Skip to content

Commit 75617dd

Browse files
ErikJiangErikJiang
authored
Merge pull request #845 from tu1h/doc_nonroot_sudo
doc: install with non-root user
2 parents 560c0b4 + c1b7cf0 commit 75617dd

17 files changed

+354
-17
lines changed

‎docs/README.md‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,12 @@
22

33
``` bash
44

5-
# Install the mkdocs utility and related dependencies
6-
$ pip install mkdocs-material
7-
$ pip install mkdocs-glightbox
8-
$ pip install mkdocs-awesome-pages-plugin
9-
105
# Go to the kubean repository directory
116
$ cd kubean/
127

8+
# Install the mkdocs utility and related dependencies
9+
$ pip3 install -r docs/requirements.txt
10+
1311
# Run Chinese documentation locally
1412
$ mkdocs serve -f docs/mkdocs.zh.yml
1513

‎docs/en/usage/all-in-one-install.md‎ renamed to ‎docs/en/usage/all_in_one_install.md‎

File renamed without changes.

‎docs/en/usage/helm-install-kubean.md‎ renamed to ‎docs/en/usage/helm_install_kubean.md‎

File renamed without changes.

‎docs/en/usage/install_without_root.md‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
# 以非 root 用户部署集群
2+
3+
## 内容
4+
5+
- ✓ [1. sudo 权限校验](#sudo权限校验)
6+
- ✓ [2. 创建主机清单配置](#创建主机清单配置)
7+
- ✓ [3. 制备部署集群的配置参数](#制备部署集群的配置参数)
8+
- ✓ [4. 准备 Kubean 的自定义资源](#准备Kubean的自定义资源)
9+
- ✓ [5. 开始部署集群](#开始部署集群)
10+
11+
## sudo 权限校验
12+
13+
安装过程中涉及系统特权操作，故用户需要具备 sudo 权限，可进行如下检查：
14+
15+
1. 使用非 root 用户登录到目标节点
16+
17+
2. 检查是否存在 sudo 命令，不存在则通过系统包管理器进行安装
18+
19+
`which sudo`
20+
21+
3. 在终端执行 `echo | sudo -S -v`
22+
23+
若结果输出 `xxx is not in the sudoers file. This incident will be reported` 或 `User xxx do not have sudo privilege` 等类似信息，即说明当前用户不具备 sudo 权限，反之说明当前用户具有 sudo 权限。
24+
25+
## 配置主机清单
26+
27+
示例：主机清单 `HostsConfCM.yml` 内容大致如下，将下方<USERNAME> 和 <PASSWORD> 替换为实际的用户名和密码：
28+
29+
```yaml
30+
apiVersion: v1
31+
kind: ConfigMap
32+
metadata:
33+
name: sample-hosts-conf
34+
namespace: kubean-system
35+
data:
36+
hosts.yml: |
37+
all:
38+
hosts:
39+
master:
40+
ip: 192.168.10.11
41+
access_ip: 192.168.10.11
42+
ansible_host: 192.168.10.11
43+
ansible_connection: ssh
44+
ansible_user: <USERNAME>
45+
ansible_password: <PASSWORD>
46+
ansible_become_password: <PASSWORD>
47+
worker:
48+
ip: 192.168.10.12
49+
access_ip: 192.168.10.12
50+
ansible_host: 192.168.10.12
51+
ansible_connection: ssh
52+
ansible_user: <USERNAME>
53+
ansible_password: <PASSWORD>
54+
ansible_become_password: <PASSWORD>
55+
children:
56+
kube_control_plane:
57+
hosts:
58+
master:
59+
kube_node:
60+
hosts:
61+
master:
62+
worker:
63+
etcd:
64+
hosts:
65+
master:
66+
k8s_cluster:
67+
children:
68+
kube_control_plane:
69+
kube_node:
70+
calico_rr:
71+
hosts: {}
72+
```
73+
> 注：如果在 /etc/sudoers 文件内该用户配置为 NOPASSWD（即无密码提权），可将 `ansible_become_password` 所在行注释
74+
75+
## 制备部署集群的配置参数
76+
77+
集群配置参数 `VarsConfCM.yml `的内容，可以参考
78+
[demo vars conf](https://github.com/kubean-io/kubean/blob/main/examples/install/2.mirror/VarsConfCM.yml)。
79+
80+
```yaml
81+
# VarsConfCM.yml
82+
apiVersion: v1
83+
kind: ConfigMap
84+
metadata:
85+
name: sample-vars-conf
86+
namespace: kubean-system
87+
data:
88+
group_vars.yml: |
89+
container_manager: containerd
90+
kube_network_plugin: calico
91+
kube_network_plugin_multus: false
92+
kube_proxy_mode: iptables
93+
enable_nodelocaldns: false
94+
etcd_deployment_type: kubeadm
95+
ntp_enabled: true
96+
...
97+
```
98+
99+
## 准备 Kubean 的自定义资源
100+
101+
- Cluster 自定义资源内容示例
102+
103+
```yaml
104+
# Cluster.yml
105+
apiVersion: kubean.io/v1alpha1
106+
kind: Cluster
107+
metadata:
108+
name: sample
109+
spec:
110+
hostsConfRef:
111+
namespace: kubean-system
112+
name: sample-hosts-conf
113+
varsConfRef:
114+
namespace: kubean-system
115+
name: sample-vars-conf
116+
sshAuthRef: # 关键属性，指定集群部署期间的 ssh 私钥 secret
117+
namespace: kubean-system
118+
name: sample-ssh-auth
119+
```
120+
121+
- ClusterOperation 自定义资源内容示例
122+
123+
```yaml
124+
