Ubuntu 18.04 下部署k8s

一 、更新Ubuntu源

mv /etc/apt/sources.list /etc/apt/sources.list.bakcat  /etc/apt/sources.list.bak |grep -v "#" |grep -v "^#34; >sources.listsed -i s/archive.ubuntu.com/mirrors.ustc.edu.cn/g /etc/apt/sources.listsed -i s/security.ubuntu.com/mirrors.ustc.edu.cn/g /etc/apt/sources.listapt -y update && apt -y upgrade# 2、timedatectlsed -i s/en_US/C/g /etc/default/localetimedatectl set-timezone Asia/Shanghai# 3、bash-completionsed -i 97,99s/#//g /root/.bashrc# 4、sshecho "PermitRootLogin yes" >>/etc/ssh/sshd_configpasswd root << "EOF"passwordpasswordEOFsystemctl reload ssh# 5	、hostsvim /etc/hosts10.0.0.20 k8s-master0010.0.0.21 k8s-master0110.0.0.22 k8s-master0210.0.0.23 k8s-node0110.0.0.24 k8s-node0210.0.0.25 k8s-bl-master# 6

、ssh-keygenssh-keygen -t rsafor i in `cat /root/*.txt`;do echo $i;ssh-copy-id -i .ssh/id_rsa.pub $i;done# 7	
、swapswapoff -ased -i '/swap/s/^(.*)$/#1/g' /etc/fstab# 8
、networknet=`cat /etc/netplan/00-installer-config.yaml |awk 'NR==4{ print $1}'`sed -i "s/${ net}/eth0:/g" /etc/netplan/00-installer-config.yamlsed -i '11s/""/"net.ifnames=0 biosdevname=0"/g' /etc/default/grubupdate-grubreboot

二 、安裝ipvs

apt -y install ipvsadm ipset sysstat conntrack libseccomp2 libseccomp-devcat >/etc/modules-load.d/ipvs.conf << EOFip_vsip_vs_lcip_vs_wlcip_vs_rrip_vs_wrrip_vs_lblcip_vs_lblcrip_vs_dhip_vs_ship_vs_foip_vs_nqip_vs_sedip_vs_ftpnf_conntrackip_tablesip_setxt_setipt_setipt_rpfilteript_REJECTipipEOFsystemctl restart systemd-modules-load.servicelsmod |grep -e ip_vs -e nf_conntrack_ipv4

三 、下載安裝containerd

wget https://github.com/containerd/containerd/releases/download/v1.6.1/cri-containerd-cni-1.6.1-linux-amd64.tar.gztar --no-overwrite-dir -C / -xzf cri-containerd-cni-1.6.1-linux-amd64.tar.gzsystemctl daemon-reloadsystemctl enable --now containerd修改 config.tomlcontainerd config default >/etc/containerd/config.toml---sed -i "s#k8s.gcr.io#registry.aliyuncs.com/google_containers#g" /etc/containerd/config.tomlsed -i "s#SystemdCgroup = false#SystemdCgroup = true#g" /etc/containerd/config.tomlsed -i '153a        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]' /etc/containerd/config.toml  # 8個空格 # endpoint 10個空格sed -i '154a          endpoint = ["https://registry.aliyuncs.com"]' /etc/containerd/config.toml修改crictl.yamlmv /etc/crictl.yaml /etc/crictl.yaml.bakcat >/etc/crictl.yaml << "EOF"runtime-endpoint: unix:///run/containerd/containerd.sockimage-endpoint: unix:///run/containerd/containerd.socktimeout: 0debug: falsepull-image-on-create: falsedisable-pull-on-run: falseEOF

四
、安裝nginx 做四層代理

apt -y install nginxcp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bakvim /etc/nginx/nginx.conf---......stream {                   log_format main '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';                  access_log /var/log/nginx/k8s-access.log main;                upstream k8s-apiserver {                 server 10.0.0.20:6443;                server 10.0.0.21:6443;                server 10.0.0.22:6443;        }            server {                 listen 6444;                 proxy_pass k8s-apiserver;        }}http { 		log_format main '$remote_addr - $remote_user [$time_local] "$request" '                        '$status $body_bytes_sent "$http_referer" '                        '"$http_user_agent" "$http_x_forwarded_for"';        ...        ...}---systemctl enable --now nginx.servicesystemctl status nginx.service

五
、安裝keepalive 做高可用

apt -y install keepalived#keepalived configcat >/etc/keepalived/keepalived.conf << "EOF"global_defs {     notification_email {       acassen@firewall.loc      failover@firewall.loc      sysadmin@firewall.loc    }    notification_email_from Alexandre.Cassen@firewall.loc    smtp_server 127.0.0.1    smtp_connect_timeout 30     router_id NGINX_MASTER}vrrp_script check_nginx {   script "/etc/keepalived/check_nginx.sh"  interval 5  weight -1  fall 2  rise 1}vrrp_instance VI_1 {     state MASTER    interface eth0 # 修改為實(shí)際網(wǎng)卡名    virtual_router_id 51 # VRRP 路由 ID 實(shí)例
，每個實(shí)例是唯一的    priority 100 # 優(yōu)先級，備服務(wù)器設(shè)置 90    advert_int 1 # 指定 VRRP 心跳包通告間隔時間

