侧边栏壁纸
博主头像
知夏IT小屋

  • 累计撰写 20 篇文章
  • 累计创建 13 个标签
  • 累计收到 0 条评论

目 录CONTENT

文章目录
K8S

【第十四期】-Ubuntu26.04 部署K8S集群

项目背景

上一章节了解了K8S及其基本概念, 本章节直接来部署一套K8S集群, 基于Ubuntu26.04， 具体信息如下

设定主机名

三个节点分别设定主机名

root@ubuntu01:~# hostnamectl set-hostname k8s-maste
root@ubuntu01:~# bash
root@k8s-maste:~#
root@ubuntu02:~# hostnamectl set-hostname k8s-node1
root@ubuntu02:~#
root@ubuntu02:~# bash
root@k8s-node1:~#
root@ubuntu03:~# hostnamectl set-hostname k8s-node2
root@ubuntu03:~# bash
root@k8s-node2:~#

设定hosts解析

三个节点分别设定hosts解析

root@k8s-maste:~# cat >> /etc/hosts << 'EOF'
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
EOF
root@k8s-maste:~# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 guzman

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
root@k8s-maste:~#
root@k8s-node1:~# cat >> /etc/hosts << 'EOF'
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
EOF
root@k8s-node1:~# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 guzman

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
root@k8s-node1:~#

root@k8s-node2:~# cat >> /etc/hosts << 'EOF'
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
EOF
root@k8s-node2:~# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 guzman

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.140.136 k8s-maste
192.168.140.137 k8s-node1
192.168.140.138 k8s-node2
root@k8s-node2:~#

关闭防火墙

三节点分别关闭防火墙(在企业中主机防火墙一般都是关闭的,会有专门的防火墙设备)

root@k8s-maste:~# systemctl stop ufw.service
root@k8s-maste:~# systemctl disable ufw.service
Synchronizing state of ufw.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable ufw
Removed '/etc/systemd/system/multi-user.target.wants/ufw.service'.
root@k8s-maste:~#
root@k8s-node1:~# systemctl stop ufw.service
root@k8s-node1:~# systemctl disable ufw.service
Synchronizing state of ufw.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable ufw
Removed '/etc/systemd/system/multi-user.target.wants/ufw.service'.
root@k8s-node1:~#
root@k8s-node2:~# systemctl stop ufw.service
root@k8s-node2:~# systemctl disable ufw.service
Synchronizing state of ufw.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable ufw
Removed '/etc/systemd/system/multi-user.target.wants/ufw.service'.
root@k8s-node2:~#

关闭SWAP

三节点分别关闭SWAP

root@k8s-maste:~# swapoff -a
root@k8s-maste:~# sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
root@k8s-maste:~#
root@k8s-node1:~# swapoff -a
root@k8s-node1:~# sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
root@k8s-node1:~#
root@k8s-node2:~# swapoff -a
root@k8s-node2:~# sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
root@k8s-node2:~#

