Alfred Sabitzer - K8s Applications mit MicroK8S auf Raspberry PI

hello-world:20211003

pgmaster

pgmaster:20211125-1327

pgmaster:20211125-1337

pgmaster:20211125-1340

pgmaster:20211125-1339

pgmaster:latest

pgmaster:20211125-1345

pgmaster:20211125-1343

pgmaster:20211125-1334

pgmaster:20211125-1336

pgmaster:20211125-1341

webdefault

webdefault:20211123-1292

webdefault:20211123-1293

webserver

webserver:20211124-1329

webserver:20211124-1321

webserver:20211124-1315

webserver:20211124-1331

webserver:20211124-1305

webserver:20211125-1333

webserver:20211124-1324

webserver:latest

webserver:20211125-1345

webserver:20211124-1306

webserver:20211124-1319

webserver:20211123-1305

webserver:20211124-1328

webserver:20211124-1312

webserver:20211124-1307

webserver:20211124-1327

webserver:20211125-1344

webserver:20211124-1330

webserver:20211124-1314

webserver:20211124-1320

webserver:20211124-1317

webserver:20211124-1332

alfred@bureau:~$ '/home/alfred/svn/trunk/k8s/dev/registry_delete.sh' webdefault:20211123-1293

Lösche webdefault:20211123-1293

* Trying 192.168.0.213:5000...

* Connected to docker.registry (192.168.0.213) port 5000 (#0)

> DELETE /v2/webdefault/manifests/sha256:ede78ca033eba1314667d5c6ced6a279833908d162ffe9103d7d1af42d53b6c7 HTTP/1.1

> Host: docker.registry:5000

> User-Agent: curl/7.74.0

> Accept: */*

>

* Mark bundle as not supporting multiuse

< HTTP/1.1 202 Accepted

< Docker-Distribution-Api-Version: registry/2.0

< X-Content-Type-Options: nosniff

< Date: Thu, 25 Nov 2021 20:55:23 GMT

< Content-Length: 0

<

* Connection #0 to host docker.registry left intact

alfred@bureau:~$ '/home/alfred/svn/trunk/k8s/dev/registry_delete.sh' webdefault:20211123-1293

alfred@bureau:~$

Mit diesen beiden Skripts kann man sich die Images anzeigen lassen, und alte Images löschen.

Zertifikate und LetsEncrypt

Inspiration:

https://suda.pl/5-minute-home-server-with/

https://faun.pub/wildcard-k8s-4998173b16c8

https://collabnix.github.io/kubetools/

https://forum.netcup.de/netcup-intern/technik/11841-let-s-encrypt-wildcard-zertifikate-via-certbot/

Um den Cluster vernünftig betreiben zu können braucht es Zertificate.

Darum habe ich den Certificate-Manager installiert.

#!/bin/bash

############################################################################################

# $Date: 2021-10-21 21:40:29 +0200 (Do, 21. Okt 2021) $

# $Revision: 659 $

# $Author: alfred $

# $HeadURL: https://monitoring.slainte.at/svn/slainte/trunk/k8s/k8s/K5_certmanager.sh $

# $Id: K5_certmanager.sh 659 2021-10-21 19:40:29Z alfred $

#

# cert-manager

#

############################################################################################

#shopt -o -s errexit #—Terminates the shell script if a command returns an error code.

shopt -o -s xtrace #—Displays each command before it’s executed.

shopt -o -s nounset #-No Variables without definition

# Voraussetzung: Scripts in der richtigen Reihenfolge

#

# Definitionen für das Deployment

#

sname=$(basename "$0")

app="mikrok8s/install/${sname}"

pf=\$"Revision: "

sf=" "\$

fr="\$Revision: 659 $"

revision=${fr#*"$pf"}

revision=${revision%"$sf"*}

xd=(`date '+%Y-%m-%d'`)

wd="${HOME}/copy/${app}/${xd}/r${revision}"

id="/opt/cluster/${app}/${xd}/r${revision}"

rm -f -R ${wd}

mkdir -p ${wd}

#

cat < ${wd}/install_certmanager.sh

#!/bin/bash

#

# \$Date: 2021-10-21 21:40:29 +0200 (Do, 21. Okt 2021) $

# \$Revision: 659 $

# \$Author: alfred $

# \$HeadURL: https://monitoring.slainte.at/svn/slainte/trunk/k8s/k8s/K5_certmanager.sh $

# \$Id: K5_certmanager.sh 659 2021-10-21 19:40:29Z alfred $

#

# Installation des cert-managers mit helm

#

#shopt -o -s errexit #—Terminates the shell script if a command returns an error code.

