# install-k8s

**Repository Path**: Sunjie2021/install-k8s

## Basic Information

- **Project Name**: install-k8s
- **Description**: No description available
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 1
- **Forks**: 1
- **Created**: 2024-05-08
- **Last Updated**: 2025-12-11

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# 安装K8s

## 配置

#### 1.Ubuntu

```shell
#开启内核转发
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

#开启ipvs
cat >> /etc/modules-load.d/ipvs.conf <<EOF 
ip_vs
ip_vs_rr
ip_vs_wrr
ip_vs_sh
nf_conntrack
ip_tables
ip_set
xt_set
ipt_set
ipt_rpfilter
ipt_REJECT
ipip
EOF

#开机重载
systemctl restart systemd-modules-load.service
```

#### 2.Linux

```shell
#开启网桥
cat >> /etc/sysconfig/modules/br_netfilter.modules <<EOF
modprobe br_netfilter
EOF

cat >> /etc/sysconfig/modules/overlay.modules <<EOF
modprobe overlay
EOF

cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
## 如果是高版本内核使用
modprobe -- nf_conntrack_ipv4
#modprobe -- nf_conntrack
EOF

#开启开机自启动
cat  >> /etc/rc.sysinit <<EOF
#!/bin/bash
for file in /etc/sysconfig/modules/*.modules
do
[ -x \$file ] && \$file
done
EOF

#添加权限

chmod 755 /etc/sysconfig/modules/br_netfilter.modules
chmod 755 /etc/sysconfig/modules/overlay.modules
chmod 755 /etc/sysconfig/modules/ipvs.modules
chmod 755 /etc/rc.sysinit

bash /etc/rc.sysinit
```

### 通用配置

```shell
#开启最大文件数
ulimit -SHn 65535
cat >> /etc/security/limits.conf <<EOF
* soft nofile 655360
* hard nofile 131072
* soft nproc 655350
* hard nproc 655350
* seft memlock unlimited
* hard memlock unlimited
EOF

#关闭swap
swapoff -a
vim /etc/fstab
#注释
#/swap.img      none    swap    sw      0       0



#内核参数
cat <<EOF > /etc/sysctl.d/k8s.conf
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
user.max_user_namesapces = 28633
vm.swappiness = 0
EOF

#加载参数
sysctl -p /etc/sysctl.d/k8s.conf
```



### 系统配置

#### 1.Ubuntu

```shell
# 对于 Ubuntu
apt update && apt upgrade -y && apt install -y wget psmisc vim net-tools nfs-kernel-server telnet lvm2 git tar curl ipvsadm ipset sysstat conntrack -y
```

#### 2.Linux

```shell
# 对于 CentOS 7
yum update -y && yum -y install  wget psmisc vim net-tools nfs-utils telnet yum-utils device-mapper-persistent-data lvm2 git tar curl
# 对于 CentOS 8
yum update -y && yum -y install wget psmisc vim net-tools nfs-utils telnet yum-utils device-mapper-persistent-data lvm2 git network-scripts tar curl
```

## 安装容器组件

### 安装Docker(可选)

#### 1.Linux

```shell
# 添加源
yum install yum-utils -y
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

# 安装
yum install docker-ce -y
```

#### 2.Ubuntu

```shell
# 添加源
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"

# 安装
apt install docker-ce -y
```

#### 3.配置文件修改

```shell
cat > /etc/docker/daemon.json <<EOF
{ 
   "registry-mirrors":["https://vcnqxbqf.mirror.aliyuncs.com"],
   "exec-opts":["native.cgroupdriver=systemd"],
   "insecure-registries": ["harbor"],
   "experimental": true,
   "log-driver":"json-file",
   "log-opts": { "max-size": "100m", "max-file": "5" },
   "storage-driver": "overlay2" 
   }
EOF

systemctl daemon-reload
systemctl restart docker
```

##### 3.1.如果使用docker作为1.24之后的容器运行，需要安装cri-dockerd
```shell
#下载地址
https://github.com/Mirantis/cri-dockerd/releases
#systemd文件
https://github.com/Mirantis/cri-dockerd/tree/master/packaging/systemd
```
###### 3.1.1. 配置文件
```shell
# cir-docker.service
cat > /usr/lib/systemd/system/cri-docker.service <<EOF
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=cri-docker.socket
[Service]

Type=notify

ExecStart=/usr/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.7

ExecReload=/bin/kill -s HUP $MAINPID

TimeoutSec=0

RestartSec=2

Restart=always
StartLimitBurst=3
StartLimitInterval=60s
LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity
TasksMax=infinity

Delegate=yes

KillMode=process
[Install]

WantedBy=multi-user.target
EOF

#cri-docker.sock
cat > /usr/lib/systemd/system/cri-docker.socket <<EOF
[Unit]
Description=CRI Docker Socket for the API
PartOf=cri-docker.service
[Socket]

ListenStream=%t/cri-dockerd.sock

SocketMode=0660

SocketUser=root

SocketGroup=docker
[Install]

WantedBy=sockets.target
EOF
```


