Deploy KubeSphere on VMware vSphere

Introduction

For a production environment, we need to consider the high availability of the cluster. If the key components (for example, kube-apiserver, kube-scheduler, and kube-controller-manager) are all running on the same control plane node, Kubernetes and KubeSphere will be unavailable once the control plane node goes down. Therefore, we need to set up a high-availability cluster by provisioning load balancers with multiple control plane nodes. You can use any cloud load balancer, or any hardware load balancer (for example, F5). In addition, Keepalived and HAProxy, or Nginx is also an alternative for creating high-availability clusters.

This tutorial walks you through an example of how to create Keepalived and HAProxy, and implement high availability of control plane and etcd nodes using the load balancers on VMware vSphere.

Prerequisites

  • Please make sure that you already know how to install KubeSphere with a multi-node cluster by following the guide. This tutorial focuses more on how to configure load balancers.
  • You need a VMware vSphere account to create VMs.
  • Considering data persistence, for a production environment, we recommend you to prepare persistent storage and create a default StorageClass in advance. For development and testing, you can use the integrated OpenEBS to provision LocalPV as the storage service directly.

Architecture

Architecture

Prepare Linux Hosts

This tutorial creates 8 virtual machines of CentOS Linux release 7.6.1810 (Core) for the default minimal installation. Every machine has 2 Cores, 4 GB of memory and 40 G disk space.

Host IPHost NameRole
10.10.71.214master1master, etcd
10.10.71.73master2master, etcd
10.10.71.62master3master, etcd
10.10.71.75node1worker
10.10.71.76node2worker
10.10.71.79node3worker
10.10.71.67vipvip (No need to create a VM)
10.10.71.77lb-0lb (Keepalived + HAProxy)
10.10.71.66lb-1lb (Keepalived + HAProxy)

Note

You do not need to create a virtual machine for vip (i.e. Virtual IP) above, so only 8 virtual machines need to be created.

You can follow the New Virtual Machine wizard to create a virtual machine to place in the VMware Host Client inventory.

create

  1. In the first step Select a creation type, you can deploy a virtual machine from an OVF or OVA file, or register an existing virtual machine directly.

    kubesphereOnVsphere-en-0-1-1-create-type

  2. When you create a new virtual machine, provide a unique name for the virtual machine to distinguish it from existing virtual machines on the host you are managing.

    kubesphereOnVsphere-en-0-1-2-name

  3. Select a compute resource and storage (datastore) for the configuration and disk files. You can select the datastore that has the most suitable properties, such as size, speed, and availability, for your virtual machine storage.

    kubesphereOnVsphere-en-0-1-3-resource

    kubesphereOnVsphere-en-0-1-4-storage

    kubesphereOnVsphere-en-0-1-5-compatibility

  4. Select a guest operating system. The wizard will provide the appropriate defaults for the operating system installation.

    kubesphereOnVsphere-en-0-1-6-system

  5. Before you finish deploying a new virtual machine, you have the option to set Virtual Hardware and VM Options. You can refer to the images below for part of the fields.

    kubesphereOnVsphere-en-0-1-7-hardware-1

    kubesphereOnVsphere-en-0-1-7-hardware-2

    kubesphereOnVsphere-en-0-1-7-hardware-3

    kubesphereOnVsphere-en-0-1-7-hardware-4

  6. In Ready to complete page, you review the configuration selections that you have made for the virtual machine. Click Finish at the bottom-right corner to continue.

    kubesphereOnVsphere-en-0-1-8

Install a Load Balancer using Keepalived and HAProxy

For a production environment, you have to prepare an external load balancer for your cluster with multiple control plane nodes. If you do not have a load balancer, you can install it using Keepalived and HAProxy. If you are provisioning a development or testing environment by installing a cluster with a control plane node, please skip this section.

Yum Install

host lb-0 (10.10.71.77) and host lb-1 (10.10.71.66).

  1. yum install keepalived haproxy psmisc -y

Configure HAProxy

On the servers with IP 10.10.71.77 and 10.10.71.66, configure HAProxy as follows.

