Repository: kelseyhightower/kubernetes-the-hard-way Branch: master Commit: 52eb26dad1a3 Files: 36 Total size: 76.5 KB Directory structure: gitextract_v2v0bjvq/ ├── .gitignore ├── CONTRIBUTING.md ├── COPYRIGHT.md ├── LICENSE ├── README.md ├── ca.conf ├── configs/ │ ├── 10-bridge.conf │ ├── 99-loopback.conf │ ├── containerd-config.toml │ ├── encryption-config.yaml │ ├── kube-apiserver-to-kubelet.yaml │ ├── kube-proxy-config.yaml │ ├── kube-scheduler.yaml │ └── kubelet-config.yaml ├── docs/ │ ├── 01-prerequisites.md │ ├── 02-jumpbox.md │ ├── 03-compute-resources.md │ ├── 04-certificate-authority.md │ ├── 05-kubernetes-configuration-files.md │ ├── 06-data-encryption-keys.md │ ├── 07-bootstrapping-etcd.md │ ├── 08-bootstrapping-kubernetes-controllers.md │ ├── 09-bootstrapping-kubernetes-workers.md │ ├── 10-configuring-kubectl.md │ ├── 11-pod-network-routes.md │ ├── 12-smoke-test.md │ └── 13-cleanup.md ├── downloads-amd64.txt ├── downloads-arm64.txt └── units/ ├── containerd.service ├── etcd.service ├── kube-apiserver.service ├── kube-controller-manager.service ├── kube-proxy.service ├── kube-scheduler.service └── kubelet.service ================================================ FILE CONTENTS ================================================ ================================================ FILE: .gitignore ================================================ admin-csr.json admin-key.pem admin.csr admin.pem admin.kubeconfig ca-config.json ca-csr.json ca-key.pem ca.csr ca.pem /encryption-config.yaml kube-controller-manager-csr.json kube-controller-manager-key.pem kube-controller-manager.csr kube-controller-manager.kubeconfig kube-controller-manager.pem kube-scheduler-csr.json kube-scheduler-key.pem kube-scheduler.csr kube-scheduler.kubeconfig kube-scheduler.pem kube-proxy-csr.json kube-proxy-key.pem kube-proxy.csr kube-proxy.kubeconfig kube-proxy.pem kubernetes-csr.json kubernetes-key.pem kubernetes.csr kubernetes.pem worker-0-csr.json worker-0-key.pem worker-0.csr worker-0.kubeconfig worker-0.pem worker-1-csr.json worker-1-key.pem worker-1.csr worker-1.kubeconfig worker-1.pem worker-2-csr.json worker-2-key.pem worker-2.csr worker-2.kubeconfig worker-2.pem service-account-key.pem service-account.csr service-account.pem service-account-csr.json *.swp .idea/ ================================================ FILE: CONTRIBUTING.md ================================================ This project is made possible by contributors like YOU! While all contributions are welcomed, please be sure and follow the following suggestions to help your PR get merged. ## License This project uses an [Apache license](LICENSE). Be sure you're comfortable with the implications of that before working up a patch. ## Review and merge process Review and merge duties are managed by [@kelseyhightower](https://github.com/kelseyhightower). Expect some burden of proof for demonstrating the marginal value of adding new content to the tutorial. Here are some examples of the review and justification process: - [#208](https://github.com/kelseyhightower/kubernetes-the-hard-way/pull/208) - [#282](https://github.com/kelseyhightower/kubernetes-the-hard-way/pull/282) ## Notes on minutiae If you find a bug that breaks the guide, please do submit it. If you are considering a minor copy edit for tone, grammar, or simple inconsistent whitespace, consider the tradeoff between maintainer time and community benefit before investing too much of your time. ================================================ FILE: COPYRIGHT.md ================================================ # Copyright Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License ================================================ FILE: LICENSE ================================================ Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ================================================ FILE: README.md ================================================ # Kubernetes The Hard Way This tutorial walks you through setting up Kubernetes the hard way. This guide is not for someone looking for a fully automated tool to bring up a Kubernetes cluster. Kubernetes The Hard Way is optimized for learning, which means taking the long route to ensure you understand each task required to bootstrap a Kubernetes cluster. > The results of this tutorial should not be viewed as production ready, and may receive limited support from the community, but don't let that stop you from learning! ## Copyright Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. ## Target Audience The target audience for this tutorial is someone who wants to understand the fundamentals of Kubernetes and how the core components fit together. ## Cluster Details Kubernetes The Hard Way guides you through bootstrapping a basic Kubernetes cluster with all control plane components running on a single node, and two worker nodes, which is enough to learn the core concepts. Component versions: * [kubernetes](https://github.com/kubernetes/kubernetes) v1.32.x * [containerd](https://github.com/containerd/containerd) v2.1.x * [cni](https://github.com/containernetworking/cni) v1.6.x * [etcd](https://github.com/etcd-io/etcd) v3.6.x ## Labs This tutorial requires four (4) ARM64 or AMD64 based virtual or physical machines connected to the same network. * [Prerequisites](docs/01-prerequisites.md) * [Setting up the Jumpbox](docs/02-jumpbox.md) * [Provisioning Compute Resources](docs/03-compute-resources.md) * [Provisioning the CA and Generating TLS Certificates](docs/04-certificate-authority.md) * [Generating Kubernetes Configuration Files for Authentication](docs/05-kubernetes-configuration-files.md) * [Generating the Data Encryption Config and Key](docs/06-data-encryption-keys.md) * [Bootstrapping the etcd Cluster](docs/07-bootstrapping-etcd.md) * [Bootstrapping the Kubernetes Control Plane](docs/08-bootstrapping-kubernetes-controllers.md) * [Bootstrapping the Kubernetes Worker Nodes](docs/09-bootstrapping-kubernetes-workers.md) * [Configuring kubectl for Remote Access](docs/10-configuring-kubectl.md) * [Provisioning Pod Network Routes](docs/11-pod-network-routes.md) * [Smoke Test](docs/12-smoke-test.md) * [Cleaning Up](docs/13-cleanup.md) ================================================ FILE: ca.conf ================================================ [req] distinguished_name = req_distinguished_name prompt = no x509_extensions = ca_x509_extensions [ca_x509_extensions] basicConstraints = CA:TRUE keyUsage = cRLSign, keyCertSign [req_distinguished_name] C = US ST = Washington L = Seattle CN = CA [admin] distinguished_name = admin_distinguished_name prompt = no req_extensions = default_req_extensions [admin_distinguished_name] CN = admin O = system:masters # Service Accounts # # The Kubernetes Controller Manager leverages a key pair to generate # and sign service account tokens as described in the # [managing service accounts](https://kubernetes.io/docs/admin/service-accounts-admin/) # documentation. [service-accounts] distinguished_name = service-accounts_distinguished_name prompt = no req_extensions = default_req_extensions [service-accounts_distinguished_name] CN = service-accounts # Worker Nodes # # Kubernetes uses a [special-purpose authorization mode](https://kubernetes.io/docs/admin/authorization/node/) # called Node Authorizer, that specifically authorizes API requests made # by [Kubelets](https://kubernetes.io/docs/concepts/overview/components/#kubelet). # In order to be authorized by the Node Authorizer, Kubelets must use a credential # that identifies them as being in the `system:nodes` group, with a username # of `system:node:`. [node-0] distinguished_name = node-0_distinguished_name prompt = no req_extensions = node-0_req_extensions [node-0_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Node-0 Certificate" subjectAltName = DNS:node-0, IP:127.0.0.1 subjectKeyIdentifier = hash [node-0_distinguished_name] CN = system:node:node-0 O = system:nodes C = US ST = Washington L = Seattle [node-1] distinguished_name = node-1_distinguished_name prompt = no req_extensions = node-1_req_extensions [node-1_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Node-1 Certificate" subjectAltName = DNS:node-1, IP:127.0.0.1 subjectKeyIdentifier = hash [node-1_distinguished_name] CN = system:node:node-1 O = system:nodes C = US ST = Washington L = Seattle # Kube Proxy Section [kube-proxy] distinguished_name = kube-proxy_distinguished_name prompt = no req_extensions = kube-proxy_req_extensions [kube-proxy_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Kube Proxy Certificate" subjectAltName = DNS:kube-proxy, IP:127.0.0.1 subjectKeyIdentifier = hash [kube-proxy_distinguished_name] CN = system:kube-proxy O = system:node-proxier C = US ST = Washington L = Seattle # Controller Manager [kube-controller-manager] distinguished_name = kube-controller-manager_distinguished_name prompt = no req_extensions = kube-controller-manager_req_extensions [kube-controller-manager_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Kube Controller Manager Certificate" subjectAltName = DNS:kube-controller-manager, IP:127.0.0.1 subjectKeyIdentifier = hash [kube-controller-manager_distinguished_name] CN = system:kube-controller-manager O = system:kube-controller-manager C = US ST = Washington L = Seattle # Scheduler [kube-scheduler] distinguished_name = kube-scheduler_distinguished_name prompt = no req_extensions = kube-scheduler_req_extensions [kube-scheduler_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Kube Scheduler Certificate" subjectAltName = DNS:kube-scheduler, IP:127.0.0.1 subjectKeyIdentifier = hash [kube-scheduler_distinguished_name] CN = system:kube-scheduler O = system:system:kube-scheduler C = US ST = Washington L = Seattle # API Server # # The Kubernetes API server is automatically assigned the `kubernetes` # internal dns name, which will be linked to the first IP address (`10.32.0.1`) # from the address range (`10.32.0.0/24`) reserved for internal cluster # services. [kube-api-server] distinguished_name = kube-api-server_distinguished_name prompt = no req_extensions = kube-api-server_req_extensions [kube-api-server_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth, serverAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client, server nsComment = "Kube API Server Certificate" subjectAltName = @kube-api-server_alt_names subjectKeyIdentifier = hash [kube-api-server_alt_names] IP.0 = 127.0.0.1 IP.1 = 10.32.0.1 DNS.0 = kubernetes DNS.1 = kubernetes.default DNS.2 = kubernetes.default.svc DNS.3 = kubernetes.default.svc.cluster DNS.4 = kubernetes.svc.cluster.local DNS.5 = server.kubernetes.local DNS.6 = api-server.kubernetes.local [kube-api-server_distinguished_name] CN = kubernetes C = US ST = Washington L = Seattle [default_req_extensions] basicConstraints = CA:FALSE extendedKeyUsage = clientAuth keyUsage = critical, digitalSignature, keyEncipherment nsCertType = client nsComment = "Admin Client Certificate" subjectKeyIdentifier = hash ================================================ FILE: configs/10-bridge.conf ================================================ { "cniVersion": "1.0.0", "name": "bridge", "type": "bridge", "bridge": "cni0", "isGateway": true, "ipMasq": true, "ipam": { "type": "host-local", "ranges": [ [{"subnet": "SUBNET"}] ], "routes": [{"dst": "0.0.0.0/0"}] } } ================================================ FILE: configs/99-loopback.conf ================================================ { "cniVersion": "1.1.0", "name": "lo", "type": "loopback" } ================================================ FILE: configs/containerd-config.toml ================================================ version = 2 [plugins."io.containerd.grpc.v1.cri"] [plugins."io.containerd.grpc.v1.cri".containerd] snapshotter = "overlayfs" default_runtime_name = "runc" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] SystemdCgroup = true [plugins."io.containerd.grpc.v1.cri".cni] bin_dir = "/opt/cni/bin" conf_dir = "/etc/cni/net.d" ================================================ FILE: configs/encryption-config.yaml ================================================ kind: EncryptionConfiguration apiVersion: apiserver.config.k8s.io/v1 resources: - resources: - secrets providers: - aescbc: keys: - name: key1 secret: ${ENCRYPTION_KEY} - identity: {} ================================================ FILE: configs/kube-apiserver-to-kubelet.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults name: system:kube-apiserver-to-kubelet rules: - apiGroups: - "" resources: - nodes/proxy - nodes/stats - nodes/log - nodes/spec - nodes/metrics verbs: - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: system:kube-apiserver namespace: "" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:kube-apiserver-to-kubelet subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: kubernetes ================================================ FILE: configs/kube-proxy-config.yaml ================================================ kind: KubeProxyConfiguration apiVersion: kubeproxy.config.k8s.io/v1alpha1 clientConnection: kubeconfig: "/var/lib/kube-proxy/kubeconfig" mode: "iptables" clusterCIDR: "10.200.0.0/16" ================================================ FILE: configs/kube-scheduler.yaml ================================================ apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: "/var/lib/kubernetes/kube-scheduler.kubeconfig" leaderElection: leaderElect: true ================================================ FILE: configs/kubelet-config.yaml ================================================ kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1 address: "0.0.0.0" authentication: anonymous: enabled: false webhook: enabled: true x509: clientCAFile: "/var/lib/kubelet/ca.crt" authorization: mode: Webhook cgroupDriver: systemd containerRuntimeEndpoint: "unix:///var/run/containerd/containerd.sock" enableServer: true failSwapOn: false maxPods: 16 memorySwap: swapBehavior: NoSwap port: 10250 resolvConf: "/etc/resolv.conf" registerNode: true runtimeRequestTimeout: "15m" tlsCertFile: "/var/lib/kubelet/kubelet.crt" tlsPrivateKeyFile: "/var/lib/kubelet/kubelet.key" ================================================ FILE: docs/01-prerequisites.md ================================================ # Prerequisites In this lab you will review the machine requirements necessary to follow this tutorial. ## Virtual or Physical Machines This tutorial requires four (4) virtual or physical ARM64 or AMD64 machines running Debian 12 (bookworm). The following table lists the four machines and their CPU, memory, and storage requirements. | Name | Description | CPU | RAM | Storage | |---------|------------------------|-----|-------|---------| | jumpbox | Administration host | 1 | 512MB | 10GB | | server | Kubernetes server | 1 | 2GB | 20GB | | node-0 | Kubernetes worker node | 1 | 2GB | 20GB | | node-1 | Kubernetes worker node | 1 | 2GB | 20GB | How you provision the machines is up to you, the only requirement is that each machine meet the above system requirements including the machine specs and OS version. Once you have all four machines provisioned, verify the OS requirements by viewing the `/etc/os-release` file: ```bash cat /etc/os-release ``` You should see something similar to the following output: ```text PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian ``` Next: [setting-up-the-jumpbox](02-jumpbox.md) ================================================ FILE: docs/02-jumpbox.md ================================================ # Set Up The Jumpbox In this lab you will set up one of the four machines to be a `jumpbox`. This