基于金山云二进制部署Kubernetes v1.31.14三Master高可用集群

最新推荐文章于 2026-08-20 14:59:03 发布
原创 最新推荐文章于 2026-08-20 14:59:03 发布 · 227 阅读 · 4 ·
本内容遵循CC 4.0 BY-SA版权协议
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
GEO检测

基于金山云二进制部署Kubernetes v1.31.14

三Master高可用集群

1. 安装前必读

请在金山云上租用云服务器，确保Master节点的配置在4核4G以上，更高配置的云服务器更佳，请不要使用带中文的服务器和克隆的虚拟机。

请将该文档复制一份，然后进行更改安装，并记录每一个步骤的返回信息，有问题可以直接发送部署文档进行问答，解决更加迅速。

生产环境中，建议使用小版本大于 5 的 Kubernetes 版本，比如 1.19.5 以后的才可用于生产环境。

创建好云服务器后，务必绑定EIP，通过远程终端软件SSH上云服务器。我这里使用三台8核16G作Master节点，两台4核4G作Worker节点。

2. 基本配置

2.1 基本环境配置

表 1-1 高可用 Kubernetes 集群规划

主机名

IP 地址

说明

k8s-master01

10.0.0.232

master主节点

k8s-master02

10.0.0.131

master节点

k8s-master03

10.0.0.224

master节点

K8s-node01

10.0.0.218

worker节点

k8s-node02

10.0.0.209

worker节点

K8s-master01/02/03

10.0.0.250

keepalived 虚拟 IP（不占用机器）

注意：请统一替换这些网段，Pod 网段和 service 和宿主机网段不要重复！！

表 1-2 金山云服务器关键配置信息

配置信息

备注

系统版本

Rocky Linux 8/9

Containerd

latest

Pod 网段

172.16.0.0/16

Service 网段

192.168.0.0/16

宿主机网段、K8s Service 网段、Pod 网段不能重复！！！若重复，会出现网络通信异常问题，会导致集群搭建失败而重装。最好就是使用10.x.x.x/x，192.168.x.x/x，172.16.x.x/x，这三段内网IP，刚好作区分。

注意：

  1. VIP（虚拟 IP）不要和公司内网 IP 重复，首先去 ping 一下，不通才可用。VIP 需要和你的主机在同一个局域网内（不是直接用我的 VIP）！
  2. 公有云上搭建 VIP 是公有云的负载均衡的 IP，比如阿里云的内网 SLB/NLB 的地址，腾讯云内网 ELB 的地址。不需要再搭建 keepalived 和 haproxy。
  3. 如果是私有云也需要问一下私有云管理员是否支持 VIP！

我这里是基于公有云搭建的，并没有使用到SLB，因为金山公有云支持keepalived 和 haproxy，所以不需要再去申请SLB产品。

安装步骤：

所有节点修改主机名：

[root@k8s-master01 ~]# hostnamectl set-hostname k8s-master01

[root@k8s-master01 ~]# bash

[root@k8s-master02 ~]# hostnamectl set-hostname k8s-master02

[root@k8s-master02 ~]# bash

[root@k8s-master03 ~]# hostnamectl set-hostname k8s-master03

[root@k8s-master03]# bash

[root@k8s-node01 ~]# hostnamectl set-hostname k8s-node01

[root@k8s-node01 ~]# bash

[root@k8s-node02 ~]# hostnamectl set-hostname k8s-node02

[root@k8s-node02 ~]# bash

所有节点修改hosts文件，内容如下：

[root@k8s-master01 ~]# vi /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

10.0.0.232 k8s-master01

10.0.0.131 k8s-master02

10.0.0.224 k8s-master03

10.0.0.218 k8s-node01

10.0.0.209 k8s-node02

所有节点配置yum源：

# 配置基础源

sed -e 's|^mirrorlist=|#mirrorlist=|g' \

-e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \

-i.bak \

/etc/yum.repos.d/*.repo



yum makecache

所有节点必备工具安装：

yum install wget jq psmisc vim net-tools telnet yum-utils device-mapper-persistent-data lvm2 git rsyslog -y

所有节点关闭防火墙，selinux,dnsmasq,swap,开启rsyslog。服务器配置如下：

systemctl disable --now firewalld

systemctl disable --now dnsmasq

setenforce 0

sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/sysconfig/selinux

sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config

systemctl enable --now rsyslog

所有节点关闭swap分区：

swapoff -a && sysctl -w vm.swappiness=0

sed -ri '/^[^#]*swap/s@^@#@' /etc/fstab

所有节点安装 ntpdate：

dnf install epel-release -y

dnf config-manager --set-enabled epel

dnf install ntpsec

所有节点同步时间并配置上海时区：

ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

echo 'Asia/Shanghai' >/etc/timezone

ntpdate time2.aliyun.com



#加入到crontab定时任务

crontab -e



*/5 * * * * /usr/sbin/ntpdate time2.aliyun.com

所有节点配置limit:

ulimit -SHn 65535

vim /etc/security/limits.conf

# 文件末尾添加如下内容

* soft nofile 65536

* hard nofile 131072

* soft nproc 65535

* hard nproc 655350

* soft memlock unlimited

* hard memlock unlimited

所有节点升级系统并重启:

yum update -y

Master01 节点免密钥登录其他节点，安装过程中生成配置文件和证书均在 Master01 上操作，集群管理也在 Master01 上操作：

ssh-keygen -t rsa

for i in k8s-master01 k8s-master02 k8s-master03 k8s-node01 k8s-node02;do ssh-copy-id -i .ssh/id_rsa.pub $i;done

Master01 节点下载安装所有的源码文件

cd /root/; git clone https://gitee.com/dukuan/k8s-ha-install.git

2.2 内核配置

所有节点安装ipvsadm:

yum install ipvsadm ipset sysstat conntrack libseccomp -y

所有节点配置ipvs模块：

modprobe -- ip_vs

modprobe -- ip_vs_rr

modprobe -- ip_vs_wrr

modprobe -- ip_vs_sh

modprobe -- nf_conntrack

所有节点创建ipvs.conf，并配置开机自动加载：

cat > /etc/modules-load.d/ipvs.conf << EOF

ip_vs

ip_vs_lc

ip_vs_wlc

ip_vs_rr

ip_vs_wrr

ip_vs_lblc

ip_vs_lblcr

ip_vs_dh

ip_vs_sh

ip_vs_fo

ip_vs_nq

ip_vs_sed

ip_vs_ftp

ip_vs_sh

nf_conntrack

ip_tables

ip_set

xt_set

ipt_set

ipt_rpfilter

ipt_REJECT

ipip

EOF

所有节点然后执行

systemctl enable --now systemd-modules-load.service

所有节点内核优化配置：

cat > /etc/sysctl.d/k8s.conf << EOF

net.ipv4.ip_forward = 1

net.bridge.bridge-nf-call-iptables = 1

net.bridge.bridge-nf-call-ip6tables = 1

fs.may_detach_mounts = 1

net.ipv4.conf.all.route_localnet = 1

vm.overcommit_memory=1

vm.panic_on_oom=0

fs.inotify.max_user_watches=89100

fs.file-max=52706963

fs.nr_open=52706963

net.netfilter.nf_conntrack_max=2310720



net.ipv4.tcp_keepalive_time = 600

net.ipv4.tcp_keepalive_probes = 3

net.ipv4.tcp_keepalive_intvl =15

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_max_orphans = 327680

net.ipv4.tcp_orphan_retries = 3

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.ip_conntrack_max = 65536

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_timestamps = 0

net.core.somaxconn = 16384

EOF

所有节点应用配置：

sysctl --system

所有节点配置完内核后，重启机器，之后查看内核模块是否已自动加载：

reboot

lsmod | grep --color=auto -e ip_vs -e nf_conntrack

2.3 高可用组件安装

注意：如果安装的不是高可用集群，haproxy和keepalived无需安装

注意：公有云要用公有云自带的负载均衡，比如阿里云的SLB、NLB，腾讯云的ELB，用来替代haproxy和keepalived，因为公有云大部分都是不支持keepalived的。

所有Master节点通过yum安装HAProxy和KeepAlived：

reboot

lsmod | grep --color=auto -e ip_vs -e nf_conntrack

所有Master节点配置HAProxy，需要注意黄色部分的IP：

mkdir -p /etc/haproxy



cat > /etc/haproxy/haproxy.cfg << EOF

global

    maxconn 2000

    ulimit-n 16384

    log 127.0.0.1 local0 err

    stats timeout 30s



defaults

    log global

    mode http

    option httplog

    timeout connect 5000

    timeout client 50000

    timeout server 50000

    timeout http-request 15s

    timeout http-keep-alive 15s



frontend monitor-in

    bind *:33305

    mode http

    option httplog

    monitor-uri /monitor



frontend k8s-master

    bind 0.0.0.0:8443

    bind 127.0.0.1:8443

    mode tcp

    option tcplog

    tcp-request inspect-delay 5s

    default_backend k8s-master



backend k8s-master

    mode tcp

    option tcplog

    option tcp-check

    balance roundrobin

    default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100

    server k8s-master01 10.0.0.232:6443 check

    server k8s-master02 10.0.0.131:6443 check

    server k8s-master03 10.0.0.224:6443 check

EOF

所有Master节点配置KeepAlived，需要注意黄色部分的配置。

Master01节点的配置：

mkdir -p /etc/keepalived



cat > /etc/keepalived/keepalived.conf << EOF

! Configuration File for keepalived

global_defs {

    router_id LVS_DEVEL

    script_user root

    enable_script_security

}



vrrp_script chk_apiserver {

    script "/etc/keepalived/check_apiserver.sh"

