[{"_1":2,"_92":-5,"_93":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_88":89},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_78":-5,"_79":80,"_81":-5,"_82":17,"_83":17,"_84":11,"_85":-5,"_86":87},"canonicalUrl","https://hub.docker.com/r/fansin/k8s-learning","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","fansin","reponame","k8s-learning","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":11,"_45":41,"_46":47,"_48":49,"_50":31,"_28":29,"_51":52,"_53":-5,"_54":52,"_55":52,"_56":57,"_58":-5,"_59":52,"_60":61,"_62":11,"_63":29,"_64":65,"_70":11,"_71":72,"_76":29,"_77":-5},"categories",[],"content_types",[],"date_registered","2020-01-23T07:36:38.114392Z","description","k8s相关学习","is_private","last_updated","last_modified","2024-10-16T13:48:34.145251Z","media_types",[],"name","pull_count",0,"repository_type","star_count","status","status_description","initialized","source","collaborator_count","full_description","\n\n![](D:\\Share\\k8s\\环境搭建\\K8S.png)\n\n\n\n系统以centos 7.6为例，其他系统类似\n\n网络情况为无法连接外网（能联网更好了）\n\n### 主要安装软件清单列表\n\n1 docker \n\n2 kubeadm\n\n\n\n### 1 docker 离线安装 \n\n官方指南：\n\n\n\n解读：\n\n系统要求 centos7+，centos-extras开启（默认开启），推荐 overlay2 \n\n离线安装：\n\n\n\n解读：\n\n1 下载rpm包并上传服务器\n\n \n\n2 命令安装\n\n```\n$ sudo yum install /path/to/package.rpm\n```\n\n\n\n**实际情况**\n\n```\nyum install -y policycoreutils-python\nrpm -i container-selinux-2.107-3.el7.noarch.rpm\nrpm -i containerd.io-1.2.6-3.3.el7.x86_64.rpm\nrpm -i docker-ce-cli-19.03.4-3.el7.x86_64.rpm\nrpm -i docker-ce-19.03.4-3.el7.x86_64.rpm\n\n```\n\n\n\n3 启动docker\n\n```\n$ sudo systemctl start docker\n```\n\n\n\n**实际情况**\n\n```\nsystemctl cat docker.service\nsystemctl daemon-reload\nsystemctl start docker\n```\n\n\n\n4 验证（能联网！！！）\n\n```\n$ sudo docker run hello-world\n#无网络\n$ sudo docker info\n```\n\n\n\n### 2 harbor 实现内网私服（基于docker环境）\n\n0 安装docker环境\n\n1 安装docker-compose\n\nhttps://dl.bintray.com/docker-compose/master/\n\n```\ncp ~/docker-compose-Linux-x86_64 /usr/local/bin/docker-compose\nchmod +x /usr/local/bin/docker-compose\n```\n\n2 下载harbor 并安装\n\n下载地址：\n\n下载后解压压缩包，编辑harbor.yml 必须修改 hostname\n\n```\n# Configuration file of Harbor\n\n# The IP address or hostname to access admin UI and registry service.\n# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.\nhostname: 30.23.76.67\n\n```\n\n```\n./install.sh\n```\n\n\n\n安装完后，访问，用户名密码 `admin/Harbor12345`\n\n```\ncat harbor.yml | grep admin\n\n```\n\n\n\n### 3 harbor和docker结合使用\n\n配置docker仓库指向harbor\n\n在安装docker的机器上，`vim /etc/hosts`\n\n```\n30.23.76.67 myharbor.com.cn\n\n```\n\n`vim /etc/docker/daemon.json`\n\n```\n{\n \"insecure-registries\":[\"http://myharbor.com.cn\"]\n}\n\n```\n\n```\nsystemctl daemon-reload\nsystemctl restart docker\n\n```\n\n登录验证\n\n```\n$docker login myharbor.com.cn\nAuthenticating with existing credentials...