Thursday, August 11, 2022

Installing Helm by a specific version

 While creating a duplicate deployment system for testing purposes we may require to install a very old version of helm

I have done this by using the below steps.

# curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3

# chmod +x get_helm.sh

# ./get_helm.sh -v v3.1.2

# helm version

version.BuildInfo{Version:"v3.1.2", GitCommit:"d878d4d45863e42fd5cff6743294a11d28a9abce", GitTreeState:"clean", GoVersion:"go1.13.8"}





Saturday, May 14, 2022

Vagrant issue with Ubuntu16.04

While executing the command "vagrant up" you will see the following error message.


 Box 'generic/ubuntu2004' could not be found. Attempting to find and install...

   servername: Box Provider: virtualbox

   servername: Box Version: 3.3.0

The box 'generic/ubuntu2004' could not be found or

could not be accessed in the remote catalog. If this is a private

box on HashiCorp's Atlas, please verify you're logged in via

`vagrant login`. Also, please double-check the name. The expanded

URL and error message are shown below:


URL: ["https://atlas.hashicorp.com/generic/ubuntu2004"]

Error: The requested URL returned error: 404 Not Found

So the issue is with your vagrant version (1.8.7), so here we would require the last Vagrant version 2


On your Ubuntu 16.04LTS vagrant binay download will show the following error.



ajeesh@Aspire-A515-51G:~/Downloads/vagr$ ./vagrant --help

/tmp/.mount_vagranhKrhmD/usr/bin/ruby2.6: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /tmp/.mount_vagranhKrhmD/usr/lib/x86_64-linux-gnu/libruby-2.6.so.2.6)

/tmp/.mount_vagranhKrhmD/usr/bin/ruby2.6: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /tmp/.mount_vagranhKrhmD/usr/lib/x86_64-linux-gnu/libruby-2.6.so.2.6)


Fix:
# apt-get remove vagrant

# apt-get install vagrant

root@Aspire-A515-51G:~# vagrant --version
Vagrant 2.2.19

Friday, March 12, 2021

Unhealthy status for controller-manager and scheduler

 [vagrant@kmaster ~]$ kubectl get cs

Warning: v1 ComponentStatus is deprecated in v1.19+

NAME                 STATUS      MESSAGE                                                                                       ERROR

scheduler            Unhealthy   Get "http://127.0.0.1:10251/healthz": dial tcp 127.0.0.1:10251: connect: connection refused   

controller-manager   Unhealthy   Get "http://127.0.0.1:10252/healthz": dial tcp 127.0.0.1:10252: connect: connection refused   

etcd-0               Healthy     {"health":"true"}    


And other commands everything works fine.


 [ajeesh@kmaster ~]$ kubectl cluster-info

Kubernetes master is running at https://172.42.42.100:6443

KubeDNS is running at https://172.42.42.100:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

[ajeesh@kmaster ~]$ kubectl get pods --all-namespaces
NAMESPACE     NAME                                          READY   STATUS         RESTARTS   AGE
kube-system   calico-kube-controllers-56b44cd6d5-27smn      1/1     Running        0          6m43s
kube-system   calico-kube-controllers-56b44cd6d5-g6gfw      0/1     NodeAffinity   0          118d
kube-system   calico-node-rv52x                             1/1     Running        0          6m42s
kube-system   calico-node-tq84v                             1/1     Running        4          118d
kube-system   calico-node-wg8h9                             1/1     Running        0          6m42s
kube-system   coredns-f9fd979d6-69dhx                       1/1     Running        2          118d
kube-system   coredns-f9fd979d6-rff6t                       1/1     Running        2          118d
kube-system   etcd-kmaster.example.com                      1/1     Running        3          118d
kube-system   kube-apiserver-kmaster.example.com            1/1     Running        3          118d
kube-system   kube-controller-manager-kmaster.example.com   1/1     Running        2          118d
kube-system   kube-proxy-7psvh                              1/1     Running        2          118d
kube-system   kube-proxy-mf4hx                              1/1     Running        2          118d
kube-system   kube-proxy-ndnk6                              1/1     Running        2          118d
kube-system   kube-scheduler-kmaster.example.com            1/1     Running        2          118d
[vagrant@kmaster ~]$ 


This issue is shown in my test Kubernetes cluster and while checking the  kube-controller-manager.yaml and kube-scheduler.yaml 0 is the default port number used. So I have commented on that line and fixed the issue.

vi /etc/kubernetes/manifests/kube-controller-manager.yaml

    - --leader-elect=true

    - --node-cidr-mask-size=24

#    - --port=0

    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt


vi /etc/kubernetes/manifests/kube-scheduler.yaml

     - --kubeconfig=/etc/kubernetes/scheduler.conf

    - --leader-elect=true

#    - --port=0

    image: k8s.gcr.io/kube-scheduler:v1.19.4

    imagePullPolicy: IfNotPresent

    livenessProbe:

      failureThreshold: 8


@kmaster vagrant]# service kubelet restart

@kmaster ~]$ kubectl get cs

Warning: v1 ComponentStatus is deprecated in v1.19+

NAME                 STATUS    MESSAGE             ERROR

controller-manager   Healthy   ok                  

scheduler            Healthy   ok                  

etcd-0               Healthy   {"health":"true"}  

Friday, December 18, 2020

Kubernetes is deprecating Docker?

 

Kubernetes is deprecating Docker?



NO, Kubernetes is deprecating Docker as a container runtime after v1.20. 

Docker support is not going away, it is just deprecating the "Dockershim"

Kubernetes using CRI(Kubernetes created a standard interface called CRI for all runtime implementations.) for all runtime and here docker is most widely used. Moreover, docker is not only the container runtime , but also we can use contained, CRI-O, Rkt etc. So kubelet is not directly talking to Container runtime, instead, it is talking to container runtime through a Container Runtime Interface. In the case of docker Kubernetes cannot use CRI to communicate with docker runtime. Since docker is not implemented with any CRI. So Kubernetes developed a wrapper like application called "dockershim" for communicating with docker runtime, which speaks CRI protocol on one side and Dockerd protocol on the other.

When this will fully be removed.

As of now 12-17-2020 K8S V1.20 - Kubelet start showing a warning message
1.21 - will also show the same warning message
1.22 - will also show the same warning message
1.23 - dockershim will remove

Questions:
Q1: Do we need to install docker?
Ans: No, you don't need to install docker , instead we need to install "containerd" or CRI-O

Q2: Your docker images will work?
Ans: Yes, you can push the image to your registry, "docker ps" can't see stuff created by CRI. Instead, there is a separate tool "crictl"
docker ps --> crictl ps, docker info --> crictl info etc

Q3: What about performance and security?
Ans: For docker runtime, K8S has lots of unwanted docker modules like API, CLI, and Server( in the server, we have container runtime, Volume, and network) but K8S only needs the runtime. So removing the docker runtime makes better performance and thus fewer components fewer security risks.

