1 您需要了解

虚拟化平台版本 VMware Workstation 17.0.0
操作系统版本 CentOS Stream release 8 ，采用最小化 minimal 安装
安装源您可访问阿里开源镜像站或其他镜像站进行下载
环境用到 3台 虚拟机，单网卡，网卡类型配置为 NAT或 桥接，需连通外部网络
为有更好的浏览体验，您可以点击文章左上方目录按钮来显示文章整体目录结构

相关文章
G003-OS-LIN-RHEL-01 红帽 8.4 安装

2 环境规划

主机名	IP	网关/DNS	CPU/内存	磁盘	角色
kmaster	192.168.100.149	192.168.100.2	2c / 8G	100g	控制节点
knode1	192.168.100.150	192.168.100.2	2c / 8G	100g	工作节点1
knode2	192.168.100.151	192.168.100.2	2c / 8G	100g	工作节点2

3 系统环境配置

3.1 设置 hosts（master节点）

[root@kmaster ~]# echo '192.168.100.149 kmaster' >> /etc/hosts
[root@kmaster ~]# echo '192.168.100.150 knode1' >> /etc/hosts
[root@kmaster ~]# echo '192.168.100.151 knode2' >> /etc/hosts
[root@kmaster ~]# scp /etc/hosts root@knode1:/etc/
The authenticity of host 'knode1 (192.168.100.150)' can't be established.
ECDSA key fingerprint is SHA256:s/vDUVQgCREDCOrRfTNyN4shz8+WWritwYHBxDY5/RA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'knode1,192.168.100.150' (ECDSA) to the list of known hosts.
root@knode1's password: 
hosts                                                                                       100%  228   112.8KB/s   00:00    
[root@kmaster ~]# scp /etc/hosts root@knode2:/etc/
The authenticity of host 'knode2 (192.168.100.151)' can't be established.
ECDSA key fingerprint is SHA256:dM4a5cU41AmOn1UUCH01Zk1UDAj4zE9+8F+EK24LbWs.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'knode2,192.168.100.151' (ECDSA) to the list of known hosts.
root@knode2's password: 
hosts                                                                                       100%  228   296.3KB/s   00:00    
[root@kmaster ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.100.149 kmaster
192.168.100.150 knode1
192.168.100.151 knode2

3.2 安装包（所有节点）

[root@kmaster ~]# yum install -y yum-utils vim bash-completion net-tools wget
[root@kmaster ~]# bash

[root@knode1 ~]# yum install -y yum-utils vim bash-completion net-tools wget
[root@knode1 ~]# bash

[root@knode2 ~]# yum install -y yum-utils vim bash-completion net-tools wget
[root@knode2 ~]# bash

3.3 关闭 swap 分区（所有节点）

在 fstab 中将 swap 分区进行注释

[root@kmaster ~]# swapoff -a
[root@kmaster ~]# swapon -s
[root@kmaster ~]# vim /etc/fstab 
[root@kmaster ~]# cat /etc/fstab 
...
#/dev/mapper/cs-swap     none                    swap    defaults        0 0

[root@knode1 ~]# swapoff -a
[root@knode1 ~]# swapon -s
[root@knode1 ~]# vim /etc/fstab 
[root@knode1 ~]# cat /etc/fstab 
...
#/dev/mapper/cs-swap     none                    swap    defaults        0 0

[root@knode2 ~]# swapoff -a
[root@knode2 ~]# swapon -s
[root@knode2 ~]# vim /etc/fstab 
[root@knode2 ~]# cat /etc/fstab 
...
#/dev/mapper/cs-swap     none                    swap    defaults        0 0

3.4 关闭防火墙和SELinux（所有节点）

[root@kmaster ~]# systemctl stop firewalld
[root@kmaster ~]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@kmaster ~]# setenforce 0
[root@kmaster ~]# sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config

[root@knode1 ~]# systemctl stop firewalld
[root@knode1 ~]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@knode1 ~]# setenforce 0
[root@knode1 ~]# sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config

