Merge pull request #1 from AliyunContainerService/master

合并
5 years ago · 69c0e9107b
parent 6a4e10df7e de54e8c9ef
commit 69c0e9107b
11 changed files with 464 additions and 286 deletions
--- a/README.md
+++ b/README.md
@ -1,69 +1,65 @@
-# 为中国用户在 Docker for Mac/Windows 中开启 Kubernetes 
+# Docker Desktop for Mac/Windows 开启 Kubernetes

 中文 | [English](README_en.md)

 说明: 

-* 需安装 Docker for Mac或者Docker for Windows，如果没有请下载[下载 Docker CE最新版本](https://store.docker.com/search?type=edition&offering=community)
-* 当前 master 分支已经在 Docker for Mac/Windows 2.0.1.x (包含 Docker CE 18.09.1 和 Kubernetes 1.13.0) 版本测试通过
-  * 如果你希望使用 Docker for Mac/Windows 2.0.0.2/2.0.0.3 (包含 Docker CE 18.09.1 和 Kubernetes 1.10.11) , 请使用下面命令切换 [v2.0.0.2 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v2.0.0.2) ```git checkout v2.0.0.2```
-  * 如果你希望使用 18.09/18.06 版本(包含 Kubernetes 1.10.3) , 请使用下面命令切换 [18.09 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/18.09) ```git checkout 18.09```
-  * 如果你希望使用 18.03 版本, 请使用下面命令切换 [18.03 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/18.03) ```git checkout 18.03```
+* 需安装 Docker Desktop 的 Mac 或者 Windows 版本，如果没有请下载[下载 Docker CE最新版本](https://store.docker.com/search?type=edition&offering=community)
+* 当前 master 分支已经在 Docker for Mac/Windows 2.2.2.0 Edge (包含 Docker CE 19.03.5 和 Kubernetes 1.16.5) 版本测试通过
+* 如果需要测试其他版本，请查看 Docker Desktop版本，Docker -> About Docker Desktop
+  ![about](images/about.png)
+  * 如Kubernetes版本为 v1.15.5, 请使用下面命令切换 [v1.15.5 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.15.5) ```git checkout v1.15.5```
+  * 如Kubernetes版本为 v1.15.4, 请使用下面命令切换 [v1.15.4 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.15.4) ```git checkout v1.15.4```
+  * 如Kubernetes版本为 v1.14.8, 请使用下面命令切换 [v1.14.8 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.14.8) ```git checkout v1.14.8```
+  * 如Kubernetes版本为 v1.14.7, 请使用下面命令切换 [v1.14.7 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.14.7) ```git checkout v1.14.7```
+  * 如Kubernetes版本为 v1.14.6, 请使用下面命令切换 [v1.14.6 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.14.6) ```git checkout v1.14.6```
+  * 如Kubernetes版本为 v1.14.3, 请使用下面命令切换 [v1.14.3 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.14.3) ```git checkout v1.14.3```
+  * 如Kubernetes版本为 v1.14.1, 请使用下面命令切换 [v1.14.1 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.14.1) ```git checkout v1.14.1```
+  * 如Kubernetes版本为 v1.13.0, 请使用下面命令切换 [v1.13.0 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.13.0) ```git checkout v1.13.0```
+  * 如Kubernetes版本为 v1.10.11, 请使用下面命令切换 [v1.10.11 分支](https://github.com/AliyunContainerService/k8s-for-docker-desktop/tree/v1.10.11) ```git checkout v1.10.11```

-### Docker for Mac 开启 Kubernetes

-为 Docker daemon 配置 Docker Hub 的中国官方镜像加速 ```https://registry.docker-cn.com```

-![mirror](images/mirror.png)
-
-可选操作: 为 Kubernetes 配置 CPU 和 内存资源，建议分配 4GB 或更多内存。 
-
-![resource](images/resource.png)
-
-预先从阿里云Docker镜像服务下载 Kubernetes 所需要的镜像, 可以通过修改 ```images.properties``` 文件加载你自己需要的镜像
-
-
-```bash
-./load_images.sh
-```
-
-开启 Kubernetes，并等待 Kubernetes 开始运行
-
-
-![k8s](images/k8s.png)


