kubeadm安装集群系列-1.基础服务安装

基础服务

本文基于centos7.5部署

规划

10.8.28.200	master-VIP
10.8.31.84	k8s-test-master-1
10.8.152.149	k8s-test-master-2
10.8.191.56	k8s-test-master-3
10.8.85.173	k8s-test-node-1

将host信息写入hosts文件

系统调优

 # 关闭swap
 swapoff -a
 yes | cp /etc/fstab /etc/fstab_bak
 cat /etc/fstab_bak |grep -v swap > /etc/fstab

 # 关闭selinux
 setenforce  \
 && sed -i 's/^SELINUX=.*$/SELINUX=disabled/' /etc/selinux/config \
 && getenforce

 # 关闭防火墙
 systemctl stop firewalld \
 && systemctl daemon-reload \
 && systemctl disable firewalld \
 && systemctl daemon-reload \
 && systemctl status firewalld

 yum install -y iptables-services \
 && systemctl stop iptables \
 && systemctl disable iptables \
 && systemctl status iptables

 # 系统参数调优
 [ ! -e "/etc/sysctl.conf_bk" ] && /bin/mv /etc/sysctl.conf{,_bk} \
 && cat > /etc/sysctl.conf << EOF
 fs.file-max=
 fs.nr_open=
 net.ipv4.tcp_max_tw_buckets =
 net.ipv4.tcp_sack =
 net.ipv4.tcp_window_scaling =
 net.ipv4.tcp_rmem =
 net.ipv4.tcp_wmem =
 net.ipv4.tcp_max_syn_backlog =
 net.core.netdev_max_backlog =
 net.core.somaxconn =
 net.core.wmem_default =
 net.core.rmem_default =
 net.core.rmem_max =
 net.core.wmem_max =
 net.ipv4.tcp_timestamps =
 net.ipv4.tcp_fin_timeout =
 net.ipv4.tcp_synack_retries =
 net.ipv4.tcp_syn_retries =
 net.ipv4.tcp_syncookies =
 #net.ipv4.tcp_tw_len =
 net.ipv4.tcp_tw_reuse =
 net.ipv4.tcp_mem =
 net.ipv4.tcp_max_orphans =
 net.ipv4.ip_local_port_range =
 #net.nf_conntrack_max =
 #net.netfilter.nf_conntrack_max =
 #net.netfilter.nf_conntrack_tcp_timeout_close_wait =
 #net.netfilter.nf_conntrack_tcp_timeout_fin_wait =
 #net.netfilter.nf_conntrack_tcp_timeout_time_wait =
 #net.netfilter.nf_conntrack_tcp_timeout_established =
 EOF
 sysctl -p

 # k8s部分参数调优
 cat <<EOF >  /etc/sysctl.d/k8s.conf
 net.bridge.bridge-nf-call-ip6tables =
 net.bridge.bridge-nf-call-iptables =
 net.ipv4.ip_nonlocal_bind =
 net.ipv4.ip_forward =
 vm.swappiness=
 EOF
 sysctl -p /etc/sysctl.d/k8s.conf

 # 开启ipvs
 cat > /etc/sysconfig/modules/ipvs.modules <<EOF
 #!/bin/bash
 modprobe -- ip_vs
 modprobe -- ip_vs_rr
 modprobe -- ip_vs_wrr
 modprobe -- ip_vs_sh
 modprobe -- nf_conntrack_ipv4
 EOF
 chmod  /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4

 # 制作镜像（正常安装无需执行）
 echo "mkdir -p /data/docker" >> /etc/rc.d/rc.local
 echo "swapoff -a" >> /etc/rc.d/rc.local

安装docker

 # 拉取rpm文件，国内可以从阿里源下载
 mkdir -p /data/init/docker && cd /data/init/docker
 wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.09.8-3.el7.x86_64.rpm
 wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm
 wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-cli-18.09.8-3.el7.x86_64.rpm
 yum install -y containerd.io-1.2.-3.3.el7.x86_64.rpm docker-ce-cli-18.09.-.el7.x86_64.rpm docker-ce-18.09.-.el7.x86_64.rpm

 # 创建docker目录，修改docker运行参数
 mkdir /data/docker
 cat << EOF >/etc/sysconfig/docker
 INSECURE_REGISTRY="--insecure-registry=harbor.test123.net"
 DOCKER_NETWORK_OPTIONS="-H fd:// --containerd=/run/containerd/containerd.sock"
 DOCKER_STORAGE_OPTIONS="--data-root=/data/docker --storage-driver=overlay2"
 EOF

 # 编辑system unit文件
 cat << EOF > /usr/lib/systemd/system/docker.service
 [Unit]
 Description=Docker Application Container Engine
 Documentation=https://docs.docker.com
 BindsTo=containerd.service
 After=network-online.target firewalld.service containerd.service
 Wants=network-online.target
 Requires=docker.socket

 [Service]
 Type=notify
 EnvironmentFile=-/etc/sysconfig/docker
 ExecStart=/usr/bin/dockerd \\
           \$INSECURE_REGISTRY \\
           \$DOCKER_STORAGE_OPTIONS \\
           \$DOCKER_NETWORK_OPTIONS
 ExecReload=/bin/kill -s HUP \$MAINPID
 TimeoutSec=
 RestartSec=
 Restart=always
 StartLimitBurst=
 StartLimitInterval=60s
 LimitNOFILE=infinity
 LimitNPROC=infinity
 LimitCORE=infinity
 TasksMax=infinity
 Delegate=yes
 KillMode=process

 [Install]
 WantedBy=multi-user.target

 EOF

 # 启动docker
 systemctl daemon-reload
 systemctl restart docker.service
 systemctl enable docker.service

 # 验证
 docker info
 docker version

安装kubeadm/kubelet/kubectl(选装)

 cat <<EOF > /etc/yum.repos.d/kubernetes.repo
 [kubernetes]
 name=Kubernetes
 baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
 enabled=
 gpgcheck=
 repo_gpgcheck=
 gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
 EOF

 yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes

 systemctl enable --now kubelet

预下载镜像

 kubeadm config images pull
 [config/images] Pulled k8s.gcr.io/kube-apiserver:v1.15.1
 [config/images] Pulled k8s.gcr.io/kube-controller-manager:v1.15.1
 [config/images] Pulled k8s.gcr.io/kube-scheduler:v1.15.1
 [config/images] Pulled k8s.gcr.io/kube-proxy:v1.15.1
 [config/images] Pulled k8s.gcr.io/pause:3.1
 [config/images] Pulled k8s.gcr.io/etcd:3.3.
 [config/images] Pulled k8s.gcr.io/coredns:1.3.

master-1到其他master免密

 # master-1执行
 ssh-keygen
 ssh-copy-id -i /root/.ssh/id_rsa.pub -p  root@k8s-test-master-
 ssh-copy-id -i /root/.ssh/id_rsa.pub -p  root@k8s-test-master-