306 lines
11 KiB
Bash
Executable File
306 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
echo -e " \033[33;5m __ _ _ ___ \033[0m"
|
|
echo -e " \033[33;5m \ \(_)_ __ ___( )__ / _ \__ _ _ __ __ _ __ _ ___ \033[0m"
|
|
echo -e " \033[33;5m \ \ | '_ \` _ \/ __| / /_\/ _\` | '__/ _\` |/ _\` |/ _ \ \033[0m"
|
|
echo -e " \033[33;5m /\_/ / | | | | | \__ \ / /_\\ (_| | | | (_| | (_| | __/ \033[0m"
|
|
echo -e " \033[33;5m \___/|_|_| |_| |_|___/ \____/\__,_|_| \__,_|\__, |\___| \033[0m"
|
|
echo -e " \033[33;5m |___/ \033[0m"
|
|
|
|
echo -e " \033[36;5m ___ _ _____ ___ \033[0m"
|
|
echo -e " \033[36;5m | _ \ |/ / __|_ ) \033[0m"
|
|
echo -e " \033[36;5m | / ' <| _| / / \033[0m"
|
|
echo -e " \033[36;5m |_|_\_|\_\___/___| \033[0m"
|
|
echo -e " \033[36;5m \033[0m"
|
|
echo -e " \033[32;5m https://youtube.com/@jims-garage \033[0m"
|
|
echo -e " \033[32;5m \033[0m"
|
|
|
|
#############################################
|
|
# YOU SHOULD ONLY NEED TO EDIT THIS SECTION #
|
|
#############################################
|
|
|
|
# Version of Kube-VIP to deploy
|
|
export KVVERSION="v0.7.2"
|
|
|
|
# The domain name of your cluster, inherit env by default
|
|
DOMAIN=${DOMAIN:-my.org}
|
|
|
|
# Set the IP addresses of the admin, masters, and workers nodes
|
|
# "admin" is the machine from which you will be running the ops,
|
|
# in theory it can be "localhost", just make sure you have sshd
|
|
# running and accessible there.
|
|
admin=192.168.60.22
|
|
master1=192.168.60.37
|
|
master2=192.168.60.38
|
|
master3=192.168.60.39
|
|
|
|
# Array of worker nodes
|
|
workers=(192.168.60.26 192.168.60.83)
|
|
|
|
# User of remote machines
|
|
remoteuser=ubuntu
|
|
|
|
# Interface used on remotes
|
|
interface=eth0
|
|
|
|
# Set the virtual IP address (VIP)
|
|
vip=192.168.60.171
|
|
|
|
# Array of extra master nodes
|
|
extramasters=("$master2" "$master3")
|
|
|
|
# Array of all master nodes
|
|
allmasters=("$master1" "${extramasters[@]}")
|
|
|
|
# Array of all minus master1
|
|
allnomaster1=("${extramasters[@]}" "${workers[@]}")
|
|
|
|
# Array of all
|
|
all=("$master1" "${allnomaster1[@]}")
|
|
|
|
#Loadbalancer IP range
|
|
lbrange=192.168.60.171-192.168.60.189
|
|
|
|
#ssh certificate name variable
|
|
certName=id_rsa
|
|
|
|
#############################################
|
|
# DO NOT EDIT BELOW #
|
|
#############################################
|
|
|
|
#fail immediately on errors
|
|
set -e
|
|
|
|
# For testing purposes - in case time is wrong due to VM snapshots
|
|
if hash timedatectl 2>/dev/null; then
|
|
sudo timedatectl set-ntp off
|
|
sudo timedatectl set-ntp on
|
|
fi
|
|
|
|
# Create a directory for the SSH certs
|
|
mkdir -p ~/.ssh
|
|
|
|
# Generate SSH certs if missing
|
|
if [ ! -f "$HOME"/.ssh/$certName ]; then
|
|
if [ -f "$HOME"/$certName ]; then
|
|
# Move SSH certs to ~/.ssh and change permissions
|
|
cp "$HOME"/$certName{,.pub} "$HOME"/.ssh
|
|
chmod 400 "$HOME"/.ssh/*
|
|
chmod 700 "$HOME"/.ssh
|
|
else
|
|
ssh-keygen -t rsa -f "$HOME"/.ssh/$certName -N ""
|
|
fi
|
|
fi
|
|
|
|
# Install Kubectl if not already present
|
|
if ! command -v kubectl version &>/dev/null; then
|
|
if [ "$OS" == "Darwin" ]; then
|
|
brew install kubernetes-cli
|
|
else # assume Linux?