machine will be used to run commands throughout this tutorial. While a dedicated machine is being used to ensure consistency, these commands can also be run from just about any machine including your personal workstation running macOS or Linux. Think of the `jumpbox` as the administration machine that you will use as a home base when setting up your Kubernetes cluster from the ground up. Before we get started we need to install a few command line utilities and clone the Kubernetes The Hard Way git repository, which contains some additional configuration files that will be used to configure various Kubernetes components throughout this tutorial. Log in to the `jumpbox`: ```bash ssh root@jumpbox ``` All commands will be run as the `root` user. This is being done for the sake of convenience, and will help reduce the number of commands required to set everything up. ### Install Command Line Utilities Now that you are logged into the `jumpbox` machine as the `root` user, you will install the command line utilities that will be used to preform various tasks throughout the tutorial. ```bash { apt-get update apt-get -y install wget curl vim openssl git } ``` ### Sync GitHub Repository Now it's time to download a copy of this tutorial which contains the configuration files and templates that will be used build your Kubernetes cluster from the ground up. Clone the Kubernetes The Hard Way git repository using the `git` command: ```bash git clone --depth 1 \ https://github.com/kelseyhightower/kubernetes-the-hard-way.git ``` Change into the `kubernetes-the-hard-way` directory: ```bash cd kubernetes-the-hard-way ``` This will be the working directory for the rest of the tutorial. If you ever get lost run the `pwd` command to verify you are in the right directory when running commands on the `jumpbox`: ```bash pwd ``` ```text /root/kubernetes-the-hard-way ``` ### Download Binaries In this section you will download the binaries for the various Kubernetes components. The binaries will be stored in the `downloads` directory on the `jumpbox`, which will reduce the amount of internet bandwidth required to complete this tutorial as we avoid downloading the binaries multiple times for each machine in our Kubernetes cluster. The binaries that will be downloaded are listed in either the `downloads-amd64.txt` or `downloads-arm64.txt` file depending on your hardware architecture, which you can review using the `cat` command: ```bash cat downloads-$(dpkg --print-architecture).txt ``` Download the binaries into a directory called `downloads` using the `wget` command: ```bash wget -q --show-progress \ --https-only \ --timestamping \ -P downloads \ -i downloads-$(dpkg --print-architecture).txt ``` Depending on your internet connection speed it may take a while to download over `500` megabytes of binaries, and once the download is complete, you can list them using the `ls` command: ```bash ls -oh downloads ``` Extract the component binaries from the release archives and organize them under the `downloads` directory. ```bash { ARCH=$(dpkg --print-architecture) mkdir -p downloads/{client,cni-plugins,controller,worker} tar -xvf downloads/crictl-v1.32.0-linux-${ARCH}.tar.gz \ -C downloads/worker/ tar -xvf downloads/containerd-2.1.0-beta.0-linux-${ARCH}.tar.gz \ --strip-components 1 \ -C downloads/worker/ tar -xvf downloads/cni-plugins-linux-${ARCH}-v1.6.2.tgz \ -C downloads/cni-plugins/ tar -xvf downloads/etcd-v3.6.0-rc.3-linux-${ARCH}.tar.gz \ -C downloads/ \ --strip-components 1 \ etcd-v3.6.0-rc.3-linux-${ARCH}/etcdctl \ etcd-v3.6.0-rc.3-linux-${ARCH}/etcd mv downloads/{etcdctl,kubectl} downloads/client/ mv downloads/{etcd,kube-apiserver,kube-controller-manager,kube-scheduler} \ downloads/controller/ mv downloads/{kubelet,kube-proxy} downloads/worker/ mv downloads/runc.${ARCH} downloads/worker/runc } ``` ```bash rm -rf downloads/*gz ``` Make the binaries executable. ```bash { chmod +x downloads/{client,cni-plugins,controller,worker}/* } ``` ### Install kubectl In this section you will install the `kubectl`, the official Kubernetes client command line tool, on the `jumpbox` machine. `kubectl` will be used to interact with the Kubernetes control plane once your cluster is provisioned later in this tutorial. Use the `chmod` command to make the `kubectl` binary executable and move it to the `/usr/local/bin/` directory: ```bash { cp downloads/client/kubectl /usr/local/bin/ } ``` At this point `kubectl` is installed and can be verified by running the `kubectl` command: ```bash kubectl version --client ``` ```text Client Version: v1.32.3 Kustomize Version: v5.5.0 ``` At this point the `jumpbox` has been set up with all the command line tools and utilities necessary to complete the labs in this tutorial. Next: [Provisioning Compute Resources](03-compute-resources.md) ================================================ FILE: docs/03-compute-resources.md ================================================ # Provisioning Compute Resources Kubernetes requires a set of machines to host the Kubernetes control plane and the worker nodes where containers are ultimately run. In this lab you will provision the machines required for setting up a Kubernetes cluster. ## Machine Database This tutorial will leverage a text file, which will serve as a machine database, to store the various machine attributes that will be used when setting up the Kubernetes control plane and worker nodes. The following schema represents entries in the machine database, one entry per line: ```text IPV4_ADDRESS FQDN HOSTNAME POD_SUBNET ``` Each of the columns corresponds to a machine IP address `IPV4_ADDRESS`, fully qualified domain name `FQDN`, host name `HOSTNAME`, and the IP subnet `POD_SUBNET`. Kubernetes assigns one IP address per `pod` and the `POD_SUBNET` represents the unique IP address range assigned to each machine in the cluster for doing so. Here is an example machine database similar to the one used when creating this tutorial. Notice the IP addresses have been masked out. Your machines can be assigned any IP address as long as each machine is reachable from each other and the `jumpbox`. ```bash cat machines.txt ``` ```text XXX.XXX.XXX.XXX server.kubernetes.local server XXX.XXX.XXX.XXX node-0.kubernetes.local node-0 10.200.0.0/24 XXX.XXX.XXX.XXX node-1.kubernetes.local node-1 10.200.1.0/24 ``` Now it's your turn to create a `machines.txt` file with the details for the three machines you will be using to create your Kubernetes cluster. Use the example machine database from above and add the details for your machines. ## Configuring SSH Access SSH will be used to configure the machines in the cluster. Verify that you have `root` SSH access to each machine listed in your machine database. You may need to enable root SSH access on each node by updating the sshd_config file and restarting the SSH server. ### Enable root SSH Access If `root` SSH access is enabled for each of your machines you can skip this section. By default, a new `debian` install disables SSH access for the `root` user. This is done for security reasons as the `root` user has total administrative control of unix-like systems. If a weak password is used on a machine connected to the internet, well, let's just say it's only a matter of time before your machine belongs to someone else. As mentioned earlier, we are going to enable `root` access over SSH in order to streamline the steps in this tutorial. Security is a tradeoff, and in this case, we are optimizing for convenience. Log on to each machine via SSH using your user account, then switch to the `root` user using the `su` command: ```bash su - root ``` Edit the `/etc/ssh/sshd_config` SSH daemon configuration file and set the `PermitRootLogin` option to `yes`: ```bash sed -i \ 's/^#*PermitRootLogin.