shopt -o -s xtrace #—Displays each command before it’s executed.

shopt -o -s nounset #-No Variables without definition

# Voraussetzung: Scripts in der richtigen Reihenfolge

microk8s kubectl create namespace cert-manager

microk8s helm3 repo add jetstack https://charts.jetstack.io

microk8s helm3 repo update

microk8s helm3 install cert-manager jetstack/cert-manager \

--namespace cert-manager --version v1.5.4 \

--set installCRDs=true \

--set ingressShim.defaultIssuerName=letsencrypt-production \

--set ingressShim.defaultIssuerKind=ClusterIssuer \

--set ingressShim.defaultIssuerGroup=cert-manager.io

#

#wget https://github.com/jetstack/cert-manager/releases/download/v1.5.4/cert-manager.yaml --output-document=${id}/cert-manager.yaml

#wget https://github.com/jetstack/cert-manager/releases/download/v1.5.4/cert-manager.crds.yaml --output-document=${id}/cert-manager.crds.yaml

#microk8s kubectl apply -f ${id}/*.yaml

#

sleep 1m

microk8s kubectl get pods --namespace cert-manager

EOF

chmod 755 ${wd}/install_certmanager.sh

#

ansible pc1 -m shell -a ${id}'/install_certmanager.sh'

#

#!/bin/bash

############################################################################################

# $Date: 2021-11-28 11:05:45 +0100 (So, 28. Nov 2021) $

# $Revision: 1404 $apiVersion: networking.k8s.io/v1

# $Author: alfred $

# $HeadURL: https://monitoring.slainte.at/svn/slainte/trunk/k8s/k8s/K14_webserver.sh $

# $Id: K14_webserver.sh 1404 2021-11-28 10:05:45Z alfred $

#

# Einspielen der lokalen Konfigurationen - Produktiv ist slainte.

# https://stackoverflow.com/questions/67430592/how-to-setup-letsencrypt-with-kubernetes-microk8s-using-default-ingress

#

############################################################################################

#shopt -o -s errexit #—Terminates the shell script if a command returns an error code.

shopt -o -s xtrace #—Displays each command before it’s executed.

shopt -o -s nounset #-No Variables without definition

#

# Definitionen für das Deployment

#

sname=$(basename "$0")

app="mikrok8s/install/${sname}"

pf=\$"Revision: "

sf=" "\$

fr="\$Revision: 1404 $"

revision=${fr#*"$pf"}

revision=${revision%"$sf"*}

xd=(`date '+%Y-%m-%d'`)

wd="${HOME}/copy/${app}/${xd}/r${revision}"

id="/opt/cluster/${app}/${xd}/r${revision}"

rm -f -R ${wd}

mkdir -p ${wd}

#

cat < ${wd}/webserver-depl-svc.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

name: webserver-depl

namespace: slainte

spec:

selector:

matchLabels:

app: webserver-app

template:

metadata:

labels:

app: webserver-app

spec:

containers:

- name: webserver-app

image: nginx:1.20

---

apiVersion: v1

kind: Service

metadata:

name: webserver-svc

namespace: slainte

spec:

selector:

app: webserver-app

ports:

- port: 80

name: http

targetPort: 80

protocol: TCP

- port: 443

name: https

targetPort: 443

protocol: TCP

EOF

ansible pc1 -m shell -a 'microk8s kubectl apply -f '${id}'/webserver-depl-svc.yaml'

cat < ${wd}/letsencrypt-staging.yaml

apiVersion: cert-manager.io/v1

kind: ClusterIssuer

metadata:

name: letsencrypt-staging

spec:

acme:

#change to your email

email: slainte@slainte.at

server: https://acme-staging-v02.api.letsencrypt.org/directory