{"id":986,"date":"2021-07-29T18:18:40","date_gmt":"2021-07-29T10:18:40","guid":{"rendered":"https:\/\/egonlin.com\/?p=986"},"modified":"2021-07-29T19:01:10","modified_gmt":"2021-07-29T11:01:10","slug":"%e7%ac%ac%e4%b8%80%e8%8a%82%ef%bc%9akubeadm%e5%ae%89%e8%a3%85k8s","status":"publish","type":"post","link":"https:\/\/egonlin.com\/?p=986","title":{"rendered":"\u7b2c\u4e00\u8282\uff1akubeadm\u5b89\u88c5k8s"},"content":{"rendered":"

kubeadm\u5b89\u88c5k8s<\/h1>\n

\u4e00\u3001\u7b80\u4ecb<\/h2>\n
    Kubernetes\u6709\u4e24\u79cd\u65b9\u5f0f\uff0c\u7b2c\u4e00\u79cd\u662f\u4e8c\u8fdb\u5236\u7684\u65b9\u5f0f\uff0c\u53ef\u5b9a\u5236\u4f46\u662f\u90e8\u7f72\u590d\u6742\u5bb9\u6613\u51fa\u9519\uff1b\u7b2c\u4e8c\u79cd\u662fkubeadm\u5de5\u5177\u5b89\u88c5\uff0c\u90e8\u7f72\u7b80\u5355\uff0c\u4e0d\u53ef\u5b9a\u5236\u5316\u3002\u672c\u6b21\u6211\u4eec\u90e8\u7f72kubeadm\u7248.\n    \u670d\u52a1\u5668\u914d\u7f6e\u81f3\u5c11\u662f2G2\u6838\u7684\u3002\u5982\u679c\u4e0d\u662f\u5219\u53ef\u4ee5\u5728\u96c6\u7fa4\u521d\u59cb\u5316\u540e\u9762\u589e\u52a0 --ignore-preflight-errors=NumCPU<\/code><\/pre>\n
\u4e8c\u3001\u90e8\u7f72\u89c4\u5212<\/h2>\n
1\u3001\u7248\u672c\u89c4\u5212<\/h3>\n\n\n\n\n\n\n\n\n\n\n
\u8f6f\u4ef6<\/th>\n\u7248\u672c<\/th>\n<\/tr>\n<\/thead>\n
Centos<\/td>\n7.5\u7248\u672c\u53ca\u4ee5\u4e0a<\/td>\n<\/tr>\n
Docker<\/td>\n19.03\u53ca\u4ee5\u4e0a<\/td>\n<\/tr>\n
Kubernetse<\/td>\nV1.20.5\u53ca\u4ee5\u4e0a<\/td>\n<\/tr>\n
Flanner<\/td>\nV0.13.0\u53ca\u4ee5\u4e0a<\/td>\n<\/tr>\n
Kernel-lm<\/td>\nkernel-lt-4.4.245-1.el7.elrepo.x86_64.rpm\u53ca\u4ee5\u4e0a<\/td>\n<\/tr>\n
Kernel-lm-devel<\/td>\nkernel-lt-devel-4.4.245-1.el7.elrepo.x86_64.rpm<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
2\u3001\u8282\u70b9\u89c4\u5212<\/h3>\n\n\n\n\n\n\n\n
Hostname<\/th>\nIp<\/th>\n\u5185\u6838\u7248\u672c<\/th>\n<\/tr>\n<\/thead>\n
k8s-master-01<\/td>\n192.168.15.31<\/td>\n5.0\u4ee5\u4e0a<\/td>\n<\/tr>\n
k8s-node-01<\/td>\n192.168.15.32<\/td>\n5.0\u4ee5\u4e0a<\/td>\n<\/tr>\n
k8s-node-02<\/td>\n192.168.15.33<\/td>\n5.0\u4ee5\u4e0a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\u4e09\u3001\u4fee\u6539\u7f51\u7edc\u53ca\uff08\u4e09\u53f0\u4e3b\u673a\uff09<\/h2>\n
1\u3001\u4fee\u6539\u865a\u62df\u7f51\u7edc\u7f16\u8f91\u5668<\/h3>\n
\"\"<\/div>
\n
\"\"<\/div><\/p>\n
2\u3001\u514b\u9686\u4e3b\u673a<\/h3>\n
192.168.15.31   k8s-m-01 m1\n192.168.15.32   k8s-n-01 n1\n192.168.15.33   k8s-n-02 n2<\/code><\/pre>\n
3\u3001\u4fee\u6539\u4e09\u53f0\u5b9e\u4f8bIP\u7f51\u5173<\/h3>\n
\"\"<\/div>
\n
\"\"<\/div>
\n
\"\"<\/div><\/p>\n
\u5185\u7f51eth1\u4e5f\u8981\u4e0d\u540cIP\u5426\u5219\u4e09\u53f0\u673a\u5668IP\u51b2\u7a81\u3002\u4fee\u6539\u5b8c\u6210\u540e\u91cd\u542f\u7f51\u5361\uff0cping baidu.com \u67e5\u770b\u7f51\u7edc\u662f\u5426\u7545\u901a<\/strong><\/p>\n
