Skip to content

Commit c0c25b6

Browse files
kenfdevkenfdev
committed
initial commit
0 parents  commit c0c25b6

File tree

57 files changed

+1166
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+1166
-0
lines changed

‎.gitignore

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
workspace/*
2+
!workspace/.gitkeep
3+
*.log
4+
5+
# Created by https://www.gitignore.io/api/macos,vagrant
6+
7+
### macOS ###
8+
*.DS_Store
9+
.AppleDouble
10+
.LSOverride
11+
12+
# Icon must end with two \r
13+
Icon
14+
15+
# Thumbnails
16+
._*
17+
18+
# Files that might appear in the root of a volume
19+
.DocumentRevisions-V100
20+
.fseventsd
21+
.Spotlight-V100
22+
.TemporaryItems
23+
.Trashes
24+
.VolumeIcon.icns
25+
.com.apple.timemachine.donotpresent
26+
27+
# Directories potentially created on remote AFP share
28+
.AppleDB
29+
.AppleDesktop
30+
Network Trash Folder
31+
Temporary Items
32+
.apdisk
33+
34+
### Vagrant ###
35+
.vagrant/
36+
*.box
37+
38+
39+
# End of https://www.gitignore.io/api/macos,vagrant

‎README.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Kubernetes the hard way with vagrant
2+
3+
You can study kubernetes with vagrant. Credits go to the Kinvolk team because this repository is based on https://github.com/kinvolk/kubernetes-the-hard-way-vagrant .
4+
5+
#### Differences with the Kinvolk version atm
6+
7+
* Uses containerd
8+
* Uses gVisor
9+
* The pod-cidr is the same as the tutorial ( `10.200.${i}.0/24` )
10+
11+
## How to use this repository
12+
13+
* Hit `vagrant up` to bring up the vms (1 load balancer node, 3 controllers nodes , 3 worker nodes)
14+
* Use the `workspace` directory to follow Kelsey Hightower's repository https://github.com/kelseyhightower/kubernetes-the-hard-way
15+
* A few things to care about is
16+
* `gcloud` commands won't work (of course). Skip everything related to `gcloud` or use an alternative command. Have a look at the `scripts` directory if you get stuck. They correspond with the chapters.
17+
* `EXTERNAL_IP` , `KUBERNETES_PUBLIC_ADDRESS` would be `10.240.0.40` (the load balancer's ip)
18+
* [vagrant-scp](https://github.com/invernizzi/vagrant-scp) would come in handy for `scp` commands
19+
* Careful about `INTERNAL_IP`s and `POD_CIDR` because you cannot fetch them with `gcloud` commands.
20+
* Be sure to add the `[plugins.cri]` config and `stream_server_address` setting to the `containerd`'s `config.toml`. If you miss this, you won't be able to `exec` in to the container. Have a look at the [script](./scripts/k8s-the-hard-way/0902-configure-containerd.sh) .
21+
* `vagrant destroy -f` when you finish and clean up the `workspace` .
22+
23+
24+
25+
All the scripts inside the `scripts` directory correspond to the commands and chapters mentioned in the tutorial. It uses alternative commands which correspond to `gcloud` commands. This has been tested with [this version](https://github.com/kelseyhightower/kubernetes-the-hard-way/tree/36d4bbf4ad16cbe3c6eb809d9f567c07eaddea8c) of the tutorial.
26+
27+
28+

