|
| 1 | +# :key: 使用 SSH 秘钥方式部署 K8S 集群 |
| 2 | + |
| 3 | +## 内容 |
| 4 | + |
| 5 | +* ✓ [1. SSH 秘钥的生成与分发](#SSH秘钥的生成与分发) |
| 6 | +* ✓ [2. 使用私钥制作 Secret](#使用私钥制作Secret) |
| 7 | +* ✓ [3. 创建主机清单配置](#创建主机清单配置) |
| 8 | +* ✓ [3. 制备部署集群的配置参数](#制备部署集群的配置参数) |
| 9 | +* ✓ [4. 准备 KuBean 的自定义资源](#准备KuBean的自定义资源) |
| 10 | +* ✓ [5. 开始部署集群](#开始部署集群) |
| 11 | + |
| 12 | +## SSH秘钥的生成与分发 |
| 13 | + |
| 14 | +1. 通过 `ssh-keygen` 命令生成公私钥对，比如： |
| 15 | +``` bash |
| 16 | +$ ssh-keygen |
| 17 | +Generating public/private rsa key pair. |
| 18 | +Enter file in which to save the key (/root/.ssh/id_rsa): |
| 19 | +Enter passphrase (empty for no passphrase): |
| 20 | +Enter same passphrase again: |
| 21 | +Your identification has been saved in /root/.ssh/id_rsa. |
| 22 | +Your public key has been saved in /root/.ssh/id_rsa.pub. |
| 23 | +The key fingerprint is: |
| 24 | +SHA256:XBSD2HY1Lp8ZRfTC82cFEXzW/BRgEMd+SWiKzBNSUHN [email protected] |
| 25 | +The key's randomart image is: |
| 26 | ++---[RSA 2048]----+ |
| 27 | +| +B=E*XO*O.| |
| 28 | +| . =X =o=O.=| |
| 29 | +| .oo o oo++o| |
| 30 | +| + = + .+| |
| 31 | +| S . .| |
| 32 | +| | |
| 33 | +| | |
| 34 | +| | |
| 35 | +| | |
| 36 | ++----[SHA256]-----+ |
| 37 | +
|
| 38 | +$ ls /root/.ssh/id_rsa* -lh |
| 39 | +-rw-------. 1 root root 1.7K Nov 10 03:47 /root/.ssh/id_rsa # 私钥 |
| 40 | +-rw-r--r--. 1 root root 408 Nov 10 03:47 /root/.ssh/id_rsa.pub # 公钥 |
| 41 | +``` |
| 42 | +
|
| 43 | +2. 分发公钥到集群的各个节点： |
| 44 | +``` bash |
| 45 | +# 比如指定将公钥分发至 `192.168.10.11` `192.168.10.12` 两个节点 |
| 46 | +$ declare -a IPS=(192.168.10.11 192.168.10.12) |
| 47 | +
|
| 48 | +# 遍历节点 IP 分发公钥，假设用户名为: root, 密码为: kubean |
| 49 | +$ for ip in ${IPS[@]}; do sshpass -p "kubean" ssh-copy-id -o StrictHostKeyChecking=no root@$ip; done |
| 50 | +``` |
| 51 | +
|
| 52 | +## 使用私钥制作Secret |
| 53 | +
|
| 54 | +1. 通过 kubectl 命令可以生成私钥的 Secret: |
| 55 | +``` bash |
| 56 | +$ kubectl -n kubean-system \ # 指定命名空间 kubean-system |
| 57 | + create secret generic sample-ssh-auth \ # 指定 secret 名称为 sample-ssh-auth |
| 58 | + --type='kubernetes.io/ssh-auth' \ # 指定 secret 类型为 kubernetes.io/ssh-auth |
| 59 | + --from-file=ssh-privatekey=/root/.ssh/id_rsa \ # 指定 ssh 私钥文件路径 |
| 60 | + --dry-run=client -o yaml > ssh_auth_sec.yaml # 指定 secret yaml 文件生成路径 |
| 61 | +``` |
| 62 | +
|
| 63 | +2. 生成的 Secret YAML 内容大致如下所示： |
| 64 | +``` yaml |
| 65 | +apiVersion: v1 |
| 66 | +kind: Secret |
| 67 | +metadata: |
| 68 | + creationTimestamp: null |
| 69 | + name: sample-ssh-auth |
| 70 | + namespace: kubean-system |
| 71 | +type: kubernetes.io/ssh-auth |
| 72 | +data: |
| 73 | + ssh-privatekey: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdWVDbC8rSng1b0RT... |
| 74 | +``` |
| 75 | +
|
| 76 | +## 创建主机清单配置 |
| 77 | +
|
| 78 | +示例：主机清单 hosts_conf_cm.yaml 内容大致如下： |
| 79 | +``` yaml |
| 80 | +apiVersion: v1 |
| 81 | +kind: ConfigMap |
| 82 | +metadata: |
| 83 | + name: sample-hosts-conf |
| 84 | + namespace: kubean-system |
| 85 | +data: |
| 86 | + hosts.yml: | |
| 87 | + all: |
| 88 | + hosts: |
| 89 | + master: |
| 90 | + ip: 192.168.10.11 |
| 91 | + access_ip: 192.168.10.11 |
| 92 | + ansible_host: 192.168.10.11 |
| 93 | + worker: |
