{"id":35699,"date":"2023-07-27T20:55:25","date_gmt":"2023-02-03T11:02:27","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/"},"modified":"2024-04-30T15:41:05","modified_gmt":"2024-04-30T07:41:05","slug":"%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/","title":{"rendered":"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes"},"content":{"rendered":"<h1>\u9996\u5148<\/h1>\n<p>\u4f7f\u7528CoreOS Container Linux\u5728 Sakura VPS \u4e0a\u90e8\u7f72 Kubernetes\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">CoreOS Container Linux\uff08Stable:1911.5.0\uff09<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">kubernetes1.13.1\uff081 master\u3001node\u306a\u3057\u306e\u69cb\u6210\u3002RBAC\uff09<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">etcd3\uff08docker\u3067\u99c6\u52d5\u3002tls secured\uff09<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Container Linux Config\uff08ignition\uff09<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30b3\u30f3\u30c6\u30ca\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306fCanal<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">CoreDNS<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u3055\u304f\u3089\u306eVPS\u306eVPS\u30d7\u30e9\u30f3\uff11\u3064\uff08\u30e1\u30e2\u30ea\uff1a1GB\uff09<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">zram<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">swap<\/ul>\n<h1>\u5c06CoreOS\u7684ISO\u6620\u50cf\u4e0a\u4f20\u81f3Sakura\u7684VPS\u3002<\/h1>\n<p>\u6b21\u306eURL\u304b\u3089ISO\u30a4\u30e1\u30fc\u30b8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<br \/>\nhttps:\/\/stable.release.core-os.net\/amd64-usr\/1632.3.0\/coreos_production_iso_image.iso<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/5-0.png\" alt=\"100_.png\" \/><\/div>\n<p>\u4eceISO\u955c\u50cf\u542f\u52a8VPS\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/7-0.png\" alt=\"111__.png\" \/><\/div>\n<p>\u5728\u8fd9\u91cc\u8f93\u5165\u4e0b\u4e00\u4e2a\u503c\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${MASTER_IP}\u3092vps\u306epublicly routable IP\u3067\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${GATEWAY}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${DNS1}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">${DNS2}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>vi \/etc\/systemd\/network\/static.network\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code>[Match]\r\nName=eth0\r\n[Network]\r\nAddress=${MASTER_IP}\/23\r\nGateway=${GATEWAY}.1\r\nDNS=${DNS1}\r\nDNS=${DNS2}\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>systemctl restart systemd-networkd\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>passwd core\r\n<\/code><\/pre>\n<p>\u8bf7\u6839\u636e\u73af\u5883\u8fdb\u884c\u7f16\u8f91\u4ee5\u4e0b\u7684yaml\u6587\u4ef6\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">ssh-rsa\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${MASTER_IP}\u3092vps\u306epublicly routable IP\u3067\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${GATEWAY}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">${DNS1}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">${DNS2}\u3092\u7f6e\u304d\u63db\u3048\u308b<\/ul>\n<pre class=\"post-pre\"><code><span class=\"c1\"># \/usr\/share\/oem\/config.ign<\/span>\r\n\r\n<span class=\"c1\"># ignition\u518d\u9069\u7528<\/span>\r\n<span class=\"c1\"># sudo touch \/boot\/coreos\/first_boot<\/span>\r\n<span class=\"c1\"># sudo rm \/etc\/machine-id<\/span>\r\n<span class=\"c1\"># sudo reboot<\/span>\r\n\r\n<span class=\"na\">passwd<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">users<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">core<\/span>\r\n      <span class=\"na\">ssh_authorized_keys<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQAB\u30fb\u30fb\u30fbZiDsoTMHdHt0nswTkLhl1NAdEHBqt core@localhost<\/span>\r\n<span class=\"na\">storage<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">files<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/var\/lib\/iptables\/rules-save<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0644<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">*filter<\/span>\r\n          <span class=\"s\">:INPUT   DROP   [0:0]<\/span>\r\n          <span class=\"s\">:FORWARD DROP   [0:0]<\/span>\r\n          <span class=\"s\">:OUTPUT  ACCEPT [0:0]<\/span>\r\n          <span class=\"s\">-A INPUT -i lo -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p icmp -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p udp --sport 53 -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p tcp --dport 22 -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p tcp --dport 80   -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p tcp --dport 443  -j ACCEPT<\/span>\r\n          <span class=\"s\">-A INPUT -p tcp --dport 6443  -j ACCEPT<\/span>\r\n          <span class=\"s\">COMMIT<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/systemd\/timesyncd.conf<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0644<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">[Time]<\/span>\r\n          <span class=\"s\">NTP=ntp.nict.jp ntp.jst.mfeed.ad.jp<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/zrm\/zrm.sh<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">#!