Kubernetes部署文档及命令

ubuntu 1804----> root密码：123456 
主要操作：

1.更改网卡名称为eth0：
root@ubuntu:vim /etc/default/grub
GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"
root@ubuntu:update-grub
root@ubuntu:reboot

2.更改系统ip地址:
root@ubuntu:/home/jack# vim /etc/netplan/01-netcfg.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: no
      addresses: [192.168.100.112/24]
      gateway4: 192.168.100.2
      nameservers:
              addresses: [192.168.100.2]

3.应用ip配置并重启测试：              
root@ubuntu:netplan  apply 

4.更改主机名：
# cat /etc/hostname 
k8s-node1.example.com

5.#安装常用命令
apt-get update
apt-get purge ufw lxd lxd-client lxcfs lxc-common #卸载不用的包
apt-get  install iproute2  ntpdate  tcpdump telnet traceroute nfs-kernel-server nfs-common  lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute  gcc openssh-server lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute iotop unzip zip ipmitool

6.安装docker：
root@k8s-node1:~# apt-get update
root@k8s-node1:~# apt-get -y install apt-transport-https ca-certificates curl software-properties-common
root@k8s-node1:~# curl -fsSL http://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
root@k8s-node1:~# add-apt-repository "deb [arch=amd64] http://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
root@k8s-node1:~# apt-get -y update && apt-get -y install docker-ce
root@k8s-node1:~# docker info

7.做快照

rm -rf /etc/localtime &&  ln -sv /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate 172.20.1.211 &&  hwclock  -w
echo "*/30 * * * * ntpdate 172.20.1.211 &&  hwclock  -w" > /var/spool/cron/crontabs/root && systemctl  restart cron.service
 
 
7.其他配置:
root@k8s-node1:~# grep "^[a-Z]" /etc/sysctl.conf 
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
vm.swappiness=0
net.ipv4.ip_forward = 1

一：服务器初始化及证书制作：
yum install -y https://mirrors.aliyun.com/docker-ce/linux/centos/7/x86_64/stable/Packages/docker-ce-selinux-17.03.2.ce-1.el7.centos.noarch.rpm
yum install -y https://mirrors.aliyun.com/docker-ce/linux/centos/7/x86_64/stable/Packages/docker-ce-17.03.2.ce-1.el7.centos.x86_64.rpm

配置主机名和host文件： 同步各服务器时间
192.168.100.101 k8s-master1.example.com   k8s-master1
192.168.100.102 k8s-master2.example.com   k8s-master2
192.168.100.103 k8s-harbor1.example.com   k8s-harbor1
192.168.100.104 k8s-harbor2.example.com   k8s-harbor2
192.168.100.105 k8s-etcd1.example.com       k8s-etcd1
192.168.100.106 k8s-etcd2.example.com       k8s-etcd2
192.168.100.107 k8s-etcd3.example.com       k8s-etcd3
192.168.100.108 k8s-node1.example.com      k8s-node1
192.168.100.109 k8s-node2.example.com      k8s-node2
192.168.100.110 k8s-haproxy1.example.com k8s-haproxy1
192.168.100.111 k8s-haproxy2.example.com k8s-haproxy2

VIP:192.168.100.112

[root@k8s-master1 ~]# yum install sshpass -y
ssh-keygen

 
二：安装harbor服务器：
 安装harbor：
 hostname = k8s-harbor1.example.com
 ui_url_protocol = https

ssl_cert = /usr/local/src/harbor/cert/server.crt
ssl_cert_key = /usr/local/src/harbor/cert/server.key
harbor_admin_password = 123456

mkdir  /usr/local/src/harbor/cert
openssl genrsa -out /usr/local/src/harbor/cert/server.key 2048  #生成私有key
openssl req -x509 -new -nodes -key /usr/local/src/harbor/cert/server.key  -subj "/CN=k8s-harbor1.example.com" -days 7120 -out /usr/local/src/harbor/cert/server.crt   #创建有效期时间的自签名证书

openssl req -x509 -new -nodes -key /usr/local/src/harbor/cert/server.key -subj "/CN=k8s-harbor2.example.com" -days 7120 -out /usr/local/src/harbor/cert/server.crt   #创建有效期时间的自签名证书

yum install python-pip -y
pip install docker-compose

配置客户端使用harbor：
mkdir /etc/docker/certs.d/k8s-harbor1.example.com -pv
mkdir /etc/docker/certs.d/k8s-harbor2.example.com -pv

[root@k8s-harbor1 harbor]# scp cert/server.crt  192.168.100.101:/etc/docker/certs.d/k8s-harbor1.example.com/
[root@k8s-harbor2 harbor]# scp cert/server.crt  192.168.100.101:/etc/docker/certs.d/k8s-harbor2.example.com/

#测试登录
[root@k8s-master1 ~]# docker login k8s-harbor1.example.com
Username (admin):  
Password: 
Login Succeeded
[root@k8s-master1 ~]# docker login k8s-harbor2.example.com
Username (admin): 
Password: 
Login Succeeded

10.10.0.0/16 内部service网络
10.20.0.0/16 容器网络

三：准备证书环境
mkdir -p /opt/kubernetes/{cfg,bin,ssl,log}  #每个机器

批量优化服务器并重启

准备证书制作工具：
cd /usr/local/src
 
[root@k8s-master1 src]# mv cfssl-certinfo_linux-amd64  /usr/bin/cfssl-certinfo
[root@k8s-master1 src]# mv cfssljson_linux-amd64  /usr/bin/cfssljson
[root@k8s-master1 src]# mv cfssl_linux-amd64  /usr/bin/cfssl
[root@k8s-master1 src]# chmod  a+x /usr/bin/cfssl*

