So far I have mostly used Amazons EKS platform for my posts on Kubernetes. However, this is of course not the only choice – there are many other providers that offer Kubernetes in a cloud environment. One of them which is explicitly targeting developers is DigitalOcean. In this post, I will show you how easy it is to automate the creation of a Kubernetes cluster on the DigitalOcean platform.
Creating an SSH key
Similar to most other platforms, DigitalOcean offers SSH access to their virtual machines. You can either ask DigitalOcean to create a root password for you and send it to you via mail, or – preferred – you can use SSH keys.
Different from AWS, key pairs need to be generated manually outside of the platform and imported. So let us generate a key pair called do_k8s and import it into the platform. To create the key locally, run
$ ssh-keygen -f ~/.ssh/do_k8s -N ""
This will create a new key (not protected by a passphrase, so be careful) and store the private key file and the public key file in separate files in the SSH standard directory. You can print out the contents of the public key file as follows.
$ cat ~/.ssh/do_k8s.pub
The resulting output is the public part of your SSH key, including the string “ssh-rsa” at the beginning. To make this key known to DigitalOcean, log into the console, navigate to the security tab, click “Add SSH key”, enter the name “do_k8s” and copy the public key into the corresponding field.
Next, let us test our setup. We will create a request using curl to list all our droplets. In the DigitalOcean terminology, a droplet is a virtual machine instance. Of course, we have not yet created one, so expect to get an empty list, but we can uses this to test that our token works. For that purpose, we simply use curl to direct a GET request to the API endpoint and pass the bearer token in an additional header.
$ curl -s -X\
GET "https://api.digitalocean.com/v2/droplets/"\
-H "Authorization: Bearer $bearerToken"\
-H "Content-Type: application/json"
{"droplets":[],"links":{},"meta":{"total":0}}
So no droplets, as expected, but our token seems to work.
Droplets
Let us now see how we can create a droplet. We could of course also use the cloud console to do this, but as our aim is automation, we will leverage the API.
When you have worked with a REST API before, you will not be surprised to learn that this is done by submitting a POST request. This request will contain a JSON body that describes the resource to be created – a droplet in our case – and a header that, among other things, is used to submit the bearer token that we have just created.
To be able to log into our droplet later on, we will have to pass the SSH key that we have just created to the API. Unfortunately, for that, we cannot use the name of the key (do_k8s), but we will have to use the internal ID. So the first thing we need to do is to place a GET request to extract this ID. As so often, we can do this with a combination of curl to retrieve the key and jq to parse the JSON output.
$ sshKeyName="do_k8s"
$ sshKeyId=$(curl -s -X \
GET "https://api.digitalocean.com/v2/account/keys/" \
-H "Authorization: Bearer $bearerToken" \
-H "Content-Type: application/json" \
| jq -r "select(.ssh_keys[].name=\"$sshKeyName\") .ssh_keys[0].id")
Here we first use curl to get a list of all keys in JSON format. We then pipe the output into jq and use the select statement to get only those items for which the attribute name matches our key name. Finally, we extract the ID field from this item and store it in a shell variable.
We can now assemble the data part of our request. The code is a bit difficult to read, as we need to escape quotes.
$ data="{\"name\":\"myDroplet\",\
\"region\":\"fra1\",\
\"size\":\"s-1vcpu-1gb\",\
\"image\":\"ubuntu-18-04-x64\",\
\"ssh_keys\":[ $sshKeyId ]}"
To get a nice, readable representation of this, we can use jq’s pretty printing capabilities.
$ echo $data | jq
{
"name": "myDroplet",
"region": "fra1",
"size": "s-1vcpu-1gb",
"image": "ubuntu-18-04-x64",
"ssh_keys": [
24322857
]
}
We see that this is a simple JSON structure. There is a name, which will be the name used later in the DigitalOcean console to display our droplet, a region (I use fra1 in central europe, a full list of all available regions is here), a size specifying the type of the droplet (in this case one vCPU and 1 GB), the OS image to use and finally the SSH key id that we have extracted before. Let us now submit our creation request.
$ curl -s -X \
POST "https://api.digitalocean.com/v2/droplets"\
-d "$data" \
-H "Authorization: Bearer $bearerToken"\
-H "Content-Type: application/json"
When everything works, you should see your droplet on the DigitalOcean web console. If you repeat the GET request above to obtain all droplets, your droplet should also show up in the list. To format the output, you can again pipe it through jq. After some time, the status field (located at the top of the output) should be “active”, and you should be able to retrieve an IP address from the section “networks”. In my case, this is 46.101.128.54. We can now SSH into the machine as follows.
$ ssh -i ~/.ssh/do_key root@46.101.128.54
Needless to say that it is also easy to delete a droplet again using the API. A full reference can be found here. I have also created a few scripts that can automatically create a droplet, list all running droplets and delete a droplet.
Creating a Kubernetes cluster
Let us now turn to the creation of a Kubernetes cluster. The good news is that this is even easier than the creation of a droplet – a single POST request will do!
But before we can assemble our request, we need to understand how the cluster definition is structured. Of course, a Kubernetes cluster consists of a couple of management nodes (which DigitalOcean manages for you in the background) and worker nodes. On DigitalOcean, worker nodes are organized in node pools. Each node pool contains a set of identical worker nodes. We could, for instance, create one pool with memory-heavy machines for database workloads that require caching, and a second pool with general purpose machines for microservices. The smallest machines that DigitalOcean will allow you to bring up as worker nodes are of type s-1vcpu-2gb. To fully specify a node pool with two machines of this type, the following JSON fragment is used.
$ nodePool="{\"size\":\"s-1vcpu-2gb\",\
\"count\": 2,\
\"name\": \"my-pool\"}"
$ echo $nodePool | jq
{
"size": "s-1vcpu-2gb",
"count": 2,
"name": "my-pool"
}
Next, we assemble the data part of the POST request. We will need to specify an array of node pools (here we will use only one node pool), the region, a name for the cluster, and a Kubernetes version (you can of course ask the API to give you a list of all existings versions by running a GET request on the URL path/v2/kubernetes/options). Using the node pool snippet from above, we can assemble and display our request data as follows.
$ data="{\"name\": \"my-cluster\",\
\"region\": \"fra1\",\
\"version\": \"1.13.5-do.1\",\
\"node_pools\": [ $nodePool ]}"
$ echo $data | jq
{
"name": "my-cluster",
"region": "fra1",
"version": "1.13.5-do.1",
"node_pools": [
{
"size": "s-1vcpu-2gb",
"count": 2,
"name": "my-pool"
}
]
}
Finally, we submit this data using a POST request as we have done it for our droplet above.
$ curl -s -w -X\
POST "https://api.digitalocean.com/v2/kubernetes/clusters"\
-d "$data" \
-H "Authorization: Bearer $bearerToken"\
-H "Content-Type: application/json"
Now cluster creation should start, and if you navigate to the Kubernetes tab of the DigitalOcean console, you should see your cluster being created.
Cluster creation is rather fast on DigitalOcean, and typically takes less than five minutes. To complete the setup, you will have to download the kubectl config file for the newly generated cluster. Of course, there are again two ways to do this – you can use the web console or the API. I have created a script that fully automates cluster creation – it detects the latest Kubernetes version, creates the cluster, waits until it is active and downloads the kubectl config file for you. If you run this, make sure to populate the shell variable bearerToken with your token or use the -t switch to pass the token to the script. The same directory also contains a few more scripts to list all existing clusters and to delete them again.
LeftAsExercise 