{"id":22748123,"url":"https://github.com/githubfoam/k8s-external-etcd-weavenet-remote-sandbox","last_synced_at":"2026-04-28T22:31:10.046Z","repository":{"id":45335143,"uuid":"236872483","full_name":"githubfoam/k8s-external-etcd-weavenet-remote-sandbox","owner":"githubfoam","description":"k8s external etcd weavenet pod network","archived":false,"fork":false,"pushed_at":"2020-01-29T00:23:38.000Z","size":32,"stargazers_count":0,"open_issues_count":2,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-30T05:42:44.664Z","etag":null,"topics":["etcd","external","k8s","weave"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/githubfoam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-01-29T00:21:48.000Z","updated_at":"2020-06-25T16:49:39.000Z","dependencies_parsed_at":"2022-09-12T16:03:26.892Z","dependency_job_id":null,"html_url":"https://github.com/githubfoam/k8s-external-etcd-weavenet-remote-sandbox","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/githubfoam/k8s-external-etcd-weavenet-remote-sandbox","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/githubfoam","download_url":"https://codeload.github.com/githubfoam/k8s-external-etcd-weavenet-remote-sandbox/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32402666,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-28T19:38:08.556Z","status":"ssl_error","status_checked_at":"2026-04-28T19:37:55.688Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["etcd","external","k8s","weave"],"created_at":"2024-12-11T03:20:02.812Z","updated_at":"2026-04-28T22:31:10.027Z","avatar_url":"https://github.com/githubfoam.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kubernetes sandbox with an external etcd cluster\ncross platform(freebsd,lin,win,mac..etc)\n~~~~\nload balancer: haproxy + heartbeat\ndistributed reliable key-value store:etcd\ncontainer runtimes:docker\npod network:weave-net\n\n[preflight] Running pre-flight checks\n[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 18.09.8. Latest validated version: 18.06\nthe docker-ce-cli package was introduced in Docker CE 18.09.\n\nsubnet\n192.168.0.0/16\n\nHAProxy + heartbeat virtual IP\n192.168.10.1\n\nEtcd \u0026 HAProxy + heartbeat computes\nvgetcd01 192.168.10.2 (HAProxy + heartbeat)\nvgetcd02 192.168.10.3 (HAProxy + heartbeat)\nvgetcd03 192.168.10.4\n\n\nK8s computes\nvgmaster01 192.168.10.5\nvgmaster01 192.168.10.6\n\n\nK8s workers\nvgworker01 192.168.10.7\nvgworker02 192.168.10.8\nvgworker02 192.168.10.9\n\n~~~~\n\n~~~~\n\u003evagrant up\n\u003evagrant ssh vgclient01\n\nvagrant@vgclient01:~$ sudo ansible-playbook -i /vagrant/provisioning/hosts /vagrant/provisioning/00_client01_deploy.yml\n\n~~~~\n\n~~~~\nvagrant@vgetcd01:~$ ssh-keygen -t rsa -b 4096\nGenerating public/private rsa key pair.\nEnter file in which to save the key (/home/vagrant/.ssh/id_rsa):\nEnter passphrase (empty for no passphrase):\nEnter same passphrase again:\nYour identification has been saved in /home/vagrant/.ssh/id_rsa.\nYour public key has been saved in /home/vagrant/.ssh/id_rsa.pub.\nThe key fingerprint is:\nSHA256:NioMqxbhQUg4RIyBcbNyd5TeUyWg89P8CDipyZxYcGQ vagrant@vgetcd01\nThe key's randomart image is:\n+---[RSA 4096]----+\n|%*o E .......    |\n|*+ = ...  ..     |\n|o.+ o.+. .       |\n| = + ..=oo       |\n|. + . + S.o      |\n| o O + + + o     |\n|  + O .   . .    |\n| o   .           |\n|o                |\n+----[SHA256]-----+\n\nvagrant@vgetcd01:~$ ssh-copy-id -i .ssh/id_rsa.pub vagrant@vgetcd02\n/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: \".ssh/id_rsa.pub\"\nThe authenticity of host 'vgetcd02 (192.168.10.3)' can't be established.\nECDSA key fingerprint is SHA256:1Z76nTl7aEpVhcnFIanMDmBiVXrhL9SXkGVxN7LcLD0.\nAre you sure you want to continue connecting (yes/no)? e^H\nPlease type 'yes' or 'no': yes\n/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys\nvagrant@vgetcd02's password:\n\nNumber of key(s) added: 1\n\nNow try logging into the machine, with:   \"ssh 'vagrant@vgetcd02'\"\nand check to make sure that only the key(s) you wanted were added.