mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 04:58:07 +00:00
Improvements for creating EC2 clusters
This commit is contained in:
Sebastiaan van Steenis
committed by
Denise
Denise
parent
1f1f6b6244
commit
df21a40a45
+124
-9
@@ -11,18 +11,133 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2.
|
||||
1. Choose **Amazon EC2**.
|
||||
1. Enter a **Cluster Name**.
|
||||
1. {{< step_create-cluster_member-roles >}}
|
||||
1. {{< step_create-cluster_cluster-options >}}
|
||||
1. {{< step_create-cluster_cluster-options >}}Refer to <a href="/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/" target="_blank">Selecting Cloud Providers</a> to configure the Kubernetes Cloud Provider.</p></div>
|
||||
1. {{< step_create-cluster_node-pools >}}
|
||||
1. Click **Add Node Template**.
|
||||
1. Click **Add Node Template**.
|
||||
|
||||
|
||||
Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2).
|
||||
- **Account Access** holds the region and API Key used to create the cluster.
|
||||
[Amazon Documentation: Creating Access Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey)
|
||||
- **Zone and Network** configures the availability zone and network settings for your cluster.
|
||||
- **Security Groups** configures the security groups applied to your cluster.
|
||||
- **Instance** provisions your VM instances.
|
||||
|
||||
* **Account Access** is there you configure the region of the nodes, and the credentials (Access Key and Secret Key) used to create the machine.
|
||||
|
||||
[Amazon Documentation: Creating Access Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey).
|
||||
|
||||
See [Example Node IAM policy](#example-node-iam-policy) for an example policy that can be applied to these credentials.
|
||||
- **Zone and Network** configures the availability zone and network settings for your cluster.
|
||||
- **Security Groups** creates or configures the security groups applied to your nodes.
|
||||
- **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
|
||||
|
||||
If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example Node IAM policy with PassRole](#example-node-iam-policy-with-passrole) for an example policy.
|
||||
|
||||
1. {{< step_rancher-template >}}
|
||||
1. Click **Create**.
|
||||
1. Click **Create**.
|
||||
1. **Optional:** Add additional node pools.
|
||||
1. Review your cluster settings to confirm they're correct. Then click **Create**.
|
||||
1. Review your cluster settings to confirm they are correct. Then click **Create**.
|
||||
|
||||
{{< result_create-cluster >}}
|
||||
|
||||
### Example Node IAM Policy
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "VisualEditor0",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:AuthorizeSecurityGroupIngress",
|
||||
"ec2:Describe*",
|
||||
"ec2:ImportKeyPair",
|
||||
"ec2:CreateKeyPair",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:CreateTags",
|
||||
"ec2:DeleteKeyPair"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "VisualEditor1",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:RunInstances"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:ec2:REGION::image/ami-*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "VisualEditor2",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:RebootInstances",
|
||||
"ec2:TerminateInstances",
|
||||
"ec2:StartInstances",
|
||||
"ec2:StopInstances"
|
||||
],
|
||||
"Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Example Node IAM Policy with PassRole
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "VisualEditor0",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:AuthorizeSecurityGroupIngress",
|
||||
"ec2:Describe*",
|
||||
"ec2:ImportKeyPair",
|
||||
"ec2:CreateKeyPair",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:CreateTags",
|
||||
"ec2:DeleteKeyPair"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "VisualEditor1",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:PassRole",
|
||||
"ec2:RunInstances"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:ec2:REGION::image/ami-*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
|
||||
"arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*",
|
||||
"arn:aws:iam::AWS_ACCOUNT_ID:role/your-role-name"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "VisualEditor2",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:RebootInstances",
|
||||
"ec2:TerminateInstances",
|
||||
"ec2:StartInstances",
|
||||
"ec2:StopInstances"
|
||||
],
|
||||
"Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
@@ -1 +1 @@
|
||||
<div><p>Use <strong>Cluster Options</strong> to choose the version of Kubernetes installed on each cluster node, along with some other options for you cluster.</p></div>
|
||||
<div><p>Use <strong>Cluster Options</strong> to choose the version of Kubernetes, what network provider will be used, if you want to enable Pod Security Policies and wether the nodes added to this cluster need to have a supported Docker version installed.
