mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
updates based on feedback
This commit is contained in:
Denise Schannon
@@ -5,4 +5,4 @@ weight: 1
|
||||
draft: true
|
||||
---
|
||||
|
||||
Rancher Kubernetes Engine (RKE) is a lightweight tool for installing Kubernetes that supports installation on bare-metal and virtualized servers. RKE is a Kubernetes installer written in Golang. It’s easy to use and doesn’t require a lot of preparation from the user to get started. Kubernetes installation is considered one of the toughest problems for operators and DevOps. Because Kubernetes can run on various platforms and operating systems, there are so many factors that need to be considered during the installation process.
|
||||
Rancher Kubernetes Engine (RKE) is a light-weight Kubernetes installer that supports installation on bare-metal and virtualized servers. RKE solves a common issue in the Kubernettes community: installation complexity. With RKE, Kubernetes installation is simplified, regardless of what operating systems and platforms you're running.
|
||||
|
||||
@@ -27,10 +27,11 @@ There are several options that can be configured in cluster configuration option
|
||||
* [Authorization]({{< baseurl >}}/rke/v0.1.x/en/config-options/authorization/)
|
||||
* [Cloud Providers]({{< baseurl >}}/rke/v0.1.x/en/config-options/cloud-providers/)
|
||||
* [Add-ons]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/)
|
||||
* [Add-ons Jobs Timeout](#add-ons-jobs-timeout)
|
||||
* [Network Plugins]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/network-plugins/)
|
||||
* [Ingress Controller]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/)
|
||||
* [User-Defined-Add-ons]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/)
|
||||
* [Add-ons Jobs Timeout](#add-ons-jobs-timeout)
|
||||
|
||||
|
||||
## Cluster Level Options
|
||||
|
||||
@@ -97,7 +98,7 @@ ssh_agent_auth: true
|
||||
|
||||
If you want to use an SSH private key with a passphrase, you will need to add your key to `ssh-agent` and have the environment variable `SSH_AUTH_SOCK` configured.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ eval "$(ssh-agent -s)"
|
||||
Agent pid 3975
|
||||
$ ssh-add /home/user/.ssh/id_rsa
|
||||
@@ -107,7 +108,6 @@ $ echo $SSH_AUTH_SOCK
|
||||
/tmp/ssh-118TMqxrXsEx/agent.3974
|
||||
```
|
||||
|
||||
|
||||
### Add-ons Job Timeout
|
||||
|
||||
You can define [add-ons]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/) to be deployed after the Kubernetes cluster comes up, which uses Kubernetes [jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/). RKE will stop attempting to retrieve the job status after the timeout, which is in seconds. The default timeout value is `30` seconds.
|
||||
|
||||
@@ -365,7 +365,7 @@ If you want to enable a different cloud provider, RKE allows for custom cloud pr
|
||||
|
||||
For example, in order to use the oVirt cloud provider with Kubernetes, here's the following cloud provider information:
|
||||
|
||||
```bash
|
||||
```
|
||||
[connection]
|
||||
uri = https://localhost:8443/ovirt-engine/api
|
||||
username = admin@internal
|
||||
|
||||
@@ -16,8 +16,6 @@ nodes:
|
||||
- controlplane
|
||||
- etcd
|
||||
- worker
|
||||
ssh_key_path: /home/user/.ssh/id_rsa
|
||||
port: 22
|
||||
```
|
||||
|
||||
## Full `cluster.yml` example
|
||||
@@ -49,6 +47,59 @@ nodes:
|
||||
labels:
|
||||
app: ingress
|
||||
|
||||
# If set to true, RKE will not fail when unsupported Docker version are found
|
||||
ignore_docker_version: false
|
||||
|
||||
# Cluster level SSH private key
|
||||
# Used if no ssh information is set for the node
|
||||
ssh_key_path: ~/.ssh/test
|
||||
|
||||
# Enable use of SSH agent to use SSH private keys with passphrase
|