\n\nvagrant@vgetcd01:~$ ssh vagrant@vgetcd02\nWelcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-131-generic x86_64)\n\n * Documentation:  https://help.ubuntu.com\n * Management:     https://landscape.canonical.com\n * Support:        https://ubuntu.com/advantage\n\n144 packages can be updated.\n91 updates are security updates.\n\n\nLast login: Sun Aug 25 07:46:12 2019 from 192.168.10.13\nvagrant@vgetcd02:~$ exit\nlogout\nConnection to vgetcd02 closed.\nvagrant@vgetcd01:~$\n\n\n\nvagrant@vgetcd01:~$ ssh-copy-id -i .ssh/id_rsa.pub vagrant@vgetcd03\n/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: \".ssh/id_rsa.pub\"\nThe authenticity of host 'vgetcd03 (192.168.10.4)' can't be established.\nECDSA key fingerprint is SHA256:1Z76nTl7aEpVhcnFIanMDmBiVXrhL9SXkGVxN7LcLD0.\nAre you sure you want to continue connecting (yes/no)? yes\n/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys\nvagrant@vgetcd03's password:\n\nNumber of key(s) added: 1\n\nNow try logging into the machine, with:   \"ssh 'vagrant@vgetcd03'\"\nand check to make sure that only the key(s) you wanted were added.\n\nvagrant@vgetcd01:~$ ssh vagrant@vgetcd03\nWelcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-131-generic x86_64)\n\n * Documentation:  https://help.ubuntu.com\n * Management:     https://landscape.canonical.com\n * Support:        https://ubuntu.com/advantage\n\n144 packages can be updated.\n91 updates are security updates.\n\n\nLast login: Sun Aug 25 07:47:46 2019 from 192.168.10.13\nvagrant@vgetcd03:~$ exit\nlogout\nConnection to vgetcd03 closed.\nvagrant@vgetcd01:~$\n\n\nvagrant@vgetcd01:~$ export HOST0=192.168.10.2\nvagrant@vgetcd01:~$ export HOST1=192.168.10.3\nvagrant@vgetcd01:~$ export HOST2=192.168.10.4\n\nvagrant@vgetcd01:~$ sudo scp -r /tmp/${HOST1}/* vagrant@${HOST1}:/tmp\nThe authenticity of host '192.168.10.3 (192.168.10.3)' can't be established.\nECDSA key fingerprint is SHA256:1Z76nTl7aEpVhcnFIanMDmBiVXrhL9SXkGVxN7LcLD0.\nAre you sure you want to continue connecting (yes/no)? yes\nWarning: Permanently added '192.168.10.3' (ECDSA) to the list of known hosts.\nvagrant@192.168.10.3's password:\nkubeadmcfg.yaml\npeer.crt\npeer.key\nca.crt\nhealthcheck-client.key\nhealthcheck-client.crt\nserver.crt\nserver.key\napiserver-etcd-client.key\napiserver-etcd-client.crt\n\nvagrant@vgetcd01:~$ sudo ansible -i /vagrant/provisioning/hosts vgetcd02  -m shell -a \"sudo cp -r /tmp/pki /etc/kubernetes/\"\n\nvagrant@vgetcd01:~$ sudo ansible -i /vagrant/provisioning/hosts vgetcd02  -m shell -a \"sudo ls -lai /etc/kubernetes/pki\"\n [WARNING]: Consider using 'become', 'become_method', and 'become_user' rather than running sudo\n\n[DEPRECATION WARNING]: Distribution Ubuntu 16.04 on host vgetcd02 should use /usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will\ndefault to using the discovered platform python for this host. See https://docs.ansible.com/ansible/2.8/reference_appendices/interpreter_discovery.html for more information. This feature will be removed in\nversion 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.\nvgetcd02 | CHANGED | rc=0 \u003e\u003e\ntotal 20\n2361219 drwxr-xr-x 3 root root 4096 Aug 25 08:24 .\n2361215 drwxr-xr-x 4 root root 4096 Aug 25 08:24 ..\n2361229 -rw-r--r-- 1 root root 1090 Aug 25 08:24 apiserver-etcd-client.crt\n2361228 -rw------- 1 root root 1675 Aug 25 08:24 apiserver-etcd-client.key\n2361220 drwxr-xr-x 2 root root 4096 Aug 25 08:24 etcd\n\nvagrant@vgetcd01:~$ sudo ansible -i /vagrant/provisioning/hosts vgetcd02  -m shell -a \"sudo ls -lai /etc/kubernetes/pki/etcd\"\n [WARNING]: Consider using 'become', 'become_method', and 'become_user' rather than running sudo\n\n[DEPRECATION WARNING]: Distribution Ubuntu 16.04 on host vgetcd02 should use /usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will\ndefault to using the discovered platform python for this host. See https://docs.ansible.com/ansible/2.8/reference_appendices/interpreter_discovery.html for more information. This feature will be removed in\nversion 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.\nvgetcd02 | CHANGED | rc=0 \u003e\u003e\ntotal 36\n2361220 drwxr-xr-x 2 root root 4096 Aug 25 08:24 .