kubernetes(k8s)集群安装calico

添加hosts解析

cat /etc/hosts

10.39.7.51 k8s-master-51

10.39.7.57 k8s-master-57

10.39.7.52 k8s-master-52

下载calico

wget http://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/hosted/calico.yaml

下载所需镜像

# 建议下载后 推到自己的镜像仓库

[root@k8s-master-51 ~]# cat calico.yaml |grep image

image: quay.io/calico/node:v3.2.4

image: quay.io/calico/cni:v3.2.4

image: quay.io/calico/kube-controllers:v3.2.4

配置etcd的ip

etcd_endpoints: "https://10.39.7.51:2379,https://10.39.7.52:2379,https://10.39.7.57:2379"

根据注释添加相关值

 # If you're using TLS enabled etcd uncomment the following.

  # You must also populate the Secret below with these files.

  etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"

  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"

  etcd_key: "/calico-secrets/etcd-key # "/calico-secrets/etcd-key"

因使用青云关系需调整mtu值

veth_mtu: "1340"

将etcd 和ca 证书用base64加密添加到calico.yaml 的相关位置

apiVersion: v1

kind: Secret

type: Opaque

metadata:

  name: calico-etcd-secrets

  namespace: kube-system

data:

  etcd-key: (cat /etc/kubernetes/ssl/etcd-key.pem | base64 | tr -d '\n')

  etcd-cert: (cat /etc/kubernetes/ssl/etcd.pem | base64 | tr -d '\n')

  etcd-ca: (cat /etc/kubernetes/ssl/ca.pem | base64 | tr -d '\n')

修改calico.yaml中的CALICO_IPV4POOL_CIDR 下的value值

- name: CALICO_IPV4POOL_CIDR

    value: "10.253.0.0/18"

安装calico

kubectl apply -f calico.yaml

修改kubelet.service 配置网络插件

cat > /etc/systemd/system/kubelet.service <<EOF

[Unit]

Description=Kubernetes Kubelet

Documentation=https://github.com/GoogleCloudPlatform/kubernetes

After=docker.service

Requires=docker.service

[Service]

WorkingDirectory=/var/lib/kubelet

ExecStart=/usr/local/bin/kubelet \

  --hostname-override=k8s-master-51 \

  --pod-infra-container-image=reg.enncloud.cn/enncloud/pause-amd64:3.1 \

  --pod-manifest-path=/etc/kubernetes/manifests  \

  --bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig \

  --kubeconfig=/etc/kubernetes/kubelet.config \

  --config=/etc/kubernetes/kubelet.config.json \

  --cert-dir=/etc/kubernetes/pki \

  --allow-privileged=true \

  --kube-reserved cpu=500m,memory=512m \

  --image-gc-high-threshold=85  --image-gc-low-threshold=70 \

  --logtostderr=true \

  --network-plugin=cni \

  --runtime-cgroups=/systemd/system.slice \

  --kubelet-cgroups=/systemd/system.slice \

  --v=2

[Install]

WantedBy=multi-user.target

EOF

# 重启kubelet

systemctl daemon-reload

systemctl restart kubelet

报错记录

calico 相关的pod无法创建 日志如下

[root@k8s-master-51 ~]# docker ps -a

CONTAINER ID        IMAGE                                                                                                                 COMMAND                  CREATED              STATUS                      PORTS               NAMES

0dabd1835d53        65733b9f36a6                                                                                                          "/usr/bin/kube-con..."   About a minute ago   Exited (1) 53 seconds ago                       k8s_calico-kube-controllers_calico-kube-controllers-5cf99599ff-hsdqw_kube-system_9175cc10-fdd2-11e8-9144-525463f5581b_13

d434d4ed5e47        e537e5882f91                                                                                                          "start_runit"            About a minute ago   Exited (1) 55 seconds ago