\/bin\/bash<\/span>\r\n          <span class=\"s\">### BEGIN INIT INFO<\/span>\r\n          <span class=\"s\"># Provides: zram<\/span>\r\n          <span class=\"s\"># Required-Start:<\/span>\r\n          <span class=\"s\"># Required-Stop:<\/span>\r\n          <span class=\"s\"># Default-Start: 2 3 4 5<\/span>\r\n          <span class=\"s\"># Default-Stop: 0 1 6<\/span>\r\n          <span class=\"s\"># Short-Description: Increased Performance In Linux With zRam (Virtual Swap Compressed in RAM)<\/span>\r\n          <span class=\"s\"># Description: Adapted from systemd scripts at https:\/\/github.com\/mystilleef\/FedoraZram<\/span>\r\n          <span class=\"s\">### END INIT INFO<\/span>\r\n          <span class=\"s\">start() {<\/span>\r\n              <span class=\"s\"># get the number of CPUs<\/span>\r\n              <span class=\"s\">num_cpus=$(grep -c processor \/proc\/cpuinfo)<\/span>\r\n              <span class=\"s\"># if something goes wrong, assume we have 1<\/span>\r\n              <span class=\"s\">[ \"$num_cpus\" != 0 ] || num_cpus=1<\/span>\r\n\r\n              <span class=\"s\"># set decremented number of CPUs<\/span>\r\n              <span class=\"s\">decr_num_cpus=$((num_cpus - 1))<\/span>\r\n\r\n              <span class=\"s\"># get the amount of memory in the machine<\/span>\r\n              <span class=\"s\">mem_total_kb=$(grep MemTotal \/proc\/meminfo | grep -E --only-matching '[[:digit:]]+')<\/span>\r\n\r\n              <span class=\"s\">#we will only assign 50% of system memory to zram<\/span>\r\n              <span class=\"s\">mem_total_kb=$((mem_total_kb * 2 \/ 5))<\/span>\r\n\r\n              <span class=\"s\">mem_total=$((mem_total_kb * 1024))<\/span>\r\n\r\n              <span class=\"s\"># load dependency modules<\/span>\r\n              <span class=\"s\">modprobe zram num_devices=$num_cpus<\/span>\r\n\r\n              <span class=\"s\"># initialize the devices<\/span>\r\n              <span class=\"s\">for i in $(seq 0 $decr_num_cpus); do<\/span>\r\n              <span class=\"s\">echo $((mem_total \/ num_cpus)) &gt; \/sys\/block\/zram$i\/disksize<\/span>\r\n              <span class=\"s\">done<\/span>\r\n\r\n              <span class=\"s\"># Creating swap filesystems<\/span>\r\n              <span class=\"s\">for i in $(seq 0 $decr_num_cpus); do<\/span>\r\n              <span class=\"s\">mkswap \/dev\/zram$i<\/span>\r\n              <span class=\"s\">done<\/span>\r\n\r\n              <span class=\"s\"># Switch the swaps on<\/span>\r\n              <span class=\"s\">for i in $(seq 0 $decr_num_cpus); do<\/span>\r\n              <span class=\"s\">swapon -p 100 \/dev\/zram$i<\/span>\r\n              <span class=\"s\">done<\/span>\r\n          <span class=\"s\">}<\/span>\r\n          <span class=\"s\">stop() {<\/span>\r\n                  <span class=\"s\">for i in $(grep '^\/dev\/zram' \/proc\/swaps | awk '{ print $1 }'); do<\/span>\r\n                          <span class=\"s\">swapoff \"$i\"<\/span>\r\n                  <span class=\"s\">done<\/span>\r\n\r\n                  <span class=\"s\">if grep -q \"^zram \" \/proc\/modules; then<\/span>\r\n                          <span class=\"s\">sleep 1<\/span>\r\n                          <span class=\"s\">rmmod zram<\/span>\r\n                  <span class=\"s\">fi<\/span>\r\n          <span class=\"s\">}<\/span>\r\n          <span class=\"s\">case \"$1\" in<\/span>\r\n              <span class=\"s\">start)<\/span>\r\n                  <span class=\"s\">start<\/span>\r\n                  <span class=\"s\">;;<\/span>\r\n              <span class=\"s\">stop)<\/span>\r\n                  <span class=\"s\">stop<\/span>\r\n                  <span class=\"s\">;;<\/span>\r\n              <span class=\"s\">restart)<\/span>\r\n                  <span class=\"s\">stop<\/span>\r\n                  <span class=\"s\">sleep 3<\/span>\r\n                  <span class=\"s\">start<\/span>\r\n                  <span class=\"s\">;;<\/span>\r\n          <span class=\"s\">esac<\/span>\r\n          <span class=\"s\">wait<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">apiVersion: v1<\/span>\r\n          <span class=\"s\">kind: Pod<\/span>\r\n          <span class=\"s\">metadata:<\/span>\r\n            <span class=\"s\">name: kube-apiserver<\/span>\r\n            <span class=\"s\">namespace: kube-system<\/span>\r\n          <span class=\"s\">spec:<\/span>\r\n            <span class=\"s\">hostNetwork: true<\/span>\r\n            <span class=\"s\">containers:<\/span>\r\n            <span class=\"s\">- name: kube-apiserver<\/span>\r\n              <span class=\"s\">image: gcr.io\/google_containers\/hyperkube-amd64:v1.13.1<\/span>\r\n              <span class=\"s\">command:<\/span>\r\n              <span class=\"s\">- \/hyperkube<\/span>\r\n              <span class=\"s\">- apiserver<\/span>\r\n              <span class=\"s\">- --bind-address=0.0.0.0<\/span>\r\n              <span class=\"s\">- --etcd-servers=https:\/\/${MASTER_IP}:2379<\/span>\r\n              <span class=\"s\">- --etcd-cafile=\/etc\/kubernetes\/ssl\/ca.pem<\/span>\r\n              <span class=\"s\">- --etcd-certfile=\/etc\/kubernetes\/ssl\/apiserver.pem<\/span>\r\n              <span class=\"s\">- --etcd-keyfile=\/etc\/kubernetes\/ssl\/apiserver-key.pem<\/span>\r\n              <span class=\"s\">- --allow-privileged=true<\/span>\r\n              <span class=\"s\">- --apiserver-count=1<\/span>\r\n              <span class=\"s\">- --endpoint-reconciler-type=lease<\/span>\r\n              <span class=\"s\">- --service-cluster-ip-range=10.3.0.0\/24<\/span>\r\n              <span class=\"s\">- --secure-port=6443<\/span>\r\n              <span class=\"s\">- --advertise-address=${MASTER_IP}<\/span>\r\n              <span class=\"s\">- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota<\/span>\r\n              <span class=\"s\">- --storage-backend=etcd3<\/span>\r\n              <span class=\"s\">- --tls-cert-file=\/etc\/kubernetes\/ssl\/apiserver.pem<\/span>\r\n              <span class=\"s\">- --tls-private-key-file=\/etc\/kubernetes\/ssl\/apiserver-key.pem<\/span>\r\n              <span class=\"s\">- --client-ca-file=\/etc\/kubernetes\/ssl\/ca.pem<\/span>\r\n              <span class=\"s\">- --service-account-key-file=\/etc\/kubernetes\/ssl\/apiserver-key.pem<\/span>\r\n              <span class=\"s\">- --runtime-config=extensions\/v1beta1\/networkpolicies=true<\/span>\r\n              <span class=\"s\">- --service-node-port-range=25-32767<\/span>\r\n              <span class=\"s\">- --authorization-mode=RBAC<\/span>\r\n              <span class=\"s\">ports:<\/span>\r\n              <span class=\"s\">- containerPort: 6443<\/span>\r\n                <span class=\"s\">hostPort: 6443<\/span>\r\n                <span class=\"s\">name: https<\/span>\r\n              <span class=\"s\">- containerPort: 8080<\/span>\r\n                <span class=\"s\">hostPort: 8080<\/span>\r\n                <span class=\"s\">name: local<\/span>\r\n              <span class=\"s\">volumeMounts:<\/span>\r\n              <span class=\"s\">- mountPath: \/etc\/kubernetes\/ssl<\/span>\r\n                <span class=\"s\">name: ssl-certs-kubernetes<\/span>\r\n                <span class=\"s\">readOnly: true<\/span>\r\n            <span class=\"s\">volumes:<\/span>\r\n            <span class=\"s\">- hostPath:<\/span>\r\n                <span class=\"s\">path: \/etc\/kubernetes\/ssl<\/span>\r\n              <span class=\"s\">name: ssl-certs-kubernetes<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/manifests\/kube-proxy.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">apiVersion: v1<\/span>\r\n          <span class=\"s\">kind: Pod<\/span>\r\n          <span class=\"s\">metadata:<\/span>\r\n            <span class=\"s\">name: kube-proxy<\/span>\r\n            <span class=\"s\">namespace: kube-system<\/span>\r\n          <span class=\"s\">spec:<\/span>\r\n            <span class=\"s\">hostNetwork: true<\/span>\r\n            <span class=\"s\">containers:<\/span>\r\n            <span class=\"s\">- name: kube-proxy<\/span>\r\n              <span class=\"s\">image: gcr.io\/google_containers\/hyperkube-amd64:v1.13.1<\/span>\r\n              <span class=\"s\">command:<\/span>\r\n              <span class=\"s\">- \/hyperkube<\/span>\r\n              <span class=\"s\">- proxy<\/span>\r\n              <span class=\"s\">- --kubeconfig=\/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n              <span class=\"s\">- --proxy-mode=iptables<\/span>\r\n              <span class=\"s\">securityContext:<\/span>\r\n                <span class=\"s\">privileged: true<\/span>\r\n              <span class=\"s\">volumeMounts:<\/span>\r\n                <span class=\"s\">- mountPath: \/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n                  <span class=\"s\">name: \"kubeconfig\"<\/span>\r\n                  <span class=\"s\">readOnly: true<\/span>\r\n                <span class=\"s\">- mountPath: \/etc\/kubernetes\/ssl<\/span>\r\n                  <span class=\"s\">name: \"etc-kube-ssl\"<\/span>\r\n                  <span class=\"s\">readOnly: true<\/span>\r\n            <span class=\"s\">volumes:<\/span>\r\n              <span class=\"s\">- name: \"kubeconfig\"<\/span>\r\n                <span class=\"s\">hostPath:<\/span>\r\n                  <span class=\"s\">path: \"\/etc\/kubernetes\/worker-kubeconfig.yaml\"<\/span>\r\n              <span class=\"s\">- name: \"etc-kube-ssl\"<\/span>\r\n                <span class=\"s\">hostPath:<\/span>\r\n                  <span class=\"s\">path: \"\/etc\/kubernetes\/ssl\"<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/manifests\/kube-controller-manager.