‎Vagrantfile

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# -*- mode: ruby -*-
2+
# vi: set ft=ruby :
3+
4+
Vagrant.configure("2") do |config|
5+
config.vm.box = "ubuntu/bionic64"
6+
7+
config.vm.provider "virtualbox" do |vb|
8+
vb.memory = "512"
9+
end
10+
11+
# must be at the top
12+
config.vm.define "lb-0" do |c|
13+
c.vm.hostname = "lb-0"
14+
c.vm.network "private_network", ip: "10.240.0.40"
15+
16+
c.vm.provision :shell, :path => "scripts/bootstrap/vagrant-setup-haproxy.sh"
17+
18+
c.vm.provider "virtualbox" do |vb|
19+
vb.memory = "256"
20+
end
21+
end
22+
23+
(0..2).each do |n|
24+
config.vm.define "controller-#{n}" do |c|
25+
c.vm.hostname = "controller-#{n}"
26+
c.vm.network "private_network", ip: "10.240.0.1#{n}"
27+
28+
c.vm.provision :shell, :path => "scripts/bootstrap/vagrant-setup-hosts-file.sh"
29+
end
30+
end
31+
32+
(0..2).each do |n|
33+
config.vm.define "worker-#{n}" do |c|
34+
c.vm.hostname = "worker-#{n}"
35+
c.vm.network "private_network", ip: "10.240.0.2#{n}"
36+
37+
c.vm.provision :shell, :path => "scripts/bootstrap/vagrant-setup-routes.sh"
38+
c.vm.provision :shell, :path => "scripts/bootstrap/vagrant-setup-hosts-file.sh"
39+
end
40+
end
41+
42+
end

‎scripts/bootstrap/vagrant-setup-haproxy.sh

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
apt-get update
6+
apt-get install -y haproxy
7+
8+
grep -q -F 'net.ipv4.ip_nonlocal_bind=1' /etc/sysctl.conf || echo 'net.ipv4.ip_nonlocal_bind=1' >> /etc/sysctl.conf
9+
10+
cat >/etc/haproxy/haproxy.cfg <<EOF
11+
global
12+
log /dev/log local0
13+
log /dev/log local1 notice
14+
chroot /var/lib/haproxy
15+
stats socket /run/haproxy/admin.sock mode 660 level admin
16+
stats timeout 30s
17+
user haproxy
18+
group haproxy
19+
daemon
20+
# Default SSL material locations
21+
ca-base /etc/ssl/certs
22+
crt-base /etc/ssl/private
23+
# Default ciphers to use on SSL-enabled listening sockets.
24+
# For more information, see ciphers(1SSL). This list is from:
25+
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
26+
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
27+
ssl-default-bind-options no-sslv3
28+
defaults
29+
log global
30+
mode tcp
31+
option tcplog
32+
option dontlognull
33+
timeout connect 5000
34+
timeout client 50000
35+
timeout server 50000
36+
errorfile 400 /etc/haproxy/errors/400.http
37+
errorfile 403 /etc/haproxy/errors/403.http
38+
errorfile 408 /etc/haproxy/errors/408.http
39+
errorfile 500 /etc/haproxy/errors/500.http
40+
errorfile 502 /etc/haproxy/errors/502.http
41+
errorfile 503 /etc/haproxy/errors/503.http
42+
errorfile 504 /etc/haproxy/errors/504.http
43+
frontend k8s
44+
bind 10.240.0.40:6443
45+
default_backend k8s_backend
46+
backend k8s_backend
47+
balance roundrobin
48+
mode tcp
49+
server controller-0 10.240.0.10:6443 check inter 1000
50+
server controller-1 10.240.0.11:6443 check inter 1000
51+
server controller-2 10.240.0.12:6443 check inter 1000
52+
EOF
53+
54+
systemctl restart haproxy

‎scripts/bootstrap/vagrant-setup-hosts-file.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
cat <<EOF | sudo tee -a /etc/hosts
6+
# KTHW Vagrant machines
7+
10.240.0.10 controller-0
8+
10.240.0.11 controller-1
9+
10.240.0.12 controller-2
10+
10.240.0.20 worker-0
11+
10.240.0.21 worker-1
12+
10.240.0.22 worker-2
13+
EOF