[root@k8s-master-51 ~]# docker logs 0dabd1835d53

#注意：Kubeconfig 字段为空无法连接etcd

2018-12-12 06:39:47.068 [INFO][1] main.go 73: Loaded configuration from environment config=&config.Config{LogLevel:"info", ReconcilerPeriod:"5m", CompactionPeriod:"10m", EnabledControllers:"policy,profile,workloadendpoint,node", WorkloadEndpointWorkers:1, ProfileWorkers:1, PolicyWorkers:1, NodeWorkers:1, Kubeconfig:"", HealthEnabled:true}

2018-12-12 06:39:57.069 [FATAL][1] main.go 85: Failed to start error=failed to build Calico client: context deadline exceeded

[root@k8s-master-51 ~]# docker logs d434d4ed5e47

2018-12-12 06:39:44.948 [INFO][8] startup.go 252: Early log level set to info

2018-12-12 06:39:44.949 [INFO][8] startup.go 272: Using HOSTNAME environment (lowercase) for node name

2018-12-12 06:39:44.949 [INFO][8] startup.go 280: Determined node name: k8s-master-51

Calico node failed to start

ERROR: Error accessing the Calico datastore: context deadline exceeded

# 解决办法：

修改前：

 # If you're using TLS enabled etcd uncomment the following.

  # You must also populate the Secret below with these files.

  etcd_ca: ""   # "/calico-secrets/etcd-ca"

  etcd_cert: "" # "/calico-secrets/etcd-cert"

  etcd_key: ""  # "/calico-secrets/etcd-key"

修改后：

    etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"

  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"

  etcd_key: "/calico-secrets/etcd-key"  # "/calico-secrets/etcd-key"

报错记录

[root@k8s-master-51 manifests]# kubectl get po -nkube-system

NAME                                       READY     STATUS    RESTARTS   AGE

calico-kube-controllers-5cf99599ff-zbmn2   0/1       Running   0          1m

[root@k8s-master-51 manifests]# kubectl logs calico-kube-controllers-5cf99599ff-zbmn2 -nkube-system

E1212 10:18:20.617128       1 reflector.go:205] github.com/projectcalico/kube-controllers/pkg/controllers/networkpolicy/policy_controller.go:147: Failed to list *v1.NetworkPolicy: Get https://10.254.0.1:443/apis/networking.k8s.io/v1/networkpolicies?limit=500&resourceVersion=0: dial tcp 10.254.0.1:443: i/o timeout

E1212 10:18:20.657457       1 reflector.go:205] github.com/projectcalico/kube-controllers/pkg/controllers/pod/pod_controller.go:206: Failed to list *v1.Pod: Get https://10.254.0.1:443/api/v1/pods?limit=500&resourceVersion=0: dial tcp 10.254.0.1:443: i/o timeout

2018-12-12 11:01:12.737 [ERROR][1] main.go 188: Failed to reach apiserver error=<nil>

[root@k8s-master-51 manifests]# kubectl describe po calico-kube-controllers-5cf99599ff-zbmn2 -nkube-system

Events:

  Type     Reason     Age                From                    Message

  ----     ------     ----               ----                    -------

  Normal   Scheduled  5m                 default-scheduler       Successfully assigned kube-system/calico-kube-controllers-5cf99599ff-zbmn2 to k8s-master-57

  Normal   Pulling    5m                 kubelet, k8s-master-57  pulling image "quay.io/calico/kube-controllers:v3.2.4"

  Normal   Pulled     5m                 kubelet, k8s-master-57  Successfully pulled image "quay.io/calico/kube-controllers:v3.2.4"

  Normal   Created    5m                 kubelet, k8s-master-57  Created container

  Normal   Started    5m                 kubelet, k8s-master-57  Started container

  Warning  Unhealthy  4m (x3 over 4m)    kubelet, k8s-master-57  Readiness probe failed: initialized to false

  Warning  Unhealthy  28s (x25 over 4m)  kubelet, k8s-master-57  Readiness probe failed: Error reaching apiserver: <nil> with http status code: 0

