ducoterra/kube-vm
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
ducoterra
2020-09-08 22:06:16 -04:00
commit e6e49a57db
5 changed files with 308 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored Normal file
View File

@@ -0,0 +1 @@
certs

59
README.md Normal file
View File

@@ -0,0 +1,59 @@
# VM Managed Kubernetes
## etcd
3 debian VMs with etcd
| Host | CPU | MEM | DISK | IP | VNC Port |
| --------- | ----- | ------ | ------- | --------- | -------- |
| etcd1 | 2 | 2G | 16G | 3.14.3.20 | 5920 |
| etcd2 | 2 | 2G | 16G | 3.14.3.21 | 5921 |
| etcd3 | 2 | 2G | 16G | 3.14.3.22 | 5922 |
| **TOTAL** | **6** | **6G** | **48G** | | |
## k3os
3 k3os VMs
| Host | CPU | MEM | DISK | IP | VNC Port |
| --------- | ------ | ------- | ------- | --------- | -------- |
| kube1 | 12 | 16G | 16G | 3.14.3.23 | 5923 |
| kube2 | 12 | 16G | 16G | 3.14.3.24 | 5924 |
| kube3 | 12 | 16G | 16G | 3.14.3.25 | 5925 |
| **TOTAL** | **36** | **48G** | **48G** | | |
## Wireguard
2 debian VMs with wireguard and dnsmasq
| Host | CPU | MEM | DISK | IP | VNC Port |
| --------- | ----- | ------ | ------- | --------- | -------- |
| wg1 | 2 | 2G | 16G | 3.14.3.26 | 5926 |
| wg2 | 2 | 2G | 16G | 3.14.3.27 | 5927 |
| **TOTAL** | **4** | **4G** | **32G** | | |
## /etc/hosts
```bash
cat <<EOF >> /etc/hosts
3.14.3.20 etcd1
3.14.3.21 etcd2
3.14.3.22 etcd3
3.14.3.23 kube1
3.14.3.24 kube2
3.14.3.25 kube3
3.14.3.26 wg1
3.14.3.27 wg2
EOF
```
## UEFI Boot Issues
1. When on UEFI Interactive Shell; type: exit
1. In the EFI menu system navigate to "Boot Maintenance Manager"
1. Select "Boot from file"
1. Locate and select your grubx64.efi file
1. When in terminal:
1. $ sudo mkdir /boot/efi/EFI/BOOT
1. $ sudo cp /boot/efi/EFI/ubuntu/grubx64.efi /boot/efi/EFI/BOOT/bootx64.efi
1. $ reboot