Q4: What is the name of container runtime for docker?
Ans: Containerd, which is already under the part of CNCF which is maintained and developed as a separate project. ContainerD is the second most alternative of using docker as a runtime.

Q5: Containerd is using any of the service providers?
Ans: Containerd is already used by major Cloud platforms ( AWS EKS, Google Kubernetes Service)

Q6: Do I need to make any modifications for my managed K8S cluster running on AWS,GCP?
Ans: Cloud providers will take care of installing the binaries and container runtime on K8S worker node.

Q7: On-prem K8S cluster?
Yes, Action required, there are two options: 1st. Change the container runtime as "containerd" or CRI-O , 2nd. We still want to use "dockershim" manually install it on your cluster, since Miratis now take control of dockershim https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/


Thursday, August 6, 2020

EIA 2020 Draft Withdrawal request

Sample Letter body:

========================================

To,
C.K.Mishra
Secretary 
Ministry of Environment, Forests and climate 
Indira Pariyavaran Bhavan
Jor Bagh, New Delhi

Date : XX-XX-2020

From,
Your_name
Address

Dear Mr. Mishra,

Subject: Withdraw the draft EIA notification, 2020 [F.N.2-50/2018/IA.III] and defer the process of public comments in the light of the COVID-2019 pandemic.

I am Your_Name, as a citizen of India, writing this mail with reference to the draft EIA notification, 2020 which has been uploaded on the environment ministry’s website on 12.3.2020 seeking public comments within sixty days of the issuance of the notification. I am happy to hear that the same has been extended to August 11. I am deeply concerned that the draft notification has been put out in the midst of a national health crisis. Due to the prevailing situation of global pandemic spread, offices and public movement have been restricted.

The EIA notification is an important regulation through which the impacts of land-use change, water extraction, tree felling, pollution, waste and effluent management for industrial and infrastructure projects are to be studied and used in developmental decisionmaking. Any change in this law has a direct bearing on the living and working conditions of people and the ecology.

As per the design and implementation of EIA notification, it is crucial that the government provides a suitable and adequate opportunity for those impacted or likely to be affected. Opportunities to understand and discuss the implications of the proposed amendments may be severely hindered due to the present health emergency with restricted public movement, social distancing, and challenges to everyday life activities. These restrictions also make it impossible to disseminate information about the notification to communities who deserve to know and influence the notification. 

 So I genuinely requesting the environment of ministry to :

1. Withdraw the proposed amendments of the Draft EIA notification 2020 as early as possible.

2. Consider reissuing the draft only after health conditions related to Covid19 and civic life is normalized across the country.

3. Ensure that there are widespread and informed public discussions on the implication of these amendments.

4. Full disclosure of the nature of comments received and the reasons for acceptance and rejection of these comments, prior to the issuance of the final amendments.

I hope that the environment ministry will uphold its obligations towards informed public participation like the commitment to Principle 10 of the Rio Declaration and also the Principles of Natural Justice, while taking a considered view on the proposed amendments to the EIA notification, 2020.

Copy to: 1. Geeta Menon, Jt Secy, MoEFF (menong@cag.gov.in)

Yours faithfully 
Your_Name

========================================

To address : eia2020-moefcc@gov.in
CC : menong@cag.gov.in
Email subject : Withdraw EIA 2020 draft

Wednesday, July 29, 2020

AWS Certified Solutions Architect – Associate C02 Tips and Tricks




Recently I have passed AWS Certified Solutions Architect - Associate[SAA-C02]. I would like to share some of my experience regarding the latest exam and its preparations.
Now you can schedule your exam at your Home(Pearson Vue only support this opportunity at the moment)

Requirements for writing your Exam from your Home:

  • Windows 10 OS( Linux OS will not work)
  • I have used my cousin sister's Laptop[4GB DDR3, 500HDD,i3]
  • Broadband internet connection ( My JIO connection failed during the start of my exam so I changed the connection, it's maybe because of my home location, It is too dangerous to do this during the Exam)
  • Passport or Driving license.
  • Test your Machine [Network, Audio, Camara] from here: https://home.pearsonvue.com/aws/onvue


I have done the following for preparing my exam:

  • A Cloud Guru CEO Ryan Kroonenburg's course
  • Solve Dumps/Questions in between 200 - 500(min)
  •  Attended AWS meetups + AWS webinars ( Optional )[I am an active member of AWS Users Kochi]
  • Do some discussion with your friend who already attended the exam before[ For me it was Muhasin-Urolime, AWS Expert, Thanks, dude.. ]
  • However, you should have some LUCK anyways...You should have to keep in mind we need to crack the AWS exam pattern[ NB: For beginners and Intermediates ]

Some of the exam topics came for my SAA-C02:
  • VPC (more than 4)
  • EFS
  • AutoScaling ( more than 5 )
  • EBS (more than 2 )
  • RDS (more than 5)
  • S3  (more than 3 )
  • Storage Gateway (more than 2)
  • Data Sync (more than 2)
  • DynamoDB
  • ElastiCache
  • RedShift
  • Kinesis
  • ServerLESS (more than 3 )
  • SQS (more than 2 )
  • Cloudfront  (more than 3 )
  • Cognito
  • Key management
  • etc others i am not sure...

Tips and Tricks

AWS Organizations
1. single point of maintenance +  limiting access to specific services or actions in all of the team members AWS accounts = Use Service control policies

EFS 
2. Shared storage between multiple EC2 instances + file locking capabilities= EFS
3. high availability +  POSIX-compliant and access concurrently from EC2 instances.= EFS

VPC
4. HA , we need two AZ and each AZ contains 3 subnets (1 public for ALB + 1 private for Web servers + 1 private for Database).
5. to provide VPC private connection to AWS services = Use VPC endpoint
6. IPv6 traffic =Egress-only internet gateway

AutoScaling
7. High availability + Scalability + Web server + Session Stickiness  = Auto Scaling group +  ALB +  multiple AZs
8. prevent any scaling delay = Use a Scheduled scaling to scale-out EC2 instances
9. HA = Auto Scaling group(ASG) + ELB + multi EC2 instances in each AZ
10. Scaling based on high demand at peak times = Dynamic Scaling
11. Scheduled workloads  = use schedule scaling.

