Aller au contenu principal

Kubeadm

1. Informations​

1.1. kube-master1.home.lab​

Caratéristiques
RAM2 Go
CPU2 coeurs
Disque20 Go
Hostnamekube-master1.home.lab
IP admin192.168.50.17

1.2. kube-worker1.home.lab​

Caratéristiques
RAM2 Go
CPU2 coeurs
Disque20 Go
Hostnamekube-worker1.home.lab
IP admin192.168.50.18

1.3. kube-worker2​

Caratéristiques
RAM2 Go
CPU2 coeurs
Disque20 Go
Hostnamekube-worker2.home.lab
IP admin192.168.50.19

2. Documentations​

3. Ajout du repository epel-release et CRB​

$ sudo dnf install -y epel-release
$ sudo /usr/bin/crb enable
$ sudo dnf update

4. Configuration du système d'exploitation​

4.1. Désactiver le swap​

$ sudo swapoff -a
$ sudo sed -i '/ swap / s/^/#/' /etc/fstab

4.2. Configurer le kernel​

  • Créer le fichier /etc/modules-load.d/k8s.conf
overlay
br_netfilter
  • Charger les modules kernel
$ sudo modprobe overlay
$ sudo modprobe br_netfilter

5. Configuration du réseau​

5.1. Configurer le kernel​

  • Créer le fichier /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
#net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
  • Appliquer les changements
$ sudo sysctl -p /etc/sysctl.d/k8s.conf

5.2. Modifier le fichier /etc/hosts​

192.168.50.17 kube-master1.home.lab kube-master1
192.168.50.18 kube-worker1.home.lab kube-worker1
192.168.50.19 kube-worker2.home.lab kube-worker2

6. Installation de podman et CRI-O​

6.1. Installer podman​

sudo dnf install -y podman

6.2. Installer cri-o et crictl​

  • Ajouter les dépôts CRI-O
$ OS=CentOS_9_Stream
$ VERSION=1.28

$ sudo curl -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo \
  https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/devel:kubic:libcontainers:stable.repo

$ sudo curl -o /etc/yum.repos.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo \
  https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo
  • Installer les packages CRI-O et cri-tools
$ sudo dnf install cri-o cri-tools
  • Démarrer le service crio
$ sudo systemctl enable --now crio
  • Vérifier l'installation de crio
$ crictl --version
$ sudo crictl info

7. Installation de kubeadm​

7.1. Configurer SELinux​

  • Modifier le mode de SELinux en "permissive"
# Set SELinux in permissive mode (effectively disabling it)
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

7.2. Installer kubeadm​

  • Créer le fichier /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
  • Installer les packages kubeadm et kubelet
sudo dnf update
sudo dnf install kubeadm kubelet kubectl --disableexcludes=kubernetes
  • Démarrer le service kubelet
sudo systemctl enable --now kubelet
  • Vérifier l'installation
kubeadm version
kubectl version

7.3. Initialiser le master du cluster k8s​

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/

LOAD_BALANCER=192.168.50.17
sudo kubeadm init --cri-socket=unix:///var/run/crio/crio.sock --pod-network-cidr=10.244.0.0/16 --upload-certs --control-plane-endpoint "192.168.50.17:6443" --apiserver-advertise-address 192.168.50.17
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

8. Configuration de firewalld​

8.1. Configurer firewalld sur le master​

# Kubernetes API server
sudo firewall-cmd --permanent --add-port=6443/tcp
# etcd server client API
sudo firewall-cmd --permanent --add-port=2379-2380/tcp
# Kubelet API
sudo firewall-cmd --permanent --add-port=10250/tcp
# kube-scheduler
sudo firewall-cmd --permanent --add-port=10251/tcp
# kube-controller-manager
sudo firewall-cmd --permanent --add-port=10252/tcp
# flannel
sudo firewall-cmd --permanent --add-port=8285/udp
sudo firewall-cmd --permanent --add-port=8472/udp
# reload firewalla rules
sudo firewall-cmd reload
  • Autres ports à ouvrir ?
sudo firewall-cmd --permanent --add-port=10259/tcp
sudo firewall-cmd --permanent --add-port=10257/tcp
sudo firewall-cmd --permanent --add-port=179/tcp
sudo firewall-cmd --permanent --add-port=4789/udp