加载内核模块及设定参数

root@k8s-maste:~# cat > /etc/modules-load.d/k8s.conf << 'EOF'
overlay
br_netfilter
EOF
root@k8s-maste:~# modprobe overlay
root@k8s-maste:~# modprobe br_netfilter
root@k8s-maste:~# cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
root@k8s-maste:~# sysctl --system
* Applying /usr/lib/sysctl.d/10-apparmor.conf ...
* Applying /usr/lib/sysctl.d/10-coredump-debian.conf ...
* Applying /usr/lib/sysctl.d/50-default.conf ...
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* Applying /usr/lib/sysctl.d/55-bufferbloat.conf ...
* Applying /usr/lib/sysctl.d/55-console-messages.conf ...
* Applying /usr/lib/sysctl.d/55-ipv6-privacy.conf ...
* Applying /usr/lib/sysctl.d/55-kernel-hardening.conf ...
* Applying /usr/lib/sysctl.d/55-magic-sysrq.conf ...
* Applying /usr/lib/sysctl.d/55-map-count.conf ...
* Applying /usr/lib/sysctl.d/55-network-security.conf ...
* Applying /usr/lib/sysctl.d/55-ptrace.conf ...
* Applying /usr/lib/sysctl.d/55-zeropage.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
kernel.apparmor_restrict_unprivileged_userns = 1
kernel.apparmor_restrict_unprivileged_unconfined = 1
kernel.core_pattern = core
kernel.sysrq = 0x01b6
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.docker0.rp_filter = 2
net.ipv4.conf.ens33.rp_filter = 2
net.ipv4.conf.lo.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.docker0.accept_source_route = 0
net.ipv4.conf.ens33.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.docker0.promote_secondaries = 1
net.ipv4.conf.ens33.promote_secondaries = 1
net.ipv4.conf.lo.promote_secondaries = 1
net.ipv4.ping_group_range = 0 2147483647
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_regular = 2
fs.protected_fifos = 1
vm.max_map_count = 1048576
kernel.pid_max = 4194304
net.core.default_qdisc = fq_codel
kernel.printk = 4 4 1 7
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
kernel.kptr_restrict = 1
kernel.sysrq = 176
vm.max_map_count = 1048576
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
kernel.yama.ptrace_scope = 1
vm.mmap_min_addr = 65536
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
root@k8s-maste:~#
root@k8s-node1:~# cat > /etc/modules-load.d/k8s.conf << 'EOF'
overlay
br_netfilter
EOF
root@k8s-node1:~# modprobe overlay
root@k8s-node1:~# modprobe br_netfilter
root@k8s-node1:~# cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
root@k8s-node1:~# sysctl --system
* Applying /usr/lib/sysctl.d/10-apparmor.conf ...
* Applying /usr/lib/sysctl.d/10-coredump-debian.conf ...
* Applying /usr/lib/sysctl.d/50-default.conf ...
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* Applying /usr/lib/sysctl.d/55-bufferbloat.conf ...
* Applying /usr/lib/sysctl.d/55-console-messages.conf ...
* Applying /usr/lib/sysctl.d/55-ipv6-privacy.conf ...
* Applying /usr/lib/sysctl.d/55-kernel-hardening.conf ...
* Applying /usr/lib/sysctl.d/55-magic-sysrq.conf ...
* Applying /usr/lib/sysctl.d/55-map-count.conf ...
* Applying /usr/lib/sysctl.d/55-network-security.conf ...
* Applying /usr/lib/sysctl.d/55-ptrace.conf ...
* Applying /usr/lib/sysctl.d/55-zeropage.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
kernel.apparmor_restrict_unprivileged_userns = 1
kernel.apparmor_restrict_unprivileged_unconfined = 1
kernel.core_pattern = core
kernel.sysrq = 0x01b6
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.docker0.rp_filter = 2
net.ipv4.conf.ens33.rp_filter = 2
net.ipv4.conf.lo.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.docker0.accept_source_route = 0
net.ipv4.conf.ens33.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.docker0.promote_secondaries = 1
net.ipv4.conf.ens33.promote_secondaries = 1
net.ipv4.conf.lo.promote_secondaries = 1
net.ipv4.ping_group_range = 0 2147483647
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_regular = 2
fs.protected_fifos = 1
vm.max_map_count = 1048576
kernel.pid_max = 4194304
net.core.default_qdisc = fq_codel
kernel.printk = 4 4 1 7
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
kernel.kptr_restrict = 1
kernel.sysrq = 176
vm.max_map_count = 1048576
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
kernel.yama.ptrace_scope = 1
vm.mmap_min_addr = 65536
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
root@k8s-node1:~#
root@k8s-node2:~# cat > /etc/modules-load.d/k8s.conf << 'EOF'
overlay
br_netfilter
EOF
root@k8s-node2:~# modprobe overlay
root@k8s-node2:~# modprobe br_netfilter
root@k8s-node2:~# cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
root@k8s-node2:~# sysctl --system
* Applying /usr/lib/sysctl.d/10-apparmor.conf ...
* Applying /usr/lib/sysctl.d/10-coredump-debian.conf ...
* Applying /usr/lib/sysctl.d/50-default.conf ...
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* Applying /usr/lib/sysctl.d/55-bufferbloat.conf ...
* Applying /usr/lib/sysctl.d/55-console-messages.conf ...
* Applying /usr/lib/sysctl.d/55-ipv6-privacy.conf ...
* Applying /usr/lib/sysctl.d/55-kernel-hardening.conf ...
* Applying /usr/lib/sysctl.d/55-magic-sysrq.conf ...
* Applying /usr/lib/sysctl.d/55-map-count.conf ...
* Applying /usr/lib/sysctl.d/55-network-security.conf ...
* Applying /usr/lib/sysctl.d/55-ptrace.conf ...
* Applying /usr/lib/sysctl.d/55-zeropage.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
kernel.apparmor_restrict_unprivileged_userns = 1
kernel.apparmor_restrict_unprivileged_unconfined = 1
kernel.core_pattern = core
kernel.sysrq = 0x01b6
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.docker0.rp_filter = 2
net.ipv4.conf.ens33.rp_filter = 2
net.ipv4.conf.lo.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.docker0.accept_source_route = 0
net.ipv4.conf.ens33.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.docker0.promote_secondaries = 1
net.ipv4.conf.ens33.promote_secondaries = 1
net.ipv4.conf.lo.promote_secondaries = 1
net.ipv4.ping_group_range = 0 2147483647
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_regular = 2
fs.protected_fifos = 1
vm.max_map_count = 1048576
kernel.pid_max = 4194304
net.core.default_qdisc = fq_codel
kernel.printk = 4 4 1 7
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
kernel.kptr_restrict = 1
kernel.sysrq = 176
vm.max_map_count = 1048576
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
kernel.yama.ptrace_scope = 1
vm.mmap_min_addr = 65536
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
root@k8s-node2:~#

设定APT源为阿里云

root@k8s-maste:~# cp /etc/apt/sources.list /etc/apt/sources.list.bak
root@k8s-maste:~# cat > /etc/apt/sources.list << 'EOF'
deb https://mirrors.aliyun.com/ubuntu/ resolute main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-updates main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-backports main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-security main restricted universe multiverse
EOF
root@k8s-maste:~# apt update
root@k8s-node1:~# cp /etc/apt/sources.list /etc/apt/sources.list.bak
root@k8s-node1:~# cat > /etc/apt/sources.list << 'EOF'
deb https://mirrors.aliyun.com/ubuntu/ resolute main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-updates main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-backports main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-security main restricted universe multiverse
EOF
root@k8s-node1:~# apt update
root@k8s-node2:~# cp /etc/apt/sources.list /etc/apt/sources.list.bak
root@k8s-node2:~# cat > /etc/apt/sources.list << 'EOF'
deb https://mirrors.aliyun.com/ubuntu/ resolute main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-updates main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-backports main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ resolute-security main restricted universe multiverse
EOF
root@k8s-node2:~# apt update

安装Docker CE

root@k8s-maste:~# apt install -y ca-certificates curl gnupg lsb-release
root@k8s-maste:~# echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list
deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu resolute stable
root@k8s-maste:~# apt update
root@k8s-maste:~# apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
root@k8s-node1:~# apt install -y ca-certificates curl gnupg lsb-release
root@k8s-node1:~# curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
root@k8s-node1:~# echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list
deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu resolute stable
root@k8s-node1:~# apt update
root@k8s-node1:~# apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
root@k8s-node2:~# apt install -y ca-certificates curl gnupg lsb-release
root@k8s-node2:~# curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archi              ve-keyring.gpg
root@k8s-node2:~# echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirro              rs.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list
deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu resolute s              table
root@k8s-node2:~# apt update
root@k8s-node2:~# apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

