Initializing the Kubernetes cluster

Master node from scratch

• Install Kubernetes on Ubuntu 18.04. Assuming version 1.14.2 is pulled, check how to fix version.

> cd init
> ./install_kubernetes.sh

• Set up other pre-requisites:
  • Reconfigure docker runtime. Edit /etc/docker/daemon.json as follows:

{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2"
}

• • Restart docker daemon:

> mkdir -p /etc/systemd/system/docker.service.d
> systemctl daemon-reload
> systemctl restart docker

• • Make sure swap is off

> sudo swapoff -a

Check /etc/fstab if swap is still configured there, delete if this is the case.

• Create cluster configuration scripts.

> cd init/templates
# edit cluster information in the following config file
> nano make_init_config.sh
> touch /home/kubernetes/.rnd
> ./make_init_config.sh

This will generate the init config from the config template and store it in /home/kubernetes/clusters/ccu.

• Spin up the master node.

Use kubeadm with the generated config to initialize the control plane.

> cd /home/kubernetes/clusters/ccu
> sudo systemctl enable docker.service
> sudo kubeadm init --config kubeadm-init-config.yaml

• Flannel daemonset (node communication)

• nVidia daemonset

• Update kubelet configuration for master node

Authentication systems

DEX with LDAP

TODO: outdated, switched to containerized DEX. Check what still needs to be done.

Set up according to this tutorial with customized install scripts in kubernetes/init/dex/

1. Create secrets for TLS connections, use certs for ccu.uni-konstanz.de
   1. Modify ca-cm.yml to contain correct ca.
   2. Run upload_ccu_tls.sh
2. Spin up login application service.
   1. Modify loginapp-cm.yml: server config
   2. Modify loginapp-ing-srv.yml: service data, mapping of ports to outside world
   3. Modify loginapp-deploy.yml: ID secret for TLS
   4. Run start-login-service.sh
3. Spin up dex
   1. Modify dex-cm.yml: server data and LDAP configuration
   2. Modify dex-ing-srv.yml: service data, mapping of ports to outside world
   3. Modify dex-deploy.yml: ID secret for TLS
   4. Run start-dex-service.sh