install_k8s1.16.1_node.sh
1.masterIP为k8s master的IP,nodeIP为k8s node的IP,CLUSTER_CIDR为etcd设置的pod网段
2.建立k8s node与k8s master的ssh 信任关系，让k8s node 可以免密ssh k8s master
3.运行如下脚本，添加1.16.1的k8s node
export masterIP=10.26.252.235export nodeIP=10.25.171.75export CLUSTER_CIDR="172.30.0.0/16"yum install -y conntrack ipvsadm ipset jq sysstat curl iptables libseccompsystemctl stop firewalldsystemctl disable firewalldsystemctl stop iptablessystemctl disable iptablesswapoff -ased -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstabsetenforce 0modprobe br_netfiltermodprobe ip_vsmkdir -p /app/k8scd /app/k8scat > kubernetes.conf <<EOFnet.ipv4.ip_forward=1vm.swappiness=0vm.overcommit_memory=1vm.panic_on_oom=0fs.inotify.max_user_watches=89100fs.file-max=52706963fs.nr_open=52706963net.ipv6.conf.all.disable_ipv6=1net.netfilter.nf_conntrack_max=2310720kernel.pid_max=1000000net.ipv4.tcp_syncookies = 1net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_fin_timeout = 30net.ipv4.conf.default.rp_filter = 0net.ipv4.conf.all.rp_filter = 0net.ipv4.conf.eth0.rp_filter = 0net.ipv4.tcp_timestamps=0net.ipv4.tcp_tw_recycle=0net.ipv4.tcp_max_tw_buckets = 3000EOFsystemctl stop kubeletsystemctl stop kube-proxysystemctl stop flanneldsystemctl stop dockersystemctl disable kubeletsystemctl disable kube-proxysystemctl disable flanneldsystemctl disable dockerrm -rf /etc/sysctl.d/kubernetes.confcp kubernetes.conf /etc/sysctl.d/kubernetes.confsysctl -p /etc/sysctl.d/kubernetes.confmount -t cgroup -o cpu,cpuacct none /sys/fs/cgroup/cpu,cpuacctrm -rf /etc/kubernetesmkdir -p /etc/kubernetes/certscp root@${masterIP}:/etc/kubernetes/cert/ca*.pem /etc/kubernetes/cert/scp root@${masterIP}:/etc/kubernetes/cert/ca-config.json /etc/kubernetes/certscp root@${masterIP}:/usr/local/bin/kubectl /usr/local/bin/rm -rf ~/.kubemkdir -p ~/.kubescp root@${masterIP}:~/.kube/config ~/.kube/scp root@${masterIP}:/usr/local/bin/{flanneld,mk-docker-opts.sh} /usr/local/bin/rm -rf /etc/flanneldmkdir -p /etc/flanneld/certscp root@${masterIP}:/etc/flanneld/cert/flanneld*.pem /etc/flanneld/certexport IFACE=eth0export ETCD_ENDPOINTS="https://${masterIP}:2379"export FLANNEL_ETCD_PREFIX="/kubernetes/network"cat > flanneld.service << EOF[Unit]Description=Flanneld overlay address etcd agentAfter=network.targetAfter=network-online.targetWants=network-online.targetAfter=etcd.serviceBefore=docker.service[Service]Type=notifyExecStart=/usr/local/bin/flanneld \\-etcd-cafile=/etc/kubernetes/cert/ca.pem \\-etcd-certfile=/etc/flanneld/cert/flanneld.pem \\-etcd-keyfile=/etc/flanneld/cert/flanneld-key.pem \\-etcd-endpoints=${ETCD_ENDPOINTS} \\-etcd-prefix=${FLANNEL_ETCD_PREFIX} \\-iface=${IFACE}ExecStartPost=/usr/local/bin/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/dockerRestart=on-failure[Install]WantedBy=multi-user.targetRequiredBy=docker.serviceEOFrm -rf /etc/systemd/system/flanneld.servicecp flanneld.service /etc/systemd/system/systemctl daemon-reloadsystemctl enable flanneldsystemctl restart flanneldscp root@${masterIP}:/usr/local/bin/docker* /usr/local/bin/scp root@${masterIP}:/usr/local/bin/runc /usr/local/bin/scp root@${masterIP}:/usr/local/bin/containerd* /usr/local/bin/scp root@${masterIP}:/etc/systemd/system/docker.service /etc/systemd/system/rm -rf /etc/dockermkdir -p /etc/docker/scp root@${masterIP}:/etc/docker/daemon.json /etc/docker/systemctl daemon-reloadsystemctl enable dockersystemctl restart dockerexport KUBE_APISERVER="https://${masterIP}:6443"export node_name="kube-node2"scp root@${masterIP}:/usr/local/bin/kube* /usr/local/bin/export BOOTSTRAP_TOKEN=$(kubeadm token create \--description kubelet-bootstrap-token \--groups system:bootstrappers:${node_name} \--kubeconfig ~/.kube/config)# 设置集群参数kubectl config set-cluster kubernetes \--certificate-authority=/etc/kubernetes/cert/ca.pem \--embed-certs=true \--server=${KUBE_APISERVER} \--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig# 设置客户端认证参数kubectl config set-credentials kubelet-bootstrap \--token=${BOOTSTRAP_TOKEN} \--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfig# 设置上下文参数kubectl config set-context default \--cluster=kubernetes \--user=kubelet-bootstrap \--kubeconfig=kubelet-bootstrap-${node_name}.kubeconfigkubectl config use-context default --kubeconfig=kubelet-bootstrap-${node_name}.kubeconfigkubeadm token list --kubeconfig ~/.kube/configrm -rf /etc/kubernetes/kubelet-bootstrap.kubeconfigcp kubelet-bootstrap-${node_name}.kubeconfig /etc/kubernetes/kubelet-bootstrap.kubeconfigcat > kubelet.config.json <<EOF{"kind": "KubeletConfiguration","apiVersion": "kubelet.config.k8s.io/v1beta1","authentication": {"x509": {"clientCAFile": "/etc/kubernetes/cert/ca.pem"},"webhook": {"enabled": true,"cacheTTL": "2m0s"},"anonymous": {"enabled": false}},"authorization": {"mode": "Webhook","webhook": {"cacheAuthorizedTTL": "5m0s","cacheUnauthorizedTTL": "30s"}},"address": "${nodeIP}","port": 10250,"readOnlyPort": 0,"cgroupDriver": "cgroupfs","hairpinMode": "promiscuous-bridge","serializeImagePulls": false,"featureGates": {"RotateKubeletClientCertificate": true,"RotateKubeletServerCertificate": true},"clusterDomain": "cluster.local.","clusterDNS": ["10.254.0.2"]}EOFrm -rf /etc/kubernetes/kubelet.config.jsoncp kubelet.config.json /etc/kubernetes/mkdir -p /var/lib/kubeletcat > kubelet.service <<EOF[Unit]Description=Kubernetes KubeletDocumentation=https://github.com/GoogleCloudPlatform/kubernetesAfter=docker.serviceRequires=docker.service[Service]WorkingDirectory=/var/lib/kubeletExecStartPre=/usr/bin/mkdir -p /sys/fs/cgroup/cpuset/system.slice/kubelet.serviceExecStartPre=/usr/bin/mkdir -p /sys/fs/cgroup/hugetlb/system.slice/kubelet.serviceExecStart=/usr/local/bin/kubelet \\--bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.kubeconfig \\--cert-dir=/etc/kubernetes/cert \\--kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\--config=/etc/kubernetes/kubelet.config.json \\--hostname-override=${nodeIP} \\--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest \\--alsologtostderr=true \\--logtostderr=false \\--log-dir=/app/log/kubernetes \\--enforce-node-allocatable=pods,kube-reserved,system-reserved \\--kube-reserved-cgroup=/system.slice/kubelet.service \\--system-reserved-cgroup=/system.slice \\--kube-reserved=cpu=500m,memory=1Gi,ephemeral-storage=1Gi \\--system-reserved=cpu=500m,memory=2Gi,ephemeral-storage=5Gi \\--eviction-hard=imagefs.available<5%,memory.available<500Mi,nodefs.available<5% \\--v=0Restart=on-failureRestartSec=5[Install]WantedBy=multi-user.targetEOFrm -rf /etc/systemd/system/kubelet.servicecp kubelet.service /etc/systemd/system/mkdir -p /app/log/kubernetessystemctl daemon-reloadsystemctl enable kubeletsystemctl restart kubeletsleep 10kubectl get csr | awk '{print $1}' | grep -v "NAME"| xargs kubectl certificate approvescp root@${masterIP}:/etc/kubernetes/kube-proxy.kubeconfig /etc/kubernetes/cat >kube-proxy.config.yaml <<EOFapiVersion: kubeproxy.config.k8s.io/v1alpha1bindAddress: ${nodeIP}clientConnection: kubeconfig: /etc/kubernetes/kube-proxy.kubeconfigclusterCIDR: ${CLUSTER_CIDR}healthzBindAddress: ${nodeIP}:10256hostnameOverride: ${nodeIP}kind: KubeProxyConfigurationmetricsBindAddress: ${nodeIP}:10249mode: "ipvs"EOFrm -rf /etc/kubernetes/kube-proxy.config.yamlcp kube-proxy.config.yaml /etc/kubernetes/mkdir -p /var/lib/kube-proxycat > kube-proxy.service <<EOF[Unit]Description=Kubernetes Kube-Proxy ServerDocumentation=https://github.com/GoogleCloudPlatform/kubernetesAfter=network.target[Service]WorkingDirectory=/var/lib/kube-proxyExecStart=/usr/local/bin/kube-proxy \\--config=/etc/kubernetes/kube-proxy.config.yaml \\--alsologtostderr=true \\--logtostderr=false \\--log-dir=/app/log/kubernetes \\--v=0Restart=on-failureRestartSec=5LimitNOFILE=65536[Install]WantedBy=multi-user.targetEOFrm -rf /etc/systemd/system/kube-proxy.servicecp kube-proxy.service /etc/systemd/system/mkdir -p /var/lib/kube-proxymkdir -p /app/log/kubernetessystemctl daemon-reloadsystemctl enable kube-proxysystemctl restart kube-proxy |
