部署kubernetes集群--部署Master节点服务

本文参考 https://blog.stanley.wang 跟我一步步安装部署kubernetes集群

安装前准备

环境准备

五台虚机，操作系统CentOS Linux release 7.9.2009 (Core)，内核版本3.10.0-1160.el7.x86_64

ip	主机名	角色
10.4.7.11	node7-11.host.com	k8s代理节点1
10.4.7.12	node7-12.host.com	k8s代理节点2
10.4.7.21	node7-21.host.com	k8s运算节点1
10.4.7.22	node7-22.host.com	k8s运算节点2
10.4.7.200	node7-200.host.com	k8s运维节点(docker仓库)

所有机器都需要执行

setenforce 0
sed -i '/^SELINUX/s/=.*/=disabled/' /etc/selinux/config
systemctl stop firewalld
systemctl disable firewalld
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum install -y wget net-tools telnet tree nmap sysstat lrzsz dos2unix bind-utils vim 

DNS服务安装部署

在 node7-11.host.com安装bind
~]# yum install -y bind

在 node7-11.host.com 配置区域文件
~]# vim /etc/named.conf
确保以下配置正确

listen-on port 53 {
    10.4.7.11; }; # 监听端口53 下面一行ipv6地址删除
directory 	"/var/named";
allow-query     {
    any; }; #允许内机器都可以查
forwarders      {
    10.4.7.254; };　
223.5.5.5
    recursion yes; # 采用递归方法查询IP
    dnssec-enable no;
    dnssec-validation no;

~]# named-checkconf
检查配置 没有信息即为正确

在 node7-11.host.com 配置主机域文件
~]# vim /var/named/host.com.zone

$ORIGIN host.com.
$TTL 600  ; 10 minutes 
@       IN SOA  dns.host.com. dnsadmin.host.com. (
        2021080501 ; serial
        10800      ; refresh (3 hours) 
        900        ; retry (15 minutes)
        604800     ; expire (1 week)
        86400      ; minimum (1 day)
        )
      NS   dns.host.com.
$TTL 60 ; 1 minute
dns                A    10.4.7.11
node7-11           A    10.4.7.11
node7-12           A    10.4.7.12
node7-21           A    10.4.7.21
node7-22           A    10.4.7.22
node7-200          A    10.4.7.200

在 node7-11.host.com 配置业务域文件
~]# vim /var/named/od.com.zone

$ORIGIN od.com.
$TTL 600  ; 10 minutes
@       IN SOA  dns.od.com. dnsadmin.od.com. (
        2021080501 ; serial
        10800      ; refresh (3 hours)
        900        ; retry (15 minutes)
        604800     ; expire (1 week)
        86400      ; minimum (1 day)
        )
        NS   dns.od.com.
$TTL 60 ; 1 minute
dns                A    10.4.7.11
~                                      

在 node7-11.host.com 启动bind服务，并测试
~]# named-checkconf
~]# systemctl start named ; systemctl enable named
~]# dig -t A node7-11.host.com @10.4.7.11 +shor
10.4.7.11

修改所有主机的dns服务器地址
~]# sed -i ‘/^DNS/s/=.*/=10.4.7.11/’ /etc/sysconfig/network-scripts/ifcfg-ens33
~]#systemctl restart network
~]# cat /etc/resolv.conf
#Generated by NetworkManager
search host.com
nameserver 10.4.7.11

准备签发证书环境

在 node7-200 下载工具
[root@node7-200 ~]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O /usr/local/bin/cfssl
[root@node7-200 ~]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O /usr/local/bin/cfssl-json
[root@node7-200 ~]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfo
[root@node7-200 ~]# chmod u+x /usr/local/bin/cfssl

在 node7-200 签发根证书
~]# mkdir /opt/certs/ ; cd /opt/certs/
certs]# vim /opt/certs/ca-csr.json

{
   
    "CN": "od",
    "hosts": [
    ],
    "key": {
   
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
   
            "C": "CN",
            "ST": "beijing",
            "L": "beijing",
            "O": "od",
            "OU": "ops"
        }
    ],
    "ca": {
   
        "expiry": "175200h" 
    }
}

certs]# cfssl gencert -initca ca-csr.json | cfssl-json -bare ca

docker环境准备

需要安装docker的机器：node7-21 node7-22 node7-200
bip需要改为 172.xx.xx.1/24 这里的xx.xx是主机内网IP的后两段

~]# wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
~]# yum install -y docker-ce
~]# mkdir /etc/docker/
~]# vim /etc/docker/daemon.json

{
   
  "graph": "/data/docker",
  "storage-driver": "overlay2",
  "insecure-registries": ["registry.access.redhat.com","quay.io","harbor.od.com"],
  "registry-mirrors": ["https://registry.docker-cn.com"],
  "bip": "172.7.21.1/24",
  "exec-opts": ["native.cgroupdriver=systemd"],
  "live-restore": true
}

~]# mkdir -p /data/docker
~]# systemctl start docker ; systemctl enable docker
~]# docker version

安装harbor

node7-200安装harbor

~]# cd /opt/src
src]# wget https://github.com/goharbor/harbor/releases/download/v1.9.4/harbor-offline-installer-v1.9.4.tgz
src]# mv harbor /opt/harbor-v1.9.4
src]# ln -s /opt/harbor-v1.9.4 /opt/harbor
src]# vim /opt/harbor/harbor.yml

hostname: harbor.od.com
http:
  port: 180
data_volume: /data/harbor
location: /data/harbor/logs

src]# yum install -y docker-compose
src]# cd /opt/harbor/
harbor]# ./install.sh
harbor]# docker-compose ps

node7-200安装nginx反向代理harbor

harbor]# vim /etc/nginx/conf.d/harbor.conf
harbor]# cat /etc/nginx/conf.d/harbor.conf

server {
   
    listen       80;