\n2361219 drwxr-xr-x 3 root root 4096 Aug 25 08:24 ..\n2361223 -rw-r--r-- 1 root root 1017 Aug 25 08:24 ca.crt\n2361225 -rw-r--r-- 1 root root 1094 Aug 25 08:24 healthcheck-client.crt\n2361224 -rw------- 1 root root 1675 Aug 25 08:24 healthcheck-client.key\n2361221 -rw-r--r-- 1 root root 1139 Aug 25 08:24 peer.crt\n2361222 -rw------- 1 root root 1675 Aug 25 08:24 peer.key\n2361226 -rw-r--r-- 1 root root 1139 Aug 25 08:24 server.crt\n2361227 -rw------- 1 root root 1679 Aug 25 08:24 server.key\n\n\n\nvagrant@vgetcd01:~$ sudo scp -r /tmp/${HOST2}/* vagrant@${HOST2}:/tmp\nvagrant@192.168.10.4's password:\nkubeadmcfg.yaml\npeer.crt\npeer.key\nca.crt\nhealthcheck-client.key\nhealthcheck-client.crt\nserver.crt\nserver.key\napiserver-etcd-client.key\napiserver-etcd-client.crt\nvagrant@vgetcd03:~$ cd /tmp\n\n\nvagrant@vgetcd01:~$ sudo ansible -b -i /vagrant/provisioning/hosts vgetcd03  -m shell -a \"whoami\"\n[DEPRECATION WARNING]: Distribution Ubuntu 16.04 on host vgetcd03 should use /usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will\ndefault to using the discovered platform python for this host. See https://docs.ansible.com/ansible/2.8/reference_appendices/interpreter_discovery.html for more information. This feature will be removed in\nversion 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.\nvgetcd03 | CHANGED | rc=0 \u003e\u003e\nroot\n\nvagrant@vgetcd01:~$ sudo ansible -b -i /vagrant/provisioning/hosts vgetcd03  -m shell -a \"cp -r /tmp/pki /etc/kubernetes/\"\nvagrant@vgetcd01:~$ sudo ansible -b -i /vagrant/provisioning/hosts vgetcd03  -m shell -a \"ls -lai /etc/kubernetes/pki\"\n[DEPRECATION WARNING]: Distribution Ubuntu 16.04 on host vgetcd03 should use /usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will\ndefault to using the discovered platform python for this host. See https://docs.ansible.com/ansible/2.8/reference_appendices/interpreter_discovery.html for more information. This feature will be removed in\nversion 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.\nvgetcd03 | CHANGED | rc=0 \u003e\u003e\ntotal 20\n2361091 drwxr-xr-x 3 root root 4096 Aug 25 18:15 .\n2361087 drwxr-xr-x 4 root root 4096 Aug 25 18:15 ..\n2361101 -rw-r--r-- 1 root root 1090 Aug 25 18:15 apiserver-etcd-client.crt\n2361100 -rw------- 1 root root 1675 Aug 25 18:15 apiserver-etcd-client.key\n2361092 drwxr-xr-x 2 root root 4096 Aug 25 18:15 etcd\n\nvagrant@vgetcd01:~$ sudo ansible -b -i /vagrant/provisioning/hosts vgetcd03  -m shell -a \"ls -lai /etc/kubernetes/pki/etcd\"\n[DEPRECATION WARNING]: Distribution Ubuntu 16.04 on host vgetcd03 should use /usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will\ndefault to using the discovered platform python for this host. See https://docs.ansible.com/ansible/2.8/reference_appendices/interpreter_discovery.html for more information. This feature will be removed in\nversion 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.\nvgetcd03 | CHANGED | rc=0 \u003e\u003e\ntotal 36\n2361092 drwxr-xr-x 2 root root 4096 Aug 25 18:15 .\n2361091 drwxr-xr-x 3 root root 4096 Aug 25 18:15 ..\n2361095 -rw-r--r-- 1 root root 1017 Aug 25 18:15 ca.crt\n2361097 -rw-r--r-- 1 root root 1094 Aug 25 18:15 healthcheck-client.crt\n2361096 -rw------- 1 root root 1675 Aug 25 18:15 healthcheck-client.key\n2361093 -rw-r--r-- 1 root root 1139 Aug 25 18:15 peer.crt\n2361094 -rw------- 1 root root 1679 Aug 25 18:15 peer.key\n2361098 -rw-r--r-- 1 root root 1139 Aug 25 18:15 server.crt\n2361099 -rw------- 1 root root 1675 Aug 25 18:15 server.key\n\n\nvagrant@vgetcd01:/tmp$ find /tmp | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n/tmp\n |-192.168.10.2\n | |-kubeadmcfg.yaml\n\nvagrant@vgetcd01:/tmp$ find /etc/kubernetes/pki | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n | |-pki\n | | |-etcd\n | | | |-peer.crt\n | | | |-peer.key\n | | | |-ca.key\n | | | |-ca.crt\n | | | |-healthcheck-client.key\n | | | |-healthcheck-client.crt\n | | | |-server.crt\n | | | |-server.key\n | | |-apiserver-etcd-client.key\n | | |-apiserver-etcd-client.crt\n\n\n