# 关闭防火墙sudo systemctl stop firewalld && systemctl disable firewalldsudo systemctl stop ufw && systemctl disable ufw# 关闭虚拟交换（注释fstab中swap配置）sudo swapoff -asudo sed -i /^[^#]*swap*/s/^/\#/g /etc/fstab

192.168.56.10 master1192.168.56.11 master2192.168.56.12 master3192.168.56.13 node1192.168.56.14 node2

#一键式部署dockercurl -fsSL https://get.docker.com | sudo bash -s docker --mirror Aliyunsudo systemctl enable docker && sudo systemctl restart docker

sudo apt-get install socat conntrack ebtables ipset ipvsadm

sudo hostnamectl set-hostname master1

[Unit]Description=kubelet: The Kubernetes Node AgentDocumentation=http://kubernetes.io/docs/
[Service]CPUAccounting=trueMemoryAccounting=trueExecStart=/usr/local/bin/kubeletRestart=alwaysStartLimitInterval=0RestartSec=10
[Install]WantedBy=multi-user.target

# Note: This dropin only works with kubeadm and kubelet v1.11+[Service]Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"# This is a file that "kubeadm init" and "kubeadm join" generate at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamicallyEnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.EnvironmentFile=-/etc/default/kubeletEnvironment="KUBELET_EXTRA_ARGS=--node-ip=192.168.56.10 --hostname-override=master1"ExecStart=ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS

sudo systemctl disable kubelet sudo systemctl enable kubelet sudo ln -snf /usr/local/bin/kubelet /usr/bin/kubelet

sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --ignore-preflight-errors=NumCPU --apiserver-advertise-address=192.168.56.10 --image-repository registry.aliyuncs.com/google_containers

---apiVersion: policy/v1beta1kind: PodSecurityPolicymetadata:  name: psp.flannel.unprivileged  annotations:    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/defaultspec:  privileged: false  volumes:    - configMap    - secret    - emptyDir    - hostPath  allowedHostPaths:    - pathPrefix: "/etc/cni/net.d"    - pathPrefix: "/etc/kube-flannel"    - pathPrefix: "/run/flannel"  readOnlyRootFilesystem: false  # Users and groups  runAsUser:    rule: RunAsAny  supplementalGroups:    rule: RunAsAny  fsGroup:    rule: RunAsAny  # Privilege Escalation  allowPrivilegeEscalation: false  defaultAllowPrivilegeEscalation: false  # Capabilities  allowedCapabilities: ['NET_ADMIN']  defaultAddCapabilities: []  requiredDropCapabilities: []  # Host namespaces  hostPID: false  hostIPC: false  hostNetwork: true  hostPorts:  - min: 0    max: 65535  # SELinux  seLinux:    # SELinux is unused in CaaSP    rule: 'RunAsAny'---kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata:  labels:    k8s-app: flannel  name: flannelrules:  - apiGroups: ['extensions']    resources: ['podsecuritypolicies']    verbs: ['use']    resourceNames: ['psp.flannel.unprivileged']  - apiGroups:      - ""    resources:      - pods    verbs:      - get  - apiGroups:      - ""    resources:      - nodes    verbs:      - get      - list      - watch  - apiGroups:      - ""    resources:      - nodes/status    verbs:      - patch  - apiGroups:     - networking.k8s.io    resources:     - clustercidrs    verbs:     - list     - watch---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:  labels:    k8s-app: flannel  name: flannelroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: flannelsubjects:- kind: ServiceAccount  name: flannel  namespace: kube-system---apiVersion: v1kind: ServiceAccountmetadata:  name: flannel  namespace: kube-system---kind: ConfigMapapiVersion: v1metadata:  name: kube-flannel-cfg  namespace: kube-system  labels:    tier: node    app: flannel    k8s-app: flanneldata:  cni-conf.json: |    {      "name": "cbr0",      "cniVersion": "0.3.1",      "plugins": [        {          "type": "flannel",          "delegate": {            "hairpinMode": true,            "isDefaultGateway": true          }        },        {          "type": "portmap",          "capabilities": {            "portMappings": true          }        }      ]    }  net-conf.json: |    {      "Network": "10.244.0.0/16",      "Backend": {        "Type": "vxlan"      }    }---apiVersion: apps/v1kind: DaemonSetmetadata:  name: kube-flannel-ds  namespace: kube-system  labels:    tier: node    app: flannel    k8s-app: flannelspec:  selector:    matchLabels:      app: flannel      k8s-app: flannel  template:    metadata:      labels:        tier: node        app: flannel        k8s-app: flannel    spec:      affinity:        nodeAffinity:          requiredDuringSchedulingIgnoredDuringExecution:            nodeSelectorTerms:              - matchExpressions:                  - key: kubernetes.io/os                    operator: In                    values:                      - linux      hostNetwork: true      tolerations:      - operator: Exists        effect: NoSchedule      priorityClassName: system-node-critical      serviceAccountName: flannel      initContainers:      - name: install-cni-plugin        args:        - -f        - /flannel        - /opt/cni/bin/flannel        command:        - cp        image: flannel/flannel-cni-plugin:v1.1.2        volumeMounts:        - mountPath: /opt/cni/bin          name: cni-plugin      - name: install-cni        image: flannel/flannel:v0.21.3        command:        - cp        args:        - -f        - /etc/kube-flannel/cni-conf.json        - /etc/cni/net.d/10-flannel.conflist        volumeMounts:        - name: cni          mountPath: /etc/cni/net.d        - name: flannel-cfg          mountPath: /etc/kube-flannel/      containers:      - name: kube-flannel        image: {{ .FlannelImage }}        command:        - /opt/bin/flanneld        args:        - --ip-masq        - --kube-subnet-mgr        resources:          requests:            cpu: "100m"            memory: "50Mi"          limits:            cpu: "100m"            memory: "50Mi"        securityContext:          privileged: false          capabilities:            add: ["NET_ADMIN", "NET_RAW"]        env:        - name: POD_NAME          valueFrom:            fieldRef:              fieldPath: metadata.name        - name: POD_NAMESPACE          valueFrom:            fieldRef:              fieldPath: metadata.namespace        volumeMounts:        - name: run          mountPath: /run/flannel        - name: flannel-cfg          mountPath: /etc/kube-flannel/        - mountPath: /run/xtables.lock          name: xtables-lock      volumes:        - name: run          hostPath:            path: /run/flannel        - name: cni-plugin          hostPath:            path: /opt/cni/bin        - name: cni          hostPath:            path: /etc/cni/net.d        - name: xtables-lock          hostPath:           path: /run/xtables.lock           type: FileOrCreate        - name: flannel-cfg          configMap:            name: kube-flannel-cfg

sudo kubectl apply -f network-plugin.yaml