K8s_cmds

# untaint master nodes : 

#kubectl taint nodes $(hostname) node-role.kubernetes.io/master:NoSchedule- 

#[root@ip-192-168-10-30 pradeep]# kubectl taint nodes $(hostname) node-role.kubernetes.io/master:NoSchedule-
#node/ip-192-168-10-30.us-east-2.compute.internal untainted


# Kubernetes Port Requirements

Master node
TCP Inbound 2379 – 2380
TCP Inbound 6443, 10250, 10251, 10252

Worker node
TCP Inbound 10250
TCP Inbound 30000–32767

# =========================================MASTER==============================================

# Become root user
sudo su

# Add IP-hostname entry to hosts file
echo -e "\n$(hostname -i) \t $(hostname)\n" >> /etc/hosts

cat /etc/hosts

# Update package lists
apt-get update

# Install Docker (Kubernetes supports upto version 18.06)
apt-get install -y apt-transport-https
curl -s https://download.docker.com/linux/ubuntu/gpg | apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
apt update
apt install -y docker-ce=18.06.0~ce~3-0~ubuntu
usermod -aG docker ubuntu

# Install Kubernetes
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
echo "deb http://apt.kubernetes.io/ kubernetes-xenial main" > /etc/apt/sources.list.d/kubernetes.list
apt-get update

apt-get install -y kubeadm kubelet kubectl
apt-mark hold kubelet kubeadm kubectl

# Initialize Kubernetes:
# kubeadm init --apiserver-advertise-address=$(hostname -i) --pod-network-cidr=10.244.0.0/16
kubeadm init --pod-network-cidr=10.244.0.0/16

# kubeadm join 172.31.44.222:6443 --token u3emp1.v1apk68iwuhpugt4 --discovery-token-ca-cert-hash sha256:bfadbe7f4ad864567cb75bc96e877ff91902320866d29e1c75dab9ecd1ea745f

# Note down the returned token
su - ubuntu
docker info

# Granting k8s access to a normal user
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

cat $HOME/.kube/config

# Wait till all pods are running (except core-dns)
kubectl get pods --all-namespaces

# Deploy Flannel network (L3 network fabric i.e. abstraction for VxLAN or other packet forwarding backends)
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

# Get pods in all namespaces
kubectl get pods --all-namespaces

# Get all nodes
kubectl get nodes

# =========================================WORKER==============================================

# Become root user
sudo su

# Add IP-hostname entry to hosts file
echo -e "\n$(hostname -i) \t $(hostname)\n" >> /etc/hosts

# Update package lists
apt-get update

# Install Docker (Kubernetes supports upto version 18.06)
apt-get install -y apt-transport-https
curl -s https://download.docker.com/linux/ubuntu/gpg | apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
apt update
apt install -y docker-ce=18.06.0~ce~3-0~ubuntu
usermod -aG docker ubuntu
docker info

# Install Kubernetes
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
echo "deb http://apt.kubernetes.io/ kubernetes-xenial main" > /etc/apt/sources.list.d/kubernetes.list
apt-get update
apt-get install -y kubeadm kubelet kubectl
apt-mark hold kubelet kubeadm kubectl






# Join the cluster
kubeadm join <MASTER_IP>:6443 --token <TOKEN> --discovery-token-ca-cert-hash sha256:<HASH>

# Use the noted token on "kubeadm init" Or run the following on master to get the join command
token=$(kubeadm token list | sed '1d' | head -1| awk '{print $1}')
hash=$(openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | awk '{print $2}')
ipaddress=$(hostname -i)
echo -e "\n\nkubeadm join $ipaddress:6443 --token $token --discovery-token-ca-cert-hash sha256:$hash\n\n";
unset token hash


# =========================================MASTER==============================================

# Get all nodes
kubectl get nodes -o wide


# Get pods in all namespaces
kubectl get pods --all-namespaces -o wide


git clone https://github.com/Kalki5/temp
cd temp

ll



vim nginx-pod.yml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    apps: nginx
spec:
  containers:
  - name: nginx
    image: nginx
    imagePullPolicy: IfNotPresent
    ports:
    - containerPort: 80

kubectl create -f nginx-pod.yml

kubectl get pods

kubectl get pods -o wide

kubectl describe pods nginx

curl <POD_IP>

kubectl expose pod nginx --port=80 --name=nginx-http

kubectl get svc

curl <SVC_IP>

kubectl delete svc nginx-http

kubectl delete -f nginx-pod.yml

kubectl get svc
kubectl get pod

vim nginx-rs.yml
apiVersion: v1
kind: ReplicationController
metadata:
  name: nginx
spec:
  replicas: 3
  selector:
    apps: nginx
  template:
    metadata:
      name: nginx
      labels:
        apps: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80

kubectl create -f nginx-rs.yml

kubectl get rc -o wide

kubectl describe rc nginx

kubectl get pods

kubectl get pods -o wide

vim nginx-svc.yml
apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    apps: nginx
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  selector:
    apps: nginx
  type: LoadBalancer


kubectl create -f nginx-svc.yml

kubectl get svc

# Kill nginx containers
htop

kubectl create deployment apache --image=httpd
kubectl get deployments
kubectl create service nodeport apache --tcp=80:80
kubectl get svc

