老程序员博客

编程生涯的最后一舞

当前位置：首页 > 技术 > 正文内容

基于二进制部署Kubernetes集群

访客 技术 2026年9月3日 1

环境准备

三台CentOS 7.9虚拟机，配置为2核4GB，需具备外网访问能力。

IP地址 角色
192.168.0.148 k8s-master01
192.168.0.246 k8s-node01
192.168.0.104 k8s-node02

主机名与网络配置

hostnamectl set-hostname k8s-master01
hostnamectl set-hostname k8s-node01
hostnamectl set-hostname k8s-node02

# 编辑 hosts 文件
echo "192.168.0.148 k8s-master01" >> /etc/hosts
echo "192.168.0.246 k8s-node01" >> /etc/hosts
echo "192.168.0.104 k8s-node02" >> /etc/hosts

关闭安全组件

systemctl stop firewalld
systemctl disable firewalld

setenforce 0
sed -i 's/enforcing/disabled/' /etc/selinux/config

swapoff -a
# 编辑 /etc/fstab，注释 swap 行

时间同步

ntpdate time.windows.com

文件下载

Master 节点

mkdir -p /root/kubernetes/resources
cd /root/kubernetes/resources
wget https://dl.k8s.io/v1.18.20/kubernetes-server-linux-amd64.tar.gz
wget https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
wget https://docs.projectcalico.org/v3.19/manifests/calico.yaml

Node 节点

mkdir -p /root/kubernetes/resources
cd /root/kubernetes/resources
wget https://dl.k8s.io/v1.18.20/kubernetes-node-linux-amd64.tar.gz
wget https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz
wget https://github.com/containernetworking/plugins/releases/download/v0.8.6/cni-plugins-linux-amd64-v0.8.6.tgz

部署 etcd 集群

使用 cfssl 工具生成 CA 证书及 etcd 安全通信密钥对。

安装 cfssl

cd /root/kubernetes/resources
cp cfssl_linux-amd64 /usr/bin/cfssl
cp cfssljson_linux-amd64 /usr/bin/cfssljson
cp cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
chmod +x /usr/bin/cfssl /usr/bin/cfssljson /usr/bin/cfssl-certinfo

mkdir -p /etc/etcd/ssl

生成 CA 证书

cd /root/kubernetes/resources/cert/etcd
vim ca-config.json

{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "etcd": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}

vim ca-csr.json

{
  "CN": "etcd ca",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing"
    }
  ]
}

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

生成 etcd 服务证书

vim server-csr.json

{
  "CN": "etcd",
  "hosts": [
    "192.168.0.148",
    "192.168.0.246",
    "192.168.0.104"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing"
    }
  ]
}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd server-csr.json | cfssljson -bare server

分发证书

cp ca.pem server-key.pem server.pem /etc/etcd/ssl
scp ca.pem server-key.pem server.pem k8s-node01:/etc/etcd/ssl
scp ca.pem server-key.pem server.pem k8s-node02:/etc/etcd/ssl

安装 etcd 二进制

cd /root/kubernetes/resources
tar -zxvf etcd-v3.4.9-linux-amd64.tar.gz
cp etcd-v3.4.9-linux-amd64/etcd etcd-v3.4.9-linux-amd64/etcdctl /usr/bin

配置 etcd 服务

在各节点分别创建配置文件：

# /etc/etcd/etcd.conf
[Member]
ETCD_NAME="etcd01"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.0.148:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.0.148:2379"

[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.0.148:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.0.148:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.0.148:2380,etcd02=https://192.168.0.246:2380,etcd03=https://192.168.0.104:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

启动 etcd 服务

mkdir -p /var/lib/etcd
vim /usr/lib/systemd/system/etcd.service

[Unit]
Description=Etcd Server
After=network.target
Wants=network-online.target

[Service]
Type=notify
EnvironmentFile=/etc/etcd/etcd.conf
ExecStart=/usr/bin/etcd \
  --cert-file=/etc/etcd/ssl/server.pem \
  --key-file=/etc/etcd/ssl/server-key.pem \
  --peer-cert-file=/etc/etcd/ssl/server.pem \
  --peer-key-file=/etc/etcd/ssl/server-key.pem \
  --trusted-ca-file=/etc/etcd/ssl/ca.pem \
  --peer-trusted-ca-file=/etc/etcd/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start etcd
systemctl enable etcd

验证集群状态

etcdctl endpoint health \
  --cacert=/etc/etcd/ssl/ca.pem \
  --cert=/etc/etcd/ssl/server.pem \
  --key=/etc/etcd/ssl/server-key.pem \
  --endpoints="https://192.168.0.148:2379,https://192.168.0.246:2379,https://192.168.0.104:2379"

部署 Master 组件

安装 kubectl

cd /root/kubernetes/resources
tar -zxvf kubernetes-server-linux-amd64.tar.gz
cp kubernetes/server/bin/kubectl /usr/bin