EBS
12. I/O intensive + relational databases =  EBS Provisioned IOPS SSD (io1)
13. Improve the performance of EBS volume + handle workloads = use EBS Provisioned IOPS SSD (io1)
14. SAN disc = Object Store = EBS
15. log processing + sequentially + throughput rate 500 MB/s = EBS Throughput Optimized HDD (st1)
16. Proprietary File System  = EBS

RDS
17. For performance = Add more read replica to Amazon RDS
18. Transactional + High performance + Data size range 16 TB to 64 TB = Amazon Aurora
19. RDS Reserved Instance's Region, DB Engine, DB Instance Class, Deployment Type and term length cannot be changed later.

S3
20. backup data  less frequently + rapid access + low cost = Amazon S3 Standard-IA
21. restrict access = generate S3 pre-signed URLs
   The pre-signed URLs are valid only for the specified duration.
22. To restrict access to content that you serve from Amazon S3 buckets
Create a special CloudFront user called an origin access identity (OAI) and associate it with your distribution.
Configure your S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket and serve them to your users.
23. PUT Request prefixes = 3,500
24. Encrypt S3 bucket + Encrypt Redshift  + Move data = Data at rest.
25. Secure + Salable + High available = S3
26. Short-term/Temporary access  = Amazon S3 pre-signed URL
27. Enable versioning in both source and destination buckets is prerequisites for cross-region replication in Amazon S3
28. Object Store + Immutable  = Amazon Glacier
29. bypass web servers and store the files directly into S3 bucket = pre-signed URL.
30. Expedited retrieval within 1 - 5 minutes
31. bulk retrieval within 5 - 12 hours
32. The Vault Lock and Standard Retrieval - with 3-5 hours

Storage Gateway
32. Storage Gateway with the cached mode is the best option to migrate iSCSI  to Cloud
33. NFS supported by File Gateway only

DynamoDB
32. 50 ms latency +  increasing exponentially = Amazon DynamoDB
33. S3, DynamoDB and Lambda all have HA
34. Centralized database + strong consistency + scalable + cost optimized = Amazon DynamoDB
35. Enable Amazon DynamoDB Auto Scaling = LESS changes
36. data in chunks + little latency = NoSQL DB = DynamoDB
37. Big Data + flexible schema + indexed data + scalable =Amazon DynamoDB
38. Lowest latency data retrieval + highest scalability = DynamoDB

ElastiCache
39. Repeated Complex Queries = Caching = Amazon ElastiCache.
40. Real data + in-memory = Use Redis.
41. Memcached -> simplicity , Redis -> rich sets of features.

RedShift
42. High Performance + Big Historical Data +  business intelligence tools = data warehouse= Amazon Redshift
43. run different queries types on big data = Amazon Redshift workload management
44. data warehouse + Big Data  + fast = Amazon Redshift

Kinesis
45. 1000 bid per second + process in order + no losing messages + multiple services to process each bid= Amazon Kinesis Data Streams
46. real-time stream +large-volume+ AWS Serverless + custom SQL = Amazon Kinesis Data Analytics
47. Real-time + BIG data streaming = Amazon Kinesis Data Streams
48. Data Analytics + SQL = Amazon Kinesis Data Analytics
49. 100,000 requests per second + Sequential events + click stream analyzing = Use Amazon Kinesis Stream
50. IOT data +  streams+ Partition by equipment + s3 =Use Amazon Kinesis Data Streams

ServerLESS [ Lambda, ]
51. Migration to AWS + Stateless application + Static Content + Less operation overhead = ServerLess solution = Amazon Cognito + Amazon S3 + Amazon API Gateway+ and AWS Lambda
52. Lambda has a limitation of 1000 concurrent requests
53. AWS compute solution +  no special hardware + use 512 MB of memory to run = AWS Lambda functions
54. Lambda is the best option to handle S3 events
55. Scalable + cost-effective + ServerLess = Amazon API Gateway with AWS Lambda Function
56. securely store database passwords + customer master key + Lambda Function  = Lambda Environment Variables

SQS
57. SQS prevent losing orders
58. sold old items first = Use Amazon SQS with FIFO Queue
59. MOST efficient + cost-effective = Decouple the two tiers using Amazon SQS.
60. handle failed messages = Amazon SQS dead-letter queue

Cloudfront
61. CloudFront has a geo-restriction, not a geo routing
62. Custom Origin "On-Premises" + enhance the performance of downloading static files  = Amazon CloudFront

Clodformation:
63. Pilot light DR scenario= DB replication + AWS CloudFormation

CloudTrail
64.  for API calls monitoring

Elastic Beanstalk
65. easy deploying + without managing infrastructure = Elastic Beanstalk 
66. simple deployment + scalable + running on IIS = AWS Elastic Beanstalk

Amazon Cognito
67. MFA +Mobile = Amazon Cognito
68. block suspicious sign-ins = Amazon Cognito user pools

AWS Shield
69. protect the application from DDOS attack = Use AWS Shield

KEY:
70. AWS manages both data key and master key + automatically manage both encryption and decryption  = SSE-S3
71. automated rotation of the encryption keys+  track the usage of encryption key = use SSE-KMS

Misc:
72. machine learning, high-performance computing, video processing, and financial modeling = Amazon FSx for Lustre



Wednesday, May 6, 2020

5 less than K8S = K3S Lightweight Kubernetes

5 less than K8S = K3S Lightweight Kubernetes
Installing and configure a Lightweight Kubernetes cluster.

This is a Lightweight Kubernetes distribution for production workloads.

You can complete the Kubernetes installation in less than 5 Minutes

Document for reference: https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/


Installation Steps:

Master : curl -sfL https://get.k3s.io | sh -
Worker : curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -



Here I am taking 1GB RAM Master and Worker Node(Ubuntu18) in my Virtual Box, The main advantage for the installation is there are no Pre-requisites.

