Single Node CoreOS Kubernetes: Complete Setup Guide#

1
#!/bin/bash
2
set -euo pipefail
3

4
KUBERNETES_VERSION="1.28.0"
5
CNI_PLUGIN="flannel"
6
LOG_FILE="/var/log/k8s-setup.log"
7

8
# Logging function
9
log() {
10
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
11
}
12

13
# Error handling
14
trap 'log "ERROR: Script failed at line $LINENO"' ERR
15

16
log "Starting Kubernetes single-node setup"
17

18
# System preparation
19
prepare_system() {
20
    log "Preparing system for Kubernetes"
21

22
    # Disable swap
23
    swapoff -a
24
    sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
25

26
    # Load required kernel modules
27
    modprobe br_netfilter
28
    modprobe ip_vs
29
    modprobe ip_vs_rr
30
    modprobe ip_vs_wrr
31
    modprobe ip_vs_sh
32
    modprobe nf_conntrack
33

34
    # Make modules persistent
35
    cat > /etc/modules-load.d/k8s.conf << EOF
36
br_netfilter
37
ip_vs
38
ip_vs_rr
39
ip_vs_wrr
40
ip_vs_sh
41
nf_conntrack
42
EOF
43

44
    # Configure sysctl settings
45
    cat > /etc/sysctl.d/k8s.conf << EOF
46
net.bridge.bridge-nf-call-ip6tables = 1
47
net.bridge.bridge-nf-call-iptables = 1
48
net.ipv4.ip_forward = 1
49
vm.swappiness = 0
50
EOF
51

52
    sysctl --system
53
    log "System preparation completed"
54
}
55

56
# Install Docker
57
install_docker() {
58
    log "Installing Docker"
59

60
    # Install Docker from official repository
61
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
62
    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
63
    apt-get update
64
    apt-get install -y docker-ce docker-ce-cli containerd.io
65

66
    # Configure Docker daemon
67
    mkdir -p /etc/docker
68
    cat > /etc/docker/daemon.json << EOF
69
{
70
    "exec-opts": ["native.cgroupdriver=systemd"],
71
    "log-driver": "json-file",
72
    "log-opts": {
73
        "max-size": "100m",
74
        "max-file": "3"
75
    },
76
    "storage-driver": "overlay2",
77
    "storage-opts": [
78
        "overlay2.override_kernel_check=true"
79
    ],
80
    "registry-mirrors": ["https://mirror.gcr.io"],
81
    "insecure-registries": ["localhost:5000"]
82
}
83
EOF
84

85
    systemctl daemon-reload
86
    systemctl enable docker
87
    systemctl start docker
88

89
    # Add core user to docker group
90
    usermod -aG docker core
91

92
    log "Docker installation completed"
93
}
94

95
# Install Kubernetes components
96
install_kubernetes() {
97
    log "Installing Kubernetes components"
98

99
    # Add Kubernetes repository
100
    curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
101
    echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" > /etc/apt/sources.list.d/kubernetes.list
102

103
    apt-get update
104
    apt-get install -y kubelet=$KUBERNETES_VERSION-00 kubeadm=$KUBERNETES_VERSION-00 kubectl=$KUBERNETES_VERSION-00
105
    apt-mark hold kubelet kubeadm kubectl
106

107
    # Configure kubelet
108
    cat > /etc/default/kubelet << EOF
109
KUBELET_EXTRA_ARGS="--fail-swap-on=false --container-runtime=docker --cgroup-driver=systemd"
110
EOF
111

112
    systemctl daemon-reload
113
    systemctl enable kubelet
114

115
    log "Kubernetes components installed"
116
}
117

118
# Initialize Kubernetes cluster
119
initialize_cluster() {
120
    log "Initializing Kubernetes cluster"
121

122
    # Initialize cluster with kubeadm
123
    kubeadm init \
124
        --config=/etc/kubernetes/kubeadm-config.yaml \
125
        --upload-certs \
126
        --v=5 2>&1 | tee -a "$LOG_FILE"
127