\u56db\u3001\u4fee\u6539\u4e3b\u673a\u540d\u53ca\u89e3\u6790(\u4e09\u53f0\u8282\u70b9)<\/h2>\n
1\u3001\u4fee\u6539\u4e3b\u673a\u540d<\/h3>\n
hostnamectl set-hostname k8s-master-01\nhostnamectl set-hostname k8s-node-01\nhostnamectl set-hostname k8s-node-02<\/code><\/pre>\n
2\u3001\u6dfb\u52a0host\u89e3\u6790<\/h3>\n
cat \/etc\/hosts\n192.168.15.31  k8s-master-01 m1\n192.168.15.32  k8s-node-01   n1\n192.168.15.33  k8s-node-02   n2<\/code><\/pre>\n
3\u3001\u6dfb\u52a0DNS\u89e3\u6790<\/h3>\n
[root@k8s-master-01 ~]# vim \/etc\/resolv.conf\n# Generated by NetworkManager\nnameserver 223.5.5.5\nnameserver 114.114.114.114\n<\/code><\/pre>\n
\u4e94\u3001\u7cfb\u7edf\u4f18\u5316(\u4e09\u4e2a\u8282\u70b9\u5168\u505a)<\/h2>\n
1\u3001\u5173\u95edselinux<\/h3>\n
# \u6c38\u4e45\u5173\u95ed\nsed -i 's#enforcing#disabled#g' \/etc\/selinux\/config\n\n#\u4e34\u65f6\u5173\u95ed\nsetenforce 0<\/code><\/pre>\n
2\u3001\u5173\u95ed\u9632\u706b\u5899<\/h3>\n
systemctl disable --now firewalld<\/code><\/pre>\n
3\u3001\u5173\u95edswap\u5206\u533a<\/h3>\n
# \u5173\u95edswap\u5206\u533a\nswapoff -a \n\n# kubelet\u5ffd\u7565swap\necho 'KUBELET_EXTRA_ARGS="--fail-swap-on=false"' > \/etc\/sysconfig\/kubelet\n\n# \u6ce8\u91caswap\u5206\u533a\nvim \/etc\/fstab<\/code><\/pre>\n
\"\"<\/div><\/p>\n
4\u3001\u505a\u514d\u5bc6\u767b\u5f55(\u4e3b\u8282\u70b9\u505a)<\/h3>\n
[root@k8s-master-01 ~]# rm -rf \/root\/.ssh\n[root@k8s-master-01 ~]# ssh-keygen      \u4ea4\u4e92\u5f0f\u76f4\u63a5\u5168\u90e8\u56de\u8f66\n[root@k8s-master-01 ~]# cd \/root\/.ssh\/\n[root@k8s-master-01 ~\/.ssh]# mv id_rsa.pub authorized_keys\n[root@k8s-master-01 ~\/.ssh]# scp  -r  \/root\/.ssh  192.168.15.32:\/root\n[root@k8s-master-01 ~\/.ssh]# scp  -r  \/root\/.ssh  192.168.15.33:\/root<\/code><\/pre>\n
5\u3001\u540c\u6b65\u96c6\u7fa4\u65f6\u95f4<\/h3>\n
echo '#Timing synchronization time' >>\/var\/spool\/cron\/root  #\u7ed9\u5b9a\u65f6\u4efb\u52a1\u52a0\u4e0a\u6ce8\u91ca\necho '0 *\/1 * * * \/usr\/sbin\/ntpdate ntp1.aliyun.com &>\/dev\/null' >>\/var\/spool\/cron\/root      #\u8bbe\u7f6e\u5b9a\u65f6\u4efb\u52a1\ncrontab -l  #\u68c0\u67e5\u7ed3\u679c<\/code><\/pre>\n
6\u3001\u66f4\u65b0yum\u6e90<\/h3>\n
rm -rf \/etc\/yum.repos.d\/*\n\ncurl -o \/etc\/yum.repos.d\/CentOS-Base.repo https:\/\/repo.huaweicloud.com\/repository\/conf\/CentOS-7-reg.repo\n\nyum remove epel-release\nrm -rf  \/var\/cache\/yum\/x86_64\/6\/epel\/\nyum install -y https:\/\/repo.huaweicloud.com\/epel\/epel-release-latest-7.noarch.rpm\n\nsed -i \"s\/#baseurl\/baseurl\/g\" \/etc\/yum.repos.d\/epel.repo\nsed -i \"s\/metalink\/#metalink\/g\" \/etc\/yum.repos.d\/epel.repo\nsed -i \"s@https\\?:\/\/download.fedoraproject.org\/pub@https:\/\/repo.huaweicloud.com@g\" \/etc\/yum.repos.d\/epel.repo\n\nyum clean all\nyum makecache<\/code><\/pre>\n
