RETIRED, Kubernetes integration with OpenStack networking
Go to file
2017-04-17 14:52:16 +00:00
contrib Fix vagrant ssh issue for virtualbox bento 2017-04-04 16:21:35 -04:00
devstack Add devstack support for https k8s api server 2017-04-05 13:45:52 +05:30
doc Spec for adding contrail support in kuryr-k8s 2017-03-20 15:17:36 +00:00
etc Experimental CNI & VIFBridge binding 2016-12-05 18:05:22 +00:00
kuryr_kubernetes Merge "Implement Guru meditation reports" 2017-04-17 14:52:16 +00:00
scripts Controller service base 2016-10-04 21:56:50 +03:00
tools move config and opt generation to new kuryr-lib 2016-09-26 13:11:47 +00:00
.coveragerc tox: fix coverage 2016-11-18 10:14:56 +03:00
.gitignore Add *.log to gitignore to ignore vagrant logs 2017-03-21 18:08:38 -07:00
.gitreview Added .gitreview 2016-05-12 09:14:08 +00:00
.testr.conf cookiecutter commit for kuryr-kubernetes 2016-05-22 08:54:07 +03:00
babel.cfg cookiecutter commit for kuryr-kubernetes 2016-05-22 08:54:07 +03:00
CONTRIBUTING.rst cookiecutter commit for kuryr-kubernetes 2016-05-22 08:54:07 +03:00
HACKING.rst cookiecutter commit for kuryr-kubernetes 2016-05-22 08:54:07 +03:00
LICENSE cookiecutter commit for kuryr-kubernetes 2016-05-22 08:54:07 +03:00
README.rst doc: Add reminder to have https in api_root 2017-03-26 08:56:26 +03:00
requirements.txt Implement Guru meditation reports 2017-04-13 03:19:08 +00:00
setup.cfg K8s Services support: LoadBalancerHandler 2017-04-10 17:07:16 +00:00
setup.py Updated from global requirements 2017-03-15 12:44:19 +00:00
test-requirements.txt Updated from global requirements 2017-03-28 21:30:02 +00:00
tox.ini Remove log translations 2017-03-28 15:13:49 +08:00

Team and repository tags

image

kuryr-kubernetes

Kubernetes integration with OpenStack networking

The OpenStack Kuryr project enables native Neutron-based networking in Kubernetes. With Kuryr-Kubernetes it's now possible to choose to run both OpenStack VMs and Kubernetes Pods on the same Neutron network if your workloads require it or to use different segments and, for example, route between them.

Configuring Kuryr

Generate sample config, etc/kuryr.conf.sample, running the following:

$ ./tools/generate_config_file_samples.sh

Rename and copy config file at required path:

$ cp etc/kuryr.conf.sample /etc/kuryr/kuryr.conf

Edit Neutron section in /etc/kuryr/kuryr.conf, replace ADMIN_PASSWORD:

[neutron]
auth_url = http://127.0.0.1:35357/v3/
username = admin
user_domain_name = Default
password = ADMIN_PASSWORD
project_name = service
project_domain_name = Default
auth_type = password

In the same file uncomment the bindir parameter with the path to the Kuryr vif binding executables. For example, if you installed it on Debian or Ubuntu:

[DEFAULT]
bindir = /usr/local/libexec/kuryr

How to try out nested-pods locally:

Following are the instructions for an all-in-one setup where K8s will also be running inside the same Nova VM in which Kuryr-controller and Kuryr-cni will be running. 4GB memory and 2 vCPUs, is the minimum resource requirement for the VM:

  1. To install OpenStack services run devstack with devstack/local.conf.pod-in-vm.undercloud.sample. Ensure that "trunk" service plugin is enabled in /etc/neutron/neutron.conf:

    [DEFAULT]
    service_plugins = neutron.services.l3_router.l3_router_plugin.L3RouterPlugin,neutron.services.trunk.plugin.TrunkPlugin
  2. Launch a VM with Neutron trunk port.

  3. Inside VM, install and setup Kubernetes along with Kuryr using devstack:
    • Since undercloud Neutron will be used by pods, neutron services should be disabled in localrc.
    • git clone kuryr-kubernetes at /opt/stack/.
    • In the devstack/plugin.sh, comment out configure_neutron_defaults. This method is getting UUID of default Neutron resources project, pod_subnet etc. using local neutron client and setting those values in /etc/kuryr/kuryr.conf. This will not work at the moment because Neutron is running remotely. Thats why this is being commented out and manually these variables will be configured in /etc/kuryr/kuryr.conf
    • Run devstack with devstack/local.conf.pod-in-vm.overcloud.sample.
  4. Once devstack is done and all services are up inside VM:
    • Configure /etc/kuryr/kuryr.conf to set UUID of Neutron resources from undercloud Neutron:

      [neutron_defaults]
      ovs_bridge = br-int
      pod_security_groups = <UNDERCLOUD_DEFAULT_SG_UUID>
      pod_subnet = <UNDERCLOUD_SUBNET_FOR_PODS_UUID>
      project = <UNDERCLOUD_DEFAULT_PROJECT_UUID>
      worker_nodes_subnet = <UNDERCLOUD_SUBNET_WORKER_NODES_UUID>
    • Configure “pod_vif_driver” as “nested-vlan”:

      [kubernetes]
      pod_vif_driver = nested-vlan
    • Configure binding section:

      [binding]
      driver = kuryr.lib.binding.drivers.vlan
      link_iface = <VM interface name eg. eth0>
    • Restart kuryr-k8s-controller from within devstack screen.

Now launch pods using kubectl, Undercloud Neutron will serve the networking.

How to watch K8S api-server over HTTPS :

Add absolute path of client side cert file and key file for K8S server in kuryr.conf:

[kubernetes]
api_root = https://your_server_address:server_ssl_port
ssl_client_crt_file = <absolute file path eg. /etc/kubernetes/admin.crt>
ssl_client_key_file = <absolute file path eg. /etc/kubernetes/admin.key>

If server ssl certification verification is also to be enabled, add absolute path to the ca cert:

[kubernetes]
ssl_ca_crt_file = <absolute file path eg. /etc/kubernetes/ca.crt>
ssl_verify_server_crt = True

If want to query HTTPS K8S api server with "--insecure" mode:

[kubernetes]
ssl_verify_server_crt = False

Features

  • TODO

Contribution guidelines

For the process of new feature addition, refer to the Kuryr Policy