-### Docker for Windows 开启 Kubernetes
+### 开启 Kubernetes

-为 Docker daemon 配置 Docker Hub 的中国官方镜像加速 ```https://registry.docker-cn.com```
+为 Docker daemon 配置镜像加速，参考[阿里云镜像服务](https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors) 或中科大镜像加速地址```https://docker.mirrors.ustc.edu.cn```

-![mirror](images/mirror_win.png)
+![mirror](images/mirror.png)

 可选操作: 为 Kubernetes 配置 CPU 和 内存资源，建议分配 4GB 或更多内存。 

-![resource](images/resource_win.png)
+![resource](images/resource.png)

 预先从阿里云Docker镜像服务下载 Kubernetes 所需要的镜像, 可以通过修改 ```images.properties``` 文件加载你自己需要的镜像

-使用 Bash shell
+
+在 Mac 上执行如下脚本

 ```bash
 ./load_images.sh
 ```

-使用 PowerShell
+
+在Windows上，使用 PowerShell

 ```powershell
 .\load_images.ps1
 ```

 说明: 如果因为安全策略无法执行 PowerShell 脚本，请在 “以管理员身份运行” 的 PowerShell 中执行 ```Set-ExecutionPolicy RemoteSigned``` 命令。 
+开启 Kubernetes，并等待 Kubernetes 开始运行
+

 开启 Kubernetes，并等待 Kubernetes 开始运行
+![k8s](images/k8s.png)
+
+**TIPS**：

-![k8s](images/k8s_win.png)
+在Mac上:

-**TIPS**：如果想知道Kubernetes部署的过程，可以通过docker desktop应用日志获得实时安装进程信息：
+如果在Kubernetes部署的过程中出现问题，可以通过docker desktop应用日志获得实时日志信息：

 ```bash
 pred='process matches ".*(ocker|vpnkit).*"
@ -71,16 +67,19 @@ pred='process matches ".*(ocker|vpnkit).*"
 /usr/bin/log stream --style syslog --level=debug --color=always --predicate "$pred"
 ```

+在Windows上:

+如果在Kubernetes部署的过程中出现问题，可以在 C:\ProgramData\DockerDesktop下的service.txt 查看Docker日志; 
+如果看到 Kubernetes一直在启动状态，请参考 [Issue 3769(comment)](https://github.com/docker/for-win/issues/3769#issuecomment-486046718) 和 [Issue 1962(comment)](https://github.com/docker/for-win/issues/1962#issuecomment-431091114)

 ### 配置 Kubernetes


-可选操作: 切换Kubernetes运行上下文至 docker-for-desktop (docker-ce 18.09 下 context 为 docker-desktop)
+可选操作: 切换Kubernetes运行上下文至 docker-desktop (之前版本的 context 为 docker-for-desktop)


 ```shell
-kubectl config use-context docker-for-desktop
+kubectl config use-context docker-desktop
 ```

 验证 Kubernetes 集群状态
@ -90,10 +89,12 @@ kubectl cluster-info
 kubectl get nodes
 ```

-部署 Kubernetes dashboard
+### 配置 Kubernetes 控制台
+
+#### 部署 Kubernetes dashboard

 ```shell
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
 ```

 或
@ -102,6 +103,12 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/
 kubectl create -f kubernetes-dashboard.yaml
 ```

+检查 kubernetes-dashboard 应用状态
+
+```shell
+kubectl get pod -n kubernetes-dashboard
+```
+
 开启 API Server 访问代理

 ```shell
@ -110,16 +117,16 @@ kubectl proxy

 通过如下 URL 访问 Kubernetes dashboard

-http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/overview?namespace=default
-
-### 配置 kubeconfig (可跳过)
+http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

+#### 配置控制台访问令牌

 对于Mac环境

