01 | Kubernetes | 部署Kubernetes(二进制)
预留30%的资源。
官方提供
Minikube:可以在本地快速运行一个单点的Kubernetes,仅用于日常尝试或者开发
部署地址:https://kubernetes.io/docs/setup/minikube/
Kubeadm:提供Kubeadm init和kubeadm join,用于快速部署Kubernetes。
部署地址:https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm/
二级制:从官方下载发行的包,手动部署每个组件,组成Kubernetes组件
下载地址: https://github.com/kubernetes/kubernetes/releases
单Master结构
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/d0ac747009849171130bc76b69492905.png)
多Master结构
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/f815634d176d81ca528033bf27d0baab.png)
环境初始化
# 关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
# 关闭selinux
sed -i 's/enforcing/disabled/' /etc/selinux/config # 永久
setenforce 0 # 临时
# 关闭swap
swapoff -a # 临时
sed -ri 's/.*swap.*/#&/' /etc/fstab # 永久
# 根据规划设置主机名
hostnamectl set-hostname <hostname>
hostnamectl set-hostname k8s-master
hostnamectl set-hostname k8s-node1
hostnamectl set-hostname k8s-node2
# 在master添加hosts
cat >> /etc/hosts << EOF
192.168.31.71 k8s-master
192.168.31.72 k8s-node1
192.168.31.73 k8s-node2
EOF
# 将桥接的IPv4流量传递到iptables的链
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system # 生效
# 时间同步
yum install ntpdate -y
ntpdate time.windows.com
自签证书
官方地址:https://pkg.cfssl.org/
crt:证书
key:私钥
# 联网操作
curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
# 未联网操作
手动下载
mv cfssl_linux-amd64 cfssl
mv cfssljson_linux-amd64 cfssljson
mv cfssl-certinfo_linux-amd64 cfssl-certinfo
cp -rf cfssl cfssljson cfssl-certinfo /usr/local/bin
chmod +x /usr/local/bin/cfssl*
mkdir -p /opt/ssl/{
etcd,kubernetes}
cd /opt/ssl/etcd
cat > ca-config.json << EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"www": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
cat > ca-csr.json << EOF
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Shanghai",
"ST": "Shanghai"
}
]
}
EOF
cat > server-csr.json << EOF
{
"CN": "etcd",
"hosts": [
"10.19.151.240",
"10.19.151.241",
"10.19.151.242"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Shanghai",
"ST": "Shanghai"
}
]
}
EOF
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
ls *pem
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
ls server*pem
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/d390bcca149213180b0ee45371de59ac.png)
ETCD集群
官方地址:https://github.com/etcd-io/etcd/releases/tag/v3.4.13
奇数节点:3,5,7
主节点负责写
集群节点间通信通过端口2380进行
下载ETCD
mkdir -p /opt/etcd/{
bin,cfg,ssl}
tar -zxf etcd-v3.4.13-linux-amd64.tar.gz
mv etcd-v3.4.13-linux-amd64/{
etcd,etcdctl} /opt/etcd/bin/
cat > /opt/etcd/cfg/etcd.conf << EOF
#[Member]
ETCD_NAME="etcd-1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://10.19.151.240:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.19.151.240:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.19.151.240:2380"