Properties:
- You can install in Raspberry Pi Hardware
- By default, the data is keeping in SQLite no ETCD, But you can configure
- It is using Flannel network
- It is using Containerd not Docker
- Just needs Linux Kernel and Cgroup


Master Node:
==============

root@master:/home# curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" sh -
[INFO]  Finding release for channel stable
[INFO]  Using v1.17.4+k3s1 as release
[INFO]  Downloading hash https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/sha256sum-amd64.txt
[INFO]  Downloading binary https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/k3s
[INFO]  Verifying binary download
[INFO]  Installing k3s to /usr/local/bin/k3s
[INFO]  Creating /usr/local/bin/kubectl symlink to k3s
[INFO]  Creating /usr/local/bin/crictl symlink to k3s
[INFO]  Creating /usr/local/bin/ctr symlink to k3s
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s.service
[INFO]  systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO]  systemd: Starting k3s
root@master:/home#


root@master:/home# kubectl get nodes
NAME         STATUS   ROLES    AGE     VERSION
master  Ready    master   9m27s   v1.17.4+k3s1
root@master:/home/#

Kuberctl is installed by Racher script
root@msater:/home# which kubectl
/usr/local/bin/kubectl

root@master:/var/lib# cd /var/lib/rancher/
root@master:/var/lib/rancher# ls
k3s

root@master:/var/lib/rancher# cd /etc/rancher/
root@master:/etc/rancher# ls
k3s  node

root@master:/etc/rancher# cd /var/lib/rancher/k3s/server/
root@master:/var/lib/rancher/k3s/server# ls
cred  db  kine.sock  manifests  node-token  static  tls  token

TOCKEN LOCATION:
root@master:/var/lib/rancher/k3s/server# cat token
K10e08a165e58554e19bf1f0eab12dd06e8345655b7efe52bcd04029a76226b2034::server:5d82295abb1eb943c32bbcd1fec959d3

KUBE-CONFIG FILE LOCATION:
root@master:~# cd /etc/rancher/k3s/
root@master:/etc/rancher/k3s# ls
k3s.yaml


WORKER NODE Installation:
=========================

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" K3S_URL="https://Master_IP:6443" K3S_TOKEN="xxxxxxxxxxx034::server:5d82295abxxxxxxxc959d3" sh -


vagrant@worker:~$ sudo su
root@worker:/home# curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" K3S_URL="https://Master_IP:6443" K3S_TOKEN="K1xxx6b2034::server:5xxxxxxx59d3" sh -
[INFO]  Finding release for channel stable
[INFO]  Using v1.17.4+k3s1 as release
[INFO]  Downloading hash https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/sha256sum-amd64.txt
[INFO]  Downloading binary https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/k3s
[INFO]  Verifying binary download
[INFO]  Installing k3s to /usr/local/bin/k3s
[INFO]  Creating /usr/local/bin/kubectl symlink to k3s
[INFO]  Creating /usr/local/bin/crictl symlink to k3s
[INFO]  Creating /usr/local/bin/ctr symlink to k3s
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-agent-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s-agent.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s-agent.service
[INFO]  systemd: Enabling k3s-agent unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s-agent.service → /etc/systemd/system/k3s-agent.service.
[INFO]  systemd: Starting k3s-agent
root@worker:/home#


After this, you can see your new worker node is added into your Kubernetes cluster.
root@master:/etc/rancher/k3s# kubectl get nodes
NAME         STATUS   ROLES    AGE   VERSION
worker   Ready       39s   v1.17.4+k3s1
master   Ready    master   27m   v1.17.4+k3s1
root@master:/etc/rancher/k3s#


So we have completed the cluster installation.


For testing, we can deploy an Nginx application and check the cluster further.


root@master:/etc/rancher/k3s# kubectl get all
NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.43.0.1            443/TCP   29m


root@master:/etc/rancher/k3s# kubectl run urolime --image nginx
kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.
deployment.apps/urolime created
root@master:/etc/rancher/k3s#


root@master:/etc/rancher/k3s# kubectl get all
NAME                           READY   STATUS              RESTARTS   AGE
pod/urolime-5b47968689-f4qnj   0/1     ContainerCreating   0          26s

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.43.0.1            443/TCP   32m

NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/urolime   0/1     1            0           26s

NAME                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/urolime-5b47968689   1         1         0       26s
root@master:/etc/rancher/k3s#


Expose the service into a NodePort and try accessing it.

root@master:/etc/rancher/k3s# kubectl expose deployment urolime --port 80 --type NodePort
service/urolime exposed
root@master:/etc/rancher/k3s# kubectl get svc
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.43.0.1              443/TCP        33m
urolime      NodePort    10.43.143.95           80:32623/TCP   7s
root@master:/etc/rancher/k3s#


root@master:/etc/rancher/k3s# curl Master_IP:32623



Welcome to nginx!


Welcome to nginx!


If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.

For online documentation and support please refer to
nginx.org.
Commercial support is available at
nginx.com.

Thank you for using nginx.


root@master:/etc/rancher/k3s#

Sunday, April 26, 2020

Backup and restore Kubernetes cluser

I am checking how can I back up and restore my Kubernetes cluster.



First, we need Object storage like S3.
Minio is opensource Object storage which is compatible for Amazon S3

Setting Up a Minio:
====================
We can run Minio in a docker environment
Stable
docker pull minio/minio
docker run -p 9000:9000 minio/minio server /data


root@testing:/home/ubuntu# docker pull minio/minio
Using default tag: latest
latest: Pulling from minio/minio
4167d3e14976: Already exists
275c32df8f5e: Pull complete
cf0c84ce4772: Pull complete
70885164616a: Pull complete
Digest: sha256:6f8db3d7a1060cb1fcd6855791e9befe2d7f51644be65183680c1189eb196177
Status: Downloaded newer image for minio/minio:latest
root@testing:/home/ubuntu# docker run --name minio -p 9000:9000 -v data:/data minio/minio server /data
Endpoint:  http://172.17.0.3:9000  http://127.0.0.1:9000
Browser Access:
   http://172.17.0.3:9000  http://127.0.0.1:9000
Object API (Amazon S3 compatible):
   Go:         https://docs.min.io/docs/golang-client-quickstart-guide
   Java:       https://docs.min.io/docs/java-client-quickstart-guide
   Python:     https://docs.min.io/docs/python-client-quickstart-guide
   JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
   .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin', please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'
VELERO SETUP:
==========================
Installing the Velero binary
ajeesh@Aspire-A515-51G:~/Downloads/valero$ wget https://github.com/vmware-tanzu/velero/releases/download/v1.3.2/velero-v1.3.2-linux-amd64.tar.gz
--2020-04-26 21:27:41--  https://github.com/vmware-tanzu/velero/releases/download/v1.3.2/velero-v1.3.2-linux-amd64.tar.gz
Resolving github.com (github.com)... 13.234.176.102
Connecting to github.com (github.com)|13.234.176.102|:443... connected.

velero-v1.3.2-linux-amd64.tar.gz      100%[=======================================================================>]  23.39M  1.30MB/s    in 25s

2020-04-26 21:28:08 (956 KB/s) - ‘velero-v1.3.2-linux-amd64.tar.gz’ saved [24528427/24528427]


ajeesh@Aspire-A515-51G:~/Downloads/valero$ tar zxf velero-v1.3.2-linux-amd64.tar.gz
ajeesh@Aspire-A515-51G:~/Downloads/valero$ sudo mv velero-v1.3.2-linux-amd64/velero /usr/local/bin/



Next, you need to update your Minio logins for Velero to configure.