 ```shell
 TOKEN=$(kubectl -n kube-system describe secret default| awk '$1=="token:"{print $2}')
 kubectl config set-credentials docker-for-desktop --token="${TOKEN}"
+echo $TOKEN
 ```

 对于Windows环境
@ -127,13 +134,18 @@ kubectl config set-credentials docker-for-desktop --token="${TOKEN}"
 ```shell
 $TOKEN=((kubectl -n kube-system describe secret default | Select-String "token:") -split " +")[1]
 kubectl config set-credentials docker-for-desktop --token="${TOKEN}"
+echo $TOKEN
 ```

-#### 登录dashboard的时候选择 kubeconfig 文件
+#### 登录dashboard的时候

 ![resource](images/k8s_credentials.png)

-选择 kubeconfig 文件,路径如下：
+选择 **令牌** 
+
+输入上文控制台输出的内容
+
+或者选择 **Kubeconfig** 文件,路径如下：

 ```
 Mac: $HOME/.kube/config
@ -149,8 +161,8 @@ Win: %UserProfile%\.kube\config
 #### 安装 Ingress

 ```shell
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/cloud-generic.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/cloud-generic.yaml
 ```

 验证
@ -191,55 +203,29 @@ kubectl delete -f sample/ingress.yaml
 #### 删除 Ingress

 ```shell
-kubectl delete -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/cloud-generic.yaml
-kubectl delete -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
+kubectl delete -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/cloud-generic.yaml
+kubectl delete -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
 ```

 ### 安装 Helm

-可以根据文档安装 helm https://github.com/helm/helm/blob/master/docs/install.md
+可以根据文档安装 helm v3 https://helm.sh/docs/intro/install/

 #### 在 Mac OS 上安装

 ##### 通过 brew 安装

-brew 安装的版本可能会和 helm server 不兼容, 如果在后续使用 helm 安装组件的过程中出现以下错误，可以 `通过二进制包安装` 对应的版本
-
-```
-$ helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
-Error: incompatible versions client[v2.13.1] server[v2.12.2]
-```
-
 ```shell
 # Use homebrew on Mac
-brew install kubernetes-helm
-
-# Change helm repo
-helm repo add stable http://mirror.azure.cn/kubernetes/charts-incubator/
+brew install helm

-# Install Tiller into your Kubernetes cluster
-helm init --upgrade -i registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12.2 --skip-refresh
+# Add helm repo
+helm repo add stable http://mirror.azure.cn/kubernetes/charts/

-# Update charts repo (Optional)
+# Update charts repo
 helm repo update
 ```

-##### 通过二进制包安装
-
-```
-# Download binary release
-在 https://github.com/helm/helm/releases 中找到匹配的版本并下载(需要梯子), 如: https://storage.googleapis.com/kubernetes-helm/helm-v2.12.2-darwin-amd64.tar.gz
-
-# Unpack
-
-tar -zxvf helm-v2.0.0-linux-amd64.tgz
-
-# Move it to its desired destination
-
-mv darwin-amd64/helm /usr/local/bin/helm
-
-```
-
 #### 在Windows上安装

 如果在后续使用 helm 安装组件的过程中出现版本兼容问题，可以参考 `通过二进制包安装` 思路安装匹配的版本
@ -250,27 +236,43 @@ mv darwin-amd64/helm /usr/local/bin/helm
 choco install kubernetes-helm

 # Change helm repo
-helm repo add stable http://mirror.azure.cn/kubernetes/charts-incubator/
-
-# Install Tiller into your Kubernetes cluster
-helm init --upgrade -i registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12.2 --skip-refresh
+helm repo add stable http://mirror.azure.cn/kubernetes/charts/

