Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Ansible container in the kubernetes

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest.
Avatar for nnao45 nnao45
September 21, 2018
1.7k

Ansible container in the kubernetes

Avatar for nnao45

nnao45

September 21, 2018
Tweet

Transcript

  1. ࣗݾ঺հ MY NAME IS NNAO45 ˏnnao45 ✓ 26ࡀ(ฏ੒3೥ੜ·Ε) ✓ ࠓ͸ओʹΫϥ΢υ԰

    ✓ \“͑͵ͳ͓\”ͱݺͼ·͢ɻ ✓ ςχεྺ10೥ ✓ ITྺ4೥໨ ✓ Go࠷ߴ!!zsh࠷ߴ!! ✓cndjpษڧձӡӦ ✓גࣜձࣾαΠόʔΤʔδΣϯτॴଐ ✓ ݩISPͷNW͕ϝΠϯ
  2. What is Kubernetes? INTRODUCTION OF START UP THE K8S MONITORING.

    ཁ͸ɺίϯςφʔͷΦʔέετϨʔλʔɻ ·ͨͦΕΛୡ੒͢ΔͨΊͷϚΠΫϩαʔϏε܈ɻ http://dondocker.com/guardar-nuestras-imagenes-docker/
  3. Getting Startted Ansible Container Initilize the Ansible container ~/myproject #

    ansible-container init Ansible Container initialized. ~/myproject # ls ansible-requirements.txt…࣮ߦ͢ΔansibleͷϞδϡʔϧࢦఆ ansible.cfg…΄ͱΜͲ࢖Θͳ͍ container.yml…ຊମ meta.yml…Ansible Garaxyʹొ࿥͢Δͱ͖ʹඞཁ requirements.yml…conainter.ymlͰRoleϞδϡʔϧΛ࢖͏࣌ʹඞཁ
  4. ʁ

  5. Getting Startted Ansible Container What is container.yaml project_name: myproject #

    deployment_output_path: ./ansible-deployment k8s_auth: # path to a K8s config file config_file: # name of a context found within the config file context: # URL for accessing the K8s API host: # An API authentication token api_key: # Path to a ca cert file ssl_ca_cert: # Path to a cert file cert_file: # Path to a key file key_file: # boolean, indicating if SSL certs should be validated #verify_ssl: k8s_namespace: name: description: display_name: services: { ɹ//σϓϩΠ͢ΔઌͷαʔϏεΛॻ͍͓ͯ͘ɻ } registries: { //͜͜ͰCDϥΠϯͰϏϧυޙʹొ࿥͢ΔϨϙδτ ϦΛॻ͍͓ͯ͘ɻ }
  6. Getting Startted Ansible Container What is container.yaml project_name: myproject #

    deployment_output_path: ./ansible-deployment k8s_auth: # path to a K8s config file config_file: # name of a context found within the config file context: # URL for accessing the K8s API host: # An API authentication token api_key: # Path to a ca cert file ssl_ca_cert: # Path to a cert file cert_file: # Path to a key file key_file: # boolean, indicating if SSL certs should be validated #verify_ssl: k8s_namespace: name: description: display_name: services: { ɹ//σϓϩΠ͢ΔઌͷαʔϏεΛॻ͍͓ͯ͘ɻ } registries: { //͜͜ͰCDϥΠϯͰϏϧυޙʹొ࿥͢ΔϨϙδτ ϦΛॻ͍͓ͯ͘ɻ }
  7. Getting Startted Ansible Container What is container.yaml services: web: from:

    "ubuntu:xenial" ports: - "80:80" command: ["/usr/sbin/nginx", "-g", "daemon off;"] roles: - “apache-container" wordpress-db: from: "mysql:latest" expose: [3306] environment: MYSQL_MAJOR: 5.7 MYSQL_VERSION: 5.7.18-1debian8 MYSQL_DATABASE: wordpress MYSQL_USER: wordpress MYSQL_PASSWORD: foobar MYSQL_ROOT_PASSWORD: foobar services ωετͨ͠1൪໨ͷkey͕group໊ʹͳΓ·͢ɻ from ͲͷίϯςφΛϕʔεʹ͢Δ͔Λࢦఆ͠·͢ɻv0.4.0ͷࠒ͸imageͰ͕ͨ͠ɺ௚ײత ʹ෼͔Δkey໊ʹͳΓ·ͨ͠Ͷɻ ports ֎෦͔Βࢀরͤ͞ΔͨΊͷϙʔτΛࢦఆ͠·͢ɻ಺֎Ͱಉ͡ϙʔτΛ࢖͏৔߹Ͱ΋ɺ ෼͔Γ΍͘͢"80:80"ͷΑ͏ʹॻ͍͓ͯ͘ͱྑ͍͔ͱࢥ͍·͢ɻ command ίϯςφىಈ࣌ͷίϚϯυΛࢦఆ͠·͢ɻσϞͰ͸ɺNginx͸"/etc/init.d/nginx start" ͸όοΫάϥ΢ϯυͰͷ࣮ߦʹͳͬͯ͠·͍ίϯςφ͕͙͢མͪͯ͠·͏ͷͰɺϑΥ Ξάϥ΢ϯυͰ࣮ߦ͞ΕΔΑ͏ʹ"-g daemon off;"ΛҾ਺ʹ͢ΔΑ͏ʹࢦఆ͍ͯ͠· ͢ɻ roles ίϯςφʹର࣮ͯ͠ߦ͢ΔRoleΛࢦఆ͠·͢ɻRoleΛAnsible GalaxyΑΓऔಘ͢Δ ৔߹͸requirements.ymlʹ΋هࡌ͢Δඞཁ͕͋Γ·͢ɻ dev_overrides ansible-container runͷ৔߹ʹͷΈద༻͞Εɺbuild, deploy࣮ߦ࣌͸ແࢹ͞Ε·͢ɻ ϩʔΧϧ΍։ൃ؀ڥͰͷΈࢼ͢͜ͱ͕͋Δ৔߹ʹ༗༻Ͱ͢ɻྫ͑͹ɺ։ൃ؀ڥͷΈϙʔ τΛม͑ͯΈΔɺͱ͔ɺίϯϑΟά͕feature flagsͷΑ͏ͳ࡞Γʹͳ͍ͬͯΔ࣌ʹ։ൃ Λࣔ͢؀ڥม਺Λ༩͑Δɺͱ͍͏͜ͱ͕ՄೳͰ͢ɻσϞͰ͸هࡌ͋Γ·ͤΜ͕ɺॏཁ ͳύϥϝʔλͷͨΊ঺հ͠·ͨ͠ɻ https://qiita.com/komattaka/items/698f47358bb945ec125e
  8. Getting Startted Ansible Container container.yaml in kubernetes config example Serviceͷઃఆ

    k8s: service: force: false cluster_ip: 10.0.171.239 load_balancer_ip: 78.11.24.19 type: LoadBalancer metadata: annotations: service.beta.kubernetes.io/aws-load-balancer-ssl- cert: arn:aws:acm:us-east-1:123456789012:certificate/ 12345678-1234-1234-1234-123456789012 Deploymentͷઃఆ k8s: deployment: force: false replicas: 2 security_context: run_as_user: root strategy: type: Rolling rolling_params: timeout_seconds: 120 max_surge: "20%" max_unavailable: "10%" pre: {} post: {} triggers: - type: "ImageChange" image_change_params: automatic: true from: kind: "ImageStreamTag" name: "test-mkii-web:latest" container_names: - “web” And volumes, routes…
  9. Getting Startted Ansible Container How it build? > ansible-container build

    Conductor container Target container image ίϯμΫλʔίϯςφ͕ίϯςφϥϯλΠϜΛհͯ͠ʢଟ෼execͱ ͔ͯ͠ΔΜ͡ΌͶʣansible͕࣮ߦ͢ΔͷͰɺ໨ඪͷίϯςφΛσϓ ϩΠ͢Δͷʹssh΍ೝূΛߟ͑ͯͳͯ͘Α͘ͳΔ(࠷େͷಛ௃͔΋Ͷ) ansible-container build͸ɺ —debug͚࣮ͭͯߦ͢Δͱॲ ཧશମ͕ΈΕͯΦεεϝΑ
  10. Getting Startted Ansible Container How conductor container works Conductor container

