cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
##Deploy a production ready kubernetes cluster
If you have questions, join us on the kubernetes slack, channel #kargo.
- Can be deployed on AWS, GCE, Azure, OpenStack or Baremetal
- High available cluster
- Composable (Choice of the network plugin for instance)
- Support most popular Linux distributions
- Continuous integration tests
To deploy the cluster you can use :
kargo-cli
Ansible usual commands and inventory builder
vagrant by simply running vagrant up (for tests purposes)
- Requirements
- Kargo vs ...
- Getting started
- Ansible inventory and tags
- Deployment data variables
- DNS stack
- HA mode
- Network plugins
- Vagrant install
- CoreOS bootstrap
- Downloaded artifacts
- Cloud providers
- OpenStack
- AWS
- Azure
- Large deployments
- Upgrades basics
- Roadmap
Supported Linux distributions
- Container Linux by CoreOS
- Debian Jessie
- Ubuntu 16.04
- CentOS/RHEL 7
Note: Upstart/SysV init based OS types are not supported.
Versions of supported components
kubernetes v1.5.1
etcd v3.0.6
flanneld v0.6.2
calicoctl v0.23.0
canal (given calico/flannel versions)
weave v1.6.1
docker v1.12.5
rkt v1.21.0
Note: rkt support as docker alternative is limited to control plane (etcd and kubelet). Docker is still used for Kubernetes cluster workloads and network plugins' related OS services. Also note, only one of the supported network plugins can be deployed for a given single cluster.
Requirements
- The target servers must have access to the Internet in order to pull docker images.
- The firewalls are not managed, you'll need to implement your own rules the way you used to. in order to avoid any issue during deployment you should disable your firewall.
- The target servers are configured to allow IPv4 forwarding.
- Copy your ssh keys to all the servers part of your inventory.
- Ansible v2.2 (or newer) and python-netaddr
Network plugins
You can choose between 4 network plugins. (default: flannel with vxlan backend)
-
flannel: gre/vxlan (layer 2) networking.
-
calico: bgp (layer 3) networking.
-
canal: a composition of calico and flannel plugins.
-
weave: Weave is a lightweight container overlay network that doesn't require an external K/V database cluster.
(Please refer toweavetroubleshooting documentation).
The choice is defined with the variable kube_network_plugin. There is also an
option to leverage built-in cloud provider networking instead.
See also Network checker.
CI Tests
CI/end-to-end tests sponsored by Google (GCE), and teuto.net for OpenStack. See the test matrix for details.