基于Kubeadm的Kubernetes集群搭建(containerd)(CentOS7)

[root@k8s-master-1 ~]# setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config     

查看防火墙状态： systemctl status firewalld.service     
关闭防火墙命令： systemctl stop firewalld.service        
禁用防火墙命令： systemctl disable firewalld.service      

[root@k8s-master-1 ~]# swapoff -a && sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

[root@k8s-master-1 ~]# vi /etc/hosts

yum -y install iptables-services && systemctl start iptables && systemctl enable iptables
# yum -y install iptables-services && systemctl start iptables && systemctl enable iptables && iptables -F && service iptables save

modprobe br_netfilter 
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4

cat > kubernetes.conf <<EOF
net.bridge.bridge-nf-call-iptables=1 # 为了让 Linux 节点的 iptables 能够正确查看桥接流量，请确认 sysctl 配置中的 net.bridge.bridge-nf-call-iptables 设置为 1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0 # 禁止使用 swap 空间，只有当系统 OOM 时才允许使用它 vm.overcommit_memory=1 # 不检查物理内存是否够用
vm.panic_on_oom=0 # 开启 OOM
fs.inotify.max_user_instances=8192
fs.inotify.max_user_watches=1048576
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF
cp kubernetes.conf /etc/sysctl.d/kubernetes.conf
sysctl -p /etc/sysctl.d/kubernetes.conf

# 安装需要的软件包， yum-util 提供yum-config-manager功能，另外两个是devicemapper驱动依赖的
yum install -y yum-utils device-mapper-persistent-data lvm2
# 设置 yum 源
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install containerd -y

$ containerd config default > /etc/containerd/config.toml
$ systemctl restart containerd
$ systemctl status containerd

# 替换 containerd 默认的 sand_box 镜像，编辑 /etc/containerd/config.toml

sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.2"

# 重启containerd
$ systemctl daemon-reload
$ systemctl restart containerd      

# https://github.com/kubernetes-sigs/cri-tools/releases/ 选择版本
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.26.0/crictl-v1.26.0-linux-amd64.tar.gz
sudo tar zxvf crictl-v1.26.0-linux-amd64.tar.gz -C /usr/local/bin

vi /etc/crictl.yaml 
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false

# 验证是否可用
crictl  pull nginx:alpine
crictl  rmi  nginx:alpine
crictl  images

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
# 删除旧版本，如果安装了
# yum remove kubeadm kubectl kubelet kubernetes-cni cri-tools socat 

# 安装指定版本用下面的命令
# yum -y install kubeadm-1.26.0 kubectl-1.26.0 kubelet-1.26.0

# 默认安装最新稳定版，当前版本1.26.0
yum install kubeadm kubectl kubelet

# 查看所有可安装版本
# yum --showduplicates list kubeadm

# 开机自启
systemctl enable kubelet.service

$ vi /usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf
# 加入下面内容
Environment="KUBELET_EXTRA_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock"

kubeadm config print init-defaults > kubeadm-config.yaml
#修改 kubeadm-config.yaml文件如下部分
localAPIEndpoint:
advertiseAddress: 192.168.28.101（这里的ip修改为主机ip）
# 默认拉取镜像地址k8s.gcr.io国内无法访问，指定阿里云镜像仓库地址
imageRepository: registry.aliyuncs.com/google_containers
# kubernetes 版本
kubernetesVersion: v1.26.0
nodeRegistration:
    criSocket: /run/containerd/containerd.sock # 这里的内容修改下
# networking组下新增一行 podSubnet: "10.244.0.0/16" flannel默认使用的网断
networking:
podSubnet: "10.244.0.0/16"
serviceSubnet: 10.96.0.0/12

# 将 kube-proxy 默认的调度方式改为ipvs
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs

# 初始化 --experimental-upload-certs 给其它主节点自动颁发证书 tee kubeadm-init.log 把所有信息写入文件中
kubeadm init --config=kubeadm-config.yaml --upload-certs | tee kubeadm-init.log

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

# 在https://www.ipaddress.com/查询raw.githubusercontent.com的真实IP。
sudo vim /etc/hosts
199.232.28.133 raw.githubusercontent.com

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum install -y --nogpgcheck kubelet kubeadm kubectl
systemctl enable kubelet && systemctl start kubelet

kubeadm join 192.168.1.162:6443 --token ****** \
--discovery-token-ca-cert-hash sha256:eb138b1edc2436d8de9ee844392059caecdadbc6e9c2bf6729f8ee2e6151c953

[root@k8s-master-1 ~]# kubectl get node