|
|
echo -e " \033[31;5mKubectl not found, installing\033[0m"
|
|
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/$(uname -m)/kubectl"
|
|
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
|
|
fi
|
|
else
|
|
echo -e " \033[32;5mKubectl already installed\033[0m"
|
|
fi
|
|
|
|
# Create SSH Config file to ignore checking (don't use in production!)
|
|
#sed -i '1s/^/StrictHostKeyChecking no\n/' ~/.ssh/config
|
|
|
|
#add ssh keys for all nodes
|
|
for node in "${all[@]}"; do
|
|
ssh-copy-id "$remoteuser@$node"
|
|
done
|
|
|
|
# Step 1: Create Kube VIP
|
|
# create RKE2's self-installing manifest dir
|
|
sudo mkdir -p /var/lib/rancher/rke2/server/manifests
|
|
# Install the kube-vip deployment into rke2's self-installing manifest folder
|
|
# shellcheck disable=SC2016
|
|
curl -s https://raw.githubusercontent.com/JamesTurland/JimsGarage/main/Kubernetes/RKE2/kube-vip |
|
|
sed 's/$interface/'$interface'/g; s/$vip/'$vip'/g' >~/kube-vip.yaml
|
|
# Find/Replace all k3s entries to represent rke2
|
|
sed -i 's/k3s/rke2/g' ~/kube-vip.yaml
|
|
sudo cp ~/kube-vip.yaml /var/lib/rancher/rke2/server/manifests/kube-vip.yaml
|
|
|
|
# make kube folder to run kubectl later
|
|
mkdir -p ~/.kube
|
|
|
|
# create the rke2 config file
|
|
sudo mkdir -p /etc/rancher/rke2
|
|
echo >~/config.yaml
|
|
{
|
|
echo "tls-san:"
|
|
echo " - $vip"
|
|
echo " - $master1"
|
|
echo " - $master2"
|
|
echo " - $master3"
|
|
echo "write-kubeconfig-mode: 0644"
|
|
echo "disable:"
|
|
echo " - rke2-ingress-nginx"
|
|
} >>~/config.yaml
|
|
# copy config.yaml to rancher directory
|
|
sudo cp ~/config.yaml /etc/rancher/rke2/config.yaml
|
|
|
|
{
|
|
# update path with rke2-binaries
|
|
echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml'
|
|
# shellcheck disable=SC2016
|
|
echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin'
|
|
echo 'alias k=kubectl'
|
|
} >>~/.bashrc
|
|
|
|
# shellcheck disable=SC1090
|
|
source ~/.bashrc
|
|
|
|
# Step 2: Copy kube-vip.yaml and certs to all masters
|
|
for newnode in "${allmasters[@]}"; do
|
|
scp -i ~/.ssh/$certName ~/kube-vip.yaml "$remoteuser@$newnode":~/kube-vip.yaml
|
|
scp -i ~/.ssh/$certName ~/config.yaml "$remoteuser@$newnode":~/config.yaml
|
|
scp -i ~/.ssh/$certName ~/.ssh/$certName{,.pub} "$remoteuser@$newnode":~/.ssh
|
|
echo -e " \033[32;5mCopied successfully!\033[0m"
|
|
done
|
|
|
|
# Step 3: Connect to Master1 and move kube-vip.yaml and config.yaml. Then install RKE2, copy token back to admin machine. We then use the token to bootstrap additional masternodes
|
|
# shellcheck disable=SC2087
|
|
ssh -tt $remoteuser@$master1 -i ~/.ssh/$certName sudo su <<EOF
|
|
mkdir -p /var/lib/rancher/rke2/server/manifests
|
|
mv kube-vip.yaml /var/lib/rancher/rke2/server/manifests/kube-vip.yaml
|
|
mkdir -p /etc/rancher/rke2
|
|
mv config.yaml /etc/rancher/rke2/config.yaml
