kubernetes_install_debian_v2
Differences
This shows you the differences between two versions of the page.
| kubernetes_install_debian_v2 [2025/07/26 17:09] – - Imported by DokuWiki Advanced Plugin wikiadm | kubernetes_install_debian_v2 [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== Cenário ===== | ||
| - | ^Hostname^IPv4^IPv6^Data Center^ESXI^VLAN^ | ||
| - | |k-ctrl-pl-1|177.75.176.34|2804: | ||
| - | |k-node-01|177.75.176.35|2804: | ||
| - | |k-node-02|177.75.176.36|2804: | ||
| - | |k-nfs-01|2804: | ||
| - | |||
| - | * **Rede nodes:** 177.75.176.32/ | ||
| - | * **Rede pods:** 10.244.0.0/ | ||
| - | * **Rede services:** 10.96.0.0/ | ||
| - | |||
| - | === Partição adicional === | ||
| - | * **/ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo hostnamectl set-hostname k-ctrl-pl-01 | ||
| - | $ sudo hostnamectl set-hostname k-node-01 | ||
| - | $ sudo hostnamectl set-hostname k-node-02 | ||
| - | </ | ||
| - | |||
| - | <file bash> | ||
| - | cat <<EOF | sudo tee -a /etc/hosts | ||
| - | 177.75.176.34 k-ctrl-pl-01.juntotelecom.com.br k-ctrl-pl-01 | ||
| - | 177.75.176.35 k-node-01.juntotelecom.com.br k-node-01 | ||
| - | 177.75.176.36 k-node-02.juntotelecom.com.br k-node-02 | ||
| - | 2804: | ||
| - | 2804: | ||
| - | 2804: | ||
| - | 2804: | ||
| - | EOF | ||
| - | </ | ||
| - | |||
| - | ===== Disco adicional ===== | ||
| - | FIXME Disco reservado para o pods - containers. | ||
| - | |||
| - | === Em ambos os servidores === | ||
| - | <code bash> | ||
| - | $ MOUNT_POINT=/ | ||
| - | $ DISK_DEVICE=/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ echo -e " | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo mkfs.ext4 ${DISK_DEVICE}1 | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ UUID=`sudo blkid -o export ${DISK_DEVICE}1 | grep UUID | grep -v PARTUUID` | ||
| - | $ sudo mkdir ${MOUNT_POINT} | ||
| - | $ sudo cp -p / | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ echo " | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo mount ${MOUNT_POINT} | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ df -hT | grep containers | ||
| - | </ | ||
| - | |||
| - | ===== Instalando o CRI-O ===== | ||
| - | Nessa instalação o CRI-O será usado como Container Runtime. | ||
| - | |||
| - | FIXME A partir da versão 1.23 do Kubernetes, o Docker não será mais compatível. | ||
| - | |||
| - | <code bash> | ||
| - | $ cat <<EOF | sudo tee / | ||
| - | overlay | ||
| - | br_netfilter | ||
| - | EOF | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo modprobe overlay | ||
| - | $ sudo modprobe br_netfilter | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ lsmod | grep br_netfilter | ||
| - | br_netfilter | ||
| - | bridge | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ lsmod | grep overlay | ||
| - | overlay | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | cat <<EOF | sudo tee / | ||
| - | net.ipv4.conf.all.forwarding | ||
| - | net.ipv6.conf.all.forwarding | ||
| - | net.bridge.bridge-nf-call-iptables | ||
| - | net.bridge.bridge-nf-call-ip6tables | ||
| - | EOF | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo sysctl --system | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ OS=Debian_11 | ||
| - | $ VERSION=1.24 | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ cat <<EOF | sudo tee / | ||
| - | deb https:// | ||
| - | EOF | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ cat <<EOF | sudo tee / | ||
| - | deb http:// | ||
| - | EOF | ||
| - | </ | ||
| - | |||
| - | <code bashs> | ||
| - | $ curl -L https:// | ||
| - | % Total % Received % Xferd Average Speed | ||
| - | | ||
| - | 0 | ||
| - | 100 | ||
| - | 100 | ||
| - | 100 | ||
| - | 100 | ||
| - | 100 | ||
| - | 100 1093 100 1093 0 | ||
| - | OK | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ curl -L https:// | ||
| - | % Total % Received % Xferd Average Speed | ||
| - | | ||
| - | 0 | ||
| - | 100 1093 100 1093 0 | ||
| - | OK | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo apt update | ||