||||
# This requires the environment `SSH_AUTH_SOCK` configured pointing to your SSH agent which has the private key added
|
||||
ssh_agent_auth: true
|
||||
|
||||
# List of registry credentials
|
||||
# If you are using a Docker Hub registry, you can omit the `url` or set it to `docker.io`
|
||||
private_registries:
|
||||
- url: registry.com
|
||||
user: Username
|
||||
password: password
|
||||
|
||||
# Bastion/Jump host configuration
|
||||
bastion_host:
|
||||
address: x.x.x.x
|
||||
user: ubuntu
|
||||
port: 22
|
||||
ssh_key_path: /home/user/.ssh/bastion_rsa
|
||||
# or
|
||||
# ssh_key: |-
|
||||
# -----BEGIN RSA PRIVATE KEY-----
|
||||
#
|
||||
# -----END RSA PRIVATE KEY-----
|
||||
|
||||
# Set the name of the Kubernetes cluster
|
||||
cluster_name: mycluster
|
||||
|
||||
|
||||
# The kubernetes version used. For now, this should match the version defined in rancher/types defaults map: https://github.com/rancher/types/blob/master/apis/management.cattle.io/v3/k8s_defaults.go#L14
|
||||
# In case the kubernetes_version and kubernetes image in system_images are defined, the system_images configuration will take precedence over kubernetes_version.
|
||||
kubernetes_version: v1.10.3-rancher2
|
||||
|
||||
# System Image Tags are defaulted to a tag tied with specific kubernetes Versions
|
||||
# Default Tags: https://github.com/rancher/types/blob/master/apis/management.cattle.io/v3/k8s_defaults.go)
|
||||
system_images:
|
||||
kubernetes: rancher/hyperkube:v1.10.3-rancher2
|
||||
etcd: rancher/coreos-etcd:v3.1.12
|
||||
alpine: rancher/rke-tools:v0.1.9
|
||||
nginx_proxy: rancher/rke-tools:v0.1.9
|
||||
cert_downloader: rancher/rke-tools:v0.1.9
|
||||
kubernetes_services_sidecar: rancher/rke-tools:v0.1.9
|
||||
kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.8
|
||||
dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.8
|
||||
kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.8
|
||||
kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0
|
||||
pod_infra_container: rancher/pause-amd64:3.1
|
||||
|
||||
services:
|
||||
etcd:
|
||||
# if external etcd is used
|
||||
@@ -68,11 +119,14 @@ services:
|
||||
# xxxxxxxxxx
|
||||
# -----END PRIVATE KEY-----
|
||||
kube-api:
|
||||
# IP range for any services created on Kubernetes
|
||||
# This must match the service_cluster_ip_range in kube-controller
|
||||
service_cluster_ip_range: 10.43.0.0/16
|
||||
# Expose a different port range for NodePort services
|
||||
service_node_port_range: 30000-32767
|
||||
pod_security_policy: false
|
||||
# add additional arguments to the kubernetes component
|
||||
# Note that this WILL OVERRIDE existing defaults
|
||||
# Add additional arguments to the kubernetes API server
|
||||
# This WILL OVERRIDE any existing defaults
|
||||
extra_args:
|
||||
# Enable audit log to stdout
|
||||
audit-log-path: "-"
|
||||
@@ -81,32 +135,56 @@ services:
|
||||
# Set the level of log output to debug-level
|
||||
v: 4
|
||||
kube-controller:
|
||||
# CIDR pool used to assign IP addresses to pods in the cluster
|
||||
cluster_cidr: 10.42.0.0/16
|
||||
# IP range for any services created on Kubernetes
|
||||
# This must match the service_cluster_ip_range in kube-api
|
||||
service_cluster_ip_range: 10.43.0.0/16
|
||||
scheduler:
|
||||
kubelet:
|
||||
# Base domain for the cluster
|
||||
cluster_domain: cluster.local
|
||||
# IP address for the DNS service endpoint
|
||||
cluster_dns_server: 10.43.0.10
|
||||
# Fail if swap is on
|
||||
fail_swap_on: false
|
||||
# Optionally define additional volume binds to a service
|
||||
extra_binds:
|
||||
- "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins"
|
||||
|
||||
network:
|
||||
plugin: flannel
|
||||
options:
|
||||
|
||||
# At the moment, the only authentication strategy supported is x509.
|
||||
# Currently, only authentication strategy supported is x509.
|
||||
# You can optionally create additional SANs (hostnames or IPs) to add to
|
||||
# the API server PKI certificate. This is useful if you want to use a load balancer
|
||||
# for the control plane servers, for example.
|
||||
# the API server PKI certificate.
|
||||
# This is useful if you want to use a load balancer for the control plane servers.
|
||||
authentication:
|
||||
strategy: x509
|
||||
sans:
|
||||
- "10.18.160.10"
|
||||
- "my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com"
|
||||
|
||||
# All addon manifests MUST specify a namespace
|
||||
# Kubernetes Authorization mode
|
||||
# Use `mode: rbac` to enable RBAC
|
||||
# Use `mode: none` to disable authorization
|
||||
authorization:
|
||||
mode: rbac
|
||||
|
||||
# If you want to set a Kubernetes cloud provider, you specify the name and configuration
|
||||
cloud_provider:
|
||||
name: aws
|
||||
|
||||
# Add-ons are deployed using kubernetes jobs. RKE will give up on trying to get the job status after this timeout in seconds..
|
||||
addon_job_timeout: 30
|
||||
|
||||
# There are several network plug-ins that work, but we default to flannel
|
||||
network:
|
||||
plugin: flannel
|
||||
|
||||
# Currently only nginx ingress provider is supported.
|
||||
# To disable ingress controller, set `provider: none`
|
||||
|
||||
ingress:
|
||||
provider: nginx
|
||||
|
||||
# All add-on manifests MUST specify a namespace
|
||||
addons: |-
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -125,87 +203,3 @@ addons_include:
|
||||
- https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-operator.yaml
|
||||
- https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-cluster.yaml
|
||||
- /path/to/manifest
|
||||
|
||||
system_images:
|
||||
etcd: rancher/etcd:v3.0.17
|
||||
kubernetes: rancher/hyperkube:v1.10.1
|
||||
alpine: rancher/rke-tools:v0.1.4
|
||||
nginx_proxy: rancher/rke-tools:v0.1.4
|
||||
cert_downloader: rancher/rke-tools:v0.1.4
|
||||
kubernetes_services_sidecar: rancher/rke-tools:v0.1.4
|
||||
kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.5
|
||||
dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.5
|
||||
kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.5
|
||||
kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0
|
||||
flannel: rancher/coreos-flannel:v0.9.1
|
||||
flannel_cni: rancher/coreos-flannel-cni:v0.2.0
|
||||
|
||||
# Global SSH private key
|
||||
ssh_key_path: ~/.ssh/test
|
||||
|
||||
# Enable use of SSH agent to use SSH private keys with passphrase
|
||||
# This requires the environment `SSH_AUTH_SOCK` configured pointing to your SSH agent which has the private key added
|
||||
ssh_agent_auth: true
|
||||
|
||||
# Kubernetes authorization mode
|
||||
# Use `mode: rbac` to enable RBAC
|
||||
# Use `mode: none` to disable authorization
|
||||
authorization:
|
||||
mode: rbac
|
||||
|
||||
# If set to true, rke won't fail when unsupported Docker version is found
|
||||
ignore_docker_version: false
|
||||
# The kubernetes version used. For now, this should match the version defined in rancher/types defaults map: https://github.com/rancher/types/blob/master/apis/management.cattle.io/v3/k8s_defaults.go#L14
|
||||
kubernetes_version: v1.10.1-rancher1
|
||||
|
||||
# add-ons are deployed using kubernetes jobs. RKE will give up on trying to get the job status after this timeout in seconds..
