{"id":10006456,"date":"2022-09-12T18:08:24","date_gmt":"2022-09-12T10:08:24","guid":{"rendered":"https:\/\/ityet.com\/?p=10006456"},"modified":"2022-09-12T18:08:24","modified_gmt":"2022-09-12T10:08:24","slug":"%e6%9c%80%e8%af%a6%e7%bb%86%e7%9a%84-k8s-%e9%ab%98%e5%8f%af%e7%94%a8%e9%83%a8%e7%bd%b2%e6%b5%81%e7%a8%8b%ef%bc%81%e6%ad%a5%e9%aa%a4%e9%bd%90%e5%85%a8%ef%bc%8c%e5%b0%91%e8%b5%b0%e5%9d%91%e8%b7%af","status":"publish","type":"post","link":"https:\/\/itmax.cn\/?p=10006456","title":{"rendered":"\u6700\u8be6\u7ec6\u7684 K8S \u9ad8\u53ef\u7528\u90e8\u7f72\u6d41\u7a0b\uff01\u6b65\u9aa4\u9f50\u5168\uff0c\u5c11\u8d70\u5751\u8def"},"content":{"rendered":"<p>\u5b98\u7f51\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=w%2F%2FP5StTuyob1YxcfWrzIw%3D%3D.%2FzeE%2F937Dm4IFIOiMiTZRMfEZdxvC2oz2fqBteJ%2BLFo%3D\" rel=\"nofollow\">https:\/\/kubernetes.io\/<\/a><\/p>\n<p>\u6587\u6863\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=qp7HLYOd0rfuKg89foTwCQ%3D%3D.kHNjEXsi6AXWYap%2FhBEEUKqILZlZL8PHK5XnbdhYGBI7dYSyzpLbeWzmk5NRHcQ7\" rel=\"nofollow\">https:\/\/kubernetes.io\/zh-cn\/d&#8230;<\/a><\/p>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458866\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h2>\u57fa\u7840\u73af\u5883\u90e8\u7f72<\/h2>\n<h6>\u524d\u671f\u51c6\u5907\uff08\u6240\u6709\u8282\u70b9\uff09<\/h6>\n<p>1\u3001\u4fee\u6539\u4e3b\u673a\u540d\u548c\u914d\u7f6e hosts<\/p>\n<p>\u5148\u90e8\u7f72 1master \u548c 2node \u8282\u70b9\uff0c\u540e\u9762\u518d\u52a0\u4e00\u4e2a master \u8282\u70b9<\/p>\n<pre><code># \u5728192.168.0.113\u6267\u884c\nhostnamectl set-hostname  k8s-master-168-0-113\n# \u5728192.168.0.114\u6267\u884c\nhostnamectl set-hostname k8s-node1-168-0-114\n# \u5728192.168.0.115\u6267\u884c\nhostnamectl set-hostname k8s-node2-168-0-115<\/code><\/pre>\n<p>\u914d\u7f6e hosts<\/p>\n<pre><code>cat\u00a0&gt;&gt;\u00a0\/etc\/hosts&lt;&lt;EOF\n192.168.0.113\u00a0k8s-master-168-0-113\n192.168.0.114\u00a0k8s-node1-168-0-114\n192.168.0.115\u00a0k8s-node2-168-0-115\nEOF<\/code><\/pre>\n<p>2\u3001\u914d\u7f6e ssh \u4e92\u4fe1<\/p>\n<pre><code># \u76f4\u63a5\u4e00\u76f4\u56de\u8f66\u5c31\u884c\nssh-keygen\n\nssh-copy-id -i ~\/.ssh\/id_rsa.pub root@k8s-master-168-0-113\nssh-copy-id -i ~\/.ssh\/id_rsa.pub root@k8s-node1-168-0-114\nssh-copy-id -i ~\/.ssh\/id_rsa.pub root@k8s-node2-168-0-115<\/code><\/pre>\n<p>3\u3001\u65f6\u95f4\u540c\u6b65<\/p>\n<pre><code>yum install chrony -y\nsystemctl start chronyd\nsystemctl enable chronyd\nchronyc sources<\/code><\/pre>\n<p>4\u3001\u5173\u95ed\u9632\u706b\u5899<\/p>\n<pre><code>systemctl stop firewalld\nsystemctl disable firewalld<\/code><\/pre>\n<p>5\u3001\u5173\u95ed swap<\/p>\n<pre><code># \u4e34\u65f6\u5173\u95ed\uff1b\u5173\u95edswap\u4e3b\u8981\u662f\u4e3a\u4e86\u6027\u80fd\u8003\u8651\nswapoff -a\n# \u53ef\u4ee5\u901a\u8fc7\u8fd9\u4e2a\u547d\u4ee4\u67e5\u770bswap\u662f\u5426\u5173\u95ed\u4e86\nfree\n# \u6c38\u4e45\u5173\u95ed\nsed -ri 's\/.*swap.*\/#&amp;\/' \/etc\/fstab<\/code><\/pre>\n<p>6\u3001\u7981\u7528 SELinux<\/p>\n<pre><code># \u4e34\u65f6\u5173\u95ed\nsetenforce 0\n# \u6c38\u4e45\u7981\u7528\nsed -i 's\/^SELINUX=enforcing$\/SELINUX=disabled\/' \/etc\/selinux\/config<\/code><\/pre>\n<p>7\u3001\u5141\u8bb8 iptables \u68c0\u67e5\u6865\u63a5\u6d41\u91cf\uff08\u53ef\u9009\uff0c\u6240\u6709\u8282\u70b9\uff09<\/p>\n<pre><code>\u82e5\u8981\u663e\u5f0f\u52a0\u8f7d\u6b64\u6a21\u5757\uff0c\u8bf7\u8fd0\u884c sudo modprobe br_netfilter\uff0c\u901a\u8fc7\u8fd0\u884c lsmod | grep br_netfilter \u6765\u9a8c\u8bc1 br_netfilter \u6a21\u5757\u662f\u5426\u5df2\u52a0\u8f7d\uff0c\n\nsudo modprobe br_netfilter\nlsmod | grep br_netfilter<\/code><\/pre>\n<p>\u4e3a\u4e86\u8ba9 Linux \u8282\u70b9\u7684 iptables \u80fd\u591f\u6b63\u786e\u67e5\u770b\u6865\u63a5\u6d41\u91cf\uff0c\u8bf7\u786e\u8ba4 sysctl \u914d\u7f6e\u4e2d\u7684 net.bridge.bridge-nf-call-iptables \u8bbe\u7f6e\u4e3a 1\u3002\u4f8b\u5982\uff1a<\/p>\n<pre><code>cat &lt;&lt;EOF | sudo tee \/etc\/modules-load.d\/k8s.conf\noverlay\nbr_netfilter\nEOF\n\nsudo modprobe overlay\nsudo modprobe br_netfilter\n\n# \u8bbe\u7f6e\u6240\u9700\u7684 sysctl \u53c2\u6570\uff0c\u53c2\u6570\u5728\u91cd\u65b0\u542f\u52a8\u540e\u4fdd\u6301\u4e0d\u53d8\ncat &lt;&lt;EOF | sudo tee \/etc\/sysctl.d\/k8s.conf\nnet.bridge.bridge-nf-call-iptables  = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.ipv4.ip_forward                 = 1\nEOF\n\n# \u5e94\u7528 sysctl \u53c2\u6570\u800c\u4e0d\u91cd\u65b0\u542f\u52a8\nsudo sysctl --system<\/code><\/pre>\n<h6>\u5b89\u88c5\u5bb9\u5668 docker\uff08\u6240\u6709\u8282\u70b9\uff09<\/h6>\n<p>\u63d0\u793a\uff1av1.24 \u4e4b\u524d\u7684 Kubernetes \u7248\u672c\u5305\u62ec\u4e0e Docker Engine \u7684\u76f4\u63a5\u96c6\u6210\uff0c\u4f7f\u7528\u540d\u4e3a dockershim \u7684\u7ec4\u4ef6\u3002\u8fd9\u79cd\u7279\u6b8a\u7684\u76f4\u63a5\u6574\u5408\u4e0d\u518d\u662f Kubernetes \u7684\u4e00\u90e8\u5206 \uff08\u8fd9\u6b21\u5220\u9664\u88ab\u4f5c\u4e3a v1.20 \u53d1\u884c\u7248\u672c\u7684\u4e00\u90e8\u5206\u5ba3\u5e03\uff09\u3002\u4f60\u53ef\u4ee5\u9605\u8bfb\u68c0\u67e5 Dockershim \u5f03\u7528\u662f\u5426\u4f1a\u5f71\u54cd\u4f60 \u4ee5\u4e86\u89e3\u6b64\u5220\u9664\u53ef\u80fd\u4f1a\u5982\u4f55\u5f71\u54cd\u4f60\u3002\u8981\u4e86\u89e3\u5982\u4f55\u4f7f\u7528 dockershim \u8fdb\u884c\u8fc1\u79fb\uff0c\u8bf7\u53c2\u9605\u4ece dockershim \u8fc1\u79fb\u3002<\/p>\n<pre><code># \u914d\u7f6eyum\u6e90\ncd \/etc\/yum.repos.d ; mkdir bak; mv CentOS-Linux-* bak\/\n# centos7\nwget -O \/etc\/yum.repos.d\/CentOS-Base.repo http:\/\/mirrors.aliyun.com\/repo\/Centos-7.repo\n# centos8\nwget -O \/etc\/yum.repos.d\/CentOS-Base.repo http:\/\/mirrors.aliyun.com\/repo\/Centos-8.repo\n\n# \u5b89\u88c5yum-config-manager\u914d\u7f6e\u5de5\u5177\nyum -y install yum-utils\n# \u8bbe\u7f6eyum\u6e90\nyum-config-manager --add-repo http:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/docker-ce.repo\n# \u5b89\u88c5docker-ce\u7248\u672c\nyum install -y docker-ce\n# \u542f\u52a8\nsystemctl start docker\n# \u5f00\u673a\u81ea\u542f\nsystemctl enable docker\n# \u67e5\u770b\u7248\u672c\u53f7\ndocker --version\n# \u67e5\u770b\u7248\u672c\u5177\u4f53\u4fe1\u606f\ndocker version\n\n# Docker\u955c\u50cf\u6e90\u8bbe\u7f6e\n# \u4fee\u6539\u6587\u4ef6 \/etc\/docker\/daemon.json\uff0c\u6ca1\u6709\u8fd9\u4e2a\u6587\u4ef6\u5c31\u521b\u5efa\n# \u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u540e\uff0c\u91cd\u542fdocker\u670d\u52a1\uff1a\ncat &gt;\/etc\/docker\/daemon.json&lt;&lt;EOF\n{\n   &quot;registry-mirrors&quot;: [&quot;http:\/\/hub-mirror.c.163.com&quot;]\n}\nEOF\n# \u52a0\u8f7d\nsystemctl reload docker\n\n# \u67e5\u770b\nsystemctl status docker containerd<\/code><\/pre>\n<p>\u3010<strong>\u6e29\u99a8\u63d0\u793a<\/strong>\u3011dockerd \u5b9e\u9645\u771f\u5b9e\u8c03\u7528\u7684\u8fd8\u662f containerd \u7684 api \u63a5\u53e3\uff0ccontainerd \u662f dockerd \u548c runC \u4e4b\u95f4\u7684\u4e00\u4e2a\u4e2d\u95f4\u4ea4\u6d41\u7ec4\u4ef6\u3002\u6240\u4ee5\u542f\u52a8 docker \u670d\u52a1\u7684\u65f6\u5019\uff0c\u4e5f\u4f1a\u542f\u52a8 containerd \u670d\u52a1\u7684\u3002<\/p>\n<h6>\u914d\u7f6e k8s yum \u6e90\uff08\u6240\u6709\u8282\u70b9\uff09<\/h6>\n<pre><code>cat &gt; \/etc\/yum.repos.d\/kubernetes.repo &lt;&lt; EOF\n[k8s]\nname=k8s\nenabled=1\ngpgcheck=0\nbaseurl=https:\/\/mirrors.aliyun.com\/kubernetes\/yum\/repos\/kubernetes-el7-x86_64\/\nEOF<\/code><\/pre>\n<h6>\u5c06 sandbox\/_image \u955c\u50cf\u6e90\u8bbe\u7f6e\u4e3a\u963f\u91cc\u4e91 google\/_containers \u955c\u50cf\u6e90\uff08\u6240\u6709\u8282\u70b9\uff09<\/h6>\n<pre><code># \u5bfc\u51fa\u9ed8\u8ba4\u914d\u7f6e\uff0cconfig.toml\u8fd9\u4e2a\u6587\u4ef6\u9ed8\u8ba4\u662f\u4e0d\u5b58\u5728\u7684\ncontainerd config default &gt; \/etc\/containerd\/config.toml\ngrep sandbox_image  \/etc\/containerd\/config.toml\nsed -i &quot;s#k8s.gcr.io\/pause#registry.aliyuncs.com\/google_containers\/pause#g&quot;       \/etc\/containerd\/config.toml\ngrep sandbox_image  \/etc\/containerd\/config.toml<\/code><\/pre>\n<h6>\u914d\u7f6e containerd cgroup \u9a71\u52a8\u7a0b\u5e8f systemd\uff08\u6240\u6709\u8282\u70b9\uff09<\/h6>\n<p>kubernets \u81ea\uff56 1.24.0 \u540e\uff0c\u5c31\u4e0d\u518d\u4f7f\u7528 docker.shim\uff0c\u66ff\u6362\u91c7\u7528 containerd \u4f5c\u4e3a\u5bb9\u5668\u8fd0\u884c\u65f6\u7aef\u70b9\u3002\u56e0\u6b64\u9700\u8981\u5b89\u88c5 containerd\uff08\u5728 docker \u7684\u57fa\u7840\u4e0b\u5b89\u88c5\uff09\uff0c\u4e0a\u9762\u5b89\u88c5 docker \u7684\u65f6\u5019\u5c31\u81ea\u52a8\u5b89\u88c5\u4e86 containerd \u4e86\u3002\u8fd9\u91cc\u7684 docker \u53ea\u662f\u4f5c\u4e3a\u5ba2\u6237\u7aef\u800c\u5df2\u3002\u5bb9\u5668\u5f15\u64ce\u8fd8\u662f containerd\u3002<\/p>\n<pre><code>sed -i 's#SystemdCgroup = false#SystemdCgroup = true#g' \/etc\/containerd\/config.toml\n# \u5e94\u7528\u6240\u6709\u66f4\u6539\u540e,\u91cd\u65b0\u542f\u52a8containerd\nsystemctl restart containerd<\/code><\/pre>\n<h6>\u5f00\u59cb\u5b89\u88c5 kubeadm\uff0ckubelet \u548c kubectl\uff08master \u8282\u70b9\uff09<\/h6>\n<pre><code># \u4e0d\u6307\u5b9a\u7248\u672c\u5c31\u662f\u6700\u65b0\u7248\u672c\uff0c\u5f53\u524d\u6700\u65b0\u7248\u5c31\u662f1.24.1\nyum install -y kubelet-1.24.1  kubeadm-1.24.1  kubectl-1.24.1 --disableexcludes=kubernetes\n# disableexcludes=kubernetes\uff1a\u7981\u6389\u9664\u4e86\u8fd9\u4e2akubernetes\u4e4b\u5916\u7684\u522b\u7684\u4ed3\u5e93\n# \u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u542f\u5e76\u73b0\u5728\u7acb\u523b\u542f\u52a8\u670d\u52a1 --now\uff1a\u7acb\u523b\u542f\u52a8\u670d\u52a1\nsystemctl enable --now kubelet\n\n# \u67e5\u770b\u72b6\u6001\uff0c\u8fd9\u91cc\u9700\u8981\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\u518d\u67e5\u770b\u670d\u52a1\u72b6\u6001\uff0c\u542f\u52a8\u4f1a\u6709\u70b9\u6162\nsystemctl status kubelet<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458867\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u67e5\u770b\u65e5\u5fd7\uff0c\u53d1\u73b0\u6709\u62a5\u9519\uff0c\u62a5\u9519\u5982\u4e0b\uff1a<\/p>\n<pre><code>kubelet.service:\u00a0Main\u00a0process\u00a0exited,\u00a0code=exited,\u00a0status=1\/FAILURE\u00a0kubelet.service:\u00a0Failed\u00a0with\u00a0result\u00a0'exit-code'.