| - | $ sudo apt install cri-o cri-o-runc cri-tools | ||
| - | </ | ||
| - | |||
| - | ===== Instalando o Kubernets ===== | ||
| - | <code bashs> | ||
| - | $ sudo swapoff -a | ||
| - | $ sudo cp -fp / | ||
| - | $ sudo sed -i '/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | sudo curl -fsSLo / | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | echo "deb [signed-by=/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo apt update | ||
| - | $ sudo apt install kubelet kubeadm kubectl | ||
| - | $ sudo apt-mark hold kubelet kubeadm kubectl | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo systemctl daemon-reload | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo systemctl enable crio --now | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo systemctl status crio | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo systemctl enable kubelet --now | ||
| - | </ | ||
| - | |||
| - | ===== Configurando o Kubernets ===== | ||
| - | Executar no master - Control Plane. | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo kubeadm config images pull | ||
| - | [config/ | ||
| - | [config/ | ||
| - | [config/ | ||
| - | [config/ | ||
| - | [config/ | ||
| - | [config/ | ||
| - | [config/ | ||
| - | </ | ||
| - | |||
| - | <file bash> | ||
| - | $ sudo crictl image | ||
| - | IMAGE | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | registry.k8s.io/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ mkdir -p yamls/ | ||
| - | $ cd yamls/ | ||
| - | </ | ||
| - | |||
| - | |||
| - | |||
| - | <file yaml kubeadm-config.yaml> | ||
| - | # vim kubeadm-config.yaml | ||
| - | --- | ||
| - | apiVersion: kubeadm.k8s.io/ | ||
| - | kind: ClusterConfiguration | ||
| - | networking: | ||
| - | podSubnet: 10.244.0.0/ | ||
| - | serviceSubnet: | ||
| - | --- | ||
| - | apiVersion: kubeadm.k8s.io/ | ||
| - | kind: InitConfiguration | ||
| - | localAPIEndpoint: | ||
| - | advertiseAddress: | ||
| - | bindPort: 6443 | ||
| - | nodeRegistration: | ||
| - | kubeletExtraArgs: | ||
| - | node-ip: 177.75.176.34, | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo kubeadm init --config=kubeadm-config.yaml | ||
| - | [init] Using Kubernetes version: v1.26.1 | ||
| - | [preflight] Running pre-flight checks | ||
| - | [preflight] Pulling images required for setting up a Kubernetes cluster | ||
| - | [preflight] This might take a minute or two, depending on the speed of your internet connection | ||
| - | [preflight] You can also perform this action in beforehand using ' | ||
| - | [certs] Using certificateDir folder "/ | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] apiserver serving cert is signed for DNS names [k-ctrl-pl-01 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 177.75.176.34] | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] etcd/server serving cert is signed for DNS names [k-ctrl-pl-01 localhost] and IPs [177.75.176.34 127.0.0.1 ::1] | ||
| - | [certs] Generating " | ||
| - | [certs] etcd/peer serving cert is signed for DNS names [k-ctrl-pl-01 localhost] and IPs [177.75.176.34 127.0.0.1 ::1] | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [certs] Generating " | ||
| - | [kubeconfig] Using kubeconfig folder "/ | ||
| - | [kubeconfig] Writing " | ||
| - | [kubeconfig] Writing " | ||
| - | [kubeconfig] Writing " | ||
| - | [kubeconfig] Writing " | ||
| - | [kubelet-start] Writing kubelet environment file with flags to file "/ | ||
| - | [kubelet-start] Writing kubelet configuration to file "/ | ||
| - | [kubelet-start] Starting the kubelet | ||
| - | [control-plane] Using manifest folder "/ | ||
| - | [control-plane] Creating static Pod manifest for " | ||
| - | [control-plane] Creating static Pod manifest for " | ||
| - | [control-plane] Creating static Pod manifest for " | ||
| - | [etcd] Creating static Pod manifest for local etcd in "/ | ||
| - | [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/ | ||