# cat <> minio.credentials
> [default]
> aws_access_key_id=minioadmin
> aws_secret_access_key=minioadmin
> EOF
root@Aspire-A515-51G:
root@Aspire-A515-51G:/velero# ls
minio.credentials


velero$ echo $KUBECONFIG
/home/ajeesh/.kube/config

velero$ /usr/local/bin/velero install   --provider aws  --plugins velero/velero-plugin-for-aws:v1.0.0 --bucket bucketone  --secret-file ./minio.credentials    --backup-location-config region=minio,s3ForcePathStyle=true,s3Url=http://myip:9000

CustomResourceDefinition/backups.velero.io: attempting to create resource
CustomResourceDefinition/backups.velero.io: created
CustomResourceDefinition/backupstoragelocations.velero.io: attempting to create resource
CustomResourceDefinition/backupstoragelocations.velero.io: created
CustomResourceDefinition/deletebackuprequests.velero.io: attempting to create resource
CustomResourceDefinition/deletebackuprequests.velero.io: created
CustomResourceDefinition/downloadrequests.velero.io: attempting to create resource
CustomResourceDefinition/downloadrequests.velero.io: created
CustomResourceDefinition/podvolumebackups.velero.io: attempting to create resource
CustomResourceDefinition/podvolumebackups.velero.io: created
CustomResourceDefinition/podvolumerestores.velero.io: attempting to create resource
CustomResourceDefinition/podvolumerestores.velero.io: created
CustomResourceDefinition/resticrepositories.velero.io: attempting to create resource
CustomResourceDefinition/resticrepositories.velero.io: created
CustomResourceDefinition/restores.velero.io: attempting to create resource
CustomResourceDefinition/restores.velero.io: created
CustomResourceDefinition/schedules.velero.io: attempting to create resource
CustomResourceDefinition/schedules.velero.io: created
CustomResourceDefinition/serverstatusrequests.velero.io: attempting to create resource
CustomResourceDefinition/serverstatusrequests.velero.io: created
CustomResourceDefinition/volumesnapshotlocations.velero.io: attempting to create resource
CustomResourceDefinition/volumesnapshotlocations.velero.io: created
Waiting for resources to be ready in cluster...
Namespace/velero: attempting to create resource
Namespace/velero: created
ClusterRoleBinding/velero: attempting to create resource
ClusterRoleBinding/velero: created
ServiceAccount/velero: attempting to create resource
ServiceAccount/velero: created
Secret/cloud-credentials: attempting to create resource
Secret/cloud-credentials: created
BackupStorageLocation/default: attempting to create resource
BackupStorageLocation/default: created
VolumeSnapshotLocation/default: attempting to create resource
VolumeSnapshotLocation/default: created
Deployment/velero: attempting to create resource
Deployment/velero: created
Velero is installed! ⛵ Use 'kubectl logs deployment/velero -n velero' to view the status.
ajeesh@Aspire-A515-51G:~/test

ajeesh@Aspire-A515-51G:~$ kubectl get all -n velero
NAME                          READY   STATUS    RESTARTS   AGE
pod/velero-795c8d58cd-fc86d   1/1     Running   2          5m17s

NAME                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/velero   1/1     1            1           5m17s

NAME                                DESIRED   CURRENT   READY   AGE
replicaset.apps/velero-795c8d58cd   1         1         1       5m17s
ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ kubectl -n velero get crds
NAME                                          CREATED AT
backups.velero.io                             2020-04-26T16:42:32Z
backupstoragelocations.velero.io              2020-04-26T16:42:32Z
bgpconfigurations.crd.projectcalico.org       2019-11-06T07:35:55Z
bgppeers.crd.projectcalico.org                2019-11-06T07:35:55Z
blockaffinities.crd.projectcalico.org         2019-11-06T07:35:55Z
clusterinformations.crd.projectcalico.org     2019-11-06T07:35:55Z
deletebackuprequests.velero.io                2020-04-26T16:42:32Z
downloadrequests.velero.io                    2020-04-26T16:42:32Z
felixconfigurations.crd.projectcalico.org     2019-11-06T07:35:55Z
globalnetworkpolicies.crd.projectcalico.org   2019-11-06T07:35:55Z
globalnetworksets.crd.projectcalico.org       2019-11-06T07:35:55Z
hostendpoints.crd.projectcalico.org           2019-11-06T07:35:55Z
ipamblocks.crd.projectcalico.org              2019-11-06T07:35:55Z
ipamconfigs.crd.projectcalico.org             2019-11-06T07:35:55Z
ipamhandles.crd.projectcalico.org             2019-11-06T07:35:55Z
ippools.crd.projectcalico.org                 2019-11-06T07:35:55Z
networkpolicies.crd.projectcalico.org         2019-11-06T07:35:55Z
networksets.crd.projectcalico.org             2019-11-06T07:35:55Z
podvolumebackups.velero.io                    2020-04-26T16:42:32Z
podvolumerestores.velero.io                   2020-04-26T16:42:32Z
resticrepositories.velero.io                  2020-04-26T16:42:32Z
restores.velero.io                            2020-04-26T16:42:32Z
schedules.velero.io                           2020-04-26T16:42:32Z
serverstatusrequests.velero.io                2020-04-26T16:42:32Z
volumesnapshotlocations.velero.io             2020-04-26T16:42:32Z
ajeesh@Aspire-A515-51G:~$

Here I have used the following values and variables for configuring the Velero installation.
=========
Velero Version: v1.3.2
velero plugin for AWS = velero/velero-plugin-for-aws:v1.0.0
http://myip:9000 = is the address for Minio container
$KUBECONFIG= home/ajeesh/.kube/config
===========

ajeesh@Aspire-A515-51G:~$ kubectl get ns
NAME                   STATUS   AGE
default                Active   172d
kube-node-lease        Active   172d
kube-public            Active   172d
kube-system            Active   172d
kubernetes-dashboard   Active   146d
metallb-system         Active   161d
velero                 Active   14m
ajeesh@Aspire-A515-51G:~$

For Velero commands to autocomplete:

ajeesh@Aspire-A515-51G:~$ source <(velero completion bash)
ajeesh@Aspire-A515-51G:~$ velero backup
backup           backup-location

