copyright | lastupdated | ||
---|---|---|---|
|
2017-10-12 |
{:new_window: target="_blank"} {:shortdesc: .shortdesc} {:screen: .screen} {:pre: .pre} {:table: .aria-labeledby="caption"} {:codeblock: .codeblock} {:tip: .tip} {:download: .download}
{: #cs_cli_install}
You can use the {{site.data.keyword.containershort_notm}} CLI or API to create and manage your Kubernetes clusters. {:shortdesc}
{: #cs_cli_install_steps}
Install the required CLIs to create and manage your Kubernetes clusters in {{site.data.keyword.containershort_notm}}, and to deploy containerized apps to your cluster. {:shortdesc}
This task includes the information for installing these CLIs and plug-ins:
- {{site.data.keyword.Bluemix_notm}} CLI version 0.5.0 or later
- {{site.data.keyword.containershort_notm}} plug-in
- Kubernetes CLI version 1.7.4 or later
- Optional: {{site.data.keyword.registryshort_notm}} plug-in
- Optional: Docker version 1.9 or later
To install the CLIs:
-
As a prerequisite for the {{site.data.keyword.containershort_notm}} plug-in, install the {{site.data.keyword.Bluemix_notm}} CLI . The prefix for running commands by using the {{site.data.keyword.Bluemix_notm}} CLI is
bx
. -
Log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your {{site.data.keyword.Bluemix_notm}} credentials when prompted.
bx login
{: pre}
Note: If you have a federated ID, use
bx login --sso
to log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your user name and use the provided URL in your CLI output to retrieve your one-time passcode. You know you have a federated ID when the login fails without the--sso
and succeeds with the--sso
option. -
To create Kubernetes clusters and manage worker nodes, install the {{site.data.keyword.containershort_notm}} plug-in. The prefix for running commands by using the {{site.data.keyword.containershort_notm}} plug-in is
bx cs
.bx plugin install container-service -r {{site.data.keyword.Bluemix_notm}}
{: pre}
To verify that the plug-in is installed properly, run the following command:
bx plugin list
{: pre}
The {{site.data.keyword.containershort_notm}} plug-in is displayed in the results as container-service.
-
To view a local version of the Kubernetes dashboard and to deploy apps into your clusters, install the Kubernetes CLI . The prefix for running commands by using the Kubernetes CLI is
kubectl
.-
For complete functional compatibility, download the Kubernetes CLI version that matches the Kubernetes cluster version you plan to use. The current {{site.data.keyword.containershort_notm}} default Kubernetes version is 1.7.4.
OS X: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/darwin/amd64/kubectl
Linux: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubectl
Windows: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/windows/amd64/kubectl.exe
Tip: If you are using Windows, install the Kubernetes CLI in the same directory as the {{site.data.keyword.Bluemix_notm}} CLI. This setup saves you some filepath changes when you run commands later.
-
For OSX and Linux users, complete the following steps.
-
Move the executable file to the
/usr/local/bin
directory.mv /<path_to_file>/kubectl /usr/local/bin/kubectl
{: pre}
-
Make sure that
/usr/local/bin
is listed in yourPATH
system variable. ThePATH
variable contains all directories where your operating system can find executable files. The directories that are listed in thePATH
variable serve different purposes./usr/local/bin
is used to store executable files for software that is not part of the operating system and that was manually installed by the system administrator.echo $PATH
{: pre}
Example CLI output:
/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
{: screen}
-
Make the file executable.
chmod +x /usr/local/bin/kubectl
{: pre}
-
-
-
To manage a private image repository, install the {{site.data.keyword.registryshort_notm}} plug-in. Use this plug-in to set up your own namespace in a multi-tenant, highly available, and scalable private image registry that is hosted by IBM, and to store and share Docker images with other users. Docker images are required to deploy containers into a cluster. The prefix for running registry commands is
bx cr
.bx plugin install container-registry -r {{site.data.keyword.Bluemix_notm}}
{: pre}
To verify that the plug-in is installed properly, run the following command:
bx plugin list
{: pre}
The plug-in is displayed in the results as container-registry.
-
To build images locally and push them to your registry namespace, install Docker . If you are using Windows 8 or earlier, you can install the Docker Toolbox instead. The Docker CLI is used to build apps into images. The prefix for running commands by using the Docker CLI is
docker
.
Next, start Creating Kubernetes clusters from the CLI with {{site.data.keyword.containershort_notm}}.
For reference information about these CLIs, see the documentation for those tools.