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
<p>Add one or more <strong>Node Pools</strong> to your cluster. A <em>node pool</em> is a set of virtual machines configured identically to your Linux host. However, each node in the pool also has additional Kubernetes master and worker components installed.<p>
|
||||
<p>Add one or more <strong>Node Pools</strong> to your cluster.<br/><br/>A <strong>Node Pool</strong> is a collection of nodes based on a Node Template. A Node Template defines the configuration of a Node, like what Operating System image, number of CPUs and amount of RAM. Each Node Pool can have one or more Nodes Roles associated with it.</p>
|
||||
|
||||
<blockquote>
|
||||
<p><strong>Notes:</strong></p>
|
||||
<ul>
|
||||
<li>After you create each node template, you can use it to create additional node pools.</li>
|
||||
<li>Each Kubernetes role (i.e. <code>etcd</code>, <code>Control</code>, and <code>Worker</code>) must be filled. You can either apply all three roles to one pool or spread them around.</li>
|
||||
<li>Ideally, you should have at least three <code>etcd</code> nodes so that your cluster can fail over to another if a etcd node goes down.</li>
|
||||
<li>After you create a Node Template, it will be saved and you will be able to re-use it in additional Node Pools.</li>
|
||||
<li>Each Node Role (i.e. <code>etcd</code>, <code>Control Plane</code>, and <code>Worker</code>) must be fulfilled. Although it is possible to apply multiple Node Roles to a Node Pool, this is not recommended.</li>
|
||||
<li>The recommended setup is to have a Node Pool with the <code>etcd</code> Node Role and a count of three, a Node Pool with the <code>Control Plane</code> Node Role and a count of at least two, and a Node Pool with the <code>Worker</code> Node Role and a count of at least two. Regarding the <code>etcd</code> Node Role, refer to the <a href="https://coreos.com/etcd/docs/latest/v2/admin_guide.html#optimal-cluster-size" target="_blank">etcd Admin Guide</a>.</li>
|
||||
</ul>
|
||||
</blockquote>
|
||||
|
||||
@@ -1,13 +1,18 @@
|
||||
<p>Complete the <strong>Rancher Template</strong> form to add metadata so that you can find your template in Rancher later.</p>
|
||||
<p>Complete the <strong>Rancher Template</strong> form to configure the Docker daemon on the instances that will be created.</p>
|
||||
<ul>
|
||||
<li>
|
||||
<p><strong>Labels</strong> apply metadata to your Docker objects.</p>
|
||||
<p><strong>Labels</strong> can be configured on the Docker daemon.</p>
|
||||
|
||||
<p><a href="https://docs.docker.com/config/labels-custom-metadata/">Docker object label documentation</a></p>
|
||||
</li>
|
||||
<li>
|
||||
<!-- TODO: Improve the engine options -->
|
||||
<p><strong>Engine Options</strong> customize the configuration of the <a href="https://docs.docker.com/engine/docker-overview/#the-docker-daemon">Docker daemon</a>.</p>
|
||||
<p><strong>Engine Options</strong> customize the configuration of the <a href="https://docs.docker.com/engine/docker-overview/#the-docker-daemon">Docker daemon</a>. Important configuration options might include:
|
||||
<ul>
|
||||
<li><strong>Docker Engine Install URL:</strong> Determines what Docker version will be installed on the instance.</li>
|
||||
<li><strong>Registry mirrors:</strong> Docker Registry mirror to be used by the Docker daemon</li>
|
||||
</ul>
|
||||
</p>
|
||||
|
||||
<p><a href="https://docs.docker.com/engine/reference/commandline/dockerd/">daemon option reference</a></p>
|
||||
</li>
|
||||
|
||||
Reference in New Issue
Block a user