Skip to content

Commit b45de3a

Browse files
author
Xiaolong He
committed
init-k8s
0 parents  commit b45de3a

28 files changed

+3127
-0
lines changed

‎README.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Kubernetes 部署
2+
3+
> Time: 2020.11.11 by [email protected]
4+
5+
本文档主要介绍了基于 Vagrant/kubeadm 部署 kubernetes 测试环境..
6+
7+
- ansible_k8s 基于 ansible 环境一键可以完成 Kubernetes 环境部署
8+
- kubeadm_k8s 手动介绍了高可用 kubernetes 环境的部署
9+
10+
如果您在使用中有任何问题，欢迎与我联系..

‎ansible_k8s/README.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Ansible 部署 Kubernetes
2+
3+
> Time: 2020.11.11
4+
5+
使用 Kubeadm 部署 Kubernetes...
6+
7+
> 需要注意 Mac 上安装好 ansible/vagrant
8+
9+
## Step1. 准备测试环境
10+
11+
安装 Virtualbox/Vagrant 之后，还需要安装好 ansible `brew install ansible`
12+
13+
## Step2. 下载 ansible 代码，并启动 Kubernetes 集群
14+
15+
```
16+
git clone https://github.com/markthink/deploy_k8s.git
17+
cd deploy_k8s
18+
vagrant up
19+
```
20+
21+
22+
## 网络测试
23+
24+
```bash
25+
# - --iface=enp0s8
26+
# https://www.jianshu.com/p/bcceb799eef6
27+
iptables -nvL
28+
iptables -F
29+
iptables -P FORWARD ACCEPT
30+
31+
32+
hostA:
33+
nc -u 10.93.0.131 (host B) 8472
34+
hostB:
35+
tcpdump -i eth0 -nn host hostA
36+
```
37+
38+

‎ansible_k8s/Vagrantfile

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
IMAGE_NAME = "bento/ubuntu-16.04"
2+
N = 2
3+
4+
Vagrant.configure("2") do |config|
5+
config.ssh.insert_key = false
6+
7+
config.vm.provider "virtualbox" do |v|
8+
v.memory = 1024
9+
v.cpus = 2
10+
end
11+
12+
config.vm.define "k8s-master" do |master|
13+
master.vm.box = IMAGE_NAME
14+
master.vm.network "private_network", ip: "192.168.50.10"
15+
master.vm.hostname = "k8s-master"
16+
master.vm.provision "ansible" do |ansible|
17+
ansible.playbook = "kubernetes-setup/master-playbook.yml"
18+
ansible.extra_vars = {
19+
node_ip: "192.168.50.10",
20+
}
21+
end
22+
end
23+
24+
(1..N).each do |i|
25+
config.vm.define "node-#{i}" do |node|
26+
node.vm.box = IMAGE_NAME
27+
node.vm.network "private_network", ip: "192.168.50.#{i + 10}"
28+
node.vm.hostname = "node-#{i}"
29+
node.vm.provision "ansible" do |ansible|
30+
ansible.playbook = "kubernetes-setup/node-playbook.yml"
31+
ansible.extra_vars = {
32+
node_ip: "192.168.50.#{i + 10}",
33+
}
34+
end
35+
end
36+
end
37+
end