#### fuck  我在51上执行的命令 才发现 calico-controller 一直跑在57上

### google 有提到cpu的问题  经查看 果不其然啊。。。。。。。

top - 18:28:42 up  1:29,  1 user,  load average: 2.17, 2.15, 1.33

Tasks: 108 total,   1 running, 107 sleeping,   0 stopped,   0 zombie

%Cpu(s): 96.3 us,  3.0 sy,  0.0 ni,  0.5 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st

KiB Mem :  1882600 total,   206224 free,   662924 used,  1013452 buff/cache

KiB Swap:  1048572 total,  1048572 free,        0 used.  1025652 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND

31230 root      20   0   37076  16788   9372 S 187.7  0.9  20:31.36 kube-controller 

#### 可能是没装kube-proxy   这之间的联系 还没有搞清楚

安装完kube-proxy之后 calico-controller 起来了

[root@k8s-master-51 ~]# kubectl get po -nkube-system

NAME                                       READY     STATUS             RESTARTS   AGE

calico-kube-controllers-5cf99599ff-cbs5l   1/1       Running            0          21h

calico.yaml

# Calico Version v3.2.4

# https://docs.projectcalico.org/v3.2/releases#v3.2.4

# This manifest includes the following component versions:

#   calico/node:v3.2.4

#   calico/cni:v3.2.4

#   calico/kube-controllers:v3.2.4

# This ConfigMap is used to configure a self-hosted Calico installation.

kind: ConfigMap

apiVersion: v1

metadata:

  name: calico-config

  namespace: kube-system

data:

  # Configure this with the location of your etcd cluster.

  etcd_endpoints: "https://10.39.7.51:2379,https://10.39.7.52:2379,https://10.39.7.57:2379"

  # If you're using TLS enabled etcd uncomment the following.

  # You must also populate the Secret below with these files.

  etcd_ca: "/calico-secrets/etcd-ca"   # "/calico-secrets/etcd-ca"

  etcd_cert: "/calico-secrets/etcd-cert" # "/calico-secrets/etcd-cert"

  etcd_key: "/calico-secrets/etcd-key"  # "/calico-secrets/etcd-key"

  # Configure the Calico backend to use.

  calico_backend: "bird"

  # Configure the MTU to use

  veth_mtu: "1340"

  # The CNI network configuration to install on each node.  The special

  # values in this config will be automatically populated.

  cni_network_config: |-

    {

      "name": "k8s-pod-network",

      "cniVersion": "0.3.0",

      "plugins": [

        {

          "type": "calico",

          "log_level": "info",

          "etcd_endpoints": "__ETCD_ENDPOINTS__",

          "etcd_key_file": "__ETCD_KEY_FILE__",

          "etcd_cert_file": "__ETCD_CERT_FILE__",

          "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",

          "mtu": __CNI_MTU__,

          "ipam": {

              "type": "calico-ipam"

          },

          "policy": {

              "type": "k8s"

          },

          "kubernetes": {

              "kubeconfig": "__KUBECONFIG_FILEPATH__"

          }

        },

        {

          "type": "portmap",

          "snat": true,

          "capabilities": {"portMappings": true}

        }

      ]

    }

---

# The following contains k8s Secrets for use with a TLS enabled etcd cluster.

# For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/

apiVersion: v1

kind: Secret

type: Opaque

metadata:

  name: calico-etcd-secrets

  namespace: kube-system

data:

