08-27-周三_17-09-29
This commit is contained in:
289
Kubernetes/手动安装手册.md
Normal file
289
Kubernetes/手动安装手册.md
Normal file
@@ -0,0 +1,289 @@
|
||||
# 环境准备
|
||||
|
||||
| 角色 | 主机名 | ip地址 | 配置 |
|
||||
| :----- | -------- | --------------- | ------- |
|
||||
| master | master01 | 192.168.173.100 | 2C4G60G |
|
||||
| node01 | node01 | 192.168.173.101 | 2C2G60G |
|
||||
| node02 | node2 | 192.168.173.102 | 2C2G60G |
|
||||
|
||||
# 环境初始化
|
||||
|
||||
```bash
|
||||
# 网卡配置
|
||||
# cat /etc/NetworkManager/system-connections/ens160.nmconnection
|
||||
[ipv4]
|
||||
method=manual
|
||||
address1=192.168.173.100/24,192.168.173.2
|
||||
dns=114.114.114.114;114.114.115.115
|
||||
# cat /etc/NetworkManager/system-connections/ens192.nmconnection
|
||||
[connection]
|
||||
autoconnect=false
|
||||
|
||||
# 调用 nmcli 重启设备和连接配置
|
||||
nmcli d d ens192
|
||||
nmcli d r ens160
|
||||
nmcli c r ens160
|
||||
```
|
||||
|
||||
```bash
|
||||
# Rocky 系统软件源更换
|
||||
sed -e 's|^mirrorlist=|#mirrorlist=|g' \
|
||||
-e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
|
||||
-i.bak \
|
||||
/etc/yum.repos.d/[Rr]ocky*.repo
|
||||
|
||||
dnf makecache
|
||||
# 防火墙修改 firewalld 为 iptables
|
||||
systemctl stop firewalld
|
||||
systemctl disable firewalld
|
||||
|
||||
yum -y install iptables-services
|
||||
systemctl start iptables
|
||||
iptables -F
|
||||
systemctl enable iptables
|
||||
service iptables save
|
||||
# 禁用 Selinux
|
||||
setenforce 0
|
||||
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
|
||||
grubby --update-kernel ALL --args selinux=0
|
||||
# 查看是否禁用，grubby --info DEFAULT
|
||||
# 回滚内核层禁用操作，grubby --update-kernel ALL --remove-args selinux
|
||||
# 设置时区
|
||||
timedatectl set-timezone Asia/Shanghai
|
||||
```
|
||||
|
||||
```bash
|
||||
# 关闭 swap 分区
|
||||
swapoff -a
|
||||
sed -i 's:/dev/mapper/rl-swap:#/dev/mapper/rl-swap:g' /etc/fstab
|
||||
|
||||
# 修改主机名
|
||||
hostnamectl set-hostname k8s-node01
|
||||
# 安装 ipvs
|
||||
yum install -y ipvsadm
|
||||
# 开启路由转发
|
||||
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
|
||||
sysctl -p
|
||||
# 加载 bridge
|
||||
yum install -y epel-release
|
||||
yum install -y bridge-utils
|
||||
|
||||
modprobe br_netfilter
|
||||
echo 'br_netfilter' >> /etc/modules-load.d/bridge.conf
|
||||
echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
|
||||
echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
|
||||
sysctl -p
|
||||
```
|
||||
|
||||
```bash
|
||||
# 添加 docker-ce yum 源
|
||||
# 中科大(ustc)
|
||||
sudo dnf config-manager --add-repo https://mirrors.ustc.edu.cn/docker-ce/linux/centos/docker-ce.repo