For testing I am creating a test namespace for Velero backup:

ajeesh@Aspire-A515-51G:~$ kubectl create ns nginxtest
namespace/nginxtest created

ajeesh@Aspire-A515-51G:~$ kubectl get ns
NAME                   STATUS   AGE
default                Active   172d
kube-node-lease        Active   172d
kube-public            Active   172d
kube-system            Active   172d
kubernetes-dashboard   Active   146d
metallb-system         Active   161d
nginxtest              Active   4s
velero                 Active   20m
ajeesh@Aspire-A515-51G:~$ kubectl -n nginxtest run nginx --image nginx --replicas 2
kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.
deployment.apps/nginx created
ajeesh@Aspire-A515-51G:~$

Create a VELERO BACKUP
----------------------
ajeesh@Aspire-A515-51G:~$ velero backup create namespacenginx --include-namespaces=nginxtest
Backup request "namespacenginx" submitted successfully.
Run `velero backup describe namespacenginx` or `velero backup logs namespacenginx` for more details.
ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ velero backup get
NAME             STATUS   CREATED   EXPIRES   STORAGE LOCATION   SELECTOR
namespacenginx   New           29d                         
ajeesh@Aspire-A515-51G:~$


ajeesh@Aspire-A515-51G:~$ kubectl -n velero get backups
NAME             AGE
namespacenginx   97s
ajeesh@Aspire-A515-51G:~$

While checking the logs i can see the following

ajeesh@Aspire-A515-51G:~$ velero backup logs namespacenginx
Logs for backup "namespacenginx" are not available until it's finished processing. Please wait until the backup has a phase of Completed or Failed and try again.
ajeesh@Aspire-A515-51G:~$ 

This seems to be some issue and my backup has some issue, I need to further check this.


ajeesh@Aspire-A515-51G:~$ velero backup describe namespacenginx
Name:         namespacenginx
Namespace:    velero
Labels:       
Annotations: 
Phase:  New
Namespaces:
  Included:  nginxtest
  Excluded: 
Resources:
  Included:        *
  Excluded:       
  Cluster-scoped:  auto
Label selector: 
Storage Location:
Snapshot PVs:  auto
TTL:  720h0m0s
Hooks: 
Backup Format Version:  0
Started:   
Completed: 
Expiration: 
Persistent Volumes:
ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ velero restore create -help
Error: unknown shorthand flag: 'e' in -elp
Usage:
  velero restore create [RESTORE_NAME] [--from-backup BACKUP_NAME | --from-schedule SCHEDULE_NAME] [flags]

Examples:
  # create a restore named "restore-1" from backup "backup-1"
  velero restore create restore-1 --from-backup backup-1

  # create a restore with a default name ("backup-1-") from backup "backup-1"
  velero restore create --from-backup backup-1
  # create a restore from the latest successful backup triggered by schedule "schedule-1"
  velero restore create --from-schedule schedule-1

  # create a restore from the latest successful OR partially-failed backup triggered by schedule "schedule-1"
  velero restore create --from-schedule schedule-1 --allow-partially-failed

  # create a restore for only persistentvolumeclaims and persistentvolumes within a backup
  velero restore create --from-backup backup-2 --include-resources persistentvolumeclaims,persistentvolumes


For a stand-alone cluster we would require the following data for the backup
1. The root certificate files /etc/kubernetes/pki/ca.crt and /etc/kubernetes/pki/ca.key
2. ECTD backup

ECTD backup:
I have followed below steps:

$ kubectl get pods -n kube-system | grep etcd
etcd-kmaster.example.com                      1/1     Running   21         186d
$ kubectl exec -it -n kube-system etcd-kmaster.example.com  -- /bin/sh

# etcdctl snapshot save
No help topic for 'snapshot'

In this case, I would require to issue the following command.

# export ETCDCTL_API=3

Then our backup command

# export ETCDCTL_API=3
# etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key snapshot save etcd-snapshot-$(date +%Y-%m-%d_%H:%M:%S_%Z).db
{"level":"warn","ts":"2020-05-10T17:01:10.150Z","caller":"clientv3/retry_interceptor.go:116","msg":"retry stream intercept"}
Snapshot saved at etcd-snapshot-2020-05-10_17:01:10_UTC.db
#du -shc etcd-snapshot-2020-05-10_17:01:10_UTC.db
3.9M etcd-snapshot-2020-05-10_17:01:10_UTC.db
3.9M total


Wednesday, December 4, 2019

HELM 3 The new chages and an overview


Helm3 has entirely changed its fundamentals, like tiller pods and service account permissions which we have used in version2.


So in the version3, it is quite easy for installing and moreover security aspect, In earlier versions, everyone installed it with proving full admin privileges. Those who are using Helm version 2 you must make sure you are using a separate and RBAC for the tiller Service Account.

In the new version Helm will use the same Kube config file permission you are using for managing your Kubernetes cluster.

Here I am providing the useful commands and configuration for Helm version 3.

Installation:

We can download the latest stable release from here: https://github.com/helm/helm/releases



ajeesh@Aspire-A515-51G:~/Downloads/helm$ tar -zxvf helm-v3.0.0-linux-amd64.tar.gz
linux-amd64/
linux-amd64/helm
linux-amd64/README.md
linux-amd64/LICENSE
ajeesh@Aspire-A515-51G:~/Downloads/helm$ cd linux-amd64/
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ ls
helm  LICENSE  README.md
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ sudo mv helm /usr/local/bin/
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ helm --help
The Kubernetes package manager
Common actions for Helm:
- helm search:    search for charts
- helm pull:      download a chart to your local directory to view
- helm install:   upload the chart to Kubernetes
- helm list:      list releases of charts
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ helm version --short
v3.0.0+ge29ce2a

If you have helm2 version and you can easily migrate your version2 repos to helm version 3 using a helm plugin.

ajeesh@Aspire-A515-51G:~$ helm plugin install https://github.com/helm/helm-2to3Downloading and installing helm-2to3 v0.2.0 ...
https://github.com/helm/helm-2to3/releases/download/v0.2.0/helm-2to3_0.2.0_linux_amd64.tar.gz
Installed plugin: 2to3
ajeesh@Aspire-A515-51G:~$ helm plugin listNAME    VERSION DESCRIPTION
2to3    0.2.0   migrate and cleanup Helm v2 configuration and releases in-place to Helm v3
ajeesh@Aspire-A515-51G:~$ helm 2to3 --helpMigrate and Cleanup Helm v2 configuration and releases in-place to Helm v3

Usage:
  2to3 [command]

