以 SSH 密钥方式部署集群

内容

SSH 密钥的生成与分发

  1. 通过 ssh-keygen 命令生成公私钥对，比如：

    1.  $ ssh-keygen -t rsa -b 4096 -C "your_email@example.com" -f $HOME/.ssh/id_rsa
    2.  Generating public/private rsa key pair.
    3.  Created directory '/root/.ssh'.
    4.  Enter passphrase (empty for no passphrase):
    5.  Enter same passphrase again:
    6.  Your identification has been saved in /root/.ssh/id_rsa.
    7.  Your public key has been saved in /root/.ssh/id_rsa.pub.
    8.  The key fingerprint is:
    9.  SHA256:oMqlhL8wLuYycOkUNXyiDso62C+ryNYc9k3LMDltQZs your_email@example.com
    10.  The keys randomart image is:
    11.  +---[RSA 4096]----+
    12.  |   .             |
    13.  |    = ..         |
    14.  |   o +o o        |
    15.  |..o  . E         |
    16.  |+o.oo o S        |
    17.  |o==* = +         |
    18.  |*=O o O .        |
    19.  |@=++ . +         |
    20.  |OBo+.            |
    21.  +----[SHA256]-----+
    23.  $ ls /root/.ssh/id_rsa* -lh
    24.  -rw-------. 1 root root 1.7K Nov 10 03:47 /root/.ssh/id_rsa         # 私钥
    25.  -rw-r--r--. 1 root root  408 Nov 10 03:47 /root/.ssh/id_rsa.pub     # 公钥

  2. 分发公钥到集群的各个节点：

    1.  # 比如指定将公钥分发至 `192.168.10.11` `192.168.10.12` 两个节点
    2.  $ declare -a IPS=(192.168.10.11 192.168.10.12)
    4.  # 遍历节点 IP 分发公钥(/root/.ssh/id_rsa.pub)，假设用户名为: root, 密码为: kubean
    5.  $ for ip in ${IPS[@]}; do sshpass -p "kubean" ssh-copy-id -i /root/.ssh/id_rsa.pub -o StrictHostKeyChecking=no root@$ip; done

使用私钥制作 Secret

通过 kubectl 命令生成私钥的 Secret：

  1. $ kubectl -n kubean-system \                            # 指定命名空间 kubean-system
  2.     create secret generic sample-ssh-auth \             # 指定 secret 名称为 sample-ssh-auth
  3.     --type='kubernetes.io/ssh-auth' \                   # 指定 secret 类型为 kubernetes.io/ssh-auth
  4.     --from-file=ssh-privatekey=/root/.ssh/id_rsa \      # 指定 ssh 私钥文件路径
  5.     --dry-run=client -o yaml > SSHAuthSec.yml           # 指定 secret yaml 文件生成路径

生成的 SSHAuthSec.yml 内容大致如下所示：

  1. # SSHAuthSec.yml
  2. apiVersion: v1
  3. kind: Secret
  4. metadata:
  5.   creationTimestamp: null
  6.   name: sample-ssh-auth
  7.   namespace: kubean-system
  8. type: kubernetes.io/ssh-auth
  9. data:
  10.   ssh-privatekey: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdWVDbC8rSng1b0RT...

创建主机清单配置

示例：主机清单 HostsConfCM.yml 内容大致如下，并将下方 替换为实际的用户名：

  1. # HostsConfCM.yml
  2. apiVersion: v1
  3. kind: ConfigMap
  4. metadata:
  5.   name: sample-hosts-conf
  6.   namespace: kubean-system
  7. data:
  8.   hosts.yml: |
  9.     all:
  10.       hosts:
  11.         master:
  12.           ip: 192.168.10.11
  13.           access_ip: 192.168.10.11
  14.           ansible_host: 192.168.10.11
  15.           ansible_user: <USRENAME>
  16.         worker:
  17.           ip: 192.168.10.12
  18.           access_ip: 192.168.10.12
  19.           ansible_host: 192.168.10.12
  20.           ansible_user: <USRENAME>
  21.       children:
  22.         kube_control_plane:
  23.           hosts:
  24.             master:
  25.         kube_node:
  26.           hosts:
  27.             master:
  28.             worker:
  29.         etcd:
  30.           hosts:
  31.             master:
  32.         k8s_cluster:
  33.           children:
  34.             kube_control_plane:
  35.             kube_node:
  36.         calico_rr:
  37.           hosts: {}

注：由于采用私钥登录，所以主机信息中不需要填写密码（即：ansible_password）

制备部署集群的配置参数

集群配置参数 VarsConfCM.yml的内容，可以参考 demo vars conf。

  1. # VarsConfCM.yml
  2. apiVersion: v1
  3. kind: ConfigMap
  4. metadata:
  5.   name: sample-vars-conf
  6.   namespace: kubean-system
  7. data:
  8.   group_vars.yml: |
  9.     container_manager: containerd
  10.     kube_network_plugin: calico
  11.     kube_network_plugin_multus: false
  12.     kube_proxy_mode: iptables
  13.     enable_nodelocaldns: false
  14.     etcd_deployment_type: kubeadm
  15.     ntp_enabled: true
  16.     ...

准备 Kubean 的自定义资源

  • Cluster 自定义资源内容示例

    1.   # Cluster.yml
    2.   apiVersion: kubean.io/v1alpha1
    3.   kind: Cluster
    4.   metadata:
    5.     name: sample
    6.   spec:
    7.     hostsConfRef:
    8.       namespace: kubean-system
    9.       name: sample-hosts-conf
    10.     varsConfRef:
    11.       namespace: kubean-system
    12.       name: sample-vars-conf
    13.     sshAuthRef: # 关键属性，指定集群部署期间的 ssh 私钥 secret
    14.       namespace: kubean-system
    15.       name: sample-ssh-auth

  • ClusterOperation 自定义资源内容示例

    1.   # ClusterOperation.yml
    2.   apiVersion: kubean.io/v1alpha1
    3.   kind: ClusterOperation
    4.   metadata:
    5.     name: sample-create-cluster
    6.   spec:
    7.     cluster: sample
    8.     image: ghcr.m.daocloud.io/kubean-io/spray-job:latest
    9.     actionType: playbook
    10.     action: cluster.yml
    11.     preHook:
    12.       - actionType: playbook
    13.         action: ping.yml
    14.       - actionType: playbook
    15.         action: disable-firewalld.yml
    16.     postHook:
    17.       - actionType: playbook
    18.         action: kubeconfig.yml
    19.       - actionType: playbook
    20.         action: cluster-info.yml

开始部署集群

假设所有 YAML 清单都存放在 create_cluster 目录：

  1. $ tree create_cluster/
  2. create_cluster
  3. ├── HostsConfCM.yml       # 主机清单
  4. ├── SSHAuthSec.yml        # SSH私钥
  5. ├── VarsConfCM.yml        # 集群参数
  6. ├── Cluster.yml           # Cluster CR
  7. └── ClusterOperation.yml  # ClusterOperation CR

通过 kubectl apply 开始部署集群:

  1. kubectl apply -f create_cluster/