尧图网站建设 
一.构建部署kubernetes所需主机主机名ip配置角色harbor.timinglee.org172.25.254.250cpu1、mem 1Gharbor仓库master-node172.25.254.100cpu4、mem4Gmasterk8s集群控制节点node1172.25.254.10cpu2、mem 2Gworkerk8s集群工作节点node2172.25.254.20cpu2、mem 2Gworkerk8s集群工作节点各主机之间确保互通二.构建harbor镜像仓库1.部署docker本地仓库[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF[docker]namedockerbaseurlhttps://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/ gpgcheck0EOF#安装软件[rootharbor ~]# dnf install httpd createrepo -y[rootharbor ~]# mkdir /var/www/html/docker/ -p[rootharbor ~]# vim /etc/httpd/conf/httpd.conf#修改端口Listen4444#启动服务[rootharbor ~]# systemctl enable --now httpd#安装docker[rootharbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y[rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/[rootharbor ~]# createrepo -v /var/www/html/docker/[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF[docker]namedockerbaseurlhttp://172.25.254.250:4444/docker gpgcheck0EOF2.安装docker在harbor仓库节点[rootharbor ~]# dnf install docker-ce -y[rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf[rootharbor ~]# modprobe -a br_netfilter[rootharbor ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1[rootharbor ~]# systemctl restart systemd-modules-load.service[rootharbor ~]# sysctl --system[rootharbor ~]# vim /lib/systemd/system/docker.service#在这一行添加参数 --iptablestrueExecStart/usr/bin/dockerd-Hfd://--containerd/run/containerd/containerd.sock--iptablestrue[rootharbor ~]# systemctl daemon-reload[rootharbor ~]# systemctl enable --now docker2.生成key[rootharbor ~]# mkdir /data/certs -p[rootharbor ~]# openssl req -newkey rsa:4096 \-nodes-sha256-keyout/data/certs/timinglee.org.key\-addextsubjectAltName DNS:reg.timinglee.org\-x509-days365-out/data/certs/timinglee.org.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter., the field will be left blank. ----- Country Name(2letter code)[XX]:CN#添加信息State or Province Name(full name)[]:Shannxi Locality Name(eg, city)[Default City]:Xian Organization Name (eg, company) [Default Company Ltd]:kubernetes Organizational Unit Name (eg, section) []:harbor Common Name (eg, your name or your servershostname)[]:reg.timinglee.org Email Address[]:admintiminglee.org3.编辑harbor配置文件#解压文件没有可去官方下载[rootharbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/[rootharbor ~]# cd /opt/harbor/[rootharbor harbor]# lscommon.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare[rootharbor harbor]# cp harbor.yml.tmpl harbor.yml[rootharbor harbor]# vim harbor.ymlhostname: reg.timinglee.org#修改名字certificate: /data/certs/timinglee.org.crt#修改位置private_key: /data/certs/timinglee.org.key harbor_admin_password: lee#密码后续会用[rootharbor harbor]# ./install.sh --with-chartmuseum#编写启动脚本[rootharbor ~]# vim /lib/systemd/system/harbor.service[Unit]Descriptionharbor with Docker ComposeDocumentationhttps://reg.timinglee.com/compose/Afterdocker.service network-online.targetRequiresdocker.service[Service]TypeoneshotWorkingDirectory/opt/harborExecStart/usr/bin/docker compose up-dExecStop/usr/bin/docker compose downRemainAfterExityes[Install]WantedBymulti-user.target[rootharbor harbor]# docker compose downWARN[0000]/opt/harbor/docker-compose.yml: the attributeversionis obsolete, it will be ignored, please remove it to avoid potential confusion[]down4/6 ⠇ Container registryctl Stopping1.9s ✔ Container nginx Removed0.2s ✔ Container chartmuseum Removed0.2s ✔ Container harbor-jobservice Removed0.1s ✔ Container harbor-portal Removed0.1s ⠦ Container harbor-core Stopping1.7s[rootharbor ~]# systemctl enable --now harborCreated symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service.[rootharbor harbor]# docker compose ps4.