企业官网建设流程全解析

设置hostname

hostnamectl set-hostname k8s-master#编辑hosts文件，添加hostsvim/etc/hosts172.21.16.7 k8s-master

关闭防火墙

systemctl stop firewalld systemctl disable firewalld

关闭selinux

setenforce0sed-i's/SELINUX=enforcing/SELINUX=disabled/g'/etc/selinux/config

关闭swapoff分区

swapoff-ased-ri's/.*swap.*/#&/'/etc/fstab

安装ipvsadm

yuminstallipvsadm ipset sysstat conntrack libseccomp-ycat>>/etc/modules-load.d/ipvs.conf<<EOF ip_vs ip_vs_rr ip_vs_wrr ip_vs_sh nf_conntrack ip_tables ip_set xt_set ipt_set ipt_rpfilter ipt_REJECT ipip EOFsystemctl restart systemd-modules-load.service

配置前置需求

#配置前置需求cat<<EOF|sudotee/etc/modules-load.d/k8s.confoverlay br_netfilter EOFsudomodprobe overlaysudomodprobe br_netfilter systemctl restart systemd-modules-load.service# sysctl params required by setup, params persist across rebootscat<<EOF|sudotee/etc/sysctl.d/k8s.confnet.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 EOF# Apply sysctl params without rebootsudosysctl--system##保险执行一下命令sysctl-wnet.ipv4.ip_forward=1

安装 container runtime

containerd

sudodnfinstall-ydnf-plugins-core&&sudodnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.reposudodnfinstallcontainerd.io#初始化默认配置containerd config default|tee/etc/containerd/config.toml#修改containerd配置更改cgroup, #修改镜像源sudosed-i-E"s#^([[:space:]]*sandbox[[:space:]]*=).*#\1'registry.aliyuncs.com/google_containers/pause:3.10.2'#"/etc/containerd/config.tomlsudosed-i's/SystemdCgroup = false/SystemdCgroup = true/'/etc/containerd/config.toml#安装cni ,docker 源安装 containerd 需要手动安装cniwgethttps://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-amd64-v1.1.1.tgzmkdir-p/opt/cni/bintarCxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.1.1.tgz systemctl daemon-reload systemctlenable--nowcontainerd#安装crictlVERSION="v1.24.1"wgethttps://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-$VERSION-linux-amd64.tar.gzsudotarzxvf crictl-$VERSION-linux-amd64.tar.gz-C/usr/local/binrm-fcrictl-$VERSION-linux-amd64.tar.gz#配置crictlcat<<EOF|tee/etc/crictl.yamlruntime-endpoint: "unix:///run/containerd/containerd.sock" image-endpoint: "unix:///run/containerd/containerd.sock" timeout: 10 debug: false pull-image-on-create: false disable-pull-on-run: false EOFsystemctl restart containerd crictl info

cri-docker

#安装配置dockersudodnf removedockerdocker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-enginesudodnfinstall-yyum-utils device-mapper-persistent-data lvm2sudodnf-yinstalldnf-plugins-coresudodnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.reposudodnfinstalldocker-ce docker-ce-cli containerd.iosudomkdir-p/etc/dockersudotee/etc/docker/daemon.json<<-'EOF' { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "experimental": false, "debug": false, "max-concurrent-downloads": 10, "registry-mirrors": ["https://a7h8080e.mirror.aliyuncs.com"] } EOFsudosystemctl daemon-reloadsudosystemctlenabledockersudosystemctl restartdocker#安装 golangdnfinstallgolang#安装 gitdnfinstallgit#安装 cri-dockergitclone https://github.com/Mirantis/cri-dockerd.gitcdcri-dockerdmkdirbin go build-obin/cri-dockerdmkdir-p/usr/local/bininstall-oroot-groot-m0755 bin/cri-dockerd /usr/local/bin/cri-dockerd#更改 packaging/systemd 目录下 cri-docker.service 和 cri-docker.socket 文件ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// 改为：ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.8 ListenStream 的值 改为：ListenStream=/var/run/cri-dockerd.sockcp-apackaging/systemd/* /etc/systemd/systemsed-i-e's,/usr/bin/cri-dockerd,/usr/local/bin/cri-dockerd,'/etc/systemd/system/cri-docker.service systemctl daemon-reload systemctlenablecri-docker.service systemctl restart cri-docker.socket crictl config runtime-endpoint unix:///run/cri-dockerd.sock crictl config image-endpoint unix:///run/cri-dockerd.sock#或者编辑 vim /etc/crictl.yaml