7\u3001\u66f4\u65b0\u7cfb\u7edf\u8f6f\u4ef6(\u6392\u9664\u5185\u6838)<\/h3>\n
yum update -y --exclud=kernel*<\/code><\/pre>\n
8\u3001\u5b89\u88c5\u57fa\u7840\u5e38\u7528\u8f6f\u4ef6<\/h3>\n
yum install wget expect vim net-tools ntp bash-completion ipvsadm ipset jq iptables conntrack sysstat libseccomp -y<\/code><\/pre>\n
9\u3001\u66f4\u65b0\u7cfb\u7edf\u5185\u6838\uff08docker \u5bf9\u7cfb\u7edf\u5185\u6838\u8981\u6c42\u6bd4\u8f83\u9ad8\uff0c\u6700\u597d\u4f7f\u75284.4+\uff09<\/h3>\n
\u4e3b\u8282\u70b9\u64cd\u4f5c<\/strong><\/p>\n
[root@k8s-master-01 ~]# wget https:\/\/elrepo.org\/linux\/kernel\/el7\/x86_64\/RPMS\/kernel-lt-5.4.107-1.el7.elrepo.x86_64.rpm\n\n[root@k8s-master-01 ~]# wget https:\/\/elrepo.org\/linux\/kernel\/el7\/x86_64\/RPMS\/kernel-lt-devel-5.4.107-1.el7.elrepo.x86_64.rpm\n\n[root@k8s-master-01 ~]# for i in n1 n2 m1 ; do scp kernel-lt-* $i:\/opt; done<\/code><\/pre>\n
\u4e09\u4e2a\u8282\u70b9\u64cd\u4f5c<\/strong><\/p>\n
#\u5b89\u88c5\nyum localinstall -y \/opt\/kernel-lt*\n\n#\u8c03\u5230\u9ed8\u8ba4\u542f\u52a8\ngrub2-set-default 0 && grub2-mkconfig -o \/etc\/grub2.cfg \n\n#\u67e5\u770b\u5f53\u524d\u9ed8\u8ba4\u542f\u52a8\u7684\u5185\u6838\ngrubby --default-kernel\n\n#\u91cd\u542f\u7cfb\u7edf\nreboot<\/code><\/pre>\n
10\u3001\u5b89\u88c5IPVS<\/h3>\n
1\uff09yum\u5b89\u88c5<\/h4>\n
yum install -y conntrack-tools ipvsadm ipset conntrack libseccomp <\/code><\/pre>\n
2\uff09\u52a0\u8f7dIPVS\u6a21\u5757<\/h4>\n
cat > \/etc\/sysconfig\/modules\/ipvs.modules <<EOF \n#!\/bin\/bash \nipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack" \n\nfor kernel_module in \\${ipvs_modules}; do \n    \/sbin\/modinfo -F filename \\${kernel_module} > \/dev\/null 2>&1 \n    if [ $? -eq 0 ]; then \n        \/sbin\/modprobe \\${kernel_module} \n    fi \ndone \nEOF\n\nchmod 755 \/etc\/sysconfig\/modules\/ipvs.modules && bash \/etc\/sysconfig\/modules\/ipvs.modules && lsmod | grep ip_vs<\/code><\/pre>\n
11\u3001\u4fee\u6539\u5185\u6838\u542f\u52a8\u53c2\u6570\u4f18\u5316<\/h3>\n
cat > \/etc\/sysctl.d\/k8s.conf << EOF\nnet.ipv4.ip_forward = 1\nnet.bridge.bridge-nf-call-iptables = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nfs.may_detach_mounts = 1\nvm.overcommit_memory=1\nvm.panic_on_oom=0\nfs.inotify.max_user_watches=89100\nfs.file-max=52706963\nfs.nr_open=52706963\nnet.ipv4.tcp_keepalive_time = 600\nnet.ipv4.tcp.keepaliv.probes = 3\nnet.ipv4.tcp_keepalive_intvl = 15\nnet.ipv4.tcp.max_tw_buckets = 36000\nnet.ipv4.tcp_tw_reuse = 1\nnet.ipv4.tcp.max_orphans = 327680\nnet.ipv4.tcp_orphan_retries = 3\nnet.ipv4.tcp_syncookies = 1\nnet.ipv4.tcp_max_syn_backlog = 16384\nnet.ipv4.ip_conntrack_max = 65536\nnet.ipv4.tcp_max_syn_backlog = 16384\nnet.ipv4.top_timestamps = 0\nnet.core.somaxconn = 16384\nEOF\n\n# \u7acb\u5373\u751f\u6548\nsysctl --system<\/code><\/pre>\n