启动并验证[rootharbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p[rootharbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt[rootharbor harbor]# vim /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6172.25.254.250 harbor reg.timinglee.org[rootharbor harbor]# systemctl restart docker[rootharbor harbor]# docker compose up -d[rootharbor harbor]# docker login reg.timinglee.org -u adminPassword: WARNING!Your credentials are stored unencryptedin/root/.docker/config.json.Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded5.所有主机配置关闭swapsystemctl disable--nowswap.target systemctl mask swap.targetsed/swap/s/^/#/g-i/etc/fstab所有主机配置docker加速器cat/etc/docker/daemon.jsonEOF { registry-mirrors:[https://reg.timinglee.org] } EOFsystemctl restartdockerdockerinfo#可以看到Registry Mirrors: https://reg.timinglee.org/所有主机彼此建立解析vim/etc/hosts#进入文件127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6172.25.254.100 master172.25.254.10 node1172.25.254.20 node2172.25.254.250 reg.timinglee.org所有主机配置kubernetes安装源vim/etc/yum.repos.d/kubernetes.repo[kubernetes]namekubernetes baseurlhttps://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/ gpgcheck0#检测dnf list kubelet以上操作完成后重启主机检测swap分区swapon-s没有任何输出表示ok三.利用Ansible部署kubernetes运行环境1.安装ansible[rootharbor ~]# vim /etc/yum.repos.d/epel.repo[epel]nameepel baseurlhttps://mirrors.aliyun.com/epel/9.6/Everything/x86_64/ gpgcheck0[rootharbor ~]# dnf install ansible-core.x86_64 ansible.noarch -y2.配置所需用户[rootharbor ~]# useradd devops[rootharbor ~]# echo lee | passwd --stdin devops更改用户 devops 的密码 。 passwd所有的身份验证令牌已经成功更新[rootharbor ~]# su - devops[devopsharbor ~]$mkdiransible[devopsharbor ~]$cdansible/[devopsharbor ansible]$3.生成ansible的临时配置文件并建立运行环境[devopsharbor ansible]$viminventory[servers]172.25.254.100172.25.254.20172.25.254.10[devopsharbor ansible]$vimansible.cfg[defaults]inventory/home/devops/ansible/inventory remote_userroot ask_passfalsehost_key_checkingfalse[devopsharbor ansible]$ ansible all-mping172.25.254.20|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}172.25.254.100|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}172.25.254.10|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}#建立用户[devopsharbor ansible]$ ansible all-muser-anamedevops statepresent[devopsharbor ansible]$ ansible all-mshell-aecho lee | passwd --stdin devops[devopsharbor ansible]$ ansible all-mlineinfile-apath/etc/sudoers linedevops ALL(ALL) NOPASSWD: ALL insertafterEOF4.生成ansible的主配置文件并测试[devopsharbor ansible]$vimansible.cfg[defaults]inventory/home/devops/ansible/inventory remote_userdevops ask_passfalsehost_key_checkingfalse[privilege_escalation]becometruebecome_methodsudobecome_userroot become_ask_passfalse[devopsharbor ansible]$ ansible all-mshell-awhoami 172.25.254.10|CHANGED|rc0root172.25.254.100|CHANGED|rc0root172.25.254.20|CHANGED|rc0root5.利用ansible剧本部署docker[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.254:4444/docker file:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.timinglee.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.timinglee.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/docker/certs.d/reg.timinglee.org/ca.crt - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt - name: load module copy: dest:{{item.dest}}content:{{item.value}}loop: - dest: /etc/modules-load.d/docker_mod.conf value: br_netfilter - dest: /etc/sysctl.d/docker.conf value:|net.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1- name: update ca cert shell:update-ca-trust extract;sysctl --system- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml6.