*/PermitRootLogin yes/' \ /etc/ssh/sshd_config ``` Restart the `sshd` SSH server to pick up the updated configuration file: ```bash systemctl restart sshd ``` ### Generate and Distribute SSH Keys In this section you will generate and distribute an SSH keypair to the `server`, `node-0`, and `node-1`, machines, which will be used to run commands on those machines throughout this tutorial. Run the following commands from the `jumpbox` machine. Generate a new SSH key: ```bash ssh-keygen ``` ```text Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa Your public key has been saved in /root/.ssh/id_rsa.pub ``` Copy the SSH public key to each machine: ```bash while read IP FQDN HOST SUBNET; do ssh-copy-id root@${IP} done < machines.txt ``` Once each key is added, verify SSH public key access is working: ```bash while read IP FQDN HOST SUBNET; do ssh -n root@${IP} hostname done < machines.txt ``` ```text server node-0 node-1 ``` ## Hostnames In this section you will assign hostnames to the `server`, `node-0`, and `node-1` machines. The hostname will be used when executing commands from the `jumpbox` to each machine. The hostname also plays a major role within the cluster. Instead of Kubernetes clients using an IP address to issue commands to the Kubernetes API server, those clients will use the `server` hostname instead. Hostnames are also used by each worker machine, `node-0` and `node-1` when registering with a given Kubernetes cluster. To configure the hostname for each machine, run the following commands on the `jumpbox`. Set the hostname on each machine listed in the `machines.txt` file: ```bash while read IP FQDN HOST SUBNET; do CMD="sed -i 's/^127.0.1.1.*/127.0.1.1\t${FQDN} ${HOST}/' /etc/hosts" ssh -n root@${IP} "$CMD" ssh -n root@${IP} hostnamectl set-hostname ${HOST} ssh -n root@${IP} systemctl restart systemd-hostnamed done < machines.txt ``` Verify the hostname is set on each machine: ```bash while read IP FQDN HOST SUBNET; do ssh -n root@${IP} hostname --fqdn done < machines.txt ``` ```text server.kubernetes.local node-0.kubernetes.local node-1.kubernetes.local ``` ## Host Lookup Table In this section you will generate a `hosts` file which will be appended to `/etc/hosts` file on the `jumpbox` and to the `/etc/hosts` files on all three cluster members used for this tutorial. This will allow each machine to be reachable using a hostname such as `server`, `node-0`, or `node-1`. Create a new `hosts` file and add a header to identify the machines being added: ```bash echo "" > hosts echo "# Kubernetes The Hard Way" >> hosts ``` Generate a host entry for each machine in the `machines.txt` file and append it to the `hosts` file: ```bash while read IP FQDN HOST SUBNET; do ENTRY="${IP} ${FQDN} ${HOST}" echo $ENTRY >> hosts done < machines.txt ``` Review the host entries in the `hosts` file: ```bash cat hosts ``` ```text # Kubernetes The Hard Way XXX.XXX.XXX.XXX server.kubernetes.local server XXX.XXX.XXX.XXX node-0.kubernetes.local node-0 XXX.XXX.XXX.XXX node-1.kubernetes.local node-1 ``` ## Adding `/etc/hosts` Entries To A Local Machine In this section you will append the DNS entries from the `hosts` file to the local `/etc/hosts` file on your `jumpbox` machine. Append the DNS entries from `hosts` to `/etc/hosts`: ```bash cat hosts >> /etc/hosts ``` Verify that the `/etc/hosts` file has been updated: ```bash cat /etc/hosts ``` ```text 127.0.0.1 localhost 127.0.1.1 jumpbox # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters # Kubernetes The Hard Way XXX.XXX.XXX.XXX server.kubernetes.local server XXX.XXX.XXX.XXX node-0.kubernetes.local node-0 XXX.XXX.XXX.XXX node-1.kubernetes.local node-1 ``` At this point you should be able to SSH to each machine listed in the `machines.txt` file using a hostname. ```bash for host in server node-0 node-1 do ssh root@${host} hostname done ``` ```text server node-0 node-1 ``` ## Adding `/etc/hosts` Entries To The Remote Machines In this section you will append the host entries from `hosts` to `/etc/hosts` on each machine listed in the `machines.txt` text file. Copy the `hosts` file to each machine and append the contents to `/etc/hosts`: ```bash while read IP FQDN HOST SUBNET; do scp hosts root@${HOST}:~/ ssh -n \ root@${HOST} "cat hosts >> /etc/hosts" done < machines.txt ``` At this point, hostnames can be used when connecting to machines from your `jumpbox` machine, or any of the three machines in the Kubernetes cluster. Instead of using IP addresses you can now connect to machines using a hostname such as `server`, `node-0`, or `node-1`. Next: [Provisioning a CA and Generating TLS Certificates](04-certificate-authority.md) ================================================ FILE: docs/04-certificate-authority.md ================================================ # Provisioning a CA and Generating TLS Certificates In this lab you will provision a [PKI Infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure) using openssl to bootstrap a Certificate Authority, and generate TLS certificates for the following components: kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, and kube-proxy. The commands in this section should be run from the `jumpbox`. ## Certificate Authority In this section you will provision a Certificate Authority that can be used to generate additional TLS certificates for the other Kubernetes components. Setting up CA and generating certificates using `openssl` can be time-consuming, especially when doing it for the first time. To streamline this lab, I've included an openssl configuration file `ca.conf`, which defines all the details needed to generate certificates for each Kubernetes component. Take a moment to review the `ca.conf` configuration file: ```bash cat ca.conf ``` You don't need to understand everything in the `ca.conf` file to complete this tutorial, but you should consider it a starting point for learning `openssl` and the configuration that goes into managing certificates at a high level. Every certificate authority starts with a private key and root certificate. In this section we are going to create a self-signed certificate authority, and while that's all we need for this tutorial, this shouldn't be considered something you would do in a real-world production environment. Generate the CA configuration file, certificate, and private key: ```bash { openssl genrsa -out ca.key 4096 openssl req -x509 -new -sha512 -noenc \ -key ca.key -days 3653 \ -config ca.conf \ -out ca.crt } ``` Results: ```txt ca.crt ca.key ``` ## Create Client and Server Certificates In this section you will generate client and server certificates for each Kubernetes component and a client certificate for the Kubernetes `admin` user. Generate the certificates and private keys: ```bash certs=( "admin" "node-0" "node-1" "kube-proxy" "kube-scheduler" "kube-controller-manager" "kube-api-server" "service-accounts" ) ``` ```bash for i in ${certs[*]}; do openssl genrsa -out "${i}.key" 4096 openssl req -new -key "${i}.key" -sha256 \ -config "ca.conf" -section ${i} \ -out "${i}.csr" openssl x509 -req -days 3653 -in "${i}.csr" \ -copy_extensions copyall \ -sha256 -CA "ca.crt" \ -CAkey "ca.key" \ -CAcreateserial \ -out "${i}.crt" done ``` The results of running the above command will generate a private key, certificate request, and signed SSL certificate for each of the Kubernetes components. You can list the generated files with the following command: ```bash ls -1 *.crt *.key *.csr ``` ## Distribute the Client and Server Certificates In this section you will copy the various certificates to every machine at a path where each Kubernetes component will search for its certificate pair. In a real-world environment these certificates should be treated like a set of sensitive secrets as they are used as credentials by the Kubernetes