128
    # Setup kubectl for core user
129
    mkdir -p /home/core/.kube
130
    cp -i /etc/kubernetes/admin.conf /home/core/.kube/config
131
    chown core:core /home/core/.kube/config
132

133
    # Setup kubectl for root
134
    export KUBECONFIG=/etc/kubernetes/admin.conf
135
    echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> /root/.bashrc
136

137
    log "Cluster initialization completed"
138
}
139

140
# Remove taints from master node (single-node setup)
141
configure_single_node() {
142
    log "Configuring single-node cluster"
143

144
    # Remove master node taint to allow scheduling
145
    kubectl taint nodes --all node-role.kubernetes.io/control-plane- || true
146
    kubectl taint nodes --all node-role.kubernetes.io/master- || true
147

148
    log "Single-node configuration completed"
149
}
150

151
# Install CNI plugin
152
install_cni() {
153
    log "Installing CNI plugin: $CNI_PLUGIN"
154

155
    case $CNI_PLUGIN in
156
        "flannel")
157
            kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
158
            ;;
159
        "calico")
160
            kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/tigera-operator.yaml
161
            kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/custom-resources.yaml
162
            ;;
163
        "weave")
164
            kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"
165
            ;;
166
    esac
167

168
    log "CNI plugin installation completed"
169
}
170

171
# Verify cluster setup
172
verify_cluster() {
173
    log "Verifying cluster setup"
174

175
    # Wait for nodes to be ready
176
    timeout=300
177
    while [[ $timeout -gt 0 ]]; do
178
        if kubectl get nodes | grep -q "Ready"; then
179
            break
180
        fi
181
        sleep 10
182
        ((timeout-=10))
183
    done
184

185
    # Display cluster information
186
    kubectl cluster-info
187
    kubectl get nodes -o wide
188
    kubectl get pods --all-namespaces
189

190
    log "Cluster verification completed"
191
}
192

193
# Main execution
194
main() {
195
    log "Starting Kubernetes single-node cluster setup"
196

197
    prepare_system
198
    install_docker
199
    install_kubernetes
200
    initialize_cluster
201
    configure_single_node
202
    install_cni
203
    verify_cluster
204

205
    log "Kubernetes single-node cluster setup completed successfully"
206
    log "Run 'kubectl get nodes' to verify cluster status"
207
    log "Run 'kubectl get pods --all-namespaces' to see system pods"
208
}
209

210
# Execute main function
211
main "$@"