| 94 | + ip: 192.168.10.12 |
| 95 | + access_ip: 192.168.10.12 |
| 96 | + ansible_host: 192.168.10.12 |
| 97 | + children: |
| 98 | + kube_control_plane: |
| 99 | + hosts: |
| 100 | + master: |
| 101 | + kube_node: |
| 102 | + hosts: |
| 103 | + master: |
| 104 | + worker: |
| 105 | + etcd: |
| 106 | + hosts: |
| 107 | + master: |
| 108 | + k8s_cluster: |
| 109 | + children: |
| 110 | + kube_control_plane: |
| 111 | + kube_node: |
| 112 | + calico_rr: |
| 113 | + hosts: {} |
| 114 | +``` |
| 115 | +
|
| 116 | +> 注： 由于采用私钥登录，所以主机信息中不需要填写用户名密码(即: ansible_user、ansible_password) |
| 117 | +
|
| 118 | +## 制备部署集群的配置参数 |
| 119 | +
|
| 120 | +集群配置参数 vars_conf_cm.yaml 的内容，可以参考: [demo vars conf](../../artifacts/demo/vars-conf-cm.yml). |
| 121 | +``` yaml |
| 122 | +apiVersion: v1 |
| 123 | +kind: ConfigMap |
| 124 | +metadata: |
| 125 | + name: sample-vars-conf |
| 126 | + namespace: kubean-system |
| 127 | +data: |
| 128 | + group_vars.yml: | |
| 129 | + container_manager: containerd |
| 130 | + kube_network_plugin: calico |
| 131 | + kube_network_plugin_multus: false |
| 132 | + kube_proxy_mode: iptables |
| 133 | + enable_nodelocaldns: false |
| 134 | + etcd_deployment_type: kubeadm |
| 135 | + ntp_enabled: true |
| 136 | + ... |
| 137 | +``` |
| 138 | +
|
| 139 | +## 准备KuBean的自定义资源 |
| 140 | +
|
| 141 | +1. Cluster 自定义资源内容示例 |
| 142 | +``` yaml |
| 143 | +apiVersion: kubean.io/v1alpha1 |
| 144 | +kind: Cluster |
| 145 | +metadata: |
| 146 | + name: sample |
| 147 | +spec: |
| 148 | + hostsConfRef: |
| 149 | + namespace: kubean-system |
| 150 | + name: sample-hosts-conf |
| 151 | + varsConfRef: |
| 152 | + namespace: kubean-system |
| 153 | + name: sample-vars-conf |
| 154 | + sshAuthRef: # 关键属性，指定集群部署期间的 ssh 私钥 secret |
| 155 | + namespace: kubean-system |
| 156 | + name: sample-ssh-auth |
| 157 | +``` |
| 158 | +
|
| 159 | +2. ClusterOperation 自定义资源内容示例 |
| 160 | +``` yaml |
| 161 | +apiVersion: kubean.io/v1alpha1 |
| 162 | +kind: ClusterOperation |
| 163 | +metadata: |
| 164 | + name: sample-create-cluster |
| 165 | +spec: |
| 166 | + cluster: sample |
| 167 | + image: ghcr.m.daocloud.io/kubean-io/spray-job:latest |
| 168 | + backoffLimit: 0 |
| 169 | + actionType: playbook |
| 170 | + action: cluster.yml |
| 171 | + preHook: |
| 172 | + - actionType: playbook |
| 173 | + action: ping.yml |
| 174 | + - actionType: playbook |
| 175 | + action: disable-firewalld.yml |
| 176 | + postHook: |
| 177 | + - actionType: playbook |
| 178 | + action: kubeconfig.yml |
| 179 | + - actionType: playbook |
| 180 | + action: cluster-info.yml |
| 181 | +``` |
| 182 | +
|
| 183 | +## 开始部署集群 |
| 184 | +
|
| 185 | +假设我们的所有 yaml 清单都存放在 create_cluster 目录 |
| 186 | +``` bash |
| 187 | +$ tree create_cluster/ |
| 188 | +create_cluster |
| 189 | +├── hosts_conf_cm.yml # 主机清单 |
| 190 | +├── ssh_auth_sec.yml # SSH私钥 |
| 191 | +├── vars_conf_cm.yml # 集群参数 |
| 192 | +├── kubeanCluster.yml # Cluster CR |
| 193 | +└── kubeanClusterOps.yml # ClusterOperation CR |
| 194 | +``` |
| 195 | +
|
| 196 | +通过 kubectl apply 开始部署集群: |
| 197 | +``` bash |
| 198 | +$ kubectl apply -f create_cluster/ |
| 199 | +``` |
0 commit comments