components to authenticate to each other. Copy the appropriate certificates and private keys to the `node-0` and `node-1` machines: ```bash for host in node-0 node-1; do ssh root@${host} mkdir /var/lib/kubelet/ scp ca.crt root@${host}:/var/lib/kubelet/ scp ${host}.crt \ root@${host}:/var/lib/kubelet/kubelet.crt scp ${host}.key \ root@${host}:/var/lib/kubelet/kubelet.key done ``` Copy the appropriate certificates and private keys to the `server` machine: ```bash scp \ ca.key ca.crt \ kube-api-server.key kube-api-server.crt \ service-accounts.key service-accounts.crt \ root@server:~/ ``` > The `kube-proxy`, `kube-controller-manager`, `kube-scheduler`, and `kubelet` client certificates will be used to generate client authentication configuration files in the next lab. Next: [Generating Kubernetes Configuration Files for Authentication](05-kubernetes-configuration-files.md) ================================================ FILE: docs/05-kubernetes-configuration-files.md ================================================ # Generating Kubernetes Configuration Files for Authentication In this lab you will generate [Kubernetes client configuration files](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/), typically called kubeconfigs, which configure Kubernetes clients to connect and authenticate to Kubernetes API Servers. ## Client Authentication Configs In this section you will generate kubeconfig files for the `kubelet` and the `admin` user. ### The kubelet Kubernetes Configuration File When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer](https://kubernetes.io/docs/reference/access-authn-authz/node/). > The following commands must be run in the same directory used to generate the SSL certificates during the [Generating TLS Certificates](04-certificate-authority.md) lab. Generate a kubeconfig file for the `node-0` and `node-1` worker nodes: ```bash for host in node-0 node-1; do kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://server.kubernetes.local:6443 \ --kubeconfig=${host}.kubeconfig kubectl config set-credentials system:node:${host} \ --client-certificate=${host}.crt \ --client-key=${host}.key \ --embed-certs=true \ --kubeconfig=${host}.kubeconfig kubectl config set-context default \ --cluster=kubernetes-the-hard-way \ --user=system:node:${host} \ --kubeconfig=${host}.kubeconfig kubectl config use-context default \ --kubeconfig=${host}.kubeconfig done ``` Results: ```text node-0.kubeconfig node-1.kubeconfig ``` ### The kube-proxy Kubernetes Configuration File Generate a kubeconfig file for the `kube-proxy` service: ```bash { kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://server.kubernetes.local:6443 \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-credentials system:kube-proxy \ --client-certificate=kube-proxy.crt \ --client-key=kube-proxy.key \ --embed-certs=true \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-context default \ --cluster=kubernetes-the-hard-way \ --user=system:kube-proxy \ --kubeconfig=kube-proxy.kubeconfig kubectl config use-context default \ --kubeconfig=kube-proxy.kubeconfig } ``` Results: ```text kube-proxy.kubeconfig ``` ### The kube-controller-manager Kubernetes Configuration File Generate a kubeconfig file for the `kube-controller-manager` service: ```bash { kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://server.kubernetes.local:6443 \ --kubeconfig=kube-controller-manager.kubeconfig kubectl config set-credentials system:kube-controller-manager \ --client-certificate=kube-controller-manager.crt \ --client-key=kube-controller-manager.key \ --embed-certs=true \ --kubeconfig=kube-controller-manager.kubeconfig kubectl config set-context default \ --cluster=kubernetes-the-hard-way \ --user=system:kube-controller-manager \ --kubeconfig=kube-controller-manager.kubeconfig kubectl config use-context default \ --kubeconfig=kube-controller-manager.kubeconfig } ``` Results: ```text kube-controller-manager.kubeconfig ``` ### The kube-scheduler Kubernetes Configuration File Generate a kubeconfig file for the `kube-scheduler` service: ```bash { kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://server.kubernetes.local:6443 \ --kubeconfig=kube-scheduler.kubeconfig kubectl config set-credentials system:kube-scheduler \ --client-certificate=kube-scheduler.crt \ --client-key=kube-scheduler.key \ --embed-certs=true \ --kubeconfig=kube-scheduler.kubeconfig kubectl config set-context default \ --cluster=kubernetes-the-hard-way \ --user=system:kube-scheduler \ --kubeconfig=kube-scheduler.kubeconfig kubectl config use-context default \ --kubeconfig=kube-scheduler.kubeconfig } ``` Results: ```text kube-scheduler.kubeconfig ``` ### The admin Kubernetes Configuration File Generate a kubeconfig file for the `admin` user: ```bash { kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://127.0.0.1:6443 \ --kubeconfig=admin.kubeconfig kubectl config set-credentials admin \ --client-certificate=admin.crt \ --client-key=admin.key \ --embed-certs=true \ --kubeconfig=admin.kubeconfig kubectl config set-context default \ --cluster=kubernetes-the-hard-way \ --user=admin \ --kubeconfig=admin.kubeconfig kubectl config use-context default \ --kubeconfig=admin.kubeconfig } ``` Results: ```text admin.kubeconfig ``` ## Distribute the Kubernetes Configuration Files Copy the `kubelet` and `kube-proxy` kubeconfig files to the `node-0` and `node-1` machines: ```bash for host in node-0 node-1; do ssh root@${host} "mkdir -p /var/lib/{kube-proxy,kubelet}" scp kube-proxy.kubeconfig \ root@${host}:/var/lib/kube-proxy/kubeconfig \ scp ${host}.kubeconfig \ root@${host}:/var/lib/kubelet/kubeconfig done ``` Copy the `kube-controller-manager` and `kube-scheduler` kubeconfig files to the `server` machine: ```bash scp admin.kubeconfig \ kube-controller-manager.kubeconfig \ kube-scheduler.kubeconfig \ root@server:~/ ``` Next: [Generating the Data Encryption Config and Key](06-data-encryption-keys.md) ================================================ FILE: docs/06-data-encryption-keys.md ================================================ # Generating the Data Encryption Config and Key Kubernetes stores a variety of data including cluster state, application configurations, and secrets. Kubernetes supports the ability to [encrypt](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data) cluster data at rest. In this lab you will generate an encryption key and an [encryption config](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#understanding-the-encryption-at-rest-configuration) suitable for encrypting Kubernetes Secrets. ## The Encryption Key Generate an encryption key: ```bash export ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64) ``` ## The Encryption Config File Create the `encryption-config.yaml` encryption config file: ```bash envsubst < configs/encryption-config.yaml \ > encryption-config.yaml ``` Copy the `encryption-config.yaml` encryption config file to each controller instance: ```bash scp encryption-config.yaml root@server:~/ ``` Next: [Bootstrapping the etcd Cluster](07-bootstrapping-etcd.md) ================================================ FILE: docs/07-bootstrapping-etcd.md ================================================ # Bootstrapping the etcd Cluster Kubernetes components are stateless and store cluster state in [etcd](https://github.com/etcd-io/etcd). In this lab you will bootstrap a single node etcd cluster. ## Prerequisites Copy `etcd` binaries and systemd unit files to the `server` machine: ```bash scp \ downloads/controller/etcd \ downloads/client/etcdctl \ units/etcd.service \ root@server:~/ ``` The commands in this lab must be run on the `server` machine. Login to the `server` machine using the `ssh` command. Example: ```bash ssh root@server ``` ## Bootstrapping an etcd Cluster ### Install the etcd