Update 10-tls-bootstrapping-kubernetes-workers.md
Add terminal prompt identifiers to indicate on which node each command should be run.pull/634/head
Greg Rundlett
GitHub
parent
9ea063f1dc
commit
b62a3e49fe
|
|
@ -40,7 +40,7 @@ So let's get started!
|
|||
Copy the ca certificate to the worker node:
|
||||
|
||||
```
|
||||
scp ca.crt worker-2:~/
|
||||
master-1$ scp ca.crt worker-2:~/
|
||||
```
|
||||
|
||||
## Step 1 Configure the Binaries on the Worker node
|
||||
|
|
@ -48,7 +48,7 @@ scp ca.crt worker-2:~/
|
|||
### Download and Install Worker Binaries
|
||||
|
||||
```
|
||||
wget -q --show-progress --https-only --timestamping \
|
||||
worker-2$ wget -q --show-progress --https-only --timestamping \
|
||||
https://storage.googleapis.com/kubernetes-release/release/v1.13.0/bin/linux/amd64/kubectl \
|
||||
https://storage.googleapis.com/kubernetes-release/release/v1.13.0/bin/linux/amd64/kube-proxy \
|
||||
https://storage.googleapis.com/kubernetes-release/release/v1.13.0/bin/linux/amd64/kubelet
|
||||
|
|
@ -59,7 +59,7 @@ Reference: https://kubernetes.io/docs/setup/release/#node-binaries
|
|||
Create the installation directories:
|
||||
|
||||
```
|
||||
sudo mkdir -p \
|
||||
worker-2$ sudo mkdir -p \
|
||||
/etc/cni/net.d \
|
||||
/opt/cni/bin \
|
||||
/var/lib/kubelet \
|
||||
|
|
@ -78,7 +78,7 @@ Install the worker binaries:
|
|||
```
|
||||
### Move the ca certificate
|
||||
|
||||
`sudo mv ca.crt /var/lib/kubernetes/`
|
||||
`worker-2$ sudo mv ca.crt /var/lib/kubernetes/`
|
||||
|
||||
# Step 1 Create the Boostrap Token to be used by Nodes(Kubelets) to invoke Certificate API
|
||||
|
||||
|
|
@ -86,10 +86,10 @@ For the workers(kubelet) to access the Certificates API, they need to authentica
|
|||
|
||||
Bootstrap Tokens take the form of a 6 character token id followed by 16 character token secret separated by a dot. Eg: abcdef.0123456789abcdef. More formally, they must match the regular expression [a-z0-9]{6}\.[a-z0-9]{16}
|
||||
|
||||
Bootstrap Tokens are created as a secret in the kube-system namespace.
|
||||
Bootstrap Tokens are created as a secret in the kube-system namespace on the master node.
|
||||
|
||||
```
|
||||
cat > bootstrap-token-07401b.yaml <<EOF
|
||||
master-1$ cat > bootstrap-token-07401b.yaml <<EOF
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
|
|
@ -119,7 +119,7 @@ stringData:
|
|||
EOF
|
||||
|
||||
|
||||
kubectl create -f bootstrap-token-07401b.yaml
|
||||
master-1$ kubectl create -f bootstrap-token-07401b.yaml
|
||||
|
||||
```
|
||||
|
||||
|
|
@ -136,11 +136,11 @@ Reference: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tok
|
|||
Next we associate the group we created before to the system:node-bootstrapper ClusterRole. This ClusterRole gives the group enough permissions to bootstrap the kubelet
|
||||
|
||||
```
|
||||
kubectl create clusterrolebinding create-csrs-for-bootstrapping --clusterrole=system:node-bootstrapper --group=system:bootstrappers
|
||||
master-1$ kubectl create clusterrolebinding create-csrs-for-bootstrapping --clusterrole=system:node-bootstrapper --group=system:bootstrappers
|
||||
|
||||
--------------- OR ---------------
|
||||
|
||||
cat > csrs-for-bootstrapping.yaml <<EOF
|
||||
master-1$ cat > csrs-for-bootstrapping.yaml <<EOF
|
||||
# enable bootstrapping nodes to create CSR
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -157,18 +157,18 @@ roleRef:
|
|||
EOF
|
||||
|
||||
|
||||
kubectl create -f csrs-for-bootstrapping.yaml
|
||||
master-1$ kubectl create -f csrs-for-bootstrapping.yaml
|
||||
|
||||
```
|
||||
Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#authorize-kubelet-to-create-csr
|
||||
|
||||
## Step 3 Authorize workers(kubelets) to approve CSR
|
||||
```
|
||||
kubectl create clusterrolebinding auto-approve-csrs-for-group --clusterrole=system:certificates.k8s.io:certificatesigningrequests:nodeclient --group=system:bootstrappers
|
||||
master-1$ kubectl create clusterrolebinding auto-approve-csrs-for-group --clusterrole=system:certificates.k8s.io:certificatesigningrequests:nodeclient --group=system:bootstrappers
|
||||
|
||||
--------------- OR ---------------
|
||||
|
||||
cat > auto-approve-csrs-for-group.yaml <<EOF
|
||||
master-1$ cat > auto-approve-csrs-for-group.yaml <<EOF
|
||||
# Approve all CSRs for the group "system:bootstrappers"
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -185,7 +185,7 @@ roleRef:
|
|||
EOF
|
||||
|
||||
|
||||
kubectl create -f auto-approve-csrs-for-group.yaml
|
||||
master-1$ kubectl create -f auto-approve-csrs-for-group.yaml
|
||||
```
|
||||
|
||||
Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#approval
|
||||
|
|
@ -195,11 +195,11 @@ Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kub
|
|||
We now create the Cluster Role Binding required for the nodes to automatically renew the certificates on expiry. Note that we are NOT using the **system:bootstrappers** group here any more. Since by the renewal period, we believe the node would be bootstrapped and part of the cluster already. All nodes are part of the **system:nodes** group.
