K8S从入门到放弃系列-(11)kubernetes集群网络Calico部署

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

摘要：

前面几个篇幅，已经介绍master与node节点集群组件部署，由于K8S本身不支持网络，当 node 全部启动后，由于网络组件(CNI)未安装会显示为 NotReady 状态，需要借助第三方网络才能进行创建Pod，下面将部署 Calico 网络为K8S提供网络支持，完成跨节点网络通讯。

官方文档 https://docs.projectcalico.org/v3.6/introduction

1）下载Calico yaml

5f39ae17-8c62-4a45-bc43-b32064c9388a:W3siYmxvY2tJZCI6IjI0MzctMTU1NjI0NDkzNjA2OSIsImJsb2NrVHlwZSI6InBhcmFncmFwaCIsInN0eWxlcyI6eyJhbGlnbiI6ImxlZnQiLCJpbmRlbnQiOjAsInRleHQtaW5kZW50IjowLCJsaW5lLWhlaWdodCI6MS43NSwiYmFjay1jb2xvciI6IiIsInBhZGRpbmciOiIifSwidHlwZSI6InBhcmFncmFwaCIsInJpY2hUZXh0Ijp7ImRhdGEiOlt7ImNoYXIiOiLmkZgifSx7ImNoYXIiOiLopoEifSx7ImNoYXIiOiLvvJoifV0sImlzUmljaFRleHQiOnRydWUsImtlZXBMaW5lQnJlYWsiOnRydWV9fSx7ImJsb2NrSWQiOiIxMzU5LTE1NTYyNDU4OTAzNDkiLCJibG9ja1R5cGUiOiJwYXJhZ3JhcGgiLCJzdHlsZXMiOnsiYWxpZ24iOiJsZWZ0IiwiaW5kZW50IjowLCJ0ZXh0LWluZGVudCI6MSwibGluZS1oZWlnaHQiOjEuNzUsImJhY2stY29sb3IiOiIiLCJwYWRkaW5nIjoiIn0sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoi5YmNIn0seyJjaGFyIjoi6Z2iIn0seyJjaGFyIjoi5YegIn0seyJjaGFyIjoi5LiqIn0seyJjaGFyIjoi56+HIn0seyJjaGFyIjoi5bmFIn0seyJjaGFyIjoi77yMIn0seyJjaGFyIjoi5beyIn0seyJjaGFyIjoi57uPIn0seyJjaGFyIjoi5LuLIn0seyJjaGFyIjoi57uNIn0seyJjaGFyIjoibSJ9LHsiY2hhciI6ImEifSx7ImNoYXIiOiJzIn0seyJjaGFyIjoidCJ9LHsiY2hhciI6ImUifSx7ImNoYXIiOiJyIn0seyJjaGFyIjoi5LiOIn0seyJjaGFyIjoibiJ9LHsiY2hhciI6Im8ifSx7ImNoYXIiOiJkIn0seyJjaGFyIjoiZSJ9LHsiY2hhciI6IuiKgiJ9LHsiY2hhciI6IueCuSJ9LHsiY2hhciI6IumbhiJ9LHsiY2hhciI6Iue+pCJ9LHsiY2hhciI6Iue7hCJ9LHsiY2hhciI6IuS7tiJ9LHsiY2hhciI6IumDqCJ9LHsiY2hhciI6Iue9siJ9LHsiY2hhciI6Iu+8jCJ9LHsiY2hhciI6IueUsSJ9LHsiY2hhciI6IuS6jiJ9LHsiY2hhciI6IksifSx7ImNoYXIiOiI4In0seyJjaGFyIjoiUyJ9LHsiY2hhciI6IuacrCJ9LHsiY2hhciI6Iui6qyJ9LHsiY2hhciI6IuS4jSJ9LHsiY2hhciI6IuaUryJ9LHsiY2hhciI6IuaMgSJ9LHsiY2hhciI6Iue9kSJ9LHsiY2hhciI6Iue7nCJ9LHsiY2hhciI6Iu+8jCJ9LHsiY2hhciI6IuW9kyJ9LHsiY2hhciI6IiAifSx7ImNoYXIiOiJuIn0seyJjaGFyIjoibyJ9LHsiY2hhciI6ImQifSx7ImNoYXIiOiJlIn0seyJjaGFyIjoiICJ9LHsiY2hhciI6IuWFqCJ9LHsiY2hhciI6IumDqCJ9LHsiY2hhciI6IuWQryJ9LHsiY2hhciI6IuWKqCJ9LHsiY2hhciI6IuWQjiJ9LHsiY2hhciI6Iu+8jCJ9LHsiY2hhciI6IueUsSJ9LHsiY2hhciI6IuS6jiJ9LHsiY2hhciI6Iue9kSJ9LHsiY2hhciI6Iue7nCJ9LHsiY2hhciI6Iue7hCJ9LHsiY2hhciI6IuS7tiJ9LHsiY2hhciI6IigifSx7ImNoYXIiOiJDIn0seyJjaGFyIjoiTiJ9LHsiY2hhciI6IkkifSx7ImNoYXIiOiIpIn0seyJjaGFyIjoi5pyqIn0seyJjaGFyIjoi5a6JIn0seyJjaGFyIjoi6KOFIn0seyJjaGFyIjoi5LyaIn0seyJjaGFyIjoi5pi+In0seyJjaGFyIjoi56S6In0seyJjaGFyIjoi5Li6In0seyJjaGFyIjoiICJ9LHsiY2hhciI6Ik4ifSx7ImNoYXIiOiJvIn0seyJjaGFyIjoidCJ9LHsiY2hhciI6IlIifSx7ImNoYXIiOiJlIn0seyJjaGFyIjoiYSJ9LHsiY2hhciI6ImQifSx7ImNoYXIiOiJ5In0seyJjaGFyIjoiICJ9LHsiY2hhciI6IueKtiJ9LHsiY2hhciI6IuaAgSJ9LHsiY2hhciI6Iu+8jCJ9LHsiY2hhciI6IumcgCJ9LHsiY2hhciI6IuimgSJ9LHsiY2hhciI6IuWAnyJ9LHsiY2hhciI6IuWKqSJ9LHsiY2hhciI6IuesrCJ9LHsiY2hhciI6IuS4iSJ9LHsiY2hhciI6IuaWuSJ9LHsiY2hhciI6Iue9kSJ9LHsiY2hhciI6Iue7nCJ9LHsiY2hhciI6IuaJjSJ9LHsiY2hhciI6IuiDvSJ9LHsiY2hhciI6Iui/myJ9LHsiY2hhciI6IuihjCJ9LHsiY2hhciI6IuWImyJ9LHsiY2hhciI6IuW7uiJ9LHsiY2hhciI6IlAifSx7ImNoYXIiOiJvIn0seyJjaGFyIjoiZCJ9LHsiY2hhciI6Iu+8jCJ9LHsiY2hhciI6IuS4iyJ9LHsiY2hhciI6IumdoiJ9LHsiY2hhciI6IuWwhiJ9LHsiY2hhciI6IumDqCJ9LHsiY2hhciI6Iue9siJ9LHsiY2hhciI6IiAifSx7ImNoYXIiOiJDIn0seyJjaGFyIjoiYSJ9LHsiY2hhciI6ImwifSx7ImNoYXIiOiJpIn0seyJjaGFyIjoiYyJ9LHsiY2hhciI6Im8ifSx7ImNoYXIiOiIgIn0seyJjaGFyIjoi572RIn0seyJjaGFyIjoi57ucIn0seyJjaGFyIjoi5Li6In0seyJjaGFyIjoiSyJ9LHsiY2hhciI6IjgifSx7ImNoYXIiOiJTIn0seyJjaGFyIjoi5o+QIn0seyJjaGFyIjoi5L6bIn0seyJjaGFyIjoi572RIn0seyJjaGFyIjoi57ucIn0seyJjaGFyIjoi5pSvIn0seyJjaGFyIjoi5oyBIn0seyJjaGFyIjoi77yMIn0seyJjaGFyIjoi5a6MIn0seyJjaGFyIjoi5oiQIn0seyJjaGFyIjoi6LeoIn0seyJjaGFyIjoi6IqCIn0seyJjaGFyIjoi54K5In0seyJjaGFyIjoi572RIn0seyJjaGFyIjoi57ucIn0seyJjaGFyIjoi6YCaIn0seyJjaGFyIjoi6K6vIn0seyJjaGFyIjoi44CCIn1dLCJpc1JpY2hUZXh