From ffdd7fda45a19cab59ecb1b6c01fc7950570a4a4 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 27 Aug 2018 07:04:01 -0500 Subject: [PATCH] Add YAML to repo; remove goo.gl links We load a few YAML files from goo.gl links. To avoid bad surprises, we're moving these YAML files to the repository. --- k8s/efk.yaml | 222 ++++++++++++++++++++++++++++++ k8s/grant-admin-to-dashboard.yaml | 14 ++ k8s/kubernetes-dashboard.yaml | 167 ++++++++++++++++++++++ k8s/socat.yaml | 67 +++++++++ slides/k8s/dashboard.md | 16 +-- slides/k8s/logs-centralized.md | 4 +- 6 files changed, 476 insertions(+), 14 deletions(-) create mode 100644 k8s/efk.yaml create mode 100644 k8s/grant-admin-to-dashboard.yaml create mode 100644 k8s/kubernetes-dashboard.yaml create mode 100644 k8s/socat.yaml diff --git a/k8s/efk.yaml b/k8s/efk.yaml new file mode 100644 index 00000000..d2bcdbda --- /dev/null +++ b/k8s/efk.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fluentd + +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: fluentd +rules: +- apiGroups: + - "" + resources: + - pods + - namespaces + verbs: + - get + - list + - watch + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fluentd +roleRef: + kind: ClusterRole + name: fluentd + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: fluentd + namespace: default + +--- +apiVersion: extensions/v1beta1 +kind: DaemonSet +metadata: + name: fluentd + labels: + k8s-app: fluentd-logging + version: v1 + kubernetes.io/cluster-service: "true" +spec: + template: + metadata: + labels: + k8s-app: fluentd-logging + version: v1 + kubernetes.io/cluster-service: "true" + spec: + serviceAccount: fluentd + serviceAccountName: fluentd + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + containers: + - name: fluentd + image: fluent/fluentd-kubernetes-daemonset:elasticsearch + env: + - name: FLUENT_ELASTICSEARCH_HOST + value: "elasticsearch" + - name: FLUENT_ELASTICSEARCH_PORT + value: "9200" + - name: FLUENT_ELASTICSEARCH_SCHEME + value: "http" + # X-Pack Authentication + # ===================== + - name: FLUENT_ELASTICSEARCH_USER + value: "elastic" + - name: FLUENT_ELASTICSEARCH_PASSWORD + value: "changeme" + resources: + limits: + memory: 200Mi + requests: + cpu: 100m + memory: 200Mi + volumeMounts: + - name: varlog + mountPath: /var/log + - name: varlibdockercontainers + mountPath: /var/lib/docker/containers + readOnly: true + terminationGracePeriodSeconds: 30 + volumes: + - name: varlog + hostPath: + path: /var/log + - name: varlibdockercontainers + hostPath: + path: /var/lib/docker/containers + +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + deployment.kubernetes.io/revision: "1" + creationTimestamp: null + generation: 1 + labels: + run: elasticsearch + name: elasticsearch + selfLink: /apis/extensions/v1beta1/namespaces/default/deployments/elasticsearch +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + run: elasticsearch + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + run: elasticsearch + spec: + containers: + - image: elasticsearch:5.6.8 + imagePullPolicy: IfNotPresent + name: elasticsearch + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: null + labels: + run: elasticsearch + name: elasticsearch + selfLink: /api/v1/namespaces/default/services/elasticsearch +spec: + ports: + - port: 9200 + protocol: TCP + targetPort: 9200 + selector: + run: elasticsearch + sessionAffinity: None + type: ClusterIP + +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + deployment.kubernetes.io/revision: "1" + creationTimestamp: null + generation: 1 + labels: + run: kibana + name: kibana + selfLink: /apis/extensions/v1beta1/namespaces/default/deployments/kibana +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + run: kibana + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + run: kibana + spec: + containers: + - env: + - name: ELASTICSEARCH_URL + value: http://elasticsearch:9200/ + image: kibana:5.6.8 + imagePullPolicy: Always + name: kibana + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: null + labels: + run: kibana + name: kibana + selfLink: /api/v1/namespaces/default/services/kibana +spec: + externalTrafficPolicy: Cluster + ports: + - port: 5601 + protocol: TCP + targetPort: 5601 + selector: + run: kibana + sessionAffinity: None + type: NodePort diff --git a/k8s/grant-admin-to-dashboard.yaml b/k8s/grant-admin-to-dashboard.yaml new file mode 100644 index 00000000..59daae9e --- /dev/null +++ b/k8s/grant-admin-to-dashboard.