KubeKey Documentation

repository·main·Indexed 25 days ago

https://github.com/kubesphere/kubekey

KubeKey is an open-source, lightweight task flow execution tool for Kubernetes installation and lifecycle management. It functions as a general-purpose task execution framework using a structured approach of Projects, Playbooks, Roles, and Tasks. The tool supports Kubernetes versions v1.23.x through v1.34.x and provides capabilities for installing private image registries like Harbor and Docker Registry, managing system dependencies across various Linux distributions, and orchestrating complex deployments via a Go template and Sprig-based syntax.

Tokens
46.4K
Snippets
118
Records
276
Agent score
84%

What's inside KubeKey

  1. Overview of KubeKey

    main

    KubeKey is an open-source, lightweight task execution framework designed for flexible and rapid Kubernetes installation. It has evolved from a Kubernetes lifecycle management tool into a general-purpose task execution tool (inspired by Ansible's workflow design).

    Key Features:

    • Task Template Management: Supports multiple sources such as Git or local files.
    • Diverse Node Connectivity: Supports local, ssh, kubernetes, and prometheus connection methods.
    • Cloud-Native Automation: Supports automated batch task management in cloud-native environments.
    • CNCF Conformance: KubeKey has passed the CNCF Kubernetes software conformance certification.
  2. Understand the KubeKey Task Execution Framework

    main
    KubeKey's task orchestration follows Ansible conventions, allowing developers to write and run custom playbook projects. The framework uses a structured approach involving Projects, Playbooks, Roles, and Tasks to orchestrate complex deployments and configurations.
  3. Use Dynamic Variables at Runtime

    main

    Dynamic variables are generated during execution and can override static variables. They include:

    • gather_facts: Information gathered about the host.
    • register: Output registered from a task.
    • set_fact: Variables explicitly set during execution.

    If multiple dynamic variables share the same name, the one defined later in the execution flow overrides the earlier one.

  4. Understand KubeKey Project Structure

    main

    A KubeKey project is a collection of YAML files used to define task templates for orchestration. KubeKey follows Ansible-like conventions. A project can contain:

    • playbooks: The execution entry points. A playbook defines a series of tasks or roles to be executed in a specific order.
    • roles: Reusable groups of tasks.

    Typical directory structure:

    project/
    ├── playbooks/          # Optional: directory for playbook files
    │   ├── playbook1.yaml
    │   └── playbook2.yaml
    ├── playbook1.yaml      # Alternatively, place playbooks in the root
    ├── playbook2.yaml
    └── roles/
        ├── roleName1/
        └── roleName2/
  5. Understand the experimental status of the exp package

    main
    The exp package contains experimental code and API types. It does not adhere to any compatibility guarantees. Users should be aware that components within this package may be moved to stable/GA packages or removed entirely without notice.
  6. Understand Variable Priority in KubeKey

    main

    KubeKey uses two types of variables: Static variables (defined before execution) and Dynamic variables (generated during execution).

    Priority Rules:

    1. Dynamic variables always override Static variables.
    2. For Static variables, the priority is: Global config > Inventory > Parameters defined in templates.
    3. Within Inventory, the priority is: Host variables > Group variables > Global variables.
    4. For Dynamic variables, later definitions override earlier ones with the same name.
  7. Prepare resources with the init phase

    main

    The init phase prepares the environment and dependencies required for the cluster installation. It performs the following tasks:

    • Software Downloads: Fetches binaries for Kubernetes, container runtimes, and network plugins.
    • Helm Preparation: Acquires and validates required Helm Chart packages.
    • Image Pulling: Downloads Docker images for core components and dependencies.
    • Offline Packaging: If offline mode is enabled, bundles all binaries, images, and Charts into a complete offline installation package.
    • Certificate Management: Generates CA and service certificates for inter-component communication.
  8. Deploy components with the install phase

    main

    The install phase is the core deployment stage where KubeKey configures the Kubernetes cluster. The following components can be installed:

    • nfs: Installs NFS service for nodes in the nfs group.
    • image_registry: Installs a registry (harbor or registry) for nodes in the image_registry group.
    • etcd: Installs etcd for nodes in the etcd group.
    • cri: Installs the container runtime (docker or containerd) for nodes in the k8s_cluster group.
    • kubernetes_install: Installs Kubernetes for nodes in the k8s_cluster group.
    • helm: Installs Helm applications and CNI plugins (supports calico, cilium, flannel, hybridnet, kubeovn, multus).
  9. Use the gen_cert module to validate or generate certificates

    main

    The gen_cert module is used to validate existing certificate files or generate new ones. It can be used to create a self-signed Root CA or to sign server certificates using an existing CA.

    Parameters

    ParameterDescriptionTypeRequiredDefault
    root_keyCA private key pathstringNo-
    root_certCA certificate pathstringNo-
    dateCertificate validity periodstringNo1y
    policyGeneration policy: Always, IfNotPresent, NonestringNoIfNotPresent
    sansSubject Alternative Names (IP/DNS list)string arrayNo-
    cnCommon NamestringYes-
    out_keyOutput private key pathstringYes-
    out_certOutput certificate pathstringYes-

    Generation Policies (policy)

    • Always: Always regenerate and overwrite out_key and out_cert.
    • IfNotPresent: Generate if files do not exist; if they exist, validate them and regenerate only if validation fails.
    • None: Only validate existing files. Do not generate new files; if files do not exist, do nothing.