vagrant@vgetcd02:~$ find /tmp | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n/tmp\n |-kubeadmcfg.yaml\n vagrant@vgetcd02:~$ find /etc/kubernetes/pki | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n  | |-pki\n  | | |-etcd\n  | | | |-peer.crt\n  | | | |-peer.key\n  | | | |-ca.crt\n  | | | |-healthcheck-client.key\n  | | | |-healthcheck-client.crt\n  | | | |-server.crt\n  | | | |-server.key\n  | | |-apiserver-etcd-client.key\n  | | |-apiserver-etcd-client.crt\n\n\n  vagrant@vgetcd03:/tmp$ find /tmp | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n/tmp\n |-kubeadmcfg.yaml\n\nvagrant@vgetcd03:/tmp$ find /etc/kubernetes/pki | sed -e \"s/[^-][^\\/]*\\// |/g\" -e \"s/|\\([^ ]\\)/|-\\1/\"\n | |-pki\n | | |-etcd\n | | | |-peer.crt\n | | | |-peer.key\n | | | |-ca.crt\n | | | |-healthcheck-client.key\n | | | |-healthcheck-client.crt\n | | | |-server.crt\n | | | |-server.key\n | | |-apiserver-etcd-client.key\n | | |-apiserver-etcd-client.crt\n\n\n\n vagrant@vgetcd01:~$ sudo kubeadm init phase etcd local --config=/tmp/192.168.10.2/kubeadmcfg.yaml\n [etcd] Creating static Pod manifest for local etcd in \"/etc/kubernetes/manifests\n\n vagrant@vgetcd02:/tmp$ sudo kubeadm init phase etcd local --config=/tmp/kubeadmcfg.yaml\n [etcd] Creating static Pod manifest for local etcd in \"/etc/kubernetes/manifests\"\n\n vagrant@vgetcd03:/tmp$ sudo kubeadm init phase etcd local --config=/tmp/kubeadmcfg.yaml\n [etcd] Creating static Pod manifest for local etcd in \"/etc/kubernetes/manifests\"\n\n\n\n vagrant@vgetcd01:~$ sudo docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes k8s.gcr.io/etcd:3.3.10 etcdctl \\\n--cert-file /etc/kubernetes/pki/etcd/peer.crt \\\n--key-file /etc/kubernetes/pki/etcd/peer.key \\\n--ca-file /etc/kubernetes/pki/etcd/ca.crt \\\n--endpoints https://192.168.10.2:2379 cluster-health\n\n vagrant@vgetcd01:~$ sudo docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes k8s.gcr.io/etcd:3.3.10 etcdctl \\\n \u003e --cert-file /etc/kubernetes/pki/etcd/peer.crt \\\n \u003e --key-file /etc/kubernetes/pki/etcd/peer.key \\\n \u003e --ca-file /etc/kubernetes/pki/etcd/ca.crt \\\n \u003e --endpoints https://192.168.10.2:2379 cluster-health\n member 2af255134b508f21 is healthy: got healthy result from https://192.168.10.4:2379\n member 4a451414459653c0 is healthy: got healthy result from https://192.168.10.2:2379\n member 86ef4da6f07b0d20 is healthy: got healthy result from https://192.168.10.3:2379\n cluster is healthy\n\n\n vagrant@vgetcd01:~$ sudo docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes k8s.gcr.io/etcd:3.3.10 etcdctl \\\n--cert-file /etc/kubernetes/pki/etcd/peer.crt \\\n--key-file /etc/kubernetes/pki/etcd/peer.key \\\n--ca-file /etc/kubernetes/pki/etcd/ca.crt \\\n--endpoints https://192.168.10.2:2379  member list\n 2af255134b508f21: name=infra2 peerURLs=https://192.168.10.4:2380 clientURLs=https://192.168.10.4:2379 isLeader=true\n 4a451414459653c0: name=infra0 peerURLs=https://192.168.10.2:2380 clientURLs=https://192.168.10.2:2379 isLeader=false\n 86ef4da6f07b0d20: name=infra1 peerURLs=https://192.168.10.3:2380 clientURLs=https://192.168.10.3:2379 isLeader=false\n\n vagrant@vgetcd01:~$ sudo docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes k8s.gcr.io/etcd:3.3.10 etcdctl \\\n--cert-file /etc/kubernetes/pki/etcd/peer.crt \\\n--key-file /etc/kubernetes/pki/etcd/peer.key \\\n--ca-file /etc/kubernetes/pki/etcd/ca.crt \\\n --endpoints https://192.168.10.2:2379 --debug cluster-health\n Cluster-Endpoints: https://192.168.10.2:2379\n cURL Command: curl -X GET https://192.168.10.2:2379/v2/members\n member 2af255134b508f21 is healthy: got healthy result from https://192.168.10.4:2379\n member 4a451414459653c0 is healthy: got healthy result from https://192.168.10.2:2379\n member 86ef4da6f07b0d20 is healthy: got healthy result from https://192.168.10.3:2379\n cluster is healthy\n\n vagrant@vgetcd01:~$ curl -X GET https://192.168.10.2:2379/v2/members\n curl: (35) gnutls_handshake() failed: Certificate is bad\n\n vagrant@vgetcd01:~$ sudo curl --cert /etc/kubernetes/pki/etcd/peer.crt --key /etc/kubernetes/pki/etcd/peer.key https://192.168.10.2:2379\n curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none\n More details here: http://curl.haxx.se/docs/sslcerts.html\n\n curl performs SSL certificate verification by default, using a \"bundle\"\n  of Certificate Authority (CA) public keys (CA certs). If the default\n  bundle file isn't adequate, you can specify an alternate file\n  using the --cacert option.