0Ijp0cnVlLCJrZWVwTGluZUJyZWFrIjp0cnVlfX0seyJibG9ja0lkIjoiMjk1Ni0xNTU2MjQ2MzcyODM3IiwiYmxvY2tUeXBlIjoicGFyYWdyYXBoIiwic3R5bGVzIjp7ImFsaWduIjoibGVmdCIsImluZGVudCI6MCwidGV4dC1pbmRlbnQiOjAsImxpbmUtaGVpZ2h0IjoxLjc1LCJiYWNrLWNvbG9yIjoiIiwicGFkZGluZyI6IiJ9LCJ0eXBlIjoicGFyYWdyYXBoIiwicmljaFRleHQiOnsiZGF0YSI6W3siY2hhciI6IuWumCJ9LHsiY2hhciI6IuaWuSJ9LHsiY2hhciI6IuaWhyJ9LHsiY2hhciI6IuahoyJ9LHsiY2hhciI6IiAifSx7ImNoYXIiOiJoIn0seyJjaGFyIjoidCJ9LHsiY2hhciI6InQifSx7ImNoYXIiOiJwIn0seyJjaGFyIjoicyJ9LHsiY2hhciI6IjoifSx7ImNoYXIiOiIvIn0seyJjaGFyIjoiLyJ9LHsiY2hhciI6ImQifSx7ImNoYXIiOiJvIn0seyJjaGFyIjoiYyJ9LHsiY2hhciI6InMifSx7ImNoYXIiOiIuIn0seyJjaGFyIjoicCJ9LHsiY2hhciI6InIifSx7ImNoYXIiOiJvIn0seyJjaGFyIjoiaiJ9LHsiY2hhciI6ImUifSx7ImNoYXIiOiJjIn0seyJjaGFyIjoidCJ9LHsiY2hhciI6ImMifSx7ImNoYXIiOiJhIn0seyJjaGFyIjoibCJ9LHsiY2hhciI6ImkifSx7ImNoYXIiOiJjIn0seyJjaGFyIjoibyJ9LHsiY2hhciI6Ii4ifSx7ImNoYXIiOiJvIn0seyJjaGFyIjoiciJ9LHsiY2hhciI6ImcifSx7ImNoYXIiOiIvIn0seyJjaGFyIjoidiJ9LHsiY2hhciI6IjMifSx7ImNoYXIiOiIuIn0seyJjaGFyIjoiNiJ9LHsiY2hhciI6Ii8ifSx7ImNoYXIiOiJpIn0seyJjaGFyIjoibiJ9LHsiY2hhciI6InQifSx7ImNoYXIiOiJyIn0seyJjaGFyIjoibyJ9LHsiY2hhciI6ImQifSx7ImNoYXIiOiJ1In0seyJjaGFyIjoiYyJ9LHsiY2hhciI6InQifSx7ImNoYXIiOiJpIn0seyJjaGFyIjoibyJ9LHsiY2hhciI6Im4ifV0sImlzUmljaFRleHQiOnRydWUsImtlZXBMaW5lQnJlYWsiOnRydWV9fSx7ImJsb2NrSWQiOiI2OTU1LTE1NTYyNDYzNjQ0NTYiLCJibG9ja1R5cGUiOiJwYXJhZ3JhcGgiLCJzdHlsZXMiOnsiYWxpZ24iOiJsZWZ0IiwiaW5kZW50IjowLCJ0ZXh0LWluZGVudCI6MCwibGluZS1oZWlnaHQiOjEuNzUsImJhY2stY29sb3IiOiIiLCJwYWRkaW5nIjoiIn0sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoiMSJ9LHsiY2hhciI6Iu+8iSJ9LHsiY2hhciI6IuS4iyJ9LHsiY2hhciI6Iui9vSJ9LHsiY2hhciI6IkMifSx7ImNoYXIiOiJhIn0seyJjaGFyIjoibCJ9LHsiY2hhciI6ImkifSx7ImNoYXIiOiJjIn0seyJjaGFyIjoibyJ9LHsiY2hhciI6IiAifSx7ImNoYXIiOiJ5In0seyJjaGFyIjoiYSJ9LHsiY2hhciI6Im0ifSx7ImNoYXIiOiJsIn1dLCJpc1JpY2hUZXh0Ijp0cnVlLCJrZWVwTGluZUJyZWFrIjp0cnVlfX1d