配置加速器

root@k8s-maste:~# cat > /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [
    "https://docker.mirrors.ustc.edu.cn",
    "https://hub-mirror.c.163.com"
  ],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2"
}
EOF
root@k8s-maste:~#
root@k8s-maste:~# systemctl daemon-reload
root@k8s-maste:~# systemctl restart docker
root@k8s-maste:~# systemctl enable docker
Synchronizing state of docker.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable docker
root@k8s-maste:~# docker --version
Docker version 29.6.2, build dfc4efb
root@k8s-maste:~#
root@k8s-node1:~# cat > /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [
    "https://docker.mirrors.ustc.edu.cn",
    "https://hub-mirror.c.163.com"
  ],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2"
}
EOF
root@k8s-node1:~# systemctl daemon-reload
root@k8s-node1:~# systemctl restart docker
root@k8s-node1:~# systemctl enable docker
Synchronizing state of docker.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable docker
root@k8s-node1:~# docker --version
Docker version 29.6.2, build dfc4efb
root@k8s-node1:~#
root@k8s-node2:~# cat > /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [
    "https://docker.mirrors.ustc.edu.cn",
    "https://hub-mirror.c.163.com"
  ],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2"
}
EOF
root@k8s-node2:~#
root@k8s-node2:~# systemctl daemon-reload
root@k8s-node2:~# systemctl restart docker
root@k8s-node2:~# systemctl enable docker
Synchronizing state of docker.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable docker
root@k8s-node2:~# docker --version
Docker version 29.6.2, build dfc4efb
root@k8s-node2:~#

安装 cri-dockerd

提前下载好安装包再上传到主机

https://github.com/Mirantis/cri-dockerd/releases/tag/v0.3.15

root@k8s-maste:/tmp# tar -zxf cri-dockerd-0.3.15.amd64.tgz
root@k8s-maste:/tmp# cd cri-dockerd
root@k8s-maste:/tmp/cri-dockerd# ll
total 46844
drwxr-xr-x  2 1001 docker       60 Jul 12  2024 ./
drwxrwxrwt 15 root root        360 Jul 21 15:41 ../
-rwxr-xr-x  1 1001 docker 47968256 Jul 12  2024 cri-dockerd*
root@k8s-maste:/tmp/cri-dockerd# install -o root -g root -m 0755 /tmp/cri-dockerd/cri-dockerd /usr/bin/cri-dockerd
root@k8s-maste:/tmp/cri-dockerd# mkdir -p /usr/lib/systemd/system/
root@k8s-maste:/tmp/cri-dockerd# cat > /etc/systemd/system/cri-docker.service << 'EOF'
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=notify
ExecStart=/usr/bin/cri-dockerd \
  --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock \
  --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.10
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

StartLimitBurst=3
StartLimitInterval=60s

LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

TasksMax=infinity
Delegate=yes
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
root@k8s-maste:/tmp/cri-dockerd# systemctl daemon-reload
root@k8s-maste:/tmp/cri-dockerd# systemctl enable --now cri-docker
root@k8s-maste:/tmp/cri-dockerd# systemctl status cri-docker
root@k8s-node1:/tmp# tar -zxf cri-dockerd-0.3.15.amd64.tgz
root@k8s-node1:/tmp# cd cri-dockerd
root@k8s-node1:/tmp/cri-dockerd# ll
total 46844
drwxr-xr-x  2 1001 docker       60 Jul 12  2024 ./
drwxrwxrwt 15 root root        320 Jul 21 15:52 ../
-rwxr-xr-x  1 1001 docker 47968256 Jul 12  2024 cri-dockerd*
root@k8s-node1:/tmp/cri-dockerd# install -o root -g root -m 0755 /tmp/cri-dockerd/cri-dockerd /usr/bin/cri-dockerd
root@k8s-node1:/tmp/cri-dockerd# mkdir -p /usr/lib/systemd/system/
root@k8s-node1:/tmp/cri-dockerd# cat > /etc/systemd/system/cri-docker.service << 'EOF'
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=notify
ExecStart=/usr/bin/cri-dockerd \
  --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock \
  --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.10
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