Binaries Extract and install the `etcd` server and the `etcdctl` command line utility: ```bash { mv etcd etcdctl /usr/local/bin/ } ``` ### Configure the etcd Server ```bash { mkdir -p /etc/etcd /var/lib/etcd chmod 700 /var/lib/etcd cp ca.crt kube-api-server.key kube-api-server.crt \ /etc/etcd/ } ``` Each etcd member must have a unique name within an etcd cluster. Set the etcd name to match the hostname of the current compute instance: Create the `etcd.service` systemd unit file: ```bash mv etcd.service /etc/systemd/system/ ``` ### Start the etcd Server ```bash { systemctl daemon-reload systemctl enable etcd systemctl start etcd } ``` ## Verification List the etcd cluster members: ```bash etcdctl member list ``` ```text 6702b0a34e2cfd39, started, controller, http://127.0.0.1:2380, http://127.0.0.1:2379, false ``` Next: [Bootstrapping the Kubernetes Control Plane](08-bootstrapping-kubernetes-controllers.md) ================================================ FILE: docs/08-bootstrapping-kubernetes-controllers.md ================================================ # Bootstrapping the Kubernetes Control Plane In this lab you will bootstrap the Kubernetes control plane. The following components will be installed on the `server` machine: Kubernetes API Server, Scheduler, and Controller Manager. ## Prerequisites Connect to the `jumpbox` and copy Kubernetes binaries and systemd unit files to the `server` machine: ```bash scp \ downloads/controller/kube-apiserver \ downloads/controller/kube-controller-manager \ downloads/controller/kube-scheduler \ downloads/client/kubectl \ units/kube-apiserver.service \ units/kube-controller-manager.service \ units/kube-scheduler.service \ configs/kube-scheduler.yaml \ configs/kube-apiserver-to-kubelet.yaml \ root@server:~/ ``` The commands in this lab must be run on the `server` machine. Login to the `server` machine using the `ssh` command. Example: ```bash ssh root@server ``` ## Provision the Kubernetes Control Plane Create the Kubernetes configuration directory: ```bash mkdir -p /etc/kubernetes/config ``` ### Install the Kubernetes Controller Binaries Install the Kubernetes binaries: ```bash { mv kube-apiserver \ kube-controller-manager \ kube-scheduler kubectl \ /usr/local/bin/ } ``` ### Configure the Kubernetes API Server ```bash { mkdir -p /var/lib/kubernetes/ mv ca.crt ca.key \ kube-api-server.key kube-api-server.crt \ service-accounts.key service-accounts.crt \ encryption-config.yaml \ /var/lib/kubernetes/ } ``` Create the `kube-apiserver.service` systemd unit file: ```bash mv kube-apiserver.service \ /etc/systemd/system/kube-apiserver.service ``` ### Configure the Kubernetes Controller Manager Move the `kube-controller-manager` kubeconfig into place: ```bash mv kube-controller-manager.kubeconfig /var/lib/kubernetes/ ``` Create the `kube-controller-manager.service` systemd unit file: ```bash mv kube-controller-manager.service /etc/systemd/system/ ``` ### Configure the Kubernetes Scheduler Move the `kube-scheduler` kubeconfig into place: ```bash mv kube-scheduler.kubeconfig /var/lib/kubernetes/ ``` Create the `kube-scheduler.yaml` configuration file: ```bash mv kube-scheduler.yaml /etc/kubernetes/config/ ``` Create the `kube-scheduler.service` systemd unit file: ```bash mv kube-scheduler.service /etc/systemd/system/ ``` ### Start the Controller Services ```bash { systemctl daemon-reload systemctl enable kube-apiserver \ kube-controller-manager kube-scheduler systemctl start kube-apiserver \ kube-controller-manager kube-scheduler } ``` > Allow up to 10 seconds for the Kubernetes API Server to fully initialize. You can check if any of the control plane components are active using the `systemctl` command. For example, to check if the `kube-apiserver` fully initialized, and active, run the following command: ```bash systemctl is-active kube-apiserver ``` For a more detailed status check, which includes additional process information and log messages, use the `systemctl status` command: ```bash systemctl status kube-apiserver ``` If you run into any errors, or want to view the logs for any of the control plane components, use the `journalctl` command. For example, to view the logs for the `kube-apiserver` run the following command: ```bash journalctl -u kube-apiserver ``` ### Verification At this point the Kubernetes control plane components should be up and running. Verify this using the `kubectl` command line tool: ```bash kubectl cluster-info \ --kubeconfig admin.kubeconfig ``` ```text Kubernetes control plane is running at https://127.0.0.1:6443 ``` ## RBAC for Kubelet Authorization In this section you will configure RBAC permissions to allow the Kubernetes API Server to access the Kubelet API on each worker node. Access to the Kubelet API is required for retrieving metrics, logs, and executing commands in pods. > This tutorial sets the Kubelet `--authorization-mode` flag to `Webhook`. Webhook mode uses the [SubjectAccessReview](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access) API to determine authorization. The commands in this section will affect the entire cluster and only need to be run on the `server` machine. ```bash ssh root@server ``` Create the `system:kube-apiserver-to-kubelet` [ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) with permissions to access the Kubelet API and perform most common tasks associated with managing pods: ```bash kubectl apply -f kube-apiserver-to-kubelet.yaml \ --kubeconfig admin.kubeconfig ``` ### Verification At this point the Kubernetes control plane is up and running. Run the following commands from the `jumpbox` machine to verify it's working: Make a HTTP request for the Kubernetes version info: ```bash curl --cacert ca.crt \ https://server.kubernetes.local:6443/version ``` ```text { "major": "1", "minor": "32", "gitVersion": "v1.32.3", "gitCommit": "32cc146f75aad04beaaa245a7157eb35063a9f99", "gitTreeState": "clean", "buildDate": "2025-03-11T19:52:21Z", "goVersion": "go1.23.6", "compiler": "gc", "platform": "linux/arm64" } ``` Next: [Bootstrapping the Kubernetes Worker Nodes](09-bootstrapping-kubernetes-workers.md) ================================================ FILE: docs/09-bootstrapping-kubernetes-workers.md ================================================ # Bootstrapping the Kubernetes Worker Nodes In this lab you will bootstrap two Kubernetes worker nodes. The following components will be installed: [runc](https://github.com/opencontainers/runc), [container networking plugins](https://github.com/containernetworking/cni), [containerd](https://github.com/containerd/containerd), [kubelet](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet), and [kube-proxy](https://kubernetes.io/docs/concepts/cluster-administration/proxies). ## Prerequisites The commands in this section must be run from the `jumpbox`. Copy the Kubernetes binaries and systemd unit files to each worker instance: ```bash for HOST in node-0 node-1; do SUBNET=$(grep ${HOST} machines.txt | cut -d " " -f 4) sed "s|SUBNET|$SUBNET|g" \ configs/10-bridge.conf > 10-bridge.conf sed "s|SUBNET|$SUBNET|g" \ configs/kubelet-config.yaml > kubelet-config.yaml scp 10-bridge.conf kubelet-config.yaml \ root@${HOST}:~/ done ``` ```bash for HOST in node-0 node-1; do scp \ downloads/worker/* \ downloads/client/kubectl \ configs/99-loopback.conf \ configs/containerd-config.toml \ configs/kube-proxy-config.yaml \ units/containerd.service \ units/kubelet.service \ units/kube-proxy.service \ root@${HOST}:~/ done ``` ```bash for HOST in node-0 node-1; do scp \ downloads/cni-plugins/* \ root@${HOST}:~/cni-plugins/ done ``` The commands in the next section must be run on each worker instance: `node-0`, `node-1`. Login to the worker instance using the `ssh` command. Example: ```bash ssh root@node-0 ``` ## Provisioning a Kubernetes