Kubernetes部署-RKE自动化部署

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

一、简介

RKE：Rancher Kubernetes Engine

一个极其简单，闪电般快速的Kubernetes安装程序，可在任何地方使用。

二、准备工作

I、配置系统

系统：CentOS 7 / Ubuntu

配置完系统后安装必要的软件：

yum install lvm2 parted lrzsz -y # 查看需要配置的磁盘 fdisk -l # 如：/dev/sda fdisk /dev/sda # 根据提示进行分区 # 配置lvm卷 pvcreate /dev/sda1 vgcreate disk1 /dev/sda1 lvcreate -n data -l +100%FREE disk1 # 格式化磁盘 mkfs.xfs /dev/disk1/data # 写入开机自动加载 diskuuid=`blkid /dev/disk1/data | awk '{print $2}' | tr -d '"'` echo "$diskuuid /data xfs defaults 0 0" >> /etc/fstab # 判断/data目录是否存在并挂载磁盘 [ -d /data ] || mkdir /data mount -a

II、安装docker

可以根据rancher提供的匹配版本进行安装：

DOCKER VERSION	INSTALL SCRIPT
18.09.2	`curl [https://releases.rancher.com/install-docker/18.09.2.sh](https://releases.rancher.com/install-docker/18.09.2.sh) \| sh`
18.06.2	`curl [https://releases.rancher.com/install-docker/18.06.2.sh](https://releases.rancher.com/install-docker/18.06.2.sh) \| sh`
17.03.2	`curl [https://releases.rancher.com/install-docker/17.03.2.sh](https://releases.rancher.com/install-docker/17.03.2.sh) \| sh`

也可以通过如下命令进行安装：

# 配置yum源 sudo yum remove docker docker-common docker-selinux docker-engine wget -O /etc/yum.repos.d/docker-ce.repo https://download.docker.com/linux/centos/docker-ce.repo sudo sed -i 's+download.docker.com+mirrors.tuna.tsinghua.edu.cn/docker-ce+' /etc/yum.repos.d/docker-ce.repo yum install -y -q docker-ce-18.09.2 # 此处指定你要安装的版本即可

配置docker的daemon.json文件：

systemctl enable docker systemctl start docker echo '''{ "data-root": "/data/docker", "log-driver": "json-file", "log-opts": { "max-size": "100m", "max-file": "3" }, "registry-mirrors": [ "https://hub-mirror.c.163.com", "https://docker.mirrors.ustc.edu.cn", "https://dockerhub.azk8s.cn" ] }''' > /etc/docker/daemon.json [ -d /data/docker ] || mkdir /data/docker systemctl restart docker

至此，基本环境已经配置完成。

三、安装配置

假设初始化环境如下：

IP	系统
192.168.0.1	CentOS 7
192.168.0.2	CentOS 7
192.168.0.3	CentOS 7

首先需要配置进行集群创建的用户以及免密登陆：

useradd admin usermod -aG docker admin su - admin cd .ssh/ ssh-keygen -t rsa # 一路回车完成配置 echo <PublicKeys> >> /home/admin/.ssh/authorized_keys

配置完免密登陆，我们需要下载rke软件并进行集群配置文件设置：

# 下载rke软件 # github地址：https://github.com/rancher/rke wget https://github.com/rancher/rke/releases/download/v1.0.4/rke_linux-amd64 ln -s rke_linux-amd64 /usr/local/bin/rke # 配置rke配置文件 [ -d /data/k8s ] || mkdir /data/k8s ; cd /data/k8s rke config --name cluster.yml # 按照提示进行rke配置 # 完整配置后 rke up # 等待安装完成