Note

The configuration of the two lb machines is the same. Please pay attention to the backend service address.

  1. # HAProxy Configure /etc/haproxy/haproxy.cfg
  2. global
  3.     log         127.0.0.1 local2
  4.     chroot      /var/lib/haproxy
  5.     pidfile     /var/run/haproxy.pid
  6.     maxconn     4000
  7.     user        haproxy
  8.     group       haproxy
  9.     daemon
  10.     # turn on stats unix socket
  11.     stats socket /var/lib/haproxy/stats
  12. #---------------------------------------------------------------------
  13. # common defaults that all the 'listen' and 'backend' sections will
  14. # use if not designated in their block
  15. #---------------------------------------------------------------------
  16. defaults
  17.     log                     global
  18.     option                  httplog
  19.     option                  dontlognull
  20.     timeout connect         5000
  21.     timeout client          5000
  22.     timeout server          5000
  23. #---------------------------------------------------------------------
  24. # main frontend which proxys to the backends
  25. #---------------------------------------------------------------------
  26. frontend  kube-apiserver
  27.     bind *:6443
  28.     mode tcp
  29.     option tcplog
  30.     default_backend kube-apiserver
  31. #---------------------------------------------------------------------
  32. # round robin balancing between the various backends
  33. #---------------------------------------------------------------------
  34. backend kube-apiserver
  35.     mode tcp
  36.     option tcplog
  37.     balance     roundrobin
  38.     default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100
  39.     server kube-apiserver-1 10.10.71.214:6443 check
  40.     server kube-apiserver-2 10.10.71.73:6443 check
  41.     server kube-apiserver-3 10.10.71.62:6443 check

Check grammar first before you start it.

  1. haproxy -f /etc/haproxy/haproxy.cfg -c

Restart HAProxy and execute the command below to enable HAProxy.

  1. systemctl restart haproxy && systemctl enable haproxy

Stop HAProxy.

  1. systemctl stop haproxy

Configure Keepalived

Main HAProxy 77 lb-0-10.10.71.77 (/etc/keepalived/keepalived.conf).

  1. global_defs {
  2.   notification_email {
  3.   }
  4.   smtp_connect_timeout 30
  5.   router_id LVS_DEVEL01
  6.   vrrp_skip_check_adv_addr
  7.   vrrp_garp_interval 0
  8.   vrrp_gna_interval 0
  9. }
  10. vrrp_script chk_haproxy {
  11.   script "killall -0 haproxy"
  12.   interval 2
  13.   weight 20
  14. }
  15. vrrp_instance haproxy-vip {
  16.   state MASTER  
  17.   priority 100  
  18.   interface ens192
  19.   virtual_router_id 60
  20.   advert_int 1
  21.   authentication {
  22.     auth_type PASS
  23.     auth_pass 1111
  24.   }
  25.   unicast_src_ip 10.10.71.77
  26.   unicast_peer {
  27.     10.10.71.66
  28.   }
  29.   virtual_ipaddress {
  30.     #vip
  31.     10.10.71.67/24
  32.   }
  33.   track_script {
  34.     chk_haproxy
  35.   }
  36. }

Remark HAProxy 66 lb-1-10.10.71.66 (/etc/keepalived/keepalived.conf).

  1. global_defs {
  2.   notification_email {
  3.   }
  4.   router_id LVS_DEVEL02
  5.   vrrp_skip_check_adv_addr
  6.   vrrp_garp_interval 0
  7.   vrrp_gna_interval 0
  8. }
  9. vrrp_script chk_haproxy {
  10.   script "killall -0 haproxy"
  11.   interval 2
  12.   weight 20
  13. }
  14. vrrp_instance haproxy-vip {
  15.   state BACKUP
  16.   priority 90
  17.   interface ens192
  18.   virtual_router_id 60
  19.   advert_int 1
  20.   authentication {
  21.     auth_type PASS
  22.     auth_pass 1111
  23.   }
  24.   unicast_src_ip 10.10.71.66
  25.   unicast_peer {
  26.     10.10.71.77
  27.   }
  28.   virtual_ipaddress {
  29.     10.10.71.67/24
  30.   }
  31.   track_script {
  32.     chk_haproxy
  33.   }
  34. }

Start keepalived and enable keepalived.

