目录1. 准备工作2. 磁盘管理2.1 磁盘分区2.2 磁盘格式化2.3 磁盘挂载3. 安装系统3.1 安装系统文件3.2 配置fstab3.3 配置系统3.4 安装引导程序3.5 安装OpenSSH3.6 主机名3.7 设置root密码3.8 网络配置3.9 重启系统,并从硬盘引导3.10 本地化配置3.11 时区配置3.12 硬件时间设置4. 安装k8s4.1 配置containerd4.2 拉取k8s镜像4.3 创建k8s集群4.4 加入control-plane节点4.5 加入worker节点4.6 查看k8s集群节点信息附录包签名错误1. 准备工作下载ISO文件:https://mirrors.tuna.tsinghua.edu.cn/archlinux/iso/latest/
以虚拟机VMWare为例。
(相关资料图)
使用EFI 非默认BIOS启动。如果不使用EFI,那么后续安装引导时也使用非EFI。
Controller-Panel节点(master)
节点列表:
hostname | ip |
---|---|
k8s-master1 | 10.0.2.101/24 |
k8s-master2 | 10.0.2.102/24 |
k8s-master3 | 10.0.2.103/24 |
CPU设置:2Core
内存设置:2GB
磁盘:20GB
网卡设置:网卡1(ens33)为自定义NAT
Worker节点
节点列表:
hostname | ip |
---|---|
k8s-worker1 | 10.0.2.111/24 |
k8s-worker2 | 10.0.2.112/24 |
k8s-worker3 | 10.0.2.113/24 |
CPU设置:2Core
内存设置:4GB
磁盘:20GB
网卡设置:网卡1(ens33)为自定义NAT
2. 磁盘管理2.1 磁盘分区使用GUID分区表,分2个区:
1)EFI System(EF00),Last sector: +500M (500MB)
2)Linux filesystem(8300) ,Last sector:<回车>(为剩余容量)
gdisk /dev/sda
2.2 磁盘格式化mkfs.vfat -F32 /dev/sda1 # ESP分区 挂载 /bootmkfs.ext4 /dev/sda2 # LFS分区 挂载 /
2.3 磁盘挂载mount /dev/sda2 /mnt # 挂载root分区mkdir /mnt/boot # 创建 /boot 目录mount /dev/sda2 /mnt/boot # 挂载boot分区lsblk # 查看分区挂载情况
3. 安装系统3.1 安装系统文件vim /etc/pacman.d/mirrorlist # 在顶部添加如下镜像服务器Server = https://mirrors.tuna.tsinghua.edu.cn/archlinux/$repo/os/$arch#Server = https://mirrors.aliyun.com/archlinux/$repo/os/$arch
# 安装系统pacstrap /mnt base base-devel
3.2 配置fstabgenfstab -U /mnt > /mnt/etc/fstab # 生成分区挂载表
编辑 fstab
vim /mnt/etc/fstab# SSD的追加options “discard,noatime”
3.3 配置系统编辑 /mnt/etc/pacman.conf文件,加入下面的内容:
[archlinuxcn]Server = https://mirrors.tuna.tsinghua.edu.cn/archlinuxcn/$arch#Server = https://mirrors.aliyun.com/archlinuxcn/$arch
切换root目录到新系统
arch-chroot /mnt /bin/bash
现在可以全面升级系统:
pacman -Syy # 切换了root目录,因此需要重新更新软件包缓存pacman -S archlinuxcn-keyringpacman -S vim bash-completion yay fakerootln -s /usr/bin/vim /usr/bin/vi
3.4 安装引导程序# 安装linux内核pacman -S linux-lts linux-firmware# 安装 Micro Codepacman -S amd-ucode # intel安装 intel-ucode
bootctl install # boot-loadervim /boot/loader/entries/arch.conftitle Arch Linuxlinux /vmlinuz-linux-ltsinitrd /amd-ucode.img # intel的为 /intel-ucode.imginitrd /initramfs-linux-lts.imgoptions root=/dev/sda2 rwvim /boot/loader/entries/arch-fallback.conftitle Arch Linux (fallback initramfs)linux /vmlinuz-linux-ltsinitrd /amd-ucode.img # intel的为 /intel-ucode.imginitrd /initramfs-linux-lts-fallback.imgoptions root=/dev/sda2 rwvim /boot/efi/loader/loader.confdefault arch.conftimeout 2console-mode maxeditor no# 验证文件路径是否正确bootctl listbootctl status
3.5 安装OpenSSHpacman -S opensshsed -i "s/#PermitRootLogin\ prohibit-passwd/PermitRootLogin yes/g" /etc/ssh/sshd_configsystemctl enable sshd
3.6 主机名echo > /etc/hostname
3.7 设置root密码passwd
3.8 网络配置使用 systemd-networkd
VMWare 网络配置:NAT模式网段:10.0.2.0/24DHCP:10.0.2.200 - 10.0.2.254网关:10.0.2.2 (不要设置为10.0.2.1,否则会导致无法访问外网)
vim /etc/systemd/network/20-wired.network[Match]Name=ens33[Network]#DHCP=ipv4 # 使用dhcp时启用Address=10.0.2.101/24Gateway=10.0.2.2DNS=223.5.5.5DNS=223.6.6.6
systemctl enable systemd-networkdsystemctl enable systemd-resolved
3.9 重启系统,并从硬盘引导exit # 退出chrootreboot # 重启后重新引导进入已安装的系统
3.10 本地化配置vim /etc/locale.genen_US.UTF-8 UTF-8zh_CN.GBK GBKzh_CN.UTF-8 UTF-8zh_CN GB2312
locale-gen # 生成localeecho "LANG=en_US.UTF-8" > /etc/locale.conf # 设置默认的 locale
