耿雨飞的个人博客

[[ slide_text ]]

[[ item.c ]]

Kubernetes 通过kubeadm安装高可用集群

发布时间：2023-06-26 作者：gengyufei 来源：gengyufei个人博客

Kubernetes

# 机器规划
```
k8s-master1
    master  etcd keepalived haproxy

k8s-master2
    master  etcd keepalived haproxy

k8s-master3
    master  etcd keepalived haproxy

k8s-node1
```
# 虚拟机准备
通过VMware虚拟4台centos服务器

# 安装docker
http://gyfblog.com/article/126/

# 系统初始化
## 概述
1、关闭防火墙
2、关闭selinux
3、关闭swap分区
4、更新/etc/hosts
5、将桥接的 IPv4 流量传递到 iptables 的链
6、时间同步
7、避免containerd进程禁用了cri模块插件
8、yum install 相关依赖
9、配置k8s组件yum源为阿里云yum源

## 具体执行
```
# 一、yum install 前置依赖
sudo yum install -y conntrack ipvsadm ipset jq iptables curl sysstat libseccomp wget vim net-tools git

# 二、关闭防火墙
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl status firewalld

# 三、关闭 selinux
## 永久关闭
sudo sed -i 's/enforcing/disabled/' /etc/selinux/config

## 验证：
cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     disabled - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of disabled.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

# 四、关闭swap分区
## 永久关闭
vim /etc/fstab  ## 将swap分区那行记录注释掉
#/dev/mapper/cl-swap     swap                    swap    defaults        0 0

## 注意：该步骤需要重启Linux服务器，才能生效（sysctl --system命令无法生效关闭swap分区）

# 五、将桥接的 IPv4 流量传递到 iptables 的链
sudo cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

# 六、时间同步
sudo yum install ntpdate -y
ntpdate time.windows.com

# 七、避免containerd进程禁用了cri模块插件
sudo vim /etc/containerd/config.toml
## 注释掉：disabled_plugins = ["cri"]

sudo systemctl restart containerd

# 八、配置k8s组件yum源为阿里云yum源
#阿里源 x86_64架构
cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
   http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

#阿里源 aarch64架构
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-aarch64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

# 九、更新/etc/hosts（视自身情况进行更新）
cat >> /etc/hosts << EOF
192.168.40.10   k8s-master1
192.168.40.11   k8s-master2
192.168.40.12   k8s-master3
192.168.40.13   k8s-node1
EOF

# 十、系统生效 & 系统重启
sudo sysctl --system
sudo reboot
```

# yum install 相关组件
## 安装k8s系统组件（所有机器）
```
sudo yum install -y kubelet-1.21.14-0 kubeadm-1.21.14-0 kubectl-1.21.14-0
```

启动kubelet & 设置为开机自启动：
```
sudo systemctl start kubelet
sudo systemctl enable kubelet
```

## 安装高可用组件
### 在线安装
```
sudo yum install -y keepalived haproxy
```

### 离线安装
```
# 离线下载rpm包
repotrack haproxy-1.5.18 --download_path=/root/haproxy/rpm_pkgs
repotrack keepalived-1.3.5 --download_path=/root/keepalived/rpm_pkgs
```
配置本地yum镜像源：http://gyfblog.com/article/128/ 的 《配置本地yum源》

# 配置高可用组件
## 配置Haproxy（所有master节点均需配置 && 配置文件信息相同）
```
# 3master配置均相同，配置中声明了后端代理的3个master节点服务器，指定了haproxy运行的端口为16443等，因此16443端口为集群的入口
cat > /etc/haproxy/haproxy.cfg << EOF
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    # to have these messages end up in /var/log/haproxy.log you will
    # need to:
    # 1) configure syslog to accept network log events.  This is done
    #    by adding the '-r' option to the SYSLOGD_OPTIONS in
    #    /etc/sysconfig/syslog
    # 2) configure local2 events to go to the /var/log/haproxy.log
    #   file. A line like the following can be added to
    #   /etc/sysconfig/syslog
    #
    #    local2.*                       /var/log/haproxy.log
    #
    log         127.0.0.1 local2
    
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon 
       
    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------  
defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000
#---------------------------------------------------------------------
# kubernetes apiserver frontend which proxys to the backends
#--------------------------------------------------------------------- 
frontend kubernetes-apiserver
    mode                 tcp
    bind                 *:16443
    option               tcplog
    default_backend      kubernetes-apiserver    
#---------------------------------------------------------------------
# round robin balancing between the various backends
#---------------------------------------------------------------------
backend kubernetes-apiserver
    mode        tcp
    balance     roundrobin
    server      k8s-master1   192.168.40.10:6443 check
    server      k8s-master2   192.168.40.11:6443 check
    server      k8s-master3   192.168.40.12:6443 check
#---------------------------------------------------------------------
# collection haproxy statistics message
#---------------------------------------------------------------------
listen stats
    bind                 *:1080
    stats auth           admin:awesomePassword
    stats refresh        5s
    stats realm          HAProxy\ Statistics
    stats uri            /admin?stats
EOF

# web url
http://192.168.40.10:1080/admin?stats
admin:awesomePassword
```

## 配置keepalived（所有master节点均需配置 && 配置文件信息不太相同）
```
# master1 配置
cat > /etc/keepalived/keepalived.conf <<EOF 
! Configuration File for keepalived

global_defs {
   router_id k8s
}

vrrp_script check_haproxy {
    script "killall -0 haproxy"
    interval 3
    weight -2
    fall 10
    rise 2
}

vrrp_instance VI_1 {
    state MASTER 
    interface ens33 #此处改成你自己的网卡名称，ip addr 可查如何查看网卡信息
    virtual_router_id 51
    priority 250
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass ceb1b3ec013d66163d6ab
    }
    virtual_ipaddress {
        192.168.40.9  # 此处需要改成你自己的虚拟IP（VIP）
    }
    track_script {
        check_haproxy
    }

}
EOF

# master2 配置
cat > /etc/keepalived/keepalived.conf <<EOF 
! Configuration File for keepalived

global_defs {
   router_id k8s
}

vrrp_script check_haproxy {
    script "killall -0 haproxy"
    interval 3
    weight -2
    fall 10
    rise 2
}

vrrp_instance VI_1 {
    state BACKUP 
    interface ens33  # 换成你自己的网卡信息
    virtual_router_id 51
    priority 200
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass ceb1b3ec013d66163d6ab
    }
    virtual_ipaddress {
        192.168.40.9  # 换成你自己的虚拟IP（VIP）
    }
    track_script {
        check_haproxy
    }

}
EOF

# master3 配置
cat > /etc/keepalived/keepalived.conf <<EOF 
! Configuration File for keepalived

global_defs {
   router_id k8s
}

vrrp_script check_haproxy {
    script "killall -0 haproxy"
    interval 3
    weight -2
    fall 10
    rise 2
}

vrrp_instance VI_1 {
    state BACKUP 
    interface ens33  # 换成你自己的网卡信息
    virtual_router_id 51
    priority 150
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass ceb1b3ec013d66163d6ab
    }
    virtual_ipaddress {
        192.168.40.9  # 换成你自己的虚拟IP（VIP）
    }
    track_script {
        check_haproxy
    }

}
EOF
```
> 注意：
使用 killall -0 haproxy 命令检查所在节点的 haproxy 进程是否正常；
interface <网卡名称>，结合实际机器情况完善；
router_id、virtual_router_id 用于标识属于该 HA 的 keepalived 实例，如果有多套 keepalived HA，则必须各不相同；
2个backup的priority分别设置200和150（目的是保证master的优先级最高）

# 启动高可用组件
```
systemctl enable keepalived && systemctl start keepalived

systemctl enable haproxy && systemctl start haproxy
```
# 验证高可用组件
## Haproxy验证
```
# 查看keepalived服务状态
systemctl status keepalived

# 在k8s-master1(虚拟ip所在节点)节点查看网卡 ens33是否增加了vip信息
ip addr   	# 理论上，网卡ens33会多出一条记录，对应VIP
```

## keepalived验证
```
# 查看Haproxy服务状态
systemctl status haproxy

# 口检查：
netstat -lntup|grep haproxy

[root@k8s-master1 ~]# netstat -lntup|grep haproxy
tcp        0      0 0.0.0.0:1080            0.0.0.0:*               LISTEN      84658/haproxy
tcp        0      0 0.0.0.0:16443           0.0.0.0:*               LISTEN      84658/haproxy
udp        0      0 0.0.0.0:33187           0.0.0.0:*                           84657/haproxy