Available Commands:
  cleanup     cleanup Helm v2 configuration, release data and Tiller deployment
  convert     migrate Helm v2 release in-place to Helm v3
  help        Help about any command
  move        migrate Helm v2 configuration in-place to Helm v3

Here if you are in version 2 first you need to convert the configuration files from version 2 to verion2 using the command
helm 2to3 move

Then you can move your installed repos one by one using the command.

helm 2to3 convert jenkins
helm 2to3 convert wordpress

After migrated all the repo then you can clean up your old helm version 2

helm 2to3 cleanup : this will delete your tiller pods from your Kubernetes cluster.

ajeesh@Aspire-A515-51G:~$ helm search repo
Error: no repositories configured

Here we need to add our helm repo:

ajeesh@Aspire-A515-51G:~$ helm repo add stable https://kubernetes-charts.storage.googleapis.com"stable" has been added to your repositories
ajeesh@Aspire-A515-51G:~$ helm repo listNAME    URL
stable  https://kubernetes-charts.storage.googleapis.com

 ajeesh@Aspire-A515-51G:~$ helm search repo jenkins
NAME            CHART VERSION   APP VERSION     DESCRIPTION
stable/jenkins  1.9.7

If you search for a new repo using our old helm version 2 command you will get an error , since in version three it is different.

ajeesh@Aspire-A515-51G:~$ helm install stable/wordpress --name myblog
Error: unknown flag: --name

Here you need to use the helm command as like this,

ajeesh@Aspire-A515-51G:~$ helm install myblog stable/wordpress
NAME: myblog
LAST DEPLOYED: Tue Dec  3 22:48:56 2019
NAMESPACE: default
STATUS: deployed
REVISION: 1
NOTES:
1. Get the WordPress URL:





Saturday, November 16, 2019

Run your Kubernetes Application in Didicated Hosting servers with Loadbalancer

After creating your Kubernetes cluster you will think how can I configure a load balancer, like load balancers in AWS GCP, Azure, etc.



Here we can make use of Metallb https://metallb.universe.tf/ as our load balancer.
 NFS as storage

This is my K8S cluster:

myk8s-tests/metallb$ kubectl get node -o wide
NAME                   STATUS   ROLES    AGE   VERSION   INTERNAL-IP     EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION               CONTAINER-RUNTIME
kmaster.example.com    Ready    master   10d   v1.16.2   172.42.42.100           CentOS Linux 7 (Core)   3.10.0-957.12.2.el7.x86_64   docker://19.3.4
kworker1.example.com   Ready       10d   v1.16.2   172.42.42.101           CentOS Linux 7 (Core)   3.10.0-957.12.2.el7.x86_64   docker://19.3.4
kworker2.example.com   Ready       10d   v1.16.2   172.42.42.102           CentOS Linux 7 (Core)   3.10.0-957.12.2.el7.x86_64   docker://19.3.4


Setup MetalLB in your K8S cluster.

1.
kubectl apply -f https://raw.githubusercontent.com/google/metallb/v0.8.3/manifests/metallb.yaml
2. cat  metallb.yml 

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 172.42.42.110-172.42.42.120  --> Add your IP ranges

Creating a NFS server for our K8S cluster storage:

# apt-get install nfs-kernel-server
# mkdir -p /srv/nfs/kubedata
# chmod -R 777 /srv/nfs/
# cat /etc/exports
/srv/nfs/kubedata *(rw,sync,no_subtree_check,insecure)
# exportfs -rav
exporting *:/srv/nfs/kubedata
# exportfs -v
/srv/nfs/kubedata
(rw,wdelay,insecure,root_squash,no_subtree_check,sec=sys,rw,insecure,root_squash,no_all_squash)
# showmount -e
Export list for ubuntu-01:
/srv/nfs/kubedata *
Then you need to test the NFS mounting in all your k8s nodes.
# showmount -e 172.42.42.10
Export list for 172.42.42.10:
/srv/nfs/kubedata *
# mount -t nfs 172.42.42.10:/srv/nfs/kubedata /mnt
# mount | grep kubedata
172.42.42.10:/srv/nfs/kubedata on /mnt type nfs4 (rw,relatime,vers=4.1,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=172.42.42.101,local_lock=none,addr=172.42.42.10)


Now configure our k8s cluster with our NFS server.

1. We need to create a physical volume in our NFS server.

cat pv-nfs.yml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-manual
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    server: 172.42.42.10
    path: "/srv/nfs/kubedata/nfs_manual"

2. After that, we will create a volume claim that matches our PV
cat pvc-nfs.yml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-nfs-manual
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany  --> need to check
  resources:
    requests:
      storage: 800Mi   --> need check

Verify both manual creations are working fine at your cluster.

nfs$ kubectl get pv,pvc
NAME                             CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                    STORAGECLASS   REASON   AGE
persistentvolume/pv-nfs-manual   1Gi        RWX            Retain           Bound    default/pvc-nfs-manual   manual                  53m
NAME                                   STATUS   VOLUME          CAPACITY   ACCESS MODES   STORAGECLASS   AGE
persistentvolumeclaim/pvc-nfs-manual   Bound    pv-nfs-manual   1Gi        RWX            manual         53m

Now we can deploy our app.

cat nfs-nginx.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: nginx
  name: nginx-deploy
spec:
  replicas: 1
  selector:
    matchLabels:
      run: nginx
  template:
    metadata:
      labels:
        run: nginx
    spec:
      volumes:
      - name: www  --> this name should be same as Volumemounts name
        persistentVolumeClaim:
          claimName: pvc-nfs-manual
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: www   --> need to be same as above name
          mountPath: /usr/share/nginx/html

Create a service for our app using type as LoadBalancer

cat nfs-nginx-svc.yml

apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

kubectl create -f nfs-nginx-svc.yml 

nfs$ kubectl get all

NAME                               READY   STATUS    RESTARTS   AGE
pod/nginx-deploy-f5bd4749b-nftg9   1/1     Running   0          51m
NAME                 TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)          AGE
service/kubernetes   ClusterIP      10.96.0.1                 443/TCP          10d
service/nginx        LoadBalancer   10.103.153.86   172.42.42.110   8080:32012/TCP   11s
NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nginx-deploy   1/1     1            1           51m
NAME                                     DESIRED   CURRENT   READY   AGE
replicaset.apps/nginx-deploy-f5bd4749b   1         1         1       51m







Monday, November 11, 2019

KIND - Kubernetes IN Docker

We can easily up and running K8S cluster for testing, This very lightweight as compared to other local setups.

This post is a reference for those who are trying to install the Kubernetes cluster on your ubuntu machine.

