day02 K8s二进制安装

1、环境初始化

1.1、软件系统版本

软件	版本
CentOS	CentOS Linux release 7.7.1908 (Core)
Docker	19.03.12
Kubernetes	V1.18.8
Flannel	V0.13.0
Kernel-lm	4.18+
Kernel-lm-devel	4.18+
Haproxy	1.5.18
Keepalived	1.3.5

1.2、节点规划

hostname	ip
k8s-master-01	192.168.12.101
k8s-master-02	192.168.12.102
k8s-master-03	192.168.12.103
k8s-node-01	192.168.12.104
k8s-node-02	192.168.12.105

1.3、修改主机名称

hostnamectl set-hostname k8s-master-01 
hostnamectl set-hostname k8s-master-02 
hostnamectl set-hostname k8s-master-03 
hostnamectl set-hostname k8s-node-01 
hostnamectl set-hostname k8s-node-02

1.4、配置HOSTS解析(5台都要执行)

cat >> /etc/hosts <


1.5、集群各节点免密登录(只有master节点做)
[root@k8s-master-01 ~]# ssh-keygen
[root@k8s-master-01 ~]# for i in 101 102 103 104 105; do ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.12.$i; done

1.6、关闭selinux
[root@k8s-master-01 ~]# for i in 101 102 103 104 105; do setenforce 0; done

1.7、关闭防火墙
[root@k8s-master-01 ~]# for i in 101 102 103 104 105; do systemctl disable --now firewalld; done

1.8、关闭swap分区
swapoff -a
sed -i.bak 's/^.*centos-swap/#&/g' /etc/fstab
echo 'KUBELET_EXTRA_ARGS="--fail-swap-on=false"' > /etc/sysconfig/kubelet

1.9、配置国内yum源
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

# 刷新缓存
yum makecache

# 更新系统
yum update -y --exclud=kernel*

1.10、升级系统内核
wget https://elrepo.org/linux/kernel/el7/x86_64/RPMS/kernel-lt-4.4.245-1.el7.elrepo.x86_64.rpm
wget https://elrepo.org/linux/kernel/el7/x86_64/RPMS/kernel-lt-devel-4.4.245-1.el7.elrepo.x86_64.rpm

yum localinstall -y kernel-lt*
grub2-set-default  0 && grub2-mkconfig -o /etc/grub2.cfg
grubby --default-kernel
reboot

1.11 、安装ipvs
yum install -y conntrack-tools ipvsadm ipset conntrack libseccomp
# 加载IPVS模块
cat > /etc/sysconfig/modules/ipvs.modules < /dev/null 2>&1
  if [ $? -eq 0 ]; then
    /sbin/modprobe \${kernel_module}
  fi
done
EOF

chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs

1.12、设置内核参数
cat > /etc/sysctl.d/k8s.conf << EOF
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
fs.may_detach_mounts = 1
vm.overcommit_memory=1
vm.panic_on_oom=0
fs.inotify.max_user_watches=89100
fs.file-max=52706963
fs.nr_open=52706963
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp.keepaliv.probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp.max_tw_buckets = 36000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp.max_orphans = 327680
net.ipv4.tcp_orphan_retries = 3
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.ip_conntrack_max = 65536
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.top_timestamps = 0
net.core.somaxconn = 16384
EOF

# 立即生效
sysctl --system

1.13 安装基础软件
yum install wget expect vim net-tools ntp bash-completion ipvsadm ipset jq iptables conntrack sysstat libseccomp -y

1.14、安装docker
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

yum install docker-ce-19.03.9 -y
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://8mh75mhz.mirror.aliyuncs.com"]
}
EOF
sudo systemctl daemon-reload ; systemctl restart docker;systemctl enable --now docker.service

1、流程
1、master

高可用

kube-apiserver
kube-controller-manager
kube-scheduler
kubelet
kube-proxy

etcd
cronDNS
flannel

2、node

kubelet
kube-proxy
cronDNS
flannel

3、免密登录
[root@k8s-master-01 ~]# ssh-keygen
[root@k8s-master-01 ~]# for i in 101 102 103 104 105 106 107 108; do ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.11.$i; done


2、部署生成证书工具
下载路径：https://github.com/cloudflare/cfssl/releases
# 下载
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64

# 设置执行权限
chmod +x cfssl_1.6.0_linux_amd64 
chmod +x cfssljson_1.6.0_linux_amd64

# 移动到/usr/local/bin
mv cfssl_1.6.0_linux_amd64 /usr/local/bin/cfssl
mv cfssljson_1.6.0_linux_amd64 /usr/local/bin/cfssljson

3、部署Etcd
3.1 创建集群根证书
mkdir -p /opt/cert/ca

cat > /opt/cert/ca/ca-config.json <

3.1、创建CA证书
cat > /opt/cert/ca/ca-csr.json << EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names":[{
    "C": "CN",
    "ST": "ShangHai",
    "L": "ShangHai"
  }]
}
EOF

# 生成根证书
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

3.2、创建Etcd应用证书
mkdir -p /opt/cert/etcd
cd /opt/cert/etcd

cat > etcd-csr.json << EOF
{
    "CN": "etcd",
    "hosts": [
        "127.0.0.1",
        "192.168.11.101",
        "192.168.11.102",
        "192.168.11.103",
        "192.168.11.104",
        "192.168.11.105"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
          "C": "CN",
          "ST": "ShangHai",
          "L": "ShangHai"
        }
    ]
}
EOF

# 生成证书
[root@k8s-master-01 etcd]# cfssl gencert -ca=../ca/ca.pem -ca-key=../ca/ca-key.pem -config=../ca/ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

3.3、分发证书（需要改下）
for ip in m1 m2 m3
do
  ssh root@${ip} "mkdir -pv /etc/etcd/ssl"
  scp ../ca/ca*.pem  root@${ip}:/etc/etcd/ssl
  scp ./etcd*.pem  root@${ip}:/etc/etcd/ssl
done

3.4、部署etcd
# 下载ETCD安装包cd /optmkdir datacd data/wget https://mirrors.huaweicloud.com/etcd/v3.3.24/etcd-v3.3.24-linux-amd64.tar.gz# 解压[root@k8s-master-01 data]# tar xf etcd-v3.3.24-linux-amd64.tar.gz # 分发至其他节点for i in m1 m2 m3doscp ./etcd-v3.3.24-linux-amd64/etcd* root@$i:/usr/local/bin/done# 查看ETCD安装是否成功[root@k8s-master-01 data]# etcd --versionetcd Version: 3.3.24Git SHA: bdd57848dGo Version: go1.12.17Go OS/Arch: linux/amd64

3.5、注册ETCD服务（需要修改）（三台master节点都要执行）
mkdir -pv /etc/kubernetes/conf/etcd

ETCD_NAME=`hostname`
INTERNAL_IP=`hostname -i`
INITIAL_CLUSTER=k8s-master-01=https://192.168.12.101:2380,k8s-master-02=https://192.168.12.102:2380,k8s-master-03=https://192.168.12.103:2380

cat << EOF | sudo tee /usr/lib/systemd/system/etcd.service
[Unit]
Description=etcd
Documentation=https://github.com/coreos

[Service]
ExecStart=/usr/local/bin/etcd \\
  --name ${ETCD_NAME} \\
  --cert-file=/etc/etcd/ssl/etcd.pem \\
  --key-file=/etc/etcd/ssl/etcd-key.pem \\
  --peer-cert-file=/etc/etcd/ssl/etcd.pem \\
  --peer-key-file=/etc/etcd/ssl/etcd-key.pem \\
  --trusted-ca-file=/etc/etcd/ssl/ca.pem \\
  --peer-trusted-ca-file=/etc/etcd/ssl/ca.pem \\
  --peer-client-cert-auth \\
  --client-cert-auth \\
  --initial-advertise-peer-urls https://${INTERNAL_IP}:2380 \\
  --listen-peer-urls https://${INTERNAL_IP}:2380 \\
  --listen-client-urls https://${INTERNAL_IP}:2379,https://127.0.0.1:2379 \\
  --advertise-client-urls https://${INTERNAL_IP}:2379 \\
  --initial-cluster-token etcd-cluster \\
  --initial-cluster ${INITIAL_CLUSTER} \\
  --initial-cluster-state new \\
  --data-dir=/var/lib/etcd
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

3.6、启动（三台master节点都要启动）
systemctl daemon-reload
systemctl enable --now etcd
systemctl status etcd
tail -f /var/log/messages

3.7、测试ETCD集群（需要改）
ETCDCTL_API=3 etcdctl \
--cacert=/etc/etcd/ssl/etcd.pem \
--cert=/etc/etcd/ssl/etcd.pem \
--key=/etc/etcd/ssl/etcd-key.pem \
--endpoints="https://192.168.12.101:2379,https://192.168.12.102:2379,https://192.168.12.103:2379" \
endpoint status --write-out='table'

ETCDCTL_API=3 etcdctl \
--cacert=/etc/etcd/ssl/etcd.pem \
--cert=/etc/etcd/ssl/etcd.pem \
--key=/etc/etcd/ssl/etcd-key.pem \
--endpoints="https://192.168.12.101:2379,https://192.168.12.102:2379,https://192.168.12.103:2379" \
member list --write-out='table'

k8s


					
					
					
						相关
						
				
						
			
																
								
										SuperEdge 和 FabEdge 联合在边缘 K8s 集群支持原生 Service 云边互访和 PodIP 直通
									
									
								 

        
								
							
							

																
								
										k8s-调度亲和性和污点容忍、指定调度节点(nodeSelector)
									
									
								 

        
								
							
							

																
								
										在 k8s 中的 jenkins 集成 sonarqube 实现代码质量检查
									
									
								 

        
								
							
							

																
								
										k8s中的nginx-ingress如何配置路径重定向
									
									
								 

        
								
							
							

																
								
										k8s搭建手札-kubeadm
									
									
								 

        
								
							
							

																
								
										k8s的对象管理一(命令式与声明式API)
									
									
								 

        
								
							
							

																
								
										K8S集群etcd备份与恢复
									
									
								 

        
								
							
							

																
								
										理解 K8S Service
									
									
								 

        
								
							
							

																
								
										k8s部署
									
									
								 

        
								
							
							

																
								
										k8s-flannel
									
									
								 

        
								
							
							

																
								
										k8s-ingress(希望和悲伤，都是一缕光。总有一天，我们会再相遇。)
									
									
								 

        
								
							
							

																
								
										k8s创建mongodb复制集集群

day02 K8s二进制安装

day02 K8s二进制安装

1、环境初始化

1.1、 软件系统版本

1.2、节点规划

1.3、修改主机名称

1.4、配置HOSTS解析(5台都要执行)

1.5、集群各节点免密登录(只有master节点做)

1.6、关闭selinux

1.7、关闭防火墙

1.8、关闭swap分区

1.9、配置国内yum源

1.10、升级系统内核

1.11 、安装ipvs

1.12、设置内核参数

1.13 安装基础软件

1.14、安装docker

1、流程

2、部署生成证书工具

3、部署Etcd

3.1 创建集群根证书

3.1、创建CA证书

3.2、创建Etcd应用证书

3.3、分发证书（需要改下）

3.4、部署etcd

3.5、注册ETCD服务（需要修改）（三台master节点都要执行）

3.6、启动（三台master节点都要启动）

3.7、测试ETCD集群（需要改）

相关

1.1、软件系统版本