12\u3001\u5b89\u88c5docker(\u4e09\u53f0\u8282\u70b9\u90fd\u8981\u505a)<\/h3>\n
1\uff09\u5378\u8f7d\u4e4b\u524d\u7684docker<\/h4>\n
yum remove docker docker-common docker-selinux docker-engine -y<\/code><\/pre>\n
2\uff09\u5b89\u88c5docker\u6240\u9700\u5b89\u88c5\u5305<\/h4>\n
yum install -y yum-utils device-mapper-persistent-data lvm2<\/code><\/pre>\n
3\uff09\u5b89\u88c5docker yum\u6e90<\/h4>\n
wget -O \/etc\/yum.repos.d\/docker-ce.repo https:\/\/repo.huaweicloud.com\/docker-ce\/linux\/centos\/docker-ce.repo<\/code><\/pre>\n
4\uff09\u5b89\u88c5docker<\/h4>\n
yum install docker-ce -y<\/code><\/pre>\n
\u4e0d\u6210\u529f\u591a\u6267\u884c\u51e0\u6b21<\/strong><\/p>\n
5\uff09\u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f<\/h4>\n
systemctl enable --now docker.service<\/code><\/pre>\n
\u516d\u3001\u5b89\u88c5k8s<\/h2>\n
1\u3001\u5b89\u88c5kubelet(\u6240\u6709\u8282\u70b9\u90fd\u8981\u88c5)<\/h3>\n
1\uff09\u5b89\u88c5kebenetes yum \u6e90<\/h4>\n
cat <<EOF > \/etc\/yum.repos.d\/kubernetes.repo\n[kubernetes]\nname=Kubernetes\nbaseurl=https:\/\/mirrors.aliyun.com\/kubernetes\/yum\/repos\/kubernetes-el7-x86_64\/\nenabled=1\ngpgcheck=0\nrepo_gpgcheck=0\ngpgkey=https:\/\/mirrors.aliyun.com\/kubernetes\/yum\/doc\/yum-key.gpg https:\/\/mirrors.aliyun.com\/kubernetes\/yum\/doc\/rpm-package-key.gpg\nEOF<\/code><\/pre>\n
2\uff09\u5b89\u88c5\u5e76\u542f\u52a8\u4e14\u5f00\u673a\u81ea\u542f<\/h4>\n
[root@k8s-m-01 ~]# yum install -y kubelet kubeadm kubectl \n[root@k8s-m-01 ~]# systemctl enable --now kubelet<\/code><\/pre>\n
2\u3001\u4e3b\u8282\u70b9\u64cd\u4f5c\uff08node\u8282\u70b9\u4e0d\u6267\u884c\uff09<\/h3>\n
1\uff09\u521d\u59cb\u5316master\u8282\u70b9(\u4ec5\u5728master\u8282\u70b9\u4e0a\u6267\u884c)<\/h4>\n
kubeadm init \\\n--image-repository=registry.cn-hangzhou.aliyuncs.com\/k8sos \\\n--kubernetes-version=v1.20.2 \\\n--service-cidr=10.96.0.0\/12 \\\n--pod-network-cidr=10.244.0.0\/16<\/code><\/pre>\n
2\uff09\u5efa\u7acb\u7528\u6237\u96c6\u7fa4\u6743\u9650<\/h4>\n
mkdir -p $HOME\/.kube\nsudo cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config\nsudo chown $(id -u):$(id -g) $HOME\/.kube\/config\n\n#\u5982\u679c\u662froot\u7528\u6237\uff0c\u5219\u53ef\u4ee5\u4f7f\u7528\uff1a\necho "export KUBECONFIG=\/etc\/kubernetes\/admin.conf" >> ~\/.bash_profile\nsource ~\/.bash_profile<\/code><\/pre>\n
3\uff09\u5b89\u88c5\u96c6\u7fa4\u7f51\u7edc\u63d2\u4ef6\uff08flannel.yaml\u89c1\u9644\u4ef6\uff09<\/h4>\n
[root@k8s-master-01 ~]#kubectl apply -f flannel.yaml<\/code><\/pre>\n
4\uff09\u5c06\u5de5\u4f5c\u8282\u70b9\u52a0\u5165\u96c6\u7fa4<\/h4>\n
