From 8672a11c3b0f477fb68a0ae2f74d1a2a1cabaa12 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Fri, 24 May 2019 18:12:45 -0500 Subject: [PATCH] Add wek8s basic info + show how to connect --- slides/wek8s/connecting.md | 205 +++++++++++++++++++++++++++++++++++++ slides/wek8s/visibility.md | 15 +++ slides/wwrk.yml | 1 + 3 files changed, 221 insertions(+) create mode 100644 slides/wek8s/connecting.md create mode 100644 slides/wek8s/visibility.md diff --git a/slides/wek8s/connecting.md b/slides/wek8s/connecting.md new file mode 100644 index 00000000..7c423df1 --- /dev/null +++ b/slides/wek8s/connecting.md @@ -0,0 +1,205 @@ +## Connecting to wek8s + +- Let's see what it entails to connect to one of our wek8s clusters + +- We need an account on https://we.okta.com/ + + (with access to "Dev AWS" environment) + +- We need an account on https://quay.io/ + + (with access to images + [wework/okta-aws](https://quay.io/repository/wework/okta-aws) + and + [wework/wek8s-tools](https://quay.io/repository/wework/wek8s-tools)) + +- We will obtain AWS credentials through Okta + +- Then, we will use these AWS credentials to obtain Kubernetes credentials + + (because the wek8s cluster we will connect to is using AWS EKS under the hood) + +.warning[These instructions are up-to-date as of May 2019, but may change in the future.] + +--- + +## Obtaining AWS credentials + +- We will use okta-aws to obtain our AWS credentials + +- For convenience, we will use a pre-built okta-aws container + +.warning[If we already have credentials in `~/.aws`, this may overwrite them!] + +.exercise[ + +- Run okta-aws to obtain AWS credentials and store them in `~/.aws`: + ```bash + docker run -it --rm -v ~/.aws:/package/.aws quay.io/wework/okta-aws + ``` + +- Select `Dev` environment at the first prompt + +- Enter Okta email, password, and MFA code + +] + +--- + +## Verifying account and role + +The last lines of output of okta-aws will confirm which account we logged into. + +For the `Dev` account, this should look like this: + +``` +Account: 681484253316 +Role: AWS-Admin +Profile: saml +``` + +... And a few files have been updated in `~/.aws`, including `~/.aws/credentials`. + +Q: How did the container update `~/.aws` on our machine? + +A: Because we mounted that directory into the container with `-v`. + +--- + +## Running wek8s-tools + +- Two more steps are necessary to obtain Kubernetes cluster credentials + +- For simplicity, we are going to use a "Swiss Army Knife" image, wek8s-tools + +- This image contains tools to obtain the Kubernetes credentials + many others + + (including kubectl, helm, ...) + +.exercise[ + +- Start a container using the the wek8s-tools image: + ```bash + docker run --rm -v ~/.aws:/root/.aws -it quay.io/wework/wek8s-tools:0.3.2 sh + ``` + +] + +*We are using the `-v` option again, to mount our fresh AWS credentials into this container.* + +--- + +## Generating kubeconfig + +- The next step is to generate a kubeconfig file with: + + - the address of the wek8s cluster we want to use + + - instructions to use the AWS IAM authenticator plugin + +- This is done with the `deploy_helper` binary + +.exercise[ + +- Generate the kubeconfig file: + ```bash + deploy_helper fetch_reqs --env wek8s-phoenix --namespace k8s-training + ``` + +] + +We now have a `~kube/config` file (in the container). + +--- + +## Using the cluster + +- Let's get a shell on this cluster! + +.exercise[ + +- Run a one-time Pod with an Alpine container: + ```bash + kubectl -n k8s-training run --restart=Never --rm -it test-$RANDOM --image=alpine + ``` + +- Find out the node's IP address: + ```bash + apk add curl + curl https://canihazip.com/s + ``` + +- Exit when done + +] + +--- + +## Using local tools + +.warning[Do not run the commands in this slide! This is not an exercise ☺] + +- What if we wanted to use our local tools, instead of the wek8s-tools image? + +- First, we would need to install the AWS IAM authenticator plugin + + (see [AWS EKS documentation](https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html) for instructions) + +- Then, we would need to get the kubeconfig file: + ```bash + docker run --rm -v ~/.aws:/root/.aws -v ~/.kube-wek8s:/root/.kube \ + quay.io/wework/wek8s-tools:0.3.2 \ + deploy_helper fetch_reqs --env wek8s-phoenix --namespace k8s-training + ``` + +- This would generate the file `~/.kube-wek8s/config` + +--- + +## Permission issues + +.warning[Do not run the commands in this slide! This is not an exercise ☺] + +- If you use Docker Desktop (on Windows or macOS), you should be set + +- Otherwise (on Linux or Docker Toolbox) you will need to fix permissions: + ```bash + chown -R $USER ~/.kube-wek8s + ``` + +--- + +## Connecting to wek8s with local tools + +.warning[Do not run the commands in this slide! This is not an exercise ☺] + +- We would need to tell kubectl (and other tools) to use the file we generated: + ```bash + export KUBECONFIG=~/.kube-wek8s/config + ``` + +- Then we could do some simple commands to test the connection: + ```bash + kubectl get version + kubectl get svc -n default kubernetes + ``` + +--- + +## Deploying DockerCoins on wek8s + +.warning[Do not run the commands in this slide! This is not an exercise ☺] + +- We could deploy DockerCoins like this: + ```bash + git clone https://github.com/jpetazzo/kubercoins + kubectl -n k8s-training apply -f kubercoins + ``` + +- To access the web UI, we would need an Ingress + + (more on that later) + +- Rather than applying YAML directly, we would use Helm Charts + + (more on that later) diff --git a/slides/wek8s/visibility.md b/slides/wek8s/visibility.md new file mode 100644 index 00000000..ad1346d8 --- /dev/null +++ b/slides/wek8s/visibility.md @@ -0,0 +1,15 @@ +## Differences with wek8s + +- We have `cluster-admin` (=`root`) privileges on our clusters + + (we can read/write everything) + +- This is typical when working on "personal" clusters + + (used by a single person, or a very small team) + +- But *not* when working on production clusters + +- On wek8s clusters, we can't access most *global* resources + + (resources that don't belong to namespaces; e.g. nodes) diff --git a/slides/wwrk.yml b/slides/wwrk.yml index 571a756f..56136854 100644 --- a/slides/wwrk.yml +++ b/slides/wwrk.yml @@ -94,6 +94,7 @@ chapters: - k8s/daemonset.md - k8s/rollout.md - k8s/setup-k8s.md + - wek8s/connecting.md - k8s/logs-cli.md - k8s/prometheus.md - k8s/localkubeconfig.md