Kubernetes高可用集群部署指南
架构
| IP | 角色 | 操作系统 |
|---|---|---|
| 192.168.31.100 | Master | Rocky 9.5 |
| 192.168.31.101 | Master | Rocky 9.5 |
| 192.168.31.102 | Master | Rocky 9.5 |
| 192.168.31.111 | Node | Rocky 9.5 |
| 192.168.31.112 | Node | Rocky 9.5 |
| 192.168.31.113 | Node | Rocky 9.5 |
| 192.168.31.105 | VIP | / |
我们使用VIP作为统一入口以避免单点故障，所有节点需在同一二层网络中。
环境初始化
包括修改主机名、hosts文件、禁用SELinux和防火墙、同步系统时间等基础配置。
安装Containerd
wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo yum install -y containerd.io containerd config default > /etc/containerd/config.toml sed -i 's/sandbox_image = "k8s.gcr.io\/pause:3.6"/sandbox_image = "registry.aliyuncs.com\/google_containers\/pause:3.10"/' /etc/containerd/config.toml sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml systemctl start containerd systemctl enable containerd
安装Kubernetes基础组件
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.32/rpm/ enabled=1 gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.32/rpm/repodata/repomd.xml.key EOF yum install -y kubelet kubeadm kubectl systemctl start kubelet systemctl enable kubelet </pre>配置内核参数
cat <<EOF | sudo tee /etc/sysctl.d/kubernetes.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv4.ip_forward = 1 EOF sysctl --system cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf br_netfilter EOF </pre>配置VIP
在192.168.31.100和192.168.31.101两台服务器上配置keepalived：
yum install -y keepalived # 在192.168.31.100上 cat <<EOF | sudo tee /etc/keepalived/keepalived.conf ! Configuration File for keepalived global_defs { router_id LVS_DEVEL } vrrp_instance VI_1 { state MASTER interface ens3 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.31.105 } } EOF # 在192.168.31.101上 cat <<EOF | sudo tee /etc/keepalived/keepalived.conf ! Configuration File for keepalived global_defs { router_id LVS_DEVEL } vrrp_instance VI_1 { state BACKUP interface ens3 virtual_router_id 51 priority 50 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.31.105 } } EOF systemctl start keepalived systemctl enable keepalived </pre>准备集群配置文件
cat <<EOF | sudo tee kubeadm-config.yaml apiVersion: kubeadm.k8s.io/v1beta4 bootstrapTokens: - groups: - system:bootstrappers:kubeadm:default-node-token token: abcdef.1234567890abcdef ttl: 24h0m0s usages: - signing - authentication kind: InitConfiguration nodeRegistration: criSocket: unix:///var/run/containerd/containerd.sock imagePullPolicy: IfNotPresent imagePullSerial: true --- apiVersion: kubeadm.k8s.io/v1beta4 certificatesDir: /etc/kubernetes/pki clusterName: kubernetes controlPlaneEndpoint: 192.168.31.105:6443 controllerManager: {} dns: {} etcd: local: dataDir: /var/lib/etcd imageRepository: registry.aliyuncs.com/google_containers kind: ClusterConfiguration kubernetesVersion: v1.32.2 networking: dnsDomain: cluster.local podSubnet: 10.20.0.0/16 serviceSubnet: 10.10.0.0/16 proxy: {} scheduler: {} apiServer: certSANs: - 192.168.31.105 - 192.168.31.100 - 192.168.31.101 - 192.168.31.102 - 127.0.0.1 caCertificateValidityPeriod: 876000h0m0s certificateValidityPeriod: 876000h0m0s EOF </pre>安装集群
kubeadm init --config=kubeadm-config.yaml --upload-certs mkdir -p $HOME/.kube cp -i /etc/kubernetes/admin.conf $HOME/.kube/config添加网络插件
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml sed -i 's/10.244.0.0/10.20.0.0/' kube-flannel.yml kubectl apply -f kube-flannel.yml检查集群状态
kubectl get nodes kubectl get pods --all-namespaces检查高可用性和证书
关闭其中一个Master节点后，检查集群状态和VIP漂移情况。
kubeadm certs check-expiration openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate
