kubeadm 高可用集群建设 Hands-on

sudo swapoff -a
# 编辑 /etc/fstab 禁用对应 swap 条目；不要误删其他挂载。
printf 'overlay\nbr_netfilter\n' | sudo tee /etc/modules-load.d/k8s.conf
sudo modprobe overlay
sudo modprobe br_netfilter
cat <<'EOF' | sudo tee /etc/sysctl.d/99-kubernetes.conf
net.ipv4.ip_forward=1
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
EOF
sudo sysctl --system

sudo apt-get update
apt-cache madison containerd.io
export CONTAINERD_PACKAGE_VERSION='REPLACE_APPROVED_2_X_PACKAGE_VERSION'
sudo apt-get install -y containerd.io="$CONTAINERD_PACKAGE_VERSION"
sudo apt-mark hold containerd.io
runc --version

containerd --version
sudo mkdir -p /etc/containerd
sudo sh -c 'containerd config default > /etc/containerd/config.toml'
sudoedit /etc/containerd/config.toml

[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
  SystemdCgroup = true

sudo systemctl enable --now containerd
sudo systemctl restart containerd
sudo ctr plugins ls
sudo crictl --runtime-endpoint unix:///run/containerd/containerd.sock info

export K8S_MINOR='1.REPLACE'
sudo apt-get update
sudo apt-get install -y ca-certificates curl gpg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL "https://pkgs.k8s.io/core:/stable:/v${K8S_MINOR}/deb/Release.key" | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
printf 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v%s/deb/ /\n' "$K8S_MINOR" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
apt-cache madison kubeadm
export K8S_PACKAGE_VERSION='REPLACE_EXACT_PACKAGE_VERSION'
sudo apt-get install -y kubelet="$K8S_PACKAGE_VERSION" kubeadm="$K8S_PACKAGE_VERSION" kubectl="$K8S_PACKAGE_VERSION"
sudo apt-mark hold kubelet kubeadm kubectl
sudo systemctl enable kubelet

apiVersion: kubeadm.k8s.io/v1beta4
kind: InitConfiguration
localAPIEndpoint: {advertiseAddress: 10.20.0.11, bindPort: 6443}
nodeRegistration:
  criSocket: unix:///run/containerd/containerd.sock
---
apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
kubernetesVersion: v1.REPLACE.PATCH
controlPlaneEndpoint: api.k8s.internal:6443
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
apiServer:
  certSANs: [api.k8s.internal]
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
rotateCertificates: true
systemReserved: {cpu: 250m, memory: 512Mi}
kubeReserved: {cpu: 250m, memory: 512Mi}
evictionHard: {memory.available: 200Mi, nodefs.available: '10%', imagefs.available: '15%', nodefs.inodesFree: '5%'}

sudo kubeadm config validate --config kubeadm.yaml
sudo kubeadm config images pull --config kubeadm.yaml
sudo kubeadm init --config kubeadm.yaml --upload-certs
mkdir -p "$HOME/.kube"
sudo install -o "$(id -u)" -g "$(id -g)" -m 600 /etc/kubernetes/admin.conf "$HOME/.kube/config"

kubectl wait --for=condition=Ready nodes --all --timeout=10m
kubectl -n kube-system get pods -o wide
kubectl get --raw='/readyz?verbose'
kubectl get nodes -o wide
sudo kubeadm token list

kubectl get nodes -o wide
kubectl label node REPLACE_WORKER_1 REPLACE_WORKER_2 REPLACE_WORKER_3 pool=application --overwrite
kubectl get nodes -l pool=application