利用ansible安装cri-dockerd#解压文件没有需要下载[devopsharbor ansible]$tarzxf cri-dockerd-0.4.4.amd64.tgz[devopsharbor ansible]$lsansible.cfg cri-dockerd cri-dockerd-0.4.4.amd64.tgz inventory kubernetes-devops.yml[devopsharbor ansible]$cdcri-dockerd/[devopsharbor cri-dockerd]$lscri-dockerd cri-docker.service cri-docker.socket[devopsharbor cri-dockerd]$vimcri-docker.service[Service]TypenotifyExecStart/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugincni --pod-infra-container-imagereg.timinglee.org/k8s/pause:3.10.1ExecReload/bin/kill-sHUP$MAINPIDTimeoutSec0RestartSec2Restartalways[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.254:4444/docker file:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.timinglee.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.timinglee.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/docker/certs.d/reg.timinglee.org/ca.crt - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt########################################################以下是新加内容- name: stup cri-dockerd copy: src:{{item.src}}dest:{{item.dest}}mode:0755loop: - src: ./cri-dockerd/cri-dockerd dest: /usr/bin/cri-dockerd - src:./cri-dockerd/cri-docker.servicedest:/lib/systemd/system/cri-docker.service- src:./cri-dockerd/cri-docker.socketdest:/lib/systemd/system/cri-docker.socket- name: update ca cert shell:update-ca-trust extract;sysctl --system;systemctl daemon-reload- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service - cri-docker[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml7.利用ansible部署k8s软件[devopsharbor ansible]$vimkubernetes-devops.yml#接着上面的内容后面添加新内容- name:installkubernetes from ansible hosts: all tasks: - name: setup k8s repo yum_repository: name: kubernetes description: kubernetes baseurl: https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm file: kubernetes gpgcheck: no - name:installsoftwareinmaster dnf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 - kubectl-1.35.7-150500.1.1 when: inventory_hostname172.25.254.100- name:installsoftwareinworknodednf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 when: inventory_hostname172.25.254.10or inventory_hostname172.25.254.20- name: setup kubectl kubeadm complication lineinfile: path: /root/.bashrc line:|source(kubectl completionbash)source(kubeadm completionbash)when: inventory_hostname172.25.254.100- name: start kubelet service: name: kubelet state: started enabled:yes[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml#让补齐功能生效[rootk8s-master mnt]# source ~/.bashrc[rootk8s-master mnt]# kubectl 命令后按2次tab键alpha(Commandsforfeaturesinalpha)annotate(更新一个资源的注解)api-resources(Print the supported API resources on the server)api-versions(Print the supported API versions on the server,inthe form ofgroup/version)apply(Apply a configuration to a resource byfilename or stdin)attach(挂接到一个运行中的容器)auth(Inspect authorization)autoscale(Auto-scale a deployment, replica set, stateful set, or replication controller)certificate(Modify certificate resources)[rootk8s-master mnt]# kubeadmcerts config init kubeconfig token version completionhelpjoinreset upgrade[rootk8s-master mnt]# systemctl status kubelet.service● kubelet.service - kubelet: The Kubernetes Node Agent Loaded: loaded(/usr/lib/systemd/system/kubelet.service;enabled;preset: disabled)Drop-In: /usr/lib/systemd/system/kubelet.service.d └─10-kubeadm.conf Active: activating(auto-restart)(Result: exit-code)since Tue2026-08-1817:09:25 CST;1s ago Docs: https://kubernetes.io/docs/ Process:79433ExecStart/usr/bin/kubelet$KUBELET_KUBECONFIG_ARGS$KUBELET_CONFIG_ARGS$KUBELET_KUBEADM_Main PID:79433(codeexited,status1/FAILURE) K8S集群部署（脚本方法）