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: kube-flannel-cfg
5
  namespace: kube-system
6
  labels:
7
    tier: node
8
    app: flannel
9
data:
10
  cni-conf.json: |
11
    {
12
      "name": "cbr0",
13
      "cniVersion": "0.3.1",
14
      "plugins": [
15
        {
16
          "type": "flannel",
17
          "delegate": {
18
            "hairpinMode": true,
19
            "isDefaultGateway": true
20
          }
21
        },
22
        {
23
          "type": "portmap",
24
          "capabilities": {
25
            "portMappings": true
26
          }
27
        }
28
      ]
29
    }
30
  net-conf.json: |
31
    {
32
      "Network": "10.244.0.0/16",
33
      "Backend": {
34
        "Type": "vxlan"
35
      }
36
    }
37
---
38
apiVersion: apps/v1
39
kind: DaemonSet
40
metadata:
41
  name: kube-flannel-ds
42
  namespace: kube-system
43
  labels:
44
    tier: node
45
    app: flannel
46
spec:
47
  selector:
48
    matchLabels:
49
      app: flannel
50
  template:
51
    metadata:
52
      labels:
53
        tier: node
54
        app: flannel
55
    spec:
56
      affinity:
57
        nodeAffinity:
58
          requiredDuringSchedulingIgnoredDuringExecution:
59
            nodeSelectorTerms:
60
              - matchExpressions:
61
                  - key: kubernetes.io/os
62
                    operator: In
63
                    values:
64
                      - linux
65
      hostNetwork: true
66
      priorityClassName: system-node-critical
67
      tolerations:
68
        - operator: Exists
69
          effect: NoSchedule
70
      serviceAccountName: flannel
71
      initContainers:
72
        - name: install-cni-plugin
73
          image: rancher/mirrored-flannelcni-flannel-cni-plugin:v1.1.0
74
          command:
75
            - cp
76
          args:
77
            - -f
78
            - /flannel
79
            - /opt/cni/bin/flannel
80
          volumeMounts:
81
            - name: cni-plugin
82
              mountPath: /opt/cni/bin
83
        - name: install-cni
84
          image: rancher/mirrored-flannelcni-flannel:v0.19.2
85
          command:
86
            - cp
87
          args:
88
            - -f
89
            - /etc/kube-flannel/cni-conf.json
90
            - /etc/cni/net.d/10-flannel.conflist
91
          volumeMounts:
92
            - name: cni
93
              mountPath: /etc/cni/net.d
94
            - name: flannel-cfg
95
              mountPath: /etc/kube-flannel/
96
      containers:
97
        - name: kube-flannel
98
          image: rancher/mirrored-flannelcni-flannel:v0.19.2
99
          command:
100
            - /opt/bin/flanneld
101
          args:
102
            - --ip-masq
103
            - --kube-subnet-mgr
104
          resources:
105
            requests:
106
              cpu: "100m"
107
              memory: "50Mi"
108
            limits:
109
              cpu: "100m"
110
              memory: "50Mi"
111
          securityContext:
112
            privileged: false
113
            capabilities:
114
              add: ["NET_ADMIN", "NET_RAW"]
115
          env:
116
            - name: POD_NAME
117
              valueFrom:
118
                fieldRef:
119
                  fieldPath: metadata.name
120
            - name: POD_NAMESPACE
121
              valueFrom:
122
                fieldRef:
123
                  fieldPath: metadata.namespace
124
            - name: EVENT_QUEUE_DEPTH
125
              value: "5000"
126
          volumeMounts:
127
            - name: run
128
              mountPath: /run/flannel
129
            - name: flannel-cfg
130
              mountPath: /etc/kube-flannel/
131
            - name: xtables-lock
132
              mountPath: /run/xtables.lock
133
      volumes:
134
        - name: run
135
          hostPath:
136
            path: /run/flannel
137
        - name: cni-plugin
138
          hostPath:
139
            path: /opt/cni/bin
140
        - name: cni
141
          hostPath:
142
            path: /etc/cni/net.d
143
        - name: flannel-cfg
144
          configMap:
145
            name: kube-flannel-cfg
146
        - name: xtables-lock
147
          hostPath:
148
            path: /run/xtables.lock
149
            type: FileOrCreate

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: default-deny-all
5
  namespace: default
6
spec:
7
  podSelector: {}
8
  policyTypes:
9
    - Ingress
10
    - Egress
11
---
12
apiVersion: networking.k8s.io/v1
13
kind: NetworkPolicy
14
metadata:
15
  name: allow-dns
16
  namespace: default
17
spec:
18
  podSelector: {}
19
  policyTypes:
20
    - Egress
21
  egress:
22
    - to: []
23
      ports:
24
        - protocol: UDP
25
          port: 53
26
        - protocol: TCP
27
          port: 53
28
---
29
apiVersion: networking.k8s.io/v1
30
kind: NetworkPolicy
31
metadata:
32
  name: allow-kube-system
33
  namespace: default
34
spec:
35
  podSelector: {}
36
  policyTypes:
37
    - Ingress
38
    - Egress
39
  ingress:
40
    - from:
41
        - namespaceSelector:
42
            matchLabels:
43
              name: kube-system
44
  egress:
45
    - to:
46
        - namespaceSelector:
47
            matchLabels:
48
              name: kube-system