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">apiVersion: v1<\/span>\r\n          <span class=\"s\">kind: Pod<\/span>\r\n          <span class=\"s\">metadata:<\/span>\r\n            <span class=\"s\">name: kube-controller-manager<\/span>\r\n            <span class=\"s\">namespace: kube-system<\/span>\r\n          <span class=\"s\">spec:<\/span>\r\n            <span class=\"s\">hostNetwork: true<\/span>\r\n            <span class=\"s\">containers:<\/span>\r\n            <span class=\"s\">- name: kube-controller-manager<\/span>\r\n              <span class=\"s\">image: gcr.io\/google_containers\/hyperkube-amd64:v1.13.1<\/span>\r\n              <span class=\"s\">command:<\/span>\r\n              <span class=\"s\">- \/hyperkube<\/span>\r\n              <span class=\"s\">- controller-manager<\/span>\r\n              <span class=\"s\">- --kubeconfig=\/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n              <span class=\"s\">- --leader-elect=true<\/span>\r\n              <span class=\"s\">- --service-account-private-key-file=\/etc\/kubernetes\/ssl\/apiserver-key.pem<\/span>\r\n              <span class=\"s\">- --root-ca-file=\/etc\/kubernetes\/ssl\/ca.pem<\/span>\r\n              <span class=\"s\">- --cluster-cidr=10.244.0.0\/16<\/span>\r\n              <span class=\"s\">- --allocate-node-cidrs=true<\/span>\r\n              <span class=\"s\">livenessProbe:<\/span>\r\n                <span class=\"s\">httpGet:<\/span>\r\n                  <span class=\"s\">host: 127.0.0.1<\/span>\r\n                  <span class=\"s\">path: \/healthz<\/span>\r\n                  <span class=\"s\">port: 10252<\/span>\r\n                <span class=\"s\">initialDelaySeconds: 15<\/span>\r\n                <span class=\"s\">timeoutSeconds: 15<\/span>\r\n              <span class=\"s\">volumeMounts:<\/span>\r\n              <span class=\"s\">- mountPath: \/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n                <span class=\"s\">name: \"kubeconfig\"<\/span>\r\n                <span class=\"s\">readOnly: true<\/span>\r\n              <span class=\"s\">- mountPath: \/etc\/kubernetes\/ssl<\/span>\r\n                <span class=\"s\">name: ssl-certs-kubernetes<\/span>\r\n                <span class=\"s\">readOnly: true<\/span>\r\n            <span class=\"s\">volumes:<\/span>\r\n            <span class=\"s\">- name: \"kubeconfig\"<\/span>\r\n              <span class=\"s\">hostPath:<\/span>\r\n                <span class=\"s\">path: \"\/etc\/kubernetes\/worker-kubeconfig.yaml\"<\/span>\r\n            <span class=\"s\">- hostPath:<\/span>\r\n                <span class=\"s\">path: \/etc\/kubernetes\/ssl<\/span>\r\n              <span class=\"s\">name: ssl-certs-kubernetes<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/manifests\/kube-scheduler.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">apiVersion: v1<\/span>\r\n          <span class=\"s\">kind: Pod<\/span>\r\n          <span class=\"s\">metadata:<\/span>\r\n            <span class=\"s\">name: kube-scheduler<\/span>\r\n            <span class=\"s\">namespace: kube-system<\/span>\r\n          <span class=\"s\">spec:<\/span>\r\n            <span class=\"s\">hostNetwork: true<\/span>\r\n            <span class=\"s\">containers:<\/span>\r\n            <span class=\"s\">- name: kube-scheduler<\/span>\r\n              <span class=\"s\">image: gcr.io\/google_containers\/hyperkube-amd64:v1.13.1<\/span>\r\n              <span class=\"s\">command:<\/span>\r\n              <span class=\"s\">- \/hyperkube<\/span>\r\n              <span class=\"s\">- scheduler<\/span>\r\n              <span class=\"s\">- --kubeconfig=\/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n              <span class=\"s\">- --leader-elect=true<\/span>\r\n              <span class=\"s\">livenessProbe:<\/span>\r\n                <span class=\"s\">httpGet:<\/span>\r\n                  <span class=\"s\">host: 127.0.0.1<\/span>\r\n                  <span class=\"s\">path: \/healthz<\/span>\r\n                  <span class=\"s\">port: 10251<\/span>\r\n                <span class=\"s\">initialDelaySeconds: 15<\/span>\r\n                <span class=\"s\">timeoutSeconds: 15<\/span>\r\n              <span class=\"s\">volumeMounts:<\/span>\r\n              <span class=\"s\">- mountPath: \/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n                <span class=\"s\">name: \"kubeconfig\"<\/span>\r\n                <span class=\"s\">readOnly: true<\/span>\r\n              <span class=\"s\">- mountPath: \/etc\/kubernetes\/ssl<\/span>\r\n                <span class=\"s\">name: \"etc-kube-ssl\"<\/span>\r\n                <span class=\"s\">readOnly: true<\/span>\r\n            <span class=\"s\">volumes:<\/span>\r\n            <span class=\"s\">- name: \"kubeconfig\"<\/span>\r\n              <span class=\"s\">hostPath:<\/span>\r\n                <span class=\"s\">path: \"\/etc\/kubernetes\/worker-kubeconfig.yaml\"<\/span>\r\n            <span class=\"s\">- name: \"etc-kube-ssl\"<\/span>\r\n              <span class=\"s\">hostPath:<\/span>\r\n                <span class=\"s\">path: \"\/etc\/kubernetes\/ssl\"<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/worker-kubeconfig.