|
||||
addon_job_timeout: 30
|
||||
# If set, this is the cluster name that will be used in the kube config file
|
||||
# Default value is "local"
|
||||
cluster_name: mycluster
|
||||
|
||||
# List of registry credentials, if you are using a Docker Hub registry,
|
||||
# you can omit the `url` or set it to `docker.io`
|
||||
private_registries:
|
||||
- url: registry.com
|
||||
user: Username
|
||||
password: password
|
||||
|
||||
# Currently only nginx ingress provider is supported.
|
||||
# To disable ingress controller, set `provider: none`
|
||||
# To enable ingress on specific nodes, use the node_selector, eg:
|
||||
# nodes:
|
||||
# - address: example.com
|
||||
# user: ubuntu
|
||||
# role:
|
||||
# - role
|
||||
# hostname_override: node3
|
||||
# internal_address: 192.168.1.6
|
||||
# labels:
|
||||
# app: ingress
|
||||
#
|
||||
# ingress:
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
# extra_args:
|
||||
# enable-ssl-passthrough: ""
|
||||
|
||||
ingress:
|
||||
provider: nginx
|
||||
|
||||
cloud_provider:
|
||||
name: aws
|
||||
|
||||
# Bastion/Jump host configuration
|
||||
bastion_host:
|
||||
address: x.x.x.x
|
||||
user: ubuntu
|
||||
port: 22
|
||||
ssh_key_path: /home/user/.ssh/bastion_rsa
|
||||
# or
|
||||
# ssh_key: |-
|
||||
# -----BEGIN RSA PRIVATE KEY-----
|
||||
#
|
||||
# -----END RSA PRIVATE KEY-----
|
||||
```
|
||||
|
||||
@@ -62,7 +62,7 @@ For each node, you specify the `user` to be used when connecting to this node. T
|
||||
|
||||
### SSH Key Path
|
||||
|
||||
For each node, you specify the path, i.e. `ssh_key_path`, for the SSH private key to be used when connecting to this node.
|
||||
For each node, you specify the path, i.e. `ssh_key_path`, for the SSH private key to be used when connecting to this node. The default key path for each node is `~/.ssh/id_rsa`.
|
||||
|
||||
> **Note:** If you have a private key that can be used across all nodes, you can set the [SSH key path at the cluster level]({{< baseurl >}}/rke/v0.1.x/en/config-options/#cluster-level-ssh-key-path). The SSH key path set in each node will always take precedence.
|
||||
|
||||
|
||||
@@ -16,6 +16,8 @@ private_registries:
|
||||
password: mypassword
|
||||
```
|
||||
|
||||
> **Note:** If you are using a Docker Hub registry, you can omit the `url` or set it to `docker.io`.
|
||||
|
||||
### Air-gapped Setups
|
||||
|
||||
If you are in an air-gapped setup, you will need to not only configure your private registry credentials, but you will need to also update all your [system images]({{< baseurl >}}/rke/v0.1.x/en/config-options/system-images/) so they are going to pull from the private registry. By default, these system images are pulling from `docker.io`.