| - | [apiclient] All control plane components are healthy after 37.003066 seconds | ||
| - | [upload-config] Storing the configuration used in ConfigMap " | ||
| - | [kubelet] Creating a ConfigMap " | ||
| - | [upload-certs] Skipping phase. Please see --upload-certs | ||
| - | [mark-control-plane] Marking the node k-ctrl-pl-01 as control-plane by adding the labels: [node-role.kubernetes.io/ | ||
| - | [mark-control-plane] Marking the node k-ctrl-pl-01 as control-plane by adding the taints [node-role.kubernetes.io/ | ||
| - | [bootstrap-token] Using token: cv5m0b.aehl2kux0tai4mga | ||
| - | [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles | ||
| - | [bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes | ||
| - | [bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials | ||
| - | [bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token | ||
| - | [bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster | ||
| - | [bootstrap-token] Creating the " | ||
| - | [kubelet-finalize] Updating "/ | ||
| - | [addons] Applied essential addon: CoreDNS | ||
| - | [addons] Applied essential addon: kube-proxy | ||
| - | |||
| - | Your Kubernetes control-plane has initialized successfully! | ||
| - | |||
| - | To start using your cluster, you need to run the following as a regular user: | ||
| - | |||
| - | mkdir -p $HOME/.kube | ||
| - | sudo cp -i / | ||
| - | sudo chown $(id -u):$(id -g) $HOME/ | ||
| - | |||
| - | Alternatively, | ||
| - | |||
| - | export KUBECONFIG=/ | ||
| - | |||
| - | You should now deploy a pod network to the cluster. | ||
| - | Run " | ||
| - | https:// | ||
| - | |||
| - | Then you can join any number of worker nodes by running the following on each as root: | ||
| - | |||
| - | kubeadm join 177.75.176.34: | ||
| - | --discovery-token-ca-cert-hash sha256: | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ mkdir -p $HOME/.kube | ||
| - | $ sudo cp -i / | ||
| - | $ sudo chown $(id -u):$(id -g) $HOME/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ kubectl get node -o wide | ||
| - | NAME | ||
| - | k-ctrl-pl-01 | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ kubectl get pod --all-namespaces -o wide | ||
| - | NAMESPACE | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | </ | ||
| - | |||
| - | ===== Adicionando os workers - nodes ===== | ||
| - | |||
| - | ==== k-node-01 ==== | ||
| - | |||
| - | <file yaml kubeadm-config.yaml> | ||
| - | $ vim kubeadm-config.yaml | ||
| - | --- | ||
| - | apiVersion: kubeadm.k8s.io/ | ||
| - | kind: JoinConfiguration | ||
| - | discovery: | ||
| - | bootstrapToken: | ||
| - | apiServerEndpoint: | ||
| - | token: " | ||
| - | caCertHashes: | ||
| - | - " | ||
| - | # change auth info above to match the actual token and CA certificate hash for your cluster | ||
| - | nodeRegistration: | ||
| - | kubeletExtraArgs: | ||
| - | node-ip: 177.75.176.35, | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo kubeadm join --config=kubeadm-config.yaml | ||
| - | [preflight] Running pre-flight checks | ||
| - | [preflight] Reading configuration from the cluster... | ||
| - | [preflight] FYI: You can look at this config file with ' | ||
| - | [kubelet-start] Writing kubelet configuration to file "/ | ||
| - | [kubelet-start] Writing kubelet environment file with flags to file "/ | ||
| - | [kubelet-start] Starting the kubelet | ||
| - | [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap... | ||
| - | |||
| - | This node has joined the cluster: | ||
| - | * Certificate signing request was sent to apiserver and a response was received. | ||
| - | * The Kubelet was informed of the new secure connection details. | ||
| - | |||
| - | Run ' | ||
| - | </ | ||
| - | |||
| - | ==== k-node-02 ==== | ||
| - | |||
| - | <file yaml kubeadm-config.yaml> | ||
| - | --- | ||
| - | apiVersion: kubeadm.k8s.io/ | ||
| - | kind: JoinConfiguration | ||
| - | discovery: | ||
| - | bootstrapToken: | ||
| - | apiServerEndpoint: | ||
| - | token: " | ||
| - | caCertHashes: | ||