，默認(rèn) 1 秒    authentication {         auth_type PASS        auth_pass K8SHA_KA_AUTH    }    # 虛擬 IP    virtual_ipaddress {         10.0.0.25/24    }    track_script {         check_nginx    }}EOF#health configcat >/etc/keepalived/check_nginx.sh << "EOF"#!/bin/bash count=$(ps -ef |grep nginx | grep sbin | egrep -cv "grep|$") if [ "$count" -eq 0 ];then   systemctl stop keepalived fiEOF---systemctl enable --now keepalived.servicesystemctl status keepalived.service

六、master端部署cfssl、etcd 、ca certificate 、etcd certificate

6.1 、下載cfssl

wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64 -O /usr/local/bin/cfsslwget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64 -O /usr/local/bin/cfssljsonwget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl-certinfo_1.6.1_linux_amd64 -O /usr/local/bin/cfssl-certinfochmod +x /usr/local/bin/cfssl*chown -Rf root:root /usr/local/bin/cfssl*

6.2 、etcd目錄規(guī)劃

# all Master# 1、etcd-sslmkdir -p /etc/etcd/ssl/# 2
、etcd-WorkingDirectorymkdir -p /var/lib/etcd/default.etcd# 3、kubernetes-sslmkdir -p /etc/kubernetes/ssl# 4、kubernetes-logmkdir -p /var/log/kubernetes

6.3 
、ca 證書生成

mkdir -p ~/workcd ~/work/---cat >ca-csr.json << "EOF"{   "CN": "kubernetes",  "key": {     "algo": "rsa",    "size": 2048  },  "names": [    {       "C": "CN",      "ST": "Shanghai",      "L": "Shanghai",      "O": "k8s",      "OU": "system"    }  ]}EOF---cat >ca-config.json << "EOF"{   "signing": {     "default": {       "expiry": "87600h"    },    "profiles": {       "kubernetes": {         "usages": [            "signing",            "key encipherment",            "server auth",            "client auth"        ],        "expiry": "87600h"      }    }  }}EOF---cfssl gencert -initca ca-csr.json | cfssljson -bare cacp ca*.pem /etc/etcd/ssl/---# send to other masterfor i in `cat ~/MasterNodes.txt`;do echo $i;scp /etc/etcd/ssl/ca*.pem $i:/etc/etcd/ssl;done

6.4 配置etcd證書

cat >etcd-csr.json << "EOF"{   "CN": "etcd",  "hosts": [    "127.0.0.1",    "10.0.0.20",    "10.0.0.21",    "10.0.0.22",    "10.0.0.25"  ],  "key": {     "algo": "rsa",    "size": 2048  },  "names": [    {       "C": "CN",      "ST": "Shanghai",      "L": "Shanghai",      "O": "k8s",      "OU": "system"    }  ]}EOF---cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcdcp etcd*.pem /etc/etcd/ssl/---# send to otherfor i in `cat ~/MasterNodes.txt`;do echo $i;scp /etc/etcd/ssl/etcd*.pem $i:/etc/etcd/ssl;done

6.5、下載及配置etcd

# download etcdwget https://github.com/etcd-io/etcd/releases/download/v3.5.0/etcd-v3.5.0-linux-amd64.tar.gz# tar etcd-*.tar.gztar -xf etcd-v3.5.0-linux-amd64.tar.gz --strip-components=1 -C ~/work/ etcd-v3.5.0-linux-amd64/etcd{ ,ctl}chown -Rf root:root etcd*cp -arp etcd* /usr/local/bin/# send to otherfor i in `cat ~/MasterNodes.txt`;do echo $i;scp /usr/local/bin/etcd{ ,ctl} $i:/usr/local/bin/;donecat >/etc/etcd/etcd.conf << "EOF"ETCD_NAME='etcd1'ETCD_DATA_DIR="/var/lib/etcd/default.etcd"ETCD_LISTEN_PEER_URLS="https://10.0.0.20:2380" # change ipETCD_LISTEN_CLIENT_URLS="https://10.0.0.20:2379,http://127.0.0.1:2379" # change ipETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.0.0.20:2380" # change ipETCD_ADVERTISE_CLIENT_URLS="https://10.0.0.20:2379" # change ipETCD_INITIAL_CLUSTER="etcd1=https://10.0.0.20:2380,etcd2=https://10.0.0.21:2380,etcd3=https://10.0.0.22:2380"ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"ETCD_INITIAL_CLUSTER_STATE="new"EOF

6.6