  # Populate the following files with etcd TLS configuration if desired, but leave blank if

  # not using TLS for etcd.

  # This self-hosted install expects three files with the following names.  The values

  # should be base64 encoded strings of the entire contents of each file.

  etcd-key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdzhzK0lMUVV5N293d3l4YlBsVTd5NWw1VDhyMXIzUjhqVDhWcFErcFRSbUUxdkwwCmRLZDV0NWszcDRsZGxhcmxLVlh0N3Fob1FQZVdEUVU3dUdQU0lFazZ4REE1VGU3YjJEbFJoa1dUUE1VZWtOTTUKTld2THNrNi83V0lGT1RZNERLUW4rREhGVENHZk9oMFpkOU15RVJ6YmhpbGpXOXRQWWI1anZnQSs1OExob25IbQpzRHJvS0t1aVQ3c0o4cVduOExZL0l0YlNJdWYrUkhPVFZEZ2NyY3NUYnJGakZuWXhWUEU5Q3lyYmdSc1ZXYnd2Ck9oQ3I2YXNVaTVOeXhscFd5SGYveERVS2dTQnlOMVV1bVBTMnNacXdmbFc2NGRrc3BLTUIxSjczeStNSFpLejAKcm9vMG1lUDZ5R1l4MDlLVGt6bmFoNGlYc09GcEN2RThqS0lKTXdJREFRQUJBb0lCQUJQd1ZLbGI3V281MGRGdQphUFJXRmJyTUxGQjE2TU12WjZleXJ1K2FRckY1VWMvWitnOFBKeFFOWkYrSlc2QnNRTjRPeENZenZEb3hmSFJpCi9ndnZEbXovU0I3R2ttOWZUY0FkUmpJWVQ4QTJpc0JRNGxpUVc3UVMxUFRGc0taODRRUllpMEY1UUJCYXRDNWsKM0QwWm90V2ZUTFBDN3oxaGZob0VHNEF6NGpRVHRPNW5QT3d6dWczZERRYTF3eVFnUHB4OUpwb0lhc0piU1dWcQowZ0ZOWXk4TjR6N1dwS2tPZWQ2MWhPb0VGMDdaRlVoL3FTbDlRdFRUaWVhb29WUHA2OVpIOUtzM2FlWG8wRnhTCjJzZkpXb0w2TjdYcG1JcEtId2tWMEZodld6TlRPZURKbllkTUt2NkJZVTVmUFVpOWJ1Ukk2V1RiZWpydEQyM3cKakpHbEQ3RUNnWUVBNU95VVB4MWVrNjRScVd1UHpVeHQ2clgzSC9SeUl1VDR0WGVubFpONk9LMThNYWJkOW4xSgpDZ2R6eWtKc3BWdHc4UjhnSk9VUVRxN1pGTkRyQjJRakJEMytVWi9KUW5IamtqWWdvRHRxeHY0dVpJc3FSTVNECldaRE8rUnc1WjBadU1lMGhiZzVBM3NScGJ0TWNJaUlRY2RLd3F2WHNOZE1DL1Njczd4em5DN2NDZ1lFQTJ2T0oKNkRDUUpEMlI5YTJycWlCekF4YmFVR01pY3RaS1IxQzlTTE1JY0liNnlrY1o4ZkVNZzR2T2VYbnE0c3hHb3VjSApyM1RtSFhuS0pXT1F0d0VmZVRLazFhNjhjWXplNDFZbzJsMnY1aXpwbjZSQmljSVlVeEhORXlUaVVXOVlqbTJECncvYXVEVHd2d1plRm14Wmh0dVhuWjZnaHY4QklxSy9VeHQ2czVtVUNnWUFtbVNVZHh5dnRKb3BmMEh6OGxvaHAKN0tod1FOMEZ1U21lSDBDb1hhZGI2eFJub3NVR0RIWEdOUjkyMk9CTXVUQS8xNG1wN3QxakJ1UWZPR0tJYW4vawo5VGJ1T0V6TTRUc0hxZ3l5TjVKM1h1QWZuNzlPdlB1UW5IUHBXTEx0RU5qL25nWG04b3hKZzBCcnFUaXpJSjg1Ck1kY0wzRThwZkJ5aTVub1REd0o5M1FLQmdRQzJWUGtURXQzMlVBK3N0K09zMlRqdDZhb0VKNG9ZZDd1RGlBa1kKOFg2bHRzSkNrTk5hVjVKRU9iaklFRzg2VDBMRGhnRXdhL2oxc3VaVUhJWDI0RWlGZFZjdlcwUXlpMDFSby82QgpXbU9SR3ZXeXErYW9BYXFnQXNMMG5sS1ozayt3ekNKZW5wNXpCeHY5NjJDbnRndkpjOHN3MXlMRHZDekZ6U2MwCk5WdG13UUtCZ0duUjJJalNIWUZUT0QwS0RNQXF4Wm4xelZjenZRL21oV3I3Y0FFeFZYZUFkU3hNWG9QZTh5V2wKcmQxRFExdzg1UmhGK0IyRlgrcFFxNlgzbUFobmRqTktEdUUvdlhwS3B5MDA2UEdqL3B1dVRKSVhoRzlncTUxbwpHdHZPblBtZmhpYlhZbXJ5ZU5mdUF4MmJuWnBqbmhzUjI5dm4zSzhuQTcwYm13ZVVTVlhCCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

