Kubernetes集群部署的方法及原理

首先Kubernetes需要采用master集群控制平面管理节点harbor私有镜像仓库节点,node1,node2工作节点如图所示四台虚拟机IP地址为master172.25.254.220 harbor172.25.254.200 node172.25.254.80 node2172.25.254.90一 . 部署本地仓库用Xshell连接后需要给四台机器关闭防火墙删除podman ,每台都需要[rootmaster ~]# systemctl stop firewalld[rootmaster ~]# systemctl disable firewalld[rootmaster ~]# dnf remove podman -y创建docker仓库文件安装软件包dnf install httpd createrepo-y安装vim /etc/httpd/conf/httpd.conf添加4444端口systemctl enable --now httpd开机自启[rootharbor ~]# dnf install docker-ce --downloadonly --destdir /mnt/ -y[rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/[rootharbor ~]# createrepo -v /var/www/html/docker/[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF[docker]name dockerbaseurl http://172.25.254.200:4444/dockergpgcheck 0EOF[rootharbor ~]# dnf install docker-ce -y二.安装docker在harbor仓库节点[rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.confbr_netfilter: 让网桥Bridge上转发的流量能够经过 iptables/netfilter 防火墙规则处理。写入开机自动加载配置[rootharbor ~]# modprobe -a br_netfilter立即手动加载该内核模块不用重启系统就能生效。[rootharbor ~]# vim /etc/sysctl.d/docker.confvim /lib/systemd/system/docker.service[rootharbor ~]# systemctl daemon-reload[rootharbor ~]# systemctl enable --now dockerHarbor 的所有组件前端、镜像仓库、认证、数据库等都是以容器形式运行的完全依赖 Docker 环境。内核模块 网络参数保证 Docker 容器网络、端口映射正常Harbor 的 Web 界面、镜像推拉接口才能对外正常提供服务服务参数配置明确 Docker 与 containerd 的绑定关系确保容器运行稳定开机自启保证服务器重启后Harbor 能随 Docker 自动恢复运行不用手动拉起。生成证书[rootharbor ~]# mkdir /data/certs -p 创建证书存放目录[rootharbor ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /data/certs/Sakura.org.key -addext subjectAltName DNS:reg.Sakura.org -x509 -days 365 -out /data/certs/Sakura.org.crt...................*...............................................*..................................................................................................................................................................................................................................................................................................................*....................................................................................................................*....................................................................................................................................................................................................-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ., the field will be left blank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:ShannxiLocality Name (eg, city) [Default City]:XianOrganization Name (eg, company) [Default Company Ltd]:kubernetesOrganizational Unit Name (eg, section) []:harborCommon Name (eg, your name or your servers hostname) []:reg.Sakura.orgEmail Address []:adminSakura.org参数作用openssl req调用 OpenSSL 的证书请求与签发工具-newkey rsa:4096生成新的 RSA 密钥对密钥长度 4096 位加密强度更高-nodes私钥不设置密码保护no DES避免 Harbor 启动时需要手动输入密码适合自动化部署-sha256使用 SHA-256 哈希算法签名是当前主流的安全签名算法-keyout ...key输出私钥文件保存到指定路径私钥文件必须严格保密-addext subjectAltName DNS:reg.Sakura.org添加「使用者备用名称SAN」将域名reg.Sakura.org写入证书-x509直接生成自签名证书而不是证书请求文件CSR自己给自己签发-days 365证书有效期 365 天到期前需要重新生成替换-out ...crt输出生成的公钥证书文件后续要分发给所有访问 Harbor 的节点做信任配置需要安装harbor-offline-installer-v2.5.4.tgz软件包三.编辑harbor配置文件hostname: reg.Sakura.orgcertificate: /data/certs/Sakura.org.crtprivate_key: /data/certs/Sakura.org.keyharbor_admin_password: 123[rootharbor harbor]# ./install.sh --with-chartmuseum#编写启动脚本[rootharbor ~]# vim /lib/systemd/system/harbor.service[rootharbor harbor]# docker compose down[rootharbor ~]# systemctl enable --now harbor[rootharbor harbor]# docker compose ps