Worker Node Install the OS dependencies: ```bash { apt-get update apt-get -y install socat conntrack ipset kmod } ``` > The socat binary enables support for the `kubectl port-forward` command. Disable Swap Kubernetes has limited support for the use of swap memory, as it is difficult to provide guarantees and account for pod memory utilization when swap is involved. Verify if swap is disabled: ```bash swapon --show ``` If output is empty then swap is disabled. If swap is enabled run the following command to disable swap immediately: ```bash swapoff -a ``` > To ensure swap remains off after reboot consult your Linux distro documentation. Create the installation directories: ```bash mkdir -p \ /etc/cni/net.d \ /opt/cni/bin \ /var/lib/kubelet \ /var/lib/kube-proxy \ /var/lib/kubernetes \ /var/run/kubernetes ``` Install the worker binaries: ```bash { mv crictl kube-proxy kubelet runc \ /usr/local/bin/ mv containerd containerd-shim-runc-v2 containerd-stress /bin/ mv cni-plugins/* /opt/cni/bin/ } ``` ### Configure CNI Networking Create the `bridge` network configuration file: ```bash mv 10-bridge.conf 99-loopback.conf /etc/cni/net.d/ ``` To ensure network traffic crossing the CNI `bridge` network is processed by `iptables`, load and configure the `br-netfilter` kernel module: ```bash { modprobe br-netfilter echo "br-netfilter" >> /etc/modules-load.d/modules.conf } ``` ```bash { echo "net.bridge.bridge-nf-call-iptables = 1" \ >> /etc/sysctl.d/kubernetes.conf echo "net.bridge.bridge-nf-call-ip6tables = 1" \ >> /etc/sysctl.d/kubernetes.conf sysctl -p /etc/sysctl.d/kubernetes.conf } ``` ### Configure containerd Install the `containerd` configuration files: ```bash { mkdir -p /etc/containerd/ mv containerd-config.toml /etc/containerd/config.toml mv containerd.service /etc/systemd/system/ } ``` ### Configure the Kubelet Create the `kubelet-config.yaml` configuration file: ```bash { mv kubelet-config.yaml /var/lib/kubelet/ mv kubelet.service /etc/systemd/system/ } ``` ### Configure the Kubernetes Proxy ```bash { mv kube-proxy-config.yaml /var/lib/kube-proxy/ mv kube-proxy.service /etc/systemd/system/ } ``` ### Start the Worker Services ```bash { systemctl daemon-reload systemctl enable containerd kubelet kube-proxy systemctl start containerd kubelet kube-proxy } ``` Check if the kubelet service is running: ```bash systemctl is-active kubelet ``` ```text active ``` Be sure to complete the steps in this section on each worker node, `node-0` and `node-1`, before moving on to the next section. ## Verification Run the following commands from the `jumpbox` machine. List the registered Kubernetes nodes: ```bash ssh root@server \ "kubectl get nodes \ --kubeconfig admin.kubeconfig" ``` ``` NAME STATUS ROLES AGE VERSION node-0 Ready 1m v1.32.3 node-1 Ready 10s v1.32.3 ``` Next: [Configuring kubectl for Remote Access](10-configuring-kubectl.md) ================================================ FILE: docs/10-configuring-kubectl.md ================================================ # Configuring kubectl for Remote Access In this lab you will generate a kubeconfig file for the `kubectl` command line utility based on the `admin` user credentials. > Run the commands in this lab from the `jumpbox` machine. ## The Admin Kubernetes Configuration File Each kubeconfig requires a Kubernetes API Server to connect to. You should be able to ping `server.kubernetes.local` based on the `/etc/hosts` DNS entry from a previous lab. ```bash curl --cacert ca.crt \ https://server.kubernetes.local:6443/version ``` ```text { "major": "1", "minor": "32", "gitVersion": "v1.32.3", "gitCommit": "32cc146f75aad04beaaa245a7157eb35063a9f99", "gitTreeState": "clean", "buildDate": "2025-03-11T19:52:21Z", "goVersion": "go1.23.6", "compiler": "gc", "platform": "linux/arm64" } ``` Generate a kubeconfig file suitable for authenticating as the `admin` user: ```bash { kubectl config set-cluster kubernetes-the-hard-way \ --certificate-authority=ca.crt \ --embed-certs=true \ --server=https://server.kubernetes.local:6443 kubectl config set-credentials admin \ --client-certificate=admin.crt \ --client-key=admin.key kubectl config set-context kubernetes-the-hard-way \ --cluster=kubernetes-the-hard-way \ --user=admin kubectl config use-context kubernetes-the-hard-way } ``` The results of running the command above should create a kubeconfig file in the default location `~/.kube/config` used by the `kubectl` commandline tool. This also means you can run the `kubectl` command without specifying a config. ## Verification Check the version of the remote Kubernetes cluster: ```bash kubectl version ``` ```text Client Version: v1.32.3 Kustomize Version: v5.5.0 Server Version: v1.32.3 ``` List the nodes in the remote Kubernetes cluster: ```bash kubectl get nodes ``` ``` NAME STATUS ROLES AGE VERSION node-0 Ready 10m v1.32.3 node-1 Ready 10m v1.32.3 ``` Next: [Provisioning Pod Network Routes](11-pod-network-routes.md) ================================================ FILE: docs/11-pod-network-routes.md ================================================ # Provisioning Pod Network Routes Pods scheduled to a node receive an IP address from the node's Pod CIDR range. At this point pods can not communicate with other pods running on different nodes due to missing network [routes](https://cloud.google.com/compute/docs/vpc/routes). In this lab you will create a route for each worker node that maps the node's Pod CIDR range to the node's internal IP address. > There are [other ways](https://kubernetes.io/docs/concepts/cluster-administration/networking/#how-to-achieve-this) to implement the Kubernetes networking model. ## The Routing Table In this section you will gather the information required to create routes in the `kubernetes-the-hard-way` VPC network. Print the internal IP address and Pod CIDR range for each worker instance: ```bash { SERVER_IP=$(grep server machines.txt | cut -d " " -f 1) NODE_0_IP=$(grep node-0 machines.txt | cut -d " " -f 1) NODE_0_SUBNET=$(grep node-0 machines.txt | cut -d " " -f 4) NODE_1_IP=$(grep node-1 machines.txt | cut -d " " -f 1) NODE_1_SUBNET=$(grep node-1 machines.txt | cut -d " " -f 4) } ``` ```bash ssh root@server < 80 Forwarding from [::1]:8080 -> 80 ``` In a new terminal make an HTTP request using the forwarding address: ```bash curl --head http://127.0.0.1:8080 ``` ```text HTTP/1.1 200 OK Server: nginx/1.27.4 Date: Sun, 06 Apr 2025 17:17:12 GMT Content-Type: text/html Content-Length: 615 Last-Modified: Wed, 05 Feb 2025 11:06:32 GMT Connection: keep-alive ETag: "67a34638-267" Accept-Ranges: bytes ``` Switch back to the previous terminal and stop the port forwarding to the `nginx` pod: ```text Forwarding from 127.0.0.1:8080 -> 80 Forwarding from [::1]:8080 -> 80 Handling connection for 8080 ^C ``` ### Logs In this section you will verify the ability to [retrieve container logs](https://kubernetes.io/docs/concepts/cluster-administration/logging/). Print the `nginx` pod logs: ```bash kubectl logs $POD_NAME ``` ```text ... 