1
# cat <<EOF > /etc/sysctl.d/k8s.conf
2
net.ipv4.ip_forward = 1
3
net.bridge.bridge-nf-call-iptables = 1
4
fs.may_detach_mounts = 1
5
vm.overcommit_memory=1
6
vm.panic_on_oom=0
7
fs.inotify.max_user_watches=89100
8
fs.file-max=52706963
9
fs.nr_open=52706963
10
net.netfilter.nf_conntrack_max=2310720
11

12
net.ipv4.tcp_keepalive_time = 600
13
net.ipv4.tcp_keepalive_probes = 3
14
net.ipv4.tcp_keepalive_intvl =15
15
net.ipv4.tcp_max_tw_buckets = 36000
16
net.ipv4.tcp_tw_reuse = 1
17
net.ipv4.tcp_max_orphans = 327680
18
net.ipv4.tcp_orphan_retries = 3
19
net.ipv4.tcp_syncookies = 1
20
net.ipv4.tcp_max_syn_backlog = 16384
21
net.ipv4.ip_conntrack_max = 65536
22
net.ipv4.tcp_max_syn_backlog = 16384
23
net.ipv4.tcp_timestamps = 0
24
net.core.somaxconn = 16384
25

26
net.ipv6.conf.all.disable_ipv6 = 0
27
net.ipv6.conf.default.disable_ipv6 = 0
28
net.ipv6.conf.lo.disable_ipv6 = 0
29
net.ipv6.conf.all.forwarding = 1
30
EOF
31

32
# sysctl --system 生效

1
cd /data/server/kubespray/kubespray-2.28.0
2
cp -rf inventory/sample/ /home/kubespray-cluster/test_cluster/
3
cd /home/kubespray-cluster/test_cluster/
4
cat inventory.ini
5
[kube_control_plane]
6
master-101 ansible_host=192.168.10.101 ip=192.168.10.101 etcd_member_name=etcd1
7

8
[etcd:children]
9
kube_control_plane
10

11
[kube_node]
12
test-worker-102 ansible_host=192.168.10.102 ip=192.168.10.102
13
test-worker-103 ansible_host=192.168.10.103 ip=192.168.10.103
14
test-worker-104 ansible_host=192.168.10.104 ip=192.168.10.104
15

16
# 修改ntp服务器地址
17
cat group_vars/all/all.yml
18
ntp_enabled: true
19
ntp_manage_config: false
20
ntp_servers:
21
  - "ntp1.aliyun.com"
22
  - "ntp2.aliyun.com"
23
  - "ntp3.aliyun.com"
24
  - "s1c.time.edu.cn"
25
  - "ntp.ntsc.ac.cn"
26
  - "cn.ntp.org.cn"
27
# 开启日志
28
unsafe_show_logs: true

1
cat group_vars/k8s_cluster/k8s-cluster.yml
2
kube_network_plugin: calico # Kubernetes 网络插件
3
kube_service_addresses: 10.233.0.0/18 # Service 的 ClusterIP 地址范围
4
kube_pods_subnet: 10.233.64.0/18 # Pod 的 IP 地址范围
5
kube_network_node_prefix: 24 # 分配给每个节点的 Pod IP 子网前缀长度
6
kube_apiserver_port: 6443  # (https) # API Server 端口
7
kube_proxy_mode: ipvs # Kube-proxy 代理模式
8
cluster_name: tst-cluster.local # 集群名称/DNS 域
9
dns_mode: coredns # DNS 模式
10
container_manager: containerd # 容器运行时
11
k8s_image_pull_policy: IfNotPresent # 镜像拉取策略
12
event_ttl_duration: "1h0m0s" # 事件保留时长
13
auto_renew_certificates: true # 自动续订证书
14
kube_proxy_nodeport_addresses: ["primary"]
15
# 离线下载相关配置
16
download_run_once: false
17
download_localhost: false
18
download_force_cache: false

