二进制部署k8s

原创

于 2025-09-13 13:26:38 发布 · 956 阅读

16 ·

CC 4.0 BY-SA版权

文章标签：

#kubernetes #容器 #云原生

一、环境准备

关闭防火墙、selinux、交换分区（swap）下载阿里云源

1、配置hosts文件

vim /etc/hosts

[root@master1 ~]# cat /etc/hosts
192.168.200.50 master1
192.168.200.51 master2
192.168.200.52 node1

2、配置主机之间无密码登陆

ssh-keygen -t rsa
ssh-copy-id -i .ssh/id_rsa.pub master1
ssh-copy-id -i .ssh/id_rsa.pub master2
ssh-copy-id -i .ssh/id_rsa.pub node1

3、修改内核参数

##加载br_netfilter 模块
modprobe br_netfilter

##验证模块是否加载成功
lsmod |grep br_netfilter

##修改内核参数
cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF

##参数生效
sysctl -p /etc/sysctl.d/k8s.conf

4、下载一些小工具

yum install openssh-clients -y
yum install ntpdate -y
yum install -y yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack ntpdate telnet rsync

5、配置时间同步

##跟网络源做同步
ntpdate cn.pool.ntp.org

##把时间同步做成计划任务
crontab -e
* */1 * * * /usr/sbin/ntpdate cn.pool.ntp.org

###重启 crond 服务
service crond restart

6、开启ipvs

vim ipvs.modules 
#!/bin/bash
ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
for kernel_module in ${ipvs_modules}; do
 /sbin/modinfo -F filename ${kernel_module} > /dev/null 2>&1
 if [ 0 -eq 0 ]; then
 /sbin/modprobe ${kernel_module}
 fi
done

----------------------------------
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs

[root@master1 modules]# scp /etc/sysconfig/modules/ipvs.modules master2:/etc/sysconfig/modules/
ipvs.modules  
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs

[root@master1 modules]# scp /etc/sysconfig/modules/ipvs.modules node1:/etc/sysconfig/modules/
ipvs.modules                                                                               
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs

二、安装docker

##配置源
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

##下载
yum install docker-ce-20.10.6 docker-ce-cli-20.10.6 containerd.io -y

##开启Docker服务
service docker start

##配置加速器
vim /etc/docker/daemon.json 
{
"exec-opts": ["native.cgroupdriver=systemd"],
"registry-mirrors": ["https://docker.1ms.run"] 
}

systemctl daemon-reload
systemctl restart docker

##kubelet 默认使用 systemd，两者必须一致才可以。

三、搭建etcd集群

1、创建配置文件和证书文件存放目录

##全部机器
mkdir -p /etc/etcd
mkdir -p /etc/etcd/ssl

2、安装签发证书工具 cfssl

mkdir /data/work -p  ##看个人喜欢吧
cd /data/work/

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 

##执行权限
chmod +x *
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

3、配置 ca 证书

##生成 ca 证书请求文件
[root@master1 work]# cat ca-csr.json
{
  "CN": "kubernetes",    #公用名称
  "key": {
      "algo": "rsa", 
      "size": 2048
  },
  "names": [
    {
      "C": "CN",         #只能是国家字母缩写
      "ST": "Guangxi",  #所在省份
      "L": "Nanning",   #所在城市
      "O": "k8s",         #单位名称
      "OU": "system"
    }
  ],
  "ca": {
          "expiry": "87600h"
  }
}

[root@master1 work]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
[root@master1 work]# 
##生成 ca 证书文件
[root@master1 work]# cat ca-config.json
{
  "signing": {
      "default": {
          "expiry": "87600h"
        },
      "profiles": {
          "kubernetes": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth",
                  "client auth"
              ],
              "expiry": "87600h"
          }
      }
  }
}

4、生成 etcd 证书

##配置 etcd 证书请求，hosts的ip换自己etcd所在节点的 ip
[root@master1 work]# cat etcd-csr.json
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.200.50",
    "192.168.200.51",
    "192.168.200.199"       ##vip漂移看后续要不要高可用
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Guangxi",
    "L": "Nanning",
    "O": "k8s",
    "OU": "system"
  }]
} 


[root@master1 work]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

5、部署 etcd 集群

wget https://github.com/etcd-io/etcd/releases/download/v3.4.13/etcd-v3.4.13-linux-amd64.tar.gz

node节点是不用etcd的，我弄就弄了。

[root@master1 work]# ls
ca-config.json  ca-csr.json  ca.pem    etcd-csr.json  etcd.pem
ca.csr          ca-key.pem   etcd.csr  etcd-key.pem   etcd-v3.4.13-linux-amd64.tar.gz
[root@master1 work]# tar -xf etcd-v3.4.13-linux-amd64.tar.gz 
[root@master1 work]# cp -p etcd-v3.4.13-linux-amd64/etcd* /usr/local/bin/

scp -r etcd-v3.4.13-linux-amd64/etcd* master2:/usr/local/bin/
scp -r etcd-v3.4.13-linux-amd64/etcd* node1:/usr/local/bin/

##创建配置文件
[root@master1 work]# cat etcd.conf
#[Member]
ETCD_NAME="etcd1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.200.50:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.200.50:2379,http://127.0.0.1:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.200.50:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.200.50:2379"
ETCD_INITIAL_CLUSTER="etcd1=https://192.168.200.50:2380,etcd2=https://192.168.200.51:2380,etcd3=https://192.168.200.52:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

##解释
ETCD_NAME：节点名称，集群中唯一
ETCD_DATA_DIR：数据目录
ETCD_LISTEN_PEER_URLS：集群通信监听地址
ETCD_LISTEN_CLIENT_URLS：客户端访问监听地址
ETCD_INITIAL_ADVERTISE_PEER_URLS：集群通告地址
ETCD_ADVERTISE_CLIENT_URLS：客户端通告地址
ETCD_INITIAL_CLUSTER：集群节点地址
ETCD_INITIAL_CLUSTER_TOKEN：集群 Token
ETCD_INITIAL_CLUSTER_STATE：加入集群的当前状态，new 是新集群，existing 表示加入已有集群

##创建启动服务文件
[root@master1 work]# cat etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
 
[Service]
Type=notify
EnvironmentFile=-/etc/etcd/etcd.conf
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/local/bin/etcd \
  --cert-file=/etc/etcd/ssl/etcd.pem \
  --key-file=/etc/etcd/ssl/etcd-key.pem \
  --trusted-ca-file=/etc/etcd/ssl/ca.pem \
  --peer-cert-file=/etc/etcd/ssl/etcd.pem \
  --peer-key-file=/etc/etcd/ssl/etcd-key.pem \
  --peer-trusted-ca-file=/etc/etcd/ssl/ca.pem \
  --peer-client-cert-auth \
  --client-cert-auth
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
 
[Install]
WantedBy=multi-user.target

cp ca*.pem /etc/etcd/ssl/
cp etcd*.pem /etc/etcd/ssl/
cp etcd.conf /etc/etcd/
cp etcd.service /usr/lib/systemd/system/

##传给其他主节点机器
for i in master2;do rsync -vaz etcd.conf $i:/etc/etcd/;done
for i in master2;do rsync -vaz etcd*.pem ca*.pem $i:/etc/etcd/ssl/;done
for i in master2;d