[root@knode2 ~]# systemctl stop firewalld
[root@knode2 ~]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@knode2 ~]# setenforce 0
[root@knode2 ~]# sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config

3.5 安装 docker（所有节点）

默认安装最新版本，如需指定版本，可采用 yum install -y docker-ce-20.10.23 docker-ce-cli-20.10.23

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum list docker-ce --showduplicates | sort -r
yum install -y docker-ce
systemctl start docker 
systemctl enable docker
docker -v
systemctl is-active docker
systemctl is-enabled docker

[root@kmaster ~]# docker -v
Docker version 23.0.0, build e92dd87
[root@kmaster ~]# systemctl is-active docker
active
[root@kmaster ~]# systemctl is-enabled docker
enabled

[root@knode1 ~]# docker -v
Docker version 23.0.0, build e92dd87
[root@knode1 ~]# systemctl is-active docker
active
[root@knode1 ~]# systemctl is-enabled docker
enabled

[root@knode2 ~]# docker -v
Docker version 23.0.0, build e92dd87
[root@knode2 ~]# systemctl is-active docker
active
[root@knode2 ~]# systemctl is-enabled docker
enabled

3.6 开启转发及 iptables 过滤（所有节点）

cat <<EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p /etc/sysctl.d/k8s.conf

3.7 修改 containerd 镜像源（所有节点）

[root@kmaster ~]# containerd config default > /etc/containerd/config.toml
[root@kmaster ~]# sed -i "s#registry.k8s.io/pause#registry.aliyuncs.com/google_containers/pause#g" /etc/containerd/config.toml[root@kmaster ~]# grep sandbox_image /etc/containerd/config.toml
    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.6"

[root@knode1 ~]# containerd config default > /etc/containerd/config.toml
[root@knode1 ~]# sed -i "s#registry.k8s.io/pause#registry.aliyuncs.com/google_containers/pause#g" /etc/containerd/config.toml
[root@knode1 ~]# grep sandbox_image /etc/containerd/config.toml
    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.6"

[root@knode2 ~]# containerd config default > /etc/containerd/config.toml
[root@knode2 ~]# sed -i "s#registry.k8s.io/pause#registry.aliyuncs.com/google_containers/pause#g" /etc/containerd/config.toml
[root@knode2 ~]# grep sandbox_image /etc/containerd/config.toml
    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.6"

3.8 配置 systemd cgroup 驱动（所有节点）

[root@kmaster ~]# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
[root@kmaster ~]# systemctl restart containerd
[root@kmaster ~]# grep SystemdCgroup /etc/containerd/config.toml
            SystemdCgroup = true

[root@knode1 ~]# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
[root@knode1 ~]# systemctl restart containerd
[root@knode1 ~]# grep SystemdCgroup /etc/containerd/config.toml
            SystemdCgroup = true

[root@knode2 ~]# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
[root@knode2 ~]# systemctl restart containerd
[root@knode2 ~]# grep SystemdCgroup /etc/containerd/config.toml
            SystemdCgroup = true

3.9 添加 k8s 源文件（所有节点）

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

4 集群搭建

4.1 安装Kube工具（所有节点）

[root@kmaster ~]# yum install -y kubelet-1.26.0 kubeadm-1.26.0 kubectl-1.26.0 --disableexcludes=kubernetes
...
Installed:
  conntrack-tools-1.4.4-11.el8.x86_64       cri-tools-1.26.0-0.x86_64                  kubeadm-1.26.0-0.x86_64              
  kubectl-1.26.0-0.x86_64                   kubelet-1.26.0-0.x86_64                    kubernetes-cni-1.2.0-0.x86_64        
  libnetfilter_cthelper-1.0.0-15.el8.x86_64 libnetfilter_cttimeout-1.0.0-11.el8.x86_64 libnetfilter_queue-1.0.4-3.el8.x86_64
  socat-1.7.4.1-1.el8.x86_64               

Complete!

