/kubernetes-on-openstack

Terraform and kubeadm for generating Kubernetes clusters on OpenStack

Primary LanguageSmartyApache License 2.0Apache-2.0

Terraform

Running Kubernetes on OpenStack with kubeadm and terraform, only accesible with a vpn

Using the module

Create a main.tf with the following content (obviously set the variables to your real values):

module "my_cluster" {
  source = "git::https://github.com/johscheuer/kubernetes-on-openstack.git"

  auth_url     = "${var.auth_url}"
  cluster_name = "${var.cluster_name}"
  username     = "${var.username}"
  password     = "${var.password}"
  domain_name  = "${var.domain_name}"
  project_id   = "${var.project_id}"
  image_name   = "${var.image_name}"
  kubeversion  = "${var.kubeversion}"
  tenant_name  = "${var.tenant_name}"
}

Fetch the module, initialize the folder and run plan:

terraform get --update
terraform init
terraform plan

Now you can create the cluster:

terraform apply

Authentication

The Kubernetes cluster will use Keystone authentication (over a WebHook). For more information have a look here. After running terraform apply there will be output how to authenticate against the newly created cluster. In order to actually authenticate with KeyStone you need to perform the following steps described here. The --insecure-skip-tls-verify=true is needed because we use the auto-generated certificates of kubeadm. There are possible workarounds to remove the flag (e.g. fetch the ca from the Kubernetes master).

Keep in mind: As a default all users in the (OpenStack) project will have cluster-admin rights.

Deprecated

When the machine has booted:

ssh ubuntu@<floating-ip>

To access the API server from external (as long as the Keystone auth doesn't work):

scp ubuntu@<floating-ip>:/home/ubuntu/.kube/config ~/.kube/my_cluster_config
export KUBECONFIG=~/.kube/my_cluster_config
kubectl get cs

TODO