StartLimitBurst=3
StartLimitInterval=60s

LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

TasksMax=infinity
Delegate=yes
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
root@k8s-node1:/tmp/cri-dockerd# systemctl daemon-reload
root@k8s-node1:/tmp/cri-dockerd# systemctl enable --now cri-docker
root@k8s-node1:/tmp/cri-dockerd# systemctl status cri-docker
root@k8s-node2:/tmp# tar -zxf cri-dockerd-0.3.15.amd64.tgz
root@k8s-node2:/tmp# cd cri-dockerd
root@k8s-node2:/tmp/cri-dockerd# ll
total 46844
drwxr-xr-x  2 1001 docker       60 Jul 12  2024 ./
drwxrwxrwt 15 root root        320 Jul 21 15:58 ../
-rwxr-xr-x  1 1001 docker 47968256 Jul 12  2024 cri-dockerd*
root@k8s-node2:/tmp/cri-dockerd# install -o root -g root -m 0755 /tmp/cri-dockerd/cri-dockerd /usr/bin/cri-dockerd
root@k8s-node2:/tmp/cri-dockerd# mkdir -p /usr/lib/systemd/system/
root@k8s-node2:/tmp/cri-dockerd# cat > /etc/systemd/system/cri-docker.service << 'EOF'
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=notify
ExecStart=/usr/bin/cri-dockerd \
  --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock \
  --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.10
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

StartLimitBurst=3
StartLimitInterval=60s

LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

TasksMax=infinity
Delegate=yes
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
root@k8s-node2:/tmp/cri-dockerd# systemctl daemon-reload
root@k8s-node2:/tmp/cri-dockerd# systemctl enable --now cri-docker
root@k8s-node2:/tmp/cri-dockerd# systemctl status cri-docker

安装K8S组件

root@k8s-maste:~# apt install -y apt-transport-https ca-certificates curl
root@k8s-maste:~# mkdir -p /etc/apt/keyrings
root@k8s-maste:~# curl -fsSL https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
root@k8s-maste:~# echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/ /
root@k8s-maste:~# apt update
root@k8s-maste:~# apt install -y kubelet kubeadm kubectl
root@k8s-maste:~# apt-mark hold kubelet kubeadm kubectl
kubelet set on hold.
kubeadm set on hold.
kubectl set on hold.
root@k8s-maste:~# systemctl enable kubelet
root@k8s-maste:~#
root@k8s-node1:~# apt install -y apt-transport-https ca-certificates curl
root@k8s-node1:~# mkdir -p /etc/apt/keyrings
root@k8s-node1:~# curl -fsSL https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
root@k8s-node1:~# echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/ /
root@k8s-node1:~# apt update
root@k8s-node1:~# apt install -y kubelet kubeadm kubectl
root@k8s-node1:~# apt-mark hold kubelet kubeadm kubectl
kubelet set on hold.
kubeadm set on hold.
kubectl set on hold.
root@k8s-node1:~# systemctl enable kubelet
root@k8s-node1:~#
root@k8s-node2:~# apt install -y apt-transport-https ca-certificates curl
root@k8s-node2:~# mkdir -p /etc/apt/keyrings
root@k8s-node2:~# curl -fsSL https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubern         etes-apt-keyring.gpg
root@k8s-node2:~# echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb         / /" | tee /etc/apt/sources.list.d/kubernetes.list
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/deb/ /
root@k8s-node2:~# apt update
root@k8s-node2:~# apt install -y kubelet kubeadm kubectl
root@k8s-node2:~# apt-mark hold kubelet kubeadm kubectl
kubelet set on hold.
kubeadm set on hold.
kubectl set on hold.
root@k8s-node2:~# systemctl enable kubelet
root@k8s-node2:~#

Maste节点初始化

root@k8s-maste:~# kubeadm init \
  --apiserver-advertise-address=192.168.140.136 \
  --image-repository registry.aliyuncs.com/google_containers \
  --kubernetes-version v1.36.2 \
  --service-cidr=10.96.0.0/12 \
  --pod-network-cidr=10.244.0.0/16 \
  --cri-socket=unix:///var/run/cri-dockerd.sock \
  --v=5
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.140.136:6443 --token ua42lo.5fu6f7ja0f0kxbj8 \
        --discovery-token-ca-cert-hash sha256:2272ddacf098c674668766bd96ff471b637f9de950d645040ed13585fcee4c8d
root@k8s-maste:~#
root@k8s-maste:~#
root@k8s-maste:~# mkdir -p $HOME/.kube
root@k8s-maste:~# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
root@k8s-maste:~# chown $(id -u):$(id -g) $HOME/.kube/config
root@k8s-maste:~#