My Ubuntu 18.04 TLS server is a VirtualBox VM and I have installed the following dependencies on that server.

1. Install Docker
sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo apt-key fingerprint 0EBFCD88
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io

2. Install GO Language
https://golang.org/dl/
$ wget https://dl.google.com/go/go1.13.4.linux-amd64.tar.gz
$sudo tar -C /usr/local -xzf go1.13.4.linux-amd64.tar.gz
$ export PATH=$PATH:/usr/local/go/bin
$ go version
go version go1.13.4 linux/amd64
3. kubectl
 $ curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 44.5M  100 44.5M    0     0  1209k      0  0:00:37  0:00:37 --:--:-- 1182k
$ chmod +x ./kubectl
$ sudo mv ./kubectl /usr/local/bin/kubectl



Now install KIND
$ GO111MODULE="on" go get sigs.k8s.io/kind@v0.5.1
go: finding sigs.k8s.io v0.5.1
$ rm go1.13.4.linux-amd64.tar.gz
$ export PATH=$PATH:/home/ajeesh/go/bin
$ kind version
v0.5.1
$ kind create cluster
Creating cluster "kind" ...
 ✓ Ensuring node image (kindest/node:v1.15.3) 🖼
 ✓ Preparing nodes 📦
 ✓ Creating kubeadm config 📜
 ✓ Starting control-plane 🕹️
 ✓ Installing CNI 🔌
 ✓ Installing StorageClass 💾
Cluster creation complete. You can now use the cluster with:
export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
kubectl cluster-info
   $ export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
  $ kind get kubeconfig-path
/home/ajeesh/.kube/kind-config-kind

$ docker ps
CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS                                  NAMES
b52ee9180210        kindest/node:v1.15.3   "/usr/local/bin/entr…"   14 minutes ago      Up 13 minutes       35507/tcp, 127.0.0.1:35507->6443/tcp   kind-control-plane
$ kubectl get nodes
NAME                 STATUS   ROLES    AGE   VERSION
kind-control-plane   Ready    master   17m   v1.15.3

But this is a single node cluster. But if you want to create a multi-node HA cluster we need to do the following settings.

First, delete the current cluster.
$ kind delete cluster
Deleting cluster "kind" ...
$KUBECONFIG is still set to use /home/ajeesh/.kube/kind-config-kind even though that file has been deleted, remember to unset it
$ unset KUBECONFIG
This will delete the kubeconfig file on your .kube folder.
/.kube$ ls
cache  http-cache
 $ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

A cluster with 3 control-plane nodes and 3 workers

$ cat multi-node-kind.yml
kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha3
nodes:
- role: control-plane
- role: control-plane
- role: control-plane
- role: worker
- role: worker
- role: worker
~$ kind create cluster --config multi-node-kind.yml
Creating cluster "kind" ...
 ✓ Ensuring node image (kindest/node:v1.15.3) 🖼
 ✓ Preparing nodes 📦📦📦📦📦
 ✓ Configuring the external load balancer ⚖️
 ✓ Creating kubeadm config 📜
 ✓ Starting control-plane 🕹️
 ✓ Installing CNI 🔌
 ✓ Installing StorageClass 💾
 ✓ Joining more control-plane nodes 🎮
 ✓ Joining worker nodes 🚜
Cluster creation complete. You can now use the cluster with:
export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
kubectl cluster-info

I have some issue with resources so I have reduced worker node to 1 from 3


$ kubectl get nodes
NAME                  STATUS   ROLES    AGE     VERSION
kind-control-plane    Ready    master   2m20s   v1.15.3
kind-control-plane2   Ready    master   106s    v1.15.3
kind-worker           Ready       46s     v1.15.3
:~$ docker ps
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS              PORTS                                  NAMES
a0e52dd3effa        kindest/node:v1.15.3           "/usr/local/bin/entr…"   4 minutes ago       Up 3 minutes                                               kind-worker
2a6c8833c3cb        kindest/node:v1.15.3           "/usr/local/bin/entr…"   4 minutes ago       Up 3 minutes        35213/tcp, 127.0.0.1:35213->6443/tcp   kind-control-plane2
4e38366ad4a7        kindest/haproxy:2.0.0-alpine   "/docker-entrypoint.…"   4 minutes ago       Up 4 minutes        37331/tcp, 127.0.0.1:37331->6443/tcp   kind-external-load-balancer
8a0ce1959722        kindest/node:v1.15.3           "/usr/local/bin/entr…"   4 minutes ago       Up 3 minutes        36145/tcp, 127.0.0.1:36145->6443/tcp   kind-control-plane
:~$ kind get nodes
kind-worker
kind-control-plane2
kind-external-load-balancer
kind-control-plane
~$ kubectl -n kube-system get all
NAME                                              READY   STATUS    RESTARTS   AGE
pod/coredns-5c98db65d4-hmrxc                      1/1     Running   0          4m31s
pod/coredns-5c98db65d4-vgj9w                      1/1     Running   0          4m31s
pod/etcd-kind-control-plane                       1/1     Running   0          3m36s
pod/etcd-kind-control-plane2                      1/1     Running   0          4m12s
pod/kindnet-7754r                                 1/1     Running   1          4m13s
pod/kindnet-9c4rt                                 1/1     Running   1          4m31s
pod/kindnet-b2td4                                 1/1     Running   1          3m13s
pod/kube-apiserver-kind-control-plane             1/1     Running   0          3m36s
pod/kube-apiserver-kind-control-plane2            1/1     Running   0          4m12s
pod/kube-controller-manager-kind-control-plane    1/1     Running   1          3m58s
pod/kube-controller-manager-kind-control-plane2   1/1     Running   0          3m58s
pod/kube-proxy-c628w                              1/1     Running   0          4m13s
pod/kube-proxy-p9787                              1/1     Running   0          4m31s
pod/kube-proxy-zf6pm                              1/1     Running   0          3m13s
pod/kube-scheduler-kind-control-plane             1/1     Running   1          3m58s
pod/kube-scheduler-kind-control-plane2            1/1     Running   0          4m12s
NAME               TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)                  AGE
service/kube-dns   ClusterIP   10.96.0.10           53/UDP,53/TCP,9153/TCP   4m46s
NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                 AGE
daemonset.apps/kindnet      3         3         3       3            3                                   4m43s
daemonset.apps/kube-proxy   3         3         3       3            3           beta.kubernetes.io/os=linux   4m45s
NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/coredns   2/2     2            2           4m46s
NAME                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/coredns-5c98db65d4   2         2         2       4m31s