k8s1(1)，Linux运维基础开发与实践

#设置主机名
hostnamectl hostname=XXX
#配置免密(包括操作机)
ssh-keygen
ssh-copy-id master*/slave*
#传输hosts
cat > /etc/hosts <<EOF
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.178.138 master01
192.168.178.139 master02
192.168.178.140 master03
192.168.178.142 slave01
192.168.178.143 slave02
192.168.178.144 slave03
EOF
scp /etc/hosts master/slave:/etc/

#如果到这都看不懂就放弃吧


### ### 初始化（所有服务器）

更新

yum update -y

卸载 firewalld

systemctl stop firewalld
yum remove firewalld -y

卸载 networkmanager

systemctl stop NetworkManager
yum remove NetworkManager -y

同步服务器时间

yum install chrony -y
systemctl enable --now chronyd
chronyc sources

关闭 selinux

setenforce 0
sed -i ‘/^SELINUX=/cSELINUX=disabled’ /etc/selinux/config
getenforce

关闭swap分区

swapoff -a # 临时
sed -i ‘/ swap / s/^/# /g’ /etc/fstab #永久

安装常用工具包

yum install -y net-tools sysstat vim wget lsof unzip zip bind-utils lrzsz telnet bash-completion

安装ipvs

cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe – ip_vs
modprobe – ip_vs_rr
modprobe – ip_vs_wrr
modprobe – ip_vs_sh
modprobe – nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules
bash /etc/sysconfig/modules/ipvs.modules
lsmod | grep -e ip_vs -e nf_conntrack_ipv4
yum install ipset ipvsadm -y

允许检查桥接流量

cat <<EOF | tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF
sysctl --system
cat <<EOF | tee /etc/sysctl.d/k8s.conf
vm.swappiness = 0
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
modprobe br_netfilter
lsmod | grep netfilter
sysctl net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-ip6tables net.ipv4.ip_forward

安装containerd

yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum list containerd.io --showduplicates
yum install -y containerd.io
mkdir -p /etc/containerd
containerd config default | tee /etc/containerd/config.toml

#crictl命令配置
cat <<EOF | tee /etc/crictl.yaml
runtime-endpoint: “unix:///run/containerd/containerd.sock”
image-endpoint: “unix:///run/containerd/containerd.sock”
timeout: 10
debug: false
pull-image-on-create: false
disable-pull-on-run: false
EOF

#使用阿里云镜像下载
sed -i “s#registry.k8s.io#registry.aliyuncs.com/google_containers#g” /etc/containerd/config.toml
#使用如下命令修改cgroup驱动
sed -i ‘s/SystemdCgroup = false/SystemdCgroup = true/’ /etc/containerd/config.toml

systemctl daemon-reload
systemctl enable containerd
systemctl restart containerd

添加kubernetes yum软件源

cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
EOF

安装kubeadm,kubelet和kubectl

yum list kubeadm --showduplicates
yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes

设置开机自启

systemctl daemon-reload
systemctl enable --now kubelet

kubelet每隔几秒就会重启，陷入等待 kubeadm 指令的死循环

命令自动补全

yum install -y bash-completion
source <(crictl completion bash)
crictl completion bash >/etc/bash_completion.d/crictl
source <(kubectl completion bash)
kubectl completion bash >/etc/bash_completion.d/kubectl
source /usr/share/bash-completion/bash_completion

NFS配置（忽略）

yum install -y nfs-common nfs-utils rpcbind
mkdir /nfs
chown nfsnobody /nfs/
#配置
vim /etc/exports
/nfs *(rw,no_root_squash,sync)
exportfs -r
systemctl start rpcbind && systemctl enable rpcbind
systemctl start nfs && systemctl enable nfs
showmount -e

### API server高可用部署

#安装 haproxy
yum -y install haproxy

#配置 haproxy
tee /etc/haproxy/haproxy.cfg <<EOF
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon

stats socket /var/lib/haproxy/stats

defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000

listen k8s-apiserver
bind *:8443
mode tcp
timeout client 1h
timeout connect 1h

log global
option tcplog
balance roundrobin
server master01 192.168.178.138:6443 check
server master02 192.168.178.139:6443 check
server master03 192.168.178.140:6443 check
acl is_websocket hdr(Upgrade) -i WebSocket
acl is_websocket hdr_beg(Host) -i ws
EOF

#运行 haproxy
systemctl enable --now haproxy

#安装 keepalived
yum -y install keepalived

#配置 keepalived
tee > /etc/keepalived/keepalived.conf <<EOF
global_defs {
router_id 100
vrrp_version 2
vrrp_garp_master_delay 1
vrrp_mcast_group4 224.0.0.18 #后续podSubnet需要一致
}

vrrp_script chk_haproxy {
script “/usr/bin/nc -nvz -w 2 127.0.0.1 8443”
timeout 1
interval 1 # check every 1 second
fall 2 # require 2 failures for KO
rise 2 # require 2 successes for OK
}

vrrp_instance lb-vips {
state MASTER
interface ens33 #VIP网卡名字
virtual_router_id 100
priority 150
advert_int 1
nopreempt
track_script {
chk_haproxy
}
authentication {
auth_type PASS
auth_pass blahblah
}
virtual_ipaddress {
192.168.178.141/24 dev eth0 #VIP的IP
}
}
EOF