Node节点加入集群

root@k8s-node1:~# kubeadm join 192.168.140.136:6443 --token ua42lo.5fu6f7ja0f0kxbj8 \
        --discovery-token-ca-cert-hash sha256:2272ddacf098c674668766bd96ff471b637f9de950d645040ed13585fcee4c8d \
        --cri-socket=unix:///var/run/cri-dockerd.sock
[preflight] Running pre-flight checks
E0721 16:28:09.486258   14765 remote_runtime.go:1177] "RuntimeConfig from runtime service failed" err="rpc error: code = Unimplemented desc = unknown method RuntimeConfig for service runtime.v1.RuntimeService"
        [WARNING ContainerRuntimeVersion]: You must update your container runtime to a version that supports the CRI method RuntimeConfig. Falling back to using cgroupDriver from kubelet config will be removed in 1.37. For more information, see https://git.k8s.io/enhancements/keps/sig-node/4033-group-driver-detection-over-cri
[preflight] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[preflight] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
W0721 16:28:09.684552   14765 utils.go:69] The recommended value for "bindAddress" in "KubeProxyConfiguration" is: ::; the provided value is: 0.0.0.0
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/instance-config.yaml"
[patches] Applied patch of type "application/strategic-merge-patch+json" to target "kubeletconfiguration"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet at http://127.0.0.1:10248/healthz. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 501.289151ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

root@k8s-node1:~#
root@k8s-node2:~# kubeadm join 192.168.140.136:6443 --token ua42lo.5fu6f7ja0f0kxbj8 \
        --discovery-token-ca-cert-hash sha256:2272ddacf098c674668766bd96ff471b637f9de950d645040ed13585fcee4c8d \
        --cri-socket=unix:///var/run/cri-dockerd.sock
[preflight] Running pre-flight checks
E0721 16:28:26.651878   17949 remote_runtime.go:1177] "RuntimeConfig from runtime service failed" err="rpc error: code = Unimplemented desc = unknown method RuntimeConfig for service runtime.v1.RuntimeService"
        [WARNING ContainerRuntimeVersion]: You must update your container runtime to a version that supports the CRI method RuntimeConfig. Falling back to using cgroupDriver from kubelet config will be removed in 1.37. For more information, see https://git.k8s.io/enhancements/keps/sig-node/4033-group-driver-detection-over-cri
[preflight] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[preflight] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
W0721 16:28:26.846325   17949 utils.go:69] The recommended value for "bindAddress" in "KubeProxyConfiguration" is: ::; the provided value is: 0.0.0.0
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/instance-config.yaml"
[patches] Applied patch of type "application/strategic-merge-patch+json" to target "kubeletconfiguration"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet at http://127.0.0.1:10248/healthz. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 502.530617ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

root@k8s-node2:~#

安装 Calico 网络插件

浏览器打开下面的链接,复制全部内容到Master主机/tmp/calico.yaml

https://raw.githubusercontent.com/projectcalico/calico/v3.29.4/manifests/calico.yaml

root@k8s-maste:~# sed -i 's/# - name: CALICO_IPV4POOL_CIDR/- name: CALICO_IPV4POOL_CIDR/' /tmp/calico.yaml
root@k8s-maste:~# sed -i 's/#   value: "192.168.0.0\/16"/  value: "10.244.0.0\/16"/' /tmp/calico.yaml
root@k8s-maste:~# sed -i 's#docker.io/calico#m.daocloud.io/docker.io/calico#g' /tmp/calico.yaml
root@k8s-maste:~# kubectl apply -f /tmp/calico.yaml
poddisruptionbudget.policy/calico-kube-controllers created
serviceaccount/calico-kube-controllers created