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">apiVersion: v1<\/span>\r\n          <span class=\"s\">kind: Config<\/span>\r\n          <span class=\"s\">clusters:<\/span>\r\n          <span class=\"s\">- name: local<\/span>\r\n            <span class=\"s\">cluster:<\/span>\r\n              <span class=\"s\">certificate-authority: \/etc\/kubernetes\/ssl\/ca.pem<\/span>\r\n              <span class=\"s\">server: https:\/\/${MASTER_IP}:6443<\/span>\r\n          <span class=\"s\">users:<\/span>\r\n          <span class=\"s\">- name: kubelet<\/span>\r\n            <span class=\"s\">user:<\/span>\r\n              <span class=\"s\">client-certificate: \/etc\/kubernetes\/ssl\/worker.pem<\/span>\r\n              <span class=\"s\">client-key: \/etc\/kubernetes\/ssl\/worker-key.pem<\/span>\r\n          <span class=\"s\">contexts:<\/span>\r\n          <span class=\"s\">- context:<\/span>\r\n              <span class=\"s\">cluster: local<\/span>\r\n              <span class=\"s\">user: kubelet<\/span>\r\n            <span class=\"s\">name: kubelet-context<\/span>\r\n          <span class=\"s\">current-context: kubelet-context<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/etc\/kubernetes\/kubelet-conf.yaml<\/span>\r\n      <span class=\"na\">filesystem<\/span><span class=\"pi\">:<\/span> <span class=\"s\">root<\/span>\r\n      <span class=\"na\">mode<\/span><span class=\"pi\">:<\/span> <span class=\"m\">0755<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">inline<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n          <span class=\"s\">kind: KubeletConfiguration<\/span>\r\n          <span class=\"s\">apiVersion: kubelet.config.k8s.io\/v1beta1<\/span>\r\n          <span class=\"s\">staticPodPath: \"\/etc\/kubernetes\/manifests\"<\/span>\r\n          <span class=\"s\">clusterDNS: [\"10.3.0.10\"]<\/span>\r\n          <span class=\"s\">clusterDomain: \"cluster.local\"<\/span>\r\n          <span class=\"s\"># Restore default authentication and authorization modes from K8s &lt; 1.9<\/span>\r\n          <span class=\"s\">authentication:<\/span>\r\n            <span class=\"s\">anonymous:<\/span>\r\n              <span class=\"s\">enabled: true # Defaults to false as of 1.10<\/span>\r\n            <span class=\"s\">webhook:<\/span>\r\n              <span class=\"s\">enabled: false # Deafults to true as of 1.10<\/span>\r\n          <span class=\"s\">authorization:<\/span>\r\n            <span class=\"s\">mode: AlwaysAllow # Deafults to webhook as of 1.10<\/span>\r\n          <span class=\"s\">readOnlyPort: 10255 # Used by heapster. Defaults to 0 (disabled) as of 1.10. Needed for metrics.<\/span>\r\n          <span class=\"s\">failSwapOn: false<\/span>\r\n\r\n<span class=\"na\">networkd<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">units<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">static.network<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Match]<\/span>\r\n        <span class=\"s\">Name=eth0<\/span>\r\n\r\n        <span class=\"s\">[Network]<\/span>\r\n        <span class=\"s\">Address=${MASTER_IP}\/23<\/span>\r\n        <span class=\"s\">Gateway=${GATEWAY}.1<\/span>\r\n        <span class=\"s\">DNS=${DNS1}<\/span>\r\n        <span class=\"s\">DNS=${DNS2}<\/span>\r\n\r\n<span class=\"na\">systemd<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">units<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">iptables-restore.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=Restore iptables firewall rules<\/span>\r\n        <span class=\"s\"># if both are queued for some reason, don't store before restoring :)<\/span>\r\n        <span class=\"s\">Before=iptables-store.service<\/span>\r\n        <span class=\"s\"># sounds reasonable to have firewall up before any of the services go up<\/span>\r\n        <span class=\"s\">Before=network.target<\/span>\r\n        <span class=\"s\">Conflicts=shutdown.target<\/span>\r\n\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">Type=oneshot<\/span>\r\n        <span class=\"s\">ExecStart=\/sbin\/iptables-restore \/var\/lib\/iptables\/rules-save<\/span>\r\n\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=basic.target<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">settimezone.