以containerd作为runtime搭建k8s集群

关闭防火墙与交换分区

systemctl stop firewalld.service

systemctl disable firewalld.service

swapoff -a ; sed -i '/swap/d' /etc/fstab

yum源设置：

#k8s

[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

containerd直接使用docker的yum源即可

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

检查可用yum源

yum makecache

安装配置containerd:

yum install containerd.io cri-tools -y

安装containerd：

yum install containerd.io cri-tools -y

安装crictl客户端工具：

crictl config runtime-endpoint unix:///var/run/containerd/containerd.sock

设置开机自启：

systemctl enable containerd.service --now

生成配置文件：

containerd config default > /etc/containerd/config.toml

在此配置单做以下修改 /etc/containerd/config.toml

disabled_plugins = [] imports = [] oom_score = 0 plugin_dir = "" required_plugins = [] root = "/var/lib/containerd" state = "/run/containerd" temp = "" version = 2 [cgroup]   path = "" [debug]   address = ""   format = ""   gid = 0   level = ""   uid = 0 [grpc]   address = "/run/containerd/containerd.sock"   gid = 0   max_recv_message_size = 16777216   max_send_message_size = 16777216   tcp_address = ""   tcp_tls_ca = ""   tcp_tls_cert = ""   tcp_tls_key = ""   uid = 0 [metrics]   address = ""   grpc_histogram = false [plugins]   [plugins."io.containerd.gc.v1.scheduler"]     deletion_threshold = 0     mutation_threshold = 100     pause_threshold = 0.02     schedule_delay = "0s"     startup_delay = "100ms"   [plugins."io.containerd.grpc.v1.cri"]     device_ownership_from_security_context = false     disable_apparmor = false     disable_cgroup = false     disable_hugetlb_controller = true     disable_proc_mount = false     disable_tcp_service = true     enable_selinux = false     enable_tls_streaming = false     enable_unprivileged_icmp = false     enable_unprivileged_ports = false     ignore_image_defined_volumes = false     max_concurrent_downloads = 3     max_container_log_line_size = 16384     netns_mounts_under_state_dir = false     restrict_oom_score_adj = false     sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.5"     selinux_category_range = 1024     stats_collect_period = 10     stream_idle_timeout = "4h0m0s"     stream_server_address = "127.0.0.1"     stream_server_port = "0"     systemd_cgroup = false     tolerate_missing_hugetlb_controller = true     unset_seccomp_profile = ""     [plugins."io.containerd.grpc.v1.cri".cni]       bin_dir = "/opt/cni/bin"       conf_dir = "/etc/cni/net.d"       conf_template = ""       ip_pref = ""       max_conf_num = 1     [plugins."io.containerd.grpc.v1.cri".containerd]       default_runtime_name = "runc"       disable_snapshot_annotations = true       discard_unpacked_layers = false       ignore_rdt_not_enabled_errors = false       no_pivot = false       snapshotter = "overlayfs"       [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]         base_runtime_spec = ""         cni_conf_dir = ""         cni_max_conf_num = 0         container_annotations = []         pod_annotations = []         privileged_without_host_devices = false         runtime_engine = ""         runtime_path = ""         runtime_root = ""         runtime_type = ""         [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]       [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]         [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]           base_runtime_spec = ""           cni_conf_dir = ""           cni_max_conf_num = 0           container_annotations = []           pod_annotations = []           privileged_without_host_devices = false           runtime_engine = ""           runtime_path = ""           runtime_root = ""           runtime_type = "io.containerd.runc.v2"           [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]             BinaryName = ""             CriuImagePath = ""             CriuPath = ""             CriuWorkPath = ""             IoGid = 0             IoUid = 0             NoNewKeyring = false             NoPivotRoot = false             Root = ""             ShimCgroup = ""             SystemdCgroup = true       [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]         base_runtime_spec = ""         cni_conf_dir = ""         cni_max_conf_num = 0         container_annotations = []         pod_annotations = []         privileged_without_host_devices = false         runtime_engine = ""         runtime_path = ""         runtime_root = ""         runtime_type = ""         [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]     [plugins."io.containerd.grpc.v1.cri".image_decryption]       key_model = "node"     [plugins."io.containerd.grpc.v1.cri".registry]       config_path = ""       [plugins."io.containerd.grpc.v1.cri".registry.auths]       [plugins."io.containerd.grpc.v1.cri".registry.configs]       [plugins."io.containerd.grpc.v1.cri".registry.headers]       [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]          endpoint= ["https://frz7i079.mirror.aliyuncs.com"]     [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]       tls_cert_file = ""       tls_key_file = ""   [plugins."io.containerd.internal.v1.opt"]     path = "/opt/containerd"   [plugins."io.containerd.internal.v1.restart"]     interval = "10s"   [plugins."io.containerd.internal.v1.tracing"]     sampling_ratio = 1.0     service_name = "containerd"   [plugins."io.containerd.metadata.v1.bolt"]     content_sharing_policy = "shared"   [plugins."io.containerd.monitor.v1.cgroups"]     no_prometheus = false   [plugins."io.containerd.runtime.v1.linux"]     no_shim = false     runtime = "runc"     runtime_root = ""     shim = "containerd-shim"     shim_debug = false   [plugins."io.containerd.runtime.v2.task"]     platforms = ["linux/amd64"]     sched_core = false   [plugins."io.containerd.service.v1.diff-service"]     default = ["walking"]   [plugins."io.containerd.service.v1.tasks-service"]     rdt_config_file = ""   [plugins."io.containerd.snapshotter.v1.aufs"]     root_path = ""   [plugins."io.containerd.snapshotter.v1.btrfs"]     root_path = ""   [plugins."io.containerd.snapshotter.v1.devmapper"]     async_remove = false     base_image_size = ""     discard_blocks = false     fs_options = ""     fs_type = ""     pool_name = ""     root_path = ""   [plugins."io.containerd.snapshotter.v1.native"]     root_path = ""   [plugins."io.containerd.snapshotter.v1.overlayfs"]     root_path = ""     upperdir_label = false   [plugins."io.containerd.snapshotter.v1.zfs"]     root_path = ""   [plugins."io.containerd.tracing.processor.v1.otlp"]     endpoint = ""     insecure = false     protocol = "" [proxy_plugins] [stream_processors]   [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]     accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]     args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]     env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]     path = "ctd-decoder"     returns = "application/vnd.oci.image.layer.v1.tar"   [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]     accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]     args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]     env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]     path = "ctd-decoder"     returns = "application/vnd.oci.image.layer.v1.tar+gzip" [timeouts]   "io.containerd.timeout.bolt.open" = "0s"   "io.containerd.timeout.shim.cleanup" = "5s"   "io.containerd.timeout.shim.load" = "5s"   "io.containerd.timeout.shim.shutdown" = "3s"   "io.containerd.timeout.task.state" = "2s" [ttrpc]   address = ""   gid = 0   uid = 0