|
|
{
|
|
echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml'
|
|
echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin'
|
|
echo 'alias k=kubectl'
|
|
} >> ~/.bashrc
|
|
source ~/.bashrc
|
|
curl -sfL https://get.rke2.io | sh -
|
|
systemctl enable rke2-server.service
|
|
systemctl start rke2-server.service
|
|
#echo "StrictHostKeyChecking no" > ~/.ssh/config
|
|
#ssh-copy-id -i ~/.ssh/$certName $remoteuser@$admin
|
|
scp -i ~/.ssh/$certName /var/lib/rancher/rke2/server/token $remoteuser@$admin:~/token
|
|
scp -i ~/.ssh/$certName /etc/rancher/rke2/rke2.yaml $remoteuser@$admin:~/.kube/rke2.yaml
|
|
exit
|
|
EOF
|
|
echo -e " \033[32;5mMaster1 Completed\033[0m"
|
|
|
|
# Step 4: Set variable to the token we just extracted, set kube config location
|
|
token=$(cat token)
|
|
sudo cat ~/.kube/rke2.yaml | sed 's/127.0.0.1/'$master1'/g' >"$HOME/.kube/config"
|
|
sudo chown "$(id -u):$(id -g)" "$HOME/.kube/config"
|
|
export KUBECONFIG=${HOME}/.kube/config
|
|
sudo cp ~/.kube/config /etc/rancher/rke2/rke2.yaml
|
|
kubectl get nodes
|
|
|
|
# Step 5: Install kube-vip as network LoadBalancer - Install the kube-vip Cloud Provider
|
|
kubectl apply -f https://kube-vip.io/manifests/rbac.yaml
|
|
kubectl apply -f https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/main/manifest/kube-vip-cloud-controller.yaml
|
|
|
|
# Step 6: Add other Masternodes, note we import the token we extracted from step 3
|
|
for newnode in "${extramasters[@]}"; do
|
|
# shellcheck disable=SC2087
|
|
ssh -tt "$remoteuser@$newnode" -i ~/.ssh/$certName sudo su <<EOF
|
|
mkdir -p /etc/rancher/rke2
|
|
echo > /etc/rancher/rke2/config.yaml
|
|
{
|
|
echo "token: $token"
|
|
echo "server: https://$master1:9345"
|
|
echo "tls-san:"
|
|
echo " - $vip"
|
|
echo " - $master1"
|
|
echo " - $master2"
|
|
echo " - $master3"
|
|
} >> /etc/rancher/rke2/config.yaml
|
|
curl -sfL https://get.rke2.io | sh -
|
|
systemctl enable rke2-server.service
|
|
systemctl start rke2-server.service
|
|
exit
|
|
EOF
|
|
echo -e " \033[32;5mMaster node joined successfully!\033[0m"
|
|
done
|
|
|
|
kubectl get nodes
|
|
|
|
# Step 7: Add Workers
|
|
for newnode in "${workers[@]}"; do
|
|
# shellcheck disable=SC2087
|
|
ssh -tt "$remoteuser@$newnode" -i ~/.ssh/$certName sudo su <<EOF
|
|
mkdir -p /etc/rancher/rke2
|
|
echo > /etc/rancher/rke2/config.yaml
|
|
echo "token: $token" >> /etc/rancher/rke2/config.yaml
|
|
echo "server: https://$vip:9345" >> /etc/rancher/rke2/config.yaml
|
|
echo "node-label:" >> /etc/rancher/rke2/config.yaml
|
|
echo " - worker=true" >> /etc/rancher/rke2/config.yaml
|
|
echo " - longhorn=true" >> /etc/rancher/rke2/config.yaml
|
|
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE="agent" sh -
|
|
systemctl enable rke2-agent.service
|
|
systemctl start rke2-agent.service
|
|
exit
|