|
||||
cd /etc/yum.repos.d
|
||||
# 切换中科大源
|
||||
sed -i 's#download.docker.com#mirrors.ustc.edu.cn/docker-ce#g' docker-ce.repo
|
||||
|
||||
# 安装 docker-ce
|
||||
yum -y install docker-ce
|
||||
|
||||
# 配置 daemon.
|
||||
cat > /etc/docker/daemon.json <<EOF
|
||||
{
|
||||
"data-root": "/data/docker",
|
||||
"exec-opts": ["native.cgroupdriver=systemd"],
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "100m",
|
||||
"max-file": "100"
|
||||
},
|
||||
"registry-mirrors": [
|
||||
"https://docker.1ms.run",
|
||||
"https://docker.1panel.live",
|
||||
"https://docker.xuanyuan.me",
|
||||
"https://dockerproxy.net",
|
||||
"https://docker.fast360.cn",
|
||||
"https://cloudlayer.icu",
|
||||
"https://docker-registry.nmqu.com",
|
||||
"https://hub.amingg.com",
|
||||
"https://docker.amingg.com",
|
||||
"https://docker.hlmirror.com"
|
||||
]
|
||||
}
|
||||
EOF
|
||||
mkdir -p /etc/systemd/system/docker.service.d
|
||||
|
||||
# 重启docker服务
|
||||
systemctl daemon-reload && systemctl restart docker && systemctl enable docker
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
# 安装 cri-docker
|
||||
wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.9/cri-dockerd-0.3.9.amd64.tgz
|
||||
tar -xf cri-dockerd-0.3.9.amd64.tgz
|
||||
cp cri-dockerd/cri-dockerd /usr/bin/
|
||||
chmod +x /usr/bin/cri-dockerd
|
||||
|
||||
# 配置 cri-docker 服务
|
||||
cat <<"EOF" > /usr/lib/systemd/system/cri-docker.service
|
||||
[Unit]
|
||||
Description=CRI Interface for Docker Application Container Engine
|
||||
Documentation=https://docs.mirantis.com
|
||||
After=network-online.target firewalld.service docker.service
|
||||
Wants=network-online.target
|
||||
Requires=cri-docker.socket
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.8
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
TimeoutSec=0
|
||||
RestartSec=2
|
||||
Restart=always
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
TasksMax=infinity
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# 添加 cri-docker 套接字
|
||||
cat <<"EOF" > /usr/lib/systemd/system/cri-docker.socket
|
||||
[Unit]
|
||||
Description=CRI Docker Socket for the API
|
||||
PartOf=cri-docker.service
|
||||
[Socket]
|
||||
ListenStream=%t/cri-dockerd.sock
|
||||
SocketMode=0660
|
||||
SocketUser=root
|
||||
SocketGroup=docker
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
EOF
|
||||
|
||||
# 启动 cri-docker 对应服务
|
||||
systemctl daemon-reload
|
||||
systemctl enable cri-docker
|
||||
systemctl start cri-docker
|
||||
systemctl is-active cri-docker
|
||||
```
|
||||
|
||||
```bash
|
||||
# 添加 kubeadm yum 源
|
||||
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
|
||||
[kubernetes]
|
||||
name=Kubernetes
|
||||
baseurl=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key
|
||||
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
|
||||
EOF
|
||||
|
||||
# 安装 kubeadm 1.29 版本
|
||||
yum install -y kubelet-1.29.0 kubectl-1.29.0 kubeadm-1.29.0
|
||||
systemctl enable kubelet.service
|
||||
```
|
||||
|
||||
```bash
|
||||
# 初始化主节点
|
||||
kubeadm init\
|
||||
--apiserver-advertise-address=192.168.173.100\
|
||||
--image-repository registry.aliyuncs.com/google_containers\
|
||||
--kubernetes-version 1.29.2\
|
||||
--service-cidr=10.10.0.0/12\
|
||||
--pod-network-cidr=10.244.0.0/16\
|
||||
--ignore-preflight-errors=all\
|
||||
--cri-socket unix:///var/run/cri-dockerd.sock
|
||||
```
|
||||
|
||||
```bash
|
||||
# node 加入
|
||||
kubeadm join 192.168.173.100:6443 --token jghzcm.mz6js92jom1flry0 \
|
||||
--discovery-token-ca-cert-hash sha256:63253f3d82fa07022af61bb2ae799177d2b0b6fe8398d5273098f4288ce67793 --cri-socket unix:///var/run/cri-dockerd.sock
|
||||
|
||||
# work token 过期后，重新申请
|
||||
kubeadm token create --print-join-command
|
||||
```
|
||||
|
||||
# 部署网络插件
|
||||
|
||||
```bash
|
||||
https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-onprem/onpremises#install-calico-with-kubernetes-api-datastore-more-than-50-nodes
|
||||
|
||||
curl https://raw.githubusercontent.com/projectcalico/calico/v3.26.3/manifests/calico-typha.yaml -o calico.yaml
|
||||
CALICO_IPV4POOL_CIDR 指定为 pod 地址
|
||||
|
||||
# 修改为 BGP 模式
|
||||
# Enable IPIP
|
||||
- name: CALICO_IPV4POOL_IPIP
|
||||
value: "Always" #改成Off
|
||||
|
||||
kubectl apply -f calico-typha.yaml
|
||||
kubectl get pod -A
|
||||
```
|
||||
|
||||
## 固定网卡(可选)
|
||||
|
||||
```bash
|
||||
# 目标 IP 或域名可达
|
||||
- name: calico-node
|
||||
image: registry.geoway.com/calico/node:v3.19.1
|
||||
env:
|
||||
# Auto-detect the BGP IP address.
|
||||
- name: IP
|
||||
value: "autodetect"
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "can-reach=www.google.com"
|
||||
kubectl set env daemonset/calico-node -n kube-system IP_AUTODETECTION_METHOD=can-reach=www.google.com
|
||||
```
|
||||
|
||||
```bash
|
||||
# 匹配目标网卡
|
||||
- name: calico-node
|
||||
image: registry.geoway.com/calico/node:v3.19.1
|
||||
env:
|
||||
# Auto-detect the BGP IP address.
|
||||
- name: IP
|
||||
value: "autodetect"
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "interface=eth.*"
|
||||
```
|
||||
|
||||
```bash
|
||||
# 排除匹配网卡
|
||||
- name: calico-node
|
||||
image: registry.geoway.com/calico/node:v3.19.1
|
||||
env:
|
||||
# Auto-detect the BGP IP address.
|
||||
- name: IP
|
||||
value: "autodetect"
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "skip-interface=eth.*"
|
||||
```
|
||||
|
||||
```bash
|
||||
# CIDR
|
||||
- name: calico-node
|
||||
image: registry.geoway.com/calico/node:v3.19.1
|
||||
env:
|
||||
# Auto-detect the BGP IP address.
|
||||
- name: IP
|
||||
value: "autodetect"
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "cidr=192.168.200.0/24,172.15.0.0/24"
|
||||
```
|
||||
|
||||
# 修改kube-proxy 模式为 ipvs
|
||||
|
||||
```bash
|
||||
# kubectl edit configmap kube-proxy -n kube-system
|
||||
mode: ipvs
|
||||
|
||||
kubectl delete pod -n kube-system -l k8s-app=kube-proxy
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user