3.11 时区配置ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
3.12 硬件时间设置# date -s "2022-7-5 16:49:45"hwclock --systohc --utc #采用UTC,将系统时间写入硬件时钟# hwclock --hctosys --utc #采用UTC,将硬件时钟写入系统时间
4. 安装k8s使用kubeadm安装: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/
pacman -S kubeadm kubelet kubectl containerdsystemctl enable containerdsystemctl start containerdsystemctl enable kubeletsystemctl start kubelet
4.1 配置containerd创建 /etc/modules-load.d/containerd.conf 配置文件:
cat << EOF > /etc/modules-load.d/containerd.confoverlaybr_netfilterEOF
修改 containerd 配置
# 修改配置mkdir -p /etc/containerdif [ ! -f /etc/containerd/config.toml ]; then containerd config default > /etc/containerd/config.tomlfi# 设置 systemd_cgroup 为 truesed -i "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.tomlsed -i "s/k8s.gcr.io/registry.aliyuncs.com\/google_containers/g" /etc/containerd/config.tomlsystemctl restart containerdecho "alias docker="crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock"" >> ~/.bashrcsource ~/.bashrc# 确保containerd 的cgroup 为 SystemdCgroupcrictl --runtime-endpoint unix:///var/run/containerd/containerd.sock info | grep SystemdCgroup | awk -F ": " "{ print $2 }"true
4.2 拉取k8s镜像通过参数 --image-repository
指定k8s镜像的仓库地址
kubeadm config images pull --image-repository=registry.aliyuncs.com/google_containers --kubernetes-version=v1.24.2
4.3 创建k8s集群# 应搭建负载均衡后,使用负载均衡IPecho "10.0.2.101 cluster.berkaroad.com" >> /etc/hosts# 这个版本的kubelet,命令行参数 `--cni-bin-dir` 已经取消,因此需要拿掉此参数sed -i "s/--cni-bin-dir=\/usr\/lib\/cni//g" /etc/kubernetes/kubelet.env# 初始化k8s集群kubeadm init --image-repository=registry.aliyuncs.com/google_containers --kubernetes-version=v1.24.2 --control-plane-endpoint=cluster.berkaroad.com --apiserver-advertise-address=10.0.2.101 --pod-network-cidr=10.100.0.0/16 --service-cidr=10.101.0.0/16 --service-dns-domain=cluster.berkaroad.com --upload-certs --v=5# 执行成功后,根据提示,配置mkdir -p $HOME/.kubesudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/config# 注意:集群中时间必须保持一致,否则会加入集群失败,错误信息: x509: certificate has expired or is not yet valid: current time 2022-07-05T03:57:41+08:00 is before 2022-07-04T23:42:18Z# You can now join any number of the control-plane node running the following command on each as root:kubeadm join cluster.berkaroad.com:6443 --token v3e3b4.a52hqkbd1rlxgkun \ --discovery-token-ca-cert-hash sha256:877bc4de6051c6aee8401bb99e6a3114f6d5a5fa7d87131c0b6377ce2419e5a3 \ --control-plane --certificate-key 6b6050b43696814460032c521569377829e6bda6d39ac69e1d650d5bfdad1a44# 如果 --certificate-key 过期了,执行如下:kubeadm init phase upload-certs --upload-certs# Then you can join any number of worker nodes by running the following on each as root:kubeadm join cluster.berkaroad.com:6443 --token v3e3b4.a52hqkbd1rlxgkun \ --discovery-token-ca-cert-hash sha256:877bc4de6051c6aee8401bb99e6a3114f6d5a5fa7d87131c0b6377ce2419e5a3# 如果token过期了,可以执行如下:kubeadm token create --print-join-command# 安装CNI:Calicokubectl apply -f https://projectcalico.docs.tigera.io/archive/v3.22/manifests/calico.yaml# 如果失败,检查 cgroup 是否一致(docker或者containerd 和 kubelet)# 查看 kubeadm 使用的 CRI 为 containerd 还是 dockercat /var/lib/kubelet/kubeadm-flags.envKUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.7"# 查看 kubelet 的 cgroup drivercat /var/lib/kubelet/config.yaml | grep cgroupDriver | awk -F ": " "{ print $2 }"systemd