  1. systemctl restart keepalived && systemctl enable keepalived
  1. systemctl stop keepalived
  1. systemctl start keepalived

Verify Availability

Use ip a s to view the vip binding status of each lb node:

  1. ip a s

Pause VIP node HAProxy through the following command:

  1. systemctl stop haproxy

Use ip a s again to check the vip binding of each lb node, and check whether vip drifts:

  1. ip a s

Alternatively, use the command below:

  1. systemctl status -l keepalived

Download KubeKey

Kubekey is the brand-new installer which provides an easy, fast and flexible way to install Kubernetes and KubeSphere 3.3.0.

Follow the step below to download KubeKey.

Download KubeKey from its GitHub Release Page or use the following command directly.

  1. curl -sfL https://get-kk.kubesphere.io | VERSION=v2.2.1 sh -

Run the following command first to make sure you download KubeKey from the correct zone.

  1. export KKZONE=cn

Run the following command to download KubeKey:

  1. curl -sfL https://get-kk.kubesphere.io | VERSION=v2.2.1 sh -

Note

After you download KubeKey, if you transfer it to a new machine also with poor network connections to Googleapis, you must run export KKZONE=cn again before you proceed with the steps below.

Note

The commands above download the latest release (v2.2.1) of KubeKey. You can change the version number in the command to download a specific version.

Make kk executable:

  1. chmod +x kk

Create a High Availability Cluster

With KubeKey, you can install Kubernetes and KubeSphere together. You have the option to create a multi-node cluster by customizing parameters in the configuration file.

Create a Kubernetes cluster with KubeSphere installed (for example, --with-kubesphere v3.3.0):

  1. ./kk create config --with-kubernetes v1.22.10 --with-kubesphere v3.3.0

Note

  • Recommended Kubernetes versions for KubeSphere 3.3.0: v1.19.x, v1.20.x, v1.21.x, v1.22.x, and v1.23.x (experimental support). If you do not specify a Kubernetes version, KubeKey will install Kubernetes v1.23.7 by default. For more information about supported Kubernetes versions, see Support Matrix.

  • If you do not add the flag --with-kubesphere in the command in this step, KubeSphere will not be deployed unless you install it using the addons field in the configuration file or add this flag again when you use ./kk create cluster later.

  • If you add the flag --with-kubesphere without specifying a KubeSphere version, the latest version of KubeSphere will be installed.

A default file config-sample.yaml will be created. Modify it according to your environment.