-# Update charts repo (Optional)
+# Update charts repo
 helm repo update
 ```

+#### 测试 Helm (可选)
+
+安装 Wordpress
+
+```shell
+helm install wordpress stable/wordpress
+```
+
+查看 wordpress 发布状态
+
+```shell
+helm install wordpress stable/wordpress
+```
+
+卸载 wordpress 发布
+
+```shell
+helm uninstall wordpress
+```

 ### 配置 Istio

 说明：Istio Ingress Gateway和Ingress缺省的端口冲突，请移除Ingress并进行下面测试

-可以根据文档安装 Istio https://istio.io/docs/setup/kubernetes/
+可以根据文档安装 Istio https://istio.io/docs/setup/getting-started/

-#### 下载 Istio 1.1.1 并安装 CLI
+#### 下载 Istio 1.5.0

 ```bash
-curl -L https://git.io/getLatestIstio | sh -
-cd istio-1.1.1/
+curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.5.0 sh -
+cd istio-1.5.0
 export PATH=$PWD/bin:$PATH
 ```

@ -280,25 +282,16 @@ export PATH=$PWD/bin:$PATH
 .\getLatestIstio.ps1
 ```

-
-
-#### 通过 Helm chart 安装 Istio
+#### 安装 Istio

 ```shell
-# 安装 istio-init chart 安装所有的 Istio CRD
-helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
-
-# 验证下安装的 Istio CRD 个数
-kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
-
-# 开始 istio chart 安装
-helm install install/kubernetes/helm/istio --name istio --namespace istio-system
+istioctl manifest apply --set profile=demo
 ```

-#### 查看 istio 发布状态
+#### 检查 Istio 状态

 ```shell
-helm status istio
+kubectl get pods -n istio-system
 ```

 #### 为 ```default``` 名空间开启自动 sidecar 注入
@ -310,53 +303,57 @@ kubectl get namespace -L istio-injection

 #### 安装 Book Info 示例

+请参考 https://istio.io/docs/examples/bookinfo/
+
 ```shell
 kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
-kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
 ```

+查看示例应用资源
+
+```shell
+kubectl get svc,pod
+```

 确认示例应用在运行中

-```bash
-export GATEWAY_URL=localhost:80
-curl -o /dev/null -s -w "%{http_code}\n" http://${GATEWAY_URL}/productpage
+```shell
+kubectl exec -it $(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}') -c ratings -- curl productpage:9080/productpage | grep -o "<title>.*</title>"
 ```

-可以通过浏览器访问
-
-http://localhost/productpage
+创建 Ingress Gateway

+```shell
+kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
+```

-说明：如果当前80端口已经被占用或保留，我们可以编辑 ```install/kubernetes/helm/istio/values.yaml``` 文件中
-Gateway 端口进行调整，比如将 80 端口替换为 8888 端口
+查看 Gateway 配置

-```
-      ## You can add custom gateway ports
-    - port: 8888  # Changed from 80
-      targetPort: 80
-      name: http2
-      nodePort: 31380
+```shell
+kubectl get gateway
 ```

-然后执行如下命令并生效
+确认示例应用可以访问

 ```shell
-kubectl delete service istio-ingressgateway -n istio-system
-helm upgrade istio install/kubernetes/helm/istio
+export GATEWAY_URL=localhost:80
+curl -s http://${GATEWAY_URL}/productpage | grep -o "<title>.*</title>"
 ```

+可以通过浏览器访问
+
+http://localhost/productpage
+
 #### 删除实例应用

-```bash
+```shell
 samples/bookinfo/platform/kube/cleanup.sh
 ```

 ### 卸载 Istio