<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458868\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u3010<strong>\u89e3\u91ca<\/strong>\u3011\u91cd\u65b0\u5b89\u88c5\uff08\u6216\u7b2c\u4e00\u6b21\u5b89\u88c5\uff09k8s\uff0c\u672a\u7ecf\u8fc7 kubeadm init \u6216\u8005 kubeadm join \u540e\uff0ckubelet \u4f1a\u4e0d\u65ad\u91cd\u542f\uff0c\u8fd9\u4e2a\u662f\u6b63\u5e38\u73b0\u8c61\u2026\u2026\uff0c\u6267\u884c init \u6216 join \u540e\u95ee\u9898\u4f1a\u81ea\u52a8\u89e3\u51b3\uff0c\u5bf9\u6b64\u5b98\u7f51\u6709\u5982\u4e0b\u63cf\u8ff0\uff0c\u4e5f\u5c31\u662f\u6b64\u65f6\u4e0d\u7528\u7406\u4f1a kubelet.service\u3002<\/p>\n<p>\u67e5\u770b\u7248\u672c<\/p>\n<pre><code>kubectl\u00a0version\n\nyum\u00a0info\u00a0kubeadm<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458869\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>\u4f7f\u7528 kubeadm \u521d\u59cb\u5316\u96c6\u7fa4\uff08master \u8282\u70b9\uff09<\/h6>\n<p>\u6700\u597d\u63d0\u524d\u628a\u955c\u50cf\u4e0b\u8f7d\u597d\uff0c\u8fd9\u6837\u5b89\u88c5\u5feb<\/p>\n<pre><code>docker pull registry.aliyuncs.com\/google_containers\/kube-apiserver:v1.24.1\ndocker pull registry.aliyuncs.com\/google_containers\/kube-controller-manager:v1.24.1\ndocker pull registry.aliyuncs.com\/google_containers\/kube-scheduler:v1.24.1\ndocker pull registry.aliyuncs.com\/google_containers\/kube-proxy:v1.24.1\ndocker pull registry.aliyuncs.com\/google_containers\/pause:3.7\ndocker pull registry.aliyuncs.com\/google_containers\/etcd:3.5.3-0\ndocker pull registry.aliyuncs.com\/google_containers\/coredns:v1.8.6<\/code><\/pre>\n<p>\u96c6\u7fa4\u521d\u59cb\u5316<\/p>\n<pre><code>kubeadm init \/\n  --apiserver-advertise-address=192.168.0.113 \/\n  --image-repository registry.aliyuncs.com\/google_containers \/\n  --control-plane-endpoint=cluster-endpoint \/\n  --kubernetes-version v1.24.1 \/\n  --service-cidr=10.1.0.0\/16 \/\n  --pod-network-cidr=10.244.0.0\/16 \/\n  --v=5\n# \u2013image-repository string\uff1a    \u8fd9\u4e2a\u7528\u4e8e\u6307\u5b9a\u4ece\u4ec0\u4e48\u4f4d\u7f6e\u6765\u62c9\u53d6\u955c\u50cf\uff081.13\u7248\u672c\u624d\u6709\u7684\uff09\uff0c\u9ed8\u8ba4\u503c\u662fk8s.gcr.io\uff0c\u6211\u4eec\u5c06\u5176\u6307\u5b9a\u4e3a\u56fd\u5185\u955c\u50cf\u5730\u5740\uff1aregistry.aliyuncs.com\/google_containers\n# \u2013kubernetes-version string\uff1a  \u6307\u5b9akubenets\u7248\u672c\u53f7\uff0c\u9ed8\u8ba4\u503c\u662fstable-1\uff0c\u4f1a\u5bfc\u81f4\u4ecehttps:\/\/dl.k8s.io\/release\/stable-1.txt\u4e0b\u8f7d\u6700\u65b0\u7684\u7248\u672c\u53f7\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06\u5176\u6307\u5b9a\u4e3a\u56fa\u5b9a\u7248\u672c\uff08v1.22.1\uff09\u6765\u8df3\u8fc7\u7f51\u7edc\u8bf7\u6c42\u3002\n# \u2013apiserver-advertise-address  \u6307\u660e\u7528 Master \u7684\u54ea\u4e2a interface \u4e0e Cluster \u7684\u5176\u4ed6\u8282\u70b9\u901a\u4fe1\u3002\u5982\u679c Master \u6709\u591a\u4e2a interface\uff0c\u5efa\u8bae\u660e\u786e\u6307\u5b9a\uff0c\u5982\u679c\u4e0d\u6307\u5b9a\uff0ckubeadm \u4f1a\u81ea\u52a8\u9009\u62e9\u6709\u9ed8\u8ba4\u7f51\u5173\u7684 interface\u3002\u8fd9\u91cc\u7684ip\u4e3amaster\u8282\u70b9ip\uff0c\u8bb0\u5f97\u66f4\u6362\u3002\n# \u2013pod-network-cidr             \u6307\u5b9a Pod \u7f51\u7edc\u7684\u8303\u56f4\u3002Kubernetes \u652f\u6301\u591a\u79cd\u7f51\u7edc\u65b9\u6848\uff0c\u800c\u4e14\u4e0d\u540c\u7f51\u7edc\u65b9\u6848\u5bf9  \u2013pod-network-cidr\u6709\u81ea\u5df1\u7684\u8981\u6c42\uff0c\u8fd9\u91cc\u8bbe\u7f6e\u4e3a10.244.0.0\/16 \u662f\u56e0\u4e3a\u6211\u4eec\u5c06\u4f7f\u7528 flannel \u7f51\u7edc\u65b9\u6848\uff0c\u5fc5\u987b\u8bbe\u7f6e\u6210\u8fd9\u4e2a CIDR\u3002\n# --control-plane-endpoint     cluster-endpoint \u662f\u6620\u5c04\u5230\u8be5 IP \u7684\u81ea\u5b9a\u4e49 DNS \u540d\u79f0\uff0c\u8fd9\u91cc\u914d\u7f6ehosts\u6620\u5c04\uff1a192.168.0.113   cluster-endpoint\u3002 \u8fd9\u5c06\u5141\u8bb8\u4f60\u5c06 --control-plane-endpoint=cluster-endpoint \u4f20\u9012\u7ed9 kubeadm init\uff0c\u5e76\u5c06\u76f8\u540c\u7684 DNS \u540d\u79f0\u4f20\u9012\u7ed9 kubeadm join\u3002 \u7a0d\u540e\u4f60\u53ef\u4ee5\u4fee\u6539 cluster-endpoint \u4ee5\u6307\u5411\u9ad8\u53ef\u7528\u6027\u65b9\u6848\u4e2d\u7684\u8d1f\u8f7d\u5747\u8861\u5668\u7684\u5730\u5740\u3002<\/code><\/pre>\n<p>\u3010<strong>\u6e29\u99a8\u63d0\u793a<\/strong>\u3011kubeadm \u4e0d\u652f\u6301\u5c06\u6ca1\u6709 &#8211;control-plane-endpoint \u53c2\u6570\u7684\u5355\u4e2a\u63a7\u5236\u5e73\u9762\u96c6\u7fa4\u8f6c\u6362\u4e3a\u9ad8\u53ef\u7528\u6027\u96c6\u7fa4\u3002<\/p>\n<p>\u91cd\u7f6e\u518d\u521d\u59cb\u5316<\/p>\n<pre><code>kubeadm reset\nrm -fr ~\/.kube\/  \/etc\/kubernetes\/* var\/lib\/etcd\/*\nkubeadm init \/\n  --apiserver-advertise-address=192.168.0.113  \/\n  --image-repository registry.aliyuncs.com\/google_containers \/\n  --control-plane-endpoint=cluster-endpoint \/\n  --kubernetes-version v1.24.1 \/\n  --service-cidr=10.1.0.0\/16 \/\n  --pod-network-cidr=10.244.0.0\/16 \/\n  --v=5\n# \u2013image-repository string\uff1a    \u8fd9\u4e2a\u7528\u4e8e\u6307\u5b9a\u4ece\u4ec0\u4e48\u4f4d\u7f6e\u6765\u62c9\u53d6\u955c\u50cf\uff081.13\u7248\u672c\u624d\u6709\u7684\uff09\uff0c\u9ed8\u8ba4\u503c\u662fk8s.gcr.io\uff0c\u6211\u4eec\u5c06\u5176\u6307\u5b9a\u4e3a\u56fd\u5185\u955c\u50cf\u5730\u5740\uff1aregistry.aliyuncs.com\/google_containers\n# \u2013kubernetes-version string\uff1a  \u6307\u5b9akubenets\u7248\u672c\u53f7\uff0c\u9ed8\u8ba4\u503c\u662fstable-1\uff0c\u4f1a\u5bfc\u81f4\u4ecehttps:\/\/dl.k8s.io\/release\/stable-1.txt\u4e0b\u8f7d\u6700\u65b0\u7684\u7248\u672c\u53f7\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06\u5176\u6307\u5b9a\u4e3a\u56fa\u5b9a\u7248\u672c\uff08v1.22.1\uff09\u6765\u8df3\u8fc7\u7f51\u7edc\u8bf7\u6c42\u3002\n# \u2013apiserver-advertise-address  \u6307\u660e\u7528 Master \u7684\u54ea\u4e2a interface \u4e0e Cluster \u7684\u5176\u4ed6\u8282\u70b9\u901a\u4fe1\u3002\u5982\u679c Master \u6709\u591a\u4e2a interface\uff0c\u5efa\u8bae\u660e\u786e\u6307\u5b9a\uff0c\u5982\u679c\u4e0d\u6307\u5b9a\uff0ckubeadm \u4f1a\u81ea\u52a8\u9009\u62e9\u6709\u9ed8\u8ba4\u7f51\u5173\u7684 interface\u3002\u8fd9\u91cc\u7684ip\u4e3amaster\u8282\u70b9ip\uff0c\u8bb0\u5f97\u66f4\u6362\u3002\n# \u2013pod-network-cidr             \u6307\u5b9a Pod \u7f51\u7edc\u7684\u8303\u56f4\u3002Kubernetes \u652f\u6301\u591a\u79cd\u7f51\u7edc\u65b9\u6848\uff0c\u800c\u4e14\u4e0d\u540c\u7f51\u7edc\u65b9\u6848\u5bf9  \u2013pod-network-cidr\u6709\u81ea\u5df1\u7684\u8981\u6c42\uff0c\u8fd9\u91cc\u8bbe\u7f6e\u4e3a10.244.0.0\/16 \u662f\u56e0\u4e3a\u6211\u4eec\u5c06\u4f7f\u7528 flannel \u7f51\u7edc\u65b9\u6848\uff0c\u5fc5\u987b\u8bbe\u7f6e\u6210\u8fd9\u4e2a CIDR\u3002\n# --control-plane-endpoint     cluster-endpoint \u662f\u6620\u5c04\u5230\u8be5 IP \u7684\u81ea\u5b9a\u4e49 DNS \u540d\u79f0\uff0c\u8fd9\u91cc\u914d\u7f6ehosts\u6620\u5c04\uff1a192.168.0.113   cluster-endpoint\u3002 \u8fd9\u5c06\u5141\u8bb8\u4f60\u5c06 --control-plane-endpoint=cluster-endpoint \u4f20\u9012\u7ed9 kubeadm init\uff0c\u5e76\u5c06\u76f8\u540c\u7684 DNS \u540d\u79f0\u4f20\u9012\u7ed9 kubeadm join\u3002 \u7a0d\u540e\u4f60\u53ef\u4ee5\u4fee\u6539 cluster-endpoint \u4ee5\u6307\u5411\u9ad8\u53ef\u7528\u6027\u65b9\u6848\u4e2d\u7684\u8d1f\u8f7d\u5747\u8861\u5668\u7684\u5730\u5740\u3002<\/code><\/pre>\n<p>\u914d\u7f6e\u73af\u5883\u53d8\u91cf<\/p>\n<pre><code>mkdir -p $HOME\/.kube\nsudo cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config\nsudo chown $(id -u):$(id -g) $HOME\/.kube\/config\n\n# \u4e34\u65f6\u751f\u6548\uff08\u9000\u51fa\u5f53\u524d\u7a97\u53e3\u91cd\u8fde\u73af\u5883\u53d8\u91cf\u5931\u6548\uff09\nexport KUBECONFIG=\/etc\/kubernetes\/admin.conf\n# \u6c38\u4e45\u751f\u6548\uff08\u63a8\u8350\uff09\necho &quot;export KUBECONFIG=\/etc\/kubernetes\/admin.conf&quot; &gt;&gt; ~\/.bash_profile\nsource  ~\/.bash_profile<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458870\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u53d1\u73b0\u8282\u70b9\u8fd8\u662f\u6709\u95ee\u9898\uff0c\u67e5\u770b\u65e5\u5fd7 \/var\/log\/messages<\/p>\n<pre><code>&quot;Container\u00a0runtime\u00a0network\u00a0not\u00a0ready&quot;\u00a0networkReady=&quot;NetworkReady=false\u00a0reason:NetworkPluginNotReady\u00a0message:Network\u00a0plugin\u00a0returns\u00a0error:\u00a0cni\u00a0plugin\u00a0not\u00a0initialized&quot;<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458871\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u63a5\u4e0b\u6765\u5c31\u662f\u5b89\u88c5 Pod \u7f51\u7edc\u63d2\u4ef6<\/p>\n<h6>\u5b89\u88c5 Pod \u7f51\u7edc\u63d2\u4ef6\uff08CNI\uff1aContainer Network Interface\uff09(master)<\/h6>\n<p>\u4f60\u5fc5\u987b\u90e8\u7f72\u4e00\u4e2a\u57fa\u4e8e Pod \u7f51\u7edc\u63d2\u4ef6\u7684 \u5bb9\u5668\u7f51\u7edc\u63a5\u53e3 (CNI)\uff0c\u4ee5\u4fbf\u4f60\u7684 Pod \u53ef\u4ee5\u76f8\u4e92\u901a\u4fe1\u3002<\/p>\n<pre><code># \u6700\u597d\u63d0\u524d\u4e0b\u8f7d\u955c\u50cf\uff08\u6240\u6709\u8282\u70b9\uff09\ndocker pull quay.io\/coreos\/flannel:v0.14.0\nkubectl apply -f https:\/\/raw.githubusercontent.com\/coreos\/flannel\/master\/Documentation\/kube-flannel.yml<\/code><\/pre>\n<p>\u5982\u679c\u4e0a\u9762\u5b89\u88c5\u5931\u8d25\uff0c\u5219\u4e0b\u8f7d\u540e\u79bb\u7ebf\u5b89\u88c5<\/p>\n<p>\u518d\u67e5\u770b node \u8282\u70b9\uff0c\u5c31\u5df2\u7ecf\u6b63\u5e38\u4e86<img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458872\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>node \u8282\u70b9\u52a0\u5165 k8s \u96c6\u7fa4<\/h6>\n<p>\u5148\u5b89\u88c5 kubelet<\/p>\n<pre><code>yum\u00a0install\u00a0-y\u00a0kubelet\u00a0kubeadm\u00a0kubectl\u00a0--disableexcludes=kubernetes\n#\u00a0\u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u542f\u5e76\u73b0\u5728\u7acb\u523b\u542f\u52a8\u670d\u52a1\u00a0--now\uff1a\u7acb\u523b\u542f\u52a8\u670d\u52a1\nsystemctl\u00a0enable\u00a0--now\u00a0kubelet\nsystemctl\u00a0status\u00a0kubelet<\/code><\/pre>\n<p>\u5982\u679c\u6ca1\u6709\u4ee4\u724c\uff0c\u53ef\u4ee5\u901a\u8fc7\u5728\u63a7\u5236\u5e73\u9762\u8282\u70b9\u4e0a\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u6765\u83b7\u53d6\u4ee4\u724c\uff1a<\/p>\n<pre><code>kubeadm\u00a0token\u00a0list<\/code><\/pre>\n<p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u4ee4\u724c\u4f1a\u572824\u5c0f\u65f6\u540e\u8fc7\u671f\u3002\u5982\u679c\u8981\u5728\u5f53\u524d\u4ee4\u724c\u8fc7\u671f\u540e\u5c06\u8282\u70b9\u52a0\u5165\u96c6\u7fa4\uff0c \u5219\u53ef\u4ee5\u901a\u8fc7\u5728\u63a7\u5236\u5e73\u9762\u8282\u70b9\u4e0a\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u6765\u521b\u5efa\u65b0\u4ee4\u724c\uff1a<\/p>\n<pre><code>kubeadm\u00a0token\u00a0create\n#\u00a0\u518d\u67e5\u770b\nkubeadm\u00a0token\u00a0list<\/code><\/pre>\n<p>\u5982\u679c\u4f60\u6ca1\u6709 <code>\u2013discovery-token-ca-cert-hash<\/code> \u7684\u503c\uff0c\u5219\u53ef\u4ee5\u901a\u8fc7\u5728\u63a7\u5236\u5e73\u9762\u8282\u70b9\u4e0a\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u94fe\u6765\u83b7\u53d6\u5b83\uff1a<\/p>\n<pre><code>openssl\u00a0x509\u00a0-pubkey\u00a0-in\u00a0\/etc\/kubernetes\/pki\/ca.crt\u00a0|\u00a0openssl\u00a0rsa\u00a0-pubin\u00a0-outform\u00a0der\u00a02&gt;\/dev\/null\u00a0|\u00a0openssl\u00a0dgst\u00a0-sha256\u00a0-hex\u00a0|\u00a0sed\u00a0's\/^.