生成 Kubernetes 证书

mkdir -p /root/kubernetes/resources/cert/kubernetes /etc/kubernetes/{ssl,bin}
cp kubernetes/server/bin/kube-apiserver kube-controller-manager kube-scheduler /etc/kubernetes/bin
cd /root/kubernetes/resources/cert/kubernetes

CA 配置

vim ca-config.json

{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}

CA 证书生成

vim ca-csr.json

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "kubernetes",
      "OU": "System"
    }
  ]
}

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

API Server 证书

vim kube-apiserver-csr.json

{
  "CN": "kubernetes",
  "hosts": [
    "10.0.0.1",
    "127.0.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local",
    "172.29.7.148",
    "172.29.7.149",
    "172.29.7.150"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing",
      "O": "kubernetes",
      "OU": "System"
    }
  ]
}

生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-apiserver-csr.json | cfssljson -bare kube-apiserver
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

分发 kube-proxy 证书

mkdir -p /etc/kubernetes/ssl
cp ca.pem ca-key.pem kube-apiserver.pem kube-apiserver-key.pem kube-proxy.pem kube-proxy-key.pem /etc/kubernetes/ssl
scp -r /etc/kubernetes/ssl k8s-node01:/etc/kubernetes
scp -r /etc/kubernetes/ssl k8s-node02:/etc/kubernetes

创建 Bootstrap Token

head -c 16 /dev/urandom | od -An -t x | tr -d ' '
# 输出示例：d5c5d767b64db39db132b433e9c45fbc
vim token.csv

d5c5d767b64db39db132b433e9c45fbc,kubelet-bootstrap,10001,"system:node-bootstrapper"

配置 kube-apiserver

vim /etc/kubernetes/apiserver

KUBE_API_ARGS="--logtostderr=false \
--v=2 \
--log-dir=/var/log/kubernetes \
--etcd-servers=https://192.168.0.148:2379,https://192.168.0.246:2379,https://192.168.0.104:2379 \
--bind-address=192.168.0.148 \
--secure-port=6443 \
--advertise-address=192.168.0.148 \
--allow-privileged=true \
--service-cluster-ip-range=10.0.0.0/24 \
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth=true \
--token-auth-file=/etc/kubernetes/token.csv \
--service-node-port-range=30000-32767 \
--kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem \
--kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem \
--tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem \
--tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem \
--client-ca-file=/etc/kubernetes/ssl/ca.pem \
--service-account-key-file=/etc/kubernetes/ssl/ca-key.pem \
--etcd-cafile=/etc/etcd/ssl/ca.pem \
--etcd-certfile=/etc/etcd/ssl/server.pem \
--etcd-keyfile=/etc/etcd/ssl/server-key.pem \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/var/logs/kubernetes/k8s-audit.log"

启动 apiserver 服务

vim /usr/lib/systemd/system/kube-apiserver.service

[Unit]
Description=Kubernetes API Server
After=etcd.service

[Service]
EnvironmentFile=/etc/kubernetes/apiserver
ExecStart=/etc/kubernetes/bin/kube-apiserver $KUBE_API_ARGS
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start kube-apiserver
systemctl enable kube-apiserver

部署 controller-manager 与 scheduler

配置方式类似，略去详细步骤。核心参数包括：

  • controller-manager: 启用 leader-elect，指定 cluster-signing 证书路径
  • scheduler: 启用 leader-elect，绑定本地地址

授权 bootstrap 用户

kubectl create clusterrolebinding kubelet-bootstrap \
  --clusterrole=system:node-bootstrapper \
  --user=kubelet-bootstrap

检查 Master 状态

kubectl get cs

部署 Node 节点

安装 Docker

yum remove docker docker-client docker-common -y
yum install yum-utils -y
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum install docker-ce docker-ce-cli containerd.io -y
systemctl enable docker && systemctl start docker

配置镜像加速器

sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://b9pmyelo.mirror.aliyuncs.com"]
}
EOF

安装 kubelet

cd /root/kubernetes/resources
tar -zxvf kubernetes-node-linux-amd64.tar.gz
mkdir -p /etc/kubernetes/{ssl,bin}
cp kubernetes/node/bin/kubelet kubernetes/node/bin/kube-proxy /etc/kubernetes/bin

配置 kubelet

vim /etc/kubernetes/kubelet

KUBELET_ARGS="--logtostderr=false \
--v=2 \
--log-dir=/var/log/kubernetes \
--enable-server=true \
--kubeconfig=/etc/kubernetes/kubelet.kubeconfig \
--hostname-override=k8s-node01 \
--network-plugin=cni \
--bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig \
--config=/etc/kubernetes/kubelet-config.yml \
--cert-dir=/etc/kubernetes/ssl"

生成 bootstrap.kubeconfig

vim /etc/kubernetes/bootstrap.kubeconfig

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/ssl/ca.pem
    server: https://192.168.0.148:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubelet-bootstrap
  name: default
current-context: default
kind: Config
users:
- name: kubelet-bootstrap
  user:
    token: d5c5d767b64db39db132b433e9c45fbc

