自分の勉強用のメモです。

AWSのEC2上でEKSのクラスタを作成する

1.SSHで EC2のインスタンスにログインして AWS CLI をセットアップします。

一旦、EC2上のBastion用のサーバーとかにSSHでログインします。
EC2にログイン後、以下のコマンドを実行してCLIをセットアップします。

aws configure

公式ドキュメント
https://docs.aws.amazon.com/ja_jp/cli/latest/userguide/cli-chap-configure.html

2.認証情報の表示

以下のコマンドでAWSのAccount、UserID、Arnが取得できます。

aws sts get-caller-identity

参考にさせていただいたQiitaの記事
https://qiita.com/kooohei/items/2a8a09e5f36bac614879

3.クラスタの作成

eksctl create cluster --name test --region=us-east-1 --node-type t3.medium --nodes 3

ターミナルの出力例

[ℹ]  eksctl version 0.11.1
[ℹ]  using region us-east-1
[ℹ]  setting availability zones to [us-east-1c us-east-1f]
[ℹ]  subnets for us-east-1c - public:***.***.0.0/19 private:***.***.64.0/19
[ℹ]  subnets for us-east-1f - public:***.***.32.0/19 private:***.***.96.0/19
[ℹ]  nodegroup "ng-07a533c2" will use "ami-*****" [AmazonLinux2/1.14]
[ℹ]  using Kubernetes version 1.14
[ℹ]  creating EKS cluster "test" in "us-east-1" region with un-managed nodes
[ℹ]  will create 2 separate CloudFormation stacks for cluster itself and the initial nodegroup
[ℹ]  if you encounter any issues, check CloudFormation console or try 'eksctl utils describe-stacks --region=us-east-1 --cluster=test'
[ℹ]  CloudWatch logging will not be enabled for cluster "test" in "us-east-1"
[ℹ]  you can enable it with 'eksctl utils update-cluster-logging --region=us-east-1 --cluster=test'
[ℹ]  Kubernetes API endpoint access will use default of {publicAccess=true, privateAccess=false} for cluster "test" in "us-east-1"
[ℹ]  2 sequential tasks: { create cluster control plane "test", create nodegroup "ng-07a533c2" }
[ℹ]  building cluster stack "eksctl-test-cluster"
[ℹ]  deploying stack "eksctl-test-cluster"
[ℹ]  building nodegroup stack "eksctl-test-nodegroup-ng-07a533c2"
[ℹ]  --nodes-min=3 was set automatically for nodegroup ng-07a533c2
[ℹ]  --nodes-max=3 was set automatically for nodegroup ng-07a533c2
[ℹ]  deploying stack "eksctl-test-nodegroup-ng-07a533c2"
[✔]  all EKS cluster resources for "test" have been created
[✔]  saved kubeconfig as "/home/user/.kube/config"
[ℹ]  adding identity "arn:aws:iam::*****:role/eksctl-test-nodegroup-ng-07a533c2-NodeInstanceRole-1DJPUV1THLN54" to auth ConfigMap
[ℹ]  nodegroup "ng-07a533c2" has 0 node(s)
[ℹ]  waiting for at least 3 node(s) to become ready in "ng-07a533c2"
[ℹ]  nodegroup "ng-07a533c2" has 3 node(s)
[ℹ]  node "**126.ec2.internal" is ready
[ℹ]  node "**152.ec2.internal" is ready
[ℹ]  node "**111.ec2.internal" is ready
[ℹ]  kubectl command should work with "/home/user/.kube/config", try 'kubectl get nodes'
[✔]  EKS cluster "test" in "us-east-1" region is ready

node-typeにはインスタンスタイプを指定します。
インスタンスタイプ
https://aws.amazon.com/jp/ec2/instance-types/

nodeの数を指定していない場合は、2個作成されます。(デフォルトが2)

公式ドキュメント
https://docs.aws.amazon.com/ja_jp/eks/latest/userguide/create-cluster.html

途中ターミナルが止まったかのように見えましたが(汗)、15分くらいで出来上がりました。

ノードを確認してみます。

[user@**** ~]$ kubectl get nodes
NAME                 STATUS   ROLES    AGE    VERSION
**126.ec2.internal   Ready    <none>   104s   v1.14.7-eks-1861c5
**152.ec2.internal   Ready    <none>   105s   v1.14.7-eks-1861c5
**111.ec2.internal   Ready    <none>   105s   v1.14.7-eks-1861c5
[user@**** ~]$

クラスタを確認してみます。

[user@**** ~]$ kubectl config get-clusters
NAME
test.us-east-1.eksctl.io
[user@**** ~]$

4.その他のパラメータについて
以下は--helpの出力結果です。


[userxxx@******** ~]$ eksctl create cluster --help
Create a cluster

Usage: eksctl create cluster [flags]