\nWARNING! Your password will be stored unencrypted in /root/.docker/config.json.\nConfigure a credential helper to remove this warning. See\nhttps://docs.docker.com/engine/reference/commandline/login/#credentials-store\n\nLogin Succeeded\n\n\n```\n\n\n\n待验证**\n\n harbor开启https\n\n官方参考文档：\n\n\n\n\n\n\n\na 生成ca证书\n\n```\nopenssl genrsa -out ca.key 4096\nopenssl req -x509 -new -nodes -sha512 -days 3650 \\\n-subj \"/C=CN/ST=Beijing/L=Beijing/O=myharbor/OU=Personal/CN=myharbor.com.cn\" \\\n-key ca.key \\\n-out ca.crt\nopenssl x509 -inform PEM -in ca.crt -out ca.cert\n\n```\n\nb 再把生产的证书赋值到docker `certs.d`目录下\n\n类似这样的目录\n\n```\n $tree /etc/docker/certs.d/\n/etc/docker/certs.d/\n├── myharbor.com.cn\n│ ├── ca.cert\n│ ├── ca.crt\n│ └── ca.key\n\n\n```\n\nc 配置harbor开启https\n\n编辑`harbor.yml `文件\n\n```\n#set hostname\nhostname: yourdomain.com\n\nhttp:\n port: 80\n\nhttps:\n # https port for harbor, default is 443\n port: 443\n # The path of cert and key files for nginx\n certificate: /data/cert/yourdomain.com.crt\n private_key: /data/cert/yourdomain.com.key\n\n ......\n\n```\n\n重新编译\n\n```\n ./prepare\n docker-compose down -v\n docker-compose up -d\n\n```\n\n\n\n### 4 安装kubeadm kubelet kubectl\n\n- `kubeadm`：引导集群的命令。\n- `kubelet`：在集群中所有计算机上运行的组件，它执行诸如启动Pod和容器之类的操作。\n- `kubectl`：用于与您的集群通信的命令行工具。\n\n官方指南：\n\n\n\n官方安装FQA：\n\n\n\n\n\n#### 前置条件：\n\n1 系统要求：\n\n- Ubuntu 16.04+\n- Debian 9+\n- CentOS 7\n- Red Hat Enterprise Linux (RHEL) 7\n- Fedora 25+\n- HypriotOS v1.0.1+\n- Container Linux (tested with 1800.6.0)\n\n2 内存2G+\n\n3 CPU 2核+\n\n4 网络可用，内网即可,关闭防火墙\n\nubuntu\n\n```\nsudo update-alternatives --set iptables /usr/sbin/iptables-legacy\nsudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy\nsudo update-alternatives --set arptables /usr/sbin/arptables-legacy\nsudo update-alternatives --set ebtables /usr/sbin/ebtables-legacy\n\n```\n\ncentos\n\n```\nsystemctl disable firewalld\nsystemctl stop firewalld\n\n```\n\n\n\n5 地址唯一表示，hostname唯一，mac唯一，产品id唯一\n\n6 端口可用\n\n Control-plane node(s)\n\n| Protocol | Direction | Port Range | Purpose | Used By |\n| :------- | :-------- | :--------- | :---------------------- | :------------------- |\n| TCP | Inbound | 6443* | Kubernetes API server | All |\n| TCP | Inbound | 2379-2380 | etcd server client API | kube-apiserver, etcd |\n| TCP | Inbound | 10250 | Kubelet API | Self, Control plane |\n| TCP | Inbound | 10251 | kube-scheduler | Self |\n| TCP | Inbound | 10252 | kube-controller-manager | Self |\n\n Worker node(s)\n\n| Protocol | Direction | Port Range | Purpose | Used By |\n| :------- | :-------- | :---------- | :------------------ | :------------------ |\n| TCP | Inbound | 10250 | Kubelet API | Self, Control plane |\n| TCP | Inbound | 30000-32767 | NodePort Services** | All |\n\n7 swap 关闭\n\n```\nsysctl -w vm.swappiness=0 \necho \"vm.swappiness = 0\">> /etc/sysctl.conf\nswapoff -a\n\n```\n\n\n\n#### 1 下载离线安装包(曲折获取全量安装包)\n\n目标主机是无法联网的，就无法按照官网方式下载了，最简单的一种方式是，可以采用先在一台可以联网的机器，下载全部安装包，然后把安装包上传到目标机器，然后在目标机手动安装。