rke cluster.yml的示例：

官方示例一：

nodes: - address: 1.1.1.1 user: ubuntu role: - controlplane - etcd ssh_key_path: /home/user/.ssh/id_rsa port: 2222 - address: 2.2.2.2 user: ubuntu role: - worker ssh_key: |- -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- - address: example.com user: ubuntu role: - worker hostname_override: node3 internal_address: 192.168.1.6 labels: app: ingress# If set to true, RKE will not fail when unsupported Docker version # are found ignore_docker_version: false# Cluster level SSH private key # Used if no ssh information is set for the node ssh_key_path: ~/.ssh/test# Enable use of SSH agent to use SSH private keys with passphrase # This requires the environment `SSH_AUTH_SOCK` configured pointing #to your SSH agent which has the private key added ssh_agent_auth: true# List of registry credentials # If you are using a Docker Hub registry, you can omit the `url` # or set it to `docker.io` # is_default set to `true` will override the system default # registry set in the global settings private_registries: - url: registry.com user: Username password: password is_default: true# Bastion/Jump host configuration bastion_host: address: x.x.x.x user: ubuntu port: 22 ssh_key_path: /home/user/.ssh/bastion_rsa # or # ssh_key: |- # -----BEGIN RSA PRIVATE KEY----- # # -----END RSA PRIVATE KEY-----# Set the name of the Kubernetes cluster cluster_name: mycluster# The Kubernetes version used. The default versions of Kubernetes # are tied to specific versions of the system images. # # For RKE v0.2.x and below, the map of Kubernetes versions and their system images is # located here: # https://github.com/rancher/types/blob/release/v2.2/apis/management.cattle.io/v3/k8s_defaults.go # # For RKE v0.3.0 and above, the map of Kubernetes versions and their system images is # located here: # https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go # # In case the kubernetes_version and kubernetes image in # system_images are defined, the system_images configuration # will take precedence over kubernetes_version. kubernetes_version: v1.10.3-rancher2# System Images are defaulted to a tag that is mapped to a specific # Kubernetes Version and not required in a cluster.yml. # Each individual system image can be specified if you want to use a different tag. # # For RKE v0.2.x and below, the map of Kubernetes versions and their system images is # located here: # https://github.com/rancher/types/blob/release/v2.2/apis/management.cattle.io/v3/k8s_defaults.go # # For RKE v0.3.0 and above, the map of Kubernetes versions and their system images is # located here: # https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go # system_images: kubernetes: rancher/hyperkube:v1.10.3-rancher2 etcd: rancher/coreos-etcd:v3.1.12 alpine: rancher/rke-tools:v0.1.9 nginx_proxy: rancher/rke-tools:v0.1.9 cert_downloader: rancher/rke-tools:v0.1.9 kubernetes_services_sidecar: rancher/rke-tools:v0.1.9 kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.8 dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.8 kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.8 kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0 pod_infra_container: rancher/pause-amd64:3.1services: etcd: # if external etcd is used # path: /etcdcluster # external_urls: # - https://etcd-example.com:2379 # ca_cert: |- # -----BEGIN CERTIFICATE----- # xxxxxxxxxx # -----END