# ClusterOperation.yml
125+
apiVersion: kubean.io/v1alpha1
126+
kind: ClusterOperation
127+
metadata:
128+
name: sample-create-cluster
129+
spec:
130+
cluster: sample
131+
image: ghcr.m.daocloud.io/kubean-io/spray-job:latest
132+
backoffLimit: 0
133+
actionType: playbook
134+
action: cluster.yml
135+
preHook:
136+
- actionType: playbook
137+
action: ping.yml
138+
- actionType: playbook
139+
action: disable-firewalld.yml
140+
postHook:
141+
- actionType: playbook
142+
action: kubeconfig.yml
143+
- actionType: playbook
144+
action: cluster-info.yml
145+
```
146+
147+
## 开始部署集群
148+
149+
假设所有 YAML 清单都存放在 `create_cluster` 目录：
150+
151+
```bash
152+
$ tree create_cluster/
153+
create_cluster
154+
├── HostsConfCM.yml # 主机清单
155+
├── SSHAuthSec.yml # SSH私钥
156+
├── VarsConfCM.yml # 集群参数
157+
├── Cluster.yml # Cluster CR
158+
└── ClusterOperation.yml # ClusterOperation CR
159+
```
160+
161+
通过 `kubectl apply` 开始部署集群:
162+
163+
```bash
164+
kubectl apply -f create_cluster/
165+
```

‎docs/en/usage/mirror-install.md‎ renamed to ‎docs/en/usage/mirror_install.md‎

File renamed without changes.

‎docs/en/usage/scale-worknode.md‎ renamed to ‎docs/en/usage/scale_worknode.md‎

File renamed without changes.

‎docs/en/usage/sshkey_deploy_cluster.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ data:
8080

8181
## Create a host configuration file
8282

83-
The `HostsConfCM.yml` file looks like:
83+
Replace the below <USERNAME> with the actual username, the `HostsConfCM.yml` file looks like:
8484

8585
```yaml
8686
# HostsConfCM.yml
@@ -97,10 +97,12 @@ data:
9797
ip: 192.168.10.11
9898
access_ip: 192.168.10.11
9999
ansible_host: 192.168.10.11
100+
ansible_user: <USRENAME>
100101
worker:
101102
ip: 192.168.10.12
102103
access_ip: 192.168.10.12
103104
ansible_host: 192.168.10.12
105+
ansible_user: <USRENAME>
104106
children:
105107
kube_control_plane:
106108
hosts:
@@ -120,7 +122,7 @@ data:
120122
hosts: {}
121123
```
122124

123-
> Note: It is not necessary to include the account and password (`ansible_user` and `ansible_password`) when logging in with a private key.
125+
> Note: It is not necessary to include the password (`ansible_password`) when logging in with a private key.
124126

125127
## Provision parameters for cluster deployment
126128

‎docs/mkdocs.en.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ theme:
4545
nav:
4646
- Introduction: index.md
4747
- Quick Start:
48-
- usage/helm-install-kubean.md
49-
- usage/all-in-one-install.md
50-
- usage/mirror-install.md
48+
- usage/helm_install_kubean.md
49+
- usage/all_in_one_install.md
50+
- usage/mirror_install.md
5151
- Functional Framework:
5252
- concepts/architecture.md
5353
- concepts/comparisons.md
@@ -56,7 +56,8 @@ nav:
5656
- concepts/theory_of_airgapped_package.md
5757
- User Guide:
5858
- usage/sshkey_deploy_cluster.md
59-
- usage/scale-worknode.md
59+
- usage/install_without_root.md
60+
- usage/scale_worknode.md
6061
- usage/upgrade.md
6162
- usage/uninstall.md
6263
- usage/airgap.md

‎docs/mkdocs.zh.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ theme:
4545
nav:
4646
- 简介: index.md
4747
- 快速入门:
48-
- usage/helm-install-kubean.md
49-
- usage/all-in-one-install.md
50-
- usage/mirror-install.md
48+
- usage/helm_install_kubean.md
49+
- usage/all_in_one_install.md
50+
- usage/mirror_install.md
5151
- 功能架构:
5252
- concepts/architecture.md
5353
- concepts/comparisons.md
@@ -56,7 +56,8 @@ nav:
5656
- concepts/theory_of_airgapped_package.md
5757
- 用户指南:
5858
- usage/sshkey_deploy_cluster.md
59-
- usage/scale-worknode.md
59+
- usage/install_without_root.md
60+
- usage/scale_worknode.md
6061
- usage/upgrade.md
6162
- usage/uninstall.md
6263
- usage/airgap.md

‎docs/requirements.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
mkdocs-material==9.1.17
2+
mkdocs-glightbox==0.3.4
3+
mkdocs-awesome-pages-plugin==2.9.1

0 commit comments

Comments
 (0)