Kubersphere基于现有Kubernetes集群安装最小化Kubersphere

【原文链接】Kubersphere----基于现有Kubernetes集群安装最小化Kubersphere

1.1 创建kubesphere-system命名空间

编辑文件 ks-namespace.yaml

apiVersion: v1
kind: Namespace
metadata:name: kubesphere-systemlabels:name: kubesphere-system


然后执行如下命令创建

kubectl apply -f ks-namespace.yaml


1.2 创建rbac授权

编辑sc-rbac.yaml

apiVersion: v1
kind: ServiceAccount
metadata:name: nfs-client-provisionernamespace: kubesphere-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:name: nfs-client-provisioner-cr
rules:- apiGroups: [""]resources: ["persistentvolumes"]verbs: ["get","list","watch","create","delete"]- apiGroups: [""]resources: ["persistentvolumeclaims"]verbs: ["get","list","watch","update"]- apiGroups: ["storage.k8s.io"]resources: ["storageclasses"]verbs: ["get","list","watch"]- apiGroups: [""]resources: ["events"]verbs: ["list","watch","create","update","patch"]- apiGroups: [""]resources: ["endpoints"]verbs: ["create","delete","get","list","watch","patch","update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:name: nfs-client-provisioner-crb
subjects:- kind: ServiceAccountname: nfs-client-provisionernamespace: kubesphere-system
roleRef:kind: ClusterRolename: nfs-client-provisioner-crapiGroup: rbac.authorization.k8s.io


执行如下命令创建

kubectl apply -f sc-rbac.yaml


1.3 创建storageclass的deployment

编辑 sc-deployment.yaml 文件&＃xff0c;内容如下&＃xff0c;这里主要需要注意设置如下位置

• NFS_SERVER 设置为安装nfs服务的服务器ip地址
• NFS_PATH 即安装nfs服务的时候创建的挂载目录
• volumes中的nfs同样需要配置对应的nfs环境信息

apiVersion: apps/v1
kind: Deployment
metadata:name: nfs-client-provisionernamespace: kubesphere-system
spec:replicas: 1selector:matchLabels:app: nfs-client-provisionerstrategy:type: Recreatetemplate:metadata:labels:app: nfs-client-provisionerspec:serviceAccountName: nfs-client-provisionercontainers:- name: nfs-client-provisionerimage: registry.cn-beijing.aliyuncs.com/xngczl/nfs-subdir-external-provisione:v4.0.0env:- name: PROVISIONER_NAMEvalue: nfs-storage-class- name: NFS_SERVERvalue: 192.168.16.40- name: NFS_PATHvalue: /root/data/nfs/storageclassvolumeMounts:- name: nfs-client-rootmountPath: /persistentvolumesvolumes:- name: nfs-client-rootnfs:server: 192.168.16.40path: /root/data/nfs/storageclass


然后执行如下命令部署

kubectl apply -f sc-deployment.yaml


1.4 创建StorageClass

编辑 sc-resource.yaml&＃xff0c;内容如下&＃xff0c;这里需要注意的是provisioner对应的值应该是步骤1.3中eenv中PROVISIONER_NAME变量设置的值

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:name: nfs-storageclass
provisioner: nfs-storage-class
allowVolumeExpansion: true
reclaimPolicy: Retain


然后执行如下命令创建

kubectl apply -f sc-resource.yaml


1.5 查看StorageClass

[root&＃64;master kubersphere]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-storageclass nfs-storage-class Retain Immediate true 33s
sc-nexus3 kubernetes.io/no-provisioner Delete WaitForFirstConsumer false 88d
[root&＃64;master kubersphere]#


1.6 设置默认的StorageClass

kubectl patch storageclass nfs-storageclass -p &＃39;{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}&＃39;


再次查看&＃xff0c;可以看到此时已经设置好默认的StorageClass了

[root&＃64;master kubersphere]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-storageclass (default) nfs-storage-class Retain Immediate true 2m6s
sc-nexus3 kubernetes.io/no-provisioner Delete WaitForFirstConsumer false 88d
[root&＃64;master kubersphere]#