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=Set the time zone<\/span>\r\n\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">ExecStart=\/usr\/bin\/timedatectl set-timezone Asia\/Tokyo<\/span>\r\n        <span class=\"s\">RemainAfterExit=yes<\/span>\r\n        <span class=\"s\">Type=oneshot<\/span>\r\n\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=basic.target<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">zrm.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=Manage swap spaces on zram, files and partitions.<\/span>\r\n        <span class=\"s\">After=local-fs.target<\/span>\r\n\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">RemainAfterExit=yes<\/span>\r\n        <span class=\"s\">ExecStart=\/etc\/zrm\/zrm.sh start<\/span>\r\n        <span class=\"s\">ExecStop=\/etc\/zrm\/zrm.sh  stop<\/span>\r\n\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=local-fs.target<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">swap.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=Turn on swap<\/span>\r\n        <span class=\"s\">Before=docker.service<\/span>\r\n\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">Type=oneshot<\/span>\r\n        <span class=\"s\">Environment=\"SWAPFILE=\/swapfile\"<\/span>\r\n        <span class=\"s\">Environment=\"SWAPSIZE=1GiB\"<\/span>\r\n        <span class=\"s\">RemainAfterExit=true<\/span>\r\n        <span class=\"s\">ExecStartPre=\/usr\/bin\/sh -c '\/usr\/bin\/fallocate -l 1GiB \/swapfile &amp;&amp; chmod 0600 \/swapfile &amp;&amp; \/usr\/sbin\/mkswap \/swapfile'<\/span>\r\n        <span class=\"s\">ExecStartPre=\/usr\/sbin\/losetup -f \/swapfile<\/span>\r\n        <span class=\"s\">ExecStart=\/usr\/bin\/sh -c \"\/sbin\/swapon \/dev\/loop0\"<\/span>\r\n        <span class=\"s\">ExecStop=\/usr\/bin\/sh -c \"\/sbin\/swapoff \/dev\/loop0\"<\/span>\r\n        <span class=\"s\">ExecStopPost=\/usr\/bin\/sh -c \"\/usr\/sbin\/losetup -d \/dev\/loop0\"<\/span>\r\n\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=multi-user.target<\/span>\r\n\r\n<span class=\"c1\"># https:\/\/github.com\/kubernetes\/kube-deploy\/blob\/master\/docker-multinode\/common.sh<\/span>\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">etcd3.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=etcd3<\/span>\r\n        <span class=\"s\">Before=kubelet.service<\/span>\r\n        <span class=\"s\">Requires=docker.service<\/span>\r\n        <span class=\"s\">After=docker.service<\/span>\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">ExecStartPre=-\/usr\/bin\/docker stop etcd3<\/span>\r\n        <span class=\"s\">ExecStartPre=-\/usr\/bin\/docker rm etcd3<\/span>\r\n        <span class=\"s\">ExecStart=\/usr\/bin\/docker run -p 2379:2379 -p 2380:2380 -v \/var\/lib\/etcd:\/var\/lib\/etcd -v \/etc\/kubernetes\/ssl:\/etc\/kubernetes\/ssl --name=etcd3 gcr.io\/google_containers\/etcd:3.2.18 \\<\/span>\r\n          <span class=\"s\">\/usr\/local\/bin\/etcd \\<\/span>\r\n          <span class=\"s\">-data-dir \/var\/lib\/etcd \\<\/span>\r\n          <span class=\"s\">-name infra0 \\<\/span>\r\n          <span class=\"s\">--client-cert-auth \\<\/span>\r\n          <span class=\"s\">--trusted-ca-file=\/etc\/kubernetes\/ssl\/ca.pem \\<\/span>\r\n          <span class=\"s\">--cert-file=\/etc\/kubernetes\/ssl\/apiserver.pem \\<\/span>\r\n          <span class=\"s\">--key-file=\/etc\/kubernetes\/ssl\/apiserver-key.pem \\<\/span>\r\n          <span class=\"s\">--peer-client-cert-auth \\<\/span>\r\n          <span class=\"s\">--peer-trusted-ca-file=\/etc\/kubernetes\/ssl\/ca.pem \\<\/span>\r\n          <span class=\"s\">--peer-cert-file=\/etc\/kubernetes\/ssl\/apiserver.pem \\<\/span>\r\n          <span class=\"s\">--peer-key-file=\/etc\/kubernetes\/ssl\/apiserver-key.pem \\<\/span>\r\n          <span class=\"s\">-advertise-client-urls https:\/\/${MASTER_IP}:2379 \\<\/span>\r\n          <span class=\"s\">-listen-client-urls https:\/\/0.0.0.0:2379 \\<\/span>\r\n          <span class=\"s\">-initial-advertise-peer-urls https:\/\/${MASTER_IP}:2380 \\<\/span>\r\n          <span class=\"s\">-listen-peer-urls https:\/\/0.0.0.0:2380 \\<\/span>\r\n          <span class=\"s\">-initial-cluster-token etcd-cluster-1 \\<\/span>\r\n          <span class=\"s\">-initial-cluster infra0=https:\/\/${MASTER_IP}:2380 \\<\/span>\r\n          <span class=\"s\">-initial-cluster-state new<\/span>\r\n        <span class=\"s\">ExecStop=\/usr\/bin\/docker stop etcd3<\/span>\r\n        <span class=\"s\">Restart=on-failure<\/span>\r\n        <span class=\"s\">RestartSec=10<\/span>\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=multi-user.target<\/span>\r\n\r\n    <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kubelet.service<\/span>\r\n      <span