一. 准备材料
1.环境相关（可选）
1）ipvs
新增ipvs.module
vim /etc/sysconfig/modules/ipvs.module
#!/bin/bash
ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
for kernel_module in ${ipvs_modules}; do
/sbin/modinfo -F filename ${kernel_module} > /dev/null 2>&1
if [ $? -eq 0 ]; then
/sbin/modprobe ${kernel_module}
fi
done
执行生效
chmod 755 /etc/sysconfig/modules/ipvs.modules sh /etc/sysconfig/modules/ipvs.modules lsmod | grep ip_vs
2)防火墙
K8s集群每个节点都需要关闭防火墙
systemctl stop firewalld && systemctl disable firewalld setenforce 0 sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
3）swap
swapoff -a cp /etc/fstab /etc/fstab.bak cat /etc/fstab.bak | grep -v swap > /etc/fstab
4)iptables
直接关闭（测试环境）、/etc/sysctl.conf添加
net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1
避免偶现dns解析失败
5)sysctl修改
/etc/sysctl.conf添加
vm.swappiness = 0 net.ipv4.ip_forward = 1
6)配置生效
sysctl -p
7）注意如果是K8s 集群， 主机名不可一致，若一致需要调整主机名
hostnamectl set-hostname
2. Docker+K8s yum源配置
可以使用aliyun的源，也可以使用清华源进行安装
aliyun:
docker-yum: http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
k8s-image:kubernetes-yum-repos-kubernetes-el7-x86_64安装包下载_开源镜像站-阿里云
清华源：
docker-rpm-yum:Index of /docker-ce/linux/ | 清华大学开源软件镜像站 | Tsinghua Open Source Mirror
1）docker安装
yum install -y yum-utils device-mapper-persistent-data lvm2 yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo yum makecache fast yum install docker-ce -y systemctl restart docker systemctl enable docker
2）配置k8s源
cat </etc/yum.repos.d/k8s.repo [k8s] name=k8s enabled=1 gpgcheck=0 baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ EOF
3) k8s 启动
#安装kube yum install -y kubelet-1.21.0-0 kubeadm-1.21.0-0 kubectl-1.21.0-0 #自启动 kubelet systemctl daemon-reload && systemctl enable kubelet
3. 获取K8s相关镜像
前提：已安装kubeadm成功
1) kubeadm config images list --kubernetes-version=v1.21.0
获取相关镜像地址
k8s.gcr.io/kube-apiserver:v1.21.0
k8s.gcr.io/kube-controller-manager:v1.21.0
k8s.gcr.io/kube-scheduler:v1.21.0
k8s.gcr.io/kube-proxy:v1.21.0
k8s.gcr.io/pause:3.2
k8s.gcr.io/etcd:3.4.3-0
k8s.gcr.io/coredns:1.6.7
注：k8s.gcr.io 国内可能连不上。
| 处理方案1. 可通过docker search kube-apiserver:v1.21.0 查到： 可通过 docker pull louwy001/kube-apiserver 下载， tag 改名后，push 到私有仓库 |
| 处理方案2. kubeadm config images list --kubernetes-version=v1.21.0 --image-repository louwy001 |
#从hub.docker.com 登录后拉取，coredns/coredns已经没有1.8.0 暂用1.8.3代替 docker pull louwy001/kube-apiserver:v1.21.0 docker pull louwy001/kube-proxy:v1.21.0 docker pull louwy001/kube-controller-manager:v1.21.0 docker pull louwy001/kube-scheduler:v1.21.0 docker pull coredns/coredns:1.8.3 docker pull louwy001/pause:3.4.1 docker pull louwy001/etcd:3.4.13-0 docker save louwy001/kube-apiserver:v1.21.0 >kube-apiserver_v1.21.0.tar docker save louwy001/kube-proxy:v1.21.0 >kube-proxy_v1.21.0.tar docker save louwy001/kube-controller-manager:v1.21.0 >kube-controller-manager_v1.21.0.tar docker save louwy001/kube-scheduler:v1.21.0 >kube-scheduler_v1.21.0.tar docker save coredns/coredns:1.8.3 >coredns_1.8.3.tar docker save louwy001/pause:3.4.1 >pause_3.4.1.tar docker save louwy001/etcd:3.4.13-0 >etcd_3.4.13-0.tar docker load -i kube-apiserver_v1.21.0.tar docker load -i kube-proxy_v1.21.0.tar docker load -i kube-controller-manager_v1.21.0.tar docker load -i kube-scheduler_v1.21.0.tar docker load -i coredns_1.8.3.tar docker load -i pause_3.4.1.tar docker load -i etcd_3.4.13-0.tar docker tag louwy001/kube-apiserver:v1.21.0 k8s.gcr.io/kube-apiserver:v1.21.0 docker tag louwy001/kube-proxy:v1.21.0 k8s.gcr.io/kube-proxy:v1.21.0 docker tag louwy001/kube-controller-manager:v1.21.0 k8s.gcr.io/kube-controller-manager:v1.21.0 docker tag louwy001/kube-scheduler:v1.21.0 k8s.gcr.io/kube-scheduler:v1.21.0 docker tag coredns/coredns:1.8.3 k8s.gcr.io/coredns/coredns:v1.8.0 docker tag louwy001/pause:3.4.1 k8s.gcr.io/pause:3.4.1 docker tag louwy001/etcd:3.4.13-0 k8s.gcr.io/etcd:3.4.13-0
另注：
| 如果使用私有库，且私有库为http 协议,docker login 的时候可能会报
原因：docker 默认是https，因为没有配置证书，所以必须添加非安全的registry 配置 /etc/docker/daemon.json
systemctl restart docker |
另注：
若已部署过低版本kube , 删除子node的服务器, 期望部署新版本需要执行 rm -rf /var/lib/kubelet/*
避免残留配置影响部署。
如果从1.18-1.21 需要注意：
部署时遇到
coredns未启动，有以下报错内容
E0610 03:14:30.260507 1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.20.2/tools/cache/reflector.go:167: Failed to watch *v1beta1.EndpointSlice: failed to list *v1beta1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:kube-system:coredns" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope
是coredns的一个bug, 需要修改coredns角色权限
kubectl edit clusterrole system:coredns
最后追加
- apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - list - watch
<未完待续，将开始master配置及集群创建>