|
||||
|
||||
@@ -24,6 +24,7 @@ The [Kubernetes API](https://kubernetes.io/docs/reference/command-line-tools-ref
|
||||
services:
|
||||
kube-api:
|
||||
# IP range for any services created on Kubernetes
|
||||
# This must match the service_cluster_ip_range in kube-controller
|
||||
service_cluster_ip_range: 10.43.0.0/16
|
||||
# Expose a different port range for NodePort services
|
||||
service_node_port_range: 30000-32767
|
||||
@@ -51,7 +52,8 @@ services:
|
||||
kube-controller:
|
||||
# CIDR pool used to assign IP addresses to pods in the cluster
|
||||
cluster_cidr: 10.42.0.0/16
|
||||
#
|
||||
# IP range for any services created on Kubernetes
|
||||
# This must match the service_cluster_ip_range in kube-api
|
||||
service_cluster_ip_range: 10.43.0.0/16
|
||||
```
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
|
||||
- OpenSSH 7.0+ must be installed on each node for stream local forwarding to work
|
||||
- The SSH user used for node access must be a member of the `docker` group on the node:
|
||||
|
||||
```bash
|
||||
```
|
||||
usermod -aG docker <user_name>
|
||||
```
|
||||
|
||||
@@ -73,7 +73,7 @@ Docker Version | Install Script |
|
||||
|
||||
Confirm that a Kubernetes supported version of Docker is installed on your machine, by running `docker version`.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ docker version
|
||||
Client:
|
||||
Version: 17.03.2-ce
|
||||
@@ -97,9 +97,12 @@ Server:
|
||||
|
||||
In order for the Kubernetes cluster to be deployed, port `TCP/6443` needs to be opened to the machine. If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the machine you are going to use in the cluster.
|
||||
|
||||
|
||||
If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the machine you are going to use in the cluster.
|
||||
|
||||
#### Opening port TCP/6443 using `iptables``
|
||||
|
||||
```bash
|
||||
```
|
||||
# Open TCP/6443 for all
|
||||
iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
|
||||
|
||||
@@ -109,7 +112,7 @@ iptables -A INPUT -p tcp -s your_ip_here --dport 6443 -j ACCEPT
|
||||
|
||||
#### Opening port TCP/6443 using `firewalld`
|
||||
|
||||
```bash
|
||||
```
|
||||
# Open TCP/6443 for all
|
||||
firewall-cmd --zone=public --add-port=6443/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
@@ -136,7 +139,7 @@ There are two easy ways to create a `cluster.yml`:
|
||||
RKE provides the command `rke config` to generate a cluster configuration template or to interactivity generate a working cluster configuration file. Review [our cluster configuration options]({{< baseurl >}}/rke/v0.1.x/en/config-options/) to understand what each question means.
|
||||
|
||||
#### Creating a Basic `cluster.yml`
|
||||
```bash
|
||||
```
|
||||
$ rke config --name cluster.yml
|
||||
```
|
||||
|
||||
@@ -146,7 +149,7 @@ After answering the list of questions, there is a `cluster.yml` created in the d
|
||||
|
||||
If you want an empty `cluster.yml` template, you can use the `--empty` flag so that a template is produced, but there are no values in the template.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke config --empty --name cluster.yml
|
||||
```
|
||||
|
||||
@@ -154,7 +157,7 @@ $ rke config --empty --name cluster.yml
|
||||
|
||||
Instead of creating a file, you can print the generated configuration to stdout using the `--print` flag.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke config --print
|
||||
```
|
||||
|
||||
@@ -162,7 +165,7 @@ $ rke config --print
|
||||
|
||||
RKE is HA ready, you can specify more than one `controlplane` node in the `cluster.yml` file. RKE will deploy master components on all of these nodes and the kubelets are configured to connect to `127.0.0.1:6443` by default which is the address of `nginx-proxy` service that proxy requests to all master nodes.
|
||||
|
||||
To create an HA cluster, specify more than one host with role `controlplane`.
|
||||
To create an HA cluster, specify more than one host with role `controlplane`.
|
||||
|
||||
## Deploying Kubernetes with RKE
|
||||
|
||||
@@ -177,7 +180,7 @@ $ ./rke_linux-amd64 up
|
||||
|
||||
There will be log statements as the Kubernetes cluster is created.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ ./rke_darwin-amd64 up
|
||||
INFO[0000] Building Kubernetes cluster
|
||||
INFO[0000] [dialer] Setup tunnel for host [10.0.0.1]
|
||||
@@ -193,7 +196,7 @@ The last line should read `Finished building Kubernetes cluster successfully` to
|
||||
|
||||
In order to start interacting with your Kubernetes cluster, you will use a different binary called `kubectl`. You will need to [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local machine. You can connect to the RKE created cluster by using the `kube_config_cluster.yml` that was generated when you deployed Kubernetes.
