K8s折腾日记 -- 搭建HA集群(1.15.1)

cat >> /etc/sysctl.conf << EOF
net.ipv4.ip_forward = 1
EOF

sysctl -p

apt install -y keepalived

# 下面的 state 第一台配置为 MASTER 剩下两台配置为 BACKUP
cat > /etc/keepalived/keepalived.conf << EOF
! Configuration File for keepalived

global_defs {
   router_id LVS_DEVEL
}

vrrp_script check_haproxy {
    script "killall -0 haproxy"
    interval 3
    weight -2
    fall 10
    rise 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 250
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 35f18af7190d51c9f7f78f37300a0cbd
    }
    virtual_ipaddress {
        192.168.137.100
    }
    track_script {
        check_haproxy
    }
}
EOF

service keepalived start
service keepalived status

cat >> /etc/sysctl.conf << EOF
net.ipv4.ip_nonlocal_bind = 1
EOF

sysctl -p

apt install -y haproxy

# 这里配置监听 VIP 192.168.137.100 的 16443 端口，并将请求转发到后端三台master的6443端口
cat > /etc/haproxy/haproxy.cfg << EOF
global
    # to have these messages end up in /var/log/haproxy.log you will
    # need to:
    #
    # 1) configure syslog to accept network log events.  This is done
    #    by adding the '-r' option to the SYSLOGD_OPTIONS in
    #    /etc/sysconfig/syslog
    #
    # 2) configure local2 events to go to the /var/log/haproxy.log
    #   file. A line like the following can be added to
    #   /etc/sysconfig/syslog
    #
    #    local2.*                       /var/log/haproxy.log
    #
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

defaults
    mode                    tcp
    log                     global
    option                  redispatch
    retries                 3


listen https-apiserver
    bind 192.168.137.100:16443
    mode        tcp
    balance     roundrobin
    timeout server 15s
    timeout connect 15s
    server  node-1 192.168.137.101:6443 check port 6443 inter 5000 fall 5
    server  node-2 192.168.137.102:6443 check port 6443 inter 5000 fall 5
    server  node-3 192.168.137.103:6443 check port 6443 inter 5000 fall 5

listen http-apiserver
    bind 192.168.137.100:1080
    mode tcp
    balance roundrobin
    timeout server 15s
    timeout connect 15s

    server  node-1 192.168.137.101:8080 check port 6443 inter 5000 fall 5
    server  node-2 192.168.137.102:8080 check port 6443 inter 5000 fall 5
    server  node-3 192.168.137.103:8080 check port 6443 inter 5000 fall 5

EOF


service haproxy start

service haproxy status

# 确保关闭了swap
swapoff -a

# 假装我有一个域名 cluster.kube.local
cat >> /etc/hosts << EOF
192.168.137.100 cluster.kube.local

192.168.137.101 node-1
192.168.137.102 node-2
192.168.137.103 node-3
192.168.137.104 node-4
192.168.137.105 node-5
192.168.137.106 node-6
EOF

# 启动 HA 集群的 config 文件
# 我准备使用 flannel 网络插件，所以 podSubnet 配置 "10.244.0.0/16"
# 如果是其他网络插件，则这里的 podSubnet 要按要求具体配置
cat > kubeadm-config.yaml << EOF
apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
kubernetesVersion: v1.15.1
apiServer:
  certSANs:
    - "cluster.kube.local"
controlPlaneEndpoint: "cluster.kube.local:16443"
networking:
  podSubnet: "10.244.0.0/16"
EOF

# 使用kubeadm init启动HA集群
sudo kubeadm init --config=kubeadm-config.yaml --upload-certs