    interval 5

    weight -5

    fall 2

    rise 1

}



vrrp_instance VI_1 {

    state MASTER

    interface eth0

    mcast_src_ip 10.0.0.232

    virtual_router_id 51

    priority 101

    advert_int 2

    authentication {

        auth_type PASS

        auth_pass K8SHA_KA_AUTH

    }

    virtual_ipaddress {

        10.0.0.250

    }

    track_script {

        chk_apiserver

    }

}

EOF

Master02节点的配置：

mkdir -p /etc/keepalived



cat > /etc/keepalived/keepalived.conf << EOF

! Configuration File for keepalived

global_defs {

    router_id LVS_DEVEL

    script_user root

    enable_script_security

}



vrrp_script chk_apiserver {

    script "/etc/keepalived/check_apiserver.sh"

    interval 5

    weight -5

    fall 2

    rise 1

}



vrrp_instance VI_1 {

    state MASTER

    interface eth0

    mcast_src_ip 10.0.0.131

    virtual_router_id 51

    priority 101

    advert_int 2

    authentication {

        auth_type PASS

        auth_pass K8SHA_KA_AUTH

    }

    virtual_ipaddress {

        10.0.0.250

    }

    track_script {

        chk_apiserver

    }

}

EOF

Master03节点的配置：

mkdir -p /etc/keepalived



cat > /etc/keepalived/keepalived.conf << EOF

! Configuration File for keepalived

global_defs {

    router_id LVS_DEVEL

    script_user root

    enable_script_security

}



vrrp_script chk_apiserver {

    script "/etc/keepalived/check_apiserver.sh"

    interval 5

    weight -5

    fall 2

    rise 1

}



vrrp_instance VI_1 {

    state MASTER

    interface eth0

    mcast_src_ip 10.0.0.224

    virtual_router_id 51

    priority 101

    advert_int 2

    authentication {

        auth_type PASS

        auth_pass K8SHA_KA_AUTH

    }

    virtual_ipaddress {

        10.0.0.250

    }

    track_script {

        chk_apiserver

    }

}

EOF

所有Master节点配置健康检查文件：

cat > /etc/keepalived/check_apiserver.sh << EOF

#!/bin/bash

err=0

for k in \$(seq 1 3)

do

    check_code=\$(pgrep haproxy)

    if [[ \$check_code == "" ]]; then

        err=\$(expr \$err + 1)

        sleep 1

        continue

    else

        err=0

        break

    fi

done



if [[ \$err != "0" ]]; then

    echo "systemctl stop keepalived"

    /usr/bin/systemctl stop keepalived

    exit 1

else

    exit 0

fi

EOF



chmod +x /etc/keepalived/check_apiserver.sh

所有master节点启动haproxy和keepalived:

# 重新加载systemd服务配置

systemctl daemon-reload



# 开机自启并立即启动haproxy

systemctl enable --now haproxy



# 开机自启并立即启动keepalived

systemctl enable --now keepalived

所有节点测试VIP

[root@k8s-master02 ~]# ping 10.0.0.250

PING 10.0.0.250 (10.0.0.250) 56(84) bytes of data.

64 bytes from 10.0.0.250: icmp_seq=1 ttl=64 time=0.041 ms

64 bytes from 10.0.0.250: icmp_seq=2 ttl=64 time=0.038 ms

64 bytes from 10.0.0.250: icmp_seq=3 ttl=64 time=0.033 ms

64 bytes from 10.0.0.250: icmp_seq=4 ttl=64 time=0.060 ms

64 bytes from 10.0.0.250: icmp_seq=5 ttl=64 time=0.082 ms

^C

--- 10.0.0.250 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4119ms

rtt min/avg/max/mdev = 0.033/0.050/0.082/0.018 ms

[root@k8s-master02 ~]# telnet 10.0.0.250 8443

Trying 10.0.0.250...

Connected to 10.0.0.250.

Escape character is '^]'.

3.Runtime安装

所有节点配置安装源：

yum install wget jq psmisc vim net-tools telnet yum-utils device-mapper-persistent-data lvm2 git -y

yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

所有节点安装docker-ce：

yum install docker-ce containerd -y

可以无需安装docker，只需要配置和启动Containerd即可

所有节点配置Containerd所需的模块：

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf

overlay

br_netfilter

EOF

所有节点加载模块：

modprobe -- overlay

modprobe -- br_netfilter

所有节点配置Containerd所需的内核参数：

cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf

net.bridge.bridge-nf-call-iptables  = 1

net.ipv4.ip_forward                 = 1

net.bridge.bridge-nf-call-ip6tables = 1

EOF

所有节点加载内核参数配置：

sysctl --system

所有节点生成containerd标准文件：

containerd config default > /etc/containerd/config.toml

所有节点更改Containerd的Cgroup和Pause镜像配置：

sed -i 's#SystemdCgroup = false#SystemdCgroup = true#g' /etc/containerd/config.toml

sed -i 's#k8s.gcr.io/pause#registry.cn-hangzhou.aliyuncs.com/google_containers/pause#g' /etc/containerd/config.toml

sed -i 's#registry.gcr.io/pause#registry.cn-hangzhou.aliyuncs.com/google_containers/pause#g' /etc/containerd/config.toml

sed -i 's#registry.k8s.io/pause#registry.cn-hangzhou.aliyuncs.com/google_containers/pause#g' /etc/containerd/config.toml

所有节点启动 Containerd，并配置开机自启动：

systemctl daemon-reload

systemctl restart containerd

systemctl enable --now containerd

所有节点配置 crictl 客户端连接的运行时位置

cat > /etc/crictl.yaml <<EOF

runtime-endpoint: unix:///run/containerd/containerd.sock

image-endpoint: unix:///run/containerd/containerd.sock

timeout: 10

debug: false

EOF

4.安装Kubernetes组件

Master01节点下载kubernetes安装包

wget https://dl.k8s.io/v1.31.14/kubernetes-server-linux-amd64.tar.gz

以下操作都在master01执行

下载etcd安装包

wget https://github.com/etcd-io/etcd/releases/download/v3.5.15/etcd-v3.5.15-linux-amd64.tar.gz

解压kubernetes安装文件

tar -xf kubernetes-server-linux-amd64.tar.gz --strip-components=3 -C /usr/local/bin kubernetes/server/bin/kube{let,ctl,-apiserver,-controller-manager,-scheduler,-proxy}

解压etcd安装文件

tar -zxvf etcd-v3.5.15-linux-amd64.tar.gz --strip-components=1 -C /usr/local/bin etcd-v3.5.15-linux-amd64/etcd{,ctl}

版本查看：

kubelet --version

etcdctl version

将组件发送到其他节点

MasterNodes='k8s-master02 k8s-master03'

WorkNodes='k8s-node01 k8s-node02'



for NODE in $MasterNodes; do

  echo $NODE

  scp /usr/local/bin/kube{let,ctl,-apiserver,-controller-manager,-scheduler,-proxy} $NODE:/usr/local/bin/

  scp /usr/local/bin/etcd* $NODE:/usr/local/bin/

done



for NODE in $WorkNodes; do

  scp /usr/local/bin/kube{let,-proxy} $NODE:/usr/local/bin/

done



切换分支

cd /root/k8s-ha-install && git checkout manual-installation-v1.31.x

5.安装证书

二进制安装最关键步骤，一步错误全盘皆输，一定要注意每个步骤都是正确的

Master01节点下载证书工具

wget "https://pkg.cfssl.org/R1.2/cfssl_linux-amd64" -O /usr/local/bin/cfssl

wget "https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64" -O /usr/local/bin/cfssljson

chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson

所有Master节点创建etcd证书目录

mkdir /etc/etcd/ssl -p

所有节点创建kubernetes相关目录

mkdir -p /etc/kubernetes/pki

Master01节点生成etcd证书：

生成证书的CSR（证书签名请求文件，配置了一些域名、公司、单位）文件：

cd /root/k8s-ha-install/pki

生成etcd CA证书和CA证书的key

cfssl gencert -initca etcd-ca-csr.json | cfssljson -bare /etc/etcd/ssl/etcd-ca



cfssl gencert \

-ca=/etc/etcd/ssl/etcd-ca.pem \

-ca-key=/etc/etcd/ssl/etcd-ca-key.pem \

-config=ca-config.json \

-hostname=127.0.0.1,k8s-master01,k8s-master02,k8s-master03,10.0.0.232,10.0.0.131,10.0.0.224 \

-profile=kubernetes \

etcd-csr.json | cfssljson -bare /etc/etcd/ssl/etcd

将证书复制到其他节点

MasterNodes='k8s-master02 k8s-master03'



for NODE in $MasterNodes; do

  ssh $NODE "mkdir -p /etc/etcd/ssl"

  for FILE in etcd-ca-key.pem etcd-ca.pem etcd-key.pem etcd.pem; do

    scp /etc/etcd/ssl/${FILE} $NODE:/etc/etcd/ssl/${FILE}

  done

Done

Master01生成kubernetes CA证书：

生成kubernetes CA证书

cfssl gencert -initca ca-csr.json | cfssljson -bare /etc/kubernetes/pki/ca

Master01生成apiserver证书

注意：192.168.0.0是k8s service的网段，如果说需要更改k8s service的网段，那就更需要修改192.168.0.1

cfssl gencert \

-ca=/etc/kubernetes/pki/ca.pem \

-ca-key=/etc/kubernetes/pki/ca-key.pem \

-config=ca-config.json \

-hostname=192.168.0.1,10.0.0.250,127.0.0.1,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster,kubernetes.default.svc.cluster.local,10.0.0.232,10.0.0.131,10.0.0.224 \