 ```shell
-helm del --purge istio
-kubectl delete -f install/kubernetes/helm/istio/templates/crds.yaml -n istio-system
+istioctl manifest generate --set profile=demo | kubectl delete -f -
 ```


--- a/README_en.md
+++ b/README_en.md
@ -1,17 +1,26 @@
-# Enable Kubernetes on Docker for Mac/Windows in China
+# Enable Kubernetes on Docker Desktop for Mac/Windows in China

 [中文](README.md) | English

 NOTE: 

-* The master branch is tested with Docker for Mac/Windows version 2.0.1.x (with Docker 18.09.1 and Kubernetes 1.13.0). 
-  * If you want to use v2.0.0.2/v2.0.0.3 (with Docker CE 18.09.1 and Kubernetes 1.10.11), please use the 18.09 branch ```git checkout v2.0.0.2```
-  * If you want to use Docker CE 18.09/18.06 (with Kubernetes 1.10.3), please use the 18.09 branch ```git checkout 18.09```
-  * If you want to use Docker CE 18.03, please use the 18.03 branch ```git checkout 18.03```
+* The master branch is tested with Docker Desktop for Mac/Windows version 2.2.2.0 Edge (with Docker CE 19.03.5 and Kubernetes 1.16.5). 
+* If you want to use with other version, pls check version of Kubernetes，Docker -> About Docker Desktop
+    ![about](images/about.png)
+    * For Kubernetes v1.15.5, please use the v1.15.5 branch ```git checkout v1.15.5```
+    * For Kubernetes v1.15.4, please use the v1.15.4 branch ```git checkout v1.15.4```
+    * For Kubernetes v1.14.8, please use the v1.14.8 branch ```git checkout v1.14.8```
+    * For Kubernetes v1.14.7, please use the v1.14.7 branch ```git checkout v1.14.7```
+    * For Kubernetes v1.14.6, please use the v1.14.6 branch ```git checkout v1.14.6```
+    * For Kubernetes v1.14.3, please use the v1.14.3 branch ```git checkout v1.14.3```
+    * For Kubernetes v1.14.1, please use the v1.14.1 branch ```git checkout v1.14.1```
+    * For Kubernetes v1.13.0, please use the v1.13.0 branch ```git checkout v1.13.0```
+    * For Kubernetes v1.10.11, please use the v1.10.11 branch ```git checkout v1.10.11```

-### Enable Kubernetes on Docker for Mac

-Config registry mirror for Docker daemon with ```https://registry.docker-cn.com``` only if in China
+### Enable Kubernetes on Docker Desktop
+
+Config registry mirror for Docker daemon with ```https://docker.mirrors.ustc.edu.cn``` only if in China

 ![mirror](images/mirror.png)

@ -21,36 +30,13 @@ Optional: config the CPU and memory for Kubernetes, 4GB RAM or more is suggested

 Preload Kubernetes images form Alibaba Cloud Registry Service, NOTE: you can modify the ```images.properties``` for your own images

+On Mac, execute the following scripts

 ```bash
 ./load_images.sh
 ```

-Enable Kubernetes in Docker for Mac, and wait a while for Kubernetes is running
-
-
-![k8s](images/k8s.png)
-
-
-### Enable Kubernetes on Docker for Windows
-
-Config registry mirror for Docker daemon with ```https://registry.docker-cn.com```
-
-![mirror](images/mirror_win.png)
-
-Optional: config the CPU and memory for Kubernetes, 4GB RAM or more is suggested. 
-
-![resource](images/resource_win.png)
-
-Preload Kubernetes images form Alibaba Cloud Registry Service, NOTE: you can modify the ```images.properties``` for your own images
-
-In Bash shell
-
-```bash
-./load_images.sh
-```
-
-or in PowerShell of Windows
+Or on Windows, execute the following scripts in PowerShell

 ```powershell
 .\load_images.ps1
@ -58,19 +44,20 @@ or in PowerShell of Windows

 NOTE: if you failed to start PowerShell scripts for security policy, please execute ```Set-ExecutionPolicy RemoteSigned``` command in PowerShell with "Run as administrator" option. 