CERTIFICATE----- # cert: |- # -----BEGIN CERTIFICATE----- # xxxxxxxxxx # -----END CERTIFICATE----- # key: |- # -----BEGIN PRIVATE KEY----- # xxxxxxxxxx # -----END PRIVATE KEY----- # Note for Rancher v2.0.5 and v2.0.6 users: If you are configuring # Cluster Options using a Config File when creating Rancher Launched # Kubernetes, the names of services should contain underscores # only: `kube_api`. kube-api: # IP range for any services created on Kubernetes # This must match the service_cluster_ip_range in kube-controller service_cluster_ip_range: 10.43.0.0/16 # Expose a different port range for NodePort services service_node_port_range: 30000-32767 pod_security_policy: false # Add additional arguments to the kubernetes API server # This WILL OVERRIDE any existing defaults extra_args: # Enable audit log to stdout audit-log-path: "-" # Increase number of delete workers delete-collection-workers: 3 # Set the level of log output to debug-level v: 4 # Note for Rancher 2 users: If you are configuring Cluster Options # using a Config File when creating Rancher Launched Kubernetes, # the names of services should contain underscores only: # `kube_controller`. This only applies to Rancher v2.0.5 and v2.0.6. kube-controller: # CIDR pool used to assign IP addresses to pods in the cluster cluster_cidr: 10.42.0.0/16 # IP range for any services created on Kubernetes # This must match the service_cluster_ip_range in kube-api service_cluster_ip_range: 10.43.0.0/16 kubelet: # Base domain for the cluster cluster_domain: cluster.local # IP address for the DNS service endpoint cluster_dns_server: 10.43.0.10 # Fail if swap is on fail_swap_on: false # Set max pods to 250 instead of default 110 extra_args: max-pods: 250 # Optionally define additional volume binds to a service extra_binds: - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins"# Currently, only authentication strategy supported is x509. # You can optionally create additional SANs (hostnames or IPs) to # add to the API server PKI certificate. # This is useful if you want to use a load balancer for the # control plane servers. authentication: strategy: x509 sans: - "10.18.160.10" - "my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com"# Kubernetes Authorization mode # Use `mode: rbac` to enable RBAC # Use `mode: none` to disable authorization authorization: mode: rbac# If you want to set a Kubernetes cloud provider, you specify # the name and configuration cloud_provider: name: aws# Add-ons are deployed using kubernetes jobs. RKE will give # up on trying to get the job status after this timeout in seconds.. addon_job_timeout: 30# Specify network plugin-in (canal, calico, flannel, weave, or none) network: plugin: canal# Specify DNS provider (coredns or kube-dns) dns: provider: coredns# Currently only nginx ingress provider is supported. # To disable ingress controller, set `provider: none` # `node_selector` controls ingress placement and is optional ingress: provider: nginx node_selector: app: ingress# All add-on manifests MUST specify a namespace addons: |- --- apiVersion: v1 kind: Pod metadata: name: my-nginx namespace: default spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80addons_include: - https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-operator.yaml - https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-cluster.yaml - /path/to/manifest