{: #cs_cli_configure}
You can use the commands that are provided with the Kubernetes CLI to manage clusters in {{site.data.keyword.Bluemix_notm}}. All kubectl
commands that are available in Kubernetes 1.7.4 are supported for use with clusters in {{site.data.keyword.Bluemix_notm}}. After you create a cluster, set the context for your local CLI to that cluster with an environment variable. Then, you can run the Kubernetes kubectl
commands to work with your cluster in {{site.data.keyword.Bluemix_notm}}.
{:shortdesc}
Before you can run kubectl
commands, install the required CLIs and create a cluster.
-
Log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your {{site.data.keyword.Bluemix_notm}} credentials when prompted. To specify a {{site.data.keyword.Bluemix_notm}} region, include the API endpoint.
bx login
{: pre}
Note: If you have a federated ID, use
bx login --sso
to log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your user name and use the provided URL in your CLI output to retrieve your one-time passcode. You know you have a federated ID when the login fails without the--sso
and succeeds with the--sso
option. -
Select a {{site.data.keyword.Bluemix_notm}} account. If you are assigned to multiple {{site.data.keyword.Bluemix_notm}} organizations, select the organization where the cluster was created. Clusters are specific to an organization, but are independent from a {{site.data.keyword.Bluemix_notm}} space. Therefore, you are not required to select a space.
-
If you want to create or access Kubernetes clusters in a region other than the {{site.data.keyword.Bluemix_notm}} region that you selected earlier, specify the {{site.data.keyword.containershort_notm}} region API endpoint.
Note: If you want to create a cluster in US East, you must specify the US East container region API endpoint using the
bx cs init --host https://us-east.containers.bluemix.net
command. -
List all of the clusters in the account to get the name of the cluster.
bx cs clusters
{: pre}
-
Set the cluster you created as the context for this session. Complete these configuration steps every time that you work with your cluster.
-
Get the command to set the environment variable and download the Kubernetes configuration files.
bx cs cluster-config <cluster_name_or_id>
{: pre}
After downloading the configuration files, a command is displayed that you can use to set the path to the local Kubernetes configuration file as an environment variable.
Example:
export KUBECONFIG=/Users/<user_name>/.bluemix/plugins/container-service/clusters/<cluster_name>/kube-config-prod-dal10-<cluster_name>.yml
{: screen}
-
Copy and paste the command that is displayed in your terminal to set the
KUBECONFIG
environment variable. -
Verify that the
KUBECONFIG
environment variable is set properly.Example:
echo $KUBECONFIG
{: pre}
Output:
/Users/<user_name>/.bluemix/plugins/container-service/clusters/<cluster_name>/kube-config-prod-dal10-<cluster_name>.yml
{: screen}
-
-
Verify that the
kubectl
commands run properly with your cluster by checking the Kubernetes CLI server version.kubectl version --short
{: pre}
Example output:
Client Version: v1.7.4 Server Version: v1.7.4
{: screen}
Now, you can run kubectl
commands to manage your clusters in {{site.data.keyword.Bluemix_notm}}. For a full list of commands, see the Kubernetes documentation .
Tip: If you are using Windows and the Kubernetes CLI is not installed in the same directory as the {{site.data.keyword.Bluemix_notm}} CLI, you must change directories to the path where the Kubernetes CLI is installed to run kubectl
commands successfully.
{: #cs_cli_upgrade}
You might want to update the CLIs periodically to use new features. {:shortdesc}
This task includes the information for updating these CLIs.
- {{site.data.keyword.Bluemix_notm}} CLI version 0.5.0 or later
- {{site.data.keyword.containershort_notm}} plug-in
- Kubernetes CLI version 1.7.4 or later
- {{site.data.keyword.registryshort_notm}} plug-in
- Docker version 1.9. or later
To update the CLIs:
-
Update the {{site.data.keyword.Bluemix_notm}} CLI. Download the latest version and run the installer.
-
Log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your {{site.data.keyword.Bluemix_notm}} credentials when prompted. To specify a {{site.data.keyword.Bluemix_notm}} region, include the API endpoint.
bx login
{: pre}
Note: If you have a federated ID, use
bx login --sso
to log in to the {{site.data.keyword.Bluemix_notm}} CLI. Enter your user name and use the provided URL in your CLI output to retrieve your one-time passcode. You know you have a federated ID when the login fails without the--sso
and succeeds with the--sso
option. -
Update the {{site.data.keyword.containershort_notm}} plug-in.
-
Install the update from the {{site.data.keyword.Bluemix_notm}} plug-in repository.
bx plugin update container-service -r {{site.data.keyword.Bluemix_notm}}
{: pre}
-
Verify the plug-in installation by running the following command and checking the list of the plug-ins that are installed.
bx plugin list
{: pre}
The {{site.data.keyword.containershort_notm}} plug-in is displayed in the results as container-service.
