101 lines
3.3 KiB
Plaintext
101 lines
3.3 KiB
Plaintext
//设置docker镜像加速
|
||
sudo tee /etc/docker/daemon.json > /dev/null <<-'EOF'
|
||
{
|
||
"registry-mirrors": [
|
||
"https://docker.m.daocloud.io",
|
||
"https://docker.xuanyuan.me",
|
||
"https://docker.1ms.run",
|
||
"https://mirror.baidubce.com",
|
||
"https://registry-1.docker.io"
|
||
],
|
||
"dns": ["8.8.8.8", "114.114.114.114"],
|
||
"live-restore": true
|
||
}
|
||
EOF
|
||
|
||
sudo systemctl daemon-reload
|
||
sudo systemctl restart docker
|
||
docker info | grep -A 5 "Registry Mirrors"
|
||
|
||
|
||
//k3s
|
||
//安装前：先写 containerd 镜像加速，否则系统镜像拉 docker.io 超时（181 曾因此 62 天系统 pod 全挂）
|
||
mkdir -p /etc/rancher/k3s
|
||
cat > /etc/rancher/k3s/registries.yaml <<'EOF'
|
||
mirrors:
|
||
docker.io:
|
||
endpoint:
|
||
- "https://docker.m.daocloud.io"
|
||
"127.0.0.1:5000":
|
||
endpoint:
|
||
- "http://127.0.0.1:5000"
|
||
configs:
|
||
"127.0.0.1:5000":
|
||
tls:
|
||
insecure_skip_verify: true
|
||
EOF
|
||
|
||
//已安装集群补配（无需重装，失败 pod 会自动重建）
|
||
//主节点：写 /etc/rancher/k3s/registries.yaml 后 systemctl restart k3s
|
||
//从节点：同样写配置后 systemctl restart k3s-agent
|
||
//注意：勿用 USTC(docker.mirrors.ustc.edu.cn)/网易(hub-mirror.c.163.com) 等已停服源，
|
||
// 181 曾因此 62 天系统 pod 全部拉取失败（换成 daocloud 后 5 分钟内恢复）
|
||
主节点：curl -sfL https://get.k3s.io | sh -s - server \
|
||
--data-dir /data/k3s \
|
||
--write-kubeconfig-mode 644 \
|
||
--disable traefik \
|
||
--disable metrics-server \
|
||
--disable local-storage \
|
||
--disable coredns \
|
||
--pause-image m.daocloud.io/rancher/mirrored-pause:3.6
|
||
主节点：cat /data/k3s/server/node-token
|
||
从节点：cat > /etc/rancher/k3s/config.yaml <<EOF
|
||
server: https://116.204.74.41:6443
|
||
token: K105c70ea9181a9f5e6e41f7f0b60bb1e0edb2bb514b84e9ee1b39c83eafad7d823::server:586b394206559f9fb6249df0ecf0148a
|
||
data-dir: /data/k3s
|
||
EOF
|
||
|
||
//kubernetes-dashboard 管理界面（dev 用 k3s.redpowerfuture.com，NodePort 32000；181 同法，另配域名）
|
||
//安装
|
||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
|
||
kubectl -n kubernetes-dashboard delete secret kubernetes-dashboard-csrf
|
||
kubectl -n kubernetes-dashboard create secret generic kubernetes-dashboard-csrf --from-literal=csrf=$(openssl rand -hex 32)
|
||
kubectl -n kubernetes-dashboard patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort","ports":[{"port":443,"targetPort":8443,"nodePort":32000}]}}'
|
||
|
||
//admin-user 管理员账号
|
||
kubectl create -f - <<EOF
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: admin-user
|
||
namespace: kubernetes-dashboard
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRoleBinding
|
||
metadata:
|
||
name: admin-user
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: ClusterRole
|
||
name: cluster-admin
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: admin-user
|
||
namespace: kubernetes-dashboard
|
||
EOF
|
||
|
||
//永久登录 token（SA secret 永不过期；kubectl create token --duration=0 实际只有 1 小时）
|
||
kubectl create -f - <<EOF
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: admin-user-token
|
||
namespace: kubernetes-dashboard
|
||
annotations:
|
||
kubernetes.io/service-account.name: admin-user
|
||
type: kubernetes.io/service-account-token
|
||
EOF
|
||
|
||
//取回 token
|
||
kubectl -n kubernetes-dashboard get secret admin-user-token -o jsonpath='{.data.token}' | base64 -d
|