    ίϯμΫλʔίϯςφ͸σϑΥϧτͰϕʔ ε͸centos:7͕ͩɺଞͷOSʹม͑Δࣄ͕Ͱ ͖Δɻࣗ࡞ͷίϯςφΠϝʔδͰ΋౰વ OK ansible-requiment.txtΛॻ͖׵͑ΔࣄͰί ϯμΫλʔίϯςφ಺ͷansibleͰ࢖ΘΕΔ ύοέʔδͷόʔδϣϯ΋ม͑ΒΕΔɻ ansible-containerͰ͸σϑΥϧτͰ gather_facts͕༗ޮʹͳ͍ͬͯΔ͕ɺ͜Ε ΋ansible.cfgʹهࡌ͢Ε͹ࢭΊΒΕΔɻ
  11. Getting Startted Ansible Container How it build? > ansible-container snipet

    > ansible-playbook *.yml Target kubernetes service Ansible-container snipetίϚϯυͰansible-playbookͰ࣮ߦՄೳͳܗࣜ ʹdeployment΍roleͳͲΛม׵ͯ͠ɺansible-playbookͰ࣮ߦ͢ΔࣄͰ kubernetes্ʹల։ग़དྷ·͢ɻ
  12. Getting Startted Ansible Container For example summary. # Init the

    project $ ansible-container init # Make Role or Install the jenkins-container role $ ansible-container install awasilyev.jenkins-container # Build the images on the ADB virtual machine $ ansible-container --no-selinux build # Generate the deployment playbook and role $ ansible-container --no-selinux shipit k8s --local-images # Set the working directory to ansible $ cd ansible # Run the playbook $ ansible-playbook shipit-k8s.yml
  13. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  14. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  15. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ - name: "copy" copy: src: ./eks-roles-policy.json

    dest: /root/eks-roles-policy.json owner: root group: root mode: 0600 register: result - name: "create-role" shell: | aws iam create-role --role-name eks --assume-role-policy-document file://eks-roles-policy.json register: result - name: "attach-role1" shell: | aws iam attach-role-policy --role-name eks --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy register: result - name: "attach-role2" shell: | aws iam attach-role-policy --role-name eks --policy-arn arn:aws:iam::aws:policy/AmazonEKSServicePolicy register: result Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "eks.amazonaws.com" }, "Action": "sts:AssumeRole" } ] eks-roles-policy.json
  16. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  17. Addition Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ - name: "create eks-demo-vpc

    deploy" shell: aws cloudformation create-stack --stack-name eks-vpc --region us-east-1 --template-url https://amazon-eks.s3-us- west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-vpc- sample.yaml register: result - debug: var=result.stdout_lines when: result | success tags: - always Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  18. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  19. Addition Amazon EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator

    ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ - name: "download" become: yes shell: curl {{ KUBECTL_CLI.URL }} -o {{ GET_URL_TEMP_DIRECTORY }}/ {{ KUBECTL_CLI.FILE_NAME }} - name: "chmod" become: yes shell: chmod +x {{ GET_URL_TEMP_DIRECTORY }}/{{ KUBECTL_CLI.FILE_NAME }} - name: "cp" become: yes shell: cp {{ GET_URL_TEMP_DIRECTORY }}/{{ KUBECTL_CLI.FILE_NAME }} /bin/ {{ KUBECTL_CLI.FILE_NAME }} Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  20. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  21. Addition Amazon EKS ΫϥελʔΛ࡞੒͢Δ - name: "regist var1" shell: aws