二、部署最小化Kubersphere

2.1 下载kubersphere的配控文件

curl -L -O https://github.com/kubesphere/ks-installer/releases/download/v3.3.1/cluster-configuration.yamlcurl -L -O https://github.com/kubesphere/ks-installer/releases/download/v3.3.1/kubesphere-installer.yaml

2.2 kubersphere-installer.yaml 配置文件

注意这里不需要修改

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:name: clusterconfigurations.installer.kubesphere.io
spec:group: installer.kubesphere.ioversions:- name: v1alpha1served: truestorage: trueschema:openAPIV3Schema:type: objectproperties:spec:type: objectx-kubernetes-preserve-unknown-fields: truestatus:type: objectx-kubernetes-preserve-unknown-fields: truescope: Namespacednames:plural: clusterconfigurationssingular: clusterconfigurationkind: ClusterConfigurationshortNames:- cc---
apiVersion: v1
kind: Namespace
metadata:name: kubesphere-system---
apiVersion: v1
kind: ServiceAccount
metadata:name: ks-installernamespace: kubesphere-system---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:name: ks-installer
rules:
- apiGroups:- ""resources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- appsresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- extensionsresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- batchresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- rbac.authorization.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- apiregistration.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- apiextensions.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- tenant.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- certificates.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- devops.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- monitoring.coreos.comresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- logging.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- jaegertracing.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- storage.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- admissionregistration.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- policyresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- autoscalingresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- networking.istio.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- config.istio.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- iam.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- notification.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- auditing.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- events.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- core.kubefed.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- installer.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- storage.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- security.istio.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- monitoring.kiali.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- kiali.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- networking.k8s.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- edgeruntime.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- types.kubefed.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- monitoring.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;
- apiGroups:- application.kubesphere.ioresources:- &＃39;*&＃39;verbs:- &＃39;*&＃39;---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: ks-installer
subjects:
- kind: ServiceAccountname: ks-installernamespace: kubesphere-system
roleRef:kind: ClusterRolename: ks-installerapiGroup: rbac.authorization.k8s.io---
apiVersion: apps/v1
kind: Deployment
metadata:name: ks-installernamespace: kubesphere-systemlabels:app: ks-installer
spec:replicas: 1selector:matchLabels:app: ks-installertemplate:metadata:labels:app: ks-installerspec:serviceAccountName: ks-installercontainers:- name: installerimage: kubesphere/ks-installer:v3.3.1imagePullPolicy: "Always"resources:limits:cpu: "1"memory: 1Girequests:cpu: 20mmemory: 100MivolumeMounts:- mountPath: /etc/localtimename: host-timereadOnly: truevolumes:- hostPath:path: /etc/localtimetype: ""name: host-time


