01 | Kubernetes | 部署Kubernetes（二进制）

01 | Kubernetes | 部署Kubernetes（二进制）

预留30%的资源。

官方提供

Minikube：可以在本地快速运行一个单点的Kubernetes,仅用于日常尝试或者开发
部署地址：https://kubernetes.io/docs/setup/minikube/

Kubeadm：提供Kubeadm init和kubeadm join,用于快速部署Kubernetes。
部署地址：https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm/

二级制：从官方下载发行的包，手动部署每个组件，组成Kubernetes组件
下载地址: https://github.com/kubernetes/kubernetes/releases

单Master结构

多Master结构

环境初始化

# 关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

# 关闭selinux
sed -i 's/enforcing/disabled/' /etc/selinux/config  # 永久
setenforce 0  # 临时

# 关闭swap
swapoff -a  # 临时
sed -ri 's/.*swap.*/#&/' /etc/fstab    # 永久

# 根据规划设置主机名
hostnamectl set-hostname <hostname>
hostnamectl set-hostname k8s-master
hostnamectl set-hostname k8s-node1
hostnamectl set-hostname k8s-node2

# 在master添加hosts
cat >> /etc/hosts << EOF
192.168.31.71 k8s-master
192.168.31.72 k8s-node1
192.168.31.73 k8s-node2
EOF

# 将桥接的IPv4流量传递到iptables的链
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system  # 生效

# 时间同步
yum install ntpdate -y
ntpdate time.windows.com

自签证书

官方地址：https://pkg.cfssl.org/

crt：证书
key：私钥

# 联网操作
curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl

curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson

curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo

# 未联网操作
手动下载
mv cfssl_linux-amd64 cfssl
mv cfssljson_linux-amd64 cfssljson
mv cfssl-certinfo_linux-amd64 cfssl-certinfo

cp -rf cfssl cfssljson cfssl-certinfo /usr/local/bin
chmod +x /usr/local/bin/cfssl*

mkdir -p /opt/ssl/{
   etcd,kubernetes}
cd /opt/ssl/etcd

cat > ca-config.json << EOF
{
   
  "signing": {
   
    "default": {
   
      "expiry": "87600h"
    },
    "profiles": {
   
      "www": {
   
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json << EOF
{
   
    "CN": "etcd CA",
    "key": {
   
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
   
            "C": "CN",
            "L": "Shanghai",
            "ST": "Shanghai"
        }
    ]
}
EOF

cat > server-csr.json << EOF
{
   
    "CN": "etcd",
    "hosts": [
    "10.19.151.240",
    "10.19.151.241",
    "10.19.151.242"
    ],
    "key": {
   
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
   
            "C": "CN",
            "L": "Shanghai",
            "ST": "Shanghai"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
ls *pem

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
ls server*pem

ETCD集群

官方地址：https://github.com/etcd-io/etcd/releases/tag/v3.4.13

奇数节点：3,5,7
主节点负责写
集群节点间通信通过端口2380进行

下载ETCD
mkdir -p /opt/etcd/{
   bin,cfg,ssl}
tar -zxf etcd-v3.4.13-linux-amd64.tar.gz
mv etcd-v3.4.13-linux-amd64/{
   etcd,etcdctl} /opt/etcd/bin/

cat > /opt/etcd/cfg/etcd.conf << EOF
#[Member]
ETCD_NAME="etcd-1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://10.19.151.240:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.19.151.240:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.19.151.240:2380"