    cloudformation describe-stacks --stack-name eks-vpc --query 'Stacks[0].Outputs[?OutputKey==`SubnetIds`] [].OutputValue' --output text register: var1 - name: "regist var2" shell: aws cloudformation describe-stacks --stack-name eks-vpc --query 'Stacks[0].Outputs[? OutputKey==`SecurityGroups`][].OutputValue' --output text register: var2 - name: "regist var3" shell: aws iam get-role --role-name eks --query 'Role.Arn' --output text register: var3 - name: "create cluster" shell: | aws eks create-cluster --name test-cluster --role-arn {{ var3.stdout }} --resources-vpc-config subnetIds={{ var1.stdout }},securityGroupIds={{ var2.stdout }} register: result Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  22. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  23. Addition Amazon EKS ͷ kubectl Λઃఆ͢Δ - name: "mkdir" file:

    path=/root/.kube state=directory owner=root group=root mode=700 - name: "regist var1" shell: aws eks describe-cluster --name test-cluster --query cluster.endpoint register: endpoint - name: "regist var2" shell: aws eks describe-cluster --name test-cluster --query cluster.certificateAuthority.data register: base64 - name: "template" template: src=template/config-test-cluster.j2 dest=/root/.kube/config-test-cluster owner=root group=root mode=0600 Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  24. Addition Amazon EKS ͷ kubectl Λઃఆ͢Δ - name: "mkdir" file:

    path=/root/.kube state=directory owner=root group=root mode=700 - name: "regist var1" shell: aws eks describe-cluster --name test-cluster --query cluster.endpoint register: endpoint - name: "regist var2" shell: aws eks describe-cluster --name test-cluster --query cluster.certificateAuthority.data register: base64 - name: "template" template: src=template/config-test-cluster.j2 dest=/root/.kube/config-test-cluster owner=root group=root mode=0600 Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ apiVersion: v1 clusters: - cluster: server: {{ endpoint.stdout }} certificate-authority-data: {{ base64.stdout }} name: kubernetes contexts: - context: cluster: kubernetes user: aws name: aws current-context: aws kind: Config preferences: {} users: - name: aws user: exec: apiVersion: client.authentication.k8s.io/ v1alpha1 command: aws-iam-authenticator args: - "token" - “-i" - "test-cluster" config-test-cluster.j2
  25. Addition Amazon EKS αʔϏεϩʔϧΛ࡞੒͢Δ Amazon EKS Ϋϥελʔ VPC Λ࡞੒͢Δ Amazon

    EKS ͷ kubectl ΛΠϯετʔϧ͠ɺઃఆ͢Δ Amazon EKS ͷ aws-iam-authenticator ΛΠϯετʔϧ͢Δ ࠷৽ͷ AWS CLI Λμ΢ϯϩʔυ͠ɺΠϯετʔϧ͢Δ Amazon EKS ΫϥελʔΛ࡞੒͢Δ Amazon EKS ͷ kubectl Λઃఆ͢Δ Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ
  26. Addition Amazon EKS ϫʔΧʔϊʔυΛىಈͯ͠ઃఆ͢Δ - name: "regist subnet” shell: aws

    cloudformation describe-stacks --stack-name eks-vpc --query 'Stacks[0].Outputs[?OutputKey==`SubnetIds`] [].OutputValue' --output text register: subnet - name: "regist vpc” shell: aws cloudformation describe-stacks --stack-name eks-vpc --query 'Stacks[0].Outputs[?OutputKey==`VpcIds`] [].OutputValue' --output text register: vpc - name: "regist sg” shell: aws cloudformation describe-stacks --stack-name eks-vpc --query 'Stacks[0].Outputs[?OutputKey==`SecurityGroups`] [].OutputValue' --output text register: sg - name: "create eks-demo-vpc deploy" shell: aws cloudformation create-stack --stack-name eks-vpc --region us-east-1 --template-url https://amazon-eks.s3-us- west-2.amazonaws.com/1.10.3/2018-07-26/amazon-eks-nodegroup.yaml —parameters ClusterName=test- cluster,ClusterControlPlaneSecurityGroup={{ sg.output }},NodeGroupName=test- cluster,NodeAutoScalingGroupMinSize=1,NodeAutoScalingGroupMaxSize=1,NodeInstanceType=t2.large,NodeImageId=ami-048 486555686d18a0,VpcId={{ vpc.output }},Subnets={{ subnet.output }} register: result Լ४උ͚ͩͰ͜Μ͚ͩɾɾɾ