官方示例二：（主要是为了着重展示扩展参数！）

nodes: - address: 1.1.1.1 internal_address: user: ubuntu role: - controlplane - etcd ssh_key_path: /home/user/.ssh/id_rsa port: 2222 - address: 2.2.2.2 internal_address: user: ubuntu role: - worker ssh_key: |- -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- - address: example.com internal_address: user: ubuntu role: - worker hostname_override: node3 internal_address: 192.168.1.6 labels: app: ingress app: dns# 如果设置为true，则可以使用不受支持的Docker版本 ignore_docker_version: false# 集群等级的SSH私钥(private key) ## 如果节点未配置SSH私钥，RKE将会以此私钥去连接集群节点 ssh_key_path: ~/.ssh/test# 使用SSH agent来提供SSH私钥 ## 需要配置环境变量`SSH_AUTH_SOCK`指向已添加私钥的SSH agent ssh_agent_auth: false# 配置docker root目录 docker_root_dir: "/var/lib/docker"# 私有仓库 ## 当设置`is_default: true`后，构建集群时会自动在配置的私有仓库中拉取镜像 ## 如果使用的是DockerHub镜像仓库，则可以省略`url`或将其设置为`docker.io` ## 如果使用内部公开仓库，则可以不用设置用户名和密码private_registries: - url: registry.com user: Username password: password is_default: true# 堡垒机 ## 如果集群节点需要通过堡垒机跳转，那么需要为RKE配置堡垒机信息 bastion_host: address: x.x.x.x user: ubuntu port: 22 ssh_key_path: /home/user/.ssh/bastion_rsa # or # ssh_key: |- # -----BEGIN RSA PRIVATE KEY----- # # -----END RSA PRIVATE KEY-----# 设置Kubernetes集群名称# 定义kubernetes版本. ## 目前, 版本定义需要与rancher/types defaults map相匹配: https://github.com/rancher/types/blob/master/apis/management.cattle.io/v3/k8s_defaults.go#L14 （后期版本请查看: https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go ） ## 如果同时定义了kubernetes_version和system_images中的kubernetes镜像，则system_images配置将优先于kubernetes_version kubernetes_version: v1.14.3-rancher1# `system_images`优先级更高，如果没有单独指定`system_images`镜像，则会使用`kubernetes_version`对应的默认镜像版本。 ## 默认Tags: https://github.com/rancher/types/blob/master/apis/management.cattle.io/v3/k8s_defaults.go)(Rancher v2.3或者RKE v0.3之后的版本请查看: https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_rke_system_images.go ） system_images: etcd: rancher/coreos-etcd:v3.3.10-rancher1 alpine: rancher/rke-tools:v0.1.34 nginx_proxy: rancher/rke-tools:v0.1.34 cert_downloader: rancher/rke-tools:v0.1.34 kubernetes_services_sidecar: rancher/rke-tools:v0.1.34 kubedns: rancher/k8s-dns-kube-dns:1.15.0 dnsmasq: rancher/k8s-dns-dnsmasq-nanny:1.15.0 kubedns_sidecar: rancher/k8s-dns-sidecar:1.15.0 kubedns_autoscaler: rancher/cluster-proportional-autoscaler:1.3.0 coredns: rancher/coredns-coredns:1.3.1 coredns_autoscaler: rancher/cluster-proportional-autoscaler:1.3.0 kubernetes: rancher/hyperkube:v1.14.3-rancher1 flannel: rancher/coreos-flannel:v0.10.0-rancher1 flannel_cni: rancher/flannel-cni:v0.3.0-rancher1 calico_node: rancher/calico-node:v3.4.0 calico_cni: rancher/calico-cni:v3.4.0 calico_controllers: "" calico_ctl: rancher/calico-ctl:v2.0.0 canal_node: rancher/calico-node:v3.4.0 canal_cni: rancher/calico-cni:v3.4.0 canal_flannel: rancher/coreos-flannel:v0.10.0 weave_node: weaveworks/weave-kube:2.5.0 weave_cni: weaveworks/weave-npc:2.5.0 pod_infra_container: rancher/pause:3.1 ingress: rancher/nginx-ingress-controller:0.21.0-rancher3 ingress_backend: rancher/nginx-ingress-controller-defaultbackend:1.5-rancher1 metrics_server: rancher/metrics-server:v0.3.1services: etcd: # if external etcd is used # path: /etcdcluster # external_urls: # - https://etcd-example.com:2379 # ca_cert: |- # -----BEGIN CERTIFICATE----- # xxxxxxxxxx # -----END CERTIFICATE----- # cert: |- # -----BEGIN CERTIFICATE----- # xxxxxxxxxx # -----END CERTIFICATE----- # key: |- # -----BEGIN PRIVATE KEY----- # xxxxxxxxxx # -----END PRIVATE KEY----- # Rancher 2用户注意事项：如果在创建Rancher Launched Kubernetes时使用配置文件配置集群，则`kube_api`服务名称应仅包含下划线。这仅适用于Rancher v2.0.5和v2.0.6。 # 以下参数仅支持RKE部署的etcd集群 # 开启自动备份 ## rke版本小于0.2.x或rancher版本小于v2.2.0时使用 snapshot: true creation: 5m0s retention: 24h ## rke版本大于等于0.2.x或rancher版本大于等于v2.2.0时使用(两段配置二选一) backup_config: enabled: true # 设置true启用ETCD自动备份，设置false禁用； interval_hours: 12 # 快照创建间隔时间，不加此参数，默认5分钟； retention: 6 # etcd备份保留份数； # S3配置选项 s3backupconfig: access_key: "myaccesskey" secret_key: "myaccesssecret" bucket_name: "my-backup-bucket" folder: "folder-name" # 此参数v2.3.0之后可用 endpoint: "s3.eu-west-1.amazonaws.com" region: "eu-west-1" # 扩展参数 extra_args: auto-compaction-retention: 240 #(单位小时) # 修改空间配额为$((6*1024*1024*1024))，默认2G,最大8G quota-backend-bytes: '6442450944' kube-api: # cluster_ip范围 ## 这必须与kube-controller中的service_cluster_ip_range匹配 service_cluster_ip_range: 10.43.0.0/16 # NodePort映射的端口范围 service_node_port_range: 30000-32767 # Pod安全策略 pod_security_policy: false # kubernetes API server扩展参数 ## 这些参数将会替换默认值 extra_args: watch-cache: true default-watch-cache-size: 1500 # 事件保留时间，默认1小时 event-ttl: 1h0m0s # 默认值400，设置0为不限制，一般来说，每25~30个Pod有15个并行 max-requests-inflight: 800 # 默认值200，设置0为不限制 max-mutating-requests-inflight: 400 # kubelet操作超时，默认5s kubelet-timeout: 5s # 启用审计日志到标准输出 audit-log-path: "-" # 增加删除workers的数量 delete-collection-workers: 3 # 将日志输出的级别设置为debug模式 v: 4 # Rancher 2用户注意事项：如果在创建Rancher Launched Kubernetes时使用配置文件配置集群，则`kube_controller`服务名称应仅包含下划线。这仅适用于Rancher v2.0.5和v2.0.6。 kube-controller: # Pods_ip范围 cluster_cidr: 10.42.0.0/16 # cluster_ip范围 ## 这必须与kube-api中的service_cluster_ip_range相同 service_cluster_ip_range: 10.43.0.0/16 extra_args: # 修改每个节点子网大小(cidr掩码长度)，默认为24，可用IP为254个；23，可用IP为510个；22，可用IP为1022个； node-cidr-mask-size: '24' feature-gates: "TaintBasedEvictions=false" # 控制器定时与节点通信以检查通信是否正常，周期默认5s node-monitor-period: '5s' ## 当节点通信失败后，再等一段时间kubernetes判定节点为notready状态。 ## 这个时间段必须是kubelet的nodeStatusUpdateFrequency(默认10s)的整数倍， ## 其中N表示允许kubelet同步节点状态的重试次数，默认40s。 node-monitor-grace-period: '20s' ## 再持续通信失败一段时间后，kubernetes判定节点为unhealthy状态，默认1m0s。 node-startup-grace-period: '30s' ## 再持续失联一段时间，kubernetes开始迁移失联节点的Pod，默认5m0s。 pod-eviction-timeout: '1m' # 默认5. 同时同步的deployment的数量。 concurrent-deployment-syncs: 5 # 默认5. 同时同步的endpoint的数量。 concurrent-endpoint-syncs: 5 # 默认20. 同时同步的垃圾收集器工作器的数量。 concurrent-gc-syncs: 20 # 默认10. 同时同步的命名空间的数量。 concurrent-namespace-syncs: 10 # 默认5. 同时同步的副本集的数量。 concurrent-replicaset-syncs: 5 # 默认5m0s. 同时同步的资源配额数。（新版本中已弃用） # concurrent-resource-quota-syncs: 5m0s # 默认1. 同时同步的服务数。 concurrent-service-syncs: 1 # 默认5. 同时同步的服务帐户令牌数。 concurrent-serviceaccount-token-syncs: 5 # 默认5. 同时同步的复制控制器的数量 concurrent-rc-syncs: 5 # 默认30s. 同步deployment的周期。 deployment-controller-sync-period: 30s # 默认15s。同步PV和PVC的周期。 pvclaimbinder-sync-period: 15s kubelet: # 集群搜索域 cluster_domain: cluster.local # 内部DNS服务器地址 cluster_dns_server: 10.43.0.10 # 禁用swap fail_swap_on: false # 扩展变量 extra_args: # 支持静态Pod。在主机/etc/kubernetes/目录下创建manifest目录，Pod YAML文件放在/etc/kubernetes/manifest/目录下 pod-manifest-path: "/etc/kubernetes/manifest/" root-dir: "/var/lib/kubelet" docker-root: "/var/lib/docker" feature-gates: "TaintBasedEvictions=false" # 指定pause镜像 pod-infra-container-image: 'rancher/pause:3.1' # 传递给网络插件的MTU值，以覆盖默认值，设置为0(零)则使用默认的1460 network-plugin-mtu: '1500' # 修改节点最大Pod数量 max-pods: "250" # 密文和配置映射同步时间，默认1分钟 sync-frequency: '3s' # Kubelet进程可以打开的文件数（默认1000000）,根据节点配置情况调整 max-open-files: '2000000' # 与apiserver会话时的并发数，默认是10 kube-api-burst: '30' # 与apiserver会话时的 QPS,默认是5，QPS = 并发量/平均响应时间 kube-api-qps: '15' # kubelet默认一次拉取一个镜像，设置为false可以同时拉取多个镜像， # 前提是存储驱动要为overlay2，对应的Dokcer也需要增加下载并发数，参考[docker配置](/rancher2x/install-prepare/best-practices/docker/) serialize-image-pulls: 'false' # 拉取镜像的最大并发数，registry-burst不能超过registry-qps ， # 仅当registry-qps大于0(零)时生效，(默认10)。如果registry-qps为0则不限制(默认5)。 registry-burst: '10' registry-qps: '0' cgroups-per-qos: 'true' cgroup-driver: 'cgroupfs' # 节点资源预留 enforce-node-allocatable: 'pods' system-reserved: 'cpu=0.25,memory=200Mi' kube-reserved: 'cpu=0.25,memory=1500Mi' # POD驱逐，这个参数只支持内存和磁盘。 ## 硬驱逐阈值 ### 当节点上的可用资源降至保留值以下时，就会触发强制驱逐。强制驱逐会强制kill掉POD，不会等POD自动退出。 