# Describe node (Notice the Taints field)
kubectl describe nodes $(hostname)
kubectl describe nodes $(hostname) | grep Taints












# Extra


# Remove the taint from master node (i.e. Allow pods to be scheduled on the master)
kubectl taint nodes $(hostname) node-role.kubernetes.io/master-

# Add the taint back again
kubectl taint nodes $(hostname) $(hostname)=DoNotSchedulePods:NoSchedule

# To reset "kubeadm init"
kubectl drain $(hostname) --delete-local-data --force --ignore-daemonsets
kubectl delete node $(hostname)
sudo kubeadm reset

cat /run/flannel/subnet.env





vim kubernetes-dashboard.yaml
# ------------------- Dashboard Secret ------------------- #
apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
  namespace: kube-system
type: Opaque
---
# ------------------- Dashboard Service Account ------------------- #
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
---
# ------------------- Dashboard Role & Role Binding ------------------- #
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
rules:
  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create"]
  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create"]
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
  verbs: ["get", "update", "delete"]
  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["kubernetes-dashboard-settings"]
  verbs: ["get", "update"]
  # Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
  resources: ["services"]
  resourceNames: ["heapster"]
  verbs: ["proxy"]
- apiGroups: [""]
  resources: ["services/proxy"]
  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
---
# ------------------- Dashboard Deployment ------------------- #
kind: Deployment
apiVersion: apps/v1beta2
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
      - name: kubernetes-dashboard
        image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3
        ports:
        - containerPort: 8443
          protocol: TCP
        args:
          - --auto-generate-certificates
          # Uncomment the following line to manually specify Kubernetes API server Host
          # If not specified, Dashboard will attempt to auto discover the API server and connect
          # to it. Uncomment only if the default does not work.
          # - --apiserver-host=http://my-address:port
        volumeMounts:
        - name: kubernetes-dashboard-certs
          mountPath: /certs
          # Create on-disk volume to store exec logs
        - mountPath: /tmp
          name: tmp-volume
        livenessProbe:
          httpGet:
            scheme: HTTPS
            path: /
            port: 8443
          initialDelaySeconds: 30
          timeoutSeconds: 30
      volumes:
      - name: kubernetes-dashboard-certs
        secret:
          secretName: kubernetes-dashboard-certs
      - name: tmp-volume
        emptyDir: {}
      serviceAccountName: kubernetes-dashboard
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
---
# ------------------- Dashboard Service ------------------- #
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
  type: NodePort


kubectl create -f kubernetes-dashboard.yaml
kubectl get deployment -n kube-system -o wide


vim heapster.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: heapster
  namespace: kube-system
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: heapster
  namespace: kube-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        task: monitoring
        k8s-app: heapster
    spec:
      serviceAccountName: heapster
      containers:
      - name: heapster
        image: gcr.io/google_containers/heapster-amd64:v1.4.2
        imagePullPolicy: IfNotPresent
        command:
        - /heapster
        - --source=kubernetes.summary_api:''?useServiceAccount=true&kubeletHttps=true&kubeletPort=10250&insecure=true
---
apiVersion: v1
kind: Service
metadata:
  labels:
    task: monitoring
    # For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons)
    # If you are NOT using this as an addon, you should comment out this line.
    kubernetes.io/cluster-service: 'true'
    kubernetes.io/name: Heapster
  name: heapster
  namespace: kube-system
spec:
  ports:
  - port: 80
    targetPort: 8082
  selector:
    k8s-app: heapster
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: heapster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:heapster
subjects:
- kind: ServiceAccount
  name: heapster
  namespace: kube-system




kubectl create -f heapster.yaml
kubectl get -f heapster.yaml


kubectl edit clusterrole system:heapster
- apiGroups:
  - ""
  resources:
  - nodes/stats
  verbs:
  - get


vim kubernetes-dashboard-admin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system


kubectl create -f kubernetes-dashboard-admin.yaml

kubectl -n kube-system get secret | grep admin-user

kubectl -n kube-system describe secret <SECRET_NAME>

# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

# kubectl proxy --address='0.0.0.0' --accept-hosts='^*$'

# kubectl -n kube-system edit service kubernetes-dashboard
# kubectl -n kube-system get service kubernetes-dashboard
# netstat -plnt

kubectl get svc -n kube-system













# Get pods in all namespaces
kubectl get pods --all-namespaces

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

vim dashboard-adminuser.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

kubectl apply -f dashboard-adminuser.yaml

vim dashboad-rolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

kubectl apply -f  dashboad-rolebinding.yaml

kubectl proxy --address='0.0.0.0' --accept-hosts='.*'