系统初始化

安装kubeadm相关工具

KUBERNETES_VERSION=v1.30
CRIO_VERSION=v1.30
apt-get update
apt-get install -y software-properties-common curl
mkdir /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/deb/Release.key |
    gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/deb/ /" |
    tee /etc/apt/sources.list.d/kubernetes.list
    
apt-get update
apt-get install -y kubelet kubeadm kubectl

安装容器运行时

以下容器运行时只能选择安装其中一个

1. crio

crio官方文档内写的很清楚，但是我没有验证过

2. cri-docker

下载docker

sudo apt install docker-ce docker-ce-cli containerd.io

配置docker

使用命令sudo vim /etc/docker/daemon.json写入如下内容

{
  "registry-mirrors": [
    	"https://dockerpull.com",
        "https://docker.anyhub.us.kg",
        "https://dockerhub.jobcher.com",
        "https://dockerhub.icu",
        "https://docker.awsl9527.cn"
    ],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "20m",
    "max-file": "5"
  },
  "storage-driver": "overlay2",
  "exec-opts": ["native.cgroupdriver=systemd"]
}

拉取pause镜像

使用docker指定pause镜像似乎有bug，我们需要把它拉下来重命名成默认的仓库的名字

sudo docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9
sudo docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9 registry.k8s.io/pause:3.9

安装cri-docker

下载

wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.15/cri-dockerd-0.3.15.arm64.tgz -O cri-dockerd.tgz
tar -zxvf cri-dockerd.tgz
mv ./cri-dockerd/cri-dockerd /usr/local/bin/cri-dockerd

设置开机自启

使用命令sudo vim /etc/systemd/system/cri-docker.service后输入如下内容

[Unit]
Description=CRI Docker daemon
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=notify
ExecStart=/usr/local/bin/cri-dockerd
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

执行如下命令

sudo systemctl start cri-docker.service
sudo systemctl enable cri-docker.service

配置操作系统

配置host

使用命令sudo vim /etc/hosts，在文件末尾加上一行，不同node改成对应ip

127.0.0.1       pi-192-168-10-201

防火墙内核

使用命令sudo vim /etc/modules-load.d/br_netfilter.conf，在新文件内写入

br_netfilter

打开ipv4转发

使用命令sudo vim /etc/sysctl.conf，在文件末尾加上一行

net.ipv4.ip_forward = 1

关闭swap

使用命令sudo vim /etc/dphys-swapfile，找到对应配置，CONF_SWAPSIZE改成0

CONF_SWAPSIZE=0

配置cgroup

使用命令/boot/cmdline.txt，在行最后面加上cgroup_enable=memory swapaccount=1

重启使上面配置生效

sudo reboot

安装kubernetes集群

安装集群前，每个机器都要完成上面的初始化操作

初始化集群

配置文件

使用命令sudo vim /etc/kubernetes/kubeadm-config.yaml，写入如下内容

apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
nodeRegistration:
  criSocket: "unix:///var/run/cri-dockerd.sock" # 如果是crio改成对应的sock文件
  name: pi-192-168-10-201  # 这里需要根据每个节点修改
  kubeletExtraArgs:
    cgroup-driver: systemd
    node-ip: 192.168.10.201  # 这里需要根据每个节点修改

---
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: v1.30.6
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
controlPlaneEndpoint: "192.168.10.100:9443" # 这边使用了负载均衡器ip，参考上篇文章，如果没有则用当前node的apiServer地址，比如192.168.10.201:6443
networking:
  podSubnet: "10.244.0.0/16"
  serviceSubnet: "169.169.0.0/16"
etcd: # 这边使用上篇文章手动部署的etcd, 如果需要部署新的etcd, 把external部分删除
  external:
    endpoints:
      - https://192.168.10.201:2379
      - https://192.168.10.202:2379
      - https://192.168.10.203:2379
    caFile: /etc/etcd/pki/ca.crt
    certFile: /etc/etcd/pki/etcd_client.crt
    keyFile: /etc/etcd/pki/etcd_client.key
apiServer:
  certSANs:
    - "kubernetes" # incluster的apiserver的service地址
    - "kubernetes.default"
    - "kubernetes.default.svc"
    - "kubernetes.default.svc.cluster.local" 
    - "pi-192-168-10-201" # master主机名列表
    - "pi-192-168-10-202"
    - "pi-192-168-10-203"
    - "169.169.0.1" # incluster的apiserver地址
    - "192.168.10.201" # master主机ip列表
    - "192.168.10.202"
    - "192.168.10.203"
    - "192.168.10.100" # 负载均衡器ip, 没有负载均衡器可以去掉
  extraArgs:
    authorization-mode: Node,RBAC
    enable-admission-plugins: NodeRestriction
    oidc-client-id: "xxxx" # oidc相关配置，没有oidc可以去掉这些’oidc-‘开头的参数
    oidc-username-claim: "email"
    oidc-username-prefix: "-"
    oidc-groups-claim: "groups"
    oidc-groups-prefix: "oidc:"
    oidc-issuer-url: "xxxx"
certificatesDir: /etc/kubernetes/pki

---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: iptables

执行初始化