openeuler/cloudnative用户指南Kubernetes二进制部署的完整教程【免费下载链接】cloudnativeInformation summary and discussion platform for CloudNative SIG项目地址: https://gitcode.com/openeuler/cloudnative前往项目官网免费下载https://ar.openeuler.org/ar/openEuler/cloudnative是一个专注于云原生技术的信息汇总与讨论平台本教程将详细介绍如何在openEuler操作系统上通过二进制方式部署Kubernetes集群帮助新手用户快速掌握这一核心技能。一、准备工作环境与依赖配置1.1 集群状态规划本次部署将使用6台openEuler 21.03系统虚拟机包含3个master节点和3个node节点部署在openEuler 21.03的x86/ARM服务器上。所有操作均需使用root权限执行。1.2 安装依赖工具首先安装虚拟机所需依赖并启用libvirtd服务dnf install virt-install virt-manager libvirt-daemon-qemu edk2-aarch64.noarch virt-viewer systemctl start libvirtd systemctl enable libvirtd1.3 准备虚拟机磁盘文件创建虚拟机存储池并生成磁盘文件dnf install -y qemu-img virsh pool-define-as vmPool --type dir --target /mnt/vm/images/ virsh pool-build vmPool virsh pool-start vmPool virsh pool-autostart vmPool # 创建master节点磁盘 virsh vol-create-as --pool vmPool --name master0.img --capacity 200G --allocation 1G --format qcow2 # 创建node节点磁盘重复命令创建node1-3.img virsh vol-create-as --pool vmPool --name node1.img --capacity 300G --allocation 1G --format qcow21.4 配置网络与防火墙方法一开放VNC端口# 查询端口 netstat -lntup | grep qemu-kvm # 开放端口 firewall-cmd --zonepublic --add-port5900-5905/tcp方法二临时关闭防火墙仅测试环境systemctl stop firewalld二、虚拟机创建与系统安装2.1 编写虚拟机配置文件创建master.xml配置文件以k8smaster0节点为例domain typekvm namek8smaster0/name memory unitGiB8/memory vcpu8/vcpu os type archaarch64 machinevirthvm/type loader readonlyyes typepflash/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw/loader nvram/var/lib/libvirt/qemu/nvram/k8smaster0.fd/nvram /os features acpi/ gic version3/ /features cpu modehost-passthrough topology sockets2 cores4 threads1/ /cpu devices emulator/usr/libexec/qemu-kvm/emulator disk typefile devicedisk driver nameqemu typeqcow2/ source file/mnt/vm/images/master0.img/ target devvda busvirtio/ /disk disk typefile devicecdrom source file/mnt/openEuler-21.03-everything-aarch64-dvd.iso/ readonly/ target devsdb busscsi/ /disk interface typenetwork mac address52:54:00:00:00:80/ source networkdefault/ model typevirtio/ /interface graphics typevnc listen0.0.0.0/ /devices /domain⚠️注意每个虚拟机需修改name、nvram路径、磁盘文件路径和mac address以保证唯一性2.2 安装并配置虚拟机# 创建虚拟机 virsh define master.xml # 启动虚拟机 virsh start k8smaster0 # 获取VNC端口 virsh vncdisplay k8smaster0 # 设置主机名 hostnamectl set-hostname k8smaster0通过VNC工具连接虚拟机完成openEuler系统安装重复上述步骤创建所有节点。三、部署Kubernetes集群核心组件3.1 环境说明完成虚拟机部署后节点信息如下HostNameMAC地址IPv4地址k8smaster052:54:00:00:00:80192.168.122.154/24k8smaster152:54:00:00:00:81192.168.122.155/24k8smaster252:54:00:00:00:82192.168.122.156/24k8snode152:54:00:00:00:83192.168.122.157/24k8snode252:54:00:00:00:84192.168.122.158/24k8snode352:54:00:00:00:85192.168.122.159/243.2 安装基础软件包# 安装依赖 dnf install -y docker conntrack-tools socat # 安装Kubernetes软件包 rpm -ivh kubernetes*.rpm3.3 证书生成与配置使用CFSSL工具生成集群所需证书3.3.1 安装CFSSLwget --no-check-certificate https://github.com/cloudflare/cfssl/archive/v1.5.0.tar.gz tar -zxf v1.5.0.tar.gz cd cfssl-1.5.0/ make -j6 cp bin/* /usr/local/bin/3.3.2 生成根证书创建CA配置文件ca-config.json{ signing: { default: { expiry: 8760h }, profiles: { kubernetes: { usages: [signing, key encipherment, server auth, client auth], expiry: 8760h } } } }生成CA证书和密钥cfssl gencert -initca ca-csr.json | cfssljson -bare ca3.3.3 生成组件证书依次生成admin、service-account、kube-controller-manager、kube-proxy、kube-scheduler、kubelet和kube-apiserver证书以admin证书为例cfssl gencert -caca.pem -ca-keyca-key.pem -configca-config.json -profilekubernetes admin-csr.json | cfssljson -bare admin详细证书生成脚本可参考docs/2-用户指南/k8s二进制部署指南.md3.4 部署etcd集群3.4.1 准备环境# 开放端口 firewall-cmd --zonepublic --add-port2379/tcp firewall-cmd --zonepublic --add-port2380/tcp # 安装etcd rpm -ivh etcd*.rpm # 准备目录和证书 mkdir -p /etc/etcd /var/lib/etcd cp ca.pem kubernetes-key.pem kubernetes.pem /etc/etcd/3.4.2 配置etcd服务创建/usr/lib/systemd/system/etcd.service[Unit] DescriptionEtcd Server Afternetwork.target [Service] Typenotify WorkingDirectory/var/lib/etcd/ ExecStart/bin/bash -c ETCD_UNSUPPORTED_ARCHarm64 /usr/bin/etcd --namek8smaster0 \ --cert-file/etc/etcd/kubernetes.pem --key-file/etc/etcd/kubernetes-key.pem \ --peer-cert-file/etc/etcd/kubernetes.pem --peer-key-file/etc/etcd/kubernetes-key.pem \ --trusted-ca-file/etc/etcd/ca.pem --peer-trusted-ca-file/etc/etcd/ca.pem \ --initial-advertise-peer-urls https://192.168.122.154:2380 \ --listen-peer-urls https://192.168.122.154:2380 \ --listen-client-urls https://192.168.122.154:2379,https://127.0.0.1:2379 \ --advertise-client-urls https://192.168.122.154:2379 \ --initial-cluster-token etcd-cluster-0 \ --initial-cluster k8smaster0https://192.168.122.154:2380,k8smaster1https://192.168.122.155:2380,k8smaster2https://192.168.122.156:2380 \ --initial-cluster-state new --data-dir /var/lib/etcd [Install] WantedBymulti-user.target3.4.3 启动并验证etcdsystemctl enable etcd systemctl start etcd # 验证集群状态 ETCDCTL_API3 etcdctl -w table endpoint status --endpointshttps://192.168.122.154:2379,https://192.168.122.155:2379,https://192.168.122.156:2379 --cacert/etc/etcd/ca.pem --cert/etc/etcd/kubernetes.pem --key/etc/etcd/kubernetes-key.pem四、部署控制面组件4.1 准备kubeconfig配置为各组件生成kubeconfig文件以kube-proxy为例kubectl config set-cluster openeuler-k8s --certificate-authority/etc/kubernetes/pki/ca.pem --embed-certstrue --serverhttps://192.168.122.154:6443 --kubeconfigkube-proxy.kubeconfig kubectl config set-credentials system:kube-proxy --client-certificate/etc/kubernetes/pki/kube-proxy.pem --client-key/etc/kubernetes/pki/kube-proxy-key.pem --embed-certstrue --kubeconfigkube-proxy.kubeconfig kubectl config set-context default --clusteropeneuler-k8s --usersystem:kube-proxy --kubeconfigkube-proxy.kubeconfig kubectl config use-context default --kubeconfigkube-proxy.kubeconfig4.2 部署API Server创建/etc/kubernetes/apiserver配置文件设置服务地址、证书路径和etcd连接信息等关键参数。编写systemd服务文件并启动systemctl enable kube-apiserver systemctl start kube-apiserver4.3 部署Controller Manager和Scheduler类似API Server部署流程配置相应的服务文件并启动# 部署controller-manager systemctl enable kube-controller-manager systemctl start kube-controller-manager # 部署scheduler systemctl enable kube-scheduler systemctl start kube-scheduler4.4 验证控制面状态# 检查API Server版本 curl --cacert /etc/kubernetes/pki/ca.pem https://192.168.122.154:6443/version五、部署Node节点组件5.1 环境准备# 安装依赖 dnf install -y docker iSulad conntrack-tools socat containernetworking-plugins # 关闭swap swapoff -a # 创建目录 mkdir -p /etc/kubernetes/pki/ /etc/cni/net.d /opt/cni5.2 配置容器运行时使用iSulad作为运行时# /etc/isulad/daemon.json { registry-mirrors: [docker.io], insecure-registries: [k8s.gcr.io, quay.io], pod-sandbox-image: k8s.gcr.io/pause:3.2, network-plugin: cni, cni-bin-dir: /usr/libexec/cni/, cni-conf-dir: /etc/cni/net.d }5.3 配置CNI网络创建桥接网络配置/etc/cni/net.d/10-bridge.conf{ cniVersion: 0.3.1, name: bridge, type: bridge, bridge: cnio0, isGateway: true, ipMasq: true, ipam: { type: host-local, subnet: 10.244.0.0/16, gateway: 10.244.0.1 } }5.4 部署kubelet和kube-proxy配置kubelet和kube-proxy的systemd服务文件设置证书路径、kubeconfig文件和运行时参数启动服务systemctl enable kubelet kube-proxy systemctl start kubelet kube-proxy5.5 验证节点状态kubectl get nodes --kubeconfig /etc/kubernetes/pki/admin.kubeconfig输出应显示所有节点状态为Ready。六、部署CoreDNS与测试应用6.1 部署CoreDNS配置Corefile并创建systemd服务# 启动coredns systemctl enable coredns systemctl start coredns # 创建service和endpoint kubectl apply -f coredns_server.yaml kubectl apply -f coredns_ep.yaml6.2 运行测试Pod创建nginx部署文件nginx.yamlapiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80部署并验证kubectl apply -f nginx.yaml kubectl get pods总结通过本教程您已掌握在openEuler系统上通过二进制方式部署Kubernetes集群的完整流程。该方法适用于学习和实验环境生产环境部署需进一步考虑高可用和安全加固。更多详细配置可参考项目官方文档docs/2-用户指南/k8s二进制部署指南.md。如需获取项目源码请克隆仓库git clone https://gitcode.com/openeuler/cloudnative【免费下载链接】cloudnativeInformation summary and discussion platform for CloudNative SIG项目地址: https://gitcode.com/openeuler/cloudnative创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考