-Enable Kubernetes in Docker for Windows, and wait a while for Kubernetes is running

-![k8s](images/k8s_win.png)
+Enable Kubernetes, and wait a while for Kubernetes is running
+
+![k8s](images/k8s.png)


 ### Config Kubernetes


-Optional: switch the context to `docker-for-desktop` (under docker ce 18.09, the conext is `docker-desktop`)
+Optional: switch the context to `docker-desktop` (In the former version, the context is `docker-for-desktop`)


 ```shell
-kubectl config use-context docker-for-desktop
+kubectl config use-context docker-desktop
 ```

 Verify Kubernetes installation
@ -80,10 +67,13 @@ kubectl cluster-info
 kubectl get nodes
 ```

-Deploy Kubernetes dashboard
+
+### Deploy Kubernetes dashboard
+
+#### Install Kubernetes dashboard

 ```shell
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
 ```

 or
@ -92,23 +82,30 @@ or
 kubectl create -f kubernetes-dashboard.yaml
 ```

+Check Kubernetes Dashboard status
+
+```shell
+kubectl get pod -n kubernetes-dashboard
+```
+
 Start proxy for API server

 ```shell
 kubectl proxy
 ```

-Access Kubernetes dashboard
+#### Access Kubernetes dashboard

-http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/overview?namespace=default
+http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

-#### Config kubeconfig (Or skip)
+#### Config Token for dashboard

 For Mac

 ```bash
 TOKEN=$(kubectl -n kube-system describe secret default| awk '$1=="token:"{print $2}')
 kubectl config set-credentials docker-for-desktop --token="${TOKEN}"
+echo $TOKEN
 ```

 For Windows
@ -116,13 +113,16 @@ For Windows
 ```cmd
 $TOKEN=((kubectl -n kube-system describe secret default | Select-String "token:") -split " +")[1]
 kubectl config set-credentials docker-for-desktop --token="${TOKEN}"
+echo $TOKEN
 ```

-#### Choose kubeconfig file (Optional)
+#### Login dashboard

 ![resource](images/k8s_credentials.png)

-Choose kubeconfig file, Path：
+Choose **Token**, and input the output from above result
+
+Or, choose **Kubeconfig**, select file from below path：

 ```
 Win: %UserProfile%\.kube\config
@ -133,18 +133,18 @@ Click login, go to Kubernetes Dashboard

 ### Install Helm

-Install helm following the instruction on https://github.com/helm/helm/blob/master/docs/install.md
+Install helm following the instruction on https://helm.sh/docs/intro/install/

 #### For Mac OS

 ```shell
 # Use homebrew on Mac
-brew install kubernetes-helm
+brew install helm

-# Install Tiller into your Kubernetes cluster
-helm init --upgrade -i registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12.2 --skip-refresh
+# add helm repo
+helm repo add stable http://mirror.azure.cn/kubernetes/charts/

-# update charts repo (Optional)
+# update charts repo
 helm repo update
 ```

@ -155,70 +155,112 @@ helm repo update
 # NOTE: please ensure you can access googleapis
 choco install kubernetes-helm

-# Install Tiller into your Kubernetes cluster
-helm init --upgrade -i registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12.2 --skip-refresh
+# add helm repo
+helm repo add stable http://mirror.azure.cn/kubernetes/charts/

-# update charts repo (Optional)
+# update charts repo
 helm repo update
 ```

-### Install Istio
+### Setup Istio

-More details can be found in https://istio.io/docs/setup/kubernetes/
+More details can be found in https://istio.io/docs/setup/getting-started/

-Download Istio 1.1.1 and install CLI
+#### Download Istio 1.5.0 and install CLI

-```bash
-curl -L https://git.io/getLatestIstio | sh -
-cd istio-1.1.1/
+```shell
+curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.5.0 sh -
+cd istio-1.5.0/
 export PATH=$PWD/bin:$PATH
 ```

-Install Istio with Helm chart
+In Windows, you can download the Istio manually, or copy ```getLatestIstio.ps1``` to your Istio directory, and execute the script. 

-```shell
-# Install the istio-init chart to bootstrap all the Istio’s CRDs
-helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
+NOTE: It refer the [scripts](https://gist.github.com/kameshsampath/796060a806da15b39aa9569c8f8e6bcf) from community.

-# Verify that all Istio CRDs were committed to the Kubernetes api-server
-kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
+```powershell
+.\getLatestIstio.ps1
+```

-# Install the istio chart
-helm install install/kubernetes/helm/istio --name istio --namespace istio-system
+#### Install Istio
+
+```shell
+istioctl manifest apply --set profile=demo
 ```