### 安装Containerd

#### 1.Linux

```shell
# 配置源
yum install yum-utils -y
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# 安装
yum install  containerd.io -y
```

#### 2.Ubuntu

```shell
# 配置源
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
# 安装
apt install containerd.io -y
```

#### 3.通用配置

```shell
# 配置containerd
mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml

sed -i "s#SystemdCgroup\ \=\ false#SystemdCgroup\ \=\ true#g" /etc/containerd/config.toml
sed -i "s#registry.k8s.io#registry.aliyuncs.com/google_containers#g" /etc/containerd/config.toml
sed -i "s#config_path\ \=\ \"\"#config_path\ \=\ \"/etc/containerd/certs.d\"#g" /etc/containerd/config.toml
# 验证
cat /etc/containerd/config.toml | grep certs.d
cat /etc/containerd/config.toml | grep SystemdCgroup
cat /etc/containerd/config.toml | grep sandbox_image


# 修改crictl配置
cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF
# 使用docker
cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/cri-dockerd.sock
image-endpoint: unix:///run/cri-dockerd.sock
timeout: 10
debug: false
EOF

# 配置contained策略
mkdir /etc/containerd/certs.d/docker.io/ -p
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://docker.io"
[host."https://vh3bm52y.mirror.aliyuncs.com"]
  capabilities = ["pull", "resolve"]
EOF

# 重启
systemctl daemon-reload
systemctl restart containerd
systemctl enable containerd
```

## 安装K8s组件

### 安装kubectl,kubeadm,kubelet

#### 1.Liunx

```shell
# 添加镜像源
cat  > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg     https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
# 分版本安装
v=1.25.6
yum install -y kubelet-$v kubeadm-$v kubectl-$v
# kubelet不用启动
systemctl enable kubelet
```

#### 2.Ubuntu

```shell
# 添加源
cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb http://mirrors.aliyun.com/kubernetes/apt kubernetes-xenial main
EOF

# 运行一次
apt-get update

# 出现报错，将key加入信任：B53DC80D13EDEF05
W: GPG error: http://mirrors.ustc.edu.cn/kubernetes/apt kubernetes-xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05

# 添加信任
apt-key adv --recv-keys --keyserver keyserver.ubuntu.com B53DC80D13EDEF05

# 再次执行
apt-get update
apt install kubelet kubeadm kubectl -y

apt install kubelet=1.16.15-00 kubeadm=1.16.15-00 kubectl=1.16.15-00 -y
```

#### 3.通用配置

```shell
# 初始化kubeadm文件，只在master节点做
kubeadm config print init-defaults > kubeadm.yaml
# 修改配置

advertiseAddress（masterip）
nodeRegistration.name改成hostname（master）
criSocket: unix:///var/run/containerd/containerd.sock
imageRepository: registry.aliyuncs.com/google_containers
networking.serviceSubnet：
networking.podSubnet：#指定pod的ip段
#追加
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
```

##### kubeadm.conf模板

```conf
apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 172.168.10.100
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///var/run/containerd/containerd.sock
  #criSocket: unix:///var/run/cri-dockerd.sock
  imagePullPolicy: IfNotPresent
  name: master1
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: 1.28.0
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
  podSubnet: 10.223.0.0/12
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
```

#### 4.初始化节点

```shell
# master初始化节点
kubeadm init --config=kubeadm.yaml --ignore-preflight-errors=SystemVerification

# 加入配置
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
  
# 加入node节点
# 命令可通过
kubeadm token create --print-join-command
# 在node上输入
kubeadm join 172.168.10.100:6443 --token abcdef.0123456789abcdef \
        --discovery-token-ca-cert-hash sha256:ed12de1515708b45edb9bc60599878f7c9aa46ee60d9b758807204617e36e732
```

#### 5.为节点打上rules

```shell
# 添加rules
kubectl label nodes node1 node-role.kubernetes.io/worker=
# 删除rules
kubectl label nodes node1 node-role.kubernetes.io/worker=""-
```

### 安装calico

站点

https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart

```shell
# 下载
curl https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calico.yaml -O
# 安装
kubectl apply -f calico.yaml
```