General flags:
  -n, --name string               EKS cluster name (generated if unspecified, e.g. "hilarious-wardrobe-1577715578")
      --tags stringToString       A list of KV pairs used to tag the AWS resources (e.g. "Owner=John Doe,Team=Some Team") (default [])
  -r, --region string             AWS region
      --zones strings             (auto-select if unspecified)
      --version string            Kubernetes version (valid options: 1.12, 1.13, 1.14) (default "1.14")
  -f, --config-file string        load configuration from a file (or stdin if set to '-')
      --timeout duration          maximum waiting time for any long-running operation (default 25m0s)
      --install-vpc-controllers   Install VPC controller that's required for Windows workloads
      --managed                   Create EKS-managed nodegroup
      --fargate                   Create a Fargate profile scheduling pods in the default and kube-system namespaces onto Fargate

Initial nodegroup flags:
      --nodegroup-name string          name of the nodegroup (generated if unspecified, e.g. "ng-1a88f5a7")
      --without-nodegroup              if set, initial nodegroup will not be created
  -t, --node-type string               node instance type (default "m5.large")
  -N, --nodes int                      total number of nodes (for a static ASG) (default 2)
  -m, --nodes-min int                  minimum nodes in ASG (default 2)
  -M, --nodes-max int                  maximum nodes in ASG (default 2)
      --node-volume-size int           node volume size in GB
      --node-volume-type string        node volume type (valid options: gp2, io1, sc1, st1) (default "gp2")
      --max-pods-per-node int          maximum number of pods per node (set automatically if unspecified)
      --ssh-access                     control SSH access for nodes. Uses ~/.ssh/id_rsa.pub as default key path if enabled
      --ssh-public-key string          SSH public key to use for nodes (import from local path, or use existing EC2 key pair)
      --node-ami string                Advanced use cases only. If 'static' is supplied (default) then eksctl will use static AMIs; if 'auto' is supplied then eksctl will automatically set the AMI based on version/region/instance type; if any other value is supplied it will override the AMI to use for the nodes. Use with extreme care. (default "static")
      --node-ami-family string         Advanced use cases only. If 'AmazonLinux2' is supplied (default), then eksctl will use the official AWS EKS AMIs (Amazon Linux 2); if 'Ubuntu1804' is supplied, then eksctl will use the official Canonical EKS AMIs (Ubuntu 18.04). (default "AmazonLinux2")
  -P, --node-private-networking        whether to make nodegroup networking private
      --node-security-groups strings   Attach additional security groups to nodes, so that it can be used to allow extra ingress/egress access from/to pods
      --node-labels stringToString     Extra labels to add when registering the nodes in the nodegroup, e.g. "partition=backend,nodeclass=hugememory" (default [])
      --node-zones strings             (inherited from the cluster if unspecified)

Cluster and nodegroup add-ons flags:
      --asg-access            enable IAM policy for cluster-autoscaler
      --external-dns-access   enable IAM policy for external-dns
      --full-ecr-access       enable full access to ECR
      --appmesh-access        enable full access to AppMesh
      --alb-ingress-access    enable full access for alb-ingress-controller

VPC networking flags:
      --vpc-cidr ipNet                 global CIDR to use for VPC (default 192.168.0.0/16)
      --vpc-private-subnets strings    re-use private subnets of an existing VPC
      --vpc-public-subnets strings     re-use public subnets of an existing VPC
      --vpc-from-kops-cluster string   re-use VPC from a given kops cluster
      --vpc-nat-mode string            VPC NAT mode, valid options: HighlyAvailable, Single, Disable (default "Single")

AWS client flags:
  -p, --profile string        AWS credentials profile to use (overrides the AWS_PROFILE environment variable)
      --cfn-role-arn string   IAM role used by CloudFormation to call AWS API on your behalf

Output kubeconfig flags:
      --kubeconfig string               path to write kubeconfig (incompatible with --auto-kubeconfig) (default "/home/cloud_user/.kube/config")
      --authenticator-role-arn string   AWS IAM role to assume for authenticator
      --set-kubeconfig-context          if true then current-context will be set in kubeconfig; if a context is already set then it will be overwritten (default true)
      --auto-kubeconfig                 save kubeconfig file by cluster name, e.g. "/home/cloud_user/.kube/eksctl/clusters/hilarious-wardrobe-1577715578"
      --write-kubeconfig                toggle writing of kubeconfig (default true)

Common flags:
  -C, --color string   toggle colorized logs (valid options: true, false, fabulous) (default "true")
  -h, --help           help for this command
  -v, --verbose int    set log level, use 0 to silence, 4 for debugging and 5 for debugging with AWS debug logging (default 3)

Use 'eksctl create cluster [command] --help' for more information about a command.

EKSの Master Nodeはどこにあるのか

EKSはフルマネージド型の Kubernetes サービスなので、Masterノードは作らなくていいんですね。なるほど。（いまさら感）

こちらの記事が参考になりました。
「eksctl」コマンドを使ったAmazon EKS構築入門
https://dev.classmethod.jp/cloud/aws/getting-started-amazon-eks-with-eksctl/

Kubernetesの修行（勉強）は続く。。