\n If this HTTPS server uses a certificate signed by a CA represented in\n  the bundle, the certificate verification probably failed due to a\n  problem with the certificate (it might be expired, or the name might\n  not match the domain name in the URL).\n If you'd like to turn off curl's verification of the certificate, use\n  the -k (or --insecure) option.\n\n\n\n\n\nvagrant@vgetcd01:~$ sudo scp \\\n/etc/kubernetes/pki/apiserver-etcd-client.crt \\\n/etc/kubernetes/pki/apiserver-etcd-client.key \\\n/etc/kubernetes/pki/etcd/ca.crt  vagrant@vgmaster01:/tmp\n\nvagrant@vgetcd01:/tmp$ sudo scp \\\n\u003e /etc/kubernetes/pki/apiserver-etcd-client.crt \\\n\u003e /etc/kubernetes/pki/apiserver-etcd-client.key \\\n\u003e /etc/kubernetes/pki/etcd/ca.crt  vagrant@vgmaster01:/tmp\nThe authenticity of host 'vgmaster01 (192.168.10.5)' can't be established.\nECDSA key fingerprint is SHA256:1Z76nTl7aEpVhcnFIanMDmBiVXrhL9SXkGVxN7LcLD0.\nAre you sure you want to continue connecting (yes/no)? yes\nWarning: Permanently added 'vgmaster01,192.168.10.5' (ECDSA) to the list of known hosts.\nvagrant@vgmaster01's password:\napiserver-etcd-client.crt\napiserver-etcd-client.key    \nca.crt\n\n\nvagrant@vgmaster01:/tmp$ cd tmp \u0026\u0026 mkdir etcd \u0026\u0026 mv ca.crt etcd\nvagrant@vgmaster01:/tmp$ ls\napiserver-etcd-client.crt  apiserver-etcd-client.key  etcd  vagrant-shell\nvagrant@vgmaster01:/tmp$ ls etcd/\nca.crt\n\n# reboot heartbeat if it takes too long and verify\nvagrant@vgetcd01:~$ sudo systemctl restart heartbeat\nvagrant@vgmaster01:/tmp$ nc -v 192.168.10.1 6443\n\nvagrant@vgmaster01:/tmp$  sudo bash /vagrant/config_vgmaster01.sh\n\nvagrant@vgmaster01:/tmp$ sudo kubeadm init --node-name vgmaster01 --config kubeadm-config.yaml --v=3\nYour Kubernetes control-plane has initialized successfully!\n\nTo start using your cluster, you need to run the following as a regular user:\n\n  mkdir -p $HOME/.kube\n  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n  sudo chown $(id -u):$(id -g) $HOME/.kube/config\n\nYou should now deploy a pod network to the cluster.\nRun \"kubectl apply -f [podnetwork].yaml\" with one of the options listed at:\n  https://kubernetes.io/docs/concepts/cluster-administration/addons/\n\nYou can now join any number of control-plane nodes by copying certificate authorities\nand service account keys on each node and then running the following as root:\n\n  kubeadm join 192.168.10.1:6443 --token x4xu0k.lkvy1to8xzujqxxp \\\n    --discovery-token-ca-cert-hash sha256:1ed586e19dd772475c581c0701a8cd03c0c52bc2e5bd5488536d0de38a60b158 \\\n    --control-plane\n\nThen you can join any number of worker nodes by running the following on each as root:\n\nkubeadm join 192.168.10.1:6443 --token x4xu0k.lkvy1to8xzujqxxp \\\n    --discovery-token-ca-cert-hash sha256:1ed586e19dd772475c581c0701a8cd03c0c52bc2e5bd5488536d0de38a60b158\n#################################################################################################################\n\n\n\nvagrant@vgmaster01:/tmp$ sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f \"https://cloud.weave.works/k8s/net?k8s-version=$(sudo kubectl version | base64 | tr -d '\\n')\"\nThe connection to the server localhost:8080 was refused - did you specify the right host or port?