*\u00a0\/\/'<\/code><\/pre>\n<p>\u5982\u679c\u6267\u884c <code>kubeadm init<\/code> \u65f6\u6ca1\u6709\u8bb0\u5f55\u4e0b\u52a0\u5165\u96c6\u7fa4\u7684\u547d\u4ee4\uff0c\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u91cd\u65b0\u521b\u5efa\uff08\u63a8\u8350\uff09\u4e00\u822c\u4e0d\u7528\u4e0a\u9762\u7684\u5206\u522b\u83b7\u53d6 token \u548c ca-cert-hash \u65b9\u5f0f\uff0c\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u4e00\u6c14\u5475\u6210\uff1a<\/p>\n<pre><code>kubeadm\u00a0token\u00a0create\u00a0--print-join-command<\/code><\/pre>\n<p>\u8fd9\u91cc\u9700\u8981\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\uff0c\u518d\u67e5\u770b\u8282\u70b9\u8282\u70b9\u72b6\u6001\uff0c\u56e0\u4e3a\u9700\u8981\u5b89\u88c5 kube-proxy \u548c flannel\u3002<\/p>\n<pre><code>kubectl\u00a0get\u00a0pods\u00a0-A\nkubectl\u00a0get\u00a0nodes<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458873\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>\u914d\u7f6e IPVS<\/h6>\n<p>\u3010\u95ee\u9898\u3011\u96c6\u7fa4\u5185\u65e0\u6cd5 ping \u901a ClusterIP\uff08\u6216 ServiceName\uff09<\/p>\n<p>1\u3001\u52a0\u8f7d ip_vs \u76f8\u5173\u5185\u6838\u6a21\u5757<\/p>\n<pre><code>modprobe\u00a0--\u00a0ip_vs\nmodprobe\u00a0--\u00a0ip_vs_sh\nmodprobe\u00a0--\u00a0ip_vs_rr\nmodprobe\u00a0--\u00a0ip_vs_wrr<\/code><\/pre>\n<p>\u6240\u6709\u8282\u70b9\u9a8c\u8bc1\u5f00\u542f\u4e86 ipvs\uff1a<\/p>\n<pre><code>lsmod\u00a0|grep\u00a0ip_vs<\/code><\/pre>\n<p>2\u3001\u5b89\u88c5 ipvsadm \u5de5\u5177<\/p>\n<pre><code>yum\u00a0install\u00a0ipset\u00a0ipvsadm\u00a0-y<\/code><\/pre>\n<p>3\u3001\u7f16\u8f91 kube-proxy \u914d\u7f6e\u6587\u4ef6\uff0cmode \u4fee\u6539\u6210 ipvs<\/p>\n<pre><code>kubectl\u00a0edit\u00a0\u00a0configmap\u00a0-n\u00a0kube-system\u00a0\u00a0kube-proxy<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458874\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>4\u3001\u91cd\u542f kube-proxy<\/p>\n<pre><code>#\u00a0\u5148\u67e5\u770b\nkubectl\u00a0get\u00a0pod\u00a0-n\u00a0kube-system\u00a0|\u00a0grep\u00a0kube-proxy\n#\u00a0\u518ddelete\u8ba9\u5b83\u81ea\u62c9\u8d77\nkubectl\u00a0get\u00a0pod\u00a0-n\u00a0kube-system\u00a0|\u00a0grep\u00a0kube-proxy\u00a0|awk\u00a0'{system(&quot;kubectl\u00a0delete\u00a0pod\u00a0&quot;$1&quot;\u00a0-n\u00a0kube-system&quot;)}'\n#\u00a0\u518d\u67e5\u770b\nkubectl\u00a0get\u00a0pod\u00a0-n\u00a0kube-system\u00a0|\u00a0grep\u00a0kube-proxy<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458875\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>5\u3001\u67e5\u770b ipvs \u8f6c\u53d1\u89c4\u5219<\/p>\n<pre><code>ipvsadm\u00a0-Ln<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458876\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>\u96c6\u7fa4\u9ad8\u53ef\u7528\u914d\u7f6e<\/h6>\n<p>\u914d\u7f6e\u9ad8\u53ef\u7528\uff08HA\uff09Kubernetes \u96c6\u7fa4\u5b9e\u73b0\u7684<code>\u4e24\u79cd\u65b9\u6848<\/code>\uff1a<\/p>\n<ul>\n<li>\u4f7f\u7528\u5806\u53e0\uff08stacked\uff09\u63a7\u5236\u5e73\u9762\u8282\u70b9\uff0c\u5176\u4e2d etcd \u8282\u70b9\u4e0e\u63a7\u5236\u5e73\u9762\u8282\u70b9\u5171\u5b58\uff08\u672c\u7ae0\u4f7f\u7528\uff09\uff0c\u67b6\u6784\u56fe\u5982\u4e0b\uff1a<\/li>\n<\/ul>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458877\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<ul>\n<li>\u4f7f\u7528\u5916\u90e8 etcd \u8282\u70b9\uff0c\u5176\u4e2d etcd \u5728\u4e0e\u63a7\u5236\u5e73\u9762\u4e0d\u540c\u7684\u8282\u70b9\u4e0a\u8fd0\u884c\uff0c\u67b6\u6784\u56fe\u5982\u4e0b\uff1a<\/li>\n<\/ul>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458878\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u8fd9\u91cc\u65b0\u589e\u4e00\u53f0\u673a\u5668\u4f5c\u4e3a\u53e6\u5916\u4e00\u4e2a master \u8282\u70b9\uff1a192.168.0.116 \u914d\u7f6e\u8ddf\u4e0a\u9762 master \u8282\u70b9\u4e00\u6837\u3002\u53ea\u662f\u4e0d\u9700\u8981\u6700\u540e\u4e00\u6b65\u521d\u59cb\u5316\u4e86\u3002<\/p>\n<p>1\u3001\u4fee\u6539\u4e3b\u673a\u540d\u548c\u914d\u7f6e hosts<\/p>\n<p>\u6240\u6709\u8282\u70b9\u90fd\u7edf\u4e00\u5982\u4e0b\u914d\u7f6e\uff1a<\/p>\n<pre><code>#\u00a0\u5728192.168.0.113\u6267\u884c\nhostnamectl\u00a0set-hostname\u00a0\u00a0k8s-master-168-0-113\n#\u00a0\u5728192.168.0.114\u6267\u884c\nhostnamectl\u00a0set-hostname\u00a0k8s-node1-168-0-114\n#\u00a0\u5728192.168.0.115\u6267\u884c\nhostnamectl\u00a0set-hostname\u00a0k8s-node2-168-0-115\n#\u00a0\u5728192.168.0.116\u6267\u884c\nhostnamectl\u00a0set-hostname\u00a0k8s-master2-168-0-116<\/code><\/pre>\n<p>\u914d\u7f6e hosts<\/p>\n<pre><code>cat\u00a0&gt;&gt;\u00a0\/etc\/hosts&lt;&lt;EOF\n192.168.0.113\u00a0k8s-master-168-0-113\u00a0cluster-endpoint\n192.168.0.114\u00a0k8s-node1-168-0-114\n192.168.0.115\u00a0k8s-node2-168-0-115\n192.168.0.116\u00a0k8s-master2-168-0-116\nEOF<\/code><\/pre>\n<p>2\u3001\u914d\u7f6e ssh \u4e92\u4fe1<\/p>\n<pre><code>#\u00a0\u76f4\u63a5\u4e00\u76f4\u56de\u8f66\u5c31\u884c\nssh-keygen\n\nssh-copy-id\u00a0-i\u00a0~\/.ssh\/id_rsa.pub\u00a0root@k8s-master-168-0-113\nssh-copy-id\u00a0-i\u00a0~\/.ssh\/id_rsa.pub\u00a0root@k8s-node1-168-0-114\nssh-copy-id\u00a0-i\u00a0~\/.ssh\/id_rsa.pub\u00a0root@k8s-node2-168-0-115\nssh-copy-id\u00a0-i\u00a0~\/.ssh\/id_rsa.pub\u00a0root@k8s-master2-168-0-116<\/code><\/pre>\n<p>3\u3001\u65f6\u95f4\u540c\u6b65<\/p>\n<pre><code>yum\u00a0install\u00a0chrony\u00a0-y\nsystemctl\u00a0start\u00a0chronyd\nsystemctl\u00a0enable\u00a0chronyd\nchronyc\u00a0sources<\/code><\/pre>\n<p>4\u3001\u5173\u95ed\u9632\u706b\u5899<\/p>\n<pre><code>systemctl\u00a0stop\u00a0firewalld\nsystemctl\u00a0disable\u00a0firewalld<\/code><\/pre>\n<p>5\u3001\u5173\u95ed swap<\/p>\n<pre><code># \u4e34\u65f6\u5173\u95ed\uff1b\u5173\u95edswap\u4e3b\u8981\u662f\u4e3a\u4e86\u6027\u80fd\u8003\u8651\nswapoff -a\n# \u53ef\u4ee5\u901a\u8fc7\u8fd9\u4e2a\u547d\u4ee4\u67e5\u770bswap\u662f\u5426\u5173\u95ed\u4e86\nfree\n# \u6c38\u4e45\u5173\u95ed\nsed -ri 's\/.*swap.*\/#&amp;\/' \/etc\/fstab<\/code><\/pre>\n<p>6\u3001\u7981\u7528 SELinux<\/p>\n<pre><code># \u4e34\u65f6\u5173\u95ed\nsetenforce 0\n# \u6c38\u4e45\u7981\u7528\nsed -i 's\/^SELINUX=enforcing$\/SELINUX=disabled\/' \/etc\/selinux\/config<\/code><\/pre>\n<p>7\u3001\u5141\u8bb8 iptables \u68c0\u67e5\u6865\u63a5\u6d41\u91cf\uff08\u53ef\u9009\uff0c\u6240\u6709\u8282\u70b9\uff09<\/p>\n<p>\u82e5\u8981\u663e\u5f0f\u52a0\u8f7d\u6b64\u6a21\u5757\uff0c\u8bf7\u8fd0\u884c <code>sudo modprobe br_netfilter<\/code>\uff0c\u901a\u8fc7\u8fd0\u884c <code>lsmod | grep br_netfilter<\/code> \u6765\u9a8c\u8bc1 br_netfilter \u6a21\u5757\u662f\u5426\u5df2\u52a0\u8f7d\uff0c<\/p>\n<pre><code>sudo\u00a0modprobe\u00a0br_netfilter\nlsmod\u00a0|\u00a0grep\u00a0br_netfilter<\/code><\/pre>\n<p>\u4e3a\u4e86\u8ba9 Linux \u8282\u70b9\u7684 iptables \u80fd\u591f\u6b63\u786e\u67e5\u770b\u6865\u63a5\u6d41\u91cf\uff0c\u8bf7\u786e\u8ba4 sysctl \u914d\u7f6e\u4e2d\u7684 <code>net.bridge.bridge-nf-call-iptables<\/code> \u8bbe\u7f6e\u4e3a<code>1<\/code>\u3002\u4f8b\u5982\uff1a<\/p>\n<pre><code>cat &lt;&lt;EOF | sudo tee \/etc\/modules-load.d\/k8s.conf\noverlay\nbr_netfilter\nEOF\n\nsudo modprobe overlay\nsudo modprobe br_netfilter\n\n# \u8bbe\u7f6e\u6240\u9700\u7684 sysctl \u53c2\u6570\uff0c\u53c2\u6570\u5728\u91cd\u65b0\u542f\u52a8\u540e\u4fdd\u6301\u4e0d\u53d8\ncat &lt;&lt;EOF | sudo tee \/etc\/sysctl.d\/k8s.conf\nnet.bridge.bridge-nf-call-iptables  = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.ipv4.ip_forward                 = 1\nEOF\n\n# \u5e94\u7528 sysctl \u53c2\u6570\u800c\u4e0d\u91cd\u65b0\u542f\u52a8\nsudo sysctl --system<\/code><\/pre>\n<p>8\u3001\u5b89\u88c5\u5bb9\u5668 docker\uff08\u6240\u6709\u8282\u70b9\uff09<\/p>\n<p>\u63d0\u793a\uff1av1.24 \u4e4b\u524d\u7684 Kubernetes \u7248\u672c\u5305\u62ec\u4e0e Docker Engine \u7684\u76f4\u63a5\u96c6\u6210\uff0c\u4f7f\u7528\u540d\u4e3a dockershim \u7684\u7ec4\u4ef6\u3002\u8fd9\u79cd\u7279\u6b8a\u7684\u76f4\u63a5\u6574\u5408\u4e0d\u518d\u662f Kubernetes \u7684\u4e00\u90e8\u5206 \uff08\u8fd9\u6b21\u5220\u9664\u88ab\u4f5c\u4e3a v1.20 \u53d1\u884c\u7248\u672c\u7684\u4e00\u90e8\u5206\u5ba3\u5e03\uff09\u3002\u4f60\u53ef\u4ee5\u9605\u8bfb\u68c0\u67e5 Dockershim \u5f03\u7528\u662f\u5426\u4f1a\u5f71\u54cd\u4f60 \u4ee5\u4e86\u89e3\u6b64\u5220\u9664\u53ef\u80fd\u4f1a\u5982\u4f55\u5f71\u54cd\u4f60\u3002\u8981\u4e86\u89e3\u5982\u4f55\u4f7f\u7528 dockershim \u8fdb\u884c\u8fc1\u79fb\uff0c\u8bf7\u53c2\u9605\u4ece dockershim \u8fc1\u79fb\u3002<\/p>\n<pre><code># \u914d\u7f6eyum\u6e90\ncd \/etc\/yum.repos.d ; mkdir bak; mv CentOS-Linux-* bak\/\n# centos7\nwget -O \/etc\/yum.repos.d\/CentOS-Base.repo http:\/\/mirrors.aliyun.com\/repo\/Centos-7.repo\n# centos8\nwget -O \/etc\/yum.repos.d\/CentOS-Base.repo http:\/\/mirrors.aliyun.com\/repo\/Centos-8.repo\n\n# \u5b89\u88c5yum-config-manager\u914d\u7f6e\u5de5\u5177\nyum -y install yum-utils\n# \u8bbe\u7f6eyum\u6e90\nyum-config-manager --add-repo http:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/docker-ce.repo\n# \u5b89\u88c5docker-ce\u7248\u672c\nyum install -y docker-ce\n# \u542f\u52a8\nsystemctl start docker\n# \u5f00\u673a\u81ea\u542f\nsystemctl enable docker\n# \u67e5\u770b\u7248\u672c\u53f7\ndocker --version\n# \u67e5\u770b\u7248\u672c\u5177\u4f53\u4fe1\u606f\ndocker version\n\n# Docker\u955c\u50cf\u6e90\u8bbe\u7f6e\n# \u4fee\u6539\u6587\u4ef6 \/etc\/docker\/daemon.json\uff0c\u6ca1\u6709\u8fd9\u4e2a\u6587\u4ef6\u5c31\u521b\u5efa\n# \u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u540e\uff0c\u91cd\u542fdocker\u670d\u52a1\uff1a\ncat &gt;\/etc\/docker\/daemon.json&lt;&lt;EOF\n{\n   &quot;registry-mirrors&quot;: [&quot;http:\/\/hub-mirror.c.163.com&quot;]\n}\nEOF\n# \u52a0\u8f7d\nsystemctl reload docker\n\n# \u67e5\u770b\nsystemctl status docker containerd<\/code><\/pre>\n<p>\u3010<strong>\u6e29\u99a8\u63d0\u793a<\/strong>\u3011dockerd \u5b9e\u9645\u771f\u5b9e\u8c03\u7528\u7684\u8fd8\u662f containerd \u7684 api \u63a5\u53e3\uff0ccontainerd \u662f dockerd \u548c runC \u4e4b\u95f4\u7684\u4e00\u4e2a\u4e2d\u95f4\u4ea4\u6d41\u7ec4\u4ef6\u3002\u6240\u4ee5\u542f\u52a8 docker \u670d\u52a1\u7684\u65f6\u5019\uff0c\u4e5f\u4f1a\u542f\u52a8 containerd \u670d\u52a1\u7684\u3002<\/p>\n<p>9\u3001\u914d\u7f6e k8s yum \u6e90\uff08\u6240\u6709\u8282\u70b9\uff09<\/p>\n<pre><code>cat &gt; \/etc\/yum.repos.d\/kubernetes.repo &lt;&lt; EOF\n[k8s]\nname=k8s\nenabled=1\ngpgcheck=0\nbaseurl=https:\/\/mirrors.aliyun.com\/kubernetes\/yum\/repos\/kubernetes-el7-x86_64\/\nEOF<\/code><\/pre>\n<p>10\u3001\u5c06 sandbox_image \u955c\u50cf\u6e90\u8bbe\u7f6e\u4e3a\u963f\u91cc\u4e91 google_containers \u955c\u50cf\u6e90\uff08\u6240\u6709\u8282\u70b9\uff09<\/p>\n<pre><code># \u5bfc\u51fa\u9ed8\u8ba4\u914d\u7f6e\uff0cconfig.toml\u8fd9\u4e2a\u6587\u4ef6\u9ed8\u8ba4\u662f\u4e0d\u5b58\u5728\u7684\ncontainerd config default &gt; \/etc\/containerd\/config.toml\ngrep sandbox_image  \/etc\/containerd\/config.toml\nsed -i &quot;s#k8s.gcr.io\/pause#registry.aliyuncs.com\/google_containers\/pause#g&quot;       \/etc\/containerd\/config.toml\ngrep sandbox_image  \/etc\/containerd\/config.toml<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458879\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>11\u3001\u914d\u7f6e containerd cgroup \u9a71\u52a8\u7a0b\u5e8f systemd<\/p>\n<p>kubernets \u81ea\uff56 1.24.0 \u540e\uff0c\u5c31\u4e0d\u518d\u4f7f\u7528 docker.shim\uff0c\u66ff\u6362\u91c7\u7528 containerd \u4f5c\u4e3a\u5bb9\u5668\u8fd0\u884c\u65f6\u7aef\u70b9\u3002\u56e0\u6b64\u9700\u8981\u5b89\u88c5 containerd\uff08\u5728 docker \u7684\u57fa\u7840\u4e0b\u5b89\u88c5\uff09\uff0c\u4e0a\u9762\u5b89\u88c5 docker \u7684\u65f6\u5019\u5c31\u81ea\u52a8\u5b89\u88c5\u4e86 containerd \u4e86\u3002\u8fd9\u91cc\u7684 docker \u53ea\u662f\u4f5c\u4e3a\u5ba2\u6237\u7aef\u800c\u5df2\u3002\u5bb9\u5668\u5f15\u64ce\u8fd8\u662f containerd\u3002<\/p>\n<pre><code>sed -i 's#SystemdCgroup = false#SystemdCgroup = true#g' \/etc\/containerd\/config.toml\n# \u5e94\u7528\u6240\u6709\u66f4\u6539\u540e,\u91cd\u65b0\u542f\u52a8containerd\nsystemctl restart containerd\n11\u3001\u5f00\u59cb\u5b89\u88c5 kubeadm\uff0ckubelet \u548c kubectl\uff08master \u8282\u70b9\uff09\n# \u4e0d\u6307\u5b9a\u7248\u672c\u5c31\u662f\u6700\u65b0\u7248\u672c\uff0c\u5f53\u524d\u6700\u65b0\u7248\u5c31\u662f1.24.1\nyum install -y kubelet-1.24.1  kubeadm-1.24.1  kubectl-1.24.1 --disableexcludes=kubernetes\n# disableexcludes=kubernetes\uff1a\u7981\u6389\u9664\u4e86\u8fd9\u4e2akubernetes\u4e4b\u5916\u7684\u522b\u7684\u4ed3\u5e93\n# \u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u542f\u5e76\u73b0\u5728\u7acb\u523b\u542f\u52a8\u670d\u52a1 --now\uff1a\u7acb\u523b\u542f\u52a8\u670d\u52a1\nsystemctl enable --now kubelet\n\n# \u67e5\u770b\u72b6\u6001\uff0c\u8fd9\u91cc\u9700\u8981\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\u518d\u67e5\u770b\u670d\u52a1\u72b6\u6001\uff0c\u542f\u52a8\u4f1a\u6709\u70b9\u6162\nsystemctl status kubelet\n\n# \u67e5\u770b\u7248\u672c\n\nkubectl version\nyum info kubeadm<\/code><\/pre>\n<p>12\u3001\u52a0\u5165 k8s \u96c6\u7fa4<\/p>\n<pre><code># \u8bc1\u5982\u679c\u8fc7\u671f\u4e86\uff0c\u53ef\u4ee5\u4f7f\u7528\u4e0b\u9762\u547d\u4ee4\u751f\u6210\u65b0\u8bc1\u4e66\u4e0a\u4f20\uff0c\u8fd9\u91cc\u4f1a\u6253\u5370\u51facertificate key\uff0c\u540e\u9762\u4f1a\u7528\u5230\nkubeadm init phase upload-certs --upload-certs\n# \u4f60\u8fd8\u53ef\u4ee5\u5728 \u3010init\u3011\u671f\u95f4\u6307\u5b9a\u81ea\u5b9a\u4e49\u7684 --certificate-key\uff0c\u4ee5\u540e\u53ef\u4ee5\u7531 join \u4f7f\u7528\u3002 \u8981\u751f\u6210\u8fd9\u6837\u7684\u5bc6\u94a5\uff0c\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\uff08\u8fd9\u91cc\u4e0d\u6267\u884c\uff0c\u5c31\u7528\u4e0a\u9762\u90a3\u4e2a\u81ea\u547d\u4ee4\u5c31\u53ef\u4ee5\u4e86\uff09\uff1a\nkubeadm certs certificate-key\n\nkubeadm token create --print-join-command\n\nkubeadm join cluster-endpoint:6443 --token wswrfw.fc81au4yvy6ovmhh --discovery-token-ca-cert-hash sha256:43a3924c25104d4393462105639f6a02b8ce284728775ef9f9c30eed8e0abc0f --control-plane --certificate-key 8d2709697403b74e35d05a420bd2c19fd8c11914eb45f2ff22937b245bed5b68\n\n# --control-plane \u6807\u5fd7\u901a\u77e5 kubeadm join \u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u63a7\u5236\u5e73\u9762\u3002\u52a0\u5165master\u5fc5\u987b\u52a0\u8fd9\u4e2a\u6807\u8bb0\n# --certificate-key ... \u5c06\u5bfc\u81f4\u4ece\u96c6\u7fa4\u4e2d\u7684 kubeadm-certs Secret \u4e0b\u8f7d\u63a7\u5236\u5e73\u9762\u8bc1\u4e66\u5e76\u4f7f\u7528\u7ed9\u5b9a\u7684\u5bc6\u94a5\u8fdb\u884c\u89e3\u5bc6\u3002\u8fd9\u91cc\u7684\u503c\u5c31\u662f\u4e0a\u9762\u8fd9\u4e2a\u547d\u4ee4\uff08kubeadm init phase upload-certs --upload-certs\uff09\u6253\u5370\u51fa\u7684key\u3002<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458880\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u6839\u636e\u63d0\u793a\u6267\u884c\u5982\u4e0b\u547d\u4ee4\uff1a<\/p>\n<pre><code>mkdir -p $HOME\/.kube\nsudo cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config\nsudo chown $(id -u):$(id -g) $HOME\/.kube\/config<\/code><\/pre>\n<p>\u67e5\u770b<\/p>\n<pre><code>kubectl\u00a0get\u00a0nodes\nkubectl\u00a0get\u00a0pods\u00a0-A\u00a0-owide<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458881\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u867d\u7136\u73b0\u5728\u5df2\u7ecf\u6709\u4e24\u4e2a master \u4e86\uff0c\u4f46\u662f\u5bf9\u5916\u8fd8\u662f\u53ea\u80fd\u6709\u4e00\u4e2a\u5165\u53e3\u7684\uff0c\u6240\u4ee5\u8fd8\u5f97\u8981\u4e00\u4e2a\u8d1f\u8f7d\u5747\u8861\u5668\uff0c\u5982\u679c\u4e00\u4e2a master \u6302\u4e86\uff0c\u4f1a\u81ea\u52a8\u5207\u5230\u53e6\u5916\u4e00\u4e2a master \u8282\u70b9\u3002<\/p>\n<h6>\u90e8\u7f72 Nginx+Keepalived \u9ad8\u53ef\u7528\u8d1f\u8f7d\u5747\u8861\u5668<\/h6>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458882\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>1\u3001\u5b89\u88c5 Nginx \u548c Keepalived<\/p>\n<pre><code>#\u00a0\u5728\u4e24\u4e2amaster\u8282\u70b9\u4e0a\u6267\u884c\nyum\u00a0install\u00a0nginx\u00a0keepalived\u00a0-y<\/code><\/pre>\n<p>2\u3001Nginx \u914d\u7f6e<\/p>\n<p>\u5728\u4e24\u4e2a master \u8282\u70b9\u914d\u7f6e<\/p>\n<pre><code>cat &gt; \/etc\/nginx\/nginx.conf &lt;&lt; &quot;EOF&quot;\nuser nginx;\nworker_processes auto;\nerror_log \/var\/log\/nginx\/error.log;\npid \/run\/nginx.pid;\ninclude \/usr\/share\/nginx\/modules\/*.conf;\nevents {\n    worker_connections 1024;\n}\n# \u56db\u5c42\u8d1f\u8f7d\u5747\u8861\uff0c\u4e3a\u4e24\u53f0Master apiserver\u7ec4\u4ef6\u63d0\u4f9b\u8d1f\u8f7d\u5747\u8861\nstream {\n    log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';\n    access_log  \/var\/log\/nginx\/k8s-access.log  main;\n    upstream k8s-apiserver {\n    # Master APISERVER IP:PORT\n       server 192.168.0.113:6443;\n    # Master2 APISERVER IP:PORT\n       server 192.168.0.116:6443;\n    }\n    server {\n       listen 16443;\n       proxy_pass k8s-apiserver;\n    }\n}\n\nhttp {\n    log_format  main  '$remote_addr - $remote_user [$time_local] &quot;$request&quot; '\n                      '$status $body_bytes_sent &quot;$http_referer&quot; '\n                      '&quot;$http_user_agent&quot; &quot;$http_x_forwarded_for&quot;';\n    access_log  \/var\/log\/nginx\/access.log  main;\n    sendfile            on;\n    tcp_nopush          on;\n    tcp_nodelay         on;\n    keepalive_timeout   65;\n    types_hash_max_size 2048;\n    include             \/etc\/nginx\/mime.types;\n    default_type        application\/octet-stream;\n    server {\n        listen       80 default_server;\n        server_name  _;\n\n        location \/ {\n        }\n    }\n}\nEOF<\/code><\/pre>\n<p>\u3010<strong>\u6e29\u99a8\u63d0\u793a<\/strong>\u3011\u5982\u679c\u53ea\u4fdd\u8bc1\u9ad8\u53ef\u7528\uff0c\u4e0d\u914d\u7f6e k8s-apiserver \u8d1f\u8f7d\u5747\u8861\u7684\u8bdd\uff0c\u53ef\u4ee5\u4e0d\u88c5 nginx\uff0c\u4f46\u662f\u6700\u597d\u8fd8\u662f\u914d\u7f6e\u4e00\u4e0b k8s-apiserver \u8d1f\u8f7d\u5747\u8861\u3002<\/p>\n<p>3\u3001Keepalived \u914d\u7f6e\uff08master\uff09<\/p>\n<pre><code>cat &gt; \/etc\/keepalived\/keepalived.conf &lt;&lt; EOF\nglobal_defs {\n   notification_email {\n     acassen@firewall.loc\n     failover@firewall.loc\n     sysadmin@firewall.loc\n   }\n   notification_email_from fage@qq.com\n   smtp_server 127.0.0.1\n   smtp_connect_timeout 30\n   router_id NGINX_MASTER\n}\nvrrp_script check_nginx {\n    script &quot;\/etc\/keepalived\/check_nginx.sh&quot;\n}\nvrrp_instance VI_1 {\n    state MASTER\n    interface ens33\n    virtual_router_id 51 # VRRP \u8def\u7531 ID\u5b9e\u4f8b\uff0c\u6bcf\u4e2a\u5b9e\u4f8b\u662f\u552f\u4e00\u7684\n    priority 100    # \u4f18\u5148\u7ea7\uff0c\u5907\u670d\u52a1\u5668\u8bbe\u7f6e 90\n    advert_int 1    # \u6307\u5b9aVRRP \u5fc3\u8df3\u5305\u901a\u544a\u95f4\u9694\u65f6\u95f4\uff0c\u9ed8\u8ba41\u79d2\n    authentication {\n        auth_type PASS\n        auth_pass 1111\n    }\n    # \u865a\u62dfIP\n    virtual_ipaddress {\n        192.168.0.120\/24\n    }\n    track_script {\n        check_nginx\n    }\n}\nEOF<\/code><\/pre>\n<p>vrrp_script\uff1a\u6307\u5b9a\u68c0\u67e5 nginx \u5de5\u4f5c\u72b6\u6001\u811a\u672c\uff08\u6839\u636e nginx \u72b6\u6001\u5224\u65ad\u662f\u5426\u6545\u969c\u8f6c\u79fb\uff09 virtual_ipaddress\uff1a\u865a\u62df IP\uff08VIP\uff09<\/p>\n<p>\u68c0\u67e5 nginx \u72b6\u6001\u811a\u672c\uff1a<\/p>\n<pre><code>cat &gt; \/etc\/keepalived\/check_nginx.sh  &lt;&lt; &quot;EOF&quot;\n#!