查看节点状态

root@k8s-maste:~# kubectl get nodes
NAME        STATUS   ROLES           AGE   VERSION
k8s-maste   Ready    control-plane   16m   v1.36.2
k8s-node1   Ready    <none>          11m   v1.36.2
k8s-node2   Ready    <none>          10m   v1.36.2
root@k8s-maste:~# kubectl get pods -n kube-system -o wide
NAME                                       READY   STATUS    RESTARTS   AGE     IP                NODE        NOMINATED NODE   READINESS GATES
calico-kube-controllers-76cff55fb5-ncd2q   1/1     Running   0          7m19s   10.244.37.66      k8s-maste   <none>           <none>
calico-node-7c9gn                          1/1     Running   0          7m19s   192.168.140.136   k8s-maste   <none>           <none>
calico-node-8fhlw                          1/1     Running   0          7m19s   192.168.140.138   k8s-node2   <none>           <none>
calico-node-vk22q                          1/1     Running   0          7m19s   192.168.140.137   k8s-node1   <none>           <none>
coredns-6b5f954497-4cs7r                   1/1     Running   0          18m     10.244.37.65      k8s-maste   <none>           <none>
coredns-6b5f954497-l4lkq                   1/1     Running   0          18m     10.244.37.67      k8s-maste   <none>           <none>
etcd-k8s-maste                             1/1     Running   0          18m     192.168.140.136   k8s-maste   <none>           <none>
kube-apiserver-k8s-maste                   1/1     Running   0          18m     192.168.140.136   k8s-maste   <none>           <none>
kube-controller-manager-k8s-maste          1/1     Running   0          18m     192.168.140.136   k8s-maste   <none>           <none>
kube-proxy-2vxn6                           1/1     Running   0          18m     192.168.140.136   k8s-maste   <none>           <none>
kube-proxy-cz9m9                           1/1     Running   0          13m     192.168.140.138   k8s-node2   <none>           <none>
kube-proxy-hdmcs                           1/1     Running   0          13m     192.168.140.137   k8s-node1   <none>           <none>
kube-scheduler-k8s-maste                   1/1     Running   0          18m     192.168.140.136   k8s-maste   <none>           <none>
root@k8s-maste:~#

验证集群

查看集群信息

root@k8s-maste:~# kubectl cluster-info
Kubernetes control plane is running at https://192.168.140.136:6443
CoreDNS is running at https://192.168.140.136:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

查看节点信息

root@k8s-maste:~# kubectl get nodes -o wide
NAME        STATUS   ROLES           AGE   VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE           KERNEL-VERSION             CONTAINER-RUNTIME
k8s-maste   Ready    control-plane   20m   v1.36.2   192.168.140.136   <none>        Ubuntu 26.04 LTS   7.0.0-28-generic (amd64)   docker://29.6.2
k8s-node1   Ready    <none>          15m   v1.36.2   192.168.140.137   <none>        Ubuntu 26.04 LTS   7.0.0-28-generic (amd64)   docker://29.6.2
k8s-node2   Ready    <none>          14m   v1.36.2   192.168.140.138   <none>        Ubuntu 26.04 LTS   7.0.0-28-generic (amd64)   docker://29.6.2

查看组件状态

root@k8s-maste:~# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME                 STATUS    MESSAGE   ERROR
scheduler            Healthy   ok
controller-manager   Healthy   ok
etcd-0               Healthy   ok
root@k8s-maste:~#

部署测试Pod

root@k8s-maste:~# kubectl create deployment nginx-test --image=m.daocloud.io/docker.io/library/nginx:latest
deployment.apps/nginx-test created
root@k8s-maste:~# kubectl get pods -o wide
NAME                          READY   STATUS    RESTARTS   AGE   IP             NODE        NOMINATED NODE   READINESS GATES
nginx-test-7c7896d87d-k45sm   1/1     Running   0          83s   10.244.36.65   k8s-node1   <none>           <none>
root@k8s-maste:~#
root@k8s-maste:~# kubectl expose deployment nginx-test --port=80 --type=NodePort
service/nginx-test exposed
root@k8s-maste:~#
root@k8s-maste:~# kubectl get svc nginx-test
NAME         TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
nginx-test   NodePort   10.98.148.192   <none>        80:30177/TCP   23s
root@k8s-maste:~#

访问测试

图片
640-KmVc
640-AODM
640-lifU

0
K8S

  1. 支付宝打赏

    qrcode alipay

  2. 微信打赏

    qrcode weixin
版权归属： 知夏IT
本文链接： https://zxit.top/archives/di-shi-si-qi--ubuntu26.04-bu-shu-k8sji-qun
许可协议： 本文使用《署名-非商业性使用-相同方式共享 4.0 国际 (CC BY-NC-SA 4.0)》协议授权

评论区