\n\n**非目标机，可以联网机器（centos）**\n\n> 官方安装地址：\n>\n> centos \n>\n> ```\n> cat < /etc/yum.repos.d/kubernetes.repo\n> [kubernetes]\n> name=Kubernetes\n> baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64\n> enabled=1\n> gpgcheck=1\n> repo_gpgcheck=1\n> gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg\n> EOF\n> \n> # Set SELinux in permissive mode (effectively disabling it)\n> #setenforce 0\n> #sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config\n> \n> #yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes\n> \n> #systemctl enable --now kubelet\n> \n> ```\n>\n> 替换为国内源`sed -i 's/packages.cloud.google.com/mirrors.aliyun.com/g' /etc/yum.repos.d/kubernetes.repo`\n>\n> 下载安装包 \n>\n> ```\n> sudo yum install yum-utils –y\n> sudo yumdownloader kubelet kubeadm kubectl --disableexcludes=kubernetes --resolve --destdir=/home/k8s\n> \n> ```\n>\n> 现在我们在`/home/k8s`得到k8s安装相关的包,大概如下包\n>\n> ```\n> 14bfe6e75a9efc8eca3f638eb22c7e2ce759c67f95b43b16fae4ebabde1549f3-cri-tools-1.13.0-0.x86_64.rpm\n> 548a0dcd865c16a50980420ddfa5fbccb8b59621179798e6dc905c9bf8af3b34-kubernetes-cni-0.7.5-0.x86_64.rpm\n> 8a0e2b605c7a616d7cb72c25c9058b2327e41d869046c7c6cb3930f10a3dc012-kubelet-1.16.3-0.x86_64.rpm\n> b45a63e77d36fc7e1ef84f1cd2f7b84bccf650c8248191a37d20c69564d8b8df-kubeadm-1.16.3-0.x86_64.rpm\n> conntrack-tools-1.4.4-5.el7_7.2.x86_64.rpm\n> fd6465355a85b8ddbc0b2e7cb073e3a40160c7c359576b86e9b8eca0a2d7805b-kubectl-1.16.3-0.x86_64.rpm\n> libnetfilter_cthelper-1.0.0-10.el7_7.1.x86_64.rpm\n> libnetfilter_cttimeout-1.0.0-6.el7_7.1.x86_64.rpm\n> libnetfilter_queue-1.0.2-2.el7_2.x86_64.rpm\n> socat-1.7.3.2-2.el7.x86_64.rpm\n> \n> \n> ```\n>\n> 现在把这些包上传到目标机器\n\n\n\n**目标机器（Centos）**\n\n执行相关命令\n\n```\n# Set SELinux in permissive mode (effectively disabling it)\nsetenforce 0\nsed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config\n\n#yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes\n\n#systemctl enable --now kubelet\n\n```\n\n设置防火墙\n\n```\ncat < /etc/sysctl.d/k8s.conf\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.bridge.bridge-nf-call-iptables = 1\nEOF\nsysctl --system\n\n```\n\n网桥调用模块\n\n```\nmodprobe br_netfilter\nlsmod | grep br_netfilter\n\n```\n\n可以看到\n\n```\nbr_netfilter 22256 0\nbridge 151336 1 br_netfilter\n\n```\n\n安装已上传的安装包\n\n```\nrpm -i k8s-1.16.3/*.rpm\n\n```\n\n如果需要其他包需要其他包可以到下载\n\n安装验证\n\n```\n# kubectl version\nClient Version: version.Info{Major:\"1\", Minor:\"16\", GitVersion:\"v1.16.3\", GitCommit:\"b3cbbae08ec52a7fc73d334838e18d17e8512749\", GitTreeState:\"clean\", BuildDate:\"2019-11-13T11:23:11Z\", GoVersion:\"go1.12.12\", Compiler:\"gc\", Platform:\"linux/amd64\"}\nServer