‎ansible_k8s/kubernetes-setup/kube-flannel.j2

+224
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
---
2+
apiVersion: policy/v1beta1
3+
kind: PodSecurityPolicy
4+
metadata:
5+
name: psp.flannel.unprivileged
6+
annotations:
7+
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
8+
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
9+
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
10+
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
11+
spec:
12+
privileged: false
13+
volumes:
14+
- configMap
15+
- secret
16+
- emptyDir
17+
- hostPath
18+
allowedHostPaths:
19+
- pathPrefix: "/etc/cni/net.d"
20+
- pathPrefix: "/etc/kube-flannel"
21+
- pathPrefix: "/run/flannel"
22+
readOnlyRootFilesystem: false
23+
# Users and groups
24+
runAsUser:
25+
rule: RunAsAny
26+
supplementalGroups:
27+
rule: RunAsAny
28+
fsGroup:
29+
rule: RunAsAny
30+
# Privilege Escalation
31+
allowPrivilegeEscalation: false
32+
defaultAllowPrivilegeEscalation: false
33+
# Capabilities
34+
allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
35+
defaultAddCapabilities: []
36+
requiredDropCapabilities: []
37+
# Host namespaces
38+
hostPID: false
39+
hostIPC: false
40+
hostNetwork: true
41+
hostPorts:
42+
- min: 0
43+
max: 65535
44+
# SELinux
45+
seLinux:
46+
# SELinux is unused in CaaSP
47+
rule: 'RunAsAny'
48+
---
49+
kind: ClusterRole
50+
apiVersion: rbac.authorization.k8s.io/v1
51+
metadata:
52+
name: flannel
53+
rules:
54+
- apiGroups: ['extensions']
55+
resources: ['podsecuritypolicies']
56+
verbs: ['use']
57+
resourceNames: ['psp.flannel.unprivileged']
58+
- apiGroups:
59+
- ""
60+
resources:
61+
- pods
62+
verbs:
63+
- get
64+
- apiGroups:
65+
- ""
66+
resources:
67+
- nodes
68+
verbs:
69+
- list
70+
- watch
71+
- apiGroups:
72+
- ""
73+
resources:
74+
- nodes/status
75+
verbs:
76+
- patch
77+
---
78+
kind: ClusterRoleBinding
79+
apiVersion: rbac.authorization.k8s.io/v1
80+
metadata:
81+
name: flannel
82+
roleRef:
83+
apiGroup: rbac.authorization.k8s.io
84+
kind: ClusterRole
85+
name: flannel
86+
subjects:
87+
- kind: ServiceAccount
88+
name: flannel
89+
namespace: kube-system
90+
---
91+
apiVersion: v1
92+
kind: ServiceAccount
93+
metadata:
94+
name: flannel
95+
namespace: kube-system
96+
---
97+
kind: ConfigMap
98+
apiVersion: v1
99+
metadata:
100+
name: kube-flannel-cfg
101+
namespace: kube-system
102+
labels:
103+
tier: node
104+
app: flannel
105+
data:
106+
cni-conf.json: |
107+
{
108+
"name": "cbr0",
109+
"cniVersion": "0.3.1",
110+
"plugins": [
111+
{
112+
"type": "flannel",
113+
"delegate": {
114+
"hairpinMode": true,
115+
"isDefaultGateway": true
116+
}
117+
},
118+
{
119+
"type": "portmap",
120+
"capabilities": {
121+
"portMappings": true
122+
}
123+
}
124+
]
125+
}
126+
net-conf.json: |
127+
{
128+
"Network": "10.244.0.0/16",
129+
"Backend": {
130+
"Type": "vxlan"
131+
}
132+
}
133+
---
134+
apiVersion: apps/v1
135+
kind: DaemonSet
136+
metadata:
137+
name: kube-flannel-ds
138+
namespace: kube-system
139+
labels:
140+
tier: node
141+
app: flannel
142+
spec:
143+
selector:
144+
matchLabels:
145+
app: flannel
146+
template:
147+
metadata:
148+
labels:
149+
tier: node
150+
app: flannel
151+
spec:
152+
affinity:
153+
nodeAffinity:
154+
requiredDuringSchedulingIgnoredDuringExecution:
155+
nodeSelectorTerms:
156+
- matchExpressions:
157+
- key: kubernetes.io/os
158+
operator: In
159+
values:
160+
- linux
161+
hostNetwork: true
162+
priorityClassName: system-node-critical
163+
tolerations:
164+
- operator: Exists
165+
effect: NoSchedule
166+
serviceAccountName: flannel
167+
initContainers:
168+
- name: install-cni
169+
image: quay.io/coreos/flannel:v0.13.0
170+
command:
171+
- cp
172+
args:
173+
- -f
174+
- /etc/kube-flannel/cni-conf.json
175+
- /etc/cni/net.d/10-flannel.conflist
176+
volumeMounts:
177+
- name: cni
178+
mountPath: /etc/cni/net.d
179+
- name: flannel-cfg
180+
mountPath: /etc/kube-flannel/
181+
containers:
182+
- name: kube-flannel
183+
image: quay.io/coreos/flannel:v0.13.0
184+
command:
185+
- /opt/bin/flanneld
186+
args:
187+
- --ip-masq
188+
- --kube-subnet-mgr
189+
- --iface={{ iface }}
190+
resources:
191+
requests:
192+
cpu: "100m"
193+
memory: "50Mi"
194+
limits:
195+
cpu: "100m"
196+
memory: "50Mi"
197+
securityContext:
198+
privileged: false
199+
capabilities:
200+
add: ["NET_ADMIN", "NET_RAW"]
201+
env:
202+
- name: POD_NAME
203+
valueFrom:
204+
fieldRef:
205+
fieldPath: metadata.name
206+
- name: POD_NAMESPACE
207+
valueFrom:
208+
fieldRef:
209+
fieldPath: metadata.namespace
210+
volumeMounts:
211+
- name: run
212+
mountPath: /run/flannel
213+
- name: flannel-cfg
214+
mountPath: /etc/kube-flannel/
215+
volumes:
216+
- name: run
217+
hostPath:
218+
path: /run/flannel
219+
- name: cni
220+
hostPath:
221+
path: /etc/cni/net.d
222+
- name: flannel-cfg
223+
configMap:
224+
name: kube-flannel-cfg

0 commit comments

Comments
 (0)