以非 root 用户部署集群

内容

sudo 权限校验

安装过程中涉及系统特权操作，故用户需要具备 sudo 权限，可进行如下检查：

  1. 使用非 root 用户登录到目标节点

  2. 检查是否存在 sudo 命令，不存在则通过系统包管理器进行安装

    which sudo

  3. 在终端执行 echo | sudo -S -v

    若结果输出 xxx is not in the sudoers file. This incident will be reported 或 User xxx do not have sudo privilege 等类似信息，即说明当前用户不具备 sudo 权限，反之说明当前用户具有 sudo 权限。

配置主机清单

示例：主机清单 HostsConfCM.yml 内容大致如下，将下方 和 替换为实际的用户名和密码：

  1.   apiVersion: v1
  2.   kind: ConfigMap
  3.   metadata:
  4.     name: sample-hosts-conf
  5.     namespace: kubean-system
  6.   data:
  7.     hosts.yml: |
  8.       all:
  9.         hosts:
  10.           master:
  11.             ip: 192.168.10.11
  12.             access_ip: 192.168.10.11
  13.             ansible_host: 192.168.10.11
  14.             ansible_connection: ssh
  15.             ansible_user: <USERNAME>
  16.             ansible_password: <PASSWORD>
  17.             ansible_become_password: <PASSWORD>
  18.           worker:
  19.             ip: 192.168.10.12
  20.             access_ip: 192.168.10.12
  21.             ansible_host: 192.168.10.12
  22.             ansible_connection: ssh
  23.             ansible_user: <USERNAME>
  24.             ansible_password: <PASSWORD>
  25.             ansible_become_password: <PASSWORD>
  26.         children:
  27.           kube_control_plane:
  28.             hosts:
  29.               master:
  30.           kube_node:
  31.             hosts:
  32.               master:
  33.               worker:
  34.           etcd:
  35.             hosts:
  36.               master:
  37.           k8s_cluster:
  38.             children:
  39.               kube_control_plane:
  40.               kube_node:
  41.           calico_rr:
  42.             hosts: {}

注：如果在 /etc/sudoers 文件内该用户配置为 NOPASSWD（即无密码提权），可将 ansible_become_password 所在行注释

制备部署集群的配置参数

集群配置参数 VarsConfCM.yml的内容，可以参考 demo vars conf。

  1. # VarsConfCM.yml
  2. apiVersion: v1
  3. kind: ConfigMap
  4. metadata:
  5.   name: sample-vars-conf
  6.   namespace: kubean-system
  7. data:
  8.   group_vars.yml: |
  9.     container_manager: containerd
  10.     kube_network_plugin: calico
  11.     kube_network_plugin_multus: false
  12.     kube_proxy_mode: iptables
  13.     enable_nodelocaldns: false
  14.     etcd_deployment_type: kubeadm
  15.     ntp_enabled: true
  16.     ...

准备 Kubean 的自定义资源

  • Cluster 自定义资源内容示例

    1.   # Cluster.yml
    2.   apiVersion: kubean.io/v1alpha1
    3.   kind: Cluster
    4.   metadata:
    5.     name: sample
    6.   spec:
    7.     hostsConfRef:
    8.       namespace: kubean-system
    9.       name: sample-hosts-conf
    10.     varsConfRef:
    11.       namespace: kubean-system
    12.       name: sample-vars-conf
    13.     sshAuthRef: # 关键属性，指定集群部署期间的 ssh 私钥 secret
    14.       namespace: kubean-system
    15.       name: sample-ssh-auth

  • ClusterOperation 自定义资源内容示例

    1.   # ClusterOperation.yml
    2.   apiVersion: kubean.io/v1alpha1
    3.   kind: ClusterOperation
    4.   metadata:
    5.     name: sample-create-cluster
    6.   spec:
    7.     cluster: sample
    8.     image: ghcr.m.daocloud.io/kubean-io/spray-job:latest
    9.     actionType: playbook
    10.     action: cluster.yml
    11.     preHook:
    12.       - actionType: playbook
    13.         action: ping.yml
    14.       - actionType: playbook
    15.         action: disable-firewalld.yml
    16.     postHook:
    17.       - actionType: playbook
    18.         action: kubeconfig.yml
    19.       - actionType: playbook
    20.         action: cluster-info.yml

开始部署集群

假设所有 YAML 清单都存放在 create_cluster 目录：

  1. $ tree create_cluster/
  2. create_cluster
  3. ├── HostsConfCM.yml       # 主机清单
  4. ├── SSHAuthSec.yml        # SSH私钥
  5. ├── VarsConfCM.yml        # 集群参数
  6. ├── Cluster.yml           # Cluster CR
  7. └── ClusterOperation.yml  # ClusterOperation CR

通过 kubectl apply 开始部署集群:

  1. kubectl apply -f create_cluster/