  etcd-cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ5akNDQXQ2Z0F3SUJBZ0lVYUFkc2FYYStsZFZDem83dUM1SE9wNS9zOHU4d0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbAphVXBwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEU0TVRFeE9UQTJOREl3TUZvWERUSTRNVEV4TmpBMk5ESXdNRm93WHpFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbGFXcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUTB3Q3dZRFZRUURFd1JsZEdOa01JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXc4cytJTFFVeTdvd3d5eGJQbFU3eTVsNVQ4cjEKcjNSOGpUOFZwUStwVFJtRTF2TDBkS2Q1dDVrM3A0bGRsYXJsS1ZYdDdxaG9RUGVXRFFVN3VHUFNJRWs2eERBNQpUZTdiMkRsUmhrV1RQTVVla05NNU5XdkxzazYvN1dJRk9UWTRES1FuK0RIRlRDR2ZPaDBaZDlNeUVSemJoaWxqClc5dFBZYjVqdmdBKzU4TGhvbkhtc0Ryb0tLdWlUN3NKOHFXbjhMWS9JdGJTSXVmK1JIT1RWRGdjcmNzVGJyRmoKRm5ZeFZQRTlDeXJiZ1JzVldid3ZPaENyNmFzVWk1Tnl4bHBXeUhmL3hEVUtnU0J5TjFVdW1QUzJzWnF3ZmxXNgo0ZGtzcEtNQjFKNzN5K01IWkt6MHJvbzBtZVA2eUdZeDA5S1Rrem5haDRpWHNPRnBDdkU4aktJSk13SURBUUFCCm80R2pNSUdnTUE0R0ExVWREd0VCL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUIKQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZEJnTlZIUTRFRmdRVXdlY2NsNzMvcS95ZDl6cmRQRWFOSCt2eQpTcjR3SHdZRFZSMGpCQmd3Rm9BVTB3RHQ2N3p1S1grYU8wTldCd0g1N29qdVIzOHdJUVlEVlIwUkJCb3dHSWNFCmZ3QUFBWWNFQ2ljSE00Y0VDaWNITkljRUNpY0hPVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBRXh1SndZRUEKdm9ZYzU0eHEzL3ZkMmtRMWdRUUpPSFhzM0tDNjFZMTNjNFBwTndWR3VQR0xzVlBwY1hVM2lFdTJTZUp5YWVpQQo4UFFKOVNuS0ZNcGY3QjBqSktKRjNQVGJDeE5taHZ2bGpsMVA3WmxYSS8zTmZGTE40d01Cenl5MFBWVmRlQm9oCjdlMXhpUnIra081SGE0bEVEUCtDeW4zWmxpN3dSeFY5ZUNYTDZGeDBuU2x4N0x2dXZiUVo1M1NEUGc4UjQramMKSHZPT0NVbXpOU3RpNXRhcTNTSFNOMWtFVUR6eFFDTGR2MTUxbVNzdU1pMi9GQkFORGRvbHlwZW9XZEswTWJBagpYZFFBSWEzdk5FY2pKVzVxZW9CRFR2TkQxSFV1RzhJbzB0K0twbjBSTS9oelc4R3FJNXFLVGQyRXJCNUlLRW0zCnU0cThMeGxod3MyL2tRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