[root@kmaster ~]# systemctl enable --now kubelet
Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service → /usr/lib/systemd/system/kubelet.service.

[root@knode1 ~]# yum install -y kubelet-1.26.0 kubeadm-1.26.0 kubectl-1.26.0 --disableexcludes=kubernetes
...
Installed:
  conntrack-tools-1.4.4-11.el8.x86_64       cri-tools-1.26.0-0.x86_64                  kubeadm-1.26.0-0.x86_64              
  kubectl-1.26.0-0.x86_64                   kubelet-1.26.0-0.x86_64                    kubernetes-cni-1.2.0-0.x86_64        
  libnetfilter_cthelper-1.0.0-15.el8.x86_64 libnetfilter_cttimeout-1.0.0-11.el8.x86_64 libnetfilter_queue-1.0.4-3.el8.x86_64
  socat-1.7.4.1-1.el8.x86_64               

Complete!

[root@knode1 ~]# systemctl enable --now kubelet
Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service → /usr/lib/systemd/system/kubelet.service.

[root@knode2 ~]# yum install -y kubelet-1.26.0 kubeadm-1.26.0 kubectl-1.26.0 --disableexcludes=kubernetes
...
Installed:
  conntrack-tools-1.4.4-11.el8.x86_64       cri-tools-1.26.0-0.x86_64                  kubeadm-1.26.0-0.x86_64              
  kubectl-1.26.0-0.x86_64                   kubelet-1.26.0-0.x86_64                    kubernetes-cni-1.2.0-0.x86_64        
  libnetfilter_cthelper-1.0.0-15.el8.x86_64 libnetfilter_cttimeout-1.0.0-11.el8.x86_64 libnetfilter_queue-1.0.4-3.el8.x86_64
  socat-1.7.4.1-1.el8.x86_64               

Complete!

[root@knode2 ~]# systemctl enable --now kubelet
Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service → /usr/lib/systemd/system/kubelet.service.

4.2 初始化集群（master节点）

注意最后生成的 token，未来工作节点加入集群需要用到

[root@kmaster ~]# kubeadm init --image-repository registry.aliyuncs.com/google_containers --kubernetes-version=v1.26.0 --pod-network-cidr=10.244.0.0/16
[init] Using Kubernetes version: v1.26.0
[preflight] Running pre-flight checks
	[WARNING FileExisting-tc]: tc not found in system path
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [kmaster kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.100.149]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [kmaster localhost] and IPs [192.168.100.149 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [kmaster localhost] and IPs [192.168.100.149 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 7.503146 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node kmaster as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node kmaster as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: ga3vo9.3tgxplio1bltfro6
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.100.149:6443 --token ga3vo9.3tgxplio1bltfro6 \
	--discovery-token-ca-cert-hash sha256:69c02753428923a695e2d353944a6c7ba710862e83d5c265a5e86d5fdb11f6de

4.3 配置环境变量（master节点）

[root@kmaster ~]# mkdir -p $HOME/.kube
[root@kmaster ~]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@kmaster ~]# sudo chown $(id -u):$(id -g) $HOME/.kube/config
[root@kmaster ~]# echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile
[root@kmaster ~]# source  ~/.bash_profile

[root@kmaster ~]# kubectl get node
NAME      STATUS     ROLES           AGE     VERSION
kmaster   NotReady   control-plane   3m35s   v1.26.0

4.4 工作节点加入集群（knode1节点及knode2节点）

将 4.2 小节 最后生成的 kubeadm join 语句，分别拷贝至两个节点执行

[root@knode1 ~]# kubeadm join 192.168.100.149:6443 --token ga3vo9.3tgxplio1bltfro6 --discovery-token-ca-cert-hash sha256:69c02753428923a695e2d353944a6c7ba710862e83d5c265a5e86d5fdb11f6de
[preflight] Running pre-flight checks
	[WARNING FileExisting-tc]: tc not found in system path
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

