Pre-requisites : kubectl , awscli, kops, domain in route53,
Create a record set in aws in route53 service
ns-444.awsdns-55.com.
ns-1644.awsdns-13.co.uk.
ns-569.awsdns-07.net.
ns-1218.awsdns-24.org.
mohammedrafi@NOC-RAFI:~$ dig +short NS k8s.devopsact.com
ns-1218.awsdns-24.org.
ns-1644.awsdns-13.co.uk.
ns-444.awsdns-55.com.
ns-569.awsdns-07.net.
mohammedrafi@NOC-RAFI:~$ dig +short NS devopsact.com
ns46.domaincontrol.com.
ns45.domaincontrol.com.
Only my sub domain will be pointing to aws dns servers .
Add the dns NS server obtained from aws in your registrar account zone file
[root@client ~]# yum install kubectl -y
[root@client ~]# kubectl version
Client Version: version.Info{Major:”1″, Minor:”7″, GitVersion:”v1.7.6″, GitCommit:”4bc5e7f9a6c25dc4c03d4d656f2cefd21540e28c”, GitTreeState:”clean”, BuildDate:”2017-09-14T06:55:55Z”, GoVersion:”go1.8.3″, Compiler:”gc”, Platform:”linux/amd64″}
The connection to the server localhost:8080 was refused – did you specify the right host or port?
[root@client ~]# yum provides pip
[root@client ~]# yum install python2-pip-8.1.2-5.el7.noarch -y
[root@client ~]# pip install awscli
[root@client ~]# pip install –upgrade pip
[root@client ~]# wget https://github.com/kubernetes/kops/releases/download/1.7.0/kops-linux-amd64
[root@client ~]# chmod +x kops-linux-amd64
[root@client ~]# mv kops-linux-amd64 /usr/local/bin/kops
[root@client ~]# /usr/local/bin/kops version
Version 1.7.0 (git-e04c29d)
Generate accesskeys in aws
Access key ID AKIAI5HH2WSRW
Secret access key OYECcpOFDPJk35r9YasbzPePCc92cwU1bk
[root@client ~]# aws configure
AWS Access Key ID [None]: AKIAI5HH2WSRW
AWS Secret Access Key [None]: OYECcpOFDPJk35r9YasbzPePCc92cwU1bk
Default region name [None]: us-west-1
Default output format [None]:
[root@client ~]# aws s3 mb s3://cluster1.k8s.devopsact.com
[root@client ~]# aws s3 ls
2017-10-28 13:22:19 cluster1.k8s.devopsact.com
[root@client ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory ‘/root/.ssh’.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:p6CFj97xQG16ZUt8YdRANZ93UQiYo8Kiac7hKYjLfdI root@client
The key’s randomart image is:
+—[RSA 2048]—-+
| +==ooo|
| +. ooo|
| . . .o .+|
| ..o… . . o|
| o..+.S * . |
| = * + * o |
|o= o+ = o . |
|= *o E = |
|.+ .+ . . |
+—-[SHA256]—–+
[root@client ~]# export KOPS_STATE_STORE=s3://cluster1.k8s.devopsact.com
[root@client ~]# /usr/local/bin/kops create cluster –cloud=aws –zones=us-west-1c –dns-zone=k8s.devopsact.com –name=cluster1.k8s.devopsact.com –yes
I1028 14:08:35.393021 1529 create_cluster.go:845] Using SSH public key: /root/.ssh/id_rsa.pub
I1028 14:08:35.814122 1529 subnets.go:183] Assigned CIDR 172.20.32.0/19 to subnet us-west-1c
I1028 14:08:39.069953 1529 executor.go:91] Tasks: 0 done / 63 total; 34 can run
I1028 14:08:42.235583 1529 vfs_castore.go:422] Issuing new certificate: “kube-scheduler”
I1028 14:08:42.308102 1529 vfs_castore.go:422] Issuing new certificate: “master”
I1028 14:08:42.512789 1529 vfs_castore.go:422] Issuing new certificate: “kube-controller-manager”
I1028 14:08:42.609567 1529 vfs_castore.go:422] Issuing new certificate: “kubecfg”
I1028 14:08:42.691972 1529 vfs_castore.go:422] Issuing new certificate: “kubelet”
I1028 14:08:42.866611 1529 vfs_castore.go:422] Issuing new certificate: “kube-proxy”
I1028 14:08:43.168530 1529 vfs_castore.go:422] Issuing new certificate: “kops”
I1028 14:08:44.526529 1529 executor.go:91] Tasks: 34 done / 63 total; 12 can run
I1028 14:08:45.373492 1529 executor.go:91] Tasks: 46 done / 63 total; 15 can run
I1028 14:08:46.105233 1529 launchconfiguration.go:327] waiting for IAM instance profile “nodes.cluster1.k8s.devopsact.com” to be ready
I1028 14:08:46.109902 1529 launchconfiguration.go:327] waiting for IAM instance profile “masters.cluster1.k8s.devopsact.com” to be ready
I1028 14:08:56.630937 1529 executor.go:91] Tasks: 61 done / 63 total; 2 can run
I1028 14:08:57.130901 1529 executor.go:91] Tasks: 63 done / 63 total; 0 can run
I1028 14:08:57.130944 1529 dns.go:152] Pre-creating DNS records
I1028 14:08:57.783919 1529 update_cluster.go:247] Exporting kubecfg for cluster
Kops has set your kubectl context to cluster1.k8s.devopsact.com
Cluster is starting. It should be ready in a few minutes.