  etcd-ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lVSUFQN1FDd0VTZGlzL2oxVi9YNmUzd0pxNFZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbAphVXBwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEU0TVRFd09EQTFORGN3TUZvWERUSXpNVEV3TnpBMU5EY3dNRm93WlRFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbGFVcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByZFdKbGNtNWxkR1Z6Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeGFiQnl1VGlTaHB5ejR0dHNhdGIKemo1dkhPZ2RhU3hKVExOeGVBOHNBM2RtRnJzN0xScjhTdzBGQkhPQ0taKzZCcVFKb2dPWXVGYXBtWHkxWmNXMgptUW92bnNydDVhSEZGTmNmbndVZGhEa1Q0MG9ZeldTeXRrVnNWTEFPSEZwekVQV1h3TGJvNnI0YndSWkJtRWlNClJBb0JJeFY4dS9PNEV5L1hEM0pRN2wrZEpnSFJZMGlnZzZQeUF0TnJseGdQVDF1VUlhdHRDQUxHK3pDVWJ5ZXYKaW4xYWlqdmZDZVJ3NmtiemZyNisxY3VvbGRTY1lOYnZTK0NJbHBuY0NPdlpURlJxT3BxTU1lOUJ5N0QwcHA1RQpISit6cDV6Qys0YStrbTdnUWVNTHNvT1dnb3RpRU45clNNVFhacDdjZEhJeUVyaEg0WmFDZHk5UDB3Qy9ibEtLCk1RSURBUUFCbzJZd1pEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWQKQmdOVkhRNEVGZ1FVMHdEdDY3enVLWCthTzBOV0J3SDU3b2p1UjM4d0h3WURWUjBqQkJnd0ZvQVUwd0R0Njd6dQpLWCthTzBOV0J3SDU3b2p1UjM4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFHRU5lYkZnd2F1eFgrbnBNREwyClloUEFyN0lnd2RvQlh0UUlVUTkvRnRQQWR5Y0pKY3pyOFpOZTE3SUM0TUNBanJleFBjckx4WDA2d1NXQVNnWVYKWktwTU8zeEdDY0FiekhuaHNWaFZoekVjeEVGU1lGZk5ZNkR3OGgyV0d0a2pvRGgwNGRaZ1BSU3RwY1Q0UlFiUgo1WW1vOWl3eWRwVVkxNFd2di9OaDVadHcrU1NKdlRGazVDekljUVZmTEdyZENyRWp3ZVptQjdpdFo5eW82UW1rClRQdHVoNW9HMnUrcUg4L1BBeVgyR1lXQmlScEZHNmdWSmp4UERjZVlBRmU2QVNmb0MzREdMOGFqaVcwRFlhTlUKWTZZdU81QWNIc1lCd0JTU3VJNDZnMzR3K0JtdnBHbzRpTENESW51Qi9lKzlsNmdRbU1nNVMvOTlMOVc1VzlKMQpwbzg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K

---

# This manifest installs the calico/node container, as well

# as the Calico CNI plugins and network config on

# each master and worker node in a Kubernetes cluster.

kind: DaemonSet

apiVersion: extensions/v1beta1

metadata:

  name: calico-node

  namespace: kube-system

  labels:

    k8s-app: calico-node

spec:

  selector:

    matchLabels:

      k8s-app: calico-node

  updateStrategy:

    type: RollingUpdate

    rollingUpdate:

      maxUnavailable: 1

  template:

    metadata:

      labels:

        k8s-app: calico-node

      annotations:

        # This, along with the CriticalAddonsOnly toleration below,

        # marks the pod as a critical add-on, ensuring it gets

        # priority scheduling and that its resources are reserved

        # if it ever gets evicted.

        scheduler.alpha.kubernetes.io/critical-pod: ''

    spec:

      nodeSelector:

        beta.kubernetes.io/os: linux

      hostNetwork: true

      tolerations:

        # Make sure calico-node gets scheduled on all nodes.

        - effect: NoSchedule

          operator: Exists

        # Mark the pod as a critical add-on for rescheduling.

        - key: CriticalAddonsOnly

          operator: Exists

        - effect: NoExecute

          operator: Exists

      serviceAccountName: calico-node

      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force

      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.

      terminationGracePeriodSeconds: 0

      containers:

        # Runs calico/node container on each Kubernetes node.  This

        # container programs network policy and routes on each

        # host.

        - name: calico-node

          image: quay.io/calico/node:v3.2.4

          env:

            # The location of the Calico etcd cluster.

            - name: ETCD_ENDPOINTS

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_endpoints

            # Location of the CA certificate for etcd.

            - name: ETCD_CA_CERT_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_ca

            # Location of the client key for etcd.

            - name: ETCD_KEY_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_key

            # Location of the client certificate for etcd.

            - name: ETCD_CERT_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_cert

            # Set noderef for node controller.

            - name: CALICO_K8S_NODE_REF

              valueFrom:

                fieldRef:

                  fieldPath: spec.nodeName

            # Choose the backend to use.

            - name: CALICO_NETWORKING_BACKEND

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: calico_backend

            # Cluster type to identify the deployment type

            - name: CLUSTER_TYPE

              value: "k8s,bgp"

            # Auto-detect the BGP IP address.

            - name: IP

              value: "autodetect"

            # Enable IPIP

            - name: CALICO_IPV4POOL_IPIP

              value: "Always"

            # Set MTU for tunnel device used if ipip is enabled

            - name: FELIX_IPINIPMTU

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: veth_mtu

            # The default IPv4 pool to create on startup if none exists. Pod IPs will be

            # chosen from this range. Changing this value after installation will have

            # no effect. This should fall within `--cluster-cidr`.

            - name: CALICO_IPV4POOL_CIDR

              value: "10.253.0.0/18"

            # Disable file logging so `kubectl logs` works.

            - name: CALICO_DISABLE_FILE_LOGGING

              value: "true"

            # Set Felix endpoint to host default action to ACCEPT.

            - name: FELIX_DEFAULTENDPOINTTOHOSTACTION

              value: "ACCEPT"

            # Disable IPv6 on Kubernetes.

            - name: FELIX_IPV6SUPPORT

              value: "false"

            # Set Felix logging to "info"

            - name: FELIX_LOGSEVERITYSCREEN

              value: "info"

            - name: FELIX_HEALTHENABLED

              value: "true"

          securityContext:

            privileged: true

          resources:

            requests:

              cpu: 250m

          livenessProbe:

            httpGet:

              path: /liveness

              port: 9099

              host: localhost

            periodSeconds: 10

            initialDelaySeconds: 10

            failureThreshold: 6

          readinessProbe:

            exec:

              command:

              - /bin/calico-node

              - -bird-ready

              - -felix-ready

            periodSeconds: 10

          volumeMounts:

            - mountPath: /lib/modules

              name: lib-modules

              readOnly: true

            - mountPath: /var/run/calico

              name: var-run-calico

              readOnly: false

            - mountPath: /var/lib/calico

              name: var-lib-calico

              readOnly: false

            - mountPath: /calico-secrets

              name: etcd-certs

        # This container installs the Calico CNI binaries

        # and CNI network config file on each node.

        - name: install-cni

          image: quay.io/calico/cni:v3.2.4

          command: ["/install-cni.sh"]

          env:

