Build a cluster with kubeadm

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Nodes voorbereiden en een cluster bouwen met kubeadm

Prepare every node

Each node needs a container runtime, kernel modules and sysctl settings for networking, swap off, and the kubeadm, kubelet and kubectl packages.

#swapoff -a && sed -i '/ swap / s/^/#/' /etc/fstab
#cat > /etc/modules-load.d/k8s.conf << 'EOF'
overlay
br_netfilter
EOF
#modprobe overlay && modprobe br_netfilter
#cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
#sysctl --system
#apt-get install -y containerd
#containerd config default > /etc/containerd/config.toml
#sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
#systemctl restart containerd
#apt-get install -y kubelet kubeadm kubectl
#apt-mark hold kubelet kubeadm kubectl

Onthoud

The kubelet and the container runtime must use the same cgroup driver (systemd on modern systems).

2.2

Initialise the control plane

kubeadm init creates the control plane on the first node.

#kubeadm init --pod-network-cidr=10.244.0.0/16 --kubernetes-version stable
$mkdir -p $HOME/.kube
$sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
$sudo chown $(id -u):$(id -g) $HOME/.kube/config
$kubectl get nodes
NAME   STATUS     ROLES           AGE   VERSION
cp1    NotReady   control-plane   40s   v1.33.1

Option	Meaning
`--pod-network-cidr`	Address range for pods (must fit the CNI)
`--apiserver-advertise-address`	The IP the API server listens on
`--control-plane-endpoint`	A stable name/IP (load balancer) for HA
`--config FILE`	All settings in a kubeadm config file

2.3

Install a CNI plugin

Nodes stay NotReady until a CNI gives pods a network.

$kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.0/manifests/calico.yaml
$kubectl get pods -n kube-system -w
$kubectl get nodes

CNI	Known for
Calico	NetworkPolicies, BGP
Cilium	eBPF, NetworkPolicies, observability, can replace kube-proxy
Flannel	Simple, no NetworkPolicies

Let op

Flannel does not enforce NetworkPolicies. For the policy tasks, the cluster needs Calico, Cilium or similar.

2.4

Join worker nodes

Workers join with a token and the CA hash. Make a new join command any time.

#kubeadm token create --print-join-command
kubeadm join 192.168.122.10:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:1a2b...
#kubeadm join 192.168.122.10:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:1a2b...
$kubectl get nodes
$kubectl label node worker1 node-role.kubernetes.io/worker=

2.5

Know high availability

For HA, run 3 control-plane nodes behind a load balancer, with stacked etcd (on the same nodes) or external etcd.

kubeadm init --control-plane-endpoint LB:6443 --upload-certs
Join more control-plane nodes with kubeadm join … --control-plane --certificate-key KEY.
etcd needs an odd number of members (3 or 5) for quorum.

2.6

Configure kubeconfig and contexts

A kubeconfig joins clusters, users and contexts (cluster + user + namespace).

$kubectl config view --minify
$kubectl config set-context dev --cluster=lab --user=dev-user --namespace=dev
$kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes
$export KUBECONFIG=~/.kube/config:~/.kube/lab2

Examentip

Every exam task tells you which context to use. Run the kubectl config use-context … line given in the task first.

Alle commando's in dit hoofdstuk