-
Initialize the CLI.
bx cs init
{: pre}
-
-
Update the Kubernetes CLI.
-
Update to the Kubernetes CLI version that matches the Kubernetes cluster version you plan to use. The current {{site.data.keyword.containershort_notm}} default Kubernetes version is 1.7.4.
OS X: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/darwin/amd64/kubectl
Linux: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubectl
Windows: https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/windows/amd64/kubectl.exe
Tip: If you are using Windows, install the Kubernetes CLI in the same directory as the {{site.data.keyword.Bluemix_notm}} CLI. This setup saves you some filepath changes when you run commands later.
-
For OSX and Linux users, complete the following steps.
-
Move the executable file to the
/usr/local/bin
directory.mv /<path_to_file>/kubectl /usr/local/bin/kubectl
{: pre}
-
Make sure that
/usr/local/bin
is listed in yourPATH
system variable. ThePATH
variable contains all directories where your operating system can find executable files. The directories that are listed in thePATH
variable serve different purposes./usr/local/bin
is used to store executable files for software that is not part of the operating system and that was manually installed by the system administrator.echo $PATH
{: pre}
Example CLI output:
/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
{: screen}
-
Make the file executable.
chmod +x /usr/local/bin/kubectl
{: pre}
-
-
-
Update the {{site.data.keyword.registryshort_notm}} plug-in.
-
Install the update from the {{site.data.keyword.Bluemix_notm}} plug-in repository.
bx plugin update container-registry -r {{site.data.keyword.Bluemix_notm}}
{: pre}
-
Verify the plug-in installation by running the following command and checking the list of the plug-ins that are installed.
bx plugin list
{: pre}
The registry plug-in is displayed in the results as container-registry.
-
-
Update Docker.
- If you are using Docker Community Edition, start Docker, click the Docker icon, and click Check for updates.
- If you are using Docker Toolbox, download the latest version and run the installer.
{: #cs_cli_uninstall}
If you no longer need the CLI, you can uninstall it. {:shortdesc}
This task includes the information for removing these CLIs:
- {{site.data.keyword.containershort_notm}} plug-in
- Kubernetes CLI version 1.7.4 or later
- {{site.data.keyword.registryshort_notm}} plug-in
- Docker version 1.9. or later
To uninstall the CLIs:
-
Uninstall the {{site.data.keyword.containershort_notm}} plug-in.
bx plugin uninstall container-service
{: pre}
-
Uninstall the {{site.data.keyword.registryshort_notm}} plug-in.
bx plugin uninstall container-registry
{: pre}
-
Verify the plug-ins were uninstalled by running the following command and checking the list of the plug-ins that are installed.
bx plugin list
{: pre}
The container-service and the container-registry plug-in are not displayed in the results.
-
Uninstall Docker. Instructions to uninstall Docker vary based on the operating system that you use.
{: #cs_api}
You can use the {{site.data.keyword.containershort_notm}} API to automate the creation, deployment, and management of your Kubernetes clusters. {:shortdesc}
The {{site.data.keyword.containershort_notm}} API requires header information that you must provide in your API request and that can vary depending on the API that you want to use. To determine what header information is needed for your API, see the {{site.data.keyword.containershort_notm}} API documentation .
Note: To authenticate with {{site.data.keyword.containershort_notm}}, you must provide an Identity and Access Management (IAM) token that is generated with your {{site.data.keyword.Bluemix_notm}} credentials and that includes the {{site.data.keyword.Bluemix_notm}} account ID where the cluster was created. Depending on the way you authenticate with {{site.data.keyword.Bluemix_notm}}, you can choose between the following options to automate the creation of your IAM token.
{{site.data.keyword.Bluemix_notm}} ID | My options |
---|---|
Unfederated ID |
|
Federated ID |
|
- Create your IAM (Identity and Access Management) access token. The body information that is included in your request varies based on the {{site.data.keyword.Bluemix_notm}} authentication method that you use. Replace the following values:
-
<my_bluemix_username>: Your {{site.data.keyword.Bluemix_notm}} user name.
-
<my_bluemix_password>: Your {{site.data.keyword.Bluemix_notm}} password.
-
<my_api_key>: Your {{site.data.keyword.Bluemix_notm}} API key.
