投稿
  1. 首页
  2. 软件运维

以containerd作为runtime搭建k8s集群

code • 2022-5-17 • 软件运维 • 阅读 103

以containerd作为runtime搭建k8s集群,第1张

关闭防火墙与交换分区

systemctl stop firewalld.service

systemctl disable firewalld.service

swapoff -a ; sed -i '/swap/d' /etc/fstab

yum源设置：

#k8s

[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

containerd直接使用docker的yum源即可

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

检查可用yum源

yum makecache

安装配置containerd:

yum install containerd.io cri-tools -y

安装containerd：

yum install containerd.io cri-tools -y

安装crictl客户端工具：

crictl config runtime-endpoint unix:///var/run/containerd/containerd.sock

设置开机自启：

systemctl enable containerd.service --now

生成配置文件：

containerd config default > /etc/containerd/config.toml

在此配置单做以下修改 /etc/containerd/config.toml

disabled_plugins = []

imports = []

oom_score = 0

plugin_dir = ""

required_plugins = []

root = "/var/lib/containerd"

state = "/run/containerd"

temp = ""

version = 2

[cgroup]

  path = ""

[debug]

  address = ""

  format = ""

  gid = 0

  level = ""

  uid = 0

[grpc]

  address = "/run/containerd/containerd.sock"

  gid = 0

  max_recv_message_size = 16777216

  max_send_message_size = 16777216

  tcp_address = ""

  tcp_tls_ca = ""

  tcp_tls_cert = ""

  tcp_tls_key = ""

  uid = 0

[metrics]

  address = ""

  grpc_histogram = false

[plugins]

  [plugins."io.containerd.gc.v1.scheduler"]

    deletion_threshold = 0

    mutation_threshold = 100

    pause_threshold = 0.02

    schedule_delay = "0s"

    startup_delay = "100ms"

  [plugins."io.containerd.grpc.v1.cri"]

    device_ownership_from_security_context = false

    disable_apparmor = false

    disable_cgroup = false

    disable_hugetlb_controller = true

    disable_proc_mount = false

    disable_tcp_service = true

    enable_selinux = false

    enable_tls_streaming = false

    enable_unprivileged_icmp = false

    enable_unprivileged_ports = false

    ignore_image_defined_volumes = false

    max_concurrent_downloads = 3

    max_container_log_line_size = 16384

    netns_mounts_under_state_dir = false

    restrict_oom_score_adj = false

    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.5"

    selinux_category_range = 1024

    stats_collect_period = 10

    stream_idle_timeout = "4h0m0s"

    stream_server_address = "127.0.0.1"

    stream_server_port = "0"

    systemd_cgroup = false

    tolerate_missing_hugetlb_controller = true

    unset_seccomp_profile = ""

    [plugins."io.containerd.grpc.v1.cri".cni]

      bin_dir = "/opt/cni/bin"

      conf_dir = "/etc/cni/net.d"

      conf_template = ""

      ip_pref = ""

      max_conf_num = 1

    [plugins."io.containerd.grpc.v1.cri".containerd]

      default_runtime_name = "runc"

      disable_snapshot_annotations = true

      discard_unpacked_layers = false

      ignore_rdt_not_enabled_errors = false

      no_pivot = false

      snapshotter = "overlayfs"

      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]

        base_runtime_spec = ""

        cni_conf_dir = ""

        cni_max_conf_num = 0

        container_annotations = []

        pod_annotations = []

        privileged_without_host_devices = false

        runtime_engine = ""

        runtime_path = ""

        runtime_root = ""

        runtime_type = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]

          base_runtime_spec = ""

          cni_conf_dir = ""

          cni_max_conf_num = 0

          container_annotations = []

          pod_annotations = []

          privileged_without_host_devices = false

          runtime_engine = ""

          runtime_path = ""

          runtime_root = ""

          runtime_type = "io.containerd.runc.v2"

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]

            BinaryName = ""

            CriuImagePath = ""

            CriuPath = ""

            CriuWorkPath = ""

            IoGid = 0

            IoUid = 0

            NoNewKeyring = false

            NoPivotRoot = false

            Root = ""

            ShimCgroup = ""

            SystemdCgroup = true

      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]

        base_runtime_spec = ""

        cni_conf_dir = ""

        cni_max_conf_num = 0

        container_annotations = []

        pod_annotations = []

        privileged_without_host_devices = false

        runtime_engine = ""

        runtime_path = ""

        runtime_root = ""

        runtime_type = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]

    [plugins."io.containerd.grpc.v1.cri".image_decryption]

      key_model = "node"

    [plugins."io.containerd.grpc.v1.cri".registry]

      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]

         endpoint= ["https://frz7i079.mirror.aliyuncs.com"]

    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]

      tls_cert_file = ""

      tls_key_file = ""

  [plugins."io.containerd.internal.v1.opt"]

    path = "/opt/containerd"

  [plugins."io.containerd.internal.v1.restart"]

    interval = "10s"