一.构建部署kubernetes所需主机主机名ip配置角色harbor.timinglee.org172.25.254.250cpu1、mem 1Gharbor仓库master-node172.25.254.100cpu4、mem4Gmasterk8s集群控制节点node1172.25.254.10cpu2、mem 2Gworkerk8s集群工作节点node2172.25.254.20cpu2、mem 2Gworkerk8s集群工作节点各主机之间确保互通二.构建harbor镜像仓库1.部署docker本地仓库[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF[docker]namedockerbaseurlhttps://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/ gpgcheck0EOF#安装软件[rootharbor ~]# dnf install httpd createrepo -y[rootharbor ~]# mkdir /var/www/html/docker/ -p[rootharbor ~]# vim /etc/httpd/conf/httpd.conf#修改端口Listen4444#启动服务[rootharbor ~]# systemctl enable --now httpd#安装docker[rootharbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y[rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/[rootharbor ~]# createrepo -v /var/www/html/docker/[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF[docker]namedockerbaseurlhttp://172.25.254.250:4444/docker gpgcheck0EOF2.安装docker在harbor仓库节点[rootharbor ~]# dnf install docker-ce -y[rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf[rootharbor ~]# modprobe -a br_netfilter[rootharbor ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1[rootharbor ~]# systemctl restart systemd-modules-load.service[rootharbor ~]# sysctl --system[rootharbor ~]# vim /lib/systemd/system/docker.service#在这一行添加参数 --iptablestrueExecStart/usr/bin/dockerd-Hfd://--containerd/run/containerd/containerd.sock--iptablestrue[rootharbor ~]# systemctl daemon-reload[rootharbor ~]# systemctl enable --now docker2.生成key[rootharbor ~]# mkdir /data/certs -p[rootharbor ~]# openssl req -newkey rsa:4096 \-nodes-sha256-keyout/data/certs/timinglee.org.key\-addextsubjectAltName DNS:reg.timinglee.org\-x509-days365-out/data/certs/timinglee.org.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter., the field will be left blank. ----- Country Name(2letter code)[XX]:CN#添加信息State or Province Name(full name)[]:Shannxi Locality Name(eg, city)[Default City]:Xian Organization Name (eg, company) [Default Company Ltd]:kubernetes Organizational Unit Name (eg, section) []:harbor Common Name (eg, your name or your servershostname)[]:reg.timinglee.org Email Address[]:admintiminglee.org3.编辑harbor配置文件#解压文件没有可去官方下载[rootharbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/[rootharbor ~]# cd /opt/harbor/[rootharbor harbor]# lscommon.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare[rootharbor harbor]# cp harbor.yml.tmpl harbor.yml[rootharbor harbor]# vim harbor.ymlhostname: reg.timinglee.org#修改名字certificate: /data/certs/timinglee.org.crt#修改位置private_key: /data/certs/timinglee.org.key harbor_admin_password: lee#密码后续会用[rootharbor harbor]# ./install.sh --with-chartmuseum#编写启动脚本[rootharbor ~]# vim /lib/systemd/system/harbor.service[Unit]Descriptionharbor with Docker ComposeDocumentationhttps://reg.timinglee.com/compose/Afterdocker.service network-online.targetRequiresdocker.service[Service]TypeoneshotWorkingDirectory/opt/harborExecStart/usr/bin/docker compose up-dExecStop/usr/bin/docker compose downRemainAfterExityes[Install]WantedBymulti-user.target[rootharbor harbor]# docker compose downWARN[0000]/opt/harbor/docker-compose.yml: the attributeversionis obsolete, it will be ignored, please remove it to avoid potential confusion[]down4/6 ⠇ Container registryctl Stopping1.9s ✔ Container nginx Removed0.2s ✔ Container chartmuseum Removed0.2s ✔ Container harbor-jobservice Removed0.1s ✔ Container harbor-portal Removed0.1s ⠦ Container harbor-core Stopping1.7s[rootharbor ~]# systemctl enable --now harborCreated symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service.[rootharbor harbor]# docker compose ps4.启动并验证[rootharbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p[rootharbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt[rootharbor harbor]# vim /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6172.25.254.250 harbor reg.timinglee.org[rootharbor harbor]# systemctl restart docker[rootharbor harbor]# docker compose up -d[rootharbor harbor]# docker login reg.timinglee.org -u adminPassword: WARNING!Your credentials are stored unencryptedin/root/.docker/config.json.Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded5.所有主机配置关闭swapsystemctl disable--nowswap.target systemctl mask swap.targetsed/swap/s/^/#/g-i/etc/fstab所有主机配置docker加速器cat/etc/docker/daemon.jsonEOF { registry-mirrors:[https://reg.timinglee.org] } EOFsystemctl restartdockerdockerinfo#可以看到Registry Mirrors: https://reg.timinglee.org/所有主机彼此建立解析vim/etc/hosts#进入文件127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6172.25.254.100 master172.25.254.10 node1172.25.254.20 node2172.25.254.250 reg.timinglee.org所有主机配置kubernetes安装源vim/etc/yum.repos.d/kubernetes.repo[kubernetes]namekubernetes baseurlhttps://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/ gpgcheck0#检测dnf list kubelet以上操作完成后重启主机检测swap分区swapon-s没有任何输出表示ok三.利用Ansible部署kubernetes运行环境1.安装ansible[rootharbor ~]# vim /etc/yum.repos.d/epel.repo[epel]nameepel baseurlhttps://mirrors.aliyun.com/epel/9.6/Everything/x86_64/ gpgcheck0[rootharbor ~]# dnf install ansible-core.x86_64 ansible.noarch -y2.配置所需用户[rootharbor ~]# useradd devops[rootharbor ~]# echo lee | passwd --stdin devops更改用户 devops 的密码 。 passwd所有的身份验证令牌已经成功更新[rootharbor ~]# su - devops[devopsharbor ~]$mkdiransible[devopsharbor ~]$cdansible/[devopsharbor ansible]$3.生成ansible的临时配置文件并建立运行环境[devopsharbor ansible]$viminventory[servers]172.25.254.100172.25.254.20172.25.254.10[devopsharbor ansible]$vimansible.cfg[defaults]inventory/home/devops/ansible/inventory remote_userroot ask_passfalsehost_key_checkingfalse[devopsharbor ansible]$ ansible all-mping172.25.254.20|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}172.25.254.100|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}172.25.254.10|SUCCESS{ansible_facts:{discovered_interpreter_python:/usr/bin/python3},changed:false,ping:pong}#建立用户[devopsharbor ansible]$ ansible all-muser-anamedevops statepresent[devopsharbor ansible]$ ansible all-mshell-aecho lee | passwd --stdin devops[devopsharbor ansible]$ ansible all-mlineinfile-apath/etc/sudoers linedevops ALL(ALL) NOPASSWD: ALL insertafterEOF4.生成ansible的主配置文件并测试[devopsharbor ansible]$vimansible.cfg[defaults]inventory/home/devops/ansible/inventory remote_userdevops ask_passfalsehost_key_checkingfalse[privilege_escalation]becometruebecome_methodsudobecome_userroot become_ask_passfalse[devopsharbor ansible]$ ansible all-mshell-awhoami 172.25.254.10|CHANGED|rc0root172.25.254.100|CHANGED|rc0root172.25.254.20|CHANGED|rc0root5.利用ansible剧本部署docker[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.254:4444/docker file:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.timinglee.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.timinglee.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/docker/certs.d/reg.timinglee.org/ca.crt - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt - name: load module copy: dest:{{item.dest}}content:{{item.value}}loop: - dest: /etc/modules-load.d/docker_mod.conf value: br_netfilter - dest: /etc/sysctl.d/docker.conf value:|net.bridge.bridge-nf-call-iptables1net.bridge.bridge-nf-call-ip6tables1net.ipv4.ip_forward1- name: update ca cert shell:update-ca-trust extract;sysctl --system- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml6.利用ansible安装cri-dockerd#解压文件没有需要下载[devopsharbor ansible]$tarzxf cri-dockerd-0.4.4.amd64.tgz[devopsharbor ansible]$lsansible.cfg cri-dockerd cri-dockerd-0.4.4.amd64.tgz inventory kubernetes-devops.yml[devopsharbor ansible]$cdcri-dockerd/[devopsharbor cri-dockerd]$lscri-dockerd cri-docker.service cri-docker.socket[devopsharbor cri-dockerd]$vimcri-docker.service[Service]TypenotifyExecStart/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugincni --pod-infra-container-imagereg.timinglee.org/k8s/pause:3.10.1ExecReload/bin/kill-sHUP$MAINPIDTimeoutSec0RestartSec2Restartalways[devopsharbor