\/bin\/bash\ncount=$(ps -ef |grep nginx |egrep -cv &quot;grep|$$&quot;)\n\nif [ &quot;$count&quot; -eq 0 ];then\n    exit 1\nelse\n    exit 0\nfi\nEOF<\/code><\/pre>\n<pre><code>chmod\u00a0+x\u00a0\/etc\/keepalived\/check_nginx.sh<\/code><\/pre>\n<p>4\u3001Keepalived \u914d\u7f6e\uff08backup\uff09<\/p>\n<pre><code>cat &gt; \/etc\/keepalived\/keepalived.conf &lt;&lt; EOF\nglobal_defs {\n   notification_email {\n     acassen@firewall.loc\n     failover@firewall.loc\n     sysadmin@firewall.loc\n   }\n   notification_email_from fage@qq.com\n   smtp_server 127.0.0.1\n   smtp_connect_timeout 30\n   router_id NGINX_BACKUP\n}\nvrrp_script check_nginx {\n    script &quot;\/etc\/keepalived\/check_nginx.sh&quot;\n}\nvrrp_instance VI_1 {\n    state BACKUP\n    interface ens33\n    virtual_router_id 51 # VRRP \u8def\u7531 ID\u5b9e\u4f8b\uff0c\u6bcf\u4e2a\u5b9e\u4f8b\u662f\u552f\u4e00\u7684\n    priority 90\n    advert_int 1\n    authentication {\n        auth_type PASS\n        auth_pass 1111\n    }\n    virtual_ipaddress {\n        192.168.0.120\/24\n    }\n    track_script {\n        check_nginx\n    }\n}\nEOF<\/code><\/pre>\n<p>\u68c0\u67e5 nginx \u72b6\u6001\u811a\u672c\uff1a<\/p>\n<pre><code>cat &gt; \/etc\/keepalived\/check_nginx.sh  &lt;&lt; &quot;EOF&quot;\n#!\/bin\/bash\ncount=$(ps -ef |grep nginx |egrep -cv &quot;grep|$$&quot;)\n\nif [ &quot;$count&quot; -eq 0 ];then\n    exit 1\nelse\n    exit 0\nfi\nEOF<\/code><\/pre>\n<pre><code>chmod\u00a0+x\u00a0\/etc\/keepalived\/check_nginx.sh<\/code><\/pre>\n<p>5\u3001\u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u542f\u52a8<\/p>\n<pre><code>systemctl\u00a0daemon-reload\nsystemctl\u00a0restart\u00a0nginx\u00a0&amp;&amp;\u00a0systemctl\u00a0enable\u00a0nginx\u00a0&amp;&amp;\u00a0systemctl\u00a0status\u00a0nginx\nsystemctl\u00a0restart\u00a0keepalived\u00a0&amp;&amp;\u00a0systemctl\u00a0enable\u00a0keepalived\u00a0&amp;&amp;\u00a0systemctl\u00a0status\u00a0keepalived<\/code><\/pre>\n<p>\u67e5\u770b VIP<\/p>\n<pre><code>ip\u00a0a<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458883\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>6\u3001\u4fee\u6539 hosts\uff08\u6240\u6709\u8282\u70b9\uff09<\/p>\n<p>\u5c06 cluster-endpoint \u4e4b\u524d\u6267\u884c\u7684 ip \u4fee\u6539\u6267\u884c\u73b0\u5728\u7684 VIP<\/p>\n<pre><code>192.168.0.113 k8s-master-168-0-113\n192.168.0.114 k8s-node1-168-0-114\n192.168.0.115 k8s-node2-168-0-115\n192.168.0.116 k8s-master2-168-0-116\n192.168.0.120 cluster-endpoint<\/code><\/pre>\n<p>7\u3001\u6d4b\u8bd5\u9a8c\u8bc1<\/p>\n<p>\u67e5\u770b\u7248\u672c\uff08\u8d1f\u8f7d\u5747\u8861\u6d4b\u8bd5\u9a8c\u8bc1\uff09<\/p>\n<pre><code>curl\u00a0-k\u00a0https:\/\/cluster-endpoint:16443\/version<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458884\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u9ad8\u53ef\u7528\u6d4b\u8bd5\u9a8c\u8bc1\uff0c\u5c06 k8s-master-168-0-113 \u8282\u70b9\u5173\u673a<\/p>\n<pre><code>shutdown -h now\ncurl -k https:\/\/cluster-endpoint:16443\/version\nkubectl get nodes -A\nkubectl get pods -A<\/code><\/pre>\n<p>\u3010<strong>\u6e29\u99a8\u63d0\u793a<\/strong>\u3011\u5806\u53e0\u96c6\u7fa4\u5b58\u5728\u8026\u5408\u5931\u8d25\u7684\u98ce\u9669\u3002\u5982\u679c\u4e00\u4e2a\u8282\u70b9\u53d1\u751f\u6545\u969c\uff0c\u5219 etcd \u6210\u5458\u548c\u63a7\u5236\u5e73\u9762\u5b9e\u4f8b\u90fd\u5c06\u4e22\u5931\uff0c \u5e76\u4e14\u5197\u4f59\u4f1a\u53d7\u5230\u5f71\u54cd\u3002\u4f60\u53ef\u4ee5\u901a\u8fc7\u6dfb\u52a0\u66f4\u591a\u63a7\u5236\u5e73\u9762\u8282\u70b9\u6765\u964d\u4f4e\u6b64\u98ce\u9669\u3002<\/p>\n<h2>k8s \u7ba1\u7406\u5e73\u53f0 dashboard \u73af\u5883\u90e8\u7f72<\/h2>\n<h6>dashboard \u90e8\u7f72<\/h6>\n<p>GitHub \u5730\u5740\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=2fMe09sQd9OViLa4XIsa0A%3D%3D.RhYRbjL8RQa3ud5J%2BXhNG6uAPOpkS9j1ObgygBitDKmd6Cz3VO7elWYNglLwpdGZ\" rel=\"nofollow\">https:\/\/github.com\/kubernetes&#8230;<\/a><\/p>\n<pre><code>kubectl\u00a0apply\u00a0-f\u00a0https:\/\/raw.githubusercontent.com\/kubernetes\/dashboard\/v2.6.0\/aio\/deploy\/recommended.yaml\nkubectl\u00a0get\u00a0pods\u00a0-n\u00a0kubernetes-dashboard<\/code><\/pre>\n<p>\u4f46\u662f\u8fd9\u4e2a\u53ea\u80fd\u5185\u90e8\u8bbf\u95ee\uff0c\u6240\u4ee5\u8981\u5916\u90e8\u8bbf\u95ee\uff0c\u8981\u4e48\u90e8\u7f72 ingress\uff0c\u8981\u4e48\u5c31\u662f\u8bbe\u7f6e service NodePort \u7c7b\u578b\u3002\u8fd9\u91cc\u9009\u62e9 service \u66b4\u9732\u7aef\u53e3\u3002<\/p>\n<pre><code>wget\u00a0https:\/\/raw.githubusercontent.com\/kubernetes\/dashboard\/v2.6.0\/aio\/deploy\/recommended.yaml<\/code><\/pre>\n<p>\u4fee\u6539\u540e\u7684\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n<pre><code># Copyright 2017 The Kubernetes Authors.\n#\n# Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#     http:\/\/www.apache.org\/licenses\/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an &quot;AS IS&quot; BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kubernetes-dashboard\n\n---\n\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\n\n---\n\nkind: Service\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nspec:\n  type: NodePort\n  ports:\n    - port: 443\n      targetPort: 8443\n      nodePort: 31443\n  selector:\n    k8s-app: kubernetes-dashboard\n\n---\n\napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-certs\n  namespace: kubernetes-dashboard\ntype: Opaque\n\n---\n\napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-csrf\n  namespace: kubernetes-dashboard\ntype: Opaque\ndata:\n  csrf: &quot;&quot;\n\n---\n\napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-key-holder\n  namespace: kubernetes-dashboard\ntype: Opaque\n\n---\n\nkind: ConfigMap\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-settings\n  namespace: kubernetes-dashboard\n\n---\n\nkind: Role\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nrules:\n  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.\n  - apiGroups: [&quot;&quot;]\n    resources: [&quot;secrets&quot;]\n    resourceNames: [&quot;kubernetes-dashboard-key-holder&quot;, &quot;kubernetes-dashboard-certs&quot;, &quot;kubernetes-dashboard-csrf&quot;]\n    verbs: [&quot;get&quot;, &quot;update&quot;, &quot;delete&quot;]\n    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.\n  - apiGroups: [&quot;&quot;]\n    resources: [&quot;configmaps&quot;]\n    resourceNames: [&quot;kubernetes-dashboard-settings&quot;]\n    verbs: [&quot;get&quot;, &quot;update&quot;]\n    # Allow Dashboard to get metrics.\n  - apiGroups: [&quot;&quot;]\n    resources: [&quot;services&quot;]\n    resourceNames: [&quot;heapster&quot;, &quot;dashboard-metrics-scraper&quot;]\n    verbs: [&quot;proxy&quot;]\n  - apiGroups: [&quot;&quot;]\n    resources: [&quot;services\/proxy&quot;]\n    resourceNames: [&quot;heapster&quot;, &quot;http:heapster:&quot;, &quot;https:heapster:&quot;, &quot;dashboard-metrics-scraper&quot;, &quot;http:dashboard-metrics-scraper&quot;]\n    verbs: [&quot;get&quot;]\n\n---\n\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\nrules:\n  # Allow Metrics Scraper to get metrics from the Metrics server\n  - apiGroups: [&quot;metrics.k8s.io&quot;]\n    resources: [&quot;pods&quot;, &quot;nodes&quot;]\n    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]\n\n---\n\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: kubernetes-dashboard\nsubjects:\n  - kind: ServiceAccount\n    name: kubernetes-dashboard\n    namespace: kubernetes-dashboard\n\n---\n\napiVersion: rbac.authorization.k8s.io\/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: kubernetes-dashboard\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: kubernetes-dashboard\nsubjects:\n  - kind: ServiceAccount\n    name: kubernetes-dashboard\n    namespace: kubernetes-dashboard\n\n---\n\nkind: Deployment\napiVersion: apps\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nspec:\n  replicas: 1\n  revisionHistoryLimit: 10\n  selector:\n    matchLabels:\n      k8s-app: kubernetes-dashboard\n  template:\n    metadata:\n      labels:\n        k8s-app: kubernetes-dashboard\n    spec:\n      securityContext:\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: kubernetes-dashboard\n          image: kubernetesui\/dashboard:v2.6.0\n          imagePullPolicy: Always\n          ports:\n            - containerPort: 8443\n              protocol: TCP\n          args:\n            - --auto-generate-certificates\n            - --namespace=kubernetes-dashboard\n            # Uncomment the following line to manually specify Kubernetes API server Host\n            # If not specified, Dashboard will attempt to auto discover the API server and connect\n            # to it. Uncomment only if the default does not work.