\nserviceaccount/weave-net created\nclusterrole.rbac.authorization.k8s.io/weave-net created\nclusterrolebinding.rbac.authorization.k8s.io/weave-net created\nrole.rbac.authorization.k8s.io/weave-net created\nrolebinding.rbac.authorization.k8s.io/weave-net created\ndaemonset.extensions/weave-net created\n\n\nvagrant@vgmaster01:/tmp$ sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -w\nNAME                                 READY   STATUS    RESTARTS   AGE\ncoredns-5c98db65d4-8s6z9             1/1     Running   0          3m47s\ncoredns-5c98db65d4-nqbs9             1/1     Running   0          3m47s\nkube-apiserver-vgmaster01            1/1     Running   0          3m32s\nkube-controller-manager-vgmaster01   1/1     Running   0          3m41s\nkube-proxy-sknhl                     1/1     Running   0          3m47s\nkube-scheduler-vgmaster01            1/1     Running   0          3m27s\nweave-net-52v2n                      2/2     Running   0          64s\n\nvagrant@vgmaster01:~$ mkdir -p $HOME/.kube\nvagrant@vgmaster01:~$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\nvagrant@vgmaster01:~$ sudo chown $(id -u):$(id -g) $HOME/.kube/config\n\nvagrant@vgmaster01:/tmp$ sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes\nNAME         STATUS   ROLES    AGE     VERSION\nvgmaster01   Ready    master   4m57s   v1.15.3\n\nvagrant@vgmaster01:~$ sudo kubectl get nodes\nNAME         STATUS   ROLES    AGE     VERSION\nvgmaster01   Ready    master   3m12s   v1.15.3\n\nvagrant@vgmaster01:~$ ssh-keygen -t rsa -b 4096\nGenerating public/private rsa key pair.\nEnter file in which to save the key (/home/vagrant/.ssh/id_rsa):\nEnter passphrase (empty for no passphrase):\nEnter same passphrase again:\nYour identification has been saved in /home/vagrant/.ssh/id_rsa.\nYour public key has been saved in /home/vagrant/.ssh/id_rsa.pub.\nThe key fingerprint is:\nSHA256:rgPVyUQ5wCgO5qYaC3ZCPxitscjj2GLywc3K1yhIePc vagrant@vgmaster01\nThe key's randomart image is:\n+---[RSA 4096]----+\n|     o.o..       |\n|... . . +        |\n|oo..   + o       |\n| *..  . +        |\n|B B  .  S        |\n|*@.*o  .         |\n|B**.+=  .        |\n|B+ooo E.         |\n|oo+o  ..         |\n+----[SHA256]-----+\nvagrant@vgmaster01:~$ ssh-copy-id -i $HOME/.ssh/id_rsa.pub vagrant@vgmaster02\n/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: \".ssh/id_rsa.pub\"\nThe authenticity of host 'vgmaster02 (192.168.10.6)' can't be established.\nECDSA key fingerprint is SHA256:1Z76nTl7aEpVhcnFIanMDmBiVXrhL9SXkGVxN7LcLD0.\nAre you sure you want to continue connecting (yes/no)? yes\n/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys\nvagrant@vgmaster02's password:\n\nNumber of key(s) added: 1\n\nNow try logging into the machine, with:   \"ssh 'vagrant@vgmaster02'\"\nand check to make sure that only the key(s) you wanted were added.\n\nvagrant@vgmaster01:~$ ssh vagrant@vgmaster02\nWelcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-131-generic x86_64)\n\n * Documentation:  https://help.ubuntu.com\n * Management:     https://landscape.canonical.com\n * Support:        https://ubuntu.com/advantage\n\n144 packages can be updated.\n91 updates are security updates.\n\n\nLast login: Sat Aug 24 23:14:15 2019 from 10.0.2.2\nvagrant@vgmaster02:~$ exit\nlogout\nConnection to vgmaster02 closed.\nvagrant@vgmaster01:~$\n\n\n\n\nvagrant@vgmaster01:~$ sudo scp /etc/kubernetes/pki/ca.crt \\\n/etc/kubernetes/pki/ca.key \\\n/etc/kubernetes/pki/sa.key \\\n/etc/kubernetes/pki/sa.pub \\\n/etc/kubernetes/pki/front-proxy-ca.crt \\\n/etc/kubernetes/pki/front-proxy-ca.key \\\n/etc/kubernetes/pki/apiserver-etcd-client.crt \\\n/etc/kubernetes/pki/apiserver-etcd-client.key \\\n/etc/kubernetes/admin.conf vagrant@vgmaster02:/tmp\n\nvagrant@vgmaster02:/tmp$ cd /tmp \u0026\u0026 mkdir etcd\nvagrant@vgmaster01:~$ sudo scp  /etc/kubernetes/pki/etcd/ca.crt vagrant@vgmaster02:/tmp/etcd\n\nvagrant@vgmaster02:/tmp$ ls\nadmin.conf  apiserver-etcd-client.crt  apiserver-etcd-client.key  ca.crt  ca.key  etcd  front-proxy-ca.crt  front-proxy-ca.key  sa.key  sa.pub  vagrant-shell\nvagrant@vgmaster02:/tmp$ ls etcd/\nca.crt\n\nvagrant@vgmaster02:/tmp$ sudo bash /vagrant/config_vgmaster02.sh\n\n# reboot heart if it takes too long and verify\nvagrant@vgetcd01:~$ sudo systemctl restart heartbeat\nvagrant@vgmaster02:/tmp$ nc -v 192.168.10.1 6443\nConnection to 192.168.10.1 6443 port [tcp/*] succeeded!