操作系统初始化配置
#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
iptables -F && iptables -t nat -F && iptables -t mangle -F && iptables -X#关闭selinux
setenforce 0
sed -i 's/enforcing/disabled/' /etc/selinux/config#关闭swap
swapoff -a
sed -ri 's/.*swap.*/#&/' /etc/fstab #根据规划设置主机名
hostnamectl set-hostname master01
hostnamectl set-hostname node01
hostnamectl set-hostname node02#在master添加hosts
cat >> /etc/hosts << EOF
192.168.73.30 master01
192.168.73.40 node01
192.168.73.140 node02
EOF#调整内核参数
cat > /etc/sysctl.d/k8s.conf << EOF
#开启网桥模式,可将网桥的流量传递给iptables链
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
#关闭ipv6协议
net.ipv6.conf.all.disable_ipv6=1
net.ipv4.ip_forward=1
EOFsysctl --system#时间同步
yum install ntpdate -y
ntpdate time.windows.com
部署 docker引擎
//所有 node 节点部署docker引擎
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install -y docker-ce docker-ce-cli containerd.iomkdir /etc/docker
cat > /etc/docker/daemon.json <<EOF
{"registry-mirrors": ["https://6ijb8ubo.mirror.aliyuncs.com"],"exec-opts": ["native.cgroupdriver=systemd"],"log-driver": "json-file","log-opts": {"max-size": "1g", "max-file": "3"}
}
EOFsystemctl start docker.service
systemctl enable docker.service docker info | grep "Cgroup Driver"
Cgroup Driver: systemd
部署 etcd 集群
准备cfssl证书生成工具
生成etcd证书
mkdir /opt/k8s
cd /opt/k8s/#上传 etcd-cert.sh 和 etcd.sh 到 /opt/k8s/ 目录中
chmod +x etcd-cert.sh etcd.sh
创建用于生成CA证书、etcd 服务器证书以及私钥的目录
mkdir /opt/k8s/etcd-cert
mv etcd-cert.sh etcd-cert/
cd /opt/k8s/etcd-cert/
./etcd-cert.sh #生成CA证书、etcd 服务器证书以及私钥
修改etcd-cert.sh的内容
再用ls查看
上传 etcd-v3.4.26-linux-amd64.tar.gz 到 /opt/k8s 目录中,启动etcd服务
cd /opt/k8s/
tar zxvf etcd-v3.4.26-linux-amd64.tar.gz
ls etcd-v3.4.26-linux-amd64
etcd就是etcd 服务的启动命令,后面可跟各种启动参数
etcdctl主要为etcd 服务提供了命令行操作
创建用于存放 etcd 配置文件,命令文件,证书的目录
mkdir -p /opt/etcd/{cfg,bin,ssl}cd /opt/k8s/etcd-v3.4.26-linux-amd64/
mv etcd etcdctl /opt/etcd/bin/
cp /opt/k8s/etcd-cert/*.pem /opt/etcd/ssl/
cd /opt/k8s/./etcd.sh etcd01 192.168.73.80 etcd02=https://192.168.73.100:2380,etcd03=https://192.168.73.110:2380
#进入卡住状态等待其他节点加入,这里需要三台etcd服务同时启动,如果只启动其中一台后,服务会卡在那里,直到集群中所有etcd节点都已启动,可忽略这个情况#可另外打开一个窗口查看etcd进程是否正常
ps -ef | grep etcd
把etcd相关证书文件、命令文件和服务管理文件全部拷贝到另外两个etcd集群节点
scp -r /opt/etcd/ root@192.168.80.11:/opt/
scp -r /opt/etcd/ root@192.168.80.12:/opt/
scp /usr/lib/systemd/system/etcd.service root@192.168.80.11:/usr/lib/systemd/system/
scp /usr/lib/systemd/system/etcd.service root@192.168.80.12:/usr/lib/systemd/system/
再另外两个节点上修改 opt/etcd/cfg/etcd
重启
启动etcd服务
systemctl start etcd
systemctl enable etcd
systemctl status etcd
查看etcd集群健康状态(要在opt/etcd/ssl目录下)
#查看etcd集群健康状态
ETCDCTL_API=3 /opt/etcd/bin/etcdctl --endpoints="https://192.168.73.80:2379,https://192.168.73.100:2379,https://192.168.73.110:2379" --cacert=ca.pem --cert=server.pem --key=server-key.pem -wtable endpoint health
#查看etcd集群状态信息
ETCDCTL_API=3 /opt/etcd/bin/etcdctl --endpoints="https://192.168.73.80:2379,https://192.168.73.100:2379,https://192.168.73.110:2379" --cacert=ca.pem --cert=server.pem --key=server-key.pem -wtable endpoint status
部署master