|
||||
|
||||
```
|
||||
kubectl create clusterrolebinding auto-approve-renewals-for-nodes --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient --group=system:nodes
|
||||
master-1$ kubectl create clusterrolebinding auto-approve-renewals-for-nodes --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient --group=system:nodes
|
||||
|
||||
--------------- OR ---------------
|
||||
|
||||
cat > auto-approve-renewals-for-nodes.yaml <<EOF
|
||||
master-1$ cat > auto-approve-renewals-for-nodes.yaml <<EOF
|
||||
# Approve renewal CSRs for the group "system:nodes"
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -216,7 +216,7 @@ roleRef:
|
|||
EOF
|
||||
|
||||
|
||||
kubectl create -f auto-approve-renewals-for-nodes.yaml
|
||||
master-1$ kubectl create -f auto-approve-renewals-for-nodes.yaml
|
||||
```
|
||||
|
||||
Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#approval
|
||||
|
|
@ -231,7 +231,7 @@ Here, we don't have the certificates yet. So we cannot create a kubeconfig file.
|
|||
This is to be done on the `worker-2` node.
|
||||
|
||||
```
|
||||
sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig set-cluster bootstrap --server='https://192.168.5.30:6443' --certificate-authority=/var/lib/kubernetes/ca.crt
|
||||
worker-2$ sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig set-cluster bootstrap --server='https://192.168.5.30:6443' --certificate-authority=/var/lib/kubernetes/ca.crt
|
||||
sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig set-credentials kubelet-bootstrap --token=07401b.f395accd246ae52d
|
||||
sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig set-context bootstrap --user=kubelet-bootstrap --cluster=bootstrap
|
||||
sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig use-context bootstrap
|
||||
|
|
@ -240,7 +240,7 @@ sudo kubectl config --kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig use-conte
|
|||
Or
|
||||
|
||||
```
|
||||
cat <<EOF | sudo tee /var/lib/kubelet/bootstrap-kubeconfig
|
||||
worker-2$ cat <<EOF | sudo tee /var/lib/kubelet/bootstrap-kubeconfig
|
||||
apiVersion: v1
|
||||
clusters:
|
||||
- cluster:
|
||||
|
|
@ -269,7 +269,7 @@ Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kub
|
|||
Create the `kubelet-config.yaml` configuration file:
|
||||
|
||||
```
|
||||
cat <<EOF | sudo tee /var/lib/kubelet/kubelet-config.yaml
|
||||
worker-2$ cat <<EOF | sudo tee /var/lib/kubelet/kubelet-config.yaml
|
||||
kind: KubeletConfiguration
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
authentication:
|
||||
|
|
@ -296,7 +296,7 @@ EOF
|
|||
Create the `kubelet.service` systemd unit file:
|
||||
|
||||
```
|
||||
cat <<EOF | sudo tee /etc/systemd/system/kubelet.service
|
||||
worker-2$ cat <<EOF | sudo tee /etc/systemd/system/kubelet.service
|
||||
[Unit]
|
||||
Description=Kubernetes Kubelet
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
|
|
@ -334,13 +334,13 @@ Things to note here:
|
|||
In one of the previous steps we created the kube-proxy.kubeconfig file. Check [here](https://github.com/mmumshad/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md) if you missed it.
|
||||
|
||||
```
|
||||
sudo mv kube-proxy.kubeconfig /var/lib/kube-proxy/kubeconfig
|
||||
worker-2$ sudo mv kube-proxy.kubeconfig /var/lib/kube-proxy/kubeconfig
|
||||
```
|
||||
|
||||
Create the `kube-proxy-config.yaml` configuration file:
|
||||
|
||||
```
|
||||
cat <<EOF | sudo tee /var/lib/kube-proxy/kube-proxy-config.yaml
|
||||
worker-2$ cat <<EOF | sudo tee /var/lib/kube-proxy/kube-proxy-config.yaml
|
||||
kind: KubeProxyConfiguration
|
||||
apiVersion: kubeproxy.config.k8s.io/v1alpha1
|
||||
clientConnection:
|
||||
|
|
@ -353,7 +353,7 @@ EOF
|
|||
Create the `kube-proxy.service` systemd unit file:
|
||||
|
||||
```
|
||||
cat <<EOF | sudo tee /etc/systemd/system/kube-proxy.service
|
||||
worker-2$ cat <<EOF | sudo tee /etc/systemd/system/kube-proxy.service
|
||||
[Unit]
|
||||
Description=Kubernetes Kube Proxy
|
||||
Documentation=https://github.com/kubernetes/kubernetes
|
||||
|
|
@ -371,6 +371,8 @@ EOF
|
|||
|
||||
## Step 8 Start the Worker Services
|
||||
|
||||
On worker-2:
|
||||
|
||||
```
|
||||
{
|
||||
sudo systemctl daemon-reload
|
||||
|
|
@ -383,7 +385,7 @@ EOF
|
|||
|
||||
## Step 9 Approve Server CSR
|
||||
|
||||
`kubectl get csr`
|
||||
`master-1$ kubectl get csr`
|
||||
|
||||
```
|
||||
NAME AGE REQUESTOR CONDITION
|
||||
|
|
@ -393,7 +395,7 @@ csr-95bv6 20s system:node:worker-
|
|||
|
||||
Approve
|
||||
|
||||
`kubectl certificate approve csr-95bv6`
|
||||
`master-1$ kubectl certificate approve csr-95bv6`
|
||||
|
||||
Reference: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubectl-approval
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue