kubeedge离线搭建 v1.9.2

kubeedge搭建前绝条件
1.cloud端部署kubernetes>1.18&&<=1.21
2.edge端部署docker>1.9

一、Cloud端和Edge端部署keadm
1.进入GitHub的release页面复制keadm的下载地址：https://github.com/kubeedge/kubeedge/releases
cloud
2.解压文件

tar -zxvf keadm-v1.9.2-linux-amd64.tar.gz
cd keadm-v1.9.2-linux-amd64/keadm/
chmod +x keadm
cp keadm /usr/local/bin/
keadm version

二、在Cloud端部署
获取适合自己云端机器类型的keadm
离线物料准备(在网络能正常拉到物料时可跳过)
a. 将crds文件夹中的所有内容平移到部署机的/etc/kubeedge/crds目录下
b. 将kubeedge压缩包放置到/etc/kubeedge目录下
c. 将checksum放置到/etc/kubeedge目录下
d. 将cloudcore.service放置到/etc/kubeedge目录下
e. 将certgen.sh放置到/etc/kubeedge目录下

1.生成密钥

export CLOUDCOREIPS="x.x.x.x"
chmod +x /etc/kubeedge/certgen.sh
/etc/kubeedge/certgen.sh stream

注：x.x.x.x为对外IP地址

2.设置iptable

iptables -t nat -A OUTPUT -p tcp --dport 10350 -j DNAT --to $CLOUDCOREIPS:10003

3.cloudcore运行

keadm init --advertise-address="x.x.x.x" --kubeedge-version=1.9.2

4.修改yaml文件/etc/kubeedge/config/cloudcore.yaml,中enable改成true

cloudStream:
  enable: true
  streamPort: 10003
  tlsStreamCAFile: /etc/kubeedge/ca/streamCA.crt
  tlsStreamCertFile: /etc/kubeedge/certs/stream.crt
  tlsStreamPrivateKeyFile: /etc/kubeedge/certs/stream.key
  tlsTunnelCAFile: /etc/kubeedge/ca/rootCA.crt
  tlsTunnelCertFile: /etc/kubeedge/certs/server.crt
  tlsTunnelPrivateKeyFile: /etc/kubeedge/certs/server.key
  tunnelPort: 10004

5.设置systemctl
将cloudcore.server复制到/usr/lib/systemd/system/

pkill cloudcore
cp /etc/kubeedge/cloudcore.service /usr/lib/systemd/system/
systemctl restart cloudcore

6.修改kube-proxy文件

 kubectl edit daemonsets.apps -n kube-system kube-proxy

添加如下字段

affinity:
nodeAffinity:
  requiredDuringSchedulingIgnoredDuringExecution:
    nodeSelectorTerms:
      - matchExpressions:
          - key: node-role.kubernetes.io/edge
            operator: DoesNotExist

7.获取token

keadm gettoken

8.查看服务状态

journalctl -u cloudcore.service -b

或者

systemctl status cloudcore.service

三、在Edge端部署
在云端运行 keadm gettoken 将返回token令牌，该令牌将在加入边缘节点时使用。
离线物料准备
a. 将kubeedge压缩包放置到/etc/kubeedge目录下
b. 将checksum下载到/etc/kubeedge目录下
c. 将edgecore.service下载到/etc/kubeedge目录下
d.将cloud端ca、certs复制到edge端的/etc/kubeedge目录下

1.运行edgecore

keadm join --kubeedge-version=1.9.2 --edgenode-name=edge01 --cloudcore-ipport=x.x.x.x:10000 --token=xxxx

2.修改yaml文件/etc/kubeedge/config/edgecore.yaml,将enable设置成true

edgeStream:
  enable: true
  handshakeTimeout: 30
  readDeadline: 15
  server: 192.168.0.139:10004
  tlsTunnelCAFile: /etc/kubeedge/ca/rootCA.crt
  tlsTunnelCertFile: /etc/kubeedge/certs/server.crt
  tlsTunnelPrivateKeyFile: /etc/kubeedge/certs/server.key
  writeDeadline: 15

重启edgecore

systemcl restart edgecore.service

3.查看服务状态

journalctl -u edgecore.service -b

或者

systemctl status edgecore.service

四、kubeedge卸载方案

#或者强制卸载 --force
./keadm reset --force

#删除相关文件
rm -rf /etc/systemd/system/edgecore.service
rm -rf /usr/lib/systemd/system/edgecore.service
rm -rf /etc/kubeedge

#停止服务
systemctl stop edgecore.service
systemctl daemon-reload
ps aux|grep edgecore

五、关闭kubeproxy等不支持edge的应用

#!/bin/bash
  
  NodeSelectorPatchJson='{"spec":{"template":{"spec":{"nodeSelector":{"node-role.kubernetes.io/master": "","node-role.kubernetes.io/worker": ""}}}}}'
  NoShedulePatchJson='{"spec":{"template":{"spec":{"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"node-role.kubernetes.io/edge","operator":"DoesNotExist"}]}]}}}}}}}'
  
  edgenode="edgenode1"
  if [ $1 ]; then
          edgenode="$1"
  fi
  
  namespaces=($(kubectl get pods -A -o wide |egrep -i $edgenode | awk '{print $1}' ))
  pods=($(kubectl get pods -A -o wide |egrep -i $edgenode | awk '{print $2}' ))
  length=${#namespaces[@]}
  
  for((i=0;i<$length;i++));  
  do
          ns=${namespaces[$i]}
          pod=${pods[$i]}
          resources=$(kubectl -n $ns describe pod $pod | grep "Controlled By" |awk '{print $3}')
          echo "Patching for ns: $ns, resources: $resources"
          kubectl -n $ns patch $resources --type merge --patch "$NoShedulePatchJson"
          sleep 1
  done