1
apiVersion: storage.k8s.io/v1
2
kind: StorageClass
3
metadata:
4
  name: local-storage
5
provisioner: kubernetes.io/no-provisioner
6
volumeBindingMode: WaitForFirstConsumer
7
reclaimPolicy: Delete
8
---
9
apiVersion: v1
10
kind: PersistentVolume
11
metadata:
12
  name: local-pv-1
13
spec:
14
  capacity:
15
    storage: 10Gi
16
  volumeMode: Filesystem
17
  accessModes:
18
    - ReadWriteOnce
19
  persistentVolumeReclaimPolicy: Delete
20
  storageClassName: local-storage
21
  local:
22
    path: /opt/local-storage/pv1
23
  nodeAffinity:
24
    required:
25
      nodeSelectorTerms:
26
        - matchExpressions:
27
            - key: kubernetes.io/hostname
28
              operator: In
29
              values:
30
                - coreos-single-node
31
---
32
apiVersion: v1
33
kind: PersistentVolume
34
metadata:
35
  name: local-pv-2
36
spec:
37
  capacity:
38
    storage: 20Gi
39
  volumeMode: Filesystem
40
  accessModes:
41
    - ReadWriteOnce
42
  persistentVolumeReclaimPolicy: Delete
43
  storageClassName: local-storage
44
  local:
45
    path: /opt/local-storage/pv2
46
  nodeAffinity:
47
    required:
48
      nodeSelectorTerms:
49
        - matchExpressions:
50
            - key: kubernetes.io/hostname
51
              operator: In
52
              values:
53
                - coreos-single-node

1
#!/bin/bash
2
# Create directories for local storage
3
mkdir -p /opt/local-storage/{pv1,pv2,pv3,pv4,pv5}
4

5
# Set proper permissions
6
chmod 755 /opt/local-storage/*
7
chown -R root:root /opt/local-storage
8

9
# Install local-path-provisioner for dynamic provisioning
10
kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.24/deploy/local-path-storage.yaml
11

12
# Set as default storage class
13
kubectl patch storageclass local-path -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
14

15
# Verify storage setup
16
kubectl get storageclass
17
kubectl get pv

1
apiVersion: v1
2
kind: ServiceAccount
3
metadata:
4
  name: admin-user
5
  namespace: kube-system
6
---
7
apiVersion: rbac.authorization.k8s.io/v1
8
kind: ClusterRoleBinding
9
metadata:
10
  name: admin-user
11
roleRef:
12
  apiGroup: rbac.authorization.k8s.io
13
  kind: ClusterRole
14
  name: cluster-admin
15
subjects:
16
  - kind: ServiceAccount
17
    name: admin-user
18
    namespace: kube-system
19
---
20
apiVersion: v1
21
kind: ServiceAccount
22
metadata:
23
  name: dashboard-readonly
24
  namespace: kube-system
25
---
26
apiVersion: rbac.authorization.k8s.io/v1
27
kind: ClusterRole
28
metadata:
29
  name: dashboard-readonly
30
rules:
31
  - apiGroups: [""]
32
    resources: ["*"]
33
    verbs: ["get", "list", "watch"]
34
  - apiGroups: ["apps", "extensions"]
35
    resources: ["*"]
36
    verbs: ["get", "list", "watch"]
37
---
38
apiVersion: rbac.authorization.k8s.io/v1
39
kind: ClusterRoleBinding
40
metadata:
41
  name: dashboard-readonly
42
roleRef:
43
  apiGroup: rbac.authorization.k8s.io
44
  kind: ClusterRole
45
  name: dashboard-readonly
46
subjects:
47
  - kind: ServiceAccount
48
    name: dashboard-readonly
49
    namespace: kube-system

1
apiVersion: v1
2
kind: Namespace
3
metadata:
4
  name: secure-namespace
5
  labels:
6
    pod-security.kubernetes.io/enforce: restricted
7
    pod-security.kubernetes.io/audit: restricted
8
    pod-security.kubernetes.io/warn: restricted
9
---
10
apiVersion: v1
11
kind: LimitRange
12
metadata:
13
  name: resource-limits
14
  namespace: secure-namespace
15
spec:
16
  limits:
17
    - default:
18
        cpu: "200m"
19
        memory: "256Mi"
20
      defaultRequest:
21
        cpu: "100m"
22
        memory: "128Mi"
23
      type: Container
24
    - max:
25
        cpu: "1"
26
        memory: "1Gi"
27
      min:
28
        cpu: "50m"
29
        memory: "64Mi"
30
      type: Container
31
---
32
apiVersion: v1
33
kind: ResourceQuota
34
metadata:
35
  name: resource-quota
36
  namespace: secure-namespace
37
spec:
38
  hard:
39
    requests.cpu: "2"
40
    requests.memory: 4Gi
41
    limits.cpu: "4"
42
    limits.memory: 8Gi
43
    pods: "10"
44
    services: "5"
45
    persistentvolumeclaims: "3"