\n            # - --apiserver-host=http:\/\/my-address:port\n          volumeMounts:\n            - name: kubernetes-dashboard-certs\n              mountPath: \/certs\n              # Create on-disk volume to store exec logs\n            - mountPath: \/tmp\n              name: tmp-volume\n          livenessProbe:\n            httpGet:\n              scheme: HTTPS\n              path: \/\n              port: 8443\n            initialDelaySeconds: 30\n            timeoutSeconds: 30\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            runAsUser: 1001\n            runAsGroup: 2001\n      volumes:\n        - name: kubernetes-dashboard-certs\n          secret:\n            secretName: kubernetes-dashboard-certs\n        - name: tmp-volume\n          emptyDir: {}\n      serviceAccountName: kubernetes-dashboard\n      nodeSelector:\n        &quot;kubernetes.io\/os&quot;: linux\n      # Comment the following tolerations if Dashboard must not be deployed on master\n      tolerations:\n        - key: node-role.kubernetes.io\/master\n          effect: NoSchedule\n\n---\n\nkind: Service\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: dashboard-metrics-scraper\n  name: dashboard-metrics-scraper\n  namespace: kubernetes-dashboard\nspec:\n  ports:\n    - port: 8000\n      targetPort: 8000\n  selector:\n    k8s-app: dashboard-metrics-scraper\n\n---\n\nkind: Deployment\napiVersion: apps\/v1\nmetadata:\n  labels:\n    k8s-app: dashboard-metrics-scraper\n  name: dashboard-metrics-scraper\n  namespace: kubernetes-dashboard\nspec:\n  replicas: 1\n  revisionHistoryLimit: 10\n  selector:\n    matchLabels:\n      k8s-app: dashboard-metrics-scraper\n  template:\n    metadata:\n      labels:\n        k8s-app: dashboard-metrics-scraper\n    spec:\n      securityContext:\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: dashboard-metrics-scraper\n          image: kubernetesui\/metrics-scraper:v1.0.8\n          ports:\n            - containerPort: 8000\n              protocol: TCP\n          livenessProbe:\n            httpGet:\n              scheme: HTTP\n              path: \/\n              port: 8000\n            initialDelaySeconds: 30\n            timeoutSeconds: 30\n          volumeMounts:\n          - mountPath: \/tmp\n            name: tmp-volume\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            runAsUser: 1001\n            runAsGroup: 2001\n      serviceAccountName: kubernetes-dashboard\n      nodeSelector:\n        &quot;kubernetes.io\/os&quot;: linux\n      # Comment the following tolerations if Dashboard must not be deployed on master\n      tolerations:\n        - key: node-role.kubernetes.io\/master\n          effect: NoSchedule\n      volumes:\n        - name: tmp-volume\n          emptyDir: {}<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458885\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u91cd\u65b0\u90e8\u7f72<\/p>\n<pre><code>kubectl delete -f recommended.yaml\nkubectl apply -f recommended.yaml\nkubectl get svc,pods -n kubernetes-dashboard<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458886\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>\u521b\u5efa\u767b\u5f55\u7528\u6237<\/h6>\n<pre><code>cat\u00a0&gt;ServiceAccount.yaml&lt;&lt;EOFapiVersion:\u00a0v1kind:\u00a0ServiceAccountmetadata:cat &gt;ServiceAccount.yaml&lt;&lt;EOF\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: admin-user\n  namespace: kubernetes-dashboard\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: admin-user\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n  name: admin-user\n  namespace: kubernetes-dashboard\nEOF\nkubectl apply -f ServiceAccount.yaml<\/code><\/pre>\n<p>\u521b\u5efa\u5e76\u83b7\u53d6\u767b\u5f55 token<\/p>\n<pre><code>kubectl\u00a0-n\u00a0kubernetes-dashboard\u00a0create\u00a0token\u00a0admin-user<\/code><\/pre>\n<h6>\u914d\u7f6e hosts \u767b\u5f55 dashboard web<\/h6>\n<p>192.168.0.120 cluster-endpoint<\/p>\n<p>\u767b\u5f55\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=lD%2F9qOCA%2B%2FGF0FCiumjMHA%3D%3D.qiOZqWuXsgZMy3O4yDPsEYpeWtRFIGpwP%2FyKvoglA1g%3D\" rel=\"nofollow\">https:\/\/cluster-endpoint:31443<\/a><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458887\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\">\u8f93\u5165\u4e0a\u9762\u521b\u5efa\u7684 token \u767b\u5f55<img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458888\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h2>k8s \u955c\u50cf\u4ed3\u5e93 harbor \u73af\u5883\u90e8\u7f72<\/h2>\n<p>GitHub \u5730\u5740\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=aGwyc7Km%2BPXovTUv2mBEMw%3D%3D.vmGfUglEL0TYj5iE3vy32P9hg4F%2BpZdfpJ7DyPYOSsIWckryqoGSuxybUUNT8AwQ\" rel=\"nofollow\">https:\/\/github.com\/helm\/helm\/&#8230;<\/a><\/p>\n<p>\u8fd9\u4f7f\u7528 helm \u5b89\u88c5\uff0c\u6240\u4ee5\u5f97\u5148\u5b89\u88c5 helm<\/p>\n<h6>\u5b89\u88c5 helm<\/h6>\n<pre><code>mkdir -p \/opt\/k8s\/helm &amp;&amp; cd \/opt\/k8s\/helm\nwget https:\/\/get.helm.sh\/helm-v3.9.0-rc.1-linux-amd64.tar.gz\ntar -xf helm-v3.9.0-rc.1-linux-amd64.tar.gz\nln -s \/opt\/k8s\/helm\/linux-amd64\/helm \/usr\/bin\/helm\nhelm version\nhelm help<\/code><\/pre>\n<h6>\u914d\u7f6e hosts<\/h6>\n<pre><code>192.168.0.120\u00a0myharbor.com<\/code><\/pre>\n<h6>\u521b\u5efa stl \u8bc1\u4e66<\/h6>\n<pre><code>mkdir \/opt\/k8s\/helm\/stl &amp;&amp; cd \/opt\/k8s\/helm\/stl\n# \u751f\u6210 CA \u8bc1\u4e66\u79c1\u94a5\nopenssl genrsa -out ca.key 4096\n# \u751f\u6210 CA \u8bc1\u4e66\nopenssl req -x509 -new -nodes -sha512 -days 3650 \/\n -subj &quot;\/C=CN\/ST=Guangdong\/L=Shenzhen\/O=harbor\/OU=harbor\/CN=myharbor.com&quot; \/\n -key ca.key \/\n -out ca.crt\n# \u521b\u5efa\u57df\u540d\u8bc1\u4e66\uff0c\u751f\u6210\u79c1\u94a5\nopenssl genrsa -out myharbor.com.key 4096\n# \u751f\u6210\u8bc1\u4e66\u7b7e\u540d\u8bf7\u6c42 CSR\nopenssl req -sha512 -new \/\n    -subj &quot;\/C=CN\/ST=Guangdong\/L=Shenzhen\/O=harbor\/OU=harbor\/CN=myharbor.com&quot; \/\n    -key myharbor.com.key \/\n    -out myharbor.com.csr\n# \u751f\u6210 x509 v3 \u6269\u5c55\ncat &gt; v3.ext &lt;&lt;-EOF\nauthorityKeyIdentifier=keyid,issuer\nbasicConstraints=CA:FALSE\nkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment\nextendedKeyUsage = serverAuth\nsubjectAltName = @alt_names\n\n[alt_names]\nDNS.1=myharbor.com\nDNS.2=*.myharbor.com\nDNS.3=hostname\nEOF\n#\u521b\u5efa Harbor \u8bbf\u95ee\u8bc1\u4e66\nopenssl x509 -req -sha512 -days 3650 \/\n    -extfile v3.ext \/\n    -CA ca.crt -CAkey ca.key -CAcreateserial \/\n    -in myharbor.com.csr \/\n    -out myharbor.com.crt<\/code><\/pre>\n<h6>\u5b89\u88c5 ingress<\/h6>\n<ul>\n<li>ingress \u5b98\u65b9\u7f51\u7ad9\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=RSTnEtUayH9cARbM0M6dRw%3D%3D.a0yjezR1RHqgGSHxe7p2cea17%2FW489N4EdyQlM0lRUctnw0xtjVtLkHqTA3%2FgWNK\" rel=\"nofollow\">https:\/\/kubernetes.github.io\/&#8230;<\/a><\/li>\n<li>ingress \u4ed3\u5e93\u5730\u5740\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=qEj3XNS6Bz%2BCx%2FtfWjGUNA%3D%3D.4kdY8ondNQ7Jq%2FlhILGJpoD4j2lA9T%2FVJ127%2Bt1US5eDF2CnZGsxIRPxi%2Fi%2BhElL\" rel=\"nofollow\">https:\/\/github.com\/kubernetes&#8230;<\/a><\/li>\n<li>\u90e8\u7f72\u6587\u6863\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=3ZQ5akYkiagFh6YjRgy8%2Bw%3D%3D.XyrlweswIrTXkwdOev%2FQ6LQnhJPGXtqhU8fFfjdYxWATcZBfRuIS2YCTY0avXqAmUwp9aUvtoDot4ax8edv5AA%3D%3D\" rel=\"nofollow\">https:\/\/kubernetes.github.io\/&#8230;<\/a><\/li>\n<\/ul>\n<p>1\u3001\u901a\u8fc7 helm \u90e8\u7f72<\/p>\n<pre><code>helm upgrade --install ingress-nginx ingress-nginx \/\n  --repo https:\/\/kubernetes.github.io\/ingress-nginx \/\n  --namespace ingress-nginx --create-namespace<\/code><\/pre>\n<p>2\u3001\u901a\u8fc7 YAML \u6587\u4ef6\u5b89\u88c5\uff08\u672c\u7ae0\u4f7f\u7528\u8fd9\u4e2a\u65b9\u5f0f\u5b89\u88c5 ingress\uff09<\/p>\n<pre><code>kubectl\u00a0apply\u00a0-f\u00a0https:\/\/raw.githubusercontent.com\/kubernetes\/ingress-nginx\/controller-v1.2.0\/deploy\/static\/provider\/cloud\/deploy.yaml<\/code><\/pre>\n<p>\u5982\u679c\u4e0b\u8f7d\u955c\u50cf\u5931\u8d25\uff0c\u53ef\u4ee5\u7528\u4ee5\u4e0b\u65b9\u5f0f\u4fee\u6539\u955c\u50cf\u5730\u5740\u518d\u5b89\u88c5<\/p>\n<pre><code># \u53ef\u4ee5\u5148\u628a\u955c\u50cf\u4e0b\u8f7d\uff0c\u518d\u5b89\u88c5\ndocker pull registry.cn-hangzhou.aliyuncs.com\/google_containers\/nginx-ingress-controller:v1.2.0\ndocker pull registry.cn-hangzhou.aliyuncs.com\/google_containers\/kube-webhook-certgen:v1.1.1\n\nwget https:\/\/raw.githubusercontent.com\/kubernetes\/ingress-nginx\/controller-v1.2.0\/deploy\/static\/provider\/cloud\/deploy.yaml\n# \u4fee\u6539\u955c\u50cf\u5730\u5740\nsed -i 's@k8s.gcr.io\/ingress-nginx\/controller:v1.2.0\/(.*\/)@registry.cn-hangzhou.aliyuncs.com\/google_containers\/nginx-ingress-controller:v1.2.0@' deploy.yaml\nsed -i 's@k8s.gcr.io\/ingress-nginx\/kube-webhook-certgen:v1.1.1\/(.