CKA
Installation overview - Out of Scope
Using ubuntu22.04lts:
Few steps:
- Install a CRI (Container Runtime)
- Install Kubernetes tools (
kubeadm, kubectl, kubelet)
- Initialize the cluster using
kubeadm init
- Configure the client
- Set up a network agent
- Add other nodes
- Verify node availability
Ensure bridged network traffic is processed by Linux iptables firewall and enable ipforwarding:
- net.bridge.bridge-nf-call-iptables=1
- net.ipv4.ip_forward=1
- net.bridge.bridge-nf-call-ip6tables=1
- net.ipv6.ip_forward=1
Create a file /etc/sysctl.d/99-kubernetes-cri.conf with:
| net.bridge.bridge-nf-call-iptables=1
net.ipv4.ip_forward=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv6.ip_forward=1
|
CRI:
We'll install containerd and tools using scripts provided by svangut
On each node:
| git clone https://github.com/sandervanvugt/cka.git
cd cka
./setup-container.sh
|
| sudo systemctl status containerd.service
|
Then, on each node:
| cd cka
./setup-kubetools-previousversion.sh
|
Initialize the cluster
Some options for kubeadm init:
--apiserver-advertise-address: the IP address on which the API server is listening. --pod-network-cidr: allows you to set the CIDR that is used for the pod network--service-cidr: allows you to set the CIDR that is used for the service network--dry-run: performs a dry run before actually installing for real--config: to specify a configuration file with parameters to be used for deployment
Steps for cluster initialization:
- preflight: ensure all conditions are met and core container images are downloaded
- certs: a Self-Signed Kubernetes CA is generated, and related certificates are created for apiserver, etcd, and proxy
- kubeconfig: configuration files are generated for Core K8s Services
- kubelet-start: kubelet is started
- control-plane: static Pod manifest are created and started for apiserver, controller manager, and scheduler
- etcd: static Pod manifest are created and started for etcd
- upload-config: ConfigMap are created for cluster and kubelet components
- upload-certs: all certificates uploaded to /etc/kubernets/pki
- mark-control-plane
- bootstrap-token
- kubelet-finalize
- add-on
In case kubeadm fails, run kubeadm reset.
Initialize the cluster:
| sudo kubeadm init --apiserver-advertise-address 192.168.1.91 --pod-network-cidr 10.175.0.0/16 --service-cidr 172.31.1.0/24
|
| To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/tmp/kubeadm-init-dryrun122084317/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
[...]
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.1.91:6443 --token irq45g.8tva192wnay35e6d \
--discovery-token-ca-cert-hash sha256:e44e3a1cf1d65b3f1b0e0e9cbd902a4583ea8400d3636ea4410270e4d84088fd
|
Notes:
Some pods are Pending as no CNI is deployed:
| benoit@cp1:~$ kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-674b8bbfcf-8f8j9 0/1 Pending 0 92s
coredns-674b8bbfcf-szcl6 0/1 Pending 0 92s
etcd-cp1 1/1 Running 0 97s
kube-apiserver-cp1 1/1 Running 0 97s
kube-controller-manager-cp1 1/1 Running 0 97s
kube-proxy-g8fvr 1/1 Running 0 92s
kube-scheduler-cp1 1/1 Running 0 98s
benoit@cp1:~$
|
kubernetes client
/etc/kubernetes/admin.conf is copied to ~/.kube/config so the administrator can access the cluster.
kubernetes networking
Install calico:
| kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
|
Checks:
| benoit@cp1:~$ kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
calico-kube-controllers-7498b9bb4c-tv9hx 1/1 Running 0 2m11s
calico-node-47qxv 1/1 Running 0 2m11s
coredns-674b8bbfcf-8f8j9 1/1 Running 0 5m41s
coredns-674b8bbfcf-szcl6 1/1 Running 0 5m41s
etcd-cp1 1/1 Running 0 5m46s
kube-apiserver-cp1 1/1 Running 0 5m46s
kube-controller-manager-cp1 1/1 Running 0 5m46s
kube-proxy-g8fvr 1/1 Running 0 5m41s
kube-scheduler-cp1 1/1 Running 0 5m47s
benoit@cp1:~$
|
Add nodes to the cluster:
If you can't get the token previously printed:
| sudo kubeadm token create --print-join-command
kubeadm join 192.168.1.91:6443 --token 47nba8.56xccnxjuq38fsxj --discovery-token-ca-cert-hash sha256:e44e3a1cf1d65b3f1b0e0e9cbd902a4583ea8400d3636ea4410270e4d84088fd
|
Then on each worker node:
| kubeadm join 192.168.1.91:6443 --token 47nba8.56xccnxjuq38fsxj --discovery-token-ca-cert-hash sha256:e44e3a1cf1d65b3f1b0e0e9cbd902a4583ea8400d3636ea4410270e4d84088fd
|
Check with:
| $ kubectl get nodes
NAME STATUS ROLES AGE VERSION
cp1 Ready control-plane 11m v1.33.5
w1 Ready <none> 55s v1.33.5
w2 Ready <none> 48s v1.33.5
$
|
Quick test:
| kubectl create deployment testdeploy --image=nginx --replicas=3
|
Check with - can take few seconds:
| $ kubectl get all
NAME READY STATUS RESTARTS AGE
pod/testdeploy-6f5f9fbfc4-lh8nv 1/1 Running 0 30s
pod/testdeploy-6f5f9fbfc4-rgknj 1/1 Running 0 30s
pod/testdeploy-6f5f9fbfc4-xtj9m 1/1 Running 0 30s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 172.31.1.1 <none> 443/TCP 14m
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/testdeploy 3/3 3 3 30s
NAME DESIRED CURRENT READY AGE
replicaset.apps/testdeploy-6f5f9fbfc4 3 3 3 30s
|