127.0.0.1 - - [06/Apr/2025:17:17:12 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.88.1" "-" ``` ### Exec In this section you will verify the ability to [execute commands in a container](https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/#running-individual-commands-in-a-container). Print the nginx version by executing the `nginx -v` command in the `nginx` container: ```bash kubectl exec -ti $POD_NAME -- nginx -v ``` ```text nginx version: nginx/1.27.4 ``` ## Services In this section you will verify the ability to expose applications using a [Service](https://kubernetes.io/docs/concepts/services-networking/service/). Expose the `nginx` deployment using a [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) service: ```bash kubectl expose deployment nginx \ --port 80 --type NodePort ``` > The LoadBalancer service type can not be used because your cluster is not configured with [cloud provider integration](https://kubernetes.io/docs/getting-started-guides/scratch/#cloud-provider). Setting up cloud provider integration is out of scope for this tutorial. Retrieve the node port assigned to the `nginx` service: ```bash NODE_PORT=$(kubectl get svc nginx \ --output=jsonpath='{range .spec.ports[0]}{.nodePort}') ``` Retrieve the hostname of the node running the `nginx` pod: ```bash NODE_NAME=$(kubectl get pods \ -l app=nginx \ -o jsonpath="{.items[0].spec.nodeName}") ``` Make an HTTP request using the IP address and the `nginx` node port: ```bash curl -I http://${NODE_NAME}:${NODE_PORT} ``` ```text Server: nginx/1.27.4 Date: Sun, 06 Apr 2025 17:18:36 GMT Content-Type: text/html Content-Length: 615 Last-Modified: Wed, 05 Feb 2025 11:06:32 GMT Connection: keep-alive ETag: "67a34638-267" Accept-Ranges: bytes ``` Next: [Cleaning Up](13-cleanup.md) ================================================ FILE: docs/13-cleanup.md ================================================ # Cleaning Up In this lab you will delete the compute resources created during this tutorial. ## Compute Instances Previous versions of this guide made use of GCP resources for various aspects of compute and networking. The current version is agnostic, and all configuration is performed on the `jumpbox`, `server`, or nodes. Clean up is as simple as deleting all virtual machines you created for this exercise. Next: [Start Over](../README.md) ================================================ FILE: downloads-amd64.txt ================================================ https://dl.k8s.io/v1.32.3/bin/linux/amd64/kubectl https://dl.k8s.io/v1.32.3/bin/linux/amd64/kube-apiserver https://dl.k8s.io/v1.32.3/bin/linux/amd64/kube-controller-manager https://dl.k8s.io/v1.32.3/bin/linux/amd64/kube-scheduler https://dl.k8s.io/v1.32.3/bin/linux/amd64/kube-proxy https://dl.k8s.io/v1.32.3/bin/linux/amd64/kubelet https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.32.0/crictl-v1.32.0-linux-amd64.tar.gz https://github.com/opencontainers/runc/releases/download/v1.3.0-rc.1/runc.amd64 https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-amd64-v1.6.2.tgz https://github.com/containerd/containerd/releases/download/v2.1.0-beta.0/containerd-2.1.0-beta.0-linux-amd64.tar.gz https://github.com/etcd-io/etcd/releases/download/v3.6.0-rc.3/etcd-v3.6.0-rc.3-linux-amd64.tar.gz ================================================ FILE: downloads-arm64.txt ================================================ https://dl.k8s.io/v1.32.3/bin/linux/arm64/kubectl https://dl.k8s.io/v1.32.3/bin/linux/arm64/kube-apiserver https://dl.k8s.io/v1.32.3/bin/linux/arm64/kube-controller-manager https://dl.k8s.io/v1.32.3/bin/linux/arm64/kube-scheduler https://dl.k8s.io/v1.32.3/bin/linux/arm64/kube-proxy https://dl.k8s.io/v1.32.3/bin/linux/arm64/kubelet https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.32.0/crictl-v1.32.0-linux-arm64.tar.gz https://github.com/opencontainers/runc/releases/download/v1.3.0-rc.1/runc.arm64 https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-arm64-v1.6.2.tgz https://github.com/containerd/containerd/releases/download/v2.1.0-beta.0/containerd-2.1.0-beta.0-linux-arm64.tar.gz https://github.com/etcd-io/etcd/releases/download/v3.6.0-rc.3/etcd-v3.6.0-rc.3-linux-arm64.tar.gz ================================================ FILE: units/containerd.service ================================================ [Unit] Description=containerd container runtime Documentation=https://containerd.io After=network.target [Service] ExecStartPre=/sbin/modprobe overlay ExecStart=/bin/containerd Restart=always RestartSec=5 Delegate=yes KillMode=process OOMScoreAdjust=-999 LimitNOFILE=1048576 LimitNPROC=infinity LimitCORE=infinity [Install] WantedBy=multi-user.target ================================================ FILE: units/etcd.service ================================================ [Unit] Description=etcd Documentation=https://github.com/etcd-io/etcd [Service] Type=notify ExecStart=/usr/local/bin/etcd \ --name controller \ --initial-advertise-peer-urls http://127.0.0.1:2380 \ --listen-peer-urls http://127.0.0.1:2380 \ --listen-client-urls http://127.0.0.1:2379 \ --advertise-client-urls http://127.0.0.1:2379 \ --initial-cluster-token etcd-cluster-0 \ --initial-cluster controller=http://127.0.0.1:2380 \ --initial-cluster-state new \ --data-dir=/var/lib/etcd Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target ================================================ FILE: units/kube-apiserver.service ================================================ [Unit] Description=Kubernetes API Server Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-apiserver \ --allow-privileged=true \ --audit-log-maxage=30 \ --audit-log-maxbackup=3 \ --audit-log-maxsize=100 \ --audit-log-path=/var/log/audit.log \ --authorization-mode=Node,RBAC \ --bind-address=0.0.0.0 \ --client-ca-file=/var/lib/kubernetes/ca.crt \ --enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \ --etcd-servers=http://127.0.0.1:2379 \ --event-ttl=1h \ --encryption-provider-config=/var/lib/kubernetes/encryption-config.yaml \ --kubelet-certificate-authority=/var/lib/kubernetes/ca.crt \ --kubelet-client-certificate=/var/lib/kubernetes/kube-api-server.crt \ --kubelet-client-key=/var/lib/kubernetes/kube-api-server.key \ --runtime-config='api/all=true' \ --service-account-key-file=/var/lib/kubernetes/service-accounts.crt \ --service-account-signing-key-file=/var/lib/kubernetes/service-accounts.key \ --service-account-issuer=https://server.kubernetes.local:6443 \ --service-node-port-range=30000-32767 \ --tls-cert-file=/var/lib/kubernetes/kube-api-server.crt \ --tls-private-key-file=/var/lib/kubernetes/kube-api-server.key \ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target ================================================ FILE: units/kube-controller-manager.service ================================================ [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-controller-manager \ --bind-address=0.0.0.0 \ --cluster-cidr=10.200.0.0/16 \ --cluster-name=kubernetes \ --cluster-signing-cert-file=/var/lib/kubernetes/ca.crt \ --cluster-signing-key-file=/var/lib/kubernetes/ca.key \ --kubeconfig=/var/lib/kubernetes/kube-controller-manager.kubeconfig \ --root-ca-file=/var/lib/kubernetes/ca.crt \ --service-account-private-key-file=/var/lib/kubernetes/service-accounts.key \ --service-cluster-ip-range=10.32.0.0/24 \ --use-service-account-credentials=true \ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target ================================================ FILE: units/kube-proxy.service ================================================ [Unit] Description=Kubernetes Kube Proxy Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-proxy \ --config=/var/lib/kube-proxy/kube-proxy-config.yaml Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target ================================================ FILE: units/kube-scheduler.service ================================================ [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/kubernetes/kubernetes [Service] ExecStart=/usr/local/bin/kube-scheduler \ --config=/etc/kubernetes/config/kube-scheduler.yaml \ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target ================================================ FILE: units/kubelet.service ================================================ [Unit] Description=Kubernetes Kubelet Documentation=https://github.com/kubernetes/kubernetes After=containerd.service Requires=containerd.service [Service] ExecStart=/usr/local/bin/kubelet \ --config=/var/lib/kubelet/kubelet-config.yaml \ --kubeconfig=/var/lib/kubelet/kubeconfig \ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target