[KUBEADM] 00.Preinstall

작업순서 

[onpremise]

1. OS설치 

 - Redhat, ubuntu

2. Preinstall

 - OS 보안설정 

ㄴ iptable (firewalld disabled)

(MASTER)

sudo firewall-cmd --add-port={6443,2379-2380,10250,10251,10252,5473,179,5473}/tcp --permanent

sudo firewall-cmd --add-port={4789,8285,8472}/udp --permanent

sudo firewall-cmd --reload

(WORKER)

sudo firewall-cmd --add-port={10250,30000-32767,5473,179,5473}/tcp --permanent

sudo firewall-cmd --add-port={4789,8285,8472}/udp --permanent

sudo firewall-cmd --reload

ㄴ selinux disabled

sudo setenforce 0

sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config

ㄴ swap off

sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

sudo swapoff -a

##################

# kubeadm 설치 영역 #

##################

### Letting iptables see bridged traffic

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf

net.bridge.bridge-nf-call-ip6tables = 1

net.bridge.bridge-nf-call-iptables = 1

EOF

sudo sysctl --system

sudo modprobe overlay

sudo modprobe br_netfilter

# Setup required sysctl params, these persist across reboots.

cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf

net.bridge.bridge-nf-call-iptables  = 1

net.ipv4.ip_forward                 = 1

net.bridge.bridge-nf-call-ip6tables = 1

EOF

# Apply sysctl params without reboot

sudo sysctl --system

### Cgroup drivers

[containerd]

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf

overlay

br_netfilter

EOF

==============================================

(Ubuntu)

sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add -

sudo add-apt-repository \

    "deb [arch=amd64] https://download.docker.com/linux/ubuntu \

    $(lsb_release -cs) \

    stable"

sudo apt-get update && sudo apt-get install -y containerd.io

sudo mkdir -p /etc/containerd

sudo containerd config default > /etc/containerd/config.toml

sudo systemctl restart containerd

(CentOS)

sudo yum install -y yum-utils device-mapper-persistent-data lvm2

sudo yum-config-manager \

    --add-repo \

    https://download.docker.com/linux/centos/docker-ce.repo

sudo yum update -y && sudo yum install -y containerd.io

sudo mkdir -p /etc/containerd

sudo containerd config default > /etc/containerd/config.toml

sudo systemctl restart containerd

==============================================

#systemd - cgroup driver 를 systemd 로 설정

To use the systemd cgroup driver in /etc/containerd/config.toml with runc, set

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]

  ...

  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]

    SystemdCgroup = true

[CRI-O]

==============================================

(Ubuntu)

Operating system $OS

Ubuntu 20.04 xUbuntu_20.04

Ubuntu 19.10 xUbuntu_19.10

Ubuntu 19.04 xUbuntu_19.04

Ubuntu 18.04 xUbuntu_18.04

$VERSION

ex) VERSION=1.18 or VERSION=1.18:1.18.3

cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list

deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ /

EOF

cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list

deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ /

EOF

curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg add -

curl -L https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/Release.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/libcontainers-cri-o.gpg add -

sudo apt-get update

sudo apt-get install cri-o cri-o-runc

(CentOS)

Operating system $OS

Centos 8             CentOS_8

Centos 8 Stream CentOS_8_Stream

Centos 7             CentOS_7

$VERSION

ex) VERSION=1.18 or VERSION=1.18:1.18.3

sudo curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/devel:kubic:libcontainers:stable.repo

sudo curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo

sudo yum install cri-o

==============================================

sudo systemctl daemon-reload

sudo systemctl start crio