[root@k8s-master01 ~]# mkdir /opt/k8s/calico

[root@k8s-master01 ~]# cd /opt/k8s/calico/

[root@k8s-master01 calico]# wget http://docs.projectcalico.org/v3.6/getting-started/kubernetes/installation/hosted/calico.yaml

2）修改配置

默认calico配置清单文件与我们部署的集群并不兼容，所以我们需要修改以下字段信息

[root@k8s-master01 calico]# vim calico.yaml

## etcd 证书 base64 地址 (执行里面的命令生成的证书 base64 码，填入里面)

apiVersion: v1

kind: Secret

type: Opaque

metadata:

  name: calico-etcd-secrets

  namespace: kube-system

data:

   etcd-key: (cat /etc/kubernetes/ssl/etcd-key.pem | base64 | tr -d '\n')

   etcd-cert: (cat /etc/kubernetes/ssl/etcd.pem | base64 | tr -d '\n')

   etcd-ca: (cat /etc/kubernetes/ssl/ca.pem | base64 | tr -d '\n')

## 如上()中只是生成base64码的命令实际操作时需要去掉(),只需要填写生成的编码并用双引号引起来即可

## ConfigMap

### 修改etcd地址

  etcd_endpoints: "https://10.10.0.18:2379,https://10.10.0.19:2379,https://10.10.0.20:2379"

### 修改etcd证书位置

  etcd_ca: "/calico-secrets/etcd-ca"

  etcd_cert: "/calico-secrets/etcd-cert"

  etcd_key: "/calico-secrets/etcd-key"

## 修改pod 分配的IP段(不能与node、service等地址同一网段)

  - name: CALICO_IPV4POOL_CIDR

    value: "10.254.64.0/18"

3）应用

5f39ae17-8c62-4a45-bc43-b32064c9388a:W3siYmxvY2tJZCI6IjI0OTMtMTU1NjI0NzQzMDg3OCIsImJsb2NrVHlwZSI6InBhcmFncmFwaCIsInN0eWxlcyI6e30sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoiMyJ9LHsiY2hhciI6Iu+8iSJ9LHsiY2hhciI6IuW6lCJ9LHsiY2hhciI6IueUqCJ9XSwiaXNSaWNoVGV4dCI6dHJ1ZSwia2VlcExpbmVCcmVhayI6dHJ1ZX19XQ==

[root@k8s-master01 calico]# kubectl apply -f calico.yaml

4）查看

5f39ae17-8c62-4a45-bc43-b32064c9388a:W3siYmxvY2tJZCI6IjgwMTUtMTU1NjI0ODM3NjM3NCIsImJsb2NrVHlwZSI6InBhcmFncmFwaCIsInN0eWxlcyI6e30sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoiNCJ9LHsiY2hhciI6Iu+8iSJ9LHsiY2hhciI6IuafpSJ9LHsiY2hhciI6IueciyJ9XSwiaXNSaWNoVGV4dCI6dHJ1ZSwia2VlcExpbmVCcmVhayI6dHJ1ZX19XQ==

[root@k8s-master01 ~]# kubectl get po -n kube-system -o wide

NAME                                       READY   STATUS    RESTARTS   AGE   IP           NODE         NOMINATED NODE   READINESS GATES

calico-kube-controllers-75569d87d7-lxmgq   /     Running             70s   10.10.0.22   k8s-node02   <none>           <none>

calico-node-lhmt8                          /     Running             70s   10.10.0.22   k8s-node02   <none>           <none>

calico-node-nkmh2                          /     Running             70s   10.10.0.21   k8s-node01   <none>           <none>

5）验证集群状态

5f39ae17-8c62-4a45-bc43-b32064c9388a:W3siYmxvY2tJZCI6IjQwOTAtMTU1NjI0ODM5MzI3OCIsImJsb2NrVHlwZSI6InBhcmFncmFwaCIsInN0eWxlcyI6e30sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoiNSJ9LHsiY2hhciI6Iu+8iSJ9LHsiY2hhciI6IumqjCJ9LHsiY2hhciI6IuivgSJ9LHsiY2hhciI6IumbhiJ9LHsiY2hhciI6Iue+pCJ9LHsiY2hhciI6IueKtiJ9LHsiY2hhciI6IuaAgSJ9XSwiaXNSaWNoVGV4dCI6dHJ1ZSwia2VlcExpbmVCcmVhayI6dHJ1ZX19XQ==

## 查看node是否为就绪状态

[root@k8s-master01 ~]# kubectl get nodes

NAME         STATUS     ROLES    AGE   VERSION

k8s-node01   Ready      <none>   19h   v1.14.1

k8s-node02   Ready      <none>   18h   v1.14.1

5f39ae17-8c62-4a45-bc43-b32064c9388a:W3siYmxvY2tJZCI6IjU3MjAtMTU1NjI0NjY0ODA2NCIsImJsb2NrVHlwZSI6InBhcmFncmFwaCIsInN0eWxlcyI6e30sInR5cGUiOiJwYXJhZ3JhcGgiLCJyaWNoVGV4dCI6eyJkYXRhIjpbeyJjaGFyIjoiMiJ9LHsiY2hhciI6Iu+8iSJ9LHsiY2hhciI6IuS/riJ9LHsiY2hhciI6IuaUuSJ9LHsiY2hhciI6IumFjSJ9LHsiY2hhciI6Iue9riJ9XSwiaXNSaWNoVGV4dCI6dHJ1ZSwia2VlcExpbmVCcmVhayI6dHJ1ZX19XQ==