部署基于docker和cri-dockerd的Kubernetes1.24

部署环境

ubuntu:18.04

kubernetes:v1.24.3

cridockerd:v0.2.5

docker ce:0.2.5.3-0

本测试环境将由master01、node01、node02和node03四个独立的主机组成，它们分别拥有2核心的CPU及2G的内存资源,操作系统环境均为最小化部署的Ubuntu Server18.04，启用了SSH服务

（1）借助于chronyd服务（程序包名称chrony）设定各节点时间精确同步；
（2）通过DNS完成各节点的主机名称解析；
（3）各节点禁用所有的Swap设备；
（4）各节点禁用默认配置的iptables防火墙服务

 设置时间同步ntp功能
~]# apt install chrony
~]# systemctl start chrony.service 
~]# cat <<EOF > /etc/chrony/chrony.conf
server ntp.aliyun.com iburst                                                                                       stratumweight 0
driftfile /var/lib/chrony/drift
rtcsync
makestep 10 3
bindcmdaddress 127.0.0.1
bindcmdaddress ::1
keyfile /etc/chrony.keys
commandkey 1
generatecommandkey
logchange 0.5
logdir /var/log/chrony
EOF
~]# systemctl restart chrony

配置每个主机的域名解析
~]# cat /etc/hosts
10.0.0.200 master01.cui.com master01 kubeapi.cui.com kubeapi
10.0.0.201 node01.cui.com node01
10.0.0.202 node02.cui.com node02
10.0.0.203 node03.cui.com node03

禁用swap功能

#关闭当前已启用的所有swap设备
~]# swapoff -a
进入/etc/fstab 把用于挂载swap的行注释或者删除掉
~]# systemctl --type swap

禁用防火墙功能
~]# ufw disable

#生成docker-ce相关的仓库
~]# apt -y install apt-transport-https ca-certificates curl software-properties-common
~]# curl -fsSL http://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | apt-key add -
~]# add-apt-repository "deb [arch=amd64] http://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
~]# apt update
~]# apt install docker-ce

#添加docker镜像加速,编辑docker的配置文件
~]# cat <<EOF > /etc/docker/daemon.json
{
"registry-mirrors": [
"https://docker.mirrors.ustc.edu.cn",
"https://hub-mirror.c.163.com",
"https://reg-mirror.qiniu.com",
"https://registry.docker-cn.com"
],
"exec-opts": ["native.cgroupdriver=systemd"]
}
EOF
~]# systemctl daemon-reload
~]# systemctl start docker.servic

安装cri-dockerd
~]# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.2.5/cri-dockerd_0.2.5.3-0.ubuntu-bionic_amd64.deb
~]# dpkg -i cri-dockerd_0.2.5.3-0.ubuntu-bionic_amd64.deb
 

安装kubelet、kubeadm和kubectl
#首先生成仓库，然后在各主机安装kubelet、kubeadm和kubectl等程序包
apt-get update && apt-get install -y apt-transport-https
curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add - 
cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
EOF
apt-get update
apt-get install -y kubelet kubeadm kubectl

配置cri-dockerd
~]# cat <<EOF > /usr/lib/systemd/system/cri-dockerd.service
ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugin=cni --cni-bin-dir=/opt/cni/bin --cni-cache-dir=/var/lib/cni/cache --cni-conf-dir=/etc/cni/net.d
EOF
~]# systemctl daemon-reload;systemctl restart cri-dockerd.service

配置kubelet
~]# mkdir /etc/sysconfig
~]# cat <<EOF > /etc/sysconfig/kubelet
KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=/run/cri-dockerd.sock"
EOF

查看相关的镜像
~]# kubeadm config images list

拉取镜像
~]# kubeadm config images pull --cri-socket unix:///run/cri-dockerd.sock 

进行初始化
~]# kubeadm init  --control-plane-endpoint kubeapi.cui.com --kubernetes-version=v1.24.3 --pod-network-cidr=192.168.0.0/16 --service-cidr=10.96.0.0/12 --token-ttl=0 --cri-socket unix:///run/cri-dockerd.sock

#成功之后还需要完成的步骤
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
#第1个步骤提示， Kubernetes集群管理员认证到Kubernetes集群时使用的kubeconfig配置文件
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
  export KUBECONFIG=/etc/kubernetes/admin.conf
#第2个步骤提示，为Kubernetes集群部署一个网络插件，具体选用的插件则取决于管理员；
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/
#第3个步骤提示，向集群添加额外的控制平面节点，但本文会略过该步骤，并将在其它文章介绍其实现方式。
You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:
# 在部署好kubeadm等程序包的其他控制平面节点上以root用户的身份运行类似如下命令，
# 命令中的hash信息对于不同的部署环境来说会各不相同；该步骤只能在其它控制平面节点上执行；
  kubeadm join kubeapi.cui.com:6443 --token vt1kti.xesiyy2ycy1oug3p \
    --discovery-token-ca-cert-hash sha256:b39eafbc3956069c7a89feb6e4f08ff066b455dcd604fb5033b1d4c14e50ebcf \
    --control-plane 
# 第4个步骤提示，向集群添加工作节点
Then you can join any number of worker nodes by running the following on each as root:
# 在部署好kubeadm等程序包的各工作节点上以root用户运行类似如下命令
kubeadm join kubeapi.cui.com:6443 --token vt1kti.xesiyy2ycy1oug3p \
    --discovery-token-ca-cert-hash sha256:b39eafbc3956069c7a89feb6e4f08ff066b455dcd604fb5033b1d4c14e50ebcf 

设置kuberctl
~]# mkdir -p $HOME/.kube
~]# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

部署第三方插件
~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
#查看插件状态

~]# kubectl get pods -n kube-system 

验证主节点的
~]# kubectl get nodes

在node01，node02，node03上都完成
~]# kubeadm join kubeapi.cui.com:6443 --token vt1kti.xesiyy2ycy1oug3p --discovery-token-ca-cert-hash sha256:b39eafbc3956069c7a89feb6e4f08ff066b455dcd604fb5033b1d4c14e50ebcf --cri-socket unix:///run/cri-dockerd.sock

#验证节点添加结果
~]# kubectl get nodes 

将demoapp运行在集群之上
~]# kubectl create deployment demoapp --image=ikubernetes/demoapp:v1.0 --replicas=3
~]# kubectl create service nodeport demoapp --tcp=80:80
#查看所使用的NodePort

~]# kubectl get service