k8s cri-o浅尝

概览：

• cri-o
• 安装cri-o
  • 添加镜像源
  • 开始安装
• 安装kubernetes
  • 优化
    • 关闭SELinux
    • 内核模块
    • 内核优化
  • 开始安装
    • 添加镜像源
    • 安装并启动
  • 启动k8s
    • 初始化k8s
    • 下载cilium
    • 安装cni网络
• 结束
  • 检查

cri-o

Kubernetes的轻量级容器运行时

安装cri-o

添加镜像源

/etc/yum.repo.d/cri-o.repo

[devel_kubic_libcontainers_stable]
name=Stable Releases of Upstream github.com/containers packages (CentOS_7)
type=rpm-md
baseurl=https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_7/
gpgcheck=1
gpgkey=https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_7/repodata/repomd.xml.key
enabled=1


[devel_kubic_libcontainers_stable_cri-o_1.24]
name=devel:kubic:libcontainers:stable:cri-o:1.24 (CentOS_7)
type=rpm-md
baseurl=https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/1.24/CentOS_7/
gpgcheck=1
gpgkey=https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/1.24/CentOS_7/repodata/repomd.xml.key
enabled=1

开始安装

yum install cri-o

安装kubernetes

优化

关闭SELinux

# Set SELinux in permissive mode (effectively disabling it)
setenforce 0
sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

内核模块

cat <<EOF | tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

modprobe overlay
modprobe br_netfilter

内核优化

# sysctl params required by setup, params persist across reboots
cat <<EOF | tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
net.ipv4.conf.all.rp_filter         = 0
EOF

# Apply sysctl params without reboot
sysctl --system

开始安装

添加镜像源

cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
enabled=1
gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

安装并启动

yum install kubelet-1.24.7 kubeadm-1.24.7 kubectl-1.24.7 --disableexcludes=kubernetes

sysctl -p /etc/sysctl.d/k8s.conf

systemctl enable --now crio
systemctl enable --now kubelet

启动k8s

初始化k8s

--skip-phases=addon/kube-proxy,这个根据自己的要求来。我是因为使用cilium替代了k8s的kube-proxy。

kubeadm init --kubernetes-version=v1.24.7 --pod-network-cidr=$CIDR --cri-socket=unix:///var/run/crio/crio.sock --skip-phases=addon/kube-proxy

下载cilium

CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
CLI_ARCH=amd64
if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}

安装cni网络

cilium install --helm-set tunnel=disabled --helm-set bpf.masquerade=true --helm-set bpf.clockProbe=true --helm-set bpf.waitForMount=true --helm-set bpf.preallocateMaps=true --helm-set bpf.tproxy=true --helm-set bpf.hostRouting=false --helm-set autoDirectNodeRoutes=true --helm-set localRedirectPolicy=true --helm-set enableCiliumEndpointSlice=true --helm-set enableK8sEventHandover=true --helm-set enableK8sEndpointSlice=true --helm-set wellKnownIdentities.enabled=true --helm-set sockops.enabled=true --helm-set bandwidthManager=true --helm-set hubble.enabled=false --helm-set installNoConntrackIptablesRules=true --helm-set egressGateway.enabled=true --helm-set endpointRoutes.enabled=false --helm-set kubeProxyReplacement=strict --helm-set loadBalancer.mode=dsr --helm-set nodePort.mode=dsr --helm-set nodePort.directRoutingDevice=eth0 --helm-set devices=eth0 --helm-set k8sServiceHost=10.0.0.3 --helm-set k8sServicePort=6443 --helm-set ipv4NativeRoutingCIDR=172.26.131.117/32

结束

检查

kubectl get pod -A