-profile=kubernetes \

apiserver-csr.json | cfssljson -bare /etc/kubernetes/pki/apiserver

生成apiserver的聚合证书：

cfssl gencert -initca front-proxy-ca-csr.json | cfssljson -bare /etc/kubernetes/pki/front-proxy-ca



cfssl gencert \

-ca=/etc/kubernetes/pki/front-proxy-ca.pem \

-ca-key=/etc/kubernetes/pki/front-proxy-ca-key.pem \

-config=ca-config.json \

-profile=kubernetes \

front-proxy-client-csr.json | cfssljson -bare /etc/kubernetes/pki/front-proxy-client



#生成controller-manager证书

cfssl gencert \

-ca=/etc/kubernetes/pki/ca.pem \

-ca-key=/etc/kubernetes/pki/ca-key.pem \

-config=ca-config.json \

-profile=kubernetes \

manager-csr.json | cfssljson -bare /etc/kubernetes/pki/controller-manager



#set-cluster: 设置集群

kubectl config set-cluster kubernetes \

--certificate-authority=/etc/kubernetes/pki/ca.pem \

--embed-certs=true \

--server=https://10.0.0.250:8443 \

--kubeconfig=/etc/kubernetes/controller-manager.kubeconfig



#设置上下文

kubectl config set-context system:kube-controller-manager@kubernetes \

--cluster=kubernetes \

--user=system:kube-controller-manager \

--kubeconfig=/etc/kubernetes/controller-manager.kubeconfig



#set-credentials 设置用户

kubectl config set-credentials system:kube-controller-manager \

--client-certificate=/etc/kubernetes/pki/controller-manager.pem \

--client-key=/etc/kubernetes/pki/controller-manager-key.pem \

--embed-certs=true \

--kubeconfig=/etc/kubernetes/controller-manager.kubeconfig



#设置默认上下文

kubectl config use-context system:kube-controller-manager@kubernetes \

--kubeconfig=/etc/kubernetes/controller-manager.kubeconfig

生成scheduler证书

cfssl gencert \

-ca=/etc/kubernetes/pki/ca.pem \

-ca-key=/etc/kubernetes/pki/ca-key.pem \

-config=ca-config.json \

-profile=kubernetes \

scheduler-csr.json | cfssljson -bare /etc/kubernetes/pki/scheduler



#设置集群信息

kubectl config set-cluster kubernetes \

--certificate-authority=/etc/kubernetes/pki/ca.pem \

--embed-certs=true \

--server=https://10.0.0.250:8443 \

--kubeconfig=/etc/kubernetes/scheduler.kubeconfig



#设置用户凭证

kubectl config set-credentials system:kube-scheduler \

--client-certificate=/etc/kubernetes/pki/scheduler.pem \

--client-key=/etc/kubernetes/pki/scheduler-key.pem \

--embed-certs=true \

--kubeconfig=/etc/kubernetes/scheduler.kubeconfig



#设置上下文

kubectl config set-context system:kube-scheduler@kubernetes \

--cluster=kubernetes \·

--user=system:kube-scheduler \

--kubeconfig=/etc/kubernetes/scheduler.kubeconfig



#使用默认上下文

kubectl config use-context system:kube-scheduler@kubernetes \

--kubeconfig=/etc/kubernetes/scheduler.kubeconfig

生成管理员证书

cfssl gencert \

-ca=/etc/kubernetes/pki/ca.pem \

-ca-key=/etc/kubernetes/pki/ca-key.pem \

-config=ca-config.json \

-profile=kubernetes \

admin-csr.json | cfssljson -bare /etc/kubernetes/pki/admin



# 设置集群

kubectl config set-cluster kubernetes \

--certificate-authority=/etc/kubernetes/pki/ca.pem \

--embed-certs=true \

--server=https://10.0.0.250:8443 \

--kubeconfig=/etc/kubernetes/admin.kubeconfig



# 设置用户凭证

kubectl config set-credentials kubernetes-admin \

--client-certificate=/etc/kubernetes/pki/admin.pem \

--client-key=/etc/kubernetes/pki/admin-key.pem \

--embed-certs=true \

--kubeconfig=/etc/kubernetes/admin.kubeconfig



# 设置上下文

kubectl config set-context kubernetes-admin@kubernetes \

--cluster=kubernetes \

--user=kubernetes-admin \

--kubeconfig=/etc/kubernetes/admin.kubeconfig



# 设置默认上下文

kubectl config use-context kubernetes-admin@kubernetes \

--kubeconfig=/etc/kubernetes/admin.kubeconfig

生成公钥私钥

# 创建SA私钥

openssl genrsa -out /etc/kubernetes/pki/sa.key 2048



# 提取公钥

openssl rsa -in /etc/kubernetes/pki/sa.key -pubout -out /etc/kubernetes/pki/sa.pub



# 发送证书至其他Master节点

for NODE in k8s-master02 k8s-master03; do

  for FILE in $(ls /etc/kubernetes/pki | grep -v etcd); do

    scp /etc/kubernetes/pki/${FILE} $NODE:/etc/kubernetes/pki/${FILE};

  done;

  for FILE in admin.kubeconfig controller-manager.kubeconfig scheduler.kubeconfig; do

    scp /etc/kubernetes/${FILE} $NODE:/etc/kubernetes/${FILE};

  done;

done



# 查看证书文件

ls /etc/kubernetes/pki/

ls /etc/kubernetes/pki/ | wc -l

    6.Kubernetes组件配置

    Etcd配置：

    Master01的配置文件：

    vim /etc/etcd/etcd.config.yml



name: 'k8s-master01'

data-dir: /var/lib/etcd

wal-dir: /var/lib/etcd/wal

snapshot-count: 5000

heartbeat-interval: 100

election-timeout: 1000

quota-backend-bytes: 0

listen-peer-urls: 'https://10.0.0.232:2380'

listen-client-urls: 'https://10.0.0.232:2379,http://127.0.0.1:2379'

max-snapshots: 3

max-wals: 5

cors:

initial-advertise-peer-urls: 'https://10.0.0.232:2380'

advertise-client-urls: 'https://10.0.0.232:2379'

discovery:

discovery-fallback: 'proxy'

discovery-proxy:

discovery-srv:

initial-cluster: 'k8s-master01=https://10.0.0.232:2380,k8s-master02=https://10.0.0.131:2380,k8s-master03=https://10.0.0.224:2380'

initial-cluster-token: 'etcd-k8s-cluster'

initial-cluster-state: 'new'

strict-reconfig-check: false

enable-v2: true

enable-pprof: true

proxy: 'off'

proxy-failure-wait: 5000

proxy-refresh-interval: 30000

proxy-dial-timeout: 1000

proxy-write-timeout: 5000

proxy-read-timeout: 0

client-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

peer-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  peer-client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

debug: false

log-package-levels:

log-outputs: [default]

force-new-cluster: false

    Master02的配置文件：

    vim /etc/etcd/etcd.config.yml



name: 'k8s-master02'

data-dir: /var/lib/etcd

wal-dir: /var/lib/etcd/wal

snapshot-count: 5000

heartbeat-interval: 100

election-timeout: 1000

quota-backend-bytes: 0

listen-peer-urls: 'https://10.0.0.131:2380'

listen-client-urls: 'https://10.0.0.131:2379,http://127.0.0.1:2379'

max-snapshots: 3

max-wals: 5

cors:

initial-advertise-peer-urls: 'https://10.0.0.131:2380'

advertise-client-urls: 'https://10.0.0.131:2379'

discovery:

discovery-fallback: 'proxy'

discovery-proxy:

discovery-srv:

initial-cluster: 'k8s-master01=https://10.0.0.232:2380,k8s-master02=https://10.0.0.131:2380,k8s-master03=https://10.0.0.224:2380'

initial-cluster-token: 'etcd-k8s-cluster'

initial-cluster-state: 'new'

strict-reconfig-check: false

enable-v2: true

enable-pprof: true

proxy: 'off'

proxy-failure-wait: 5000

proxy-refresh-interval: 30000

proxy-dial-timeout: 1000

proxy-write-timeout: 5000

proxy-read-timeout: 0

client-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

peer-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  peer-client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

debug: false

log-package-levels:

log-outputs: [default]

force-new-cluster: false

    Master03的配置文件：

    vim /etc/etcd/etcd.config.yml



name: 'k8s-master03'

data-dir: /var/lib/etcd

wal-dir: /var/lib/etcd/wal

snapshot-count: 5000

heartbeat-interval: 100

election-timeout: 1000

quota-backend-bytes: 0

listen-peer-urls: 'https://10.0.0.224:2380'

listen-client-urls: 'https://10.0.0.224:2379,http://127.0.0.1:2379'

max-snapshots: 3

max-wals: 5

cors:

initial-advertise-peer-urls: 'https://10.0.0.224:2380'

advertise-client-urls: 'https://10.0.0.224:2379'

discovery:

discovery-fallback: 'proxy'

discovery-proxy:

discovery-srv:

initial-cluster: 'k8s-master01=https://10.0.0.232:2380,k8s-master02=https://10.0.0.131:2380,k8s-master03=https://10.0.0.224:2380'

initial-cluster-token: 'etcd-k8s-cluster'

initial-cluster-state: 'new'

strict-reconfig-check: false

enable-v2: true

enable-pprof: true

proxy: 'off'

proxy-failure-wait: 5000

proxy-refresh-interval: 30000

proxy-dial-timeout: 1000

proxy-write-timeout: 5000

proxy-read-timeout: 0

client-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

peer-transport-security:

  cert-file: '/etc/kubernetes/pki/etcd/etcd.pem'

  key-file: '/etc/kubernetes/pki/etcd/etcd-key.pem'

  peer-client-cert-auth: true

  trusted-ca-file: '/etc/kubernetes/pki/etcd/etcd-ca.pem'

  auto-tls: true

debug: false

log-package-levels:

log-outputs: [default]

force-new-cluster: false

    所有节点配置Etcd服务

    vim /usr/lib/systemd/system/etcd.service



[Unit]