-
<my_passcode>: Your {{site.data.keyword.Bluemix_notm}} one-time passcode. Run
bx login --sso
and follow the instructions in your CLI output to retrieve your one-time passcode by using your web browser.POST https://iam.<region>.bluemix.net/oidc/token
{: codeblock}
Input Parameters Values Header - Content-Type:application/x-www-form-urlencoded
- Authorization: Basic Yng6Yng=
Body for {{site.data.keyword.Bluemix_notm}} user name and password - grant_type: password
- response_type: cloud_iam, uaa
- username: <my_bluemix_username>
- password: <my_bluemix_password>
- uaa_client_id: cf
- uaa_client_secret:
**Note:** Add the uaa_client_secret key with no value specified.
Body for {{site.data.keyword.Bluemix_notm}} API keys - grant_type: urn:ibm:params:oauth:grant-type:apikey
- response_type: cloud_iam, uaa
- apikey: <my_api_key>
- uaa_client_id: cf
- uaa_client_secret:
**Note:** Add the uaa_client_secret key with no value specified.
Body for {{site.data.keyword.Bluemix_notm}} one-time passcode - grant_type: urn:ibm:params:oauth:grant-type:passcode
- response_type: cloud_iam, uaa
- passcode: <my_passcode>
- uaa_client_id: cf
- uaa_client_secret:
**Note:** Add the uaa_client_secret key with no value specified.
Example API output:
{ "access_token": "<iam_token>", "refresh_token": "<iam_refresh_token>", "uaa_token": "<uaa_token>", "uaa_refresh_token": "<uaa_refresh_token>", "token_type": "Bearer", "expires_in": 3600, "expiration": 1493747503 }
{: screen}
You can find the IAM token in the access_token field of your API ouput. Note the IAM token to retrieve additional header information in the next steps.
-
Retrieve the ID of the {{site.data.keyword.Bluemix_notm}} account where the cluster was created. Replace <iam_token> with the IAM token that you retrieved in the previous step.
GET https://accountmanagement.<region>.bluemix.net/v1/accounts
{: codeblock}
Input parameters Values Headers - Content-Type: application/json
- Authorization: bearer <iam_token>
- Accept: application/json
Example API output:
{ "total_results": 3, "total_pages": 1, "prev_url": null, "next_url": null, "resources": { "metadata": { "guid": "<my_bluemix_account_id>", "url": "/v1/accounts/<my_bluemix_account_id>", "created_at": "2016-01-07T18:55:09.726Z", "updated_at": "2017-04-28T23:46:03.739Z", "origin": "BSS" ...
{: screen}
You can find the ID of your {{site.data.keyword.Bluemix_notm}} account in the resources/metadata/guid field of your API output.
-
Generate a new IAM token that includes your {{site.data.keyword.Bluemix_notm}} credentials and the account ID where the cluster was created. Replace <my_bluemix_account_id> with the ID of the {{site.data.keyword.Bluemix_notm}} account that you retrieved in the previous step.
Note: If you are using a {{site.data.keyword.Bluemix_notm}} API key, you must use the {{site.data.keyword.Bluemix_notm}} account ID the API key was created for. To access clusters in other accounts, log into this account and create a {{site.data.keyword.Bluemix_notm}} API key that is based on this account.
POST https://iam.<region>.bluemix.net/oidc/token
{: codeblock}
Input Parameters Values Header - Content-Type:application/x-www-form-urlencoded
- Authorization: Basic Yng6Yng=
Body for {{site.data.keyword.Bluemix_notm}} user name and password - grant_type: password
- response_type: cloud_iam, uaa
- username: <my_bluemix_username>
- password: <my_bluemix_password>
- uaa_client_id: cf
- uaa_client_secret:
- bss_account: <my_bluemix_account_id>
**Note:** Add the uaa_client_secret key with no value specified.
Body for {{site.data.keyword.Bluemix_notm}} API keys - grant_type: urn:ibm:params:oauth:grant-type:apikey
- response_type: cloud_iam, uaa
- apikey: <my_api_key>
- uaa_client_id: cf
- uaa_client_secret:
- bss_account: <my_bluemix_account_id>
**Note:** Add the uaa_client_secret key with no value specified.
Body for {{site.data.keyword.Bluemix_notm}} one-time passcode - grant_type: urn:ibm:params:oauth:grant-type:passcode
- response_type: cloud_iam, uaa
- passcode: <my_passcode>
- uaa_client_id: cf
- uaa_client_secret:
- bss_account: <my_bluemix_account_id>
**Note:** Add the uaa_client_secret key with no value specified.
Example API output:
{ "access_token": "<iam_token>", "refresh_token": "<iam_refresh_token>", "uaa_token": "<uaa_token>", "uaa_refresh_token": "<uaa_refresh_token>", "token_type": "Bearer", "expires_in": 3600, "expiration": 1493747503 }
{: screen}
You can find the IAM token in the access_token, the IAM refresh token in the refresh_token, and the UAA token in the uaa_token field of your CLI output.
