节点ip
k8s-1（master）192.168.200.132
k8s-2（master）后加入192.168.200.135
k8s-3（master）后加入192.168.200.148

要求：

  1. etcd外设
  2. 高可用节点配置
  3. master节点可加入集群

 Centos 8.2配置k8s1.19.1基础配置_centos8 chrony 时间同步-CSDN博客文章浏览阅读125次。【代码】Centos 8配置k8s1.19.1基础配置。_centos8 chrony 时间同步https://blog.csdn.net/weixin_50763319/article/details/139595192?csdn_share_tail=%7B%22type%22%3A%22blog%22%2C%22rType%22%3A%22article%22%2C%22rId%22%3A%22139595192%22%2C%22source%22%3A%22weixin_50763319%22%7D（前置基础配置参考）

etcd部署

本文前置环境依赖包部署包工具包均已配置好，省略下载步骤直接开始部署。

centos8已经不再维护很多依赖包缺失，文章采用了阿里云与bclinux8.2源。建议使用bclinux8.2源

创建自定义目录
注意!:cfssl cfssljson etcd etcdctl需先安装好，本文已经安装不做演示 etcd-v3.4.3
mkdir -p /data/etcd/bin
mkdir -p /data/etcd/ssl
cd /data/etcd/ssl
#三台均创建目录，证书仅在一台节点上创建
mkdir -p /data/etcd
创建ca证书

vim ca-config.json

{
    "signing": {
        "default": {
            "expiry": "876000h"
        },
        "profiles": {
            "server": {
                "expiry": "876000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            },
            "client": {
                "expiry": "876000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "876000h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}
创建证书签名请求ca-csr.json

vim ca-csr.json

{
    "CN": "etcd",
    "key": {
        "algo": "rsa",
        "size": 2048
    }
}

#生成CA证书和私钥
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

#生成出以下证书
ca.csr
ca-key.pem
ca.pem
生成客户端证书

vim client.json

{
    "CN": "client",
    "key": {
        "algo": "ecdsa",
        "size": 256
    }
}

#生成client证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json  | cfssljson -bare client -

#获得以下证书
client.csr
client-key.pem
client.pem
 ca与client整体证书
ca-config.json
ca.csr
ca-csr.json
ca-key.pem
ca.pem
client.csr
client.json
client-key.pem
client.pem
#三个json是自己手动创建，其他非json为工具生成的证书
生成server，peer证书

vim etcd.json

{
    "CN": "etcd",
    "hosts": [
        "192.168.200.132",
        "192.168.200.135",
        "192.168.200.148"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "CN",
            "L": "BJ",
            "ST": "BJ"
        }
    ]
}

#生成peer跟server证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server etcd.json | cfssljson -bare server

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd.json | cfssljson -bare peer
证书总览
ca-config.json
ca.csr
ca-csr.json
ca-key.pem
ca.pem
client.csr
client.json
client-key.pem
client.pem
etcd.json
peer.csr
peer-key.pem
peer.pem
server.csr
server-key.pem
server.pem

ca证书 client证书 peer证书 server证书
ca-config.json ca-csr.json client.json etcd.json为手动创建
将证书同步到另外两台节点
scp -r /data/etcd 192.168.200.135:/data/
scp -r /data/etcd 192.168.200.148:/data/
#拷贝etcd工具
scp etcd etcdctl root@192.168.200.148:/data/etcd/bin/
scp etcd etcdctl root@192.168.200.135:/data/etcd/bin/
 systemd管理etcd

vim /usr/lib/systemd/system/etcd.service（记得删除注释）

[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
Type=notify
WorkingDirectory=/data/etcd/
ExecStart=/data/etcd/bin/etcd   --name=etcd1   --cert-file=/data/etcd/ssl/server.pem   --key-file=/data/etcd/ssl/server-key.pem   --peer-cert-file=/data/etcd/ssl/peer.pem  --peer-key-file=/data/etcd/ssl/peer-key.pem    --trusted-ca-file=/data/etcd/ssl/ca.pem   --peer-trusted-ca-file=/data/etcd/ssl/ca.pem   --initial-advertise-peer-urls=https://192.168.200.132:2380   --listen-peer-urls=https://192.168.200.132:2380   --listen-client-urls=https://192.168.200.132:2379   --advertise-client-urls=https://192.168.200.132:2379   --initial-cluster-token=etcd-cluster-0   --initial-cluster=etcd1=https://192.168.200.132:2380,etcd2=https://192.168.200.135:2380,etcd3=https://192.168.200.148:2380   --initial-cluster-state=new   --data-dir=/data/etcd   --snapshot-count=50000   --auto-compaction-retention=1   --max-request-bytes=10485760   --quota-backend-bytes=8589934592
Restart=always
RestartSec=15
LimitNOFILE=65536
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target



#注意：需要修改的内容
  --name=etcd1    #对应etcd节点修改
  --initial-advertise-peer-urls=https://192.168.200.132:2380 #本机ip
  --listen-peer-urls=https://192.168.200.132:2380 #本机ip
  --listen-client-urls=https://192.168.200.132:2379 #本机ip
  --advertise-client-urls=https://192.168.200.132:2379 #本机ip
  --initial-cluster=etcd1=https://192.168.200.132:2380,etcd2=https://192.168.200.135:2380,etcd3=https://192.168.200.148:2380  #集群地址
启动etcd
systemctl daemon-reload
systemctl enable etcd
systemctl start etcd
systemctl status etcd