*\/)$@registry.cn-hangzhou.aliyuncs.com\/google_containers\/kube-webhook-certgen:v1.1.1@' deploy.yaml\n\n###\u8fd8\u9700\u8981\u4fee\u6539\u4e24\u5730\u65b9\n#1\u3001kind: \u7c7b\u578b\u4fee\u6539\u6210DaemonSet\uff0creplicas: \u6ce8\u9500\u6389\uff0c\u56e0\u4e3aDaemonSet\u6a21\u5f0f\u4f1a\u6bcf\u4e2a\u8282\u70b9\u8fd0\u884c\u4e00\u4e2apod\n#2\u3001\u5728\u6dfb\u52a0\u4e00\u6761\uff1ahostnetwork\uff1atrue\n#3\u3001\u628aLoadBalancer\u4fee\u6539\u6210NodePort\n#4\u3001\u5728--validating-webhook-key\u4e0b\u9762\u6dfb\u52a0- --watch-ingress-without-class=true\n#5\u3001\u8bbe\u7f6emaster\u8282\u70b9\u53ef\u8c03\u5ea6\nkubectl taint nodes k8s-master-168-0-113 node-role.kubernetes.io\/control-plane:NoSchedule-\nkubectl taint nodes k8s-master2-168-0-116 node-role.kubernetes.io\/control-plane:NoSchedule-\n\nkubectl apply -f deploy.yaml<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458889\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<h6>\u5b89\u88c5 nfs<\/h6>\n<p>1\u3001\u6240\u6709\u8282\u70b9\u5b89\u88c5 nfs<\/p>\n<pre><code>yum\u00a0-y\u00a0install\u00a0\u00a0nfs-utils\u00a0rpcbind<\/code><\/pre>\n<p>2\u3001\u5728 master \u8282\u70b9\u521b\u5efa\u5171\u4eab\u76ee\u5f55\u5e76\u6388\u6743<\/p>\n<pre><code>mkdir\u00a0\/opt\/nfsdata\n#\u00a0\u6388\u6743\u5171\u4eab\u76ee\u5f55\nchmod\u00a0666\u00a0\/opt\/nfsdata<\/code><\/pre>\n<p>3\u3001\u914d\u7f6e exports \u6587\u4ef6<\/p>\n<pre><code>cat &gt; \/etc\/exports&lt;&lt;EOF\n\/opt\/nfsdata *(rw,no_root_squash,no_all_squash,sync)\nEOF\n# \u914d\u7f6e\u751f\u6548\nexportfs -r\nexportfs \u547d\u4ee4<\/code><\/pre>\n<p>\u5e38\u7528\u9009\u9879<\/p>\n<pre><code>-a\u00a0\u5168\u90e8\u6302\u8f7d\u6216\u8005\u5168\u90e8\u5378\u8f7d\n-r\u00a0\u91cd\u65b0\u6302\u8f7d\n-u\u00a0\u5378\u8f7d\u67d0\u4e00\u4e2a\u76ee\u5f55\n-v\u00a0\u663e\u793a\u5171\u4eab\u76ee\u5f55\u00a0\u4ee5\u4e0b\u64cd\u4f5c\u5728\u670d\u52a1\u7aef\u4e0a<\/code><\/pre>\n<p>4\u3001\u542f\u52a8 rpc \u548c nfs\uff08\u5ba2\u6237\u7aef\u53ea\u9700\u8981\u542f\u52a8 rpc \u670d\u52a1\uff09\uff08\u6ce8\u610f\u987a\u5e8f\uff09<\/p>\n<pre><code>systemctl\u00a0start\u00a0rpcbind\nsystemctl\u00a0start\u00a0nfs-server\nsystemctl\u00a0enable\u00a0rpcbind\nsystemctl\u00a0enable\u00a0nfs-server<\/code><\/pre>\n<p>\u67e5\u770b<\/p>\n<pre><code>showmount -e\n# VIP\nshowmount -e 192.168.0.120\n\n-e #\u663e\u793a NFS \u670d\u52a1\u5668\u7684\u5171\u4eab\u5217\u8868\n-a #\u663e\u793a\u672c\u673a\u6302\u8f7d\u7684\u6587\u4ef6\u8d44\u6e90\u7684\u60c5\u51b5 NFS \u8d44\u6e90\u7684\u60c5\u51b5\n-v #\u663e\u793a\u7248\u672c\u53f7<\/code><\/pre>\n<p>5\u3001\u5ba2\u6237\u7aef<\/p>\n<pre><code># \u5b89\u88c5\nyum -y install  nfs-utils rpcbind\n# \u542f\u52a8rpc\u670d\u52a1\nsystemctl start rpcbind\nsystemctl enable rpcbind\n# \u521b\u5efa\u6302\u8f7d\u76ee\u5f55\nmkdir \/mnt\/nfsdata\n# \u6302\u8f7d\necho &quot;192.168.0.120:\/opt\/nfsdata \/mnt\/nfsdata     nfs    defaults  0 1&quot;&gt;&gt; \/etc\/fstab\nmount -a<\/code><\/pre>\n<p>6\u3001rsync \u6570\u636e\u540c\u6b65<\/p>\n<p>\u30101\u3011rsync \u5b89\u88c5<\/p>\n<pre><code>#\u00a0\u4e24\u7aef\u90fd\u5f97\u5b89\u88c5\nyum\u00a0-y\u00a0install\u00a0rsync<\/code><\/pre>\n<p>\u30102\u3011\u914d\u7f6e\uff0c\u5728\/etc\/rsyncd.conf \u4e2d\u6dfb\u52a0<\/p>\n<pre><code>cat &gt;\/etc\/rsyncd.conf&lt;&lt;EOF\nuid = root\ngid = root\n#\u7981\u9522\u5728\u6e90\u76ee\u5f55\nuse chroot = yes\n#\u76d1\u542c\u5730\u5740\naddress = 192.168.0.113\n#\u76d1\u542c\u5730\u5740tcp\/udp 873\uff0c\u53ef\u901a\u8fc7cat \/etc\/services | grep rsync\u67e5\u770b\nport 873\n#\u65e5\u5fd7\u6587\u4ef6\u4f4d\u7f6e\nlog file = \/var\/log\/rsyncd.log\n#\u5b58\u653e\u8fdb\u7a0b ID \u7684\u6587\u4ef6\u4f4d\u7f6e\npid file = \/var\/run\/rsyncd.pid\n#\u5141\u8bb8\u8bbf\u95ee\u7684\u5ba2\u6237\u673a\u5730\u5740\nhosts allow = 192.168.0.0\/16\n#\u5171\u4eab\u6a21\u5757\u540d\u79f0\n[nfsdata]\n#\u6e90\u76ee\u5f55\u7684\u5b9e\u9645\u8def\u5f84\npath = \/opt\/nfsdata\ncomment = Document Root of www.kgc.com\n#\u6307\u5b9a\u5ba2\u6237\u7aef\u662f\u5426\u53ef\u4ee5\u4e0a\u4f20\u6587\u4ef6\uff0c\u9ed8\u8ba4\u5bf9\u6240\u6709\u6a21\u5757\u4e3a true\nread only = yes\n#\u540c\u6b65\u65f6\u4e0d\u518d\u538b\u7f29\u7684\u6587\u4ef6\u7c7b\u578b\ndont compress = *.gz *.bz2 *.tgz *.zip *.rar *.z\n#\u6388\u6743\u8d26\u6237\uff0c\u591a\u4e2a\u8d26\u53f7\u4ee5\u7a7a\u683c\u5206\u9694\uff0c\u4e0d\u52a0\u5219\u4e3a\u533f\u540d\uff0c\u4e0d\u4f9d\u8d56\u7cfb\u7edf\u8d26\u53f7\nauth users = backuper\n#\u5b58\u653e\u8d26\u6237\u4fe1\u606f\u7684\u6570\u636e\u6587\u4ef6\nsecrets file = \/etc\/rsyncd_users.db\nEOF<\/code><\/pre>\n<p>\u914d\u7f6e rsyncd\/_users.db<\/p>\n<pre><code>cat\u00a0&gt;\/etc\/rsyncd_users.db&lt;&lt;EOF\nbackuper:123456\nEOF\n#\u5b98\u65b9\u8981\u6c42\uff0c\u6700\u597d\u53ea\u662f\u8d4b\u6743600\uff01\nchmod\u00a0600\u00a0\/etc\/rsyncd_users.db<\/code><\/pre>\n<p>\u30103\u3011rsyncd.conf \u5e38\u7528\u53c2\u6570\u8be6\u89e3<img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458890\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u30104\u3011rsync \u5e38\u7528\u547d\u4ee4\u53c2\u6570\u8be6\u89e3<\/p>\n<pre><code>rsync --help\n\nrsync [\u9009\u9879]  \u539f\u59cb\u4f4d\u7f6e   \u76ee\u6807\u4f4d\u7f6e\n\n\u5e38\u7528\u9009\u9879    \u8bf4\u660e\n-r    \u9012\u5f52\u6a21\u5f0f\uff0c\u5305\u542b\u76ee\u5f55\u53ca\u5b50\u76ee\u5f55\u4e2d\u7684\u6240\u6709\u6587\u4ef6\n-l    \u5bf9\u4e8e\u7b26\u53f7\u94fe\u63a5\u6587\u4ef6\u4ecd\u7136\u590d\u5236\u4e3a\u7b26\u53f7\u94fe\u63a5\u6587\u4ef6\n-v    \u663e\u793a\u540c\u6b65\u8fc7\u7a0b\u7684\u8be6\u7ec6\u4fe1\u606f\n-z    \u5728\u4f20\u8f93\u6587\u4ef6\u65f6\u8fdb\u884c\u538b\u7f29goD\n-p    \u4fdd\u7559\u6587\u4ef6\u7684\u6743\u9650\u6807\u8bb0\n-a    \u5f52\u6863\u6a21\u5f0f\uff0c\u9012\u5f52\u5e76\u4fdd\u7559\u5bf9\u8c61\u5c5e\u6027\uff0c\u7b49\u540c\u4e8e-rlpt\n-t    \u4fdd\u7559\u6587\u4ef6\u7684\u65f6\u95f4\u6807\u8bb0\n-g    \u4fdd\u7559\u6587\u4ef6\u7684\u5c5e\u7ec4\u6807\u8bb0\uff08\u4ec5\u8d85\u7ea7\u7528\u6237\u4f7f\u7528\uff09\n-o    \u4fdd\u7559\u6587\u4ef6\u7684\u5c5e\u4e3b\u6807\u8bb0\uff08\u4ec5\u8d85\u7ea7\u7528\u6237\u4f7f\u7528\uff09\n-H    \u4fdd\u7559\u786c\u94fe\u63a5\u6587\u4ef6\n-A    \u4fdd\u7559ACL\u5c5e\u6027\u4fe1\u606f\n-D    \u4fdd\u7559\u8bbe\u5907\u6587\u4ef6\u53ca\u5176\u4ed6\u7279\u6b8a\u6587\u4ef6\n--delete  \u5220\u9664\u76ee\u6807\u4f4d\u7f6e\u6709\u800c\u539f\u59cb\u4f4d\u7f6e\u6ca1\u6709\u7684\u6587\u4ef6\n--checksum  \u6839\u636e\u5bf9\u8c61\u7684\u6821\u9a8c\u548c\u6765\u51b3\u5b9a\u662f\u5426\u8df3\u8fc7\u6587\u4ef6<\/code><\/pre>\n<p>\u30105\u3011\u542f\u52a8\u670d\u52a1\uff08\u6570\u636e\u6e90\u673a\u5668\uff09<\/p>\n<pre><code>#rsync\u76d1\u542c\u7aef\u53e3\uff1a873\n#rsync\u8fd0\u884c\u6a21\u5f0f\uff1aC\/S\nrsync --daemon --config=\/etc\/rsyncd.conf\nnetstat -tnlp|grep :873<\/code><\/pre>\n<p>\u30106\u3011\u6267\u884c\u547d\u4ee4\u540c\u6b65\u6570\u636e<\/p>\n<pre><code># \u5728\u76ee\u7684\u673a\u5668\u4e0a\u6267\u884c\n# rsync -avz \u7528\u6237\u540d@\u6e90\u4e3b\u673a\u5730\u5740\/\u6e90\u76ee\u5f55 \u76ee\u7684\u76ee\u5f55\nrsync -avz root@192.168.0.113:\/opt\/nfsdata\/* \/opt\/nfsdata\/\n\u30107\u3011crontab \u5b9a\u65f6\u540c\u6b65\n# \u914d\u7f6ecrontab\uff0c \u6bcf\u4e94\u5206\u949f\u540c\u6b65\u4e00\u6b21\uff0c\u8fd9\u79cd\u65b9\u5f0f\u4e0d\u597d\n*\/5 * * * * rsync -avz root@192.168.0.113:\/opt\/nfsdata\/* \/opt\/nfsdata\/<\/code><\/pre>\n<p>\u3010\u6e29\u99a8\u63d0\u793a\u3011crontab \u5b9a\u65f6\u540c\u6b65\u6570\u636e\u4e0d\u592a\u597d\uff0c\u53ef\u4ee5\u4f7f\u7528rsync+inotify\u505a\u6570\u636e\u5b9e\u65f6\u540c\u6b65\uff0c\u8fd9\u91cc\u7bc7\u5e45\u6709\u70b9\u957f\u4e86\uff0c\u5148\u4e0d\u8bb2\uff0c\u5982\u679c\u540e\u9762\u6709\u65f6\u95f4\u4f1a\u51fa\u4e00\u7bc7\u5355\u72ec\u6587\u7ae0\u6765\u8bb2\u3002<\/p>\n<h6>\u521b\u5efa nfs provisioner \u548c\u6301\u4e45\u5316\u5b58\u50a8 SC<\/h6>\n<p>\u3010\u6e29\u99a8\u63d0\u793a\u3011\u8fd9\u91cc\u8ddf\u6211\u4e4b\u524d\u7684\u6587\u7ae0\u6709\u70b9\u4e0d\u540c\uff0c\u4e4b\u524d\u7684\u65b9\u5f0f\u4e5f\u4e0d\u9002\u7528\u65b0\u7248\u672c\u3002<\/p>\n<p>GitHub \u5730\u5740\uff1a<a href=\"https:\/\/link.segmentfault.com\/?enc=mskCUzPd2TY65xKFVv2gpg%3D%3D.7mHUwiUpcnPFWe%2BdsIcHK%2B5rOR3TKDPMPhGbWQ14u9fadVNULmaFzMP20I7%2FekBCjUs5qXSmKCt4vp8oYmPJArNMve%2B1Ve5fBrrIhHigTYY%3D\" rel=\"nofollow\">https:\/\/github.com\/kubernetes&#8230;<\/a><\/p>\n<p>helm \u90e8\u7f72 nfs-subdir-external-provisioner<\/p>\n<p>1\u3001\u6dfb\u52a0 helm \u4ed3\u5e93<\/p>\n<pre><code>helm\u00a0repo\u00a0add\u00a0nfs-subdir-external-provisioner\u00a0https:\/\/kubernetes-sigs.github.io\/nfs-subdir-external-provisioner\/<\/code><\/pre>\n<p>2\u3001helm \u5b89\u88c5 nfs provisioner<\/p>\n<p>\u3010\u6e29\u99a8\u63d0\u793a\u3011\u9ed8\u8ba4\u955c\u50cf\u662f\u65e0\u6cd5\u8bbf\u95ee\u7684\uff0c\u8fd9\u91cc\u4f7f\u7528 dockerhub \u641c\u7d22\u5230\u7684\u955c\u50cfwilldockerhub\/nfs-subdir-external-provisioner:v4.0.2\uff0c\u8fd8\u6709\u5c31\u662f StorageClass \u4e0d\u5206\u547d\u540d\u7a7a\u95f4\uff0c\u6240\u6709\u5728\u6240\u6709\u547d\u540d\u7a7a\u95f4\u4e0b\u90fd\u53ef\u4ee5\u4f7f\u7528\u3002<\/p>\n<pre><code>helm install nfs-subdir-external-provisioner nfs-subdir-external-provisioner\/nfs-subdir-external-provisioner \/\n  --namespace=nfs-provisioner \/\n  --create-namespace \/\n  --set image.repository=willdockerhub\/nfs-subdir-external-provisioner \/\n  --set image.tag=v4.0.2 \/\n  --set replicaCount=2 \/\n  --set storageClass.name=nfs-client \/\n  --set storageClass.defaultClass=true \/\n  --set nfs.server=192.168.0.120 \/\n  --set nfs.path=\/opt\/nfsdata<\/code><\/pre>\n<p>\u3010\u6e29\u99a8\u63d0\u793a\u3011\u4e0a\u9762 nfs.server \u8bbe\u7f6e\u4e3a VIP\uff0c\u53ef\u5b9e\u73b0\u9ad8\u53ef\u7528\u3002<\/p>\n<p>3\u3001\u67e5\u770b<\/p>\n<pre><code>kubectl\u00a0get\u00a0pods,deploy,sc\u00a0-n\u00a0nfs-provisioner<\/code><\/pre>\n<h6>\u90e8\u7f72 Harbor\uff08Https \u65b9\u5f0f\uff09<\/h6>\n<p>1\u3001\u521b\u5efa Namespace<\/p>\n<pre><code>kubectl\u00a0create\u00a0ns\u00a0harbor<\/code><\/pre>\n<p>2\u3001\u521b\u5efa\u8bc1\u4e66\u79d8\u94a5<\/p>\n<pre><code>kubectl create secret tls myharbor.com --key myharbor.com.key --cert myharbor.com.crt -n harbor\nkubectl get secret myharbor.com -n harbor<\/code><\/pre>\n<p>3\u3001\u6dfb\u52a0 Chart \u5e93<\/p>\n<pre><code>helm\u00a0repo\u00a0add\u00a0harbor\u00a0https:\/\/helm.goharbor.io<\/code><\/pre>\n<p>4\u3001\u901a\u8fc7 helm \u5b89\u88c5 harbor<\/p>\n<pre><code>helm install myharbor --namespace harbor harbor\/harbor \/\n  --set expose.ingress.hosts.core=myharbor.com \/\n  --set expose.ingress.hosts.notary=notary.myharbor.com \/\n  --set-string expose.ingress.annotations.'nginx\/.org\/client-max-body-size'=&quot;1024m&quot; \/\n  --set expose.tls.secretName=myharbor.com \/\n  --set persistence.persistentVolumeClaim.registry.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.jobservice.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.database.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.redis.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.trivy.