-
Retrieve the ID of the {{site.data.keyword.Bluemix_notm}} space where the cluster was created.
-
Retrieve the API endpoint to access the space ID. Replace <uaa_token> with the UAA token that you retrieved in the previous step.
GET https://api.<region>.bluemix.net/v2/organizations
{: codeblock}
Input parameters Values Header - Content-Type: application/x-www-form-urlencoded;charset=utf
- Authorization: bearer <uaa_token>
- Accept: application/json;charset=utf-8
Example API output:
{ "metadata": { "guid": "<bluemix_org_id>", "url": "/v2/organizations/<my_bluemix_org_id>", "created_at": "2016-01-07T18:55:19Z", "updated_at": "2016-02-09T15:56:22Z" }, "entity": { "name": "<bluemix_org_name>", "billing_enabled": false, "quota_definition_guid": "<bluemix_org_id>", "status": "active", "quota_definition_url": "/v2/quota_definitions/<bluemix_org_id>", "spaces_url": "/v2/organizations/<bluemix_org_id>/spaces", ...
{: screen}
-
-
Note the output of the spaces_url field.
-
Retrieve the ID of the {{site.data.keyword.Bluemix_notm}} space by using the spaces_url endpoint.
GET https://api.<region>.bluemix.net/v2/organizations/<bluemix_org_id>/spaces
{: codeblock}
Example API output:
{ "metadata": { "guid": "<bluemix_space_id>", "url": "/v2/spaces/<my_bluemix_space_id>", "created_at": "2016-01-07T18:55:22Z", "updated_at": null }, "entity": { "name": "<bluemix_space_name>", "organization_guid": "<bluemix_org_id>", "space_quota_definition_guid": null, "allow_ssh": true, ...
{: screen}
You can find the ID of the {{site.data.keyword.Bluemix_notm}} space in the metadata/guid field of your API output.
-
List all Kubernetes clusters in your account. Use the information that you retrieved in earlier steps to build your header information.
-
US-South
GET https://us-south.containers.bluemix.net/v1/clusters
{: codeblock}
-
US-East
GET https://us-east.containers.bluemix.net/v1/clusters
{: codeblock}
-
UK-South
GET https://uk-south.containers.bluemix.net/v1/clusters
{: codeblock}
-
EU-Central
GET https://eu-central.containers.bluemix.net/v1/clusters
{: codeblock}
-
AP-South
GET https://ap-south.containers.bluemix.net/v1/clusters
{: codeblock}
Input parameters Values Header - Authorization: bearer <iam_token>
- X-Auth-Refresh-Token: <refresh_token>
-
-
Review the {{site.data.keyword.containershort_notm}} API documentation to find a list of supported APIs.
{: #cs_api_refresh}
Every IAM (Identity and Access Management) access token that is issued via the API expires after one hour. You must refresh your access token on a regular basis to assure access to the {{site.data.keyword.containershort_notm}} API. {:shortdesc}
Before you begin, make sure that you have an IAM refresh token that you can use to request a new access token. If you do not have a refresh token, review Automating the cluster creation and management process with the {{site.data.keyword.containershort_notm}} API to retrieve your access token.
Use the following steps if you want to refresh your IAM token.
-
Generate a new IAM access token. Replace <iam_refresh_token> with the IAM refresh token that you received when you authenticated with {{site.data.keyword.Bluemix_notm}}.
POST https://iam.ng.bluemix.net/oidc/token
{: codeblock}
Input parameters Values Header - Content-Type: application/x-www-form-urlencoded
- Authorization: Basic Yng6Yng=
Body - grant_type: refresh_token
- response_type: cloud_iam, uaa
- refresh_token: <iam_refresh_token>
- uaa_client_id: cf
- uaa_client_secret:
- bss_account: <bluemix_account_id>
**Note:** Add the uaa_client_secret key with no value specified.
Example API output:
{ "access_token": "<iam_token>", "refresh_token": "<iam_refresh_token>", "uaa_token": "<uaa_token>", "uaa_refresh_token": "<uaa_refresh_token>", "token_type": "Bearer", "expires_in": 3600, "expiration": 1493747503 }
{: screen}
You can find your new IAM token in the access_token, and the IAM refresh token in the refresh_token field of your API output.
-
Continue working with the {{site.data.keyword.containershort_notm}} API documentation by using the token from the previous step.