安装docker

yum install -y yum-utils device-mapper-persistent-data lvm2
wget -O /etc/yum.repos.d/docker-ce.repo https://download.docker.com/linux/centos/docker-ce.repo
sed -i 's+download.docker.com+mirrors.tuna.tsinghua.edu.cn/docker-ce+' /etc/yum.repos.d/docker-ce.repo
yum install docker-ce-18.06.1.ce

mkdir /etc/docker

vim /etc/docker/daemon.json
{
  "storage-driver": "overlay2",
  "registry-mirrors": ["https://q2gr04ke.mirror.aliyuncs.com"]
}

启动docker

---

hosts文件

cat >>/etc/hosts<<EOF
192.168.66.28 k8s-master
192.168.66.81 k8s-node1
192.168.66.178 k8s-node2
EOF

设置主机名

hostnamectl set-hostname k8s-master
hostnamectl set-hostname k8s-node1
hostnamectl set-hostname k8s-node2

设置内核参数

vim /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
vm.swappiness = 0

sysctl -p /etc/sysctl.d/k8s.conf

kube-proxy开启ipvs的前置条件

cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF

chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4

设置yum安装源，安装kubelet、kubeadm、kubectl

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum install -y kubelet-1.17.0 kubeadm-1.17.0 kubectl-1.17.0

在初始化群集之前重新编译kubeadm，证书有效期自动为100年

wget https://github.com/kubernetes/kubernetes/archive/v1.17.0.tar.gz

tar xf v1.17.0.tar.gz
mv kubernetes-1.17.0 kubernetes
cd kubernetes

修改 CA 有效期为 100 年（默认为 10 年）

vim ./staging/src/k8s.io/client-go/util/cert/cert.go
...
                //NotAfter:              now.Add(duration365d * 10).UTC(),
                NotAfter:              now.Add(duration365d * 100).UTC(),
...

修改证书有效期为 100 年（默认为 1 年）

vim ./cmd/kubeadm/app/constants/constants.go
...
        CertificateValidity = time.Hour * 24 * 365 * 100
...

编译

cat ./build/build-image/cross/VERSION
v1.13.4-1

docker pull registry.aliyuncs.com/google_containers/kube-cross:v1.13.6-1

# docker run --rm -v <你修改后的代码目录>:/go/src/k8s.io/kubernetes -it gcrcontainer/kube-cross bash
docker run --rm -v /root/kubernetes:/go/src/k8s.io/kubernetes -it registry.aliyuncs.com/google_containers/kube-cross:v1.13.6-1 bash

cd /go/src/k8s.io/kubernetes

# 编译kubeadm, 这里主要编译kubeadm 即可
make all WHAT=cmd/kubeadm GOFLAGS=-v

# 编译kubelet
# make all WHAT=cmd/kubelet GOFLAGS=-v

# 编译kubectl
# make all WHAT=cmd/kubectl GOFLAGS=-v

# 退出容器
exit

#编译完产物在 _output/bin/kubeadm 目录下，
#其中bin是使用了软连接
#真实路径是_output/local/bin/linux/amd64/kubeadm
mv /usr/bin/kubeadm /usr/bin/kubeadm_backup
cp _output/local/bin/linux/amd64/kubeadm /usr/bin/kubeadm
chmod +x /usr/bin/kubeadm


#其它节点也替换
mv /usr/bin/kubeadm /usr/bin/kubeadm_backup
scp /usr/bin/kubeadm 192.168.66.81:/usr/bin/
mv /usr/bin/kubeadm /usr/bin/kubeadm_backup
scp /usr/bin/kubeadm 192.168.66.178:/usr/bin/


# 验证版本
kubeadm version

Master节点需要完成

运行初始化命令

kubeadm init --kubernetes-version=1.17.0 \
--apiserver-advertise-address=192.168.66.28 \
--image-repository registry.aliyuncs.com/google_containers \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

安装Calico

mkdir k8s
cd k8s
#wget https://docs.projectcalico.org/v3.10/gettingstarted/kubernetes/installation/hosted/kubernetes-datastore/caliconetworking/1.7/calico.yaml
wget https://docs.projectcalico.org/v3.8/manifests/calico.yaml
sed -i 's/192.168.0.0/10.244.0.0/g' calico.yaml

k8s节点多网卡时指定网卡

            - name: IP_AUTODETECTION_METHOD
              value: "interface=ens3|team1"

kubectl apply -f calico.yaml

kubectl get pod --all-namespaces

systemctl start kubelet

---

每个node节点都操作

使用之前Master节点产生的命令加入集群

kubeadm join 192.168.66.28:6443 --token owxynr.f0le95hh49h8rzzz \
    --discovery-token-ca-cert-hash sha256:8d66e028182fa508fef096c8445874cd0ff75d8475980dcda8632cde43d217fe

systemctl start kubelet

kubectl命令补全功能

echo "source <(kubectl completion bash)" >> /etc/profile

---

附

检查证书到期时间

kubeadm alpha certs check-expiration

续订全部证书

#备份集群配置
kubeadm config view > kubeadm-cluster.yaml
#更新所有证书
kubeadm alpha certs renew all --config=kubeadm-cluster.yaml

kubeadm部署k8s高可用集群

参考
https://www.cnblogs.com/lfl17718347843/p/13417304.html