ansible]$vimkubernetes-devops.yml - name: devops k8s from ansible hosts: all tasks: - name: setupdockerrepo yum_repository: name:dockerdescription:dockerbaseurl: http://172.25.254.254:4444/docker file:dockergpgcheck: no - name:installdockerdnf: name: docker-ce state: present - name: setup docker.service replace: path: /lib/systemd/system/docker.service regexp:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sockreplace:ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue- name: setupdockerregistry copy: content:|{registry-mirrors:[https://reg.timinglee.org]}dest: /etc/docker/daemon.json - name: setupdockercerts file: path: /etc/docker/certs.d/reg.timinglee.org state: directory - name:cpcertsfilecopy: src:{{item.src}}dest:{{item.dest}}loop: - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/docker/certs.d/reg.timinglee.org/ca.crt - src: /etc/docker/certs.d/reg.timinglee.org/ca.crt dest: /etc/pki/ca-trust/source/anchors/ca.crt########################################################以下是新加内容- name: stup cri-dockerd copy: src:{{item.src}}dest:{{item.dest}}mode:0755loop: - src: ./cri-dockerd/cri-dockerd dest: /usr/bin/cri-dockerd - src:./cri-dockerd/cri-docker.servicedest:/lib/systemd/system/cri-docker.service- src:./cri-dockerd/cri-docker.socketdest:/lib/systemd/system/cri-docker.socket- name: update ca cert shell:update-ca-trust extract;sysctl --system;systemctl daemon-reload- name: start services service: name:{{item}}state: restarted enabled:yesloop: -docker- systemd-modules-load.service - cri-docker[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml7.利用ansible部署k8s软件[devopsharbor ansible]$vimkubernetes-devops.yml#接着上面的内容后面添加新内容- name:installkubernetes from ansible hosts: all tasks: - name: setup k8s repo yum_repository: name: kubernetes description: kubernetes baseurl: https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm file: kubernetes gpgcheck: no - name:installsoftwareinmaster dnf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 - kubectl-1.35.7-150500.1.1 when: inventory_hostname172.25.254.100- name:installsoftwareinworknodednf: name:{{item}}state: present loop: - kubeadm-1.35.7-150500.1.1 - kubelet-1.35.7-150500.1.1 when: inventory_hostname172.25.254.10or inventory_hostname172.25.254.20- name: setup kubectl kubeadm complication lineinfile: path: /root/.bashrc line:|source(kubectl completionbash)source(kubeadm completionbash)when: inventory_hostname172.25.254.100- name: start kubelet service: name: kubelet state: started enabled:yes[devopsharbor ansible]$ ansible-playbook kubernetes-devops.yml#让补齐功能生效[rootk8s-master mnt]# source ~/.bashrc[rootk8s-master mnt]# kubectl 命令后按2次tab键alpha(Commandsforfeaturesinalpha)annotate(更新一个资源的注解)api-resources(Print the supported API resources on the server)api-versions(Print the supported API versions on the server,inthe form ofgroup/version)apply(Apply a configuration to a resource byfilename or stdin)attach(挂接到一个运行中的容器)auth(Inspect authorization)autoscale(Auto-scale a deployment, replica set, stateful set, or replication controller)certificate(Modify certificate resources)[rootk8s-master mnt]# kubeadmcerts config init kubeconfig token version completionhelpjoinreset upgrade[rootk8s-master mnt]# systemctl status kubelet.service● kubelet.service - kubelet: The Kubernetes Node Agent Loaded: loaded(/usr/lib/systemd/system/kubelet.service;enabled;preset: disabled)Drop-In: /usr/lib/systemd/system/kubelet.service.d └─10-kubeadm.conf Active: activating(auto-restart)(Result: exit-code)since Tue2026-08-1817:09:25 CST;1s ago Docs: https://kubernetes.io/docs/ Process:79433ExecStart/usr/bin/kubelet$KUBELET_KUBECONFIG_ARGS$KUBELET_CONFIG_ARGS$KUBELET_KUBEADM_Main PID:79433(codeexited,status1/FAILURE)