[root@k8s-master-01 ~]#kubeadm token create    --print-join-command\n\nkubeadm join 192.168.15.31:6443 --token zvyidd.gxnw8v1zdv3pdlzf     --discovery-token-ca-cert-hash sha256:05b6946a4de3f0e6900291118cf25de7bcdce3bcd19aa53eaaa8ffa86d67e440\n## \u6ce8\uff1a\u5c06\u4e0a\u65b9\u751f\u6210\u7684token\u590d\u5236\u5230node\u8282\u70b9\u4e0a\u6267\u884c\u3002<\/code><\/pre>\n
5\uff09\u68c0\u67e5\u96c6\u7fa4\u72b6\u6001<\/h4>\n
## \u7b2c\u4e00\u79cd\u65b9\u5f0f\n[root@k8s-master-01 ~]# kubectl get nodes\nNAME            STATUS   ROLES                  AGE     VERSION\nk8s-master-01   Ready    control-plane,master   11m     v1.20.5\nk8s-node-01     Ready    <none>                 3m13s   v1.20.5\nk8s-node-02     Ready    <none>                 3m9s    v1.20.5\n\n# \u7b2c\u4e8c\u79cd\u65b9\u5f0f\n[root@k8s-master-01 ~]# kubectl get pods -n kube-system\nNAME                                    READY   STATUS    RESTARTS   AGE\ncoredns-f68b4c98f-mmxkc                 1\/1     Running   0          11m\ncoredns-f68b4c98f-nvp6b                 1\/1     Running   0          11m\netcd-k8s-master-01                      1\/1     Running   0          11m\nkube-apiserver-k8s-master-01            1\/1     Running   0          11m\nkube-controller-manager-k8s-master-01   1\/1     Running   0          11m\nkube-flannel-ds-25kk5                   1\/1     Running   0          4m49s\nkube-flannel-ds-9zkkl                   1\/1     Running   0          3m22s\nkube-flannel-ds-sx57n                   1\/1     Running   0          3m26s\nkube-proxy-2gsrl                        1\/1     Running   0          11m\nkube-proxy-jkdbs                        1\/1     Running   0          3m22s\nkube-proxy-wqrc2                        1\/1     Running   0          3m26s\nkube-scheduler-k8s-master-01            1\/1     Running   0          11m\n\n# \u7b2c\u4e09\u79cd\u65b9\u5f0f\uff1a\u76f4\u63a5\u9a8c\u8bc1\u96c6\u7fa4DNS\n[root@k8s-master-01 ~]# kubectl run test -it --rm --image=busybox:1.28.3\nIf you don't see a command prompt, try pressing enter.\n\/ # nslookup kubernetes\nServer:    10.96.0.10\nAddress 1: 10.96.0.10 kube-dns.kube-system.svc.cluster.local\n\nName:      kubernetes\nAddress 1: 10.96.0.1 kubernetes.default.svc.cluster.local<\/code><\/pre>\n
\u9644\u4ef6\uff1a<\/p>\n
---\napiVersion: policy\/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n  name: psp.flannel.unprivileged\n  annotations:\n    seccomp.security.alpha.kubernetes.io\/allowedProfileNames: docker\/default\n    seccomp.security.alpha.kubernetes.io\/defaultProfileName: docker\/default\n    apparmor.security.beta.kubernetes.io\/allowedProfileNames: runtime\/default\n    apparmor.security.beta.kubernetes.io\/defaultProfileName: runtime\/default\nspec:\n  privileged: false\n  volumes:\n  - configMap\n  - secret\n  - emptyDir\n  - hostPath\n  