class=\"na\">enabled<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">contents<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">|<\/span>\r\n        <span class=\"s\">[Unit]<\/span>\r\n        <span class=\"s\">Description=kubelet<\/span>\r\n        <span class=\"s\">Requires=etcd3.service<\/span>\r\n        <span class=\"s\">After=etcd3.service<\/span>\r\n        <span class=\"s\">[Service]<\/span>\r\n        <span class=\"s\">ExecStartPre=\/usr\/bin\/mkdir -p \/etc\/kubernetes\/manifests<\/span>\r\n        <span class=\"s\">ExecStartPre=\/bin\/mkdir -p \/var\/lib\/kubelet\/volumeplugins<\/span>\r\n        <span class=\"s\">ExecStartPre=\/bin\/mkdir -p \/var\/lib\/rook<\/span>\r\n        <span class=\"s\">ExecStart=\/usr\/bin\/docker run \\<\/span>\r\n          <span class=\"s\">--net=host \\<\/span>\r\n          <span class=\"s\">--pid=host \\<\/span>\r\n          <span class=\"s\">--privileged \\<\/span>\r\n          <span class=\"s\">-v \/:\/rootfs:ro \\<\/span>\r\n          <span class=\"s\">-v \/sys:\/sys:ro \\<\/span>\r\n          <span class=\"s\">-v \/dev:\/dev \\<\/span>\r\n          <span class=\"s\">-v \/var\/run:\/var\/run:rw \\<\/span>\r\n          <span class=\"s\">-v \/run:\/run:rw \\<\/span>\r\n          <span class=\"s\">-v \/var\/lib\/docker:\/var\/lib\/docker:rw \\<\/span>\r\n          <span class=\"s\">-v \/var\/lib\/kubelet:\/var\/lib\/kubelet:shared \\<\/span>\r\n          <span class=\"s\">-v \/var\/log\/containers:\/var\/log\/containers:rw \\<\/span>\r\n          <span class=\"s\">-v \/etc\/kubernetes:\/etc\/kubernetes:rw \\<\/span>\r\n          <span class=\"s\">-v \/etc\/cni\/net.d:\/etc\/cni\/net.d:rw \\<\/span>\r\n          <span class=\"s\">-v \/opt\/cni\/bin:\/opt\/cni\/bin:rw \\<\/span>\r\n          <span class=\"s\">gcr.io\/google_containers\/hyperkube-amd64:v1.13.1 \\<\/span>\r\n          <span class=\"s\">\/hyperkube kubelet \\<\/span>\r\n          <span class=\"s\">--config=\/etc\/kubernetes\/kubelet-conf.yaml \\<\/span>\r\n          <span class=\"s\">--network-plugin=cni \\<\/span>\r\n          <span class=\"s\">--cni-conf-dir=\/etc\/cni\/net.d \\<\/span>\r\n          <span class=\"s\">--cni-bin-dir=\/opt\/cni\/bin \\<\/span>\r\n          <span class=\"s\">--container-runtime=docker \\<\/span>\r\n          <span class=\"s\">--register-node=true \\<\/span>\r\n          <span class=\"s\">--allow-privileged=true \\<\/span>\r\n          <span class=\"s\">--hostname-override=${MASTER_IP} \\<\/span>\r\n          <span class=\"s\">--kubeconfig=\/etc\/kubernetes\/worker-kubeconfig.yaml \\<\/span>\r\n          <span class=\"s\">--containerized \\<\/span>\r\n          <span class=\"s\">--v=4 \\<\/span>\r\n          <span class=\"s\">--volume-plugin-dir=\/var\/lib\/kubelet\/volumeplugins<\/span>\r\n        <span class=\"s\">Restart=always<\/span>\r\n        <span class=\"s\">RestartSec=10<\/span>\r\n        <span class=\"s\">[Install]<\/span>\r\n        <span class=\"s\">WantedBy=multi-user.target<\/span>\r\n<\/code><\/pre>\n<p>\u4f7f\u7528 Container Linux Config Transpiler \u5de5\u5177\u5c06 Container Linux Config \u8f6c\u6362\u4e3a ignition\uff08\u4ee5\u4e0b\u793a\u4f8b\u4f7f\u7528 Windows \u547d\u4ee4\u4e3a\u4f8b\uff09\u3002<br \/>\nContainer Linux Config Transpiler\uff1ahttps:\/\/github.com\/coreos\/container-linux-config-transpiler\/releases<\/p>\n<pre class=\"post-pre\"><code>C:<span class=\"se\">\\&gt;<\/span>ct-v0.9.0-x86_64-pc-windows-gnu.exe <span class=\"nt\">--in-file<\/span> C:<span class=\"se\">\\t<\/span>emp<span class=\"se\">\\c<\/span>ontainer-linux-config.yaml <span class=\"o\">&gt;<\/span> C:<span class=\"se\">\\t<\/span>emp<span class=\"se\">\\i<\/span>gnition.json\r\n<\/code><\/pre>\n<p>\u5c06&#8221;ignition&#8221;\u4e0a\u4f20\u5230VPS\uff0c\u5e76\u6267\u884c&#8221;coreos-install&#8221;\u547d\u4ee4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>scp <span class=\"nt\">-r<\/span> ignition.json core@<span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span>:\/home\/core\/\r\n<span class=\"nv\">$ <\/span>ssh <span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span> <span class=\"nt\">-l<\/span> core\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>curl https:\/\/raw.githubusercontent.com\/coreos\/init\/master\/bin\/coreos-install <span class=\"o\">&gt;<\/span> coreos-install-current\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">chmod <\/span>777 coreos-install-current\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo<\/span> .