[root@knode2 ~]# kubeadm join 192.168.100.149:6443 --token ga3vo9.3tgxplio1bltfro6 --discovery-token-ca-cert-hash sha256:69c02753428923a695e2d353944a6c7ba710862e83d5c265a5e86d5fdb11f6de
[preflight] Running pre-flight checks
	[WARNING FileExisting-tc]: tc not found in system path
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

[root@kmaster ~]# kubectl get node
NAME      STATUS     ROLES           AGE     VERSION
kmaster   NotReady   control-plane   2m44s   v1.26.0
knode1    NotReady   <none>          55s     v1.26.0
knode2    NotReady   <none>          47s     v1.26.0

4.5 修改默认端点连接（master节点）

默认情况下，通过 crictl img 命令查询镜像会报错，因为 crictl 命令默认会去找 /var/run/dockershim.sock 文件，而自 1.24 版本起，Dockershim 已从 Kubernetes 项目中移除，找不到对应的文件所以报错。

[root@kmaster ~]# crictl img
WARN[0000] image connect using default endpoints: [unix:///var/run/dockershim.sock unix:///run/containerd/containerd.sock unix:///run/crio/crio.sock unix:///var/run/cri-dockerd.sock]. As the default settings are now deprecated, you should set the endpoint instead. 
E0206 22:40:05.231463    3452 remote_image.go:119] "ListImages with filter from image service failed" err="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory\"" filter="&ImageFilter{Image:&ImageSpec{Image:,Annotations:map[string]string{},},}"
FATA[0000] listing images: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory" 

#编辑文件 crictl.yaml
[root@kmaster ~]# vim /etc/crictl.yaml 
[root@kmaster ~]# cat /etc/crictl.yaml 
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 5
debug: false

#再次执行
[root@kmaster ~]# crictl img
IMAGE                                                             TAG                 IMAGE ID            SIZE
registry.aliyuncs.com/google_containers/coredns                   v1.9.3              5185b96f0becf       14.8MB
registry.aliyuncs.com/google_containers/etcd                      3.5.6-0             fce326961ae2d       103MB
registry.aliyuncs.com/google_containers/kube-apiserver            v1.26.0             a31e1d84401e6       35.3MB
registry.aliyuncs.com/google_containers/kube-controller-manager   v1.26.0             5d7c5dfd3ba18       32.2MB
registry.aliyuncs.com/google_containers/kube-proxy                v1.26.0             556768f31eb1d       21.5MB
registry.aliyuncs.com/google_containers/kube-scheduler            v1.26.0             dafd8ad70b156       17.5MB
registry.aliyuncs.com/google_containers/pause                     3.6                 6270bb605e12e       302kB
registry.aliyuncs.com/google_containers/pause                     3.9                 e6f1816883972       322kB

#将配置文件拷贝至其他节点
[root@kmaster ~]# scp /etc/crictl.yaml 192.168.100.150:/etc/
root@192.168.100.150's password: 
crictl.yaml                                                                                 100%  136    86.4KB/s   00:00    
[root@kmaster ~]# scp /etc/crictl.yaml 192.168.100.151:/etc/
root@192.168.100.151's password: 
crictl.yaml                                                                                 100%  136   118.8KB/s   00:00

4.6 安装 calico 网络（master节点）

安装网络组件前，集群状态为 NotReady，安装后，稍等片刻，集群状态将变为 Ready，因为当前 1.26 版本所需镜像无法从外部网络获取，所以通过私有镜像仓库手工拉取到本地，再执行 yaml 文件。

查看集群状态

[root@kmaster ~]# kubectl get node
NAME      STATUS     ROLES           AGE   VERSION
kmaster   NotReady   control-plane   24m   v1.26.0
knode1    NotReady   <none>          16m   v1.26.0
knode2    NotReady   <none>          15m   v1.26.0