```

# 安装k8s集群
## kubeadm初始化集群（在具有vip的master上操作，这里为k8s-master1）
### 生成kubeadm配置文件模板
```
kubeadm config print init-defaults > kubeadm-init-conf.yml
```
### 按需修改配置文件
```
cat > kubeadm-init-conf.yml << EOF
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 192.168.40.10   							# 设置k8s-master1 ip
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: k8s-master1 											# use k8s-master1 节点的域名
  taints:													    # 需要更新
  - effect: NoSchedule 											# 需要更新
    key: node-role.kubernetes.io/master							# 需要更新
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers    	# use aliyun repo
kind: ClusterConfiguration
controlPlaneEndpoint: "192.168.40.9:16443"						# vip:port
kubernetesVersion: 1.21.14										# version
networking:
  dnsDomain: cluster.local
  podSubnet: "10.244.0.0/16"    								# 配置 POD 所在网段为我们虚拟机不重叠的网段（这里用的是 Flannel 默认网段）
  serviceSubnet: 10.96.0.0/12
scheduler: {}
EOF
```

注意字段：
- advertiseAddress
- nodeRegistration.name
- nodeRegistration.taints
- imageRepository
- controlPlaneEndpoint
- kubernetesVersion
- networking.podSubnet
- networking.serviceSubnet

### 执行初始化
```
# 增加--upload-certs参数后，在join master节点时，自动将证书同步到目标节点（join节点）
kubeadm init --config kubeadm-init-conf.yml --upload-certs

# 遇到问题：
    问题：[ERROR FileContent--proc-sys-net-ipv4-ip_forward]: /proc/sys/net/ipv4/ip_forward contents are not set to 1
    解决：
        kubeadm reset
        echo 1 > /proc/sys/net/ipv4/ip_forward
```

### 保存 join 命令
```
# master:
kubeadm join 192.168.40.9:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:c069af55467f1676ef395c1729ce346257e76f9860f54cb17d69dd9e29eb81ca \
--control-plane --certificate-key 648c5df010dfb94f0241838d34d542a38064ae6aad666be00be75ed76df6c5e8

# node:
kubeadm join 192.168.40.9:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:c069af55467f1676ef395c1729ce346257e76f9860f54cb17d69dd9e29eb81ca
```

### 给节点添加角色
```
kubectl label node <node_name> node-role.kubernetes.io/worker=worker

kubectl label node <node_name> node-role.kubernetes.io/master=master
```

## 安装网络插件flannel
### 配置文件
```
cat > kube-flannel.yml << EOF

---
kind: Namespace
apiVersion: v1
metadata:
  name: kube-flannel
  labels:
    pod-security.kubernetes.io/enforce: privileged
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/status
  verbs:
  - patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flannel
subjects:
- kind: ServiceAccount
  name: flannel
  namespace: kube-flannel
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flannel
  namespace: kube-flannel
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-flannel
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "cniVersion": "0.3.1",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds
  namespace: kube-flannel
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      hostNetwork: true
      priorityClassName: system-node-critical
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni-plugin
       #image: flannelcni/flannel-cni-plugin:v1.1.0 for ppc64le and mips64le (dockerhub limitations may apply)
        image: docker.io/rancher/mirrored-flannelcni-flannel-cni-plugin:v1.1.0
        command:
        - cp
        args:
        - -f
        - /flannel
        - /opt/cni/bin/flannel
        volumeMounts:
        - name: cni-plugin
          mountPath: /opt/cni/bin
      - name: install-cni
       #image: flannelcni/flannel:v0.20.1 for ppc64le and mips64le (dockerhub limitations may apply)
        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.1
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
       #image: flannelcni/flannel:v0.20.1 for ppc64le and mips64le (dockerhub limitations may apply)
        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.1
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN", "NET_RAW"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: EVENT_QUEUE_DEPTH
          value: "5000"
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
        - name: xtables-lock
          mountPath: /run/xtables.lock
      volumes:
      - name: run
        hostPath:
          path: /run/flannel
      - name: cni-plugin
        hostPath:
          path: /opt/cni/bin
      - name: cni
        hostPath:
          path: /etc/cni/net.d
      - name: flannel-cfg
        configMap:
          name: kube-flannel-cfg
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
EOF
```

