diff --git a/docs/08-controller-manager.md b/docs/08-controller-manager.md index a207fec..3d6d844 100644 --- a/docs/08-controller-manager.md +++ b/docs/08-controller-manager.md @@ -1,6 +1,6 @@ # Controller manager -In this part we will configure controller-manager. +In this section we will configure controller-manager. ![image](./img/08_cluster_architecture_controller_manager.png "Kubelet") diff --git a/docs/09-kubeproxy.md b/docs/09-kubeproxy.md index e3c29e2..5aaf1ea 100644 --- a/docs/09-kubeproxy.md +++ b/docs/09-kubeproxy.md @@ -1,9 +1,12 @@ # Kube-proxy +In this section we will configure kupe-proxy. +> kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept. +> kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster. + ![image](./img/09_cluster_architecture_proxy.png "Kubelet") -такс, - +Before we will start, lets clarify the reason why do we need it. To do that, we will create deployment with nginx. ```bash { cat < nginx-deployment.yml @@ -65,8 +68,7 @@ nginx-deployment-db9778f94-q5jx4 1/1 Running 0 63s 10.240.1.1 nginx-deployment-db9778f94-twx78 1/1 Running 0 63s 10.240.1.11 example-server ``` -now, we will run busybox container and will try to access our pods from other container - +As you an see, we created 3 pods (each has its own ip address). Now, we will run busybox container and will try to access our pods from other container ```bash { cat < pod.yaml @@ -85,8 +87,7 @@ kubectl apply -f pod.yaml } ``` -and execute command from our container - +And execute command from our container ```bash kubectl exec busy-box -- wget -O - $(kubectl get pod -o wide | grep nginx | awk '{print $6}' | head -n 1) ``` @@ -96,8 +97,7 @@ Output: error: unable to upgrade connection: Forbidden (user=kubernetes, verb=create, resource=nodes, subresource=proxy) ``` -error occured because api server has no access to execute commands - +This error occured, because api server has no access to execute commands. We will fix this issue, by creating cluster role and assigning it role to kubernetes user. ```bash { cat < rbac-create.yml @@ -128,8 +128,7 @@ kubectl apply -f rbac-create.yml } ``` -and execute command from our container - +Now, we can execute command ```bash kubectl exec busy-box -- wget -O - $(kubectl get pod -o wide | grep nginx | awk '{print $6}' | head -n 1) ``` @@ -143,10 +142,9 @@ writing to stdout written to stdout ``` -it is not very interesting to access pods by ip, we want to have some automatic load balancing -we know that services may help us with that - +Note: it take some time to apply user permission. During this you can steel see permission error. +As you can see, we successfully received the response from the nginx. But to do that we used the IP address of the pod. To solve service discovery issue, kubernetes has special component - service. Now we will create it. ```bash { cat < nginx-service.yml @@ -167,14 +165,12 @@ kubectl apply -f nginx-service.yml } ``` -get our server - +Get service created ```bash kubectl get service ``` -and try to ping our containers by service ip - +Now, we will try to access our pods by using the IP of the service created. ```bash kubectl exec busy-box -- wget -O - $(kubectl get service -o wide | grep nginx | awk '{print $3}') ``` @@ -184,14 +180,14 @@ Output: Connecting to 10.32.0.230 (10.32.0.230:80) ``` -hm, nothing happen, the reason - our cluster do not know how to connect to service ip +As you can see, we received an error. This error occured because kubernetes know nothing about the IP creted for the service. As already mentioned, kube-proxy is the component responsible to handle requests to ip of the service and redirect that requests to the pods. So, lets configure kube-proxy. -this is responsibiltiy of kube-proxy +## certificates -it means that we need to configure kube-proxy - -as usually we will start with certs +We will start with certificates. +As you remeber we configured our API server to use client certificate to authenticate user. +So, lets create proper certificate for the kube-proxy ```bash { cat > kube-proxy-csr.json < In Kubernetes, DNS (Domain Name System) is a crucial component that enables service discovery and communication between various resources within a cluster. DNS allows you to refer to services, pods, and other Kubernetes objects by their domain names instead of IP addresses, making it easier to manage and communicate between them. + +Befire we will configure it, we can check if we can access our service (created in previuos section) by its name. ```bash kubectl exec busy-box -- wget -O - nginx-service ``` -and nothing happen +And nothing happen. The reason of this befaviour - pod can't resolve IP address of the domain name requested as DNS server is not configured in our cluster. -the reason is DNS server which we still not configured - -but dns server we can install from kubernetes directly - -```bash -kubectl apply -f https://storage.googleapis.com/kubernetes-the-hard-way/coredns-1.8.yaml +Also, would like to mention, that kubernetes automatically configure DNS system in pod to use "special" DNS server configured for our cluster, this DNS server was configured using during setting up kubelet +``` +... +clusterDNS: + - "10.32.0.10" +... ``` -and try to erpeat +We will configure DNS server with the usage of the coredns, and will install it using out kubernetes cluster +```bash +kubectl apply -f https://raw.githubusercontent.com/ruslansavchuk/kubernetes-the-hard-way/master/manifests/coredns.yml -n kube-system +``` +After our DNS server is up and running, we can try to repeat the call once again ```bash kubectl exec busy-box -- wget -O - nginx-service ``` - Output: ``` Hello from pod: nginx-deployment-68b9c94586-zh9vn @@ -33,4 +43,4 @@ writing to stdout written to stdout ``` -great, everything works as expected \ No newline at end of file +As you can see everything works as expected.