下载 calico 文件并编辑

[root@kmaster ~]# wget https://docs.projectcalico.org/manifests/calico.yaml --no-check-certificate
--2023-02-06 22:33:54--  https://docs.projectcalico.org/manifests/calico.yaml
Resolving docs.projectcalico.org (docs.projectcalico.org)... 13.228.199.255, 34.142.199.10, 2406:da18:880:3801::c8, ...
Connecting to docs.projectcalico.org (docs.projectcalico.org)|13.228.199.255|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 238089 (233K) [text/yaml]
Saving to: ‘calico.yaml’

calico.yaml                     100%[=====================================================>] 232.51K   864KB/s    in 0.3s    

2023-02-06 22:33:55 (864 KB/s) - ‘calico.yaml’ saved [238089/238089]

[root@kmaster ~]# vim calico.yaml
...
#将以下两行参数取消注释，并修改 value 为 10.244.0.0/16，保存并退出
- name: CALICO_IPV4POOL_CIDR
  value: "10.244.0.0/16"
...

master 节点拉取镜像

[root@kmaster ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/kube-controllers:v3.25.0
Image is up to date for sha256:5e785d005ccc1ab22527a783835cf2741f6f5f385a8956144c661f8c23ae9d78
[root@kmaster ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/cni:v3.25.0
Image is up to date for sha256:d70a5947d57e5ab3340d126a38e6ae51bd9e8e0b342daa2012e78d8868bed5b7
[root@kmaster ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/node:v3.25.0
Image is up to date for sha256:08616d26b8e74867402274687491e5978ba4a6ded94e9f5ecc3e364024e5683e

node1 节点拉取镜像

[root@knode1 ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/cni:v3.25.0
Image is up to date for sha256:d70a5947d57e5ab3340d126a38e6ae51bd9e8e0b342daa2012e78d8868bed5b7
[root@knode1 ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/node:v3.25.0
Image is up to date for sha256:08616d26b8e74867402274687491e5978ba4a6ded94e9f5ecc3e364024e5683e

node2 节点拉取镜像

[root@knode2 ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/cni:v3.25.0
Image is up to date for sha256:d70a5947d57e5ab3340d126a38e6ae51bd9e8e0b342daa2012e78d8868bed5b7
[root@knode2 ~]# crictl pull registry.cn-hangzhou.aliyuncs.com/cloudcs/node:v3.25.0
Image is up to date for sha256:08616d26b8e74867402274687491e5978ba4a6ded94e9f5ecc3e364024e5683e

master 节点执行 calico.yaml

[root@kmaster ~]# kubectl apply -f calico.yaml 
poddisruptionbudget.policy/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
serviceaccount/calico-node created
configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/caliconodestatuses.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipreservations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-node created
daemonset.apps/calico-node created
deployment.apps/calico-kube-controllers created

再次查看集群状态

[root@kmaster ~]# kubectl get node
NAME      STATUS   ROLES           AGE   VERSION
kmaster   Ready    control-plane   17m   v1.26.0
knode1    Ready    <none>          15m   v1.26.0
knode2    Ready    <none>          15m   v1.26.0

秒客网

G030-CON-CKA-K8S-01 CentOS 8 Stream 搭建 kubernetes 集群 v1.26.0

1 您需要了解

2 环境规划

3 系统环境配置

3.1 设置 hosts（master节点）

3.2 安装包（所有节点）

3.3 关闭 swap 分区（所有节点）

3.4 关闭防火墙和SELinux（所有节点）

3.5 安装 docker（所有节点）

3.6 开启转发及 iptables 过滤（所有节点）

3.7 修改 containerd 镜像源（所有节点）

3.8 配置 systemd cgroup 驱动（所有节点）

3.9 添加 k8s 源文件（所有节点）

4 集群搭建

4.1 安装Kube工具（所有节点）

4.2 初始化集群（master节点）

4.3 配置环境变量（master节点）

4.4 工作节点加入集群（knode1节点及knode2节点）

4.5 修改默认端点连接（master节点）

4.6 安装 calico 网络（master节点）

相关文章