操作步骤
升级CentOS内核（建议使用ubuntu server）如果是CentOS做如下升级
红帽企业版 Linux 仓库网站https://www.elrepo.org，CentOS7 内核升级。如下按照网站提示载入elrepo公钥及最新elrepo版本，然后按步骤升级内核（以安装长期支持版本 kernel-lt 为例）
# 载入公钥
rpm —import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# 安装ELRepo
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
# 载入elrepo-kernel元数据
yum --disablerepo=\* --enablerepo=elrepo-kernel repolist
# 查看可用的rpm包
yum --disablerepo=\* --enablerepo=elrepo-kernel list kernel*
# 安装长期支持版本的kernel
yum --disablerepo=\* --enablerepo=elrepo-kernel install -y kernel-lt.x86_64
# 删除旧版本工具包
yum remove kernel-tools-libs.x86_64 kernel-tools.x86_64 -y
# 安装新版本工具包
yum --disablerepo=\* --enablerepo=elrepo-kernel install -y kernel-lt-tools.x86_64
#查看默认启动顺序
awk -F\' '$1=="menuentry " {print $2}' /etc/grub2.cfg
CentOS Linux (4.4.183-1.el7.elrepo.x86_64) 7 (Core)
CentOS Linux (3.10.0-327.10.1.el7.x86_64) 7 (Core)
CentOS Linux (0-rescue-c52097a1078c403da03b8eddeac5080b) 7 (Core)
#默认启动的顺序是从0开始，新内核是从头插入（目前位置在0，而4.4.4的是在1），所以需要选择0。
grub2-set-default 0
#重启并检查
reboot在ansible控制端配置免密码登录
# 使用 Ed25519 算法
ssh-keygen -t ed25519 -N '' -f ~/.ssh/id_ed25519
ssh-copy-id $IPs #$IPs为所有节点地址包括自身，按照提示输入yes 和root密码每个节点安装依赖工具
# 文档中脚本默认均以root用户执行
yum update
# 安装python
yum install python -y在ansible控制端安装及准备ansible
# CentOS 7
yum install git python-pip -y
# pip安装ansible(国内如果安装太慢可以直接用pip阿里云加速)
pip install —upgrade -i https://mirrors.aliyun.com/
pypi/simple/ pip
#or
pip install --upgrade pip
pip install --upgrade setuptools
pip install ansible==2.6.18 netaddr==0.7.19在控制端下载安装脚本并下载软件
curl -C- -fLO --retry 3 https://github.com/easzlab/kubeasz/releases/download/2.2.0/easzup
chmod +x easzup
./easzup -D进入/etc/ansible目录，并配置hosts
cd /etc/ansible
cp example/hosts.multi-node hosts配置如下：
# 'etcd' cluster should have odd member(s) (1,3,5,...)
# variable 'NODE_NAME' is the distinct name of a member in 'etcd' cluster
[etcd]
10.5.1.10 ansible_ssh_port=7642 NODE_NAME=etcd1
10.5.1.11 ansible_ssh_port=7642 NODE_NAME=etcd2
10.5.1.12 ansible_ssh_port=7642 NODE_NAME=etcd3
# master node(s)
[kube-master]
10.5.1.10 ansible_ssh_port=7642
10.5.1.11 ansible_ssh_port=7642
# work node(s)
[kube-node]
10.5.1.12 ansible_ssh_port=7642
10.5.1.13 ansible_ssh_port=7642
# [optional] harbor server, a private docker registry
# 'NEW_INSTALL': 'yes' to install a harbor server; 'no' to integrate with existed one
# 'SELF_SIGNED_CERT': 'no' you need put files of certificates named harbor.pem and harbor-key.pem in directory 'down'
[harbor]
#192.168.1.8 HARBOR_DOMAIN="harbor.yourdomain.com" NEW_INSTALL=no SELF_SIGNED_CERT=yes
# [optional] loadbalance for accessing k8s from outside
[ex-lb]
#192.168.1.6 LB_ROLE=backup EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443
#192.168.1.7 LB_ROLE=master EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443
# [optional] ntp server for the cluster
[chrony]
10.5.1.10 ansible_ssh_port=7642
[all:vars]
# --------- Main Variables ---------------
# Cluster container-runtime supported: docker, containerd
CONTAINER_RUNTIME="docker"
# Network plugins supported: calico, flannel, kube-router, cilium, kube-ovn
CLUSTER_NETWORK="calico"
# Service proxy mode of kube-proxy: 'iptables' or 'ipvs'
PROXY_MODE="ipvs"
# K8S Service CIDR, not overlap with node(host) networking
SERVICE_CIDR="192.168.0.0/16"
# Cluster CIDR (Pod CIDR), not overlap with node(host) networking
CLUSTER_CIDR="172.20.0.0/16"
# NodePort Range
NODE_PORT_RANGE="20000-40000"
# Cluster DNS Domain
CLUSTER_DNS_DOMAIN="cluster.local."
# -------- Additional Variables (don't change the default value right now) ---
# Binaries Directory
bin_dir="/opt/kube/bin"
# CA and other components cert/key Directory
ca_dir="/etc/kubernetes/ssl"
# Deploy Directory (kubeasz workspace)
base_dir="/etc/ansible"执行安装
ansible-playbook 90.setup.yml打开master调度
kubectl patch node 10.5.1.11 -p '{"spec":{"unschedulable":false}}'增加node节点
/etc/ansible/hosts文件 [kube-node] 组下添加一行
10.5.1.14 ansible_ssh_port=7642执行以下命令：
ansible-playbook /etc/ansible/tools/02.addnode.yml -e NODE_TO_ADD=10.5.1.14增加etcd节点
#执行以下命令，并输入唯一的etcd名称
[root@k8s-sre-d01 tools]# ./easzctl add-etcd 10.1.1.200
[INFO] Action: add a etcd node : add-etcd 10.1.1.200
Please input an UNIQUE name(string) for the new node:
etcd5删除node节点
ansible-playbook roles/clean/clean_node.yml \
-e NODE_TO_CLEAN=10.5.1.16 \
-e DEL_NODE=yes \
-e DEL_LB=yes如果API SERVER要提供给外部集群使用，修改证书的方法
有的时候（比如apiserver地址通过边界防火墙的NAT转换成公网IP访问，或者需要添加公网域名访问）我们需要APISERVER（MASTER）证书中添加一些域名或者IP，可以方便操作如下：
修改*roles/kube-master/defaults/main.yml*，加入公网ip或域名
# k8s 集群 master 节点证书配置，可以添加多个ip和域名（比如增加公网ip和域名）
MASTER_CERT_HOSTS:
- “api-server.yourdomain.com”
#- “61.182.11.41”
#- “www.test.com”执行生成新证书：
ansible-playbook 04.kube-master.yml -t change_cert
# 新证书生效需要重启kube-apiserver.service
ansible-playbook 04.kube-master.yml -t restart_master