            # Name of the CNI config file to create.

            - name: CNI_CONF_NAME

              value: "10-calico.conflist"

            # The location of the Calico etcd cluster.

            - name: ETCD_ENDPOINTS

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_endpoints

            # The CNI network config to install on each node.

            - name: CNI_NETWORK_CONFIG

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: cni_network_config

            # CNI MTU Config variable

            - name: CNI_MTU

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: veth_mtu

          volumeMounts:

            - mountPath: /host/opt/cni/bin

              name: cni-bin-dir

            - mountPath: /host/etc/cni/net.d

              name: cni-net-dir

            - mountPath: /calico-secrets

              name: etcd-certs

      volumes:

        # Used by calico/node.

        - name: lib-modules

          hostPath:

            path: /lib/modules

        - name: var-run-calico

          hostPath:

            path: /var/run/calico

        - name: var-lib-calico

          hostPath:

            path: /var/lib/calico

        # Used to install CNI.

        - name: cni-bin-dir

          hostPath:

            path: /opt/cni/bin

        - name: cni-net-dir

          hostPath:

            path: /etc/cni/net.d

        # Mount in the etcd TLS secrets with mode 400.

        # See https://kubernetes.io/docs/concepts/configuration/secret/

        - name: etcd-certs

          secret:

            secretName: calico-etcd-secrets

            defaultMode: 0400

---

apiVersion: v1

kind: ServiceAccount

metadata:

  name: calico-node

  namespace: kube-system

---

# This manifest deploys the Calico Kubernetes controllers.

# See https://github.com/projectcalico/kube-controllers

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

  name: calico-kube-controllers

  namespace: kube-system

  labels:

    k8s-app: calico-kube-controllers

  annotations:

    scheduler.alpha.kubernetes.io/critical-pod: ''

spec:

  # The controllers can only have a single active instance.

  replicas: 1

  strategy:

    type: Recreate

  template:

    metadata:

      name: calico-kube-controllers

      namespace: kube-system

      labels:

        k8s-app: calico-kube-controllers

    spec:

      nodeSelector:

        beta.kubernetes.io/os: linux

      # The controllers must run in the host network namespace so that

      # it isn't governed by policy that would prevent it from working.

      hostNetwork: true

      tolerations:

        # Mark the pod as a critical add-on for rescheduling.

        - key: CriticalAddonsOnly

          operator: Exists

        - key: node-role.kubernetes.io/master

          effect: NoSchedule

      serviceAccountName: calico-kube-controllers

      containers:

        - name: calico-kube-controllers

          image: quay.io/calico/kube-controllers:v3.2.4

          env:

            # The location of the Calico etcd cluster.

            - name: ETCD_ENDPOINTS

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_endpoints

            # Location of the CA certificate for etcd.

            - name: ETCD_CA_CERT_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_ca

            # Location of the client key for etcd.

            - name: ETCD_KEY_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_key

            # Location of the client certificate for etcd.

            - name: ETCD_CERT_FILE

              valueFrom:

                configMapKeyRef:

                  name: calico-config

                  key: etcd_cert

            # Choose which controllers to run.

            - name: ENABLED_CONTROLLERS

              value: policy,profile,workloadendpoint,node

          volumeMounts:

            # Mount in the etcd TLS secrets.

            - mountPath: /calico-secrets

              name: etcd-certs

          readinessProbe:

            exec:

              command:

              - /usr/bin/check-status

              - -r

      volumes:

        # Mount in the etcd TLS secrets with mode 400.

        # See https://kubernetes.io/docs/concepts/configuration/secret/

        - name: etcd-certs

          secret:

            secretName: calico-etcd-secrets

            defaultMode: 0400

---

apiVersion: v1

kind: ServiceAccount

metadata:

  name: calico-kube-controllers

  namespace: kube-system

巴特西

kubernetes(k8s)集群安装calico

最新文章

热门文章