Deploy a Production Ready Kubernetes Cluster

If you have questions, check the documentation and join us on the , channel #kubespray. You can get your invite here

Can be deployed on AWS, GCE, Azure, OpenStack, vSphere, Packet (bare metal), Oracle Cloud Infrastructure (Experimental), or Baremetal
Highly available cluster
Composable (Choice of the network plugin for instance)
Supports most popular Linux distributions
Continuous integration tests

To deploy the cluster you can use :

Usage

Note: When Ansible is already installed via system packages on the control machine, other python packages installed via will go to a different directory tree (e.g. /usr/local/lib/python2.7/dist-packages on Ubuntu) from Ansible’s (e.g. /usr/lib/python2.7/dist-packages/ansible still on Ubuntu). As a consequence, ansible-playbook command will fail with:

probably pointing on a task depending on a module present in requirements.txt (i.e. “unseal vault”).

One way of solving this would be to uninstall the Ansible package and then, to install it via pip but it is not always possible. A workaround consists of setting ANSIBLE_LIBRARY and environment variables respectively to the ansible/modules and ansible/module_utils subdirectories of pip packages installation location, which can be found in the Location field of the output of pip show [package] before executing ansible-playbook.

Vagrant

For Vagrant we need to install python dependencies for provisioning tasks. Check if Python and pip are installed:

Documents

Supported Linux Distributions

Container Linux by CoreOS
Debian Buster, Jessie, Stretch, Wheezy
Ubuntu 16.04, 18.04
CentOS/RHEL 7
Fedora 28
Fedora/CentOS Atomic
openSUSE Leap 42.3/Tumbleweed

Note: Upstart/SysV init based OS types are not supported.

Core
- v1.14.3
- etcd v3.2.26
- v18.06 (see note)
- cri-o v1.11.5 (experimental: see . Only on centos based OS)
Network Plugin
- calico v3.4.0
- (given calico/flannel versions)
- cilium v1.3.0
- v1.2.1
- flanneld v0.11.0
- v0.2.5
- multus v3.1.autoconf
- v2.5.1

Note: The list of validated docker versions was updated to 1.11.1, 1.12.1, 1.13.1, 17.03, 17.06, 17.09, 18.06. kubeadm now properly recognizes Docker 18.09.0 and newer, but still treats 18.06 as the default supported version. The kubelet might break on docker’s non-standard version numbering (it no longer uses semantic versioning). To ensure auto-updates don’t break your cluster look into e.g. yum versionlock plugin or apt pin).

Requirements

Ansible v2.7.8 (or newer) and python-netaddr is installed on the machine that will run Ansible commands
Jinja 2.9 (or newer) is required to run the Ansible Playbooks
The target servers must have access to the Internet in order to pull docker images. Otherwise, additional configuration is required (See Offline Environment)
The target servers are configured to allow IPv4 forwarding.
Your ssh key must be copied to all the servers part of your inventory.
The firewalls are not managed, you’ll need to implement your own rules the way you used to. in order to avoid any issue during deployment you should disable your firewall.
If kubespray is ran from non-root user account, correct privilege escalation method should be configured in the target servers. Then the flag or command parameters --become or -b should be specified.

Hardware:
These limits are safe guarded by Kubespray. Actual requirements for your workload can differ. For a sizing guide go to the guide.

Master
- Memory: 1500 MB
Node
- Memory: 1024 MB

Network Plugins

You can choose between 6 network plugins. (default: calico, except Vagrant uses flannel)

: gre/vxlan (layer 2) networking.
calico: bgp (layer 3) networking.
: layer 3/4 networking (as well as layer 7 to protect and secure application protocols), supports dynamic insertion of BPF bytecode into the Linux kernel to implement security services, networking and visibility logic.
contiv: supports vlan, vxlan, bgp and Cisco SDN networking. This plugin is able to apply firewall policies, segregate containers in multiple network and bridging pods onto physical networks.
: Weave is a lightweight container overlay network that doesn’t require an external K/V database cluster. (Please refer to weave troubleshooting documentation).
: Kube-router is a L3 CNI for Kubernetes networking aiming to provide operational simplicity and high performance: it uses IPVS to provide Kube Services Proxy (if setup to replace kube-proxy), iptables for network policies, and BGP for ods L3 networking (with optionally BGP peering with out-of-cluster BGP peers). It can also optionally advertise routes to Kubernetes cluster Pods CIDRs, ClusterIPs, ExternalIPs and LoadBalancerIPs.
multus: Multus is a meta CNI plugin that provides multiple network interface support to pods. For each interface Multus delegates CNI calls to secondary CNI plugins such as Calico, macvlan, etc.