4.4 加入control-plane节点# 应搭建负载均衡后,使用负载均衡IPecho "10.0.2.101 cluster.berkaroad.com" >> /etc/hosts# 这个版本的kubelet,命令行参数 `--cni-bin-dir` 已经取消,因此需要拿掉此参数sed -i "s/--cni-bin-dir=\/usr\/lib\/cni//g" /etc/kubernetes/kubelet.env# 注意:集群中时间必须保持一致,否则会加入集群失败,错误信息: x509: certificate has expired or is not yet valid: current time 2022-07-05T03:57:41+08:00 is before 2022-07-04T23:42:18Z# You can now join any number of the control-plane node running the following command on each as root:kubeadm join cluster.berkaroad.com:6443 --token v3e3b4.a52hqkbd1rlxgkun \ --discovery-token-ca-cert-hash sha256:877bc4de6051c6aee8401bb99e6a3114f6d5a5fa7d87131c0b6377ce2419e5a3 \ --control-plane --certificate-key 6b6050b43696814460032c521569377829e6bda6d39ac69e1d650d5bfdad1a44# 如果 --certificate-key 过期了,执行如下:kubeadm init phase upload-certs --upload-certs# 如果token过期了,可以执行如下:kubeadm token create --print-join-command# 执行成功后,根据提示,配置mkdir -p $HOME/.kubesudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/config
4.5 加入worker节点# 应搭建负载均衡后,使用负载均衡IPecho "10.0.2.101 cluster.berkaroad.com" >> /etc/hosts# 这个版本的kubelet,命令行参数 `--cni-bin-dir` 已经取消,因此需要拿掉此参数sed -i "s/--cni-bin-dir=\/usr\/lib\/cni//g" /etc/kubernetes/kubelet.env# 执行成功后,根据提示,配置mkdir -p $HOME/.kubesudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/config# 注意:集群中时间必须保持一致,否则会加入集群失败,错误信息: x509: certificate has expired or is not yet valid: current time 2022-07-05T03:57:41+08:00 is before 2022-07-04T23:42:18Z# Then you can join any number of worker nodes by running the following on each as root:kubeadm join cluster.berkaroad.com:6443 --token v3e3b4.a52hqkbd1rlxgkun \ --discovery-token-ca-cert-hash sha256:877bc4de6051c6aee8401bb99e6a3114f6d5a5fa7d87131c0b6377ce2419e5a3# 如果token过期了,可以执行如下:kubeadm token create --print-join-command
4.6 查看k8s集群节点信息kubectl get no -o wideNAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIMEk8s-master1 Ready control-plane 2d9h v1.24.2 10.0.2.101 Arch Linux 5.15.50-1-lts containerd://1.6.6k8s-master2 Ready control-plane 2d5h v1.24.2 10.0.2.102 Arch Linux 5.15.52-1-lts containerd://1.6.6k8s-master3 Ready control-plane 2d v1.24.2 10.0.2.103 Arch Linux 5.15.52-1-lts containerd://1.6.6k8s-worker1 Ready 3h4m v1.24.2 10.0.2.111 Arch Linux 5.15.52-1-lts containerd://1.6.6k8s-worker2 Ready 176m v1.24.2 10.0.2.112 Arch Linux 5.15.52-1-lts containerd://1.6.6k8s-worker3 Ready 176m v1.24.2 10.0.2.113 Arch Linux 5.15.52-1-lts containerd://1.6.6
附录包签名错误error: libcap: signature from "David Runge " is marginal trust:: File /var/cache/pacman/pkg/libcap-2.65-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).Do you want to delete it? [Y/n] Yerror: failed to commit transaction (invalid or corrupted package)Errors occurred, no packages were upgraded.
更新pacman key证书
pacman -S gnupgpacman -Sy archlinux-keyringpacman-key --populate archlinuxpacman-key --refresh-keyspacman -Syux
[责任编辑:linlin]
标签:
从零开始基于Archlinux 安装 containerd + k8s|天天要闻
天天动态:香港财政司司长陈茂波:香港第一季经济好于上季度
一季度,我国快递业务量完成268.9亿件,同比增长11%快递业企稳回
2024美国大选将是“二老相争”吗 基本信息讲解
在华市占率降至1.6%,韩系还有救吗? 当前聚焦
当前时讯:2023年4月27日亚盘交易建议:黄金、白银、欧元、英镑
天天日报丨黄晓明再努力,也捧不红她
浙江一图书馆将核酸亭改为自习室 可线上预约使用
世界焦点!潇湘平:共品柳风古韵 共谱文旅新篇
世界看点:“喊话推荐其他山东城市”,淄博“五一”会有多火?
每日观点:医保基金安全宣传进社区
天天速读:黑洞新照发布!中国科学家领衔!