### 准备docker镜像
```
# 在线下载
docker pull flannel/flannel:v0.22.0
docker pull flannel/flannel-cni-plugin:v1.1.2

# 离线导入
docker load -i flannel-cni-plugin-v1.1.2.tar
docker load -i flannel-v0.22.0.tar
```
### 部署网络插件
```
kubectl apply -f kube-flannel.yml
```

# 检查k8s集群
## 查看pod
```
kubectl get pods -A -o wide
NAMESPACE      NAME                                  READY   STATUS    RESTARTS   AGE    IP              NODE          NOMINATED NODE   READINESS GATES
kube-flannel   kube-flannel-ds-4bktn                 1/1     Running   0          114m   192.168.40.10   k8s-master1   <none>           <none>
kube-flannel   kube-flannel-ds-fb97x                 1/1     Running   0          114m   192.168.40.12   k8s-master3   <none>           <none>
kube-flannel   kube-flannel-ds-lsf6c                 1/1     Running   0          114m   192.168.40.11   k8s-master2   <none>           <none>
kube-flannel   kube-flannel-ds-mgslj                 1/1     Running   0          114m   192.168.40.13   k8s-node1     <none>           <none>
kube-system    coredns-59d64cd4d4-8w9dc              1/1     Running   0          177m   10.244.0.3      k8s-master1   <none>           <none>
kube-system    coredns-59d64cd4d4-jd5l6              1/1     Running   0          177m   10.244.0.2      k8s-master1   <none>           <none>
kube-system    etcd-k8s-master1                      1/1     Running   1          178m   192.168.40.10   k8s-master1   <none>           <none>
kube-system    etcd-k8s-master2                      1/1     Running   0          150m   192.168.40.11   k8s-master2   <none>           <none>
kube-system    etcd-k8s-master3                      1/1     Running   0          143m   192.168.40.12   k8s-master3   <none>           <none>
kube-system    kube-apiserver-k8s-master1            1/1     Running   2          177m   192.168.40.10   k8s-master1   <none>           <none>
kube-system    kube-apiserver-k8s-master2            1/1     Running   1          150m   192.168.40.11   k8s-master2   <none>           <none>
kube-system    kube-apiserver-k8s-master3            1/1     Running   1          143m   192.168.40.12   k8s-master3   <none>           <none>
kube-system    kube-controller-manager-k8s-master1   1/1     Running   4          177m   192.168.40.10   k8s-master1   <none>           <none>
kube-system    kube-controller-manager-k8s-master2   1/1     Running   3          150m   192.168.40.11   k8s-master2   <none>           <none>
kube-system    kube-controller-manager-k8s-master3   1/1     Running   3          143m   192.168.40.12   k8s-master3   <none>           <none>
kube-system    kube-proxy-4qqvs                      1/1     Running   0          143m   192.168.40.12   k8s-master3   <none>           <none>
kube-system    kube-proxy-54p5x                      1/1     Running   0          141m   192.168.40.13   k8s-node1     <none>           <none>
kube-system    kube-proxy-ghkhj                      1/1     Running   0          177m   192.168.40.10   k8s-master1   <none>           <none>
kube-system    kube-proxy-tkt4x                      1/1     Running   0          150m   192.168.40.11   k8s-master2   <none>           <none>
kube-system    kube-scheduler-k8s-master1            1/1     Running   4          178m   192.168.40.10   k8s-master1   <none>           <none>
kube-system    kube-scheduler-k8s-master2            1/1     Running   5          150m   192.168.40.11   k8s-master2   <none>           <none>
kube-system    kube-scheduler-k8s-master3            1/1     Running   3          143m   192.168.40.12   k8s-master3   <none>           <none>

```

## 查看节点状态
```
kubectl get nodes
NAME          STATUS   ROLES                  AGE    VERSION
k8s-master1   Ready    control-plane,master   178m   v1.21.14
k8s-master2   Ready    control-plane,master   150m   v1.21.14
k8s-master3   Ready    control-plane,master   144m   v1.21.14
k8s-node1     Ready    worker                 142m   v1.21.14
```

