kubeadm部署

安装和配置先决条件

转发 IPv4 并让 iptables 看到桥接流量

通过运行 lsmod | grep br_netfilter 来验证 br_netfilter 模块是否已加载。
若要显式加载此模块，请运行 sudo modprobe br_netfilter。
为了让 Linux 节点的 iptables 能够正确查看桥接流量，请确认 sysctl 配置中的 net.bridge.bridge-nf-call-iptables 设置为 1。

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# 设置所需的 sysctl 参数，参数在重新启动后保持不变
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

# 应用 sysctl 参数而不重新启动
sudo sysctl --system

sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

containerd 安装

# step 1: 安装必要的一些系统工具
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
# Step 2: 添加软件源信息
sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# Step 3
sudo sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
# Step 4: 更新并安装 containerd.io
sudo yum makecache fast
sudo yum -y install containerd.io

修改 containerd 使用 systemd

# 所有节点执行
containerd  config default > /etc/containerd/config.toml
sed -i 's#registry.k8s.io#registry.aliyuncs.com/google_containers#g' /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml

重启 containerd

# 所有节点执行
systemctl daemon-reload
systemctl enable --now containerd
systemctl restart  containerd

安装​​crictl​​

VERSION="v1.25.0"
curl -L https://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-${VERSION}-linux-amd64.tar.gz --output crictl-${VERSION}-linux-amd64.tar.gz

tar zxvf crictl-v1.25.0-linux-amd64.tar.gz -C /usr/local/bin/

crictl config --set runtime-endpoint=unix:///run/containerd/containerd.sock

安装 kubeadm、kubelet 和 kubectl

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
setenforce 0
yum install -y kubelet-1.25.11 kubeadm-1.25.11 kubectl-1.25.11
systemctl enable kubelet && systemctl start kubelet

使用 kubeadm 引导集群

kubeadm init --control-plane-endpoint "10.10.101.253:6443" --image-repository registry.aliyuncs.com/google_containers  --upload-certs --kubernetes-version v1.25.11

• --control-plane-endpoint VIP地址
• --image-repository 镜像地址

根据输出添加其它节点

部署calico

curl https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/calico.yaml -O

在使用私有仓库拉取镜像需要添加imagePullSecrets
创建harbor仓库 secret

kubectl create  -n kube-system secret docker-registry harbor --docker-server=harbor.xxx.xxx--docker-username=admin --docker-password=xxxxx --docker-email=xxx@xxx.cn

在calico.yaml中spec.template.spec下添加，与containers同级

      imagePullSecrets:
        - name: harbor

检查集群状态

[root@k8s-master-01 ~]# kubectl get nodes
NAME            STATUS   ROLES           AGE   VERSION
k8s-master-01   Ready    control-plane   16h   v1.25.11
k8s-master-02   Ready    control-plane   16h   v1.25.11
k8s-master-03   Ready    control-plane   16h   v1.25.11
k8s-work-01     Ready    <none>          16h   v1.25.11
k8s-work-02     Ready    <none>          16h   v1.25.11
k8s-work-03     Ready    <none>          16h   v1.25.11
k8s-work-04     Ready    <none>          16h   v1.25.11
k8s-work-05     Ready    <none>          16h   v1.25.11
k8s-work-06     Ready    <none>          16h   v1.25.11

其它

• kubectl补全

  source <(kubectl completion bash)