配置 kubelet-config.yml

vim /etc/kubernetes/kubelet-config.yml

kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 0.0.0.0
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS:
- 10.0.0.2
clusterDomain: cluster.local
failSwapOn: false
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/ssl/ca.pem
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
evictionHard:
  imagefs.available: 15%
  memory.available: 100Mi
  nodefs.available: 10%
  nodefs.inodesFree: 5%
maxOpenFiles: 1000000
maxPods: 110

启动 kubelet

systemctl daemon-reload
systemctl start kubelet
systemctl enable kubelet

审批 CSR 请求

kubectl get csr
kubectl certificate approve node-csr-xxxxx

安装 kube-proxy

vim /etc/kubernetes/kube-proxy

KUBE_PROXY_ARGS="--logtostderr=false \
--v=2 \
--log-dir=/var/log/kubernetes \
--config=/etc/kubernetes/kube-proxy-config.yml"

配置 kube-proxy-config.yml

vim /etc/kubernetes/kube-proxy-config.yml

kind: KubeProxyConfiguration
apiVersion: kubeproxy.config.k8s.io/v1alpha1
address: 0.0.0.0
metricsBindAddress: 0.0.0.0:10249
clientConnection:
  kubeconfig: /etc/kubernetes/kube-proxy.kubeconfig
hostnameOverride: k8s-node01
clusterCIDR: 10.0.0.0/24
mode: ipvs
ipvs:
  scheduler: "rr"
iptables:
  masqueradeAll: true

启动 kube-proxy

systemctl daemon-reload
systemctl start kube-proxy
systemctl enable kube-proxy

部署 CNI 插件

mkdir -p /opt/cni/bin /etc/cni/net.d
tar -zxvf cni-plugins-linux-amd64-v0.8.6.tgz -C /opt/cni/bin

部署 Calico 网络

kubectl apply -f calico.yaml

测试集群

kubectl create deployment nginx --image=nginx
kubectl expose deployment nginx --port=80 --type=NodePort
curl 192.168.0.246:32063
标签: Kubernetesetcdcfsslcnicalico
返回列表

上一篇：PyTorch 卷积神经网络实现 MNIST 手写数字识别

下一篇：线段树详解：区间修改与查询的高效实现

相关文章

Linux crontab 详解

1) crontab 是什么cron 是 Linux 的定时任务守护进程；crontab 是用来编辑/查看“按时间周期执行命令”的表（cron table）。常见两类：用户 crontab：每个用户一份（crontab -e 编辑）系统级 crontab / cron.d：可指定执行用户（/etc/crontab、/etc/cron.d/*）2) crontab 时间...

富文本里可以允许的 HTML 属性

一、所有标签默认允许的安全属性（极少）class        （可选）id           （通常建议禁用）title️ 注意：id 容易被滥用做锚点注入，很多系统直接禁用class 允许的话最好只允许固定前缀（如 editor-*）二、a 标签允许属性<a href="" t...

Mac 安装 Node.js 指南

方法一：通过官网安装包（最简单，适合初学者）如果你只是想快速安装并开始使用，这是最直接的方法。访问 Node.js 官网。页面会显示两个版本：LTS (Recommended For Most Users)：长期支持版，最稳定。建议选这个。Current：最新特性版，包含最新功能但可能不够稳定。下载 .pkg 安装包并运行。按照安装向导点击“下一步”即可完成。方法二：使用 Homebrew 安装（...

Dom\HTML_NO_DEFAULT_NS 的副作用：自动加闭合标签

在使用Dom\HTMLDocument时，Dom\HTML_NO_DEFAULT_NS 将禁止在解析过程中设置元素的命名空间, 此设置是为了与DOMDocument向后兼容而存在的。当使用它时，已知的一个副作用就是：自动加闭合标签例如 </img> 为什么会这样？当你使用：Dom\HTML_NO_DEFAULT_NS文档会变成 无命名空间模式，此时内部更接近 XML...

Laravel 事件和监听器创建

在 Laravel 中，使用 Artisan 命令创建 Events（事件） 和 Listeners（监听器） 是非常高效的。你可以通过以下几种方式来实现：1. 手动创建单个 Event如果你只想创建一个事件类，可以使用 make:event 命令：Bashphp artisan make:event UserRegistered执行后，文件将生成在 app/Even...

自定义域名解析神器 dnsmasq

什么是 dnsmasq？dnsmasq 是一个轻量级、功能强大的网络服务工具，专为小型和中等规模网络设计。它是一个综合的网络基础设施解决方案[1]。dnsmasq 能做什么？功能说明应用场景DNS 转发与缓存将 DNS 查询转发到上游服务器（ISP、Google DNS 等），并在本地缓存结果加快 DNS 查询速度，减少外部 DNS 流量本地 DNS解析本地网络设备的主机名，无需编辑&n...

发表评论

访客

◎欢迎参与讨论，请在这里发表您的看法和观点。

Copyright © agingcoder.cn

Powered By Z-BlogPHP. Theme by TOYEAN.