Version: version.Info{Major:\"1\", Minor:\"16\", GitVersion:\"v1.16.3\", GitCommit:\"b3cbbae08ec52a7fc73d334838e18d17e8512749\", GitTreeState:\"clean\", BuildDate:\"2019-11-13T11:13:49Z\", GoVersion:\"go1.12.12\", Compiler:\"gc\", Platform:\"linux/amd64\"}\n# kubeadm version\nkubeadm version: &version.Info{Major:\"1\", Minor:\"16\", GitVersion:\"v1.16.3\", GitCommit:\"b3cbbae08ec52a7fc73d334838e18d17e8512749\", GitTreeState:\"clean\", BuildDate:\"2019-11-13T11:20:25Z\", GoVersion:\"go1.12.12\", Compiler:\"gc\", Platform:\"linux/amd64\"}\n# kubelet --version\nKubernetes v1.16.3\n\n\n```\n\n\n\n\n\n修改`--apiserver-advertise-address=30.23.76.131`为master的主机ip\n\n```\nkubeadm init --apiserver-advertise-address=30.23.76.131 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.16.3 --service-cidr=10.1.0.0/16 --pod-network-cidr=10.244.0.0/16\n\n\n```\n\n\n\n1. --control-plane-endpoint 负载均衡地址\n2. --pod-network-cidr 网络使用calico，可以随便设置一个不冲突网段\n3. --cri-socket v1.14.0版本后，自动检测，不用设置\n4. --apiserver-advertise-address 默认使用默认网关接口\n5. --image-repository docker镜像地址，设置后，不用docker tag 为标准镜像\n\n更多参数\n\n\n\n\n\n执行完成后，输出类似如下结果\n\n```\nYour Kubernetes control-plane has initialized successfully!\n\nTo start using your cluster, you need to run the following as a regular user:\n\n mkdir -p $HOME/.kube\n sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n sudo chown $(id -u):$(id -g) $HOME/.kube/config\n\nYou should now deploy a pod network to the cluster.\nRun \"kubectl apply -f [podnetwork].yaml\" with one of the options listed at:\n https://kubernetes.io/docs/concepts/cluster-administration/addons/\n\nThen you can join any number of worker nodes by running the following on each as root:\n\nkubeadm join 30.23.76.131:6443 --token 70afkg.0gxmcpyu94fspp6g \\\n --discovery-token-ca-cert-hash sha256:01398c4f935185b0f17446d597089ce8ff7f8a23645bba4e649b4c10615339e9 \n\n\n```\n\n\n\n创建目录\n\n```\n mkdir -p $HOME/.kube\n sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n sudo chown $(id -u):$(id -g) $HOME/.kube/config\n\n```\n\n\n\n记录下加入集群的方式\n\n```\nkubeadm join 30.23.76.131:6443 --token 70afkg.0gxmcpyu94fspp6g \\\n --discovery-token-ca-cert-hash sha256:01398c4f935185b0f17446d597089ce8ff7f8a23645bba4e649b4c10615339e9 \n\n```\n\n\n\n# 附录：\n\n- overlay和overlay2差异 (overlay 使用硬链接，overlay2 使用软连接)","has_starred","hub_user","immutable_tags_settings",{"_66":11,"_67":68},"enabled","rules",[69],".*","is_automated","permissions",{"_73":17,"_74":11,"_75":11},"read","write","admin","user","storage_size","orgData","recentTags",[],"sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame._index",{"_90":-5,"_91":-5,"_32":-5},"org","repoPullsData","actionData","errors"]

fansin/k8s-learning

fansin/k8s-learning repository overview

Tag Summary