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: kubernetes-dashboard + labels: + k8s-app: kubernetes-dashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: kubernetes-dashboard + namespace: kube-system \ No newline at end of file diff --git a/k8s/kubernetes-dashboard.yaml b/k8s/kubernetes-dashboard.yaml new file mode 100644 index 00000000..73fcc239 --- /dev/null +++ b/k8s/kubernetes-dashboard.yaml @@ -0,0 +1,167 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Configuration to deploy release version of the Dashboard UI compatible with +# Kubernetes 1.8. +# +# Example usage: kubectl create -f + +# ------------------- Dashboard Secret ------------------- # + +apiVersion: v1 +kind: Secret +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard-certs + namespace: kube-system +type: Opaque + +--- +# ------------------- Dashboard Service Account ------------------- # + +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: kube-system + +--- +# ------------------- Dashboard Role & Role Binding ------------------- # + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubernetes-dashboard-minimal + namespace: kube-system +rules: + # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] + # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] + # Allow Dashboard to get, update and delete Dashboard exclusive secrets. +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"] + verbs: ["get", "update", "delete"] + # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. +- apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["kubernetes-dashboard-settings"] + verbs: ["get", "update"] + # Allow Dashboard to get metrics from heapster. +- apiGroups: [""] + resources: ["services"] + resourceNames: ["heapster"] + verbs: ["proxy"] +- apiGroups: [""] + resources: ["services/proxy"] + resourceNames: ["heapster", "http:heapster:", "https:heapster:"] + verbs: ["get"] + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubernetes-dashboard-minimal + namespace: kube-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubernetes-dashboard-minimal +subjects: +- kind: ServiceAccount + name: kubernetes-dashboard + namespace: kube-system + +--- +# ------------------- Dashboard Deployment ------------------- # + +kind: Deployment +apiVersion: apps/v1beta2 +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: kube-system +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + k8s-app: kubernetes-dashboard + template: + metadata: + labels: + k8s-app: kubernetes-dashboard + spec: + containers: + - name: kubernetes-dashboard + image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 + ports: + - containerPort: 8443 + protocol: TCP + args: + - --auto-generate-certificates + # Uncomment the following line to manually specify Kubernetes API server Host + # If not specified, Dashboard will attempt to auto discover the API server and connect + # to it. Uncomment only if the default does not work. + # - --apiserver-host=http://my-address:port + volumeMounts: + - name: kubernetes-dashboard-certs + mountPath: /certs + # Create on-disk volume to store exec logs + - mountPath: /tmp + name: tmp-volume + livenessProbe: + httpGet: + scheme: HTTPS + path: / + port: 8443 + initialDelaySeconds: 30 + timeoutSeconds: 30 + volumes: + - name: kubernetes-dashboard-certs + secret: + secretName: kubernetes-dashboard-certs + - name: tmp-volume + emptyDir: {} + serviceAccountName: kubernetes-dashboard + # Comment the following tolerations if