\n^C\n\nvagrant@vgmaster02:~$ sudo kubeadm join 192.168.10.1:6443 --apiserver-advertise-address=\"192.168.10.6\" \\\n--node-name vgmaster02 --token x4xu0k.lkvy1to8xzujqxxp \\\n--discovery-token-ca-cert-hash sha256:1ed586e19dd772475c581c0701a8cd03c0c52bc2e5bd5488536d0de38a60b158 \\\n--control-plane --v=3\n\nvagrant@vgmaster02:~$ mkdir -p $HOME/.kube\nvagrant@vgmaster02:~$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\nvagrant@vgmaster02:~$ sudo chown $(id -u):$(id -g) $HOME/.kube/config\nvagrant@vgmaster02:~$ kubectl get nodes\nNAME         STATUS   ROLES    AGE    VERSION\nvgmaster01   Ready    master   28m    v1.15.3\nvgmaster02   Ready    master   2m8s   v1.15.3\n\n\nvagrant@vgmaster01:~$ kubectl -n kube-system get cm kubeadm-config -oyaml\napiVersion: v1\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      certSANs:\n      - 192.168.10.1\n      extraArgs:\n        advertise-address: 192.168.10.1\n        authorization-mode: Node,RBAC\n      timeoutForControlPlane: 4m0s\n    apiVersion: kubeadm.k8s.io/v1beta2\n    certificatesDir: /etc/kubernetes/pki\n    clusterName: kubernetes\n    controlPlaneEndpoint: 192.168.10.1:6443\n    controllerManager: {}\n    dns:\n      type: CoreDNS\n    etcd:\n      external:\n        caFile: /etc/kubernetes/pki/etcd/ca.crt\n        certFile: /etc/kubernetes/pki/apiserver-etcd-client.crt\n        endpoints:\n        - https://192.168.10.2:2379\n        - https://192.168.10.3:2379\n        - https://192.168.10.4:2379\n        keyFile: /etc/kubernetes/pki/apiserver-etcd-client.key\n    imageRepository: k8s.gcr.io\n    kind: ClusterConfiguration\n    kubernetesVersion: v1.15.3\n    networking:\n      dnsDomain: cluster.local\n      podSubnet: 192.168.0.0/16\n      serviceSubnet: 10.96.0.0/12\n    scheduler: {}\n  ClusterStatus: |\n    apiEndpoints:\n      vgmaster01:\n        advertiseAddress: 192.168.10.5\n        bindPort: 6443\n      vgmaster02:\n        advertiseAddress: 192.168.10.6\n        bindPort: 6443\n    apiVersion: kubeadm.k8s.io/v1beta2\n    kind: ClusterStatus\nkind: ConfigMap\nmetadata:\n  creationTimestamp: \"2019-08-25T18:57:07Z\"\n  name: kubeadm-config\n  namespace: kube-system\n  resourceVersion: \"2356\"\n  selfLink: /api/v1/namespaces/kube-system/configmaps/kubeadm-config\n  uid: ec5e1468-f2d3-47f0-ba2e-4bd70190826a\nvagrant@vgmaster01:~$\n\nvagrant@vgmaster02:~$  kubectl -n kube-system get cm kubeadm-config -oyaml\napiVersion: v1\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      certSANs:\n      - 192.168.10.1\n      extraArgs:\n        advertise-address: 192.168.10.1\n        authorization-mode: Node,RBAC\n      timeoutForControlPlane: 4m0s\n    apiVersion: kubeadm.k8s.io/v1beta2\n    certificatesDir: /etc/kubernetes/pki\n    clusterName: kubernetes\n    controlPlaneEndpoint: 192.168.10.1:6443\n    controllerManager: {}\n    dns:\n      type: CoreDNS\n    etcd:\n      external:\n        caFile: /etc/kubernetes/pki/etcd/ca.crt\n        certFile: /etc/kubernetes/pki/apiserver-etcd-client.crt\n        endpoints:\n        - https://192.168.10.2:2379\n        - https://192.168.10.3:2379\n        - https://192.168.10.4:2379\n        keyFile: /etc/kubernetes/pki/apiserver-etcd-client.key\n    imageRepository: k8s.gcr.io\n    kind: ClusterConfiguration\n    kubernetesVersion: v1.15.3\n    networking:\n      dnsDomain: cluster.local\n      podSubnet: 192.168.0.0/16\n      serviceSubnet: 10.96.0.0/12\n    scheduler: {}\n  ClusterStatus: |\n    apiEndpoints:\n      vgmaster01:\n        advertiseAddress: 192.168.10.5\n        bindPort: 6443\n      vgmaster02:\n        advertiseAddress: 192.168.10.6\n        bindPort: 6443\n    apiVersion: kubeadm.k8s.io/v1beta2\n    kind: ClusterStatus\nkind: ConfigMap\nmetadata:\n  creationTimestamp: \"2019-08-25T18:57:07Z\"\n  name: kubeadm-config\n  namespace: kube-system\n  resourceVersion: \"2356\"\n  selfLink: /api/v1/namespaces/kube-system/configmaps/kubeadm-config\n  uid: ec5e1468-f2d3-47f0-ba2e-4bd70190826a\nvagrant@vgmaster02:~$\n\n\nvagrant@vgmaster01:~$ kubectl get pod -n kube-system -w\nNAME                                 READY   STATUS    RESTARTS   