[root@k8s-master1 ~]# cd /usr/local/src/ #初始化cfssl
[root@k8s-master1 src]#  cfssl print-defaults config > config.json
[root@k8s-master1 src]#  cfssl print-defaults csr > csr.json

创建生成CA的json文件：
[root@k8s-master1 src]# vim  ca-config.json
{
  "signing": {
    "default": {
      "expiry": "172800h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "172800h"
      }
    }
  }
}

创建生成CA签名证书CSR文件的json文件：
CN是证书拥有者名字，一般为网站名或IP+端口，如www.baidu.com，OU组织机构名 O组织名 L城市 ST州或省 C国家代码
[root@k8s-master1 src]# cat  ca-csr.json

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

生成CA证书（ca.pem）和密钥（ca-key.pem）
[root@k8s-master1 src]#  cfssl gencert -initca ca-csr.json | cfssljson -bare ca
[root@k8s-master1 src]# ll *.pem
-rw------- 1 root root 1675 Jul 11 21:27 ca-key.pem
-rw-r--r-- 1 root root 1359 Jul 11 21:27 ca.pem

#分发证书：
[root@k8s-master1 src]# cp ca.csr ca.pem ca-key.pem ca-config.json /opt/kubernetes/ssl
[root@k8s-master1 src]# ll /opt/kubernetes/ssl/
total 16
-rw-r--r-- 1 root root  290 Jul 11 21:29 ca-config.json
-rw-r--r-- 1 root root 1001 Jul 11 21:29 ca.csr
-rw------- 1 root root 1675 Jul 11 21:29 ca-key.pem
-rw-r--r-- 1 root root 1359 Jul 11 21:29 ca.pem

[root@k8s-master1 src]# cat  /root/ssh.sh
#!/bin/bash
IP="
192.168.100.102
192.168.100.103
192.168.100.104
192.168.100.105
192.168.100.106
192.168.100.107
192.168.100.108
192.168.100.109
192.168.100.110
192.168.100.111
"

for node in ${IP};do
  #sshpass -p 123456 ssh-copy-id  -p22 ${node}  -o StrictHostKeyChecking=no
    if [ $? -eq 0 ];then
    echo "${node} 秘钥copy完成,准备环境初始化....."
#      ssh  -p22   ${node}  "test ! -d /etc/docker/certs.d/k8s-harbor1.example.com && mkdir /etc/docker/certs.d/k8s-harbor1.example.com -pv"
#      ssh  -p22   ${node}  "test ! -d /etc/docker/certs.d/k8s-harbor1.example.com && mkdir /etc/docker/certs.d/k8s-harbor2.example.com -pv"
#      echo "${node} Harbor 证书目录创建成功!"
#      scp -P22 /etc/docker/certs.d/k8s-harbor1.example.com/server.crt ${node}:/etc/docker/certs.d/k8s-harbor1.example.com/server.crt
#      scp -P22 /etc/docker/certs.d/k8s-harbor2.example.com/server.crt ${node}:/etc/docker/certs.d/k8s-harbor2.example.com/server.crt
#      echo "${node} Harbor 证书拷贝成功!"
##      scp -P22 /etc/hosts ${node}:/etc/hosts
#      echo "${node} host 文件拷贝完成"
#      scp -P22 /etc/sysctl.conf  ${node}:/etc/sysctl.conf
#      echo "${node} sysctl.conf 文件拷贝完成"
#      scp -P22 /etc/security/limits.conf  ${node}:/etc/security/limits.conf
#      echo "${node} limits.conf 文件拷贝完成"
#      scp -r -P22  /root/.docker  ${node}:/root/
#      echo "${node} Harbor 认证文件拷贝完成!"
#      scp -r -P22  /etc/resolv.conf  ${node}:/etc/
#      sleep 2
#      ssh  -p22   ${node}  "reboot"
#      sleep 2
        scp -r -P22 /opt/kubernetes/ssl/*  ${node}:/opt/kubernetes/ssl 
    else
    echo "${node} ssh-key copy error!"
    fi
done

二：etcd集群部署：
#各etcd服务器下载etcd安装包：
[root@k8s-etcd1 src]# tar zxf etcd-v3.2.18-linux-amd64.tar.gz
[root@k8s-etcd1 src]# cd etcd-v3.2.18-linux-amd64

[root@k8s-etcd1 etcd-v3.2.18-linux-amd64]# cp etcdctl  etcd /opt/kubernetes/bin/
[root@k8s-etcd1 etcd-v3.2.18-linux-amd64]# scp  /opt/kubernetes/bin/etcd* 192.168.100.106:/opt/kubernetes/bin/
[root@k8s-etcd1 etcd-v3.2.18-linux-amd64]# scp  /opt/kubernetes/bin/etcd* 192.168.100.107:/opt/kubernetes/bin/

#在master创建创建 etcd 证书签名请求：
root@k8s-master1:/usr/local/src/ssl/etcd# nano etcd-csr.json
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
"192.168.100.105",
"192.168.100.106",
"192.168.100.107"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

#生成 etcd 证书和私钥：
root@k8s-master1:/usr/local/src/ssl/etcd# pwd
/usr/local/src/ssl/etcd
root@k8s-master1:/usr/local/src/ssl/etcd#  cfssl gencert -ca=/opt/kubernetes/ssl/ca.