1、Helm是Kubernetes的包管理器

hostnamectl set-hostname master
yum install wget -y
wget https://get.helm.sh/helm-v3.3.1-linux-amd64.tar.gz
tar -zxvf helm-v3.3.1-linux-amd64.tar.gz
cp linux-amd64/helm /usr/local/bin/
yum install vim -y 
vim /etc/profile
# 末尾写入内容
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
# esc :wq 退出保存 执行
source /etc/profile
# 查看版本
helm version
# 添加仓库
helm repo add ali-stable  https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts 
helm repo update

2、NFS即网络文件系统

# ip:172.17.216.82 内网
yum install -y rpcbind nfs-utils
vim /etc/exports
# 写入以下内容
/root/nfs_root/ *(insecure,rw,sync,no_root_squash)
# 创建共享目录，如果要使用自己的目录，请替换本文档中所有的 /root/nfs_root/
mkdir /root/nfs_root
# 启动检查
systemctl enable rpcbind
systemctl enable nfs-server
systemctl start rpcbind
systemctl start nfs-server
exportfs -r
exportfs
# 输出结果如下所示
# /root/nfs_root /root/nfs_root

# 其他客户端节点，有多台服务器集群时选择安装
yum install -y nfs-utils
# showmount -e $(nfs服务器的IP)
showmount -e 172.17.216.82
# 输出结果如下所示
Export list for 172.17.216.82:
/root/nfs_root *

mkdir /root/nfsmount
# mount -t nfs $(nfs服务器的IP):/root/nfs_root /root/nfsmount
mount -t nfs 172.17.216.82:/root/nfs_root /root/nfsmount
# 写入一个测试文件
echo "hello nfs server" > /root/nfsmount/test.txt

3、K3s 轻量级的 Kubernetes 发行版

# 主节点安装
curl -sfL http://rancher-mirror.cnrancher.com/k3s/k3s-install.sh | INSTALL_K3S_MIRROR=cn INSTALL_K3S_EXEC="--disable traefik" sh -
# 添加node节点，在工作节点执行，myserver替换主节点ip，mynodetoken 主节点token
curl -sfL http://rancher-mirror.cnrancher.com/k3s/k3s-install.sh | INSTALL_K3S_MIRROR=cn K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -
# 查看主节点token
cat /var/lib/rancher/k3s/server/node-token

# server 节点卸载 K3s
/usr/local/bin/k3s-uninstall.sh 
# agent 节点卸载 K3s          
/usr/local/bin/k3s-agent-uninstall.sh
#查看k3s服务状态
systemctl status k3s
#重启k3s服务
systemctl restart k3s 

4、Kuboard, k8s面板 https://kuboard.cn/learning

kubectl apply -f https://addons.kuboard.cn/kuboard/kuboard-v3.yaml
# 查看是否就绪
kubectl get pods -n kuboard -o wide

在浏览器中打开链接 http://your-ip-address:30080，记得开放安全组端口， k8s端口范围30000-32767
输入初始用户名和密码，并登录
用户名： admin
密码： Kuboard123

image.png

image.png

5、traefik HTTP反向代理、负载均衡工具 , 也可以换成 ingress-nginx https://kubernetes.github.io/ingress-nginx/deploy/

helm repo add traefik https://containous.github.io/traefik-helm-chart
helm repo update
helm install traefik traefik/traefik -f traefik-v2-chart-values.yaml -n kube-system
# 主机名:master，nodeSelector 固定在master节点

# traefik-v2-chart-values.yaml
service:
  type: ClusterIP

ingressRoute:
  dashboard:
    enabled: false

nodeSelector:
  kubernetes.io/hostname: master

ports:
  web:
    hostPort: 80
  websecure:
    hostPort: 443
  traefik:
    port: 8080
    hostPort: 8080
    exposedPort: 8080
    expose: true

additionalArguments:
  - "--serversTransport.insecureSkipVerify=true"
  - "--api.insecure=true"
  - "--api.dashboard=true"

kubectl apply -f traefik-dashboard-ingress-route.yaml -n kube-system
# Host 替换为自己域名，解析到master主机

# traefik-dashboard-ingress-route.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-route
spec:
  entryPoints:
    - websecure
  tls:
    secretName: cloudfe-cert-tls
  routes:
    - match: Host(`traefik.renrenlol.com`)
      kind: Rule
      services:
        - name: traefik
          port: 8080

image.png

这里是刚才生成的，可以在此修改

image.png

image.png

配置https访问 , 可以去阿里云申请免费ssl证书

image.png

image.png

修改traefik-dashboard-ingress-route.yaml， secretName:创建的TLS密文名称

image.png

image.png

Traefik 中间件 BasicAuth 设置面板访问权限

yum -y install httpd-tools
# admin:$apr1$HwWTM7UI$Wq3j47.UEl0xe9TZfRWG2.
htpasswd -nb admin admin123
# test:$apr1$HnEisKFW$hIQTVJCukPNBJyGgc/.9Z/
htpasswd -nb test  test123
# 将加密的信息放入一个叫policy的文件
vim policy

# policy
admin:$apr1$HwWTM7UI$Wq3j47.UEl0xe9TZfRWG2.
test:$apr1$HnEisKFW$hIQTVJCukPNBJyGgc/.9Z/

# 进行base64加密，获得加密后的字符
cat policy | openssl base64

YWRtaW46JGFwcjEkSHdXVE03VUkkV3EzajQ3LlVFbDB4ZTlUWmZSV0cyLgp0ZXN0
OiRhcHIxJEhuRWlzS0ZXJGhJUVRWSkN1a1BOQkp5R2djLy45Wi8K

# traefik-basic-auth.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: traefik-basic-auth
spec:
  basicAuth:
    secret: authsecret
---
apiVersion: v1
kind: Secret
metadata:
  name: authsecret
data:
  users: |2
    YWRtaW46JGFwcjEkSHdXVE03VUkkV3EzajQ3LlVFbDB4ZTlUWmZSV0cyLgp0ZXN0
    OiRhcHIxJEhuRWlzS0ZXJGhJUVRWSkN1a1BOQkp5R2djLy45Wi8K

# traefik-dashboard-ingress-route.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-route
  namespace: kube-system
  resourceVersion: '9239'
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`traefik.renrenlol.com`)
      services:
        - name: traefik
          port: 8080
      middlewares:
        - name: traefik-basic-auth
  tls:
    secretName: traefik.renrenlol.com

kubectl apply -f traefik-basic-auth.yaml -n kube-system
kubectl apply -f traefik-dashboard-ingress-route.yaml -n kube-system

https访问, 用户名：admin 密码：admin123

image.png

http会出现404

image.png