1
vim ../../roles/container-engine/containerd/templates/config.toml.j2
2
[plugins."io.containerd.cri.v1.images".registry]
3
  config_path = "{{ containerd_cfg_dir }}/certs.d"
4
# 此段下面添加
5
{% for registry in containerd_registry_auth if registry['registry'] is defined %}
6
{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
7
    [plugins."io.containerd.cri.v1.images".registry.configs."{{ registry['registry'] }}".auth]
8
{% if registry['username'] is defined and registry['password'] is defined %}
9
      password = "{{ registry['password'] }}"
10
      username = "{{ registry['username'] }}"
11
{% else %}
12
      auth = "{{ registry['auth'] }}"
13
{% endif %}
14
{% endif %}
15
{% endfor %}
16

17
# 默认从https改为http
18
vim ../../roles/container-engine/containerd/templates/hosts.toml.j2
19
server = "{{ item.server | default("http://" + item.prefix) }}"

1
cat group_vars/all/offline.yml
2
---
3
registry_host: "tst-registry.bluethink.local/library" #镜像仓库地址
4
files_repo: "http://192.168.10.100:5000/kubespray" #dufs地址
5

6
containerd_registries_mirrors:
7
  - prefix: "{{ registry_host }}"
8
    mirrors:
9
      - host: "{{ registry_host }}"
10
        capabilities: ["pull", "resolve"]
11
        skip_verify: true
12
containerd_registry_auth:
13
  - registry: tst-registry.bluethink.local
14
    username: bluethink
15
    password: 1qaz@WSX
16

17
kube_image_repo: "{{ registry_host }}"
18
gcr_image_repo: "{{ registry_host }}"
19
github_image_repo: "{{ registry_host }}"
20
docker_image_repo: "{{ registry_host }}"
21
quay_image_repo: "{{ registry_host }}"
22

23
kubeadm_download_url: "{{ files_repo }}/dl.k8s.io/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubeadm"
24
kubectl_download_url: "{{ files_repo }}/dl.k8s.io/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubectl"
25
kubelet_download_url: "{{ files_repo }}/dl.k8s.io/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubelet"
26

27
cni_download_url: "{{ files_repo }}/github.com/containernetworking/plugins/releases/download/v{{ cni_version }}/cni-plugins-linux-{{ image_arch }}-v{{ cni_version }}.tgz"
28

29
crictl_download_url: "{{ files_repo }}/github.com/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
30

31
etcd_download_url: "{{ files_repo }}/github.com/etcd-io/etcd/releases/download/v{{ etcd_version }}/etcd-v{{ etcd_version }}-linux-{{ image_arch }}.tar.gz"
32

33
calicoctl_download_url: "{{ files_repo }}/github.com/projectcalico/calico/releases/download/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
34
calico_crds_download_url: "{{ files_repo }}/github.com/projectcalico/calico/archive/v{{ calico_version }}.tar.gz"
35

36
ciliumcli_download_url: "{{ files_repo }}/github.com/cilium/cilium-cli/releases/download/v{{ cilium_cli_version }}/cilium-linux-{{ image_arch }}.tar.gz"
37

38
helm_download_url: "{{ files_repo }}/get.helm.sh/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz"
39

40
crun_download_url: "{{ files_repo }}/github.com/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
41

42
kata_containers_download_url: "{{ files_repo }}/github.com/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz"
43

44
cri_dockerd_download_url: "{{ files_repo }}/github.com/Mirantis/cri-dockerd/releases/download/v{{ cri_dockerd_version }}/cri-dockerd-{{ cri_dockerd_version }}.{{ image_arch }}.tgz"
45

46
runc_download_url: "{{ files_repo }}/github.com/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}"
47

48
crio_download_url: "{{ files_repo }}/storage.googleapis.com/cri-o/artifacts/cri-o.{{ image_arch }}.v{{ crio_version }}.tar.gz"
49
skopeo_download_url: "{{ files_repo }}/github.com/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}"
50

51
containerd_download_url: "{{ files_repo }}/github.com/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
52
nerdctl_download_url: "{{ files_repo }}/github.com/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
53

54
gvisor_runsc_download_url: "{{ files_repo }}/storage.googleapis.com/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/runsc"
55
gvisor_containerd_shim_runsc_download_url: "{{ files_repo }}/storage.googleapis.com/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/containerd-shim-runsc-v1"