 Check status of istio release

 ```shell
-helm status istio
+kubectl get pods -n istio-system
 ```

-Enable automatic sidecar injection for ```default``` namespace
+#### Enable automatic sidecar injection for ```default``` namespace

 ```shell
 kubectl label namespace default istio-injection=enabled
 kubectl get namespace -L istio-injection
 ```

-Install Book Info sample
+#### Install Book Info sample
+
+Please refer https://istio.io/docs/examples/bookinfo/

 ```shell
 kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
+```
+
+Check the resources of sample application
+
+```shell
+kubectl get svc,pod
+```
+
+Confirm the application is running
+
+```shell
+kubectl exec -it $(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}') -c ratings -- curl productpage:9080/productpage | grep -o "<title>.*</title>"
+```
+
+Create Ingress Gateway
+
+```shell
 kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
+```

+Check Gateway status

-Confirm application is running
+```shell
+kubectl get gateway
+```
+
+Confirm the application is accessible
+
+```shell
+export GATEWAY_URL=localhost:80
+curl -s http://${GATEWAY_URL}/productpage | grep -o "<title>.*</title>"
+```
+
+Open with browser http://localhost/productpage

-```bash
+
+#### Confirm application is running
+
+```shell
 export GATEWAY_URL=localhost:80
 curl -o /dev/null -s -w "%{http_code}\n" http://${GATEWAY_URL}/productpage
 ```

-Delete Istio
+#### Cleanup sample application 
+
+```shell
+samples/bookinfo/platform/kube/cleanup.sh
+```
+
+#### Delete Istio

 ```shell
-helm del --purge istio
-kubectl delete -f install/kubernetes/helm/istio/templates/crds.yaml -n istio-system
+istioctl manifest generate --set profile=demo | kubectl delete -f -
 ```


+
--- a/getLatestIstio.ps1
+++ b/getLatestIstio.ps1
@ -1,10 +1,10 @@
 param(
-    [string] $IstioVersion = "1.0.3"
+    [string] $IstioVersion = $(Invoke-RestMethod "https://api.github.com/repos/istio/istio/releases")[0].tag_name
 )

 $url = "https://github.com/istio/istio/releases/download/$($IstioVersion)/istio-$($IstioVersion)-win.zip"
 $Path = Get-Location
-$output = [IO.Path]::Combine($Path, "istio-$($IstioVersion)-win.zip¡±)
+$output = [IO.Path]::Combine($Path, "istio-$($IstioVersion)-win.zip")
    
 Write-Host "Downloading Istio from $url to path " $Path -ForegroundColor Green 
    
--- a/images.properties
+++ b/images.properties
@ -1,10 +1,8 @@
 k8s.gcr.io/pause:3.1=registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.1
-k8s.gcr.io/kube-controller-manager:v1.13.0=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.13.0
-k8s.gcr.io/kube-scheduler:v1.13.0=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.13.0
-k8s.gcr.io/kube-proxy:v1.13.0=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.13.0
-k8s.gcr.io/kube-apiserver:v1.13.0=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.13.0
-k8s.gcr.io/etcd:3.2.24=registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.2.24
-k8s.gcr.io/coredns:1.2.6=registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.2.6
-k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1=registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
-quay.io/coreos/hyperkube:v1.7.6_coreos.0=registry.cn-hangzhou.aliyuncs.com/coreos_containers/hyperkube:v1.7.6_coreos.0
-quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.21.0=registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.21.0
+k8s.gcr.io/kube-controller-manager:v1.16.5=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.16.5
+k8s.gcr.io/kube-scheduler:v1.16.5=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.16.5
+k8s.gcr.io/kube-proxy:v1.16.5=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.16.5
+k8s.gcr.io/kube-apiserver:v1.16.5=registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.16.5
+k8s.gcr.io/etcd:3.3.15-0=registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.3.15-0
+k8s.gcr.io/coredns:1.6.2=registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.6.2
+quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1=registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.26.1
--- a/images/about.png
+++ b/images/about.png
--- a/images/k8s.png
+++ b/images/k8s.png
--- a/images/k8s_credentials.png
+++ b/images/k8s_credentials.png
--- a/images/mirror.png
+++ b/images/mirror.png
--- a/images/resource.png
+++ b/images/resource.png
--- a/kubernetes-dashboard.yaml
+++ b/kubernetes-dashboard.yaml
@ -12,7 +12,38 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# ------------------- Dashboard Secret ------------------- #
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubernetes-dashboard
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+  selector:
+    k8s-app: kubernetes-dashboard
+
+---

