关闭selinux和防火墙
systemctl stop firewalld
systemctl disable firewalld关闭selinux
sed -i 's/enforcing/disabled/' /etc/selinux/config #重启后生效关闭swapoff -a
sed -i 's/.*swap.*/#&/' /etc/fstab加载内核模块：
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF内核预检
modprobe overlay
modprobe br_netfilter安装软件包
apt-get install -y ipset ipvsadm vim wget curl net-tools
yum install -y ipset ipvsadm vim wget curl net-tools额外的
停止 AppArmor 服务
systemctl stop apparmor.service
禁用 AppArmor 服务
systemctl disable apparmor.service添加网桥过滤和地址转发功能 两种方式
简单版本
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system //生效命令
# 查看是否已成功加载模块
lsmod | grep br_netfilter
# 将读取该文件中的参数设置，并将其应用到系统的当前运行状态中
sysctl -p /etc/sysctl.d/k8s.conf
复杂版本
cat > /etc/sysctl.d/kubernetes.conf << EOF
# 允许 IPv6 转发请求通过iptables进行处理（如果禁用防火墙或不是iptables，则该配置无效）
net.bridge.bridge-nf-call-ip6tables = 1
# 允许 IPv4 转发请求通过iptables进行处理（如果禁用防火墙或不是iptables，则该配置无效）
net.bridge.bridge-nf-call-iptables = 1
# 启用IPv4数据包的转发功能
net.ipv4.ip_forward = 1
# 禁用发送 ICMP 重定向消息
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# 提高 TCP 连接跟踪的最大数量
net.netfilter.nf_conntrack_max = 1000000
# 提高连接追踪表的超时时间
net.netfilter.nf_conntrack_tcp_timeout_established = 86400
# 提高监听队列大小
net.core.somaxconn = 1024
# 防止 SYN 攻击
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
# 提高文件描述符限制
fs.file-max = 65536
# 设置虚拟内存交换（swap）的使用策略为0，减少对磁盘的频繁读写
vm.swappiness = 0
EOF
#然后执行
sysctl --system //生效命令
# 查看是否已成功加载模块
lsmod | grep br_netfilter
# 将读取该文件中的参数设置，并将其应用到系统的当前运行状态中
sysctl -p /etc/sysctl.d/kubernetes.conf解析hosts
cat >> /etc/hosts << EOF
192.168.100.105 master
192.168.100.106 node1
192.168.100.107 node2
EOFipvs模式
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4docker安装
debian11安装
安装依赖
apt install \
apt-transport-https \
ca-certificates \
curl \
gnupg \
lsb-release导入秘钥
curl -fsSL http://mirrors.aliyun.com/docker-ce/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg添加存储库
echo \
"deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null打印指定版本
apt-cache madison docker-ce | awk '{ print $3 }' 给版本变量
ver=5:20.10.14~3-0~debian-bullseye指定版本安装
apt-get install docker-ce=$VERSION_STRING docker-ce-cli=$VERSION_STRING containerd.io docker-buildx-plugin docker-compose-plugincri-docker参考下面
Centos安装
安装docker依赖
yum install -y yum-utils 配置软件软
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo安装docker
yum install docker-ce docker-ce-cli containerd.io -y安装指定版本
yum list docker-ce --showduplicates|grep "^doc"|sort -r
yum install docker-ce-23.0.1-1.el7 docker-ce-cli-23.0.1-1.el7 containerd.io -y设置docker开机自启
配置docker镜像源
cat <<EOF > /etc/docker/daemon.json
{
"registry-mirrors": [
"http://hub-mirror.c.163.com",
"https://docker.mirrors.ustc.edu.cn",
"https://registry.docker-cn.com"
],
"exec-opts": ["native.cgroupdriver=systemd"]
}
EOF
#重启docker
systemctl restart docker安装cri-docker
-
官方地址
-
下载下来rpm安装
-
配置cri-docker使用国内镜像
vim /usr/lib/systemd/system/cri-docker.service -
修改配置如下：
ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --pod-infra-container-image registry.aliyuncs.com/google_containers/pause:3.9 -
自启
systemctl daemon-reload && systemctl start cri-docker && systemctl enable cri-docker && systemctl status cri-docker
安装Containerd
1.24后不在支持docker需要ctr但是可以下载cri-docker用于容器运行时这里是另外的ctr方式可以忽略
二进制安装
下载
wget https://github.7boe.top/https://github.com/containerd/containerd/releases/download/v1.7.10/cri-containerd-1.7.10-linux-amd64.tar.gz自动解压到指定位置
tar xf cri-containerd-1.7.9-linux-amd64.tar.gz -C /下载runc并且编译好库
wget https://github.7boe.top/https://github.com/opencontainers/runc/releases/download/v1.1.10/libseccomp-2.5.4.tar.gz
wget https://github.7boe.top/https://github.com/opencontainers/runc/releases/download/v1.1.10/runc.amd64
tar zxvf libseccomp-2.5.4.tar.gz
cd libseccomp-2.5.4
./configure
make && make install移动新的runc到目录内
chmod +x runc.amd64
mv runc.amd64 /usr/local/sbin/runc验证版本
containerd -version
ctr version
crictl version
systemctl enable containerd ; systemctl start containerd ; systemctl status containerdyum安装
yum install -y yum-utils \
device-mapper-persistent-data \
lvm2
yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
yum list | grep containerd
yum install containerd.io生成配置
mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml替换配置
registry.aliyuncs.com/google_containers/pause:3.9
SystemdCgroup = true
sed -i "s#https://registry-1.docker.io#https://registry.cn-hangzhou.aliyuncs.com#g" /etc/containerd/config.toml需要crictr
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.26.1/crictl-v1.26.1-linux-amd64.tar.gz
tar -zxvf crictl-v1.24.0-linux-amd64.tar.gz -C /usr/local/bin改变容器运行时
crictl config runtime-endpoint unix:///run/containerd/containerd.sock
crictl config image-endpoint unix:///run/containerd/containerd.sock
cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///var/run/containerd/containerd.sock
image-endpoint: unix:///var/run/containerd/containerd.sock
timeout: 10
debug: false
pull-image-on-create: false
EOFctr版本信息查看
containerd -version
ctr version
crictl version
systemctl enable containerd ; systemctl start containerd ; systemctl status containerd安装k8s
kubeadm kubelet kubectl kubeadm是一个Kubernetes的部署工具，负责执行构建一个最小化的可用集群以及将其启动等的必要基本步骤。提供kubeadm init 和 kubeadm join两个操作命令，可以让我们快速部署一个Kubernetes集群。
kubeadm是Kubernetes集群全生命周期的管理工具，可用于实现集群的部署、升级、降级及拆除。kubeadm部署Kubernetes集群是将大部分资源以pod的方式运行，例如（kube-proxy、kube-controller-manager、kube-scheduler、kube-apiserver、flannel)都是以pod方式运行。
kubectl是Kubernetes集群的命令行工具，通过kubectl能够对集群本身进行管理，并能够在集群上进行容器化应用的安装和部署。接下来我们会经常与kubectl命令打交道的
配置k8s源
Debian12国内源安装
# 添加并信任APT证书
curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | sudo apt-key add -
安装apt软件仓库添加工具
apt-get install -y software-properties-common
# 添加源地址
add-apt-repository "deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main"
apt-cache madison kubectl | awk '{ print $3 }'
ver=1.26.1
# 更新源并安装最新版 kubenetes
sudo apt install kubeadm=$ver kubectl=$ver kubeadm=$ver
sudo apt update && apt install -y kubelet kubeadm kubectlCentos导入源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF安装指定版本 kubeadm，kubelet和kubectl
yum install -y kubelet-1.26.1 kubeadm-1.26.1 kubectl-1.26.1设置开机自启
systemctl enable kubelet && systemctl start kubelet && systemctl status kubelet可以不带这个
使用 /etc/default/kubelet 文件来设置 kubelet 的额外参数
该参数指定了 kubelet 使用 systemd 作为容器运行时的 cgroup 驱动程序
KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"
EOF部署Kubernetes初始化
++接下来的命令在master上执行++
查看国内镜像
kubeadm config images list --image-repository registry.aliyuncs.com/google_containers国内镜像拉取
kubeadm config images pull --kubernetes-version=v1.26.1 --image-repository registry.aliyuncs.com/google_containers --cri-socket unix:///var/run/cri-dockerd.sock初始化命令
kubeadm init \
--kubernetes-version v1.26.1 \
--image-repository registry.aliyuncs.com/google_containers \
--apiserver-advertise-address 10.0.0.1 \
--service-cidr 10.100.0.0/16 \
--pod-network-cidr 10.200.0.0/16 \
--cri-socket=unix:///var/run/cri-dockerd.sock \
--ignore-preflight-errors=all比较全的初始化
kubeadm init --apiserver-advertise-address=121.40.147.166 --kubernetes-version=v1.26.1 --pod-network-cidr=10.100.0.0/24 --service-cidr=10.200.0.0/24 --token-ttl=0 --cri-socket=unix:///var/run/cri-dockerd.sock --image-repository registry.aliyuncs.com/google_containers --upload-certs --ignore-preflight-errors=all配置 Kubernetes 集群的访问权限
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
export KUBECONFIG=/etc/kubernetes/admin.confkubectl命令补全
source <(kubectl completion bash)node加入集群
注意后面要设置容器运行时工具
kubeadm join 192.168.72.139:6443 --token tbrqt5.e9xje0c0i1vv6b66 --discovery-token-ca-cert-hash sha256:f27da12089c64c1c5611ed5b6e008032e07988cc5fbbf190899314d098cfb0fb --cri-socket=unix:///var/run/cri-dockerd.sock查看集群信息
kubectl get nodes查看pod信息
kubectl get pods -A 安装网络插件Calico
官网文档
https://docs.tigera.io/calico/3.25/getting-started/kubernetes/self-managed-onprem/onpremises查看支持的版本信息
https://docs.tigera.io/calico/3.25/getting-started/kubernetes/requirements安装步骤就俩
curl https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/calico.yaml -O
kubectl apply -f calico.yaml创建默认存储类
创建配置文件
vim default-storage-class.yaml写入存储类配置
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: kubebord
provisioner: kubernetes.io/local-volume
kubectl apply -f default-storage-class.yaml让他变成默认存储类
kubectl patch storageclass <your-storage-class-name> -p '{"metadata": {"annotations":{"storageclass.kube