allowedHostPaths:\n  - pathPrefix: "\/etc\/cni\/net.d"\n  - pathPrefix: "\/etc\/kube-flannel"\n  - pathPrefix: "\/run\/flannel"\n  readOnlyRootFilesystem: false\n  # Users and groups\n  runAsUser:\n    rule: RunAsAny\n  supplementalGroups:\n    rule: RunAsAny\n  fsGroup:\n    rule: RunAsAny\n  # Privilege Escalation\n  allowPrivilegeEscalation: false\n  defaultAllowPrivilegeEscalation: false\n  # Capabilities\n  allowedCapabilities: ['NET_ADMIN', 'NET_RAW']\n  defaultAddCapabilities: []\n  requiredDropCapabilities: []\n  # Host namespaces\n  hostPID: false\n  hostIPC: false\n  hostNetwork: true\n  hostPorts:\n  - min: 0\n    max: 65535\n  # SELinux\n  seLinux:\n    # SELinux is unused in CaaSP\n    rule: 'RunAsAny'\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  name: flannel\nrules:\n- apiGroups: ['extensions']\n  resources: ['podsecuritypolicies']\n  verbs: ['use']\n  resourceNames: ['psp.flannel.unprivileged']\n- apiGroups:\n  - ""\n  resources:\n  - pods\n  verbs:\n  - get\n- apiGroups:\n  - ""\n  resources:\n  - nodes\n  verbs:\n  - list\n  - watch\n- apiGroups:\n  - ""\n  resources:\n  - nodes\/status\n  verbs:\n  - patch\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  name: flannel\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: flannel\nsubjects:\n- kind: ServiceAccount\n  name: flannel\n  namespace: kube-system\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: flannel\n  namespace: kube-system\n---\nkind: ConfigMap\napiVersion: v1\nmetadata:\n  name: kube-flannel-cfg\n  namespace: kube-system\n  labels:\n    tier: node\n    app: flannel\ndata:\n  cni-conf.json: |\n    {\n      "name": "cbr0",\n      "cniVersion": "0.3.1",\n      "plugins": [\n        {\n          "type": "flannel",\n          "delegate": {\n            "hairpinMode": true,\n            "isDefaultGateway": true\n          }\n        },\n        {\n          "type": "portmap",\n          "capabilities": {\n            "portMappings": true\n          }\n        }\n      ]\n    }\n  net-conf.json: |\n    {\n      "Network": "10.244.0.0\/16",\n      "Backend": {\n        "Type": "vxlan"\n      }\n    }\n---\napiVersion: apps\/v1\nkind: DaemonSet\nmetadata:\n  name: kube-flannel-ds\n  namespace: kube-system\n  labels:\n    tier: node\n    app: flannel\nspec:\n  selector:\n    matchLabels:\n      app: flannel\n  template:\n    metadata:\n      labels:\n        tier: node\n        app: flannel\n    spec:\n      affinity:\n        nodeAffinity:\n          requiredDuringSchedulingIgnoredDuringExecution:\n            nodeSelectorTerms:\n            - matchExpressions:\n              - key: kubernetes.io\/os\n                operator: In\n                values:\n                - linux\n      hostNetwork: true\n      priorityClassName: system-node-critical\n      tolerations:\n      - operator: Exists\n        effect: NoSchedule\n      serviceAccountName: flannel\n      initContainers:\n      - name: install-cni\n        image: registry.cn-hangzhou.aliyuncs.com\/alvinos\/flanned:v0.13.1-rc1\n        command:\n        - cp\n        args:\n        - -f\n        - \/etc\/kube-flannel\/cni-conf.json\n        - \/etc\/cni\/net.d\/10-flannel.conflist\n        volumeMounts:\n        - name: cni\n          mountPath: \/etc\/cni\/net.d\n        - name: flannel-cfg\n          mountPath: \/etc\/kube-flannel\/\n      containers:\n      - name: kube-flannel\n        image: registry.cn-hangzhou.aliyuncs.com\/alvinos\/flanned:v0.13.1-rc1\n        command:\n        - \/opt\/bin\/flanneld\n        args:\n        - --ip-masq\n        - --kube-subnet-mgr\n        resources:\n          requests:\n            cpu: "100m"\n            memory: "50Mi"\n          limits:\n            cpu: "100m"\n            memory: "50Mi"\n        securityContext:\n          privileged: false\n          capabilities:\n            add: ["NET_ADMIN", "NET_RAW"]\n        env:\n        - name: POD_NAME\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.name\n        - name: POD_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        volumeMounts:\n        - name: run\n          mountPath: \/run\/flannel\n        - name: flannel-cfg\n          mountPath: \/etc\/kube-flannel\/\n      volumes:\n      - name: run\n        hostPath:\n          path: \/run\/flannel\n      - name: cni\n        hostPath:\n          path: \/etc\/cni\/net.d\n      - name: flannel-cfg\n        configMap:\n          name: kube-flannel-cfg<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
kubeadm\u5b89\u88c5k8s \u4e00\u3001\u7b80\u4ecb Kubernetes\u6709\u4e24\u79cd\u65b9\u5f0f\uff0c\u7b2c\u4e00\u79cd\u662f\u4e8c\u8fdb\u5236\u7684\u65b9\u5f0f\uff0c\u53ef\u5b9a\u5236\u4f46\u662f\u90e8\u7f72\u590d\u6742\u5bb9 […]<\/p>\n","protected":false},"author":3,"featured_media":992,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[122],"tags":[21,133,134,135,19,22,132,20],"_links":{"self":[{"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/posts\/986"}],"collection":[{"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/egonlin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=986"}],"version-history":[{"count":0,"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/posts\/986\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/egonlin.com\/index.php?rest_route=\/wp\/v2\/media\/992"}],"wp:attachment":[{"href":"https:\/\/egonlin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/egonlin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/egonlin.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}