Suggestions:
* validate cluster: kops validate cluster
* list nodes: kubectl get nodes –show-labels
* ssh to the master: ssh -i ~/.ssh/id_rsa admin@api.cluster1.k8s.devopsact.com
The admin user is specific to Debian. If not using Debian please use the appropriate user based on your OS.
* read about installing addons: https://github.com/kubernetes/kops/blob/master/docs/addons.md
[root@client ~]# /usr/local/bin/kops validate cluster
Using cluster from kubectl context: cluster1.k8s.devopsact.com
Validating cluster cluster1.k8s.devopsact.com
cannot get nodes for “cluster1.k8s.devopsact.com”: Get https://api.cluster1.k8s.devopsact.com/api/v1/nodes: dial tcp 203.0.113.123:443: i/o timeout
[root@client ~]# /usr/local/bin/kops validate cluster
Using cluster from kubectl context: cluster1.k8s.devopsact.com
State Store: Required value: Please set the –state flag or export KOPS_STATE_STORE.
A valid value follows the format s3://.
A s3 bucket is required to store cluster state information.
[root@client ~]# kubectl get nodes
NAME STATUS AGE VERSION
ip-172-20-35-5.us-west-1.compute.internal NotReady 8s v1.7.4
ip-172-20-36-140.us-west-1.compute.internal NotReady 6s v1.7.4
ip-172-20-61-95.us-west-1.compute.internal Ready 2m v1.7.4
[root@client ~]# kubectl get pods
No resources found.
[root@client ~]# kubectl get svc
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes 100.64.0.1 443/TCP 3m
[root@client ~]# kubectl get dc
the server doesn’t have a resource type “dc”
[root@client ~]# ssh admin@ec2-54-183-102-135.us-west-1.compute.amazonaws.com
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
admin@ip-172-20-61-95:~$ sudo -i
root@ip-172-20-61-95:~# netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 430/rpcbind
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 2268/kube-apiserver
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 568/sshd
tcp 0 0 0.0.0.0:55737 0.0.0.0:* LISTEN 439/rpc.statd
tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 1580/kubelet
tcp 0 0 127.0.0.1:10249 0.0.0.0:* LISTEN 1973/kube-proxy
tcp6 0 0 :::10255 :::* LISTEN 1580/kubelet
tcp6 0 0 :::111 :::* LISTEN 430/rpcbind
tcp6 0 0 :::10256 :::* LISTEN 1973/kube-proxy
tcp6 0 0 :::22 :::* LISTEN 568/sshd
tcp6 0 0 :::57882 :::* LISTEN 439/rpc.statd
tcp6 0 0 :::443 :::* LISTEN 2268/kube-apiserver
tcp6 0 0 :::4001 :::* LISTEN 2128/etcd
tcp6 0 0 :::4002 :::* LISTEN 2049/etcd
tcp6 0 0 :::4194 :::* LISTEN 1580/kubelet
tcp6 0 0 :::10250 :::* LISTEN 1580/kubelet
tcp6 0 0 :::10251 :::* LISTEN 2360/kube-scheduler
tcp6 0 0 :::10252 :::* LISTEN 2327/kube-controlle
tcp6 0 0 :::2380 :::* LISTEN 2128/etcd
tcp6 0 0 :::2381 :::* LISTEN 2049/etcd
root@ip-172-20-61-95:~#
[root@client ~]# ssh admin@ec2-54-183-95-115.us-west-1.compute.amazonaws.com
The authenticity of host ‘ec2-54-183-95-115.us-west-1.compute.amazonaws.com (54.183.95.115)’ can’t be established.
ECDSA key fingerprint is SHA256:iME8OWy98cQcbxj/GLbd6lknZXyUBHc3wSz8VU9l8Ao.
ECDSA key fingerprint is MD5:e8:4f:46:ec:1f:fb:79:67:28:cc:e9:db:d3:7e:4c:30.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘ec2-54-183-95-115.us-west-1.compute.amazonaws.com,54.183.95.115’ (ECDSA) to the list of known hosts.
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
admin@ip-172-20-35-5:~$ netstat -tlpn
(No info could be read for “-p”: geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN –
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN –
tcp 0 0 0.0.0.0:51993 0.0.0.0:* LISTEN –
tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN –
tcp 0 0 127.0.0.1:10249 0.0.0.0:* LISTEN –
tcp6 0 0 :::10255 :::* LISTEN –
tcp6 0 0 :::111 :::* LISTEN –
tcp6 0 0 :::10256 :::* LISTEN –
tcp6 0 0 :::22 :::* LISTEN –
tcp6 0 0 :::4194 :::* LISTEN –
tcp6 0 0 :::37891 :::* LISTEN –
tcp6 0 0 :::10250 :::* LISTEN –
[root@client ~]# /usr/local/bin/kops delete cluster –name=cluster1.k8s.devopsact.com –yes
linuxmadeeasy 