  1. vi config-sample.yaml
  1. apiVersion: kubekey.kubesphere.io/v1alpha1
  2. kind: Cluster
  3. metadata:
  4.   name: config-sample
  5. spec:
  6.   hosts:
  7.   - {name: master1, address: 10.10.71.214, internalAddress: 10.10.71.214, password: [email protected]!}
  8.   - {name: master2, address: 10.10.71.73, internalAddress: 10.10.71.73, password: [email protected]!}
  9.   - {name: master3, address: 10.10.71.62, internalAddress: 10.10.71.62, password: [email protected]!}
  10.   - {name: node1, address: 10.10.71.75, internalAddress: 10.10.71.75, password: [email protected]!}
  11.   - {name: node2, address: 10.10.71.76, internalAddress: 10.10.71.76, password: [email protected]!}
  12.   - {name: node3, address: 10.10.71.79, internalAddress: 10.10.71.79, password: [email protected]!}
  13.   roleGroups:
  14.     etcd:
  15.     - master1
  16.     - master2
  17.     - master3
  18.     control-plane:
  19.     - master1
  20.     - master2
  21.     - master3
  22.     worker:
  23.     - node1
  24.     - node2
  25.     - node3
  26.   controlPlaneEndpoint:
  27.     domain: lb.kubesphere.local
  28.     # vip
  29.     address: "10.10.71.67"
  30.     port: 6443
  31.   kubernetes:
  32.     version: v1.21.5
  33.     imageRepo: kubesphere
  34.     clusterName: cluster.local
  35.     masqueradeAll: false  # masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode. [Default: false]
  36.     maxPods: 110  # maxPods is the number of pods that can run on this Kubelet. [Default: 110]
  37.     nodeCidrMaskSize: 24  # internal network node size allocation. This is the size allocated to each node on your network. [Default: 24]
  38.     proxyMode: ipvs  # mode specifies which proxy mode to use. [Default: ipvs]
  39.   network:
  40.     plugin: calico
  41.     calico:
  42.       ipipMode: Always  # IPIP Mode to use for the IPv4 POOL created at start up. If set to a value other than Never, vxlanMode should be set to "Never". [Always | CrossSubnet | Never] [Default: Always]
  43.       vxlanMode: Never  # VXLAN Mode to use for the IPv4 POOL created at start up. If set to a value other than Never, ipipMode should be set to "Never". [Always | CrossSubnet | Never] [Default: Never]
  44.       vethMTU: 1440  # The maximum transmission unit (MTU) setting determines the largest packet size that can be transmitted through your network. [Default: 1440]
  45.     kubePodsCIDR: 10.233.64.0/18
  46.     kubeServiceCIDR: 10.233.0.0/18
  47.   registry:
  48.     registryMirrors: []
  49.     insecureRegistries: []
  50.     privateRegistry: ""
  51.   storage:
  52.     defaultStorageClass: localVolume
  53.     localVolume:
  54.       storageClassName: local  
  56. ---
  57. apiVersion: installer.kubesphere.io/v1alpha1
  58. kind: ClusterConfiguration
  59. metadata:
  60.   name: ks-installer
  61.   namespace: kubesphere-system
  62.   labels:
  63.     version: v3.3.0
  64. spec:
  65.   local_registry: ""
  66.   persistence:
  67.     storageClass: ""
  68.   authentication:
  69.     jwtSecret: ""
  70.   etcd:
  71.     monitoring: true        # Whether to install etcd monitoring dashboard
  72.     endpointIps: 192.168.0.7,192.168.0.8,192.168.0.9  # etcd cluster endpointIps
  73.     port: 2379              # etcd port
  74.     tlsEnable: true
  75.   common:
  76.     mysqlVolumeSize: 20Gi # MySQL PVC size
  77.     minioVolumeSize: 20Gi # Minio PVC size
  78.     etcdVolumeSize: 20Gi  # etcd PVC size
  79.     openldapVolumeSize: 2Gi   # openldap PVC size
  80.     redisVolumSize: 2Gi # Redis PVC size
  81.     es:  # Storage backend for logging, tracing, events and auditing.
  82.       elasticsearchMasterReplicas: 1   # total number of master nodes, it's not allowed to use even number
  83.       elasticsearchDataReplicas: 1     # total number of data nodes
  84.       elasticsearchMasterVolumeSize: 4Gi   # Volume size of Elasticsearch master nodes
  85.       elasticsearchDataVolumeSize: 20Gi    # Volume size of Elasticsearch data nodes
  86.       logMaxAge: 7                     # Log retention time in built-in Elasticsearch, it is 7 days by default.
  87.       elkPrefix: logstash              # The string making up index names. The index name will be formatted as ks-<elk_prefix>-log
  88.       # externalElasticsearchUrl:
  89.       # externalElasticsearchPort:
  90.   console:
  91.     enableMultiLogin: false  # enable/disable multiple sing on, it allows a user can be used by different users at the same time.
  92.     port: 30880
  93.   alerting:                # Whether to install KubeSphere alerting system. It enables Users to customize alerting policies to send messages to receivers in time with different time intervals and alerting levels to choose from.
  94.     enabled: false
  95.   auditing:                # Whether to install KubeSphere audit log system. It provides a security-relevant chronological set of records，recording the sequence of activities happened in platform, initiated by different tenants.
  96.     enabled: false
  97.   devops:                  # Whether to install KubeSphere DevOps System. It provides out-of-box CI/CD system based on Jenkins, and automated workflow tools including Source-to-Image & Binary-to-Image
  98.     enabled: false
  99.     jenkinsMemoryLim: 2Gi      # Jenkins memory limit
  100.     jenkinsMemoryReq: 1500Mi   # Jenkins memory request
  101.     jenkinsVolumeSize: 8Gi     # Jenkins volume size
  102.     jenkinsJavaOpts_Xms: 512m  # The following three fields are JVM parameters
  103.     jenkinsJavaOpts_Xmx: 512m
  104.     jenkinsJavaOpts_MaxRAM: 2g
  105.   events:                  # Whether to install KubeSphere events system. It provides a graphical web console for Kubernetes Events exporting, filtering and alerting in multi-tenant Kubernetes clusters.
  106.     enabled: false
  107.   logging:                 # Whether to install KubeSphere logging system. Flexible logging functions are provided for log query, collection and management in a unified console. Additional log collectors can be added, such as Elasticsearch, Kafka and Fluentd.
  108.     enabled: false
  109.     logsidecarReplicas: 2
  110.   metrics_server:                    # Whether to install metrics-server. IT enables HPA (Horizontal Pod Autoscaler).
  111.     enabled: true
  112.   monitoring:                        #
  113.     prometheusReplicas: 1            # Prometheus replicas are responsible for monitoring different segments of data source and provide high availability as well.
  114.     prometheusMemoryRequest: 400Mi   # Prometheus request memory
  115.     prometheusVolumeSize: 20Gi       # Prometheus PVC size
  116.     alertmanagerReplicas: 1          # AlertManager Replicas
  117.   multicluster:
  118.     clusterRole: none  # host | member | none  # You can install a solo cluster, or specify it as the role of host or member cluster
  119.   networkpolicy:       # Network policies allow network isolation within the same cluster, which means firewalls can be set up between certain instances (Pods).
  120.     enabled: false
  121.   notification:        # It supports notification management in multi-tenant Kubernetes clusters. It allows you to set AlertManager as its sender, and receivers include Email, Wechat Work, and Slack.
  122.     enabled: false
  123.   openpitrix:          # Whether to install KubeSphere App Store. It provides an application store for Helm-based applications, and offer application lifecycle management
  124.     enabled: false
  125.   servicemesh:         # (0.3 Core, 300 MiB) Provide fine-grained traffic management, observability and tracing, and visualized traffic topology
  126.     enabled: false

Create a cluster using the configuration file you customized above:

  1. ./kk create cluster -f config-sample.yaml

Verify the Multi-node Installation

Inspect the logs of installation by executing the command below:

  1. kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}') -f

If you can see the welcome log return, it means the installation is successful. Your cluster is up and running.

  1. **************************************************
  2. #####################################################
  3. ###              Welcome to KubeSphere!           ###
  4. #####################################################
  5. Console: http://10.10.71.214:30880
  6. Account: admin
  7. Password: [email protected]
  8. NOTES：
  9.   1. After you log into the console, please check the
  10.      monitoring status of service components in
  11.      the "Cluster Management". If any service is not
  12.      ready, please wait patiently until all components
  13.      are up and running.
  14.   2. Please change the default password after login.
  15. #####################################################
  16. https://kubesphere.io             2020-08-15 23:32:12
  17. #####################################################

Log in to the Console

You will be able to use default account and password admin/[[email protected]](https://kubesphere.io/cdn-cgi/l/email-protection) to log in to the console http://{$IP}:30880 to take a tour of KubeSphere. Please change the default password after login.

Enable Pluggable Components (Optional)

The example above demonstrates the process of a default minimal installation. To enable other components in KubeSphere, see Enable Pluggable Components for more details.