‎scripts/bootstrap/vagrant-setup-routes.sh

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
case "$(hostname)" in
6+
worker-0)
7+
route add -net 10.200.1.0/24 gw 10.240.0.21
8+
route add -net 10.200.2.0/24 gw 10.240.0.22
9+
;;
10+
worker-1)
11+
route add -net 10.200.0.0/24 gw 10.240.0.20
12+
route add -net 10.200.2.0/24 gw 10.240.0.22
13+
;;
14+
worker-2)
15+
route add -net 10.200.0.0/24 gw 10.240.0.20
16+
route add -net 10.200.1.0/24 gw 10.240.0.21
17+
;;
18+
*)
19+
route add -net 10.200.0.0/24 gw 10.240.0.20
20+
route add -net 10.200.1.0/24 gw 10.240.0.21
21+
route add -net 10.200.2.0/24 gw 10.240.0.22
22+
;;
23+
esac

‎scripts/k8s-the-hard-way/0400-certificate-authority.sh

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
3+
cat > ca-config.json <<EOF
4+
{
5+
"signing": {
6+
"default": {
7+
"expiry": "8760h"
8+
},
9+
"profiles": {
10+
"kubernetes": {
11+
"usages": ["signing", "key encipherment", "server auth", "client auth"],
12+
"expiry": "8760h"
13+
}
14+
}
15+
}
16+
}
17+
EOF
18+
19+
cat > ca-csr.json <<EOF
20+
{
21+
"CN": "Kubernetes",
22+
"key": {
23+
"algo": "rsa",
24+
"size": 2048
25+
},
26+
"names": [
27+
{
28+
"C": "US",
29+
"L": "Portland",
30+
"O": "Kubernetes",
31+
"OU": "CA",
32+
"ST": "Oregon"
33+
}
34+
]
35+
}
36+
EOF
37+
38+
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

‎scripts/k8s-the-hard-way/0410-admin-client-certificate.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
3+
cat > admin-csr.json <<EOF
4+
{
5+
"CN": "admin",
6+
"key": {
7+
"algo": "rsa",
8+
"size": 2048
9+
},
10+
"names": [
11+
{
12+
"C": "US",
13+
"L": "Portland",
14+
"O": "system:masters",
15+
"OU": "Kubernetes The Hard Way",
16+
"ST": "Oregon"
17+
}
18+
]
19+
}
20+
EOF
21+
22+
cfssl gencert \
23+
-ca=ca.pem \
24+
-ca-key=ca-key.pem \
25+
-config=ca-config.json \
26+
-profile=kubernetes \
27+
admin-csr.json | cfssljson -bare admin

‎scripts/k8s-the-hard-way/0411-kubelet-client-certificates.sh

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/bash
2+
3+
for instance in worker-0 worker-1 worker-2; do
4+
cat > ${instance}-csr.json <<EOF
5+
{
6+
"CN": "system:node:${instance}",
7+
"key": {
8+
"algo": "rsa",
9+
"size": 2048
10+
},
11+
"names": [
12+
{
13+
"C": "US",
14+
"L": "Portland",
15+
"O": "system:nodes",
16+
"OU": "Kubernetes The Hard Way",
17+
"ST": "Oregon"
18+
}
19+
]
20+
}
21+
EOF
22+
23+
EXTERNAL_IP=10.240.0.40
24+
25+
cfssl gencert \
26+
-ca=ca.pem \
27+
-ca-key=ca-key.pem \
28+
-config=ca-config.json \
29+
-hostname=${instance},${EXTERNAL_IP} \
30+
-profile=kubernetes \
31+
${instance}-csr.json | cfssljson -bare ${instance}
32+
done

‎scripts/k8s-the-hard-way/0412-controller-manager-client-certfiicate.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
3+
cat > kube-controller-manager-csr.json <<EOF
4+
{
5+
"CN": "system:kube-controller-manager",
6+
"key": {
7+
"algo": "rsa",
8+
"size": 2048
9+
},
10+
"names": [
11+
{
12+
"C": "US",
13+
"L": "Portland",
14+
"O": "system:kube-controller-manager",
15+
"OU": "Kubernetes The Hard Way",
16+
"ST": "Oregon"
17+
}
18+
]
19+
}
20+
EOF
21+
22+
cfssl gencert \
23+
-ca=ca.pem \
24+
-ca-key=ca-key.pem \
25+
-config=ca-config.json \
26+
-profile=kubernetes \
27+
kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

0 commit comments

Comments
 (0)