2.3 cluster-configuration.yaml 配置文件

注意这里同样不需要做任何修改

---
apiVersion: installer.kubesphere.io/v1alpha1
kind: ClusterConfiguration
metadata:name: ks-installernamespace: kubesphere-systemlabels:version: v3.3.1
spec:persistence:storageClass: "nfs-storageclass" # If there is no default StorageClass in your cluster, you need to specify an existing StorageClass here.authentication:# adminPassword: "" # Custom password of the admin user. If the parameter exists but the value is empty, a random password is generated. If the parameter does not exist, P&＃64;88w0rd is used.jwtSecret: "" # Keep the jwtSecret consistent with the Host Cluster. Retrieve the jwtSecret by executing "kubectl -n kubesphere-system get cm kubesphere-config -o yaml | grep -v "apiVersion" | grep jwtSecret" on the Host Cluster.local_registry: "" # Add your private registry address if it is needed.# dev_tag: "" # Add your kubesphere image tag you want to install, by default it&＃39;s same as ks-installer release version.etcd:monitoring: false # Enable or disable etcd monitoring dashboard installation. You have to create a Secret for etcd before you enable it.endpointIps: localhost # etcd cluster EndpointIps. It can be a bunch of IPs here.port: 2379 # etcd port.tlsEnable: truecommon:core:console:enableMultiLogin: true # Enable or disable simultaneous logins. It allows different users to log in with the same account at the same time.port: 30880type: NodePort# apiserver: # Enlarge the apiserver and controller manager&＃39;s resource requests and limits for the large cluster# resources: {}# controllerManager:# resources: {}redis:enabled: falseenableHA: falsevolumeSize: 2Gi # Redis PVC size.openldap:enabled: falsevolumeSize: 2Gi # openldap PVC size.minio:volumeSize: 20Gi # Minio PVC size.monitoring:# type: external # Whether to specify the external prometheus stack, and need to modify the endpoint at the next line.endpoint: http://prometheus-operated.kubesphere-monitoring-system.svc:9090 # Prometheus endpoint to get metrics data.GPUMonitoring: # Enable or disable the GPU-related metrics. If you enable this switch but have no GPU resources, Kubesphere will set it to zero.enabled: falsegpu: # Install GPUKinds. The default GPU kind is nvidia.com/gpu. Other GPU kinds can be added here according to your needs.kinds:- resourceName: "nvidia.com/gpu"resourceType: "GPU"default: truees: # Storage backend for logging, events and auditing.# master:# volumeSize: 4Gi # The volume size of Elasticsearch master nodes.# replicas: 1 # The total number of master nodes. Even numbers are not allowed.# resources: {}# data:# volumeSize: 20Gi # The volume size of Elasticsearch data nodes.# replicas: 1 # The total number of data nodes.# resources: {}logMaxAge: 7 # Log retention time in built-in Elasticsearch. It is 7 days by default.elkPrefix: logstash # The string making up index names. The index name will be formatted as ks--log.basicAuth:enabled: falseusername: ""password: ""externalElasticsearchHost: ""externalElasticsearchPort: ""alerting: # (CPU: 0.1 Core, Memory: 100 MiB) It enables users to customize alerting policies to send messages to receivers in time with different time intervals and alerting levels to choose from.enabled: false # Enable or disable the KubeSphere Alerting System.# thanosruler:# replicas: 1# resources: {}auditing: # Provide a security-relevant chronological set of records&＃xff0c;recording the sequence of activities happening on the platform, initiated by different tenants.enabled: false # Enable or disable the KubeSphere Auditing Log System.# operator:# resources: {}# webhook:# resources: {}devops: # (CPU: 0.47 Core, Memory: 8.6 G) Provide an out-of-the-box CI/CD system based on Jenkins, and automated workflow tools including Source-to-Image & Binary-to-Image.enabled: false # Enable or disable the KubeSphere DevOps System.# resources: {}jenkinsMemoryLim: 8Gi # Jenkins memory limit.jenkinsMemoryReq: 4Gi # Jenkins memory request.jenkinsVolumeSize: 8Gi # Jenkins volume size.events: # Provide a graphical web console for Kubernetes Events exporting, filtering and alerting in multi-tenant Kubernetes clusters.enabled: false # Enable or disable the KubeSphere Events System.