Dashboard must not be deployed on master + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + +--- +# ------------------- Dashboard Service ------------------- # + +kind: Service +apiVersion: v1 +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: kube-system +spec: + ports: + - port: 443 + targetPort: 8443 + selector: + k8s-app: kubernetes-dashboard diff --git a/k8s/socat.yaml b/k8s/socat.yaml new file mode 100644 index 00000000..5d4b2ca5 --- /dev/null +++ b/k8s/socat.yaml @@ -0,0 +1,67 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + deployment.kubernetes.io/revision: "2" + creationTimestamp: null + generation: 1 + labels: + run: socat + name: socat + namespace: kube-system + selfLink: /apis/extensions/v1beta1/namespaces/kube-system/deployments/socat +spec: + replicas: 1 + selector: + matchLabels: + run: socat + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + run: socat + spec: + containers: + - args: + - sh + - -c + - apk add --no-cache socat && socat TCP-LISTEN:80,fork,reuseaddr OPENSSL:kubernetes-dashboard:443,verify=0 + image: alpine + imagePullPolicy: Always + name: socat + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 +status: {} +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: null + labels: + run: socat + name: socat + namespace: kube-system + selfLink: /api/v1/namespaces/kube-system/services/socat +spec: + externalTrafficPolicy: Cluster + ports: + - port: 80 + protocol: TCP + targetPort: 80 + selector: + run: socat + sessionAffinity: None + type: NodePort +status: + loadBalancer: {} diff --git a/slides/k8s/dashboard.md b/slides/k8s/dashboard.md index 21cf314b..cdef44d2 100644 --- a/slides/k8s/dashboard.md +++ b/slides/k8s/dashboard.md @@ -32,15 +32,11 @@ There is an additional step to make the dashboard available from outside (we'll - Create all the dashboard resources, with the following command: ```bash - kubectl apply -f https://goo.gl/Qamqab + kubectl apply -f ~/container.training/k8s/kubernetes-dashboard.yaml ``` ] -The goo.gl URL expands to: -
-.small[https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml] - --- @@ -72,15 +68,11 @@ The goo.gl URL expands to: - Apply the convenient YAML file, and defeat SSL protection: ```bash - kubectl apply -f https://goo.gl/tA7GLz + kubectl apply -f ~/container.training/k8s/socat.yaml ``` ] -The goo.gl URL expands to: -
-.small[.small[https://gist.githubusercontent.com/jpetazzo/c53a28b5b7fdae88bc3c5f0945552c04/raw/da13ef1bdd38cc0e90b7a4074be8d6a0215e1a65/socat.yaml]] - .warning[All our dashboard traffic is now clear-text, including passwords!] --- @@ -135,7 +127,7 @@ The dashboard will then ask you which authentication you want to use. - Grant admin privileges to the dashboard so we can see our resources: ```bash - kubectl apply -f https://goo.gl/CHsLTA + kubectl apply -f ~/container.training/k8s/grant-admin-to-dashboard.yaml ``` - Reload the dashboard and enjoy! @@ -175,7 +167,7 @@ The dashboard will then ask you which authentication you want to use. ## Editing the `kubernetes-dashboard` service -- If we look at the [YAML](https://goo.gl/Qamqab) that we loaded before, we'll get a hint +- If we look at the [YAML](https://github.com/jpetazzo/container.training/blob/master/k8s/kubernetes-dashboard.yaml) that we loaded before, we'll get a hint -- diff --git a/slides/k8s/logs-centralized.md b/slides/k8s/logs-centralized.md index a707e0b9..6cdddda8 100644 --- a/slides/k8s/logs-centralized.md +++ b/slides/k8s/logs-centralized.md @@ -40,12 +40,12 @@ - Load the YAML file into our cluster: ```bash - kubectl apply -f https://goo.gl/MUZhE4 + kubectl apply -f ~/container.training/k8s/efk.yaml ``` ] -If we [look at the YAML file](https://goo.gl/MUZhE4), we see that +If we [look at the YAML file](https://github.com/jpetazzo/container.training/blob/master/k8s/efk.yaml), we see that it creates a daemon set, two deployments, two services, and a few roles and role bindings (to give fluentd the required permissions).