|
EOF
|
|
echo -e " \033[32;5mWorker node joined successfully!\033[0m"
|
|
done
|
|
|
|
kubectl get nodes
|
|
|
|
# Step 8: Install Metallb
|
|
echo -e " \033[32;5mDeploying Metallb\033[0m"
|
|
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.12.1/manifests/namespace.yaml
|
|
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.12/config/manifests/metallb-native.yaml
|
|
# Download ipAddressPool and configure using lbrange above
|
|
# shellcheck disable=SC2016
|
|
curl -s https://raw.githubusercontent.com/JamesTurland/JimsGarage/main/Kubernetes/RKE2/ipAddressPool |
|
|
sed 's/$lbrange/'$lbrange'/g' >"$HOME/ipAddressPool.yaml"
|
|
|
|
# Step 9: Deploy IP Pools and l2Advertisement
|
|
echo -e " \033[32;5mAdding IP Pools, waiting for Metallb to be available first. This can take a long time as we're likely being rate limited for container pulls...\033[0m"
|
|
kubectl wait --namespace metallb-system \
|
|
--for=condition=ready pod \
|
|
--selector=component=controller \
|
|
--timeout=1800s
|
|
kubectl apply -f ipAddressPool.yaml
|
|
kubectl apply -f https://raw.githubusercontent.com/JamesTurland/JimsGarage/main/Kubernetes/RKE2/l2Advertisement.yaml
|
|
|
|
# Step 10: Install Rancher (Optional - Delete if not required)
|
|
#Install Helm
|
|
echo -e " \033[32;5mInstalling Helm\033[0m"
|
|
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
|
|
chmod 700 get_helm.sh
|
|
./get_helm.sh
|
|
|
|
# Add Rancher Helm Repo & create namespace
|
|
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
|
|
kubectl create namespace cattle-system
|
|
|
|
# Install Cert-Manager
|
|
echo -e " \033[32;5mDeploying Cert-Manager\033[0m"
|
|
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.crds.yaml
|
|
helm repo add jetstack https://charts.jetstack.io
|
|
helm repo update
|
|
helm install cert-manager jetstack/cert-manager \
|
|
--namespace cert-manager \
|
|
--create-namespace \
|
|
--version v1.13.2
|
|
kubectl get pods --namespace cert-manager
|
|
|
|
# Install Rancher
|
|
echo -e " \033[32;5mDeploying Rancher\033[0m"
|
|
helm install rancher rancher-latest/rancher \
|
|
--namespace cattle-system \
|
|
--set hostname="rancher.$DOMAIN" \
|
|
--set bootstrapPassword=admin
|
|
kubectl -n cattle-system rollout status deploy/rancher
|
|
kubectl -n cattle-system get deploy rancher
|
|
|
|
# Add Rancher LoadBalancer
|
|
kubectl get svc -n cattle-system
|
|
kubectl expose deployment rancher --name=rancher-lb --port=443 --type=LoadBalancer -n cattle-system
|
|
while [[ $(kubectl get svc -n cattle-system 'jsonpath={..status.conditions[?(@.type=="Pending")].status}') = "True" ]]; do
|
|
sleep 5
|
|
echo -e " \033[32;5mWaiting for LoadBalancer to come online\033[0m"
|
|
done
|
|
kubectl get svc -n cattle-system
|
|
|
|
echo -e " \033[32;5mAccess Rancher from the IP above - Password is admin!\033[0m"
|