Description=Etcd Service

Documentation=https://coreos.com/etcd/docs/latest/

After=network.target



[Service]

Type=notify

ExecStart=/usr/local/bin/etcd --config-file=/etc/etcd/etcd.config.yml

Restart=on-failure

RestartSec=10

LimitNOFILE=65536



[Install]

WantedBy=multi-user.target

Alias=etcd3.service

    所有Master节点创建etcd证书目录并创建软链接

    mkdir /etc/kubernetes/pki/etcd

ln -s /etc/etcd/ssl/* /etc/kubernetes/pki/etcd/

    重载systemd并启动etcd，设置开机自启

    systemctl daemon-reload

systemctl enable --now etcd

    查看etcd集群状态

    export ETCDCTL_API=3

etcdctl --endpoints="10.0.0.232:2379,10.0.0.131:2379,10.0.0.224:2379" \

--cacert=/etc/kubernetes/pki/etcd/etcd-ca.pem \

--cert=/etc/kubernetes/pki/etcd/etcd.pem \

--key=/etc/kubernetes/pki/etcd/etcd-key.pem \

endpoint status --write-out=table

    API server配置：

    Master01:

    cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF

[Unit]

Description=Kubernetes API Server

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-apiserver \

  --v=2 \

  --allow-privileged=true \

  --bind-address=0.0.0.0 \

  --secure-port=6443 \

  --advertise-address=10.0.0.232 \

  --service-cluster-ip-range=192.168.0.0/16 \

  --service-node-port-range=30000-32767 \

  --etcd-servers=https://10.0.0.232:2379,https://10.0.0.131:2379,https://10.0.0.224:2379 \

  --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem \

  --etcd-certfile=/etc/etcd/ssl/etcd.pem \

  --etcd-keyfile=/etc/etcd/ssl/etcd-key.pem \

  --client-ca-file=/etc/kubernetes/pki/ca.pem \

  --tls-cert-file=/etc/kubernetes/pki/apiserver.pem \

  --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem \

  --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem \

  --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem \

  --service-account-key-file=/etc/kubernetes/pki/sa.pub \

  --service-account-signing-key-file=/etc/kubernetes/pki/sa.key \

  --service-account-issuer=https://kubernetes.default.svc.cluster.local \

  --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname \

  --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota \

  --authorization-mode=Node,RBAC \

  --enable-bootstrap-token-auth=true \

  --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem \

  --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem \

  --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem \

  --requestheader-allowed-names=aggregator \

  --requestheader-group-headers=X-Remote-Group \

  --requestheader-extra-headers-prefix=X-Remote-Extra- \

  --requestheader-username-headers=X-Remote-User

  # --token-auth-file=/etc/kubernetes/token.csv



Restart=on-failure

RestartSec=10s

LimitNOFILE=65535



[Install]

WantedBy=multi-user.target

EOF

    Master02:

    cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF

[Unit]

Description=Kubernetes API Server

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-apiserver \

  --v=2 \

  --allow-privileged=true \

  --bind-address=0.0.0.0 \

  --secure-port=6443 \

  --advertise-address=10.0.0.131 \

  --service-cluster-ip-range=192.168.0.0/16 \

  --service-node-port-range=30000-32767 \

  --etcd-servers=https://10.0.0.232:2379,https://10.0.0.131:2379,https://10.0.0.224:2379 \

  --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem \

  --etcd-certfile=/etc/etcd/ssl/etcd.pem \

  --etcd-keyfile=/etc/etcd/ssl/etcd-key.pem \

  --client-ca-file=/etc/kubernetes/pki/ca.pem \

  --tls-cert-file=/etc/kubernetes/pki/apiserver.pem \

  --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem \

  --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem \

  --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem \

  --service-account-key-file=/etc/kubernetes/pki/sa.pub \

  --service-account-signing-key-file=/etc/kubernetes/pki/sa.key \

  --service-account-issuer=https://kubernetes.default.svc.cluster.local \

  --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname \

  --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota \

  --authorization-mode=Node,RBAC \

  --enable-bootstrap-token-auth=true \

  --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem \

  --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem \

  --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem \

  --requestheader-allowed-names=aggregator \

  --requestheader-group-headers=X-Remote-Group \

  --requestheader-extra-headers-prefix=X-Remote-Extra- \

  --requestheader-username-headers=X-Remote-User

  # --token-auth-file=/etc/kubernetes/token.csv



Restart=on-failure

RestartSec=10s

LimitNOFILE=65535



[Install]

WantedBy=multi-user.target

EOF

    Master03:

    cat > /usr/lib/systemd/system/kube-apiserver.service <<EOF

[Unit]

Description=Kubernetes API Server

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-apiserver \

  --v=2 \

  --allow-privileged=true \

  --bind-address=0.0.0.0 \

  --secure-port=6443 \

  --advertise-address=10.0.0.224 \

  --service-cluster-ip-range=192.168.0.0/16 \

  --service-node-port-range=30000-32767 \

  --etcd-servers=https://10.0.0.232:2379,https://10.0.0.131:2379,https://10.0.0.224:2379 \

  --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem \

  --etcd-certfile=/etc/etcd/ssl/etcd.pem \

  --etcd-keyfile=/etc/etcd/ssl/etcd-key.pem \

  --client-ca-file=/etc/kubernetes/pki/ca.pem \

  --tls-cert-file=/etc/kubernetes/pki/apiserver.pem \

  --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem \

  --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem \

  --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem \

  --service-account-key-file=/etc/kubernetes/pki/sa.pub \

  --service-account-signing-key-file=/etc/kubernetes/pki/sa.key \

  --service-account-issuer=https://kubernetes.default.svc.cluster.local \

  --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname \

  --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota \

  --authorization-mode=Node,RBAC \

  --enable-bootstrap-token-auth=true \

  --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem \

  --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem \

  --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem \

  --requestheader-allowed-names=aggregator \

  --requestheader-group-headers=X-Remote-Group \

  --requestheader-extra-headers-prefix=X-Remote-Extra- \

  --requestheader-username-headers=X-Remote-User

  # --token-auth-file=/etc/kubernetes/token.csv



Restart=on-failure

RestartSec=10s

LimitNOFILE=65535



[Install]

WantedBy=multi-user.target

EOF

    所有Master节点执行，重载配置并启动kube-apiserver，设置开机自启

    systemctl daemon-reload && systemctl e

    查看kube-apiserver运行状态

    systemctl status kube-apiserver

    所有Master节点配置controller-manager

    cat > /usr/lib/systemd/system/kube-controller-manager.service <<EOF

[Unit]

Description=Kubernetes Controller Manager

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-controller-manager \

  --v=2 \

  --root-ca-file=/etc/kubernetes/pki/ca.pem \

  --cluster-signing-cert-file=/etc/kubernetes/pki/ca.pem \

  --cluster-signing-key-file=/etc/kubernetes/pki/ca-key.pem \

  --service-account-private-key-file=/etc/kubernetes/pki/sa.key \

  --kubeconfig=/etc/kubernetes/controller-manager.kubeconfig \

  --authentication-kubeconfig=/etc/kubernetes/controller-manager.kubeconfig \

  --authorization-kubeconfig=/etc/kubernetes/controller-manager.kubeconfig \

  --leader-elect=true \

  --use-service-account-credentials=true \

  --node-monitor-grace-period=40s \

  --node-monitor-period=5s \

  --controllers=*,bootstrapsigner,tokencleaner \

  --allocate-node-cidrs=true \

  --cluster-cidr=172.16.0.0/16 \

  --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem \

  --node-cidr-mask-size=24



Restart=always

RestartSec=10s



[Install]

WantedBy=multi-user.target

EOF

    所有Master节点启动kube-controller-manager

    systemctl daemon-reload

systemctl enable --now kube-controller-manager

    查看运行状态

    systemctl status kube-controller-manager

    所有Master节点配置kube-scheduler service（所有节点都一样）

    cat > /usr/lib/systemd/system/kube-scheduler.service <<EOF

[Unit]

Description=Kubernetes Scheduler

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-scheduler \

  --v=2 \

  --leader-elect=true \

  --authentication-kubeconfig=/etc/kubernetes/scheduler.kubeconfig \

  --authorization-kubeconfig=/etc/kubernetes/scheduler.kubeconfig \

  --kubeconfig=/etc/kubernetes/scheduler.kubeconfig



Restart=always

RestartSec=10s



[Install]