配置haproxy+keepalived高可用

 安装 keepalived 和 haproxy
dnf -y install keepalived haproxy
keepalived，haproxy配置apiserver高可用

参考：

【云原生-K8s-2】kubeadm搭建k8s高可用集群(三主两从一VIP)完整教程_kubeadm高可用集群-CSDN博客

k8s1.19.1部署

#查看镜像
kubeadm config images list
k8s.gcr.io/kube-apiserver:v1.19.16
k8s.gcr.io/kube-controller-manager:v1.19.16
k8s.gcr.io/kube-scheduler:v1.19.16
k8s.gcr.io/kube-proxy:v1.19.16
k8s.gcr.io/pause:3.2
k8s.gcr.io/etcd:3.4.13-0
k8s.gcr.io/coredns:1.7.0

#镜像提前下载可更换国内地址
registry.cn-hangzhou.aliyuncs.com/google_containers
初始化master
#配置apiserver证书etcd证书
mkdir -p /etc/kubernetes/pki/etcd/

\cp -rf /data/etcd/ssl/ca.pem /etc/kubernetes/pki/etcd/
\cp -rf /data/etcd/ssl/client.pem /etc/kubernetes/pki/apiserver-etcd-client.pem
\cp -rf /data/etcd/ssl/client-key.pem /etc/kubernetes/pki/apiserver-etcd-client-key.pem

#检查etcd状态
systemctl status etcd
配置kubeadm配置文件
kubeadm config print init-defaults > kubeadm-init.yaml
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 192.168.200.132        #本机ip
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: k8s-1
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
        #  local:
        #dataDir: /var/lib/etcd
  external:
    endpoints:
    - https://192.168.200.132:2379
    - https://192.168.200.135:2379
    - https://192.168.200.148:2379
    caFile: /etc/kubernetes/pki/etcd/ca.pem  #搭建etcd集群时生成的ca证书
    certFile: /etc/kubernetes/pki/apiserver-etcd-client.pem   #搭建etcd集群时生成的客户端证书
    keyFile: /etc/kubernetes/pki/apiserver-etcd-client-key.pem  #搭建etcd集群时生成的客户端密钥
imageRepository: k8s.gcr.io    #镜像提前下载
kind: ClusterConfiguration
kubernetesVersion: v1.19.1     #版本要与k8s版本保持一致
controlPlaneEndpoint: 192.168.200.66:16443
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: "ipvs"
初始化k8s节点
kubeadm init --config=kubeadm-init.yaml --upload-certs

另外两台master节点加入集群
  kubeadm join 192.168.200.66:16443 --token abcdef.0123456789abcdef \
    --discovery-token-ca-cert-hash sha256:4cfeb2347878e4505d272b8d4bc924164c86b1541ec8e47a460a6adaeaf965a0 \
    --control-plane --certificate-key 57944fbbcd3af8dae151bccccd0957c7dbcaaacb70e64c0ae7bed23b84ee1a40
证书过期如何加入master

kubeadm init phase upload-certs --upload-certs
kubeadm token create --print-join-command

添加命令
kubeadm join 192.168.206.138:6443 --token iw6jit.m5fp5ftpmzd5qw14     --discovery-token-ca-cert-hash sha256:af0bd61b3323d6ccf692706f9be2b0d89eb7f0c4ed79ae3ef874b4b1690b1c85 --control-plane --certificate-key 272fb136b903ee039690d2cc8fef37b60da6506f59377560d04ffc7cbc722bff

部署calico配置集群网络

vim calico.yaml

#CALICO_IPV4POOL_CIDR配置为podip
#IP_AUTODETECTION_METHOD配置为节点网卡
            - name: CALICO_IPV4POOL_CIDR
              value: "10.244.0.0/16"
            - name: IP_AUTODETECTION_METHOD
              value: "interface=(enp.*)|(eth.*)|(eno1.*)|(bo.*)|(ens.*)"
#生成calico
kubectl apply -f calico.yaml

# kubernetes # 容器 # 云原生
Logo
K8S/Kubernetes

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐

【深度】阿里巴巴万级规模 K8s 集群全局高可用体系之美

作者 |  韩堂、柘远、沉醉来源 | 阿里巴巴云原生公众号​前言台湾作家林清玄在接受记者采访的时候，如此评价自己 30 多年写作生涯：“第一个十年我才华横溢，‘贼光闪现’，令周边黯然失色；第二个十年，我终于‘宝光现形’，不再去抢风头，反而与身边的美丽相得益彰；进入第三个十年，繁华落尽见真醇，我进入了‘醇光初现’的阶段，真正体味到了境界之美”。​长夜有穷，真水无香。领略过了 K8s“身在江

avatar K8S/Kubernetes

如何基于 K8s 构建下一代 DevOps 平台？

作者 | 孙健波（天元）导读：当前云原生 DevOps 体系现状如何？面临哪些挑战？如何通过 OAM 解决云原生 DevOps 场景下的诸多问题？云原生开发应用模型 OAM(Open Application Model) 社区核心成员孙健波将为大家一一解答，并分享如何基于 OAM 和 Kubernetes 打造无限能力的下一代 DevOps 平台。什么是 DevOps？为什么基于 Kub

avatar K8S/Kubernetes

k8s 火了！

2020，上云之年，产品云端化成为一种趋势。在一线城市，很多公司都已经构建了自己的私有云环境，比如阿里云、网易云、华为云等。而Kubernetes 作为基于容器编排领域的王者，具备扩展...

avatar K8S/Kubernetes