232
etcd.md Normal file
View File

@@ -0,0 +1,232 @@
# ETCD Config and Testing
## Config
### /etc/hosts
```bash
cat <<EOF >> /etc/hosts
3.14.3.20 etcd1
3.14.3.21 etcd2
3.14.3.22 etcd3
3.14.3.23 kube1
3.14.3.24 kube2
3.14.3.25 kube3
3.14.3.26 wg1
3.14.3.27 wg2
EOF
```
### Generate Certs
Pick one server to act as the CA.
Install make
```bash
apt install -y make gcc git
```
Install [go](https://golang.org/doc/install)
```bash
tar -C /usr/local -xzf go...
rm go...
cat <<EOF >> ~/.bashrc
export PATH=$PATH:/usr/local/go/bin
EOF
source ~/.bashrc
```
Install [cfssl](https://github.com/cloudflare/cfssl)
```bash
git clone https://github.com/cloudflare/cfssl
cd cfssl
make -j 2
cp bin/cfssl bin/cfssljson /usr/local/bin/
cd ..
rm -r cfssl
```
Create templates
```bash
mkdir ~/.cfssl
cd ~/.cfssl
cat <<EOF > ca-config.json
{
"signing": {
"default": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "876000h"
}
}
}
EOF
cat <<EOF > ca-csr.json
{
"CN": "etcd",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"O": "autogenerated",
"OU": "etcd cluster",
"L": "duconet"
}
]
}
EOF
cat <<EOF > req-csr.json
{
"CN": "etcd",
"hosts": [
"etcd1",
"etcd2",
"etcd3",
"localhost"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"O": "autogenerated",
"OU": "etcd cluster",
"L": "duconet"
}
]
}
EOF
```
Generate CA:
```bash
mkdir -p /certs
cfssl gencert -initca ca-csr.json | cfssljson -bare /certs/ca
```
Generate a Peer and Client Cert:
```bash
cfssl gencert \
-ca /certs/ca.pem \
-ca-key /certs/ca-key.pem \
-config ca-config.json \
req-csr.json | cfssljson -bare /certs/client
cfssl gencert \
-ca /certs/ca.pem \
-ca-key /certs/ca-key.pem \
-config ca-config.json \
req-csr.json | cfssljson -bare /certs/etcd1
cfssl gencert \
-ca /certs/ca.pem \
-ca-key /certs/ca-key.pem \
-config ca-config.json \
req-csr.json | cfssljson -bare /certs/etcd2
cfssl gencert \
-ca /certs/ca.pem \
-ca-key /certs/ca-key.pem \
-config ca-config.json \
req-csr.json | cfssljson -bare /certs/etcd3
# Run this on every node
useradd etcd
usermod -aG etcd ducoterra
mkdir -p /certs
chown -R etcd:etcd /certs
chmod 770 /certs
scp /certs/ca.pem /certs/client-key.pem /certs/client.pem /certs/etcd2-key.pem /certs/etcd2.pem etcd2:/certs/
scp /certs/ca.pem /certs/client-key.pem /certs/client.pem /certs/etcd3-key.pem /certs/etcd3.pem etcd3:/certs/
chown -R etcd:etcd /certs
chmod 600 /certs/*
```
## Install ETCD
[Download the latest version](https://github.com/etcd-io/etcd/releases)
```bash
tar xf $(find . -maxdepth 1 -name etcd*)
cp $(find . -maxdepth 1 -type d -name "etcd*")/etcd $(find . -maxdepth 1 -type d -name "etcd*")/etcdctl /usr/local/bin/
chmod +x /usr/local/bin/etcd /usr/local/bin/etcdctl
echo 'export ETCD_IP=etcd1' >> ~/.bashrc
echo 'export ETCD_NAME=etcd1' >> ~/.bashrc
source ~/.bashrc
mkdir -p /var/lib/etcd
chown -R etcd:etcd /var/lib/etcd
chmod -R 700 /var/lib/etcd
cat <<EOF > /etc/systemd/system/etcd.service
[Unit]
Description=etcd service
Documentation=https://github.com/etcd-io/etcd
After=network.target
[Service]
User=etcd
Type=notify
Environment=ETCD_DATA_DIR=/var/lib/etcd/$ETCD_NAME
Environment=ETCD_NAME=$ETCD_NAME
Environment=ETCD_INITIAL_ADVERTISE_PEER_URLS=https://$ETCD_IP:2380
Environment=ETCD_LISTEN_PEER_URLS=https://0.0.0.0:2380
Environment=ETCD_LISTEN_CLIENT_URLS=https://0.0.0.0:2379
Environment=ETCD_ADVERTISE_CLIENT_URLS=https://$ETCD_IP:2379
Environment=ETCD_INITIAL_CLUSTER_TOKEN=pi-cluster-1
Environment=ETCD_INITIAL_CLUSTER="etcd1=https://etcd1:2380,etcd2=https://etcd2:2380,etcd3=https://etcd3:2380"
Environment=ETCD_INITIAL_CLUSTER_STATE=new
Environment=ETCD_TRUSTED_CA_FILE=/certs/ca.pem
Environment=ETCD_CERT_FILE=/certs/client.pem
Environment=ETCD_KEY_FILE=/certs/client-key.pem
Environment=ETCD_PEER_TRUSTED_CA_FILE=/certs/ca.pem
Environment=ETCD_PEER_CERT_FILE=/certs/$ETCD_NAME.pem
Environment=ETCD_PEER_KEY_FILE=/certs/$ETCD_NAME-key.pem
ExecStart=/usr/local/bin/etcd --client-cert-auth --peer-client-cert-auth
Restart=on-failure
RestartSec=5
LimitNOFILE=40000
[Install]
WantedBy=multi-user.target
EOF
systemctl start etcd
systemctl enable etcd
journalctl -u etcd -f
```
## Testing
```bash
scp etcd1:/certs/client.pem etcd1:/certs/client-key.pem etcd1:/certs/ca.pem certs
export ETCDCTL_DIAL_TIMEOUT=3s;
export ETCDCTL_CACERT=./certs/ca.pem;
export ETCDCTL_CERT=./certs/client.pem;
export ETCDCTL_KEY=./certs/client-key.pem;
export ETCDCTL_ENDPOINTS=https://etcd1:2379,https://etcd2:2379,https://etcd3:2379;
etcdctl put foo bar
etcdctl get foo
while true; do etcdctl put foo $(( ( RANDOM % 1000 ) + 1 )) && etcdctl get foo; done;
etcdctl del "" --from-key=true
```

1
k3os.md Normal file
View File

@@ -0,0 +1 @@
# K3OS

15
k3os1.yaml Normal file
View File

@@ -0,0 +1,15 @@
hostname: k3os1
ssh_authorized_keys:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFb/p/AdaQMlWqUNlE3NdSiX8Wxpr2q4gmsW/h/IbC2uU47VynMK5NZjZs00+HTRRg6LSj42zF9Q6zxn2RCoG0WGvU7c9JJbmnr9OB+TWg+0vBK0Ic9p5or5pMLE7OGRMiNwvIxmNXyBEH7m1VIz+Z2iiuOtNeicSOa8nTtz7mt+fQX6rCpolekFFbi+Hraq/wI9EDZO3FqWISEkHkLbYhwJS87PYkqIiuLqZhYahx7KtYcfVMpPuYy6Wjtd8enTT7FWHaeU9YkDtLF0XhDQOAWAvfpz0xfmsl2obzLJ5KMMlhCMz9FPfuglxnFy8X7QsnZ2KdVjwu6QcYlULFWBxt ducoterra@DucoBook.local"
boot_cmd:
- "echo '127.0.0.1 hub.ducoterra.net' | tee --append /etc/hosts"
k3os:
k3s_args:
- server
- "--disable"
- "traefik"
- "--disable"
- "local-storage"
ntp_servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org