WantedBy=multi-user.target

EOF

    重载systemd、启动服务

    systemctl daemon-reload

systemctl enable --now kube-scheduler

    查看运行状态

    systemctl status kube-scheduler

      7.TLS Bootstrapping

      只需要在Master01节点做下列bootstrap配置：

      cd /root/k8s-ha-install/bootstrap



kubectl config set-cluster kubernetes \

--certificate-authority=/etc/kubernetes/pki/ca.pem \

--embed-certs=true \

--server=https://10.0.0.250:8443 \

--kubeconfig=/etc/kubernetes/bootstrap-kubelet.kubeconfig



kubectl config set-credentials tls-bootstrap-token-user \

--token=c8ad9c.2e4d610cf3e7426e \

--kubeconfig=/etc/kubernetes/bootstrap-kubelet.kubeconfig



kubectl config set-context tls-bootstrap-token-user@kubernetes \

--cluster=kubernetes \

--user=tls-bootstrap-token-user \

--kubeconfig=/etc/kubernetes/bootstrap-kubelet.kubeconfig



kubectl config use-context tls-bootstrap-token-user@kubernetes \

--kubeconfig=/etc/kubernetes/bootstrap-kubelet.kubeconfig



mkdir -p /root/.kube ; cp /etc/kubernetes/admin.kubeconfig /root/.kube/config

      可以正常查询集群状态，才可以继续往下，否则不行，需要排查K8s组件是否有故障

      [root@k8s-master01 bootstrap]#Kubectl get cs

Warning: v1 ComponentStatus is deprecated in v1.19+

NAME                 STATUS    MESSAGE   ERROR

controller-manager   Healthy   ok        

scheduler            Healthy   ok        

etcd-0               Healthy   ok

      创建bootstrap相关资源：

      [root@k8s-master01 bootstrap]# kubectl create -f bootstrap.secret.yaml

secret/bootstrap-token-c8ad9c created

clusterrolebinding.rbac.authorization.k8s.io/kubelet-bootstrap created

clusterrolebinding.rbac.authorization.k8s.io/node-autoapprove-bootstrap created

clusterrolebinding.rbac.authorization.k8s.io/node-autoapprove-certificate-rotation created

clusterrole.rbac.authorization.k8s.io/system:kube-apiserver-to-kubelet created

clusterrolebinding.rbac.authorization.k8s.io/system:kube-apiserver created

        8.Node节点的配置

        Node 节点上主要部署公司的一些业务应用，生产环境中不建议 Master 节点部署系统组件之外的其他 Pod，测试环境可以允许 Master 节点部署 Pod 以节省系统资源。

        Master01节点复制证书至其他节点：

        cd /etc/kubernetes/



for NODE in k8s-master02 k8s-master03 k8s-node01 k8s-node02; do

    ssh $NODE mkdir -p /etc/kubernetes/pki

    for FILE in pki/ca.pem pki/ca-key.pem pki/front-proxy-ca.pem bootstrap-kubelet.kubeconfig; do

        scp /etc/kubernetes/$FILE $NODE:/etc/kubernetes/${FILE}

    done

Done

        所有节点创建Kubelet配置目录

        mkdir -p /var/lib/kubelet /var/log/kubernete

        所有节点配置kubelet service

        cat > /usr/lib/systemd/system/kubelet.service <<EOF

[Unit]

Description=Kubernetes Kubelet

Documentation=https://github.com/kubernetes/kubernetes



[Service]

ExecStart=/usr/local/bin/kubelet

Restart=always

StartLimitInterval=0

RestartSec=10



[Install]

WantedBy=multi-user.target

EOF

        所有节点配置kubelet service的配置文件

        cat > /etc/systemd/system/kubelet.service.d/10-kubelet.conf <<EOF

[Service]

Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.kubeconfig --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"

Environment="KUBELET_SYSTEM_ARGS=--container-runtime-endpoint=unix:///run/containerd/containerd.sock"

Environment="KUBELET_CONFIG_ARGS=--config=/etc/kubernetes/kubelet-conf.yml"

Environment="KUBELET_EXTRA_ARGS=--node-labels=node.kubernetes.io/node='' "

ExecStart=

ExecStart=/usr/local/bin/kubelet \$KUBELET_KUBECONFIG_ARGS \$KUBELET_CONFIG_ARGS \$KUBELET_SYSTEM_ARGS \$KUBELET_EXTRA_ARGS

EOF

        所有节点创建kubelet的配置文件

        cat > /etc/kubernetes/kubelet-conf.yml <<EOF

apiVersion: kubelet.config.k8s.io/v1beta1

kind: KubeletConfiguration

address: 0.0.0.0

port: 10250

readOnlyPort: 10255

authentication:

  anonymous:

    enabled: false

  webhook:

    cacheTTL: 2m0s

    enabled: true

  x509:

    clientCAFile: /etc/kubernetes/pki/ca.pem

authorization:

  mode: Webhook

  webhook:

    cacheAuthorizedTTL: 5m0s

    cacheUnauthorizedTTL: 30s

cgroupDriver: systemd

cgroupsPerQOS: true

clusterDNS:

- 192.168.0.10

clusterDomain: cluster.local

containerLogMaxFiles: 5

containerLogMaxSize: 10Mi

contentType: application/vnd.kubernetes.protobuf

cpuCFSQuota: true

cpuManagerPolicy: none

cpuManagerReconcilePeriod: 10s

enableControllerAttachDetach: true

enableDebuggingHandlers: true

enforceNodeAllocatable:

- pods

eventBurst: 10

eventRecordQPS: 5

evictionHard:

  imagefs.available: 15%

  memory.available: 100Mi

  nodefs.available: 10%

  nodefs.inodesFree: 5%

evictionPressureTransitionPeriod: 5m0s

failSwapOn: true

fileCheckFrequency: 20s

hairpinMode: promiscuous-bridge

healthzBindAddress: 127.0.0.1

healthzPort: 10248

httpCheckFrequency: 20s

imageGCHighThresholdPercent: 85

imageGCLowThresholdPercent: 80

imageMinimumGCAge: 2m0s

iptablesDropBit: 15

iptablesMasqueradeBit: 14

kubeAPIBurst: 10

kubeAPIQPS: 5

makeIPTablesUtilChains: true

maxOpenFiles: 1000000

maxPods: 110

nodeStatusUpdateFrequency: 10s

oomScoreAdj: -999

podPidsLimit: -1

registryBurst: 10

registryPullQPS: 5

resolvConf: /etc/resolv.conf

rotateCertificates: true

runtimeRequestTimeout: 2m0s

serializeImagePulls: true

staticPodPath: /etc/kubernetes/manifests

streamingConnectionIdleTimeout: 4h0m0s

syncFrequency: 1m0s

volumeStatsAggPeriod: 1m0s

EOF

        启动所有节点kubelet

        systemctl daemon-reload

systemctl enable --now kubelet

        此时系统日志/var/log/messages显示只有如下两种信息为正常，安装calico后即可恢复

        Jul 30 12:33:51 k8s-master02 kubelet[2175010]: I0730 12:33:51.365098 2175010 kuberuntime_manager.go:1635] "Updating runtime config through cri with podcidr" CIDR="172.16.0.0/24"

Jul 30 12:33:51 k8s-master02 kubelet[2175010]: I0730 12:33:51.366104 2175010 kubelet_network.go:61] "Updating Pod CIDR" originalPodCIDR="" newPodCIDR="172.16.0.0/24"

Jul 30 12:33:52 k8s-master02 kubelet[2175010]: I0730 12:33:52.141584 2175010 apiserver.go:52] "Watching apiserver"

Jul 30 12:33:52 k8s-master02 kubelet[2175010]: I0730 12:33:52.149643 2175010 desired_state_of_world_populator.go:155] "Finished populating initial desired state of world"

        所有节点初始化完成后，查看集群状态（NotReady不影响）

        [root@k8s-master01 ~]# kubectl get nodes

NAME           STATUS     ROLES    AGE     VERSION

k8s-master01   NotReady   <none>   6m42s   v1.31.14

k8s-master02   NotReady   <none>   8m12s   v1.31.14

k8s-master03   NotReady   <none>   67s     v1.31.14

k8s-node01     NotReady   <none>   29s     v1.31.14

k8s-node02     NotReady   <none>   24s     v1.31.14

        注意，如果不是高可用集群，192.168.181.236:8443改为 master01 的地址，8443 改为 apiserver 的端口，默认是 6443，生产 kube-proxy 的证书

        以下操作只在 Master01节点 执行

        cd /root/k8s-ha-install/pki

cfssl gencert \

  -ca=/etc/kubernetes/pki/ca.pem \

  -ca-key=/etc/kubernetes/pki/ca-key.pem \

  -config=ca-config.json \

  -profile=kubernetes \

  kube-proxy-csr.json | cfssljson -bare /etc/kubernetes/pki/kube-proxy



kubectl config set-cluster kubernetes \

  --certificate-authority=/etc/kubernetes/pki/ca.pem \

  --embed-certs=true \

  --server=https://10.0.0.250:8443 \

  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig



kubectl config set-credentials system:kube-proxy \

  --client-certificate=/etc/kubernetes/pki/kube-proxy.pem \

  --client-key=/etc/kubernetes/pki/kube-proxy-key.pem \

  --embed-certs=true \

  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig



kubectl config set-context system:kube-proxy@kubernetes \

  --cluster=kubernetes \

  --user=system:kube-proxy \

  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig



kubectl config use-context system:kube-proxy@kubernetes \

  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig

        将kubeconfig发送至其他节点

        # 分发到另外两台master

for NODE in k8s-master02 k8s-master03; do

    scp /etc/kubernetes/kube-proxy.kubeconfig $NODE:/etc/kubernetes/kube-proxy.kubeconfig

done



# 分发到node节点

for NODE in k8s-node01 k8s-node02; do

    scp /etc/kubernetes/kube-proxy.kubeconfig $NODE:/etc/kubernetes/kube-proxy.kubeconfig

done

        所有节点添加kube-proxy的配置和service文件：

        cat > /usr/lib/systemd/system/kube-proxy.service <<EOF

[Unit]