 apiVersion: v1
 kind: Secret
@ -20,74 +51,121 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 type: Opaque

 ---
-# ------------------- Dashboard Service Account ------------------- #

 apiVersion: v1
-kind: ServiceAccount
+kind: Secret
 metadata:
  labels:
    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kube-system
+  name: kubernetes-dashboard-csrf
+  namespace: kubernetes-dashboard
+type: Opaque
+data:
+  csrf: ""
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-key-holder
+  namespace: kubernetes-dashboard
+type: Opaque
+
+---
+
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-settings
+  namespace: kubernetes-dashboard

 ---
-# ------------------- Dashboard Role & Role Binding ------------------- #

 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: kubernetes-dashboard-minimal
-  namespace: kube-system
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
 rules:
-  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create"]
-  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["create"]
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: [""]
    resources: ["secrets"]
-  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
+    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
-  # Allow Dashboard to get metrics from heapster.
+    # Allow Dashboard to get metrics.
  - apiGroups: [""]
    resources: ["services"]
-  resourceNames: ["heapster"]
+    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
-  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
+    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

 ---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+rules:
+  # Allow Metrics Scraper to get metrics from the Metrics server
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+
+---
+
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: kubernetes-dashboard-minimal
-  namespace: kube-system
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
-  name: kubernetes-dashboard-minimal
+  name: kubernetes-dashboard
 subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
-  namespace: kube-system
+    namespace: kubernetes-dashboard
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kubernetes-dashboard

 ---
-# ------------------- Dashboard Deployment ------------------- #

 kind: Deployment
 apiVersion: apps/v1
@ -95,7 +173,7 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 spec:
  replicas: 1
  revisionHistoryLimit: 10
@ -109,12 +187,14 @@ spec:
    spec:
      containers:
        - name: kubernetes-dashboard
-        image: registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
+          image: kubernetesui/dashboard:v2.0.0-rc5
+          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --auto-generate-certificates
+            - --namespace=kubernetes-dashboard
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
@ -132,6 +212,11 @@ spec:
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
@ -139,24 +224,79 @@ spec:
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "beta.kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule

 ---
-# ------------------- Dashboard Service ------------------- #

 kind: Service
 apiVersion: v1
 metadata:
  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kube-system
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
 spec:
  ports:
-    - port: 443
-      targetPort: 8443
+    - port: 8000
+      targetPort: 8000
  selector:
-    k8s-app: kubernetes-dashboard
+    k8s-app: dashboard-metrics-scraper
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: dashboard-metrics-scraper
+  template:
+    metadata:
+      labels:
+        k8s-app: dashboard-metrics-scraper
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
+    spec:
+      containers:
+        - name: dashboard-metrics-scraper
+          image: kubernetesui/metrics-scraper:v1.0.3
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 8000
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          volumeMounts:
+          - mountPath: /tmp
+            name: tmp-volume
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "beta.kubernetes.io/os": linux
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}
--- a/load_images.sh
+++ b/load_images.sh
@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash

 file="images.properties"

@ -17,3 +17,4 @@ then
 else
  echo "$file not found."
 fi
+