#说明：

#生成pause容器

sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.5"

#添加镜像仓库

 [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]

        endpoint = ["https://frz7i079.mirror.aliyuncs.com"]

#修改驱动为systemd

SystemdCgroup = true

重启containerd:

systemctl restart containerd.service

设置命名空间：

export CONTAINERD_NAMESPACE=k8s.io

配置工具包

nerdctl下载地址：https://github.com/containerd/nerdctl

tar zxf nerdctl-0.12.1-linux-amd64.tar.gz

tar zxf cni-plugins-linux-amd64-v0.9.1.tgz

cp nerdctl /bin/

sed -i '1a source <(nerdctl completion bash)' /etc/profile

source /etc/profile

设置开机自动加载以下模块

cat > /etc/modules-load.d/containerd.conf <

overlay

br_netfilter

EOF

cat < /etc/sysctl.d/k8s.conf

net.bridge.bridge-nf-call-ip6tables = 1

net.bridge.bridge-nf-call-iptables = 1

net.ipv4.ip_forward = 1

EOF

使模块生效：

modprobe overlay

modprobe br_netfilter

sysctl -p /etc/sysctl.d/k8s.conf

安装目前最新版本的k8s（1.24）

yum -y install kubelet kubeadm kubectl --disableexcludes=kubernetes

设置开机自启

systemctl restart kubelet ; systemctl enable kubelet

master集群初始化

kubeadm init --image-repository registry.aliyuncs.com/google_containers --kubernetes-version=v1.24.0 --pod-network-cidr=10.244.0.0/16

mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config

node加入集群

kubeadm join 192.168.26.40:6443 --token 0dveup.32lk0cu3s5ruzeka --discovery-token-ca-cert-hash sha256:021c35ab30ac0e03be2797ae7071caaf8f5a94f6b90d715c1970002975fae0b6

安装calico网络插件

将镜像导入所有节点

nerdctl load -i calico-3.19-img.tar

kubectl apply -f calico.yaml

master设置tab

yum -y install bash-* #设置kubectl与kubeadm命令补全，下次login生效 kubectl completion bash > /etc/bash_completion.d/kubectl

kubeadm completion bash > /etc/bash_completion.d/kubeadm

bash

集群部署完成