Description=Kubernetes Kube Proxy

Documentation=https://github.com/kubernetes/kubernetes

After=network.target



[Service]

ExecStart=/usr/local/bin/kube-proxy \\

  --config=/etc/kubernetes/kube-proxy.yaml \\

  --v=2



Restart=always

RestartSec=10s



[Install]

WantedBy=multi-user.target

EOF

        如果更改了集群pod的网段，需要更改kube-proxy.yaml和clusterCIDR为自己的Pod网段

        cat > /etc/kubernetes/kube-proxy.yaml <<EOF

apiVersion: kubeproxy.config.k8s.io/v1alpha1

bindAddress: 0.0.0.0

clientConnection:

  acceptContentTypes: ""

  burst: 10

  contentType: application/vnd.kubernetes.protobuf

  kubeconfig: /etc/kubernetes/kube-proxy.kubeconfig

  qps: 5

clusterCIDR: 172.16.0.0/16

configSyncPeriod: 15m0s

conntrack:

  max: null

  maxPerCore: 32768

  min: 131072

  tcpCloseWaitTimeout: 1h0m0s

  tcpEstablishedTimeout: 24h0m0s

enableProfiling: false

healthzBindAddress: 0.0.0.0:10256

hostnameOverride: ""

iptables:

  masqueradeAll: false

  masqueradeBit: 14

  minSyncPeriod: 0s

  syncPeriod: 30s

ipvs:

  masqueradeAll: true

  minSyncPeriod: 5s

  scheduler: "rr"

  syncPeriod: 30s

kind: KubeProxyConfiguration

metricsBindAddress: 127.0.0.1:10249

mode: "ipvs"

nodePortAddresses: null

oomScoreAdj: -999

portRange: ""

udpIdleTimeout: 250ms

EOF

        所有节点启动kube-proxy

        systemctl daemon-reload

systemctl enable --now kube-proxy

        9.Calico组件的安装

        以下步骤只在 master01 执行：

        cd /root/k8s-ha-install/calico/

        修改Pod网段：

        sed -i "s#POD_CIDR#172.16.0.0/16#g" calico.yaml

kubectl apply -f calico.yaml

        此时节点全部变为Ready状态

        kubectl get node

        10.安装CoreDNS

        如果更改了k8s service的网段，需要把coredns的serviceIP改成K8s service网段的第十个IP，如果下面的命令没法改，就vim进文件改，改clusterIP为192.168.0.10

        cd /root/k8s-ha-install/

COREDNS_SERVICE_IP=`kubectl get svc | grep kubernetes | awk '{print $3}'`0

sed -i "s#KUBEDNS_SERVICE_IP#${COREDNS_SERVICE_IP}#g" CoreDNS/coredns.yaml

        安装coredns

        kubectl create -f CoreDNS/coredns.yaml

          11.Metrics部署

          在新版的 Kubernetes 中系统资源的采集均使用 Metrics-server，可以通过 Metrics 采集节点和 Pod 的内存、磁盘、CPU 和网络的使用率。

          以下操作均在 master01 节点执行 安装 metrics server

          cd /root/k8s-ha-install/metrics-server

kubectl create -f .

          等pod起来后，查看资源利用率

          [root@k8s-master02 ~]# kubectl top nodes

NAME           CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%   

k8s-master01   89m          1%     1346Mi          8%        

k8s-master02   158m         1%     1195Mi          7%        

k8s-master03   82m          1%     1232Mi          7%        

k8s-node01     45m          1%     823Mi           10%       

k8s-node02     44m          1%     821Mi           10%       

[root@k8s-master02 ~]# kubectl top pod -A

NAMESPACE              NAME                                         CPU(cores)   MEMORY(bytes)   

default                cluster-test-6ffdf9cb49-w82dz                0m           0Mi             

default                nginx-594c9bbcbd-zd6wx                       0m           6Mi             

krm                    krm-backend-f4f5c95f9-fnxxw                  1m           27Mi            

krm                    krm-frontend-856b4fb57b-wlg54                1m           4Mi             

kube-system            calico-kube-controllers-7d67d4b9c7-c7hvv     1m           19Mi            

kube-system            calico-node-9qcsl                            12m          156Mi           

kube-system            calico-node-c8m9k                            14m          151Mi           

kube-system            calico-node-gk5vj                            13m          156Mi           

kube-system            calico-node-hqc7b                            15m          149Mi           

kube-system            calico-node-s6psb                            10m          158Mi           

kube-system            coredns-fcd6c9c4-hgsmk                       1m           18Mi            

kube-system            coredns-fcd6c9c4-zcz76                       1m           16Mi            

kube-system            etcd-k8s-master01                            16m          98Mi            

kube-system            etcd-k8s-master02                            19m          96Mi            

kube-system            etcd-k8s-master03                            15m          97Mi            

kube-system            kube-apiserver-k8s-master01                  16m          324Mi           

kube-system            kube-apiserver-k8s-master02                  18m          225Mi           

kube-system            kube-apiserver-k8s-master03                  14m          248Mi           

kube-system            kube-controller-manager-k8s-master01         5m           65Mi            

kube-system            kube-controller-manager-k8s-master02         1m           22Mi            

kube-system            kube-controller-manager-k8s-master03         1m           19Mi            

kube-system            kube-proxy-7tl52                             3m           22Mi            

kube-system            kube-proxy-bc55f                             3m           26Mi            

kube-system            kube-proxy-dmq2w                             5m           22Mi            

kube-system            kube-proxy-hmjjz                             3m           25Mi            

kube-system            kube-proxy-zz7j4                             4m           26Mi            

kube-system            kube-scheduler-k8s-master01                  2m           25Mi            

kube-system            kube-scheduler-k8s-master02                  2m           24Mi            

kube-system            kube-scheduler-k8s-master03                  1m           22Mi            

kube-system            metrics-server-7f9b8dc8fb-mqqwz              2m           26Mi            

kubernetes-dashboard   dashboard-metrics-scraper-678ffd64dd-z8shf   1m           16Mi            

kubernetes-dashboard   kubernetes-dashboard-79d7fbff9b-bf2cs        1m           35Mi

            12.Dashboard部署

            Dashboard用于展示集群中的各类资源，同时也可以通过Dashboard实时查看Pod日志和在容器中执行一些命令。

            cd /root/k8s-ha-install/dashboard/

kubectl create -f .

            更改 dashboard 的 svc 为 NodePort：

            kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard



ports:

- port: 443

  protocol: TCP

  targetPort: 8443

selector:

  k8s-app: kubernetes-dashboard

sessionAffinity: None

type: ClusterIP

            将 ClusterIP 更改为 NodePort（如果已经为 NodePort 忽略此步骤）：

            查看端口号：

            kubectl get svc kubernetes-dashboard -n kubernetes-dashboard

            随后根据自己的实例端口号，通过EIP+映射端口号即可访问到dashboard。

            访问https://10.0.0.232:31106，把端口和IP改成自己的，选择token认证，随后创建Token:

            kubectl create token admin-user -n kube-system

            更好用的多集群管理工具 KRM部署

            KRM采用前后端分离架构，前端使用Vue实现，后端使用Go实现。

            KRM安装时需要把服务安装到Kubernetes集群当中，之后可以在KRM中添加被管理的集群，所以要求KRM所在的集群需要和其它被管理的集群的APIServer能够通信，其它无要求，安装无侵入。

            ## 服务部署

            在安装KRM的集群中创建Namespace，并授权 `注意: 下述步骤将KRM安装到了krm命名空间，如果需要更改Namespace，需要把下面步骤所有关于Namespace的地方更改为自己的Namespace，推荐不更改Namespace`
             

            kubectl create ns krm

kubectl create sa krm-backend -n krm

kubectl create rolebinding krm-backend --clusterrole=edit --serviceaccount=krm:krm-backend --namespace=krm

kubectl create clusterrole namespace-creater --verb=create --resource=namespaces

kubectl create clusterrolebinding krm-backend-ns-creater --clusterrole=namespace-creater --serviceaccount=krm:krm-backend --namespace=krm

            部署后端服务

            cat<<EOF | kubectl -n krm apply -f -

---

apiVersion: v1

kind: Service

metadata:

  labels:

    app: krm-backend

  name: krm-backend

spec:

  ports:

  - name: http

    port: 8080

    protocol: TCP

    targetPort: 8080

  selector:

    app: krm-backend

  sessionAffinity: None

  type: ClusterIP

---

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: krm-backend

  name: krm-backend

spec:

  replicas: 1

  selector:

    matchLabels:

      app: krm-backend

  strategy:

    rollingUpdate:

      maxSurge: 1

      maxUnavailable: 0

    type: RollingUpdate

  template:

    metadata:

      labels:

        app: krm-backend

    spec:

      serviceAccountName: krm-backend

      containers:

      - env:

        - name: TZ

          value: Asia/Shanghai

        - name: LANG

          value: C.UTF-8

        - name: GIN_MODE

          value: release

        - name: LOG_LEVEL

          value: info

        - name: USERNAME

          value: 21232F297A57A5A743894A0E4A801FC3

        - name: PASSWORD

          value: 21232F297A57A5A743894A0E4A801FC3

        - name: "IN_CLUSTER"

          value: "true"

        image: registry.cn-beijing.aliyuncs.com/dotbalo/krm-backend:latest

        lifecycle: {}

        livenessProbe:

          failureThreshold: 2

          initialDelaySeconds: 10

          periodSeconds: 10

          successThreshold: 1

          tcpSocket:

            port: 8080

          timeoutSeconds: 2

        name: krm-backend

        ports:

        - containerPort: 8080

          name: web

          protocol: TCP

        readinessProbe:

          failureThreshold: 2

          initialDelaySeconds: 10

          periodSeconds: 10

          successThreshold: 1

          tcpSocket:

            port: 8080

          timeoutSeconds: 2

        resources:

          limits:

            cpu: 1

            memory: 1024Mi

          requests:

            cpu: 200m

            memory: 256Mi

      restartPolicy: Always

EOF

            部署前端服务

            cat<<EOF | kubectl -n krm apply -f -

---

apiVersion: v1

kind: Service

metadata:

  labels:

    app: krm-frontend

  name: krm-frontend

spec:

  ports:

  - name: http

    port: 80

    protocol: TCP

    targetPort: 80

  selector:

    app: krm-frontend

  sessionAffinity: None

  type: NodePort

---

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: krm-frontend

  name: krm-frontend

spec:

  replicas: 1

  selector:

    matchLabels:

      app: krm-frontend

  strategy:

    rollingUpdate:

      maxSurge: 1

      maxUnavailable: 0

    type: RollingUpdate

  template:

    metadata:

      labels:

        app: krm-frontend

    spec:

      containers:

      - env:

        - name: TZ

          value: Asia/Shanghai

        - name: LANG

          value: C.UTF-8

        image: registry.cn-beijing.aliyuncs.com/dotbalo/krm-frontend:latest

        lifecycle: {}

        livenessProbe:

          failureThreshold: 2

          initialDelaySeconds: 10

          periodSeconds: 10

          successThreshold: 1

          tcpSocket:

            port: 80

          timeoutSeconds: 2

        name: krm-backend

        ports:

        - containerPort: 80

          name: web

          protocol: TCP

        readinessProbe:

          failureThreshold: 2

          initialDelaySeconds: 10

          periodSeconds: 10

          successThreshold: 1

          tcpSocket:

            port: 80

          timeoutSeconds: 2

        resources:

          limits:

            cpu: 1

            memory: 512Mi

          requests:

            cpu: 100m

            memory: 256Mi

      restartPolicy: Always

EOF

            部署成功后，通过kubectl get svc -n krm查看krm-frontend的Service的NodePort，之后通过任意一台Kubernetes工作节点的IP:NodePort即可访问KRM

            默认用户名密码：admin / admin

            `用户名密码请在后端的USERNAME/PASSWORD变量中更改，注意更改的值为用户名密码的大写的32位MD5值`

            ## 配置域名

            如果集群中有Ingress或者其它网关服务，可以自行配置访问域名，比如使用ingress-nginx````

            apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: krm

  namespace: krm

spec:

  rules:

    - host: demo.kubeasy.com

      http:

        paths:

          - backend:

              service:

                name: krm-frontend

                port:

                  number: 80

            path: /

            pathType: Prefix

  ingressClassName: nginx

            ## 添加管理集群

            点击集群管理--添加，之后添加集群信息即可，添加集群后，就可以管理集群中的资源。

            13.【必看】一些必须的配置更改

            将 Kube-proxy 改为 ipvs 模式，因为在初始化集群的时候注释了 ipvs 配置，所以需要自行修改一下：

            在 master01 节点执行：

            kubectl edit cm kube-proxy -n kube-system

mode: ipvs

            更新 Kube-Proxy 的 Pod：

            kubectl patch daemonset kube-proxy -p '{"spec":{"template":{"metadata":{"annotations":{"date":"'`date +'%s'`'"}}}}}' -n kube-system

            验证 Kube-Proxy 模式

            [root@k8s-master01]# curl 127.0.0.1:10249/proxyMode

ipvs

              14.【必看】注意事项

              注意：kubeadm 安装的集群，证书有效期默认是一年。master 节点的 kube-apiserver、kube-scheduler、kube-controller-manager、etcd 都是以容器运行的。可以通过 kubectl get po -n kube-system 查看。

              启动和二进制不同的是，kubelet 的配置文件在 /etc/sysconfig/kubelet 和 /var/lib/kubelet/config.yaml，修改后需要重启 kubelet 进程。

              其他组件的配置文件在 /etc/kubernetes/manifests 目录下，比如 kube-apiserver.yaml，该 yaml 文件更改后，kubelet 会自动刷新配置，也就是会重启 pod。不能再次创建该文件

              kube-proxy 的配置在 kube-system 命名空间下的 configmap 中，可以通过kubectl edit cm kube-proxy -n kube-system进行更改，更改完成后，可以通过 patch 重启 kube-proxy。

              kubectl patch daemonset kube-proxy -p '{"spec":{"template":{"metadata":{"annotations":{"date":"'`date +'%s'`'"}}}}}' -n kube-system