eviction-hard: 'memory.available<300Mi,nodefs.available<10%,imagefs.available<15%,nodefs.inodesFree<5%' ## 软驱逐阈值 ### 以下四个参数配套使用，当节点上的可用资源少于这个值时但大于硬驱逐阈值时候，会等待eviction-soft-grace-period设置的时长； ### 等待中每10s检查一次，当最后一次检查还触发了软驱逐阈值就会开始驱逐，驱逐不会直接Kill POD，先发送停止信号给POD，然后等待eviction-max-pod-grace-period设置的时长； ### 在eviction-max-pod-grace-period时长之后，如果POD还未退出则发送强制kill POD" eviction-soft: 'memory.available<500Mi,nodefs.available<50%,imagefs.available<50%,nodefs.inodesFree<10%' eviction-soft-grace-period: 'memory.available=1m30s' eviction-max-pod-grace-period: '30' eviction-pressure-transition-period: '30s' # 指定kubelet多长时间向master发布一次节点状态。注意: 它必须与kube-controller中的nodeMonitorGracePeriod一起协调工作。(默认 10s) node-status-update-frequency: 10s # 设置cAdvisor全局的采集行为的时间间隔，主要通过内核事件来发现新容器的产生。默认1m0s global-housekeeping-interval: 1m0s # 每个已发现的容器的数据采集频率。默认10s housekeeping-interval: 10s # 所有运行时请求的超时，除了长时间运行的 pull, logs, exec and attach。超时后，kubelet将取消请求，抛出错误，然后重试。(默认2m0s) runtime-request-timeout: 2m0s # 指定kubelet计算和缓存所有pod和卷的卷磁盘使用量的间隔。默认为1m0s volume-stats-agg-period: 1m0s # 可以选择定义额外的卷绑定到服务 extra_binds: - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins" - "/etc/iscsi:/etc/iscsi" - "/sbin/iscsiadm:/sbin/iscsiadm" kubeproxy: extra_args: # 默认使用iptables进行数据转发，如果要启用ipvs，则此处设置为`ipvs` proxy-mode: "" # 与kubernetes apiserver通信并发数,默认10 kube-api-burst: 20 # 与kubernetes apiserver通信时使用QPS，默认值5，QPS=并发量/平均响应时间 kube-api-qps: 10 extra_binds: scheduler: extra_args: {} extra_binds: [] extra_env: []# 目前，只支持x509验证 ## 您可以选择创建额外的SAN(主机名或IP)以添加到API服务器PKI证书。 ## 如果要为control plane servers使用负载均衡器，这很有用。 authentication: strategy: "x509|webhook" webhook: config_file: "...." cache_timeout: 5s sans: # 此处配置备用域名或IP，当主域名或者IP无法访问时，可通过备用域名或IP访问 - "192.168.1.100" - "www.test.com" # Kubernetes认证模式 ## Use `mode: rbac` 启用 RBAC ## Use `mode: none` 禁用认证 authorization: mode: rbac # 如果要设置Kubernetes云提供商，需要指定名称和配置，非云主机则留空； cloud_provider: # Add-ons是通过kubernetes jobs来部署。在超时后，RKE将放弃重试获取job状态。以秒为单位。 addon_job_timeout: 30 # 有几个网络插件可以选择：`flannel、canal、calico`，Rancher2默认canal network: # rke v1.0.4+ 可用，如果选择canal网络驱动，需要设置mtu为1450 mtu: 1450 plugin: canal options: flannel_backend_type: "vxlan" # 目前只支持nginx ingress controller ## 可以设置`provider: none`来禁用ingress controller ingress: provider: nginx node_selector: app: ingress # 配置dns上游dns服务器 ## 可用rke版本 v0.2.0 dns: provider: coredns upstreamnameservers: - 114.114.114.114 - 1.2.4.8 node_selector: app: dns # 安装附加应用 ## 所有附加应用都必须指定命名空间 addons: |- --- apiVersion: v1 kind: Pod metadata: namespace: default spec: containers: image: nginx ports: - containerPort: 80addons_include: - https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-operator.yml - https://raw.githubusercontent.com/rook/rook/master/cluster/examples/kubernetes/rook-cluster.yml - /path/to/manifest

