kubernetes-ansible

Install and configure a kubernetes cluster including network overlay and optionnal addons. Based on CiscoCloud work.

Requirements

Tested on Debian Jessie and Ubuntu (14.10, 15.04, 15.10). The target servers must have access to the Internet in order to pull docker imaqes. The firewalls are not managed, you'll need to implement your own rules the way you used to.

Ansible v1.9.x

Components

• kubernetes v1.0.6
• etcd v2.2.0
• calicoctl v0.5.1
• flanneld v0.5.3
• docker v1.8.2

Ansible

Download binaries

A role allows to download required binaries which will be stored in a directory defined by the variable 'local_release_dir' (by default /tmp). Please ensure that you have enough disk space there (about 1G).

Note: Whenever you'll need to change the version of a software, you'll have to erase the content of this directory.

Variables

The main variables to change are located in the directory environments/[env_name]/group_vars/k8s-cluster.yml.

Playbook

---
- hosts: downloader
  sudo: no
  roles:
    - { role: download, tags: download }

- hosts: k8s-cluster
  roles:
    - { role: etcd, tags: etcd }
    - { role: docker, tags: docker }
    - { role: overlay_network, tags: ['calico', 'flannel', 'network'] }
    - { role: dnsmasq, tags: dnsmasq }

- hosts: kube-master
  roles:
    - { role: kubernetes/master, tags: master }
    - { role: k8s-skydns, tags: skydns }
    - { role: k8s-kube-ui, tags: kube-ui }

- hosts: kube-node
  roles:
    - { role: kubernetes/node, tags: node }

Run

It is possible to define variables for different environments. For instance, in order to deploy the cluster on 'dev' environment run the following command.

ansible-playbook -i environments/dev/inventory cluster.yml -u root

Kubernetes

Network Overlay

You can choose between 2 network overlays. Only one must be chosen.

• flannel: gre/vxlan (layer 2) networking. (official docs)

• calico: bgp (layer 3) networking. (official docs)

The choice is defined with the variable 'overlay_network_plugin'

Expose a service

There are several loadbalancing solutions. The ones i found suitable for kubernetes are Vulcand and Haproxy

My cluster is working with haproxy and kubernetes services are configured with the loadbalancing type 'nodePort'. eg: each node opens the same tcp port and forwards the traffic to the target pod wherever it is located.

Then Haproxy can be configured to request kubernetes's api in order to loadbalance on the proper tcp port on the nodes.

Please refer to the proper kubernetes documentation on Services

Check cluster status

Kubernetes components

Master processes : kube-apiserver, kube-scheduler, kube-controller, kube-proxy Nodes processes : kubelet, kube-proxy, [calico-node|flanneld]

• Check the status of the processes

systemctl status [process_name]

• Check the logs

journalctl -ae -u [process_name]

• Check the NAT rules

iptables -nLv -t nat

Available apps, installation procedure

Additionnal apps can be installed as git submodules. These submodules install Ansible roles, one role per app.

You can list available submodules with the following command:

grep path .gitmodules | sed 's/.*= //'

For instance if you will probably want to install a dns server as it is strongly recommanded. In order to use this role you'll need to follow these steps

git submodule init roles/apps/k8s-skydns
git submodule update

Then update your playbook with the chosen role

...
- hosts: kube-master
  roles:
    - { role: kubernetes/master, tags: master }
    - { role: apps/k8s-skydns, tags: skydns }
...

Please refer to the k8s-skydns readme for additionnal info.

Calico networking

Check if the calico-node container is running

docker ps | grep calico

The calicoctl command allows to check the status of the network workloads.

• Check the status of Calico nodes

calicoctl status

• Show the configured network subnet for containers

calicoctl pool show

• Show the workloads (ip addresses of containers and their located)

calicoctl endpoint show --detail

Flannel networking

Congrats ! now you can walk through kubernetes basics

Known issues

Node reboot and Calico

There is a major issue with calico-kubernetes version 0.5.1 and kubernetes prior to 1.1 : After host reboot, the pods networking are not configured again, they are started without any network configuration. This issue will be fixed when kubernetes 1.1 will be released as described in this issue

Monitoring addon

Until now i didn't managed to get the monitoring addon working.

Apiserver listen on secure port only

Currently the api-server listens on both secure and insecure ports. The insecure port is mainly used for calico. Will be fixed soon.