//设置docker镜像加速
sudo tee /etc/docker/daemon.json > /dev/null <<-'EOF'
{
  "registry-mirrors": [
    "https://docker.m.daocloud.io",
    "https://docker.xuanyuan.me",
    "https://docker.1ms.run",
    "https://mirror.baidubce.com",
    "https://registry-1.docker.io"
  ],
  "dns": ["8.8.8.8", "114.114.114.114"],
  "live-restore": true
}
EOF

sudo systemctl daemon-reload
sudo systemctl restart docker
docker info | grep -A 5 "Registry Mirrors"


//k3s
//安装前：先写 containerd 镜像加速，否则系统镜像拉 docker.io 超时（181 曾因此 62 天系统 pod 全挂）
mkdir -p /etc/rancher/k3s
cat > /etc/rancher/k3s/registries.yaml <<'EOF'
mirrors:
  docker.io:
    endpoint:
      - "https://docker.m.daocloud.io"
  "127.0.0.1:5000":
    endpoint:
      - "http://127.0.0.1:5000"
configs:
  "127.0.0.1:5000":
    tls:
      insecure_skip_verify: true
EOF

//已安装集群补配（无需重装，失败 pod 会自动重建）
//主节点：写 /etc/rancher/k3s/registries.yaml 后 systemctl restart k3s
//从节点：同样写配置后 systemctl restart k3s-agent
//注意：勿用 USTC(docker.mirrors.ustc.edu.cn)/网易(hub-mirror.c.163.com) 等已停服源，
//      181 曾因此 62 天系统 pod 全部拉取失败（换成 daocloud 后 5 分钟内恢复）
主节点：curl -sfL https://get.k3s.io | sh -s - server \
    --data-dir /data/k3s \
    --write-kubeconfig-mode 644 \
    --disable traefik \
    --disable metrics-server \
    --disable local-storage \
    --disable coredns \
    --pause-image m.daocloud.io/rancher/mirrored-pause:3.6
主节点：cat /data/k3s/server/node-token
从节点：cat > /etc/rancher/k3s/config.yaml <<EOF
    server: https://116.204.74.41:6443
    token: K105c70ea9181a9f5e6e41f7f0b60bb1e0edb2bb514b84e9ee1b39c83eafad7d823::server:586b394206559f9fb6249df0ecf0148a
    data-dir: /data/k3s
    EOF

//kubernetes-dashboard 管理界面（dev 用 k3s.redpowerfuture.com，NodePort 32000；181 同法，另配域名）
//安装
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
kubectl -n kubernetes-dashboard delete secret kubernetes-dashboard-csrf
kubectl -n kubernetes-dashboard create secret generic kubernetes-dashboard-csrf --from-literal=csrf=$(openssl rand -hex 32)
kubectl -n kubernetes-dashboard patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort","ports":[{"port":443,"targetPort":8443,"nodePort":32000}]}}'

//admin-user 管理员账号
kubectl create -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
EOF

//永久登录 token（SA secret 永不过期；kubectl create token --duration=0 实际只有 1 小时）
kubectl create -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: admin-user-token
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/service-account.name: admin-user
type: kubernetes.io/service-account-token
EOF

//取回 token
kubectl -n kubernetes-dashboard get secret admin-user-token -o jsonpath='{.data.token}' | base64 -d