|
||||
|
||||
```bash
|
||||
```
|
||||
# Confirm that kubectl is working by checking the version of your Kubernetes cluster
|
||||
$ kubectl --kubeconfig kube_config_cluster.yml version
|
||||
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0", GitCommit:"fc32d2f3698e36b93322a3465f63a14e9f0eaead", GitTreeState:"clean", BuildDate:"2018-03-27T00:13:02Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"darwin/amd64"}
|
||||
@@ -202,7 +205,7 @@ Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.9-rancher1"
|
||||
|
||||
The client and server version are reported, indicating that you have a local `kubectl` client and are able to request the server version from the newly built cluster. Now, you can issue any command to your cluster, like requesting the nodes that are in the cluster.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ kubectl --kubeconfig kube_config_cluster.yml get nodes
|
||||
NAME STATUS ROLES AGE VERSION
|
||||
10.0.0.1 Ready controlplane,etcd,worker 35m v1.10.3-rancher1
|
||||
|
||||
@@ -10,7 +10,7 @@ As of v0.1.7, you can configure a RKE cluster to automatically take snapshots of
|
||||
|
||||
RKE can take a one-time snapshot of a running etcd node in a RKE cluster. The snapshot is automatically saved in `/opt/rke/etcd-snapshots`.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke etcd snapshot-save --config cluster.yml
|
||||
|
||||
WARN[0000] Name of the snapshot is not specified using [rke_etcd_snapshot_2018-05-17T23:32:08+02:00]
|
||||
@@ -79,7 +79,7 @@ If there is a disaster with your Kubernetes cluster, you can use `rke etcd snaps
|
||||
|
||||
>**Warning:** Restoring an etcd snapshot deletes your current etcd cluster and replaces it with a new one. Before you run the `rke etcd snapshot-restore` command, you should back up any important data in your cluster.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke etcd snapshot-restore --name mysnapshot --config cluster.yml
|
||||
INFO[0000] Starting restore on etcd hosts
|
||||
INFO[0000] [dialer] Setup tunnel for host [x.x.x.x]
|
||||
@@ -133,17 +133,17 @@ In this example, the Kubernetes cluster was deployed on two AWS nodes.
|
||||
|
||||
Take a snapshot of the Kubernetes cluster.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke etcd snapshot-save --name snapshot.db --config cluster.yml
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
### Store the snapshot externally
|
||||
|
||||
After taking the etcd snapshot on `node2`, we recommend saving this backup in a persistence place. One of the options is to save the backup on a S3 bucket or tape backup.
|
||||
|
||||
```bash
|
||||
```
|
||||
# If you're using an AWS host and have the ability to connect to S3
|
||||
root@node2:~# s3cmd mb s3://rke-etcd-backup
|
||||
root@node2:~# s3cmd /opt/rke/etcdbackup/snapshot.db s3://rke-etcd-backup/
|
||||
@@ -153,7 +153,7 @@ root@node2:~# s3cmd /opt/rke/etcdbackup/snapshot.db s3://rke-etcd-backup/
|
||||
|
||||
To simulate the failure, let's power down `node2`.