安装kubeadm ,kubectl ,kubelet

# 添加kubernetes yum软件源cat>/etc/yum.repos.d/kubernetes.repo<<EOF [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 enabled=1 gpgcheck=0 repo_gpgcheck=0 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOFsudoyuminstall-ykubelet kubeadm kubectl--disableexcludes=kubernetessudosystemctlenable--nowkubelet# 命令补全yuminstall-ybash-completionsource<(crictl completionbash)crictl completionbash>/etc/bash_completion.d/crictlsource<(kubectl completionbash)kubectl completionbash>/etc/bash_completion.d/kubectlsource/usr/share/bash-completion/bash_completion

配置kubeadm

kubeadm config print init-defaults>kubeadm.yaml

apiVersion:kubeadm.k8s.io/v1beta3bootstrapTokens:-groups:-system:bootstrappers:kubeadm:default-node-tokentoken:abcdef.0123456789abcdefttl:24h0m0susages:-signing-authenticationkind:InitConfigurationlocalAPIEndpoint:advertiseAddress:172.21.16.7bindPort:6443nodeRegistration:# 如果用cri-docker#criSocket: unix:///var/run/cri-dockerd.sockcriSocket:unix:///var/run/containerd/containerd.sockimagePullPolicy:IfNotPresentname:k8s-mastertaints:null---apiServer:timeoutForControlPlane:4m0sapiVersion:kubeadm.k8s.io/v1beta3certificatesDir:/etc/kubernetes/pkiclusterName:kubernetescontrollerManager:{}dns:{}etcd:local:dataDir:/var/lib/etcdimageRepository:registry.aliyuncs.com/google_containerskind:ClusterConfigurationkubernetesVersion:1.24.0networking:dnsDomain:cluster.localserviceSubnet:10.96.0.0/12podSubnet:10.244.0.0/16scheduler:{}---apiVersion:kubeproxy.config.k8s.io/v1alpha1kind:KubeProxyConfigurationmode:ipvs---apiVersion:kubelet.config.k8s.io/v1beta1kind:KubeletConfigurationcgroupDriver:systemd

创建集群

kubeadm init--configkubeadm.yamlmkdir-p$HOME/.kube&&\cp-i/etc/kubernetes/admin.conf$HOME/.kube/config&&\chown$(id-u):$(id-g)$HOME/.kube/config# 下载calico 网络配置curl-Ohttps://docs.projectcalico.org/manifests/calico.yaml#初始化网络配置kubectl apply-fcalico.yaml#设置端口范围 vim /etc/kubernetes/manifests/kube-apiserver.yaml 添加- --service-node-port-range=1-65535

单节点去除master节点的污点

kubectl taintnodek8s-master node-role.kubernetes.io/control-plane-

补充k8s 1.24.0版本基于nfs-client-provisioner的StorageClass PVC一直 pending，无法创建`

旧版本的k8s 解决方案是更改/etc/kubernetes/manifests/kube-apiserver.yaml,添加

- --feature-gates=RemoveSelfLink=false

新版本后(1.24)更改此配置导致kubelet无法启动，使用新版本的nfs-client-provisioner 即可解决此问题

#添加repohelm repoaddnfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/#拉去资源helm pull nfs-subdir-external-provisioner/nfs-subdir-external-provisioner

更改配置

# 由于国内网络拉取不到谷歌仓库，这里在docker hub上找的资源image:repository:docker.io/willdockerhub/nfs-subdir-external-provisioner...nfs:server:xx.xx.xx.xxxpath:xx...

Tip1: kubernetes 1.24之后创建serviceaccount不会创建secrets了，所以需要service-account-token来做bearer token得情况应该使用TokenRequest的方式来获取token

1. 创建一个serviceaccount kubectl create sa admin2. 给sa绑定一个clusterrole kubectl create clusterrolebinding admin--clusterrole=cluster-admin--serviceaccount=test:admin3. 从sa创建个token kubectl create token admin