1：服务器节点信息
| 主机名称 | IP | 备注 |
| node1 | 10.100.24.20 | master and etcd |
| node2 | 10.100.24.21 | master and etcd |
| node3 | 10.100.24.22 | master and etcd |
| node4 | 10.100.24.23 | node |
| node5 | 10.100.24.24 | node |
| vip | 10.100.24.25 |
软件版本：
docker-ce 17.03.2
kubernetes 1.10.4
2：初始化环境（所有节点）
设置主机名
hostnamectl set-hostname node1 hostnamectl set-hostname node2 hostnamectl set-hostname node3 hostnamectl set-hostname node4 hostnamectl set-hostname node5
cat <<EOF >> /etc/hosts 10.100.24.20 node1 10.100.24.21 node2 10.100.24.22 node3 10.100.24.23 node4 10.100.24.24 node5 EOF
ssh免密登陆
ssh-keygen #一路回车即可 ssh-copy-id node2 ssh-copy-id node3 ssh-copy-id node4 ssh-copy-id node5
关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
关闭swap
swapoff -a sed -i 's/.*swap.*/#&/' /etc/fstab
关闭selinux
setenforce 0 sed -i "s/^SELINUX=enforcing/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/^SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config sed -i "s/^SELINUX=permissive/SELINUX=disabled/g" /etc/sysconfig/selinux sed -i "s/^SELINUX=permissive/SELINUX=disabled/g" /etc/selinux/config
加载内核模块
modprobe br_netfilter cat <<EOF > /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 EOF sysctl -p /etc/sysctl.d/k8s.conf ls /proc/sys/net/bridge
添加kubernetes阿里源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF
安装工具
yum install -y epel-release yum install -y yum-utils device-mapper-persistent-data lvm2 net-tools conntrack-tools wget vim ntpdate libseccomp libtool-ltdl
配置时间服务器
yum install ntp -y 修改一下时间服务器地址 times.aliyun.com systemctl enable ntpd systemctl start ntpd
优化limit
echo "* soft nofile 65536" >> /etc/security/limits.conf echo "* hard nofile 65536" >> /etc/security/limits.conf echo "* soft nproc 65536" >> /etc/security/limits.conf echo "* hard nproc 65536" >> /etc/security/limits.conf echo "* soft memlock unlimited" >> /etc/security/limits.conf echo "* hard memlock unlimited" >> /etc/security/limits.conf
3：安装、配置keepalived（主节点）
1:安装keepalived
yum install -y keepalived systemctl enable keepalived
node1的keepalived.conf
cat <<EOF > /etc/keepalived/keepalived.conf global_defs { router_id LVS_k8s } vrrp_script CheckK8sMaster { script "curl -k https://10.100.24.25:6443" interval 3 timeout 9 fall 2 rise 2 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 61 priority 100 advert_int 1 mcast_src_ip 10.100.24.20 nopreempt authentication { auth_type PASS auth_pass sqP05dQgMSlzrxHj } unicast_peer { 10.100.24.21 10.100.24.22 } virtual_ipaddress { 10.100.24.25/24 } track_script { CheckK8sMaster } } EOF
node2的keepalived.conf
cat <<EOF > /etc/keepalived/keepalived.conf global_defs { router_id LVS_k8s } global_defs { router_id LVS_k8s } vrrp_script CheckK8sMaster { script "curl -k https://10.100.24.25:6443" interval 3 timeout 9 fall 2 rise 2 } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 61 priority 90 advert_int 1 mcast_src_ip 10.100.24.21 nopreempt authentication { auth_type PASS auth_pass sqP05dQgMSlzrxHj } unicast_peer { 10.100.24.20 10.100.24.22 } virtual_ipaddress { 10.100.24.25/24 } track_script { CheckK8sMaster } } EOF
node3的keepalived.conf
cat <<EOF > /etc/keepalived/keepalived.conf global_defs { router_id LVS_k8s } global_defs { router_id LVS_k8s } vrrp_script CheckK8sMaster { script "curl -k https://10.100.24.25:6443" interval 3 timeout 9 fall 2 rise 2 } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 61 priority 80 advert_int 1 mcast_src_ip 10.100.24.22 nopreempt authentication { auth_type PASS auth_pass sqP05dQgMSlzrxHj } unicast_peer { 10.100.24.20 10.100.24.21 } virtual_ipaddress { 10.100.24.25/24 } track_script { CheckK8sMaster } } EOF
2：启动keepalived
systemctl restart keepalived
可以看到VIP已经绑定到node1上面了
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:b2:09:6a brd ff:ff:ff:ff:ff:ff inet 10.100.24.20/24 brd 192.168.150.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.100.24.25/24 scope global secondary eth0 valid_lft forever preferred_lft forever inet6 fe80::e3d1:55df:2f64:8571/64 scope link valid_lft forever preferred_lft forever
4：创建etcd证书(node1上执行即可)
1：设置cfssl环境
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 chmod +x cfssl_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl chmod +x cfssljson_linux-amd64 mv cfssljson_linux-amd64 /usr/local/bin/cfssljson chmod +x cfssl-certinfo_linux-amd64 mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
2：创建 CA 配置文件（下面配置的IP为etc节点的IP）
mkdir /root/ssl cd /root/ssl cat > ca-config.json <<EOF { "signing": { "default": { "expiry": "8760h" }, "profiles": { "kubernetes-Soulmate": { "usages": [ "signing", "key encipherment", "server auth", "client auth" ], "expiry": "8760h" } } } } EOF cat > ca-csr.json <<EOF { "CN": "kubernetes-Soulmate", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "shanghai", "L": "shanghai", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -initca ca-csr.json | cfssljson -bare ca cat > etcd-csr.json <<EOF { "CN": "etcd", "hosts": [ "127.0.0.1", "10.100.24.20", "10.100.24.21", "10.100.24.22" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "shanghai", "L": "shanghai", "O": "k8s", "OU": "System" } ] } EOF cfssl gencert -ca=ca.pem \ -ca-key=ca-key.pem \ -config=ca-config.json \ -profile=kubernetes-Soulmate etcd-csr.json | cfssljson -bare etcd