1
#!/bin/bash
2
# Enable audit logging
3
mkdir -p /var/log/kubernetes
4

5
cat > /etc/kubernetes/audit-policy.yaml << EOF
6
apiVersion: audit.k8s.io/v1
7
kind: Policy
8
rules:
9
- level: Metadata
10
  resources:
11
  - group: ""
12
    resources: ["secrets", "configmaps"]
13
- level: RequestResponse
14
  resources:
15
  - group: ""
16
    resources: ["pods", "services"]
17
- level: Request
18
  namespaces: ["kube-system"]
19
EOF
20

21
# Update API server configuration
22
sed -i '/--enable-admission-plugins/s/$/,PodSecurityPolicy/' /etc/kubernetes/manifests/kube-apiserver.yaml
23
sed -i '/--enable-admission-plugins/a\    - --audit-log-path=/var/log/kubernetes/audit.log' /etc/kubernetes/manifests/kube-apiserver.yaml
24
sed -i '/--audit-log-path/a\    - --audit-policy-file=/etc/kubernetes/audit-policy.yaml' /etc/kubernetes/manifests/kube-apiserver.yaml
25
sed -i '/--audit-policy-file/a\    - --audit-log-maxage=30' /etc/kubernetes/manifests/kube-apiserver.yaml
26
sed -i '/--audit-log-maxage/a\    - --audit-log-maxbackup=3' /etc/kubernetes/manifests/kube-apiserver.yaml
27
sed -i '/--audit-log-maxbackup/a\    - --audit-log-maxsize=100' /etc/kubernetes/manifests/kube-apiserver.yaml
28

29
# Restart kubelet to apply changes
30
systemctl restart kubelet
31

32
echo "Security hardening applied. Monitor /var/log/kubernetes/audit.log for security events."

1
apiVersion: v1
2
kind: Namespace
3
metadata:
4
  name: monitoring
5
---
6
apiVersion: apps/v1
7
kind: Deployment
8
metadata:
9
  name: prometheus
10
  namespace: monitoring
11
spec:
12
  replicas: 1
13
  selector:
14
    matchLabels:
15
      app: prometheus
16
  template:
17
    metadata:
18
      labels:
19
        app: prometheus
20
    spec:
21
      containers:
22
        - name: prometheus
23
          image: prom/prometheus:v2.45.0
24
          ports:
25
            - containerPort: 9090
26
          args:
27
            - "--config.file=/etc/prometheus/prometheus.yml"
28
            - "--storage.tsdb.path=/prometheus/"
29
            - "--web.console.libraries=/etc/prometheus/console_libraries"
30
            - "--web.console.templates=/etc/prometheus/consoles"
31
            - "--storage.tsdb.retention.time=200h"
32
            - "--web.enable-lifecycle"
33
          volumeMounts:
34
            - name: prometheus-config
35
              mountPath: /etc/prometheus/
36
            - name: prometheus-storage
37
              mountPath: /prometheus/
38
      volumes:
39
        - name: prometheus-config
40
          configMap:
41
            name: prometheus-config
42
        - name: prometheus-storage
43
          emptyDir: {}
44
---
45
apiVersion: v1
46
kind: ConfigMap
47
metadata:
48
  name: prometheus-config
49
  namespace: monitoring
50
data:
51
  prometheus.yml: |
52
    global:
53
      scrape_interval: 15s
54
      evaluation_interval: 15s
55

56
    rule_files:
57
      - "first_rules.yml"
58

59
    scrape_configs:
60
      - job_name: 'prometheus'
61
        static_configs:
62
          - targets: ['localhost:9090']
63

64
      - job_name: 'kubernetes-apiservers'
65
        kubernetes_sd_configs:
66
        - role: endpoints
67
        scheme: https
68
        tls_config:
69
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
70
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
71
        relabel_configs:
72
        - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
73
          action: keep
74
          regex: default;kubernetes;https
75

76
      - job_name: 'kubernetes-nodes'
77
        kubernetes_sd_configs:
78
        - role: node
79
        scheme: https
80
        tls_config:
81
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
82
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
83
        relabel_configs:
84
        - action: labelmap
85
          regex: __meta_kubernetes_node_label_(.+)
86
        - target_label: __address__
87
          replacement: kubernetes.default.svc:443
88
        - source_labels: [__meta_kubernetes_node_name]
89
          regex: (.+)
90
          target_label: __metrics_path__
91
          replacement: /api/v1/nodes/${1}/proxy/metrics
92

93
      - job_name: 'kubernetes-pods'
94
        kubernetes_sd_configs:
95
        - role: pod
96
        relabel_configs:
97
        - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
98
          action: keep
99
          regex: true
100
        - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
101
          action: replace
102
          target_label: __metrics_path__
103
          regex: (.+)
104
        - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
105
          action: replace
106
          regex: ([^:]+)(?::\d+)?;(\d+)
107
          replacement: $1:$2
108
          target_label: __address__
109
        - action: labelmap
110
          regex: __meta_kubernetes_pod_label_(.+)
111
        - source_labels: [__meta_kubernetes_namespace]
112
          action: replace
113
          target_label: kubernetes_namespace
114
        - source_labels: [__meta_kubernetes_pod_name]
115
          action: replace
116
          target_label: kubernetes_pod_name
117
---
118
apiVersion: v1
119
kind: Service
120
metadata:
121
  name: prometheus
122
  namespace: monitoring
123
spec:
124
  type: NodePort
125
  ports:
126
    - port: 9090
127
      targetPort: 9090
128
      nodePort: 30090
129
  selector:
130
    app: prometheus

1
apiVersion: apps/v1
2
kind: DaemonSet
3
metadata:
4
  name: node-exporter
5
  namespace: monitoring
6
  labels:
7
    app: node-exporter
8
spec:
9
  selector:
10
    matchLabels:
11
      app: node-exporter
12
  template:
13
    metadata:
14
      labels:
15
        app: node-exporter
16
      annotations:
17
        prometheus.io/scrape: "true"
18
        prometheus.io/port: "9100"
19
    spec:
20
      hostPID: true
21
      hostIPC: true
22
      hostNetwork: true
23
      containers:
24
        - name: node-exporter
25
          image: prom/node-exporter:v1.6.0
26
          ports:
27
            - containerPort: 9100
28
          args:
29
            - "--path.sysfs=/host/sys"
30
            - "--path.rootfs=/host/root"
31
            - "--no-collector.wifi"
32
            - "--no-collector.hwmon"
33
            - "--collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+)($|/)"
34
            - "--collector.filesystem.ignored-fs-types=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
35
          resources:
36
            requests:
37
              memory: 30Mi
38
              cpu: 100m
39
            limits:
40
              memory: 50Mi
41
              cpu: 200m
42
          volumeMounts:
43
            - name: dev
44
              mountPath: /host/dev
45
            - name: proc
46
              mountPath: /host/proc
47
            - name: sys
48
              mountPath: /host/sys
49
            - name: rootfs
50
              mountPath: /host/root
51
      tolerations:
52
        - operator: Exists
53
      volumes:
54
        - name: proc
55
          hostPath:
56
            path: /proc
57
        - name: dev
58
          hostPath:
59
            path: /dev
60
        - name: sys
61
          hostPath:
62
            path: /sys
63
        - name: rootfs
64
          hostPath:
65
            path: /

1
#!/bin/bash
2
# Comprehensive troubleshooting script for single-node Kubernetes
3

4
# Check cluster health
5
check_cluster_health() {
6
    echo "=== Cluster Health Check ==="
7

8
    echo "Node Status:"
9
    kubectl get nodes -o wide
10

11
    echo "System Pods Status:"
12
    kubectl get pods -n kube-system
13

14
    echo "API Server Health:"
15
    kubectl get --raw='/readyz'
16

17
    echo "etcd Health:"
18
    kubectl get pods -n kube-system -l component=etcd
19