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.chartmuseum.storageClass=nfs-client \/\n  --set persistence.enabled=true \/\n  --set externalURL=https:\/\/myharbor.com \/\n  --set harborAdminPassword=Harbor12345<\/code><\/pre>\n<p>\u8fd9\u91cc\u7a0d\u7b49\u4e00\u6bb5\u65f6\u95f4\u5728\u67e5\u770b\u8d44\u6e90\u72b6\u6001<\/p>\n<pre><code>kubectl\u00a0get\u00a0ingress,svc,pods,pvc\u00a0-n\u00a0harbor<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458891\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>5\u3001ingress \u6ca1\u6709 ADDRESS \u95ee\u9898\u89e3\u51b3<\/p>\n<p>\u3010\u5206\u6790\u3011\uff0c\u53d1\u73b0&#8221;error: endpoints \u201cdefault-http-backend\u201d not found&#8221;<\/p>\n<pre><code>cat &lt;&lt; EOF &gt; default-http-backend.yaml\n---\n\napiVersion: apps\/v1\nkind: Deployment\nmetadata:\n  name: default-http-backend\n  labels:\n    app: default-http-backend\n  namespace: harbor\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: default-http-backend\n  template:\n    metadata:\n      labels:\n        app: default-http-backend\n    spec:\n      terminationGracePeriodSeconds: 60\n      containers:\n      - name: default-http-backend\n        # Any image is permissible as long as:\n        # 1. It serves a 404 page at \/\n        # 2. It serves 200 on a \/healthz endpoint\n        image: registry.cn-hangzhou.aliyuncs.com\/google_containers\/defaultbackend:1.4\n#        image: gcr.io\/google_containers\/defaultbackend:1.4\n        livenessProbe:\n          httpGet:\n            path: \/healthz\n            port: 8080\n            scheme: HTTP\n          initialDelaySeconds: 30\n          timeoutSeconds: 5\n        ports:\n        - containerPort: 8080\n        resources:\n          limits:\n            cpu: 10m\n            memory: 20Mi\n          requests:\n            cpu: 10m\n            memory: 20Mi\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n  name: default-http-backend\n  namespace: harbor\n  labels:\n    app: default-http-backend\nspec:\n  ports:\n  - port: 80\n    targetPort: 8080\n  selector:\n    app: default-http-backend\nEOF\nkubectl apply -f default-http-backend.yaml<\/code><\/pre>\n<p>6\u3001\u5378\u8f7d\u91cd\u65b0\u90e8\u7f72<\/p>\n<pre><code># \u5378\u8f7d\nhelm uninstall myharbor -n harbor\nkubectl get pvc -n harbor| awk 'NR!=1{print $1}' | xargs kubectl delete pvc -n harbor\n\n# \u90e8\u7f72\nhelm install myharbor --namespace harbor harbor\/harbor \/\n  --set expose.ingress.hosts.core=myharbor.com \/\n  --set expose.ingress.hosts.notary=notary.myharbor.com \/\n  --set-string expose.ingress.annotations.'nginx\/.org\/client-max-body-size'=&quot;1024m&quot; \/\n  --set expose.tls.secretName=myharbor.com \/\n  --set persistence.persistentVolumeClaim.registry.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.jobservice.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.database.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.redis.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.trivy.storageClass=nfs-client \/\n  --set persistence.persistentVolumeClaim.chartmuseum.storageClass=nfs-client \/\n  --set persistence.enabled=true \/\n  --set externalURL=https:\/\/myharbor.com \/\n  --set harborAdminPassword=Harbor12345<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458892\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>5\u3001\u8bbf\u95ee harbor<\/p>\n<p><a href=\"https:\/\/link.segmentfault.com\/?enc=HQawiQjrrfOc9%2FPqcUAEPA%3D%3D.4Wm35AXFn%2F2qJq%2B7sUX3DIJzVB7pdNBF9uFv5%2BQMEFA%3D\" rel=\"nofollow\">https:\/\/myharbor.com<\/a><\/p>\n<p>\u8d26\u53f7\/\u5bc6\u7801\uff1aadmin\/Harbor12345<img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458893\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>6\u3001harbor \u5e38\u89c1\u64cd\u4f5c<\/p>\n<p>\u30101\u3011\u521b\u5efa\u9879\u76ee bigdata<img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458894\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u30102\u3011\u914d\u7f6e\u79c1\u6709\u4ed3\u5e93\uff0c\u5728\u6587\u4ef6\/etc\/docker\/daemon.json\u6dfb\u52a0\u5982\u4e0b\u5185\u5bb9\uff1a<\/p>\n<pre><code>&quot;insecure-registries&quot;:[&quot;https:\/\/myharbor.com&quot;]<\/code><\/pre>\n<p>\u91cd\u542f docker<\/p>\n<pre><code>systemctl\u00a0restart\u00a0docker<\/code><\/pre>\n<p>\u30103\u3011\u670d\u52a1\u5668\u4e0a\u767b\u5f55 harbor<\/p>\n<p>docker login <a href=\"https:\/\/link.segmentfault.com\/?enc=DB%2FmyJP2s3aKW3TPCmp4Rw%3D%3D.%2Ffxz9nz91N2ej7snSpKskwINiyyje8qxileKROOHi%2FU%3D\" rel=\"nofollow\">https:\/\/myharbor.com<\/a> #\u8d26\u53f7\/\u5bc6\u7801\uff1aadmin\/Harbor12345<\/p>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458895\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u30104\u3011\u6253\u6807\u7b7e\u5e76\u628a\u955c\u50cf\u4e0a\u4f20\u5230 harbor<\/p>\n<pre><code>docker\u00a0tag\u00a0rancher\/pause:3.6\u00a0myharbor.com\/bigdata\/pause:3.6\ndocker\u00a0push\u00a0myharbor.com\/bigdata\/pause:3.6<\/code><\/pre>\n<p>7\u3001\u4fee\u6539 containerd \u914d\u7f6e<\/p>\n<p>\u4ee5\u524d\u4f7f\u7528 docker-engine \u7684\u65f6\u5019\uff0c\u53ea\u9700\u8981\u4fee\u6539\/etc\/docker\/daemon.json \u5c31\u884c\uff0c\u4f46\u662f\u65b0\u7248\u7684 k8s \u5df2\u7ecf\u4f7f\u7528 containerd \u4e86\uff0c\u6240\u4ee5\u8fd9\u91cc\u9700\u8981\u505a\u76f8\u5173\u914d\u7f6e\uff0c\u8981\u4e0d\u7136 containerd \u4f1a\u5931\u8d25\u3002\u8bc1\u4e66\uff08ca.crt\uff09\u53ef\u4ee5\u5728\u9875\u9762\u4e0a\u4e0b\u8f7d\uff1a<\/p>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458896\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u521b\u5efa\u57df\u540d\u76ee\u5f55<\/p>\n<pre><code>mkdir\u00a0\/etc\/containerd\/myharbor.com\ncp\u00a0ca.crt\u00a0\/etc\/containerd\/myharbor.com\/<\/code><\/pre>\n<p>\u914d\u7f6e\u6587\u4ef6\uff1a\/etc\/containerd\/config.toml<\/p>\n<pre><code>[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]\n      config_path = &quot;&quot;\n\n      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.auths]\n\n      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]\n        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;myharbor.com&quot;.tls]\n          ca_file = &quot;\/etc\/containerd\/myharbor.com\/ca.crt&quot;\n        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;myharbor.com&quot;.auth]\n          username = &quot;admin&quot;\n          password = &quot;Harbor12345&quot;\n\n      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.headers]\n\n      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]\n        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;myharbor.com&quot;]\n          endpoint = [&quot;https:\/\/myharbor.com&quot;]<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458897\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>\u91cd\u542f containerd<\/p>\n<pre><code>#\u91cd\u65b0\u52a0\u8f7d\u914d\u7f6e\nsystemctl\u00a0daemon-reload\n#\u91cd\u542f\ncontainerdsystemctl\u00a0restart\u00a0containerd<\/code><\/pre>\n<p>\u7b80\u5355\u4f7f\u7528<\/p>\n<pre><code>#\u00a0\u628adocker\u6362\u6210crictl\u00a0\u5c31\u884c\uff0c\u547d\u4ee4\u90fd\u5dee\u4e0d\u591a\ncrictl\u00a0pull\u00a0myharbor.com\/bigdata\/mysql:5.7.38<\/code><\/pre>\n<p>\u6267\u884c crictl \u62a5\u5982\u4e0b\u9519\u8bef\u7684\u89e3\u51b3\u529e\u6cd5<\/p>\n<pre><code>WARN[0000]\u00a0image\u00a0connect\u00a0using\u00a0default\u00a0endpoints:\u00a0[unix:\/\/\/var\/run\/dockershim.sock\u00a0unix:\/\/\/run\/containerd\/containerd.sock\u00a0unix:\/\/\/run\/crio\/crio.sock\u00a0unix:\/\/\/var\/run\/cri-dockerd.sock].\u00a0As\u00a0the\u00a0default\u00a0settings\u00a0are\u00a0now\u00a0deprecated,\u00a0you\u00a0should\u00a0set\u00a0the\u00a0endpoint\u00a0instead.ERRO[0000]\u00a0unable\u00a0to\u00a0determine\u00a0image\u00a0API\u00a0version:\u00a0rpc\u00a0error:\u00a0code\u00a0=\u00a0Unavailable\u00a0desc\u00a0=\u00a0connection\u00a0error:\u00a0desc\u00a0=\u00a0&quot;transport:\u00a0Error\u00a0while\u00a0dialing\u00a0dial\u00a0unix\u00a0\/var\/run\/dockershim.sock:\u00a0connect:\u00a0no\u00a0such\u00a0file\u00a0or\u00a0directory&quot;<\/code><\/pre>\n<p>\u8fd9\u4e2a\u62a5\u9519\u662f docker \u7684\u62a5\u9519\uff0c\u8fd9\u91cc\u6ca1\u4f7f\u7528\uff0c\u6240\u4ee5\u8fd9\u4e2a\u9519\u8bef\u4e0d\u5f71\u54cd\u4f7f\u7528\uff0c\u4f46\u662f\u8fd8\u662f\u89e3\u51b3\u597d\u70b9\uff0c\u89e3\u51b3\u65b9\u6cd5\u5982\u4e0b\uff1a<\/p>\n<pre><code>cat &lt;&lt;EOF&gt; \/etc\/crictl.yaml\nruntime-endpoint: unix:\/\/\/run\/containerd\/containerd.sock\nimage-endpoint: unix:\/\/\/run\/containerd\/containerd.sock\ntimeout: 10\ndebug: false\nEOF<\/code><\/pre>\n<p>\u518d\u6b21\u62c9\u53d6\u955c\u50cf<\/p>\n<pre><code>crictl\u00a0pull\u00a0myharbor.com\/bigdata\/mysql:5.7.38<\/code><\/pre>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000042458898\" alt=\"\u56fe\u7247\" title=\"\u56fe\u7247\" loading=\"lazy\"><\/p>\n<p>Kubernetes\uff08k8s\uff09\u6700\u65b0\u7248\u6700\u5b8c\u6574\u7248\u57fa\u7840\u73af\u5883\u90e8\u7f72+master \u9ad8\u53ef\u7528\u5b9e\u73b0\u8be6\u7ec6\u6b65\u9aa4\u5c31\u5230\u8fd9\u91cc\u4e86\uff0c\u6709\u7591\u95ee\u7684\u5c0f\u4f19\u4f34\u6b22\u8fce\u7ed9\u6211\u7559\u8a00\u54e6~<\/p>\n<p><em>\u94fe\u63a5\uff1acnblogs.com\/liugp\/p\/16345473.html<\/em><\/p>\n<p><img decoding=\"async\" referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/bVbHCzg\" alt=\"\" title=\"\" loading=\"lazy\"><\/p>\n<p><a href=\"https:\/\/segmentfault.com\/a\/1190000042458864\">https:\/\/segmentfault.com\/a\/1190000042458864<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5b98\u7f51\uff1ahttps:\/\/kubernetes.io\/ \u6587\u6863\uff1ahttps:\/\/kubernetes.io\/zh-c [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[],"tags":[],"class_list":["post-10006456","post","type-post","status-publish","format-standard","hentry"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts\/10006456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10006456"}],"version-history":[{"count":0,"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts\/10006456\/revisions"}],"wp:attachment":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10006456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10006456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10006456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}