个人示例：

nodes: - address: 192.168.0.1 port: "22" internal_address: 192.168.0.1 role: - controlplane - etcd - worker hostname_override: 192.168.0.1 user: admin docker_socket: /var/run/docker.sock ssh_key: "" ssh_key_path: "" ssh_cert: "" ssh_cert_path: "" labels: {} taints: [] - address: 192.168.0.2 port: "22" internal_address: 192.168.0.2 role: - controlplane - etcd - worker hostname_override: 192.168.0.2 user: admin docker_socket: /var/run/docker.sock ssh_key: "" ssh_key_path: "" ssh_cert: "" ssh_cert_path: "" labels: {} taints: [] - address: 192.168.0.3 port: "22" internal_address: 192.168.0.3 role: - controlplane - etcd - worker hostname_override: 192.168.0.3 user: admin docker_socket: /var/run/docker.sock ssh_key: "" ssh_key_path: "" ssh_cert: "" ssh_cert_path: "" labels: {} taints: [] services: etcd: image: "" extra_args: {} extra_binds: [] extra_env: [] external_urls: [] ca_cert: "" cert: "" key: "" path: "" uid: 0 gid: 0 snapshot: null retention: "" creation: "" backup_config: null kube-api: image: "" extra_args: {} extra_binds: [] extra_env: [] service_cluster_ip_range: 172.26.96.0/20 service_node_port_range: "30000-40000" pod_security_policy: false always_pull_images: false secrets_encryption_config: null audit_log: null admission_configuration: null event_rate_limit: null kube-controller: image: "" extra_args: {} extra_args: # 修改每个节点子网大小(cidr掩码长度)，默认为24，可用IP为254个；23，可用IP为510个；22，可用IP为1022个； node-cidr-mask-size: '25' extra_binds: [] extra_env: [] cluster_cidr: 172.26.112.0/20 service_cluster_ip_range: 172.26.96.0/20 scheduler: image: "" extra_args: {} extra_binds: [] extra_env: [] kubelet: image: "" extra_args: # 修改节点最大Pod数量 max-pods: "120" extra_binds: [] extra_env: [] cluster_domain: cluster.local infra_container_image: "" cluster_dns_server: 172.26.96.10 fail_swap_on: false generate_serving_certificate: false kubeproxy: image: "" extra_args: {} extra_binds: [] extra_env: [] network: plugin: flannel options: {} mtu: 0 node_selector: {} authentication: strategy: x509 sans: [] webhook: null # All add-on manifests MUST specify a namespace addons: |- --- apiVersion: v1 kind: ConfigMap metadata: labels: app: flannel tier: node name: kube-flannel-cfg namespace: kube-system data: cni-conf.json: | { "name": "cbr0", "cniVersion":"0.3.1", "plugins": [ { "type": "flannel", "delegate": { "hairpinMode": true, "isDefaultGateway": true } }, { "type": "portmap", "capabilities": { "portMappings": true } } ] } net-conf.json: | { "Network": "172.26.112.0/20", "Backend": { "Type": "vxlan", "VNI": 1, "Port": 8472 } } addons_include: [] system_images: etcd: rancher/coreos-etcd:v3.4.3-rancher1 alpine: rancher/rke-tools:v0.1.52 nginx_proxy: rancher/rke-tools:v0.1.52 cert_downloader: rancher/rke-tools:v0.1.52 kubernetes_services_sidecar: rancher/rke-tools:v0.1.52 kubedns: rancher/k8s-dns-kube-dns:1.15.0 dnsmasq: rancher/k8s-dns-dnsmasq-nanny:1.15.0 kubedns_sidecar: rancher/k8s-dns-sidecar:1.15.0 kubedns_autoscaler: rancher/cluster-proportional-autoscaler:1.7.1 coredns: rancher/coredns-coredns:1.6.5 coredns_autoscaler: rancher/cluster-proportional-autoscaler:1.7.1 kubernetes: rancher/hyperkube:v1.17.2-rancher1 flannel: rancher/coreos-flannel:v0.11.0-rancher1 flannel_cni: rancher/flannel-cni:v0.3.0-rancher5 calico_node: rancher/calico-node:v3.10.2 calico_cni: rancher/calico-cni:v3.10.2 calico_controllers: rancher/calico-kube-controllers:v3.10.2 calico_ctl: rancher/calico-ctl:v2.0.0 calico_flexvol: rancher/calico-pod2daemon-flexvol:v3.10.2 canal_node: rancher/calico-node:v3.10.2 canal_cni: rancher/calico-cni:v3.10.2 canal_flannel: rancher/coreos-flannel:v0.11.0 canal_flexvol: rancher/calico-pod2daemon-flexvol:v3.10.2 weave_node: weaveworks/weave-kube:2.5.2 weave_cni: weaveworks/weave-npc:2.5.2 pod_infra_container: rancher/pause:3.1 ingress: rancher/nginx-ingress-controller:nginx-0.25.1-rancher1 ingress_backend: rancher/nginx-ingress-controller-defaultbackend:1.5-rancher1 metrics_server: rancher/metrics-server:v0.3.6 windows_pod_infra_container: rancher/kubelet-pause:v0.1.3 ssh_key_path: ~/.ssh/id_rsa ssh_cert_path: "" ssh_agent_auth: false authorization: mode: rbac options: {} ignore_docker_version: true kubernetes_version: "" private_registries: [] ingress: provider: "" options: {} node_selector: {} extra_args: {} dns_policy: "" extra_envs: [] extra_volumes: [] extra_volume_mounts: [] cluster_name: "" cloud_provider: name: "" prefix_path: "" addon_job_timeout: 0 bastion_host: address: "" port: "" user: "" ssh_key: "" ssh_key_path: "" ssh_cert: "" ssh_cert_path: "" monitoring: provider: "" options: {} node_selector: {} restore: restore: false snapshot_name: "" dns: null