# operator:# resources: {}# exporter:# resources: {}# ruler:# enabled: true# replicas: 2# resources: {}logging: # (CPU: 57 m, Memory: 2.76 G) Flexible logging functions are provided for log query, collection and management in a unified console. Additional log collectors can be added, such as Elasticsearch, Kafka and Fluentd.enabled: false # Enable or disable the KubeSphere Logging System.logsidecar:enabled: truereplicas: 2# resources: {}metrics_server: # (CPU: 56 m, Memory: 44.35 MiB) It enables HPA (Horizontal Pod Autoscaler).enabled: false # Enable or disable metrics-server.monitoring:storageClass: "" # If there is an independent StorageClass you need for Prometheus, you can specify it here. The default StorageClass is used by default.node_exporter:port: 9100# resources: {}# kube_rbac_proxy:# resources: {}# kube_state_metrics:# resources: {}# prometheus:# replicas: 1 # Prometheus replicas are responsible for monitoring different segments of data source and providing high availability.# volumeSize: 20Gi # Prometheus PVC size.# resources: {}# operator:# resources: {}# alertmanager:# replicas: 1 # AlertManager Replicas.# resources: {}# notification_manager:# resources: {}# operator:# resources: {}# proxy:# resources: {}gpu: # GPU monitoring-related plug-in installation.nvidia_dcgm_exporter: # Ensure that gpu resources on your hosts can be used normally, otherwise this plug-in will not work properly.enabled: false # Check whether the labels on the GPU hosts contain "nvidia.com/gpu.present&＃61;true" to ensure that the DCGM pod is scheduled to these nodes.# resources: {}multicluster:clusterRole: none # host | member | none # You can install a solo cluster, or specify it as the Host or Member Cluster.network:networkpolicy: # Network policies allow network isolation within the same cluster, which means firewalls can be set up between certain instances (Pods).# Make sure that the CNI network plugin used by the cluster supports NetworkPolicy. There are a number of CNI network plugins that support NetworkPolicy, including Calico, Cilium, Kube-router, Romana and Weave Net.enabled: false # Enable or disable network policies.ippool: # Use Pod IP Pools to manage the Pod network address space. Pods to be created can be assigned IP addresses from a Pod IP Pool.type: none # Specify "calico" for this field if Calico is used as your CNI plugin. "none" means that Pod IP Pools are disabled.topology: # Use Service Topology to view Service-to-Service communication based on Weave Scope.type: none # Specify "weave-scope" for this field to enable Service Topology. "none" means that Service Topology is disabled.openpitrix: # An App Store that is accessible to all platform tenants. You can use it to manage apps across their entire lifecycle.store:enabled: false # Enable or disable the KubeSphere App Store.servicemesh: # (0.3 Core, 300 MiB) Provide fine-grained traffic management, observability and tracing, and visualized traffic topology.enabled: false # Base component (pilot). Enable or disable KubeSphere Service Mesh (Istio-based).istio: # Customizing the istio installation configuration, refer to https://istio.io/latest/docs/setup/additional-setup/customize-installation/components:ingressGateways:- name: istio-ingressgatewayenabled: falsecni:enabled: falseedgeruntime: # Add edge nodes to your cluster and deploy workloads on edge nodes.enabled: falsekubeedge: # kubeedge configurationsenabled: falsecloudCore:cloudHub:advertiseAddress: # At least a public IP address or an IP address which can be accessed by edge nodes must be provided.- "" # Note that once KubeEdge is enabled, CloudCore will malfunction if the address is not provided.service:cloudhubNodePort: "30000"cloudhubQuicNodePort: "30001"cloudhubHttpsNodePort: "30002"cloudstreamNodePort: "30003"tunnelNodePort: "30004"# resources: {}# hostNetWork: falseiptables-manager:enabled: truemode: "external"# resources: {}# edgeService:# resources: {}gatekeeper: # Provide admission policy and rule management, A validating (mutating TBA) webhook that enforces CRD-based policies executed by Open Policy Agent.enabled: false # Enable or disable Gatekeeper.# controller_manager:# resources: {}# audit:# resources: {}terminal:# image: &＃39;alpine:3.15&＃39; # There must be an nsenter program in the imagetimeout: 600 # Container timeout, if set to 0, no timeout will be used. The unit is seconds


2.4 执行如下命令启动

kubectl apply -f kubesphere-installer.yaml
kubectl apply -f cluster-configuration.yaml


2.5 查看安装日志

然后可通过如下命令查看安装日志

kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l &＃39;app in (ks-install, ks-installer)&＃39; -o jsonpath&＃61;&＃39;{.items[0].metadata.name}&＃39;) -f


如下&＃xff0c;表示已经安装成功&＃xff0c;而且这里也提示了admin用户以及默认密码

2.6 浏览器访问

浏览器打开 IP:30880 即可&＃xff0c;如下&＃xff0c;默认情况下用户名密码&＃xff1a;admin/P&＃64;88w0rd

2.7 首次登录修改密码

然后会提示修改密码&＃xff0c;此时设置为自己的密码即可

2.8 登录成功

此时即登录进来了&＃xff0c;如下表示已经搭建成功