Install CNI plugin

    To understand how the Container Network Interface (CNI) works with Kubernetes, and how it enhances Kubernetes networking, read our Kubernetes CNI guide.

    The CNI plugin interacts with the Kubernetes API server while creating pods, both to obtain additional information and to update the datastore with information about the pod.

    On the Kubernetes master node, create a key for the CNI plugin to authenticate with and certificate signing request.

    We will sign this certificate using the main Kubernetes CA.

    2.                   -CA /etc/kubernetes/pki/ca.crt \
    3.                   -CAkey /etc/kubernetes/pki/ca.key \
    4.                   -CAcreateserial \
    5.                   -out cni.crt \
    6.                   -days 365
    7. sudo chown $(id -u):$(id -g) cni.crt
    1. APISERVER=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}')
    2. kubectl config set-cluster kubernetes \
    3.     --certificate-authority=/etc/kubernetes/pki/ca.crt \
    4.     --embed-certs=true \
    5.     --server=$APISERVER \
    6.     --kubeconfig=cni.kubeconfig
    8. kubectl config set-credentials calico-cni \
    9.     --client-certificate=cni.crt \
    10.     --client-key=cni.key \
    11.     --embed-certs=true \
    12.     --kubeconfig=cni.kubeconfig
    14. kubectl config set-context default \
    15.     --cluster=kubernetes \
    16.     --user=calico-cni \
    17.     --kubeconfig=cni.kubeconfig
    19. kubectl config use-context default --kubeconfig=cni.kubeconfig

    Define a cluster role the CNI plugin will use to access Kubernetes.

    1. kubectl apply -f - <<EOF
    2. kind: ClusterRole
    3. apiVersion: rbac.authorization.k8s.io/v1
    4. metadata:
    5.   name: calico-cni
    6.   # The CNI plugin needs to get pods, nodes, and namespaces.
    7.   - apiGroups: [""]
    9.       - pods
    10.       - nodes
    11.       - namespaces
    12.     verbs:
    13.       - get
    14.   # The CNI plugin patches pods/status.
    15.   - apiGroups: [""]
    16.     resources:
    17.       - pods/status
    18.     verbs:
    19.       - patch
    20.  # These permissions are required for Calico CNI to perform IPAM allocations.
    21.   - apiGroups: ["crd.projectcalico.org"]
    22.     resources:
    23.       - blockaffinities
    24.       - ipamblocks
    25.       - ipamhandles
    26.     verbs:
    27.       - get
    28.       - list
    29.       - create
    30.       - update
    31.       - delete
    32.   - apiGroups: ["crd.projectcalico.org"]
    33.     resources:
    34.       - ipamconfigs
    35.       - clusterinformations
    36.       - ippools
    37.     verbs:
    38.       - get
    39.       - list
    40. EOF

    Bind the cluster role to the calico-cni account.

    Do these steps on each node in your cluster.

    Run these commands as root.

      2. chmod 755 /opt/cni/bin/calico
      3. curl -L -o /opt/cni/bin/calico-ipam https://github.com/projectcalico/cni-plugin/releases/download/v3.14.0/calico-ipam-amd64
      4. chmod 755 /opt/cni/bin/calico-ipam

      Create the config directory

      1. mkdir -p /etc/cni/net.d/

      Copy the kubeconfig from the previous section

      Write the CNI configuration

      1. cat > /etc/cni/net.d/10-calico.conflist <<EOF
      2. {
      3.   "name": "k8s-pod-network",
      4.   "cniVersion": "0.3.1",
      5.   "plugins": [
      6.     {
      7.       "type": "calico",
      8.       "log_level": "info",
      9.       "datastore_type": "kubernetes",
      10.       "mtu": 1500,
      11.       "ipam": {
      12.           "type": "calico-ipam"
      13.       },
      14.       "policy": {
      15.           "type": "k8s"
      16.       },
      17.       "kubernetes": {
      18.           "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      19.       }
      20.     },
      21.     {
      22.       "type": "portmap",
      23.       "snat": true,
      24.       "capabilities": {"portMappings": true}
      25.     }
      26.   ]
      27. }
      28. EOF

      Exit from su and go back to the logged in user.

      1. exit