8.2. Configurer firewalld sur les workers​

# Kubelet API
sudo firewall-cmd --permanent --add-port=10250/tcp
# flannel
sudo firewall-cmd --permanent --add-port=8285/udp
sudo firewall-cmd --permanent --add-port=8472/udp
# NodePort services
sudo firewall-cmd --permanent --add-port=30000-32767/tcp
# reload firewall rules
sudo firewall-cmd reload
sudo firewall-cmd --permanent --add-port=179/tcp
sudo firewall-cmd --permanent --add-port=4789/udp
sudo firewall reload

9. Création du cluster k8s​

9.1. Créer un token pour joindre le cluster k8s​

  • sur le master kube-master1, générer un token pour joindre le cluster k8s
kubeadm token create --print-join-command
kubeadm join 192.168.50.17:6443 --token <TOKEN> --discovery-token-ca-cert-hash sha256:<HASH>

9.2. Joindre un worker au cluster cluster k8s​

  • Utiliser le token généré sur le master kube-master1
sudo kubeadm join 192.168.50.17:6443 --token <TOKEN> --discovery-token-ca-cert-hash sha256:<HASH> --cri-socket=unix:///var/run/crio/crio.sock

10. Vérification de l'état du cluster​

10.1. Get nodes​

  • sur le master kube-master1
kubectl get nodes
NAME           STATUS   ROLES           AGE   VERSION
kube-master1   Ready    control-plane   16m   v1.33.0
kube-worker1   Ready    <none>          96s   v1.33.0
kube-worker2   Ready    <none>          69s   v1.33.0

10.2. Get pods​

  • sur le master kube-master1
kubectl get pods -A                                                                NAMESPACE     NAME                                   READY   STATUS    RESTARTS   AGE
kube-system   coredns-674b8bbfcf-66rgl               1/1     Running   0          17m                                                
kube-system   coredns-674b8bbfcf-drh4r               1/1     Running   0          17m                                                
kube-system   etcd-kube-master1                      1/1     Running   0          17m                                                
kube-system   kube-apiserver-kube-master1            1/1     Running   0          17m                                                
kube-system   kube-controller-manager-kube-master1   1/1     Running   0          17m                                                
kube-system   kube-proxy-c24lw                       1/1     Running   0          17m                                                
kube-system   kube-proxy-cfpmj                       1/1     Running   0          2m25s                                              
kube-system   kube-proxy-m847z                       1/1     Running   0          118s                                               
kube-system   kube-scheduler-kube-master1            1/1     Running   0          17m

11. Installation de plugins réseau​

11.1. Installer Flannel​

  • sur le master kube-master1
$ kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

11.2. Installer Calico​

  • #todo à compélter

12. Configuration du DNS au sein du cluster k8s​

12.1. Editer le pod coredns​

  • Modifier la configmap
kubectl -n kube-system edit configmap coredns
  • Ajouter un forward de zone DNS home.lab vers le serveur DNS FreeIPA (192.168.50.11)
    home.lab:53 {
        errors
        cache 30
        forward . 192.168.50.11    
    }

12.2. Redéployer le pod coredns​

$ kubectl -n kube-system rollout restart deployment coredns

12.3. Ouvrir le flux DNS ?​

$ sudo firewall-cmd --add-port=udp/53 --permanent
$ sudo firewall-cmd --reload

12.4. Tester le DNS depuis un pod​

$ kubectl run -i --tty dns-test --image=busybox --restart=Never -- sh
cat /etc/resolv.conf
search default.svc.cluster.local svc.cluster.local cluster.local home.lab
nameserver 10.96.0.10
options ndots:5

nslookup gitlab1.home.lab

13. Déployer le certificat de l'AC au sein du cluster k8s​

  • #todo à compléter