## haproxy web 查看
```
http://192.168.40.10:1080/admin?stats
user: admin
pass: awesomePassword
```

正常现象：
![](https://tcs-devops.aliyuncs.com/storage/112vef517907090dab65e35f02a441a89b9e?Signature=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJBcHBJRCI6IjVlNzQ4MmQ2MjE1MjJiZDVjN2Y5YjMzNSIsIl9hcHBJZCI6IjVlNzQ4MmQ2MjE1MjJiZDVjN2Y5YjMzNSIsIl9vcmdhbml6YXRpb25JZCI6IjVmZTg3YjM5ZWRiY2I1MjljNjI4OGVhMyIsImV4cCI6MTY4ODM4MzI4NCwiaWF0IjoxNjg3Nzc4NDg0LCJyZXNvdXJjZSI6Ii9zdG9yYWdlLzExMnZlZjUxNzkwNzA5MGRhYjY1ZTM1ZjAyYTQ0MWE4OWI5ZSJ9.cSu58EPfsISTn5r00M_lC4H5dCLZxtrD3-Bqjf7T5Qo)

# 安装kuboard管理界面
kuboard 官方wiki：https://www.kuboard.cn/install/v3/install-in-k8s.html#%E5%AE%89%E8%A3%85

## 安装
```
kubectl apply -f kuboard-v3.yaml

# web url
http://node_ip:30080/kuboard/cluster
http://192.168.40.10:30080/kuboard/cluster

用户名： admin
密码： Kuboard123
```