AGE\ncoredns-5c98db65d4-26lq8             1/1     Running   0          33m\ncoredns-5c98db65d4-cr6k5             1/1     Running   0          33m\nkube-apiserver-vgmaster01            1/1     Running   0          32m\nkube-apiserver-vgmaster02            1/1     Running   0          6m58s\nkube-controller-manager-vgmaster01   1/1     Running   0          32m\nkube-controller-manager-vgmaster02   1/1     Running   0          6m58s\nkube-proxy-btkw6                     1/1     Running   0          6m58s\nkube-proxy-ktr9v                     1/1     Running   0          33m\nkube-scheduler-vgmaster01            1/1     Running   0          32m\nkube-scheduler-vgmaster02            1/1     Running   0          6m58s\nweave-net-56f49                      2/2     Running   0          31m\nweave-net-xtpwb                      2/2     Running   1          6m58s\n\n\n\n\nvagrant@vgworker01:~$ nc -v 192.168.10.1 6443\nConnection to 192.168.10.1 6443 port [tcp/*] succeeded!\nvagrant@vgworker01:~$ sudo kubeadm join 192.168.10.1:6443 --token x4xu0k.lkvy1to8xzujqxxp --discovery-token-ca-cert-hash sha256:1ed586e19dd772475c581c0701a8cd03c0c52bc2e5bd5488536d0de38a60b158\n[preflight] Running pre-flight checks\n[preflight] Reading configuration from the cluster...\n[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'\n[kubelet-start] Downloading configuration for the kubelet from the \"kubelet-config-1.15\" ConfigMap in the kube-system namespace\n[kubelet-start] Writing kubelet configuration to file \"/var/lib/kubelet/config.yaml\"\n[kubelet-start] Writing kubelet environment file with flags to file \"/var/lib/kubelet/kubeadm-flags.env\"\n[kubelet-start] Activating the kubelet service\n[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...\n[kubelet-check] Initial timeout of 40s passed.\n\nThis node has joined the cluster:\n* Certificate signing request was sent to apiserver and a response was received.\n* The Kubelet was informed of the new secure connection details.\n\nRun 'kubectl get nodes' on the control-plane to see this node join the cluster.\n\n\nvagrant@vgmaster01:~$ kubectl get nodes\nNAME         STATUS   ROLES    AGE   VERSION\nvgmaster01   Ready    master   56m   v1.15.3\nvgmaster02   Ready    master   29m   v1.15.3\nvgworker01   Ready    \u003cnone\u003e   10m   v1.15.3\n\n\nvagrant@vgmaster01:/tmp$ sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes\nNAME         STATUS   ROLES    AGE   VERSION\nvgmaster01   Ready    master   75m   v1.15.3\nvgmaster02   Ready    master   47m   v1.15.3\nvgworker01   Ready    \u003cnone\u003e   38m   v1.15.3\nvgworker02   Ready    \u003cnone\u003e   13m   v1.15.3\nvgworker03   Ready    \u003cnone\u003e   17m   v1.15.3                \n\n\n~~~~\nsmoke tests\n~~~~\nWeb UI (Dashboard)  \n\u003chttps://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/#deploying-the-dashboard-ui\u003e\n~~~~\n~~~~\nCreating Highly Available clusters with kubeadm\n\u003chttps://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/\u003e\nSet up a High Availability etcd cluster with kubeadm\n\u003chttps://kubernetes.io/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/\u003e\nCustomizing control plane configuration with kubeadm\n\u003chttps://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/\u003e\nContainer runtimes\n\u003chttps://kubernetes.io/docs/setup/production-environment/container-runtimes/\u003e\nInstalling kubeadm\n\u003chttps://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/\u003e\n\n\nkubeadm init\n\u003chttps://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/\u003e\npackage v1beta2\nkubeadm configuration file format\n\u003chttps://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2#ClusterConfiguration\u003e\n\nWeave Troubleshooting\n\u003chttps://www.weave.works/docs/net/latest/kubernetes/kube-addon/#troubleshooting\u003e\n\nManual certificate distribution\nhttps://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/#manual-certs\n~~~~\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithubfoam%2Fk8s-external-etcd-weavenet-remote-sandbox/lists"}