|
||||
|
||||
```bash
|
||||
```
|
||||
root@node2:~# poweroff
|
||||
```
|
||||
|
||||
@@ -167,7 +167,7 @@ Before restoring etcd and running `rancher up`, we need to retrieve the backup s
|
||||
| node3 | 10.0.0.3 | [etcd] |
|
||||
| | | |
|
||||
|
||||
```bash
|
||||
```
|
||||
# Make a Directory
|
||||
root@node3:~# mkdir -p /opt/rke/etcdbackup
|
||||
$ Get the Backup from S3
|
||||
@@ -178,37 +178,41 @@ root@node3:~# s3cmd get s3://rke-etcd-backup/snapshot.db /opt/rke/etcdbackup/sna
|
||||
|
||||
Before updating and restoring etcd, you will need to add the new node into the Kubernetes cluster with the `etcd` role. In the `cluster.yml`, comment out the old node and add in the new node. `
|
||||
|
||||
```
|
||||
```yaml
|
||||
nodes:
|
||||
- address: 10.0.0.1
|
||||
hostname_override: node1
|
||||
user: ubuntu
|
||||
role: [controlplane,worker]
|
||||
# - address: 10.0.0.2
|
||||
# hostname_override: node2
|
||||
# user: ubuntu
|
||||
# role: [etcd]
|
||||
- address: 10.0.0.3
|
||||
hostname_override: node3
|
||||
user: ubuntu
|
||||
role: [etcd]
|
||||
- address: 10.0.0.1
|
||||
hostname_override: node1
|
||||
user: ubuntu
|
||||
role:
|
||||
- controlplane
|
||||
- worker
|
||||
# - address: 10.0.0.2
|
||||
# hostname_override: node2
|
||||
# user: ubuntu
|
||||
# role:
|
||||
# - etcd
|
||||
- address: 10.0.0.3
|
||||
hostname_override: node3
|
||||
user: ubuntu
|
||||
role:
|
||||
- etcd
|
||||
```
|
||||
|
||||
After the new node is added to the `cluster.yml`, run `rke etcd snapshot-restore` to launch `etcd` from the backup. ]
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke etcd snapshot-restore --name snapshot.db --config cluster.yml
|
||||
```
|
||||
|
||||
Finally, we need to restore the operations on the cluster by making the Kubernetes API point to the new `etcd` by running `rke up` again using the new `cluster.yml`.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke up --config cluster.yml
|
||||
```
|
||||
|
||||
Confirm that your Kubernetes cluster is functional by checking the pods on your cluster.
|
||||
|
||||
```bash
|
||||
```
|
||||
> kubectl get pods
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
nginx-65899c769f-kcdpr 1/1 Running 0 17s
|
||||
|
||||
@@ -13,7 +13,7 @@ Add in notes of which OS are currently used-->
|
||||
- OpenSSH 7.0+ must be installed on each node for stream local forwarding to work
|
||||
- The SSH user used for node access must be a member of the `docker` group on the node:
|
||||
|
||||
```bash
|
||||
```
|
||||
usermod -aG docker <user_name>
|
||||
```
|
||||
|
||||
@@ -31,7 +31,7 @@ In RKE, most of the volumes are mounted with option `z`, but there are some cont
|
||||
|
||||
Before running RKE, users will need to run the following commands to make some additional directories:
|
||||
|
||||
```bash
|
||||
```
|
||||
# mkdir /opt/cni /etc/cni
|
||||
# chcon -Rt svirt_sandbox_file_t /etc/cni
|
||||
# chcon -Rt svirt_sandbox_file_t /opt/cni
|
||||
@@ -45,6 +45,6 @@ By default, Atomic hosts ship with OpenSSH 6.4, which doesn't support SSH tunnel
|
||||
|
||||
By default, Atomic hosts do not come with a Docker group. You can update the ownership of the Docker socket by enabling the specific user in order to launch RKE.