| - | - " | ||
| - | # change auth info above to match the actual token and CA certificate hash for your cluster | ||
| - | nodeRegistration: | ||
| - | kubeletExtraArgs: | ||
| - | node-ip: 177.75.176.35, | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ sudo kubeadm join --config=kubeadm-config.yaml | ||
| - | [preflight] Running pre-flight checks | ||
| - | [preflight] Reading configuration from the cluster... | ||
| - | [preflight] FYI: You can look at this config file with ' | ||
| - | [kubelet-start] Writing kubelet configuration to file "/ | ||
| - | [kubelet-start] Writing kubelet environment file with flags to file "/ | ||
| - | [kubelet-start] Starting the kubelet | ||
| - | [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap... | ||
| - | |||
| - | This node has joined the cluster: | ||
| - | * Certificate signing request was sent to apiserver and a response was received. | ||
| - | * The Kubelet was informed of the new secure connection details. | ||
| - | |||
| - | Run ' | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ kubectl get node -o wide | ||
| - | NAME STATUS | ||
| - | k-ctrl-pl-01 | ||
| - | k-node-01.juntotelecom.com.br | ||
| - | k-node-02.juntotelecom.com.br | ||
| - | </ | ||
| - | |||
| - | ===== Rede calico ===== | ||
| - | <code bash> | ||
| - | $ kubectl create -f https:// | ||
| - | namespace/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | customresourcedefinition.apiextensions.k8s.io/ | ||
| - | Warning: policy/ | ||
| - | podsecuritypolicy.policy/ | ||
| - | serviceaccount/ | ||
| - | clusterrole.rbac.authorization.k8s.io/ | ||
| - | clusterrolebinding.rbac.authorization.k8s.io/ | ||
| - | deployment.apps/ | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ curl -L https:// | ||
| - | % Total % Received % Xferd Average Speed | ||
| - | | ||
| - | 100 | ||
| - | </ | ||
| - | |||
| - | <file yaml custom-resources.yaml> | ||
| - | --- | ||
| - | $ cat custom-resources.yaml | ||
| - | # This section includes base Calico installation configuration. | ||
| - | # For more information, | ||
| - | apiVersion: operator.tigera.io/ | ||
| - | kind: Installation | ||
| - | metadata: | ||
| - | name: default | ||
| - | spec: | ||
| - | # Configures Calico networking. | ||
| - | calicoNetwork: | ||
| - | # Note: The ipPools section cannot be modified post-install. | ||
| - | ipPools: | ||
| - | - blockSize: 26 | ||
| - | cidr: 10.244.0.0/ | ||
| - | encapsulation: | ||
| - | natOutgoing: | ||
| - | nodeSelector: | ||
| - | - blockSize: 122 | ||
| - | cidr: fd01::/48 | ||
| - | encapsulation: | ||
| - | natOutgoing: | ||
| - | nodeSelector: | ||
| - | |||
| - | --- | ||
| - | |||
| - | # This section configures the Calico API server. | ||
| - | # For more information, | ||
| - | apiVersion: operator.tigera.io/ | ||
| - | kind: APIServer | ||
| - | metadata: | ||
| - | name: default | ||
| - | spec: {} | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | $ kubectl apply -f custom-resources.yaml | ||
| - | installation.operator.tigera.io/ | ||
| - | apiserver.operator.tigera.io/ | ||
| - | </ | ||
| - | |||
| - | <file bash> | ||
| - | $ cat / | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | }, | ||
| - | " | ||
| - | " | ||
| - | }, | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | }, | ||
| - | {" | ||
| - | ] | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | FIXME após reiniciar o servidor o calico conseguiu atribuir os ips da configuração aos pods. | ||
| - | |||
| - | <code bash> | ||
| - | $ kubectl get pod --all-namespaces -o wide | ||
| - | NAMESPACE | ||
| - | calico-apiserver | ||
| - | calico-apiserver | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | calico-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | kube-system | ||
| - | tigera-operator | ||
| - | </ | ||
| - | |||
| - | ===== Referências ===== | ||
| - | - [[https:// | ||
| - | - [[https:// | ||
kubernetes_install_debian_v2.1753560544.txt.gz · Last modified: by wikiadm