetes-release/release/v1.5.1/bin/linux/amd64/kubelet +wget https://storage.googleapis.com/kubernetes-release/release/v1.6.0-beta.4/bin/linux/amd64/kubelet ``` ``` @@ -118,61 +149,42 @@ chmod +x kubectl kube-proxy kubelet sudo mv kubectl kube-proxy kubelet /usr/bin/ ``` -``` -sudo mkdir -p /var/lib/kubelet/ -``` - -``` -sudo sh -c 'echo "apiVersion: v1 -kind: Config -clusters: -- cluster: - certificate-authority: /var/lib/kubernetes/ca.pem - server: https://10.240.0.10:6443 - name: kubernetes -contexts: -- context: - cluster: kubernetes - user: kubelet - name: kubelet -current-context: kubelet -users: -- name: kubelet - user: - token: chAng3m3" > /var/lib/kubelet/kubeconfig' -``` - Create the kubelet systemd unit file: ``` -sudo sh -c 'echo "[Unit] +cat > kubelet.service < /etc/systemd/system/kubelet.service' +WantedBy=multi-user.target +EOF +``` + +``` +sudo mv kubelet.service /etc/systemd/system/kubelet.service ``` ``` @@ -190,22 +202,26 @@ sudo systemctl status kubelet --no-pager ``` -sudo sh -c 'echo "[Unit] +cat > kube-proxy.service < /etc/systemd/system/kube-proxy.service' +WantedBy=multi-user.target +``` + +``` +sudo mv kube-proxy.service /etc/systemd/system/kube-proxy.service ``` ``` diff --git a/docs/06-kubectl.md b/docs/06-kubectl.md index 65bbe1f..efdc528 100644 --- a/docs/06-kubectl.md +++ b/docs/06-kubectl.md @@ -7,7 +7,7 @@ Run the following commands from the machine which will be your Kubernetes Client ### OS X ``` -wget https://storage.googleapis.com/kubernetes-release/release/v1.5.1/bin/darwin/amd64/kubectl +wget https://storage.googleapis.com/kubernetes-release/release/v1.6.0-beta.4/bin/darwin/amd64/kubectl chmod +x kubectl sudo mv kubectl /usr/local/bin ``` @@ -15,7 +15,7 @@ sudo mv kubectl /usr/local/bin ### Linux ``` -wget https://storage.googleapis.com/kubernetes-release/release/v1.5.1/bin/linux/amd64/kubectl +wget https://storage.googleapis.com/kubernetes-release/release/v1.6.0-beta.4/bin/linux/amd64/kubectl chmod +x kubectl sudo mv kubectl /usr/local/bin ``` @@ -40,13 +40,6 @@ KUBERNETES_PUBLIC_ADDRESS=$(aws elb describe-load-balancers \ ``` --- -Recall the token we setup for the admin user: - -``` -# /var/lib/kubernetes/token.csv on the controller nodes -chAng3m3,admin,admin -``` - Also be sure to locate the CA certificate [created earlier](02-certificate-authority.md). Since we are using self-signed TLS certs we need to trust the CA certificate so we can verify the remote API Servers. ### Build up the kubeconfig entry @@ -61,7 +54,9 @@ kubectl config set-cluster kubernetes-the-hard-way \ ``` ``` -kubectl config set-credentials admin --token chAng3m3 +kubectl config set-credentials admin \ + --client-certificate=admin.pem \ + --client-key=admin-key.pem ``` ```