              Kubeadm 安装后，master 节点默认不允许部署 pod，可以通过以下方式删除 Taint，即可部署 Pod：

              [root@k8s-master01 ~]# kubectl taint node -l node-role.kubernetes.io/control-plane node-role.kubernetes.io/control-plane:NoSchedule-
              标签
              #kubernetes #容器 #云原生
              GYTYYDSa
              关注
              基于FFmpeg与Nginx的大华摄像头实时视频Web接入方案
              weixin_28040125的博客
              03-01 323
              本文详细介绍了一种基于FFmpeg与Nginx的大华摄像头实时视频Web接入方案。该方案通过FFmpeg将摄像头RTSP协议流转换为浏览器友好的HLS格式，并利用Nginx进行高效分发，最终结合Video.js构建前端播放页面，实现无需插件的跨平台实时监控。方案具有免费、轻量、稳定、易于部署的特点，适合中小企业、个人开发者快速搭建内部监控或展示系统。
              IIR数字滤波器原理，设计方法及嵌入式应用
              热门推荐
              weixin_38342580的博客
              10-26 1万+
              基于STM32的二阶直接II型巴特沃斯低通滤波器设计方法及应用
              第30篇-Kubeflow-Training-Operator-K8s上的分布式训练
              m0_68987304的博客
              08-18 279
              AIaaS 全栈架构师教程，技术栈以 Go 为主。本篇聚焦 K8s 如何用 Operator 模式管理分布式训练任务，以及 Gang Scheduling 如何解决 all-or-nothing 难题。
              FreeRTOS深入教程（任务创建的深入和任务调度机制分析）
              m0_49476241的博客
              10-28 6318
              本篇文章将带大家深入学习任务的创建和分析任务调度的机制。本篇文章深入的讲解了任务创建的内部实现和任务调度的源代码分析和实现，学习这篇文章有助于更深入的学习FreeRTOS的源码。
              【Kubernetes】（七）Kubernetes控制器
              2401_86088850的博客
              08-19 460
              当你更新、修改Deployment的时，它不会直接修改旧RS，而是创建一个新的RS，新RS的副本数从0到3，创建3个新版本的Pod，同时旧RS从3减到0，旧Pod被逐个销毁，始终保持可用pod数为3。当副本集为三的时候，在命令行用kubectl删掉其中一个pod的时候，kubelet发现后就会告诉APIserver，APIserver公示给控制器后，控制器会干预，使pod数始终为我们所期望的。保证（给定数量，完全相同的）Pod的高可用性：实时监控副本数量，当一个Pod崩溃后自动重建一个，防止服务单点。
              K8s 环境部署 ECShop 商城（实操记录）
              Ningcode的博客
              08-18 194
              本文记录了在 Kubernetes 集群中部署 ECShop 商城的完整实操过程。主要步骤包括：在 master 节点搭建 NFS 服务器并配置共享目录 /ecshop；部署 NFS 动态卷制备器，创建 ecshop 存储类型；所有资源部署在 ecshop 命名空间并设置资源配额；后续还将完成 MySQL 集群、PHP 和 Nginx 部署、Ingress 配置等。环境使用内网镜像仓库 hub.laoma.cloud 和自定义域名 *.ningcode.cn，通过 NFS 提供持久化存储支持。
              k8s-152习题【内含k8s、docker、prometheus、ELK、Jenkins等面试内容】
              Nightwish5的博客
              08-18 308
              常用资源介绍：Pod、最早的控制器RS、deployment（RS的升级）、daemonSet、statefulSet、service、IngressIngress-controller、configmap、secret 、serviceAccount（服务账号）Pod:运行服务器部署中的最小工作单元，pod里运行服务的容器，可以运行一个或者多个容器，一般运行一个一个容器。RS控制器/ReplicaSet，是Pod的控制器，维护pod的副本数，更新pod时候，手动删除pod才能更新。
              K8s+DeepSpeed+vLLM打通大模型训练到上线全链路
              08-19 306
              DeepSpeed 是微软开源的分布式训练优化库，核心是 ZeRO 显存切分技术，最近两年在大模型岗位的招聘要求里出现得越来越频繁——但网上大多数介绍停留在"ZeRO 三个 stage 分别切什么"，很少讲清楚它在一条完整生产链路里具体怎么落地。这篇文章接着上一篇的思路，换一条编排路径：用 K8s + Kubeflow Trainer 的 MPI-based 调度承载 DeepSpeed ZeRO 分布式微调，微调产出的分片权重合并后交给 vLLM 部署成推理服务，四个阶段每一步命令都能真实跑通。
              Docker 负责打包，Kubernetes 负责调度：一文吃透容器化与 K8s 编排
              huaiixinsi的博客
              08-18 350
              Docker：让应用能够被标准化打包、分发和运行。让大量容器能够在集群中被声明式地调度、治理和恢复。代码-> 镜像-> Pod-> Service-> Ingress-> 集群运行镜像是应用交付单元，容器是镜像的运行实例。Pod 是 Kubernetes 的最小部署单元，不等于单个容器。Deployment 管理无状态副本，Service 提供稳定访问入口。Docker Engine、containerd、CRI-O 和 Kubernetes 处于不同层次。
              云原生k8s【第一课】： Docker 容器技术
              2602_96636859的博客
              08-18 211
              kubelet → CRI → cri‑dockerd → docker → containerd，cri‑dockerd 是适配器，用来让 k8s 可以对接 docker。镜像分层只读，容器写数据不会改动原镜像，会单独开一层可写层；容器删掉，可写层数据全部丢失，想要保存数据必须用卷。写时复制，修改文件就把文件拷贝到上层再改动。安装 docker、配置镜像加速，实操模拟 namespace、cgroup、overlay2 加深理解。容器不是虚拟机，本质就是受限制、做了隔离的普通 Linux 进程。
              k8s进阶_RBAC账户授权管理
              最新发布
              panzhengxiang的博客
              08-20 264
              k8s账户授权管理RBAC基本使用
              云原生k8s【第二课】：K8s 部署与架构
              2602_96636859的博客
              08-19 218
              所有节点装 kubeadm/kubelet/kubectl；master 用 kubeadm init 初始化集群；worker 拿命令加入集群；装上网络插件 Calico 集群网络才通。每个节点 kubelet 接收指令，调用容器运行时启动容器。给节点、Pod 打标签做标记；选择器通过标签筛选匹配资源，Service 就是靠标签找到后端 Pod。集群分为控制平面 master 节点 + worker 工作节点。用来批量管理容器，目标是实际状态往期望状态靠拢。第 5 章 K8s 部署与架构。
              k8s-agent架构思考(二)
              mingover的专栏
              08-18 222
              前面完成了一个 agent基础功能，这个agent是可以做为一个整体部署到任何一台机器的,下一个问题是：如何将Agent部署到Kubernetes集群中，并支持多Agent的管理和使用？如果要考虑云agent的话, 就需要思考一些实现思路了:**固定机器模式: **直接把agent部署到线上,一个用户指定一个,需要的时候开启? 类似家里的电脑一样,需要就开,不用就关固定分配池模式：维护一个 Agent 云池，用户首次接入时被分配到某个agent，后续请求始终路由到同一 agent，并动态加载该用户的会话、
              云原生数据库冷热数据分离｜K8s 环境历史数据归档 + 透明查询（金仓 / 达梦双库落地）
              雨辰AI的博客
              08-17 382
              云原生数据库冷热分离，本质是用分层的思路解决数据增长的问题：热数据花贵钱买性能，冷数据花少钱买容量，各得其所。基于分区表 + 分层表空间 + K8s 分级存储的方案，业务零改造、数据库原生支持、运维成本低、收益可量化，是绝大多数信创项目的最优解。数据只会越来越多，冷热分离不是可选项，是迟早要做的必选项。早做早受益，既提性能又降成本。政务选金仓，金融选达梦；MySQL 迁移选金仓，Oracle 迁移选达梦。📚专栏推荐。
              k8s deployment或statefulset分组关停
              2404_85855917的博客
              08-19 214
              "${STOPPED[$idx]}" = "1" ] && { echo "[$name] 已经停止过了";echo " ${GROUP_NAMES[$i]}: 运行中 ($remaining 个 Pod)"echo "停止 [$name] (当前 ${initial_pods} 个 Pod) ..."echo " ${GROUP_NAMES[$i]}: 已停止"echo "========== 当前服务状态 =========="echo "1) 停止 ${GROUP_NAMES[0]}"
              RDMA与容器网络深度解析：K8s环境下的SR-IOV与设备池化（必知必会）
              专注分享DPU、RDMA智能网卡/SSD(固态硬盘)产品测试与优化
              08-19 480
              本文深度剖析Kubernetes环境下RDMA网络的硬件实现与工程实践。从芯片级RTL视角拆解SR-IOV在ConnectX-7中的VF上下文分配与Doorbell机制，结合NVIDIA Network Operator与H3C交换机配置，详解K8s中RDMA设备的池化与直通方案。包含寄存器级时序分析、多厂商实战配置及P999尾延迟评测，为构建微秒级低延迟AI/HPC集群提供芯片级指导。
              K8s 实战复盘：用 StatefulSet + 无头服务 + NFS 搭建 MySQL 主从集群
              2401_86194191的博客
              08-19 186
              mysql-0 ──挂载──> PVC(data-mysql-0) ──绑定──> PV(mysql-pv-0) ──NFS──> /data/nfs/mysql-0。mysql-1 ──挂载──> PVC(data-mysql-1) ──绑定──> PV(mysql-pv-1) ──NFS──> /data/nfs/mysql-1。kubectl -n mysql get pod -w # 观察有序创建：先 mysql-0 Running，才起 mysql-1。
              从零搭建一个单节点 K8S 可观测实验室（七）：从一次 Pod 创建过程，看懂 Kubernetes 核心原理
              mosespaul的博客
              08-10 613
              从一次 kubectl create deployment nginx 出发，拆解 Kubernetes 内部的完整 Pod 创建流程，串起 API Server、etcd、Scheduler、Controller Manager、Kubelet、Runtime、CNI、Service 与 CoreDNS，理解 K8S 的核心工作原理。
              FastAPI和K8s中间的空缺，被一个叫Jina-Serve的开源项目填上了
              2403_88996352的博客
              08-19 98
              从定义HTTP端点，到处理gRPC流，再到打包Docker镜像、编写Kubernetes YAML文件，大量与模型无关的“胶水代码”和运维工作，消耗着AI工程师宝贵的创造力。在AI应用日益复杂的今天，采用Jina-Serve这样的框架，或许意味着能将更多资源投入到算法优化与业务创新本身，而非无穷无尽的基础设施建设。它的目标是为任何Python函数或机器学习模型，瞬间注入生产级的服务能力，让你可以像在本地测试一个函数一样，去部署和运维一个高可用的AI微服务集群。
              Docker + K8s 云原生多节点 Web 服务架构搭建与自动化运维
              ziyun666888的博客
              08-19 419
              K8s 集群从 Harbor 拉取镜像：搭建 3 节点集群并部署 Harbor 私有仓库，配置 containerd 与 Harbor（HTTP 协议）对接，解决因协议不匹配导致的全量 Pod ImagePullBackOff——通过逐节点配置的hosts.toml声明 insecure registry 修复，并总结出配置目录不可携带端口号、多节点必须逐一配置的要点；Deployment 管理前后端 Pod 滚动更新。
              第33篇-KServe推理平台-标准化的K8s推理服务管理
              m0_68987304的博客
              08-19 426
              AIaaS 全栈架构师教程，技术栈以 Go 为主。本篇聚焦 KServe——K8s 上的推理服务标准，拆解 InferenceService CRD、推理服务生命周期、自动扩缩容（HPA/KEDA）、Canary/蓝绿/影子部署，以及 InferenceGraph 多模型编排。
              使用 Helm 搭建 Prometheus + Grafana 监控平台完整笔记(k8s)
              2301_81704123的博客
              08-17 368
              NetworkPolicy 是 Kubernetes 的四层（TCP/UDP/SCTP）网络访问控制机制。它定义了 Pod 之间的通信规则——谁能访问我（Ingress）我能访问谁（Egress）​。⚠️前提条件：必须使用支持 NetworkPolicy 的 CNI 插件（如 Calico、Cilium 等），否则策略不生效。
              容器安全入门：K8s常见基础安全风险通俗解读
              彭大帅的博客
              08-20 371
              Kubernetes（K8s）作为容器编排的主流平台，其安全风险可以通过一个生动的"公寓管理"类比来理解。想象一下，K8s就像一个大型公寓社区，每个容器是其中的一个房间，而K8s则是物业管理公司。在这个社区中，邻居可能闯入你家（容器逃逸）、你的钥匙能开别人的门（权限过大）、有人偷用你的水电（资源滥用）、你的房间没有监控（审计缺失）。容器安全就是给Docker和Kubernetes穿上"防护服"，防止这些安全问题。
              国民经济行业（CIC2011）与IO2012行业转换表
              如题，手工整理了GB/T 4754-2011(国民经济行业分类)与投入产出表(2012)之间的行业代码对应表，包含了所有的国民经济行业分类(不仅仅是制造业)。收点手工费= =
              RNN实现文本生成
              用RNN实现的一个语言模型（实现的是可以自主生成歌词，用的是周杰伦的一些歌词，但由于是自己从网上下来的，前期预处理不是很好，每个人也可以用诗歌等训练，来生成诗歌）
              评论
              添加红包

              请填写红包祝福语或标题

              个

              红包个数最小为10个

              元

              红包金额最低5元

              当前余额3.43元 前往充值 >
              需支付：10.00元
              成就一亿技术人!
              领取后你会自动成为博主和红包主的粉丝 规则
              hope_wisdom
              发出的红包
              实付元
              使用余额支付
              点击重新获取
              扫码支付
              钱包余额 0

              抵扣说明：

              1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
              2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

              余额充值