20
    echo "Component Status:"
21
    kubectl get componentstatuses
22
}
23

24
# Check resource usage
25
check_resources() {
26
    echo "=== Resource Usage ==="
27

28
    echo "Node Resource Usage:"
29
    kubectl top nodes
30

31
    echo "Pod Resource Usage:"
32
    kubectl top pods --all-namespaces
33

34
    echo "Disk Usage:"
35
    df -h
36

37
    echo "Memory Usage:"
38
    free -h
39

40
    echo "Docker Images:"
41
    docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"
42
}
43

44
# Check networking
45
check_networking() {
46
    echo "=== Networking Check ==="
47

48
    echo "Pod Network Status:"
49
    kubectl get pods -n kube-system -l app=flannel
50

51
    echo "Service Status:"
52
    kubectl get svc --all-namespaces
53

54
    echo "Network Policies:"
55
    kubectl get networkpolicies --all-namespaces
56

57
    echo "DNS Test:"
58
    kubectl run test-dns --image=busybox --rm -it --restart=Never -- nslookup kubernetes.default
59
}
60

61
# Check logs
62
check_logs() {
63
    echo "=== System Logs ==="
64

65
    echo "Kubelet Logs:"
66
    journalctl -u kubelet --no-pager -n 20
67

68
    echo "Docker Logs:"
69
    journalctl -u docker --no-pager -n 10
70

71
    echo "Failed Pods:"
72
    kubectl get pods --all-namespaces --field-selector=status.phase=Failed
73
}
74

75
# Clean up resources
76
cleanup_resources() {
77
    echo "=== Cleanup Resources ==="
78

79
    echo "Removing failed pods:"
80
    kubectl delete pods --all-namespaces --field-selector=status.phase=Failed
81

82
    echo "Cleaning Docker:"
83
    docker system prune -f
84

85
    echo "Cleaning unused images:"
86
    docker image prune -f
87

88
    echo "Restart kubelet if needed:"
89
    read -p "Restart kubelet? (y/N): " restart_kubelet
90
    if [[ $restart_kubelet == "y" ]]; then
91
        systemctl restart kubelet
92
    fi
93
}
94

95
# Performance optimization
96
optimize_performance() {
97
    echo "=== Performance Optimization ==="
98

99
    # Optimize kernel parameters
100
    echo "net.core.somaxconn = 32768" >> /etc/sysctl.conf
101
    echo "net.ipv4.tcp_max_syn_backlog = 32768" >> /etc/sysctl.conf
102
    echo "net.core.netdev_max_backlog = 32768" >> /etc/sysctl.conf
103
    sysctl -p
104

105
    # Configure Docker logging
106
    cat > /etc/docker/daemon.json << EOF
107
{
108
    "log-driver": "json-file",
109
    "log-opts": {
110
        "max-size": "100m",
111
        "max-file": "3"
112
    }
113
}
114
EOF
115

116
    systemctl restart docker
117

118
    echo "Performance optimizations applied"
119
}
120

121
# Main menu
122
main() {
123
    while true; do
124
        echo "=== Kubernetes Troubleshooting Toolkit ==="
125
        echo "1. Check Cluster Health"
126
        echo "2. Check Resource Usage"
127
        echo "3. Check Networking"
128
        echo "4. Check Logs"
129
        echo "5. Cleanup Resources"
130
        echo "6. Optimize Performance"
131
        echo "7. Exit"
132

133
        read -p "Select option (1-7): " choice
134

135
        case $choice in
136
            1) check_cluster_health ;;
137
            2) check_resources ;;
138
            3) check_networking ;;
139
            4) check_logs ;;
140
            5) cleanup_resources ;;
141
            6) optimize_performance ;;
142
            7) exit 0 ;;
143
            *) echo "Invalid option" ;;
144
        esac
145

146
        echo
147
        read -p "Press Enter to continue..."
148
        clear
149
    done
150
}
151

152
main "$@"