kuboard-v3.yaml文件内容：
```
# 文件内容:
# 镜像拉取策略已更新为 imagePullPolicy: IfNotPresent
---
apiVersion: v1
kind: Namespace
metadata:
  name: kuboard

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kuboard-v3-config
  namespace: kuboard
data:
  # 关于如下参数的解释，请参考文档 https://kuboard.cn/install/v3/install-built-in.html
  # [common]
  KUBOARD_SERVER_NODE_PORT: '30080'
  KUBOARD_AGENT_SERVER_UDP_PORT: '30081'
  KUBOARD_AGENT_SERVER_TCP_PORT: '30081'
  KUBOARD_SERVER_LOGRUS_LEVEL: info  # error / debug / trace
  # KUBOARD_AGENT_KEY 是 Agent 与 Kuboard 通信时的密钥，请修改为一个任意的包含字母、数字的32位字符串，此密钥变更后，需要删除 Kuboard Agent 重新导入。
  KUBOARD_AGENT_KEY: 32b7d6572c6255211b4eec9009e4a816
  KUBOARD_AGENT_IMAG: eipwork/kuboard-agent
  KUBOARD_QUESTDB_IMAGE: questdb/questdb:6.0.5
  KUBOARD_DISABLE_AUDIT: 'false' # 如果要禁用 Kuboard 审计功能，将此参数的值设置为 'true'，必须带引号。

# 关于如下参数的解释，请参考文档 https://kuboard.cn/install/v3/install-gitlab.html
  # [gitlab login]
  # KUBOARD_LOGIN_TYPE: "gitlab"
  # KUBOARD_ROOT_USER: "your-user-name-in-gitlab"
  # GITLAB_BASE_URL: "http://gitlab.mycompany.com"
  # GITLAB_APPLICATION_ID: "7c10882aa46810a0402d17c66103894ac5e43d6130b81c17f7f2d8ae182040b5"
  # GITLAB_CLIENT_SECRET: "77c149bd3a4b6870bffa1a1afaf37cba28a1817f4cf518699065f5a8fe958889"
  
  # 关于如下参数的解释，请参考文档 https://kuboard.cn/install/v3/install-github.html
  # [github login]
  # KUBOARD_LOGIN_TYPE: "github"
  # KUBOARD_ROOT_USER: "your-user-name-in-github"
  # GITHUB_CLIENT_ID: "17577d45e4de7dad88e0"
  # GITHUB_CLIENT_SECRET: "ff738553a8c7e9ad39569c8d02c1d85ec19115a7"

# 关于如下参数的解释，请参考文档 https://kuboard.cn/install/v3/install-ldap.html
  # [ldap login]
  # KUBOARD_LOGIN_TYPE: "ldap"
  # KUBOARD_ROOT_USER: "your-user-name-in-ldap"
  # LDAP_HOST: "ldap-ip-address:389"
  # LDAP_BIND_DN: "cn=admin,dc=example,dc=org"
  # LDAP_BIND_PASSWORD: "admin"
  # LDAP_BASE_DN: "dc=example,dc=org"
  # LDAP_FILTER: "(objectClass=posixAccount)"
  # LDAP_ID_ATTRIBUTE: "uid"
  # LDAP_USER_NAME_ATTRIBUTE: "uid"
  # LDAP_EMAIL_ATTRIBUTE: "mail"
  # LDAP_DISPLAY_NAME_ATTRIBUTE: "cn"
  # LDAP_GROUP_SEARCH_BASE_DN: "dc=example,dc=org"
  # LDAP_GROUP_SEARCH_FILTER: "(objectClass=posixGroup)"
  # LDAP_USER_MACHER_USER_ATTRIBUTE: "gidNumber"
  # LDAP_USER_MACHER_GROUP_ATTRIBUTE: "gidNumber"
  # LDAP_GROUP_NAME_ATTRIBUTE: "cn"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kuboard-boostrap
  namespace: kuboard

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kuboard-boostrap-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kuboard-boostrap
  namespace: kuboard

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s.kuboard.cn/name: kuboard-etcd
  name: kuboard-etcd
  namespace: kuboard
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s.kuboard.cn/name: kuboard-etcd
  template:
    metadata:
      labels:
        k8s.kuboard.cn/name: kuboard-etcd
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/master
                    operator: Exists
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Exists
              - matchExpressions:
                  - key: k8s.kuboard.cn/role
                    operator: In
                    values:
                      - etcd
      containers:
        - env:
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: HOSTIP
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: status.hostIP
          image: 'eipwork/etcd-host:3.4.16-2'
          imagePullPolicy: IfNotPresent
          name: etcd
          ports:
            - containerPort: 2381
              hostPort: 2381
              name: server
              protocol: TCP
            - containerPort: 2382
              hostPort: 2382
              name: peer
              protocol: TCP
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /health
              port: 2381
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - mountPath: /data
              name: data
      dnsPolicy: ClusterFirst
      hostNetwork: true
      restartPolicy: Always
      serviceAccount: kuboard-boostrap
      serviceAccountName: kuboard-boostrap
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
      volumes:
        - hostPath:
            path: /usr/share/kuboard/etcd
          name: data
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate

---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations: {}
  labels:
    k8s.kuboard.cn/name: kuboard-v3
  name: kuboard-v3
  namespace: kuboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s.kuboard.cn/name: kuboard-v3
  template:
    metadata:
      labels:
        k8s.kuboard.cn/name: kuboard-v3
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                  - key: node-role.kubernetes.io/master
                    operator: Exists
              weight: 100
            - preference:
                matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Exists
              weight: 100
      containers:
        - env:
            - name: HOSTIP
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: status.hostIP
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
          envFrom:
            - configMapRef:
                name: kuboard-v3-config
          image: 'eipwork/kuboard:v3'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /kuboard-resources/version.json
              port: 80
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: kuboard
          ports:
            - containerPort: 80
              name: web
              protocol: TCP
            - containerPort: 443
              name: https
              protocol: TCP
            - containerPort: 10081
              name: peer
              protocol: TCP
            - containerPort: 10081
              name: peer-u
              protocol: UDP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /kuboard-resources/version.json
              port: 80
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          # startupProbe:
          #   failureThreshold: 20
          #   httpGet:
          #     path: /kuboard-resources/version.json
          #     port: 80
          #     scheme: HTTP
          #   initialDelaySeconds: 5
          #   periodSeconds: 10
          #   successThreshold: 1
          #   timeoutSeconds: 1
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      serviceAccount: kuboard-boostrap
      serviceAccountName: kuboard-boostrap
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists

---
apiVersion: v1
kind: Service
metadata:
  annotations: {}
  labels:
    k8s.kuboard.cn/name: kuboard-v3
  name: kuboard-v3
  namespace: kuboard
spec:
  ports:
    - name: web
      nodePort: 30080
      port: 80
      protocol: TCP
      targetPort: 80
    - name: tcp
      nodePort: 30081
      port: 10081
      protocol: TCP
      targetPort: 10081
    - name: udp
      nodePort: 30081
      port: 10081
      protocol: UDP
      targetPort: 10081
  selector:
    k8s.kuboard.cn/name: kuboard-v3
  sessionAffinity: None
  type: NodePort

```

## 验证
```
kubectl get pods -n kuboard
```

上一篇：Kubernetes 通过kubeadm离线安装k8s集群下一篇：Kubernetes CKA认证考试

你觉得文章怎么样