|
||||
|
||||
```bash
|
||||
```
|
||||
# chown <user> /var/run/docker.sock
|
||||
```
|
||||
|
||||
@@ -28,7 +28,7 @@ system-images:
|
||||
|
||||
After updating your `cluster.yml` with the required changes, all you need to do is run `rke up` to upgrade Kubernetes.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ rke up --config cluster.yml
|
||||
```
|
||||
|
||||
|
||||
@@ -59,7 +59,7 @@ Docker Version | Install Script |
|
||||
|
||||
Confirm that a Kubernetes supported version of Docker is installed on your machine, by running `docker version`.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ docker version
|
||||
Client:
|
||||
Version: 17.03.2-ce
|
||||
@@ -81,32 +81,11 @@ Server:
|
||||
|
||||
### Port Requirements
|
||||
|
||||
In order for the Kubernetes cluster to be deployed, port `TCP/6443` needs to be opened to the machine. If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the machine you are going to use in the cluster.
|
||||
In order for the Kubernetes cluster to be deployed, the follow ports need to be opened to allow the cluster nodes communicate with each other:
|
||||
|
||||
#### Opening port TCP/6443 using `iptables``
|
||||
- Ports 6443, 2379, and 2380
|
||||
|
||||
```bash
|
||||
# Open TCP/6443 for all
|
||||
iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
|
||||
|
||||
# Open TCP/6443 for one specific IP
|
||||
iptables -A INPUT -p tcp -s your_ip_here --dport 6443 -j ACCEPT
|
||||
```
|
||||
|
||||
#### Opening port TCP/6443 using `firewalld`
|
||||
|
||||
```bash
|
||||
# Open TCP/6443 for all
|
||||
firewall-cmd --zone=public --add-port=6443/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
# Open TCP/6443 for one specific IP
|
||||
firewall-cmd --permanent --zone=public --add-rich-rule='
|
||||
rule family="ipv4"
|
||||
source address="your_ip_here/32"
|
||||
port protocol="tcp" port="6443" accept'
|
||||
firewall-cmd --reload
|
||||
```
|
||||
If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the machine you are going to use in the cluster.
|
||||
|
||||
## Creating the Cluster Configuration File
|
||||
|
||||
@@ -123,7 +102,7 @@ To create a new `cluster.yml`, you can run `rke config` and this command will qu
|
||||
|
||||
> **Note:** As features are added into RKE, the list and order of questions may change.
|
||||
|
||||
```bash
|
||||
```
|
||||
./rke_darwin-amd64 config
|
||||
|
||||
# This example is using one host
|
||||
@@ -157,7 +136,7 @@ $ ./rke_linux-amd64 up
|
||||
|
||||
There will be log statements as the Kubernetes cluster is created.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ ./rke_darwin-amd64 up
|
||||
INFO[0000] Building Kubernetes cluster
|
||||
INFO[0000] [dialer] Setup tunnel for host [10.0.0.1]
|
||||
@@ -173,7 +152,7 @@ The last line should read `Finished building Kubernetes cluster successfully` to
|
||||
|
||||
In order to start interacting with your Kubernetes cluster, you will use a different binary called `kubectl`. You will need to [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local machine. You can connect to the RKE created cluster by using the `kube_config_cluster.yml` that was generated when you deployed Kubernetes.
|
||||
|
||||
```bash
|
||||
```
|
||||
# Confirm that kubectl is working by checking the version of your Kubernetes cluster
|
||||
$ kubectl --kubeconfig kube_config_cluster.yml version
|
||||
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.0", GitCommit:"fc32d2f3698e36b93322a3465f63a14e9f0eaead", GitTreeState:"clean", BuildDate:"2018-03-27T00:13:02Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"darwin/amd64"}
|
||||
@@ -182,7 +161,7 @@ Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.9-rancher1"
|
||||
|
||||
The client and server version are reported, indicating that you have a local `kubectl` client and are able to request the server version from the newly built cluster. Now, you can issue any command to your cluster, like requesting the nodes that are in the cluster.
|
||||
|
||||
```bash
|
||||
```
|
||||
$ kubectl --kubeconfig kube_config_cluster.yml get nodes
|
||||
NAME STATUS ROLES AGE VERSION
|
||||
10.0.0.1 Ready controlplane,etcd,worker 35m v1.10.3-rancher1
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 192 KiB |
Reference in New Issue
Block a user