  [plugins."io.containerd.internal.v1.tracing"]

    sampling_ratio = 1.0

    service_name = "containerd"

  [plugins."io.containerd.metadata.v1.bolt"]

    content_sharing_policy = "shared"

  [plugins."io.containerd.monitor.v1.cgroups"]

    no_prometheus = false

  [plugins."io.containerd.runtime.v1.linux"]

    no_shim = false

    runtime = "runc"

    runtime_root = ""

    shim = "containerd-shim"

    shim_debug = false

  [plugins."io.containerd.runtime.v2.task"]

    platforms = ["linux/amd64"]

    sched_core = false

  [plugins."io.containerd.service.v1.diff-service"]

    default = ["walking"]

  [plugins."io.containerd.service.v1.tasks-service"]

    rdt_config_file = ""

  [plugins."io.containerd.snapshotter.v1.aufs"]

    root_path = ""

  [plugins."io.containerd.snapshotter.v1.btrfs"]

    root_path = ""

  [plugins."io.containerd.snapshotter.v1.devmapper"]

    async_remove = false

    base_image_size = ""

    discard_blocks = false

    fs_options = ""

    fs_type = ""

    pool_name = ""

    root_path = ""

  [plugins."io.containerd.snapshotter.v1.native"]

    root_path = ""

  [plugins."io.containerd.snapshotter.v1.overlayfs"]

    root_path = ""

    upperdir_label = false

  [plugins."io.containerd.snapshotter.v1.zfs"]

    root_path = ""

  [plugins."io.containerd.tracing.processor.v1.otlp"]

    endpoint = ""

    insecure = false

    protocol = ""

[proxy_plugins]

[stream_processors]

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]

    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]

    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]

    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]

    path = "ctd-decoder"

    returns = "application/vnd.oci.image.layer.v1.tar"

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]

    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]

    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]

    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]

    path = "ctd-decoder"

    returns = "application/vnd.oci.image.layer.v1.tar+gzip"

[timeouts]

  "io.containerd.timeout.bolt.open" = "0s"

  "io.containerd.timeout.shim.cleanup" = "5s"

  "io.containerd.timeout.shim.load" = "5s"

  "io.containerd.timeout.shim.shutdown" = "3s"

  "io.containerd.timeout.task.state" = "2s"

[ttrpc]

  address = ""

  gid = 0

  uid = 0

    

#说明：

#生成pause容器

sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.5"

#添加镜像仓库

 [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]

        endpoint = ["https://frz7i079.mirror.aliyuncs.com"]

#修改驱动为systemd

SystemdCgroup = true

重启containerd:

systemctl restart containerd.service

设置命名空间：

export CONTAINERD_NAMESPACE=k8s.io

配置工具包

nerdctl下载地址：https://github.com/containerd/nerdctl

tar zxf nerdctl-0.12.1-linux-amd64.tar.gz

tar zxf cni-plugins-linux-amd64-v0.9.1.tgz

cp nerdctl /bin/

sed -i '1a source <(nerdctl completion bash)' /etc/profile

source /etc/profile

设置开机自动加载以下模块

cat > /etc/modules-load.d/containerd.conf <

overlay

br_netfilter

EOF

cat < /etc/sysctl.d/k8s.conf

net.bridge.bridge-nf-call-ip6tables = 1

net.bridge.bridge-nf-call-iptables = 1

net.ipv4.ip_forward = 1

EOF

使模块生效：

modprobe overlay

modprobe br_netfilter

sysctl -p /etc/sysctl.d/k8s.conf

安装目前最新版本的k8s（1.24）

yum -y install kubelet kubeadm kubectl --disableexcludes=kubernetes

设置开机自启

systemctl restart kubelet ; systemctl enable kubelet

master集群初始化

kubeadm init --image-repository registry.aliyuncs.com/google_containers --kubernetes-version=v1.24.0 --pod-network-cidr=10.244.0.0/16

mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config

node加入集群

kubeadm join 192.168.26.40:6443 --token 0dveup.32lk0cu3s5ruzeka --discovery-token-ca-cert-hash sha256:021c35ab30ac0e03be2797ae7071caaf8f5a94f6b90d715c1970002975fae0b6

安装calico网络插件

将镜像导入所有节点

nerdctl load -i calico-3.19-img.tar

kubectl apply -f calico.yaml

master设置tab

yum -y install bash-* #设置kubectl与kubeadm命令补全，下次login生效 kubectl completion bash > /etc/bash_completion.d/kubectl

kubeadm completion bash > /etc/bash_completion.d/kubeadm

bash

集群部署完成

欢迎分享，转载请注明来源：内存溢出

原文地址: http://outofmemory.cn/yw/928679.html

赞 (0)
打赏 微信扫一扫 微信扫一扫 支付宝扫一扫 支付宝扫一扫
code code 管理员组
0 0
上一篇 2022-05-17
下一篇 2022-05-17

发表评论

登录后才能评论

评论列表（0条）

保存