部署docker本地仓库修改httpd端口[rootharbor ~]# vim /etc/httpd/conf/httpd.conf Listen 4444 [rootharbor ~]# systemctl enable --now httpd [rootharbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y安装docker在harbor仓库节点[rootharbor ~]# dnf install docker-ce -y[rootharbor ~]# vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue [rootharbor ~]# systemctl daemon-reload [rootharbor ~]# systemctl enable --now docker生成key​ [rootharbor ~]# mkdir /data/certs -p [rootharbor ~]# openssl req -newkey rsa:4096 \ -nodes -sha256 -keyout /data/certs/timinglee.org.key \ -addext subjectAltName DNS:reg.timinglee.org \ -x509 -days 365 -out /data/certs/timinglee.org.crt ​编辑harbor配置文件编写启动脚本启动harbor并测试安装ansiblednf install ansible-core.x86_64 ansible.noarch -y配置所需用户生成ansible的临时配置文件并建立运行环境#建立用户 [devopsharbor ansible]$ ansible all -m user -a namedevops statepresent [devopsharbor ansible]$ ansible all -m shell -a echo lee | passwd --stdin devops [devopsharbor ansible]$ ansible all -m lineinfile -a path/etc/sudoers linedevops ALL(ALL) NOPASSWD: ALL insertafterEOF安装[devopsharbor ansible]$ tar zxf cri-dockerd-0.4.4.amd64.tgz [devopsharbor ansible]$ ls ansible.cfg cri-dockerd cri-dockerd-0.4.4.amd64.tgz inventory kubernetes-devops.yml [devopsharbor ansible]$ cd cri-dockerd/ [devopsharbor cri-dockerd]$ ls cri-dockerd cri-docker.service cri-docker.socket [devopsharbor cri-dockerd]$ vim cri-docker.service [Service] Typenotify ExecStart/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugincni --pod-infra-container-imagereg.timinglee.org/k8s/pause:3.10.1 ExecReload/bin/kill -s HUP $MAINPID TimeoutSec0 RestartSec2 Restartalways[devopsharbor ansible]$ vim ansible.cfg - name: devops k8s from ansible hosts: all tasks: - name: setup docker repo yum_repository: name: docker description: docker baseurl: http://172.25.254.250:4444/docker file: docker gpgcheck: no - name: install docker dnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp: ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock replace: ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue - name: setup docker registry copy: content: | { registry-mirrors:[https://reg.timinglee.org] } dest: /etc/docker/daemon.json - name: setup docker certs file: path: /etc/docker/certs.d/reg.timinglee.org state: directory - name: cp certs file copy: src: {{item.src}} dest: {{item.dest}} loop: - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/docker/certs.d/reg.timinglee.org/ca.crt - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt - name: stup cri-dockerd copy: src: {{item.src}} dest: {{item.dest}} mode: 0755 loop: - src: ./cri-dockerd/cri-dockerd dest: /usr/bin/cri-dockerd - src: ./cri-dockerd/cri-docker.service dest: /lib/systemd/system/cri-docker.service - src: ./cri-dockerd/cri-docker.socket dest: /lib/systemd/system/cri-docker.socket - name: update ca cert shell: update-ca-trust extract;sysctl --system;systemctl daemon-reload - name: start services service: name: {{item}} state: restarted enabled: yes loop: - docker - systemd-modules-load.service - cri-docker - name: install kubernetes from ansible hosts: all tasks: - name: setup k8s repo yum_repository: name: kubernetes description: kubernetes baseurl: https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm file: kubernetes gpgcheck: no - name: install software in master dnf: name: {{item}} state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 - kubectl-1.35.7-150500.1.1 when: inventory_hostname 172.25.254.100 - name: install software in work node dnf: name: {{item}} state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 when: inventory_hostname 172.25.254.10 or inventory_hostname 172.25.254.20 - name: setup kubectl kubeadm complication lineinfile: path: /root/.bashrc line: | source (kubectl completion bash) source (kubeadm completion bash) when: inventory_hostname 172.25.254.100 - name: start kubelet service: name: kubelet state: started enabled: yes下载kubernetes集群所需镜像上传镜像在master中初始化kubernetes集群依靠凭证加入节点 [rootk8s-server ~]# kubeadm token create --print-join-command kubeadm join 172.25.254.100:6443 --token s581s4.1hqcppjyy7tcpl18 --discovery-token-ca-cert-hash sha256:499fc0c56873912cdc18d1fcd68ce6276a954024ffb388ef1e10f44cc201fce0节点加入成功集群搭建完成