\/coreos-install-current <span class=\"nt\">-d<\/span> \/dev\/vda <span class=\"nt\">-C<\/span> stable <span class=\"nt\">-V<\/span> 1911.5.0 <span class=\"nt\">-i<\/span> ignition.json\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>systemctl poweroff\r\n<\/code><\/pre>\n<p>\u63a5\u4e0b\u6765\uff0c\u60a8\u53ef\u4ee5\u901a\u8fc7\u6a31\u82b1VPS\u7684\u63a7\u5236\u53f0\u542f\u52a8VPS\u3002<\/p>\n<h1>\u4e3aKubernetes\u51c6\u5907TLS\u8bc1\u4e66<\/h1>\n<p>\u8bf7\u6839\u636e\u4ee5\u4e0b\u6b65\u9aa4\u751f\u6210\u652f\u6301RBAC\u7684TLS\u8d44\u4ea7\u3002<br \/>\n\uff08<br \/>\nhttps:\/\/coreos.com\/kubernetes\/docs\/1.0.6\/openssl.html<br \/>\n\u6216<br \/>\nhttps:\/\/github.com\/coreos\/coreos-kubernetes\/blob\/master\/Documentation\/openssl.md<br \/>\n\uff09<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>openssl genrsa <span class=\"nt\">-out<\/span> ca-key.pem 2048\r\n<span class=\"nv\">$ <\/span>openssl req <span class=\"nt\">-x509<\/span> <span class=\"nt\">-new<\/span> <span class=\"nt\">-nodes<\/span> <span class=\"nt\">-key<\/span> ca-key.pem <span class=\"nt\">-days<\/span> 10000 <span class=\"nt\">-out<\/span> ca.pem <span class=\"nt\">-subj<\/span> <span class=\"s2\">\"\/CN=kube-ca\"<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code>[req]\r\nreq_extensions = v3_req\r\ndistinguished_name = req_distinguished_name\r\n[req_distinguished_name]\r\n[ v3_req ]\r\nbasicConstraints = CA:FALSE\r\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\r\nsubjectAltName = @alt_names\r\n[alt_names]\r\nDNS.1 = kubernetes\r\nDNS.2 = kubernetes.default\r\nDNS.3 = kubernetes.default.svc\r\nDNS.4 = kubernetes.default.svc.cluster.local\r\nIP.1 = 10.3.0.1\r\nIP.2 = ${MASTER_IP}\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>openssl genrsa <span class=\"nt\">-out<\/span> apiserver-key.pem 2048\r\n<span class=\"nv\">$ <\/span>openssl req <span class=\"nt\">-new<\/span> <span class=\"nt\">-key<\/span> apiserver-key.pem <span class=\"nt\">-out<\/span> apiserver.csr <span class=\"nt\">-subj<\/span> <span class=\"s2\">\"\/CN=kube-apiserver\"<\/span> <span class=\"nt\">-config<\/span> openssl.cnf\r\n<span class=\"nv\">$ <\/span>openssl x509 <span class=\"nt\">-req<\/span> <span class=\"nt\">-in<\/span> apiserver.csr <span class=\"nt\">-CA<\/span> ca.pem <span class=\"nt\">-CAkey<\/span> ca-key.pem <span class=\"nt\">-CAcreateserial<\/span> <span class=\"nt\">-out<\/span> apiserver.pem <span class=\"nt\">-days<\/span> 365 <span class=\"nt\">-extensions<\/span> v3_req <span class=\"nt\">-extfile<\/span> openssl.cnf\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code>[req]\r\nreq_extensions = v3_req\r\ndistinguished_name = req_distinguished_name\r\n[req_distinguished_name]\r\n[ v3_req ]\r\nbasicConstraints = CA:FALSE\r\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\r\nsubjectAltName = @alt_names\r\n[alt_names]\r\nIP.1 = $ENV::WORKER_IP\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>openssl genrsa <span class=\"nt\">-out<\/span> kube-worker-0-worker-key.pem 2048\r\n<span class=\"nv\">$ WORKER_IP<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span> openssl req <span class=\"nt\">-new<\/span> <span class=\"nt\">-key<\/span> kube-worker-0-worker-key.pem <span class=\"nt\">-out<\/span> kube-worker-0-worker.csr <span class=\"nt\">-subj<\/span> <span class=\"s2\">\"\/CN=kube-worker-0\/O=system:masters\"<\/span> <span class=\"nt\">-config<\/span> worker-openssl.cnf\r\n<span class=\"nv\">$ WORKER_IP<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span> openssl x509 <span class=\"nt\">-req<\/span> <span class=\"nt\">-in<\/span> kube-worker-0-worker.csr <span class=\"nt\">-CA<\/span> ca.pem <span class=\"nt\">-CAkey<\/span> ca-key.pem <span class=\"nt\">-CAcreateserial<\/span> <span class=\"nt\">-out<\/span> kube-worker-0-worker.pem <span class=\"nt\">-days<\/span> 365 <span class=\"nt\">-extensions<\/span> v3_req <span class=\"nt\">-extfile<\/span> worker-openssl.cnf\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>openssl genrsa <span class=\"nt\">-out<\/span> admin-key.pem 2048\r\n<span class=\"nv\">$ <\/span>openssl req <span class=\"nt\">-new<\/span> <span class=\"nt\">-key<\/span> admin-key.pem <span class=\"nt\">-out<\/span> admin.csr <span class=\"nt\">-subj<\/span> <span class=\"s2\">\"\/CN=kube-admin\/O=system:masters\"<\/span>\r\n<span class=\"nv\">$ <\/span>openssl x509 <span class=\"nt\">-req<\/span> <span class=\"nt\">-in<\/span> admin.csr <span class=\"nt\">-CA<\/span> ca.pem <span class=\"nt\">-CAkey<\/span> ca-key.pem <span class=\"nt\">-CAcreateserial<\/span> <span class=\"nt\">-out<\/span> admin.pem <span class=\"nt\">-days<\/span> 365\r\n<\/code><\/pre>\n<p>\u6211\u4eec\u5047\u8bbe\u5728\u540e\u7eed\u6b65\u9aa4\u4e2d\u751f\u6210\u4e86\u4ee5\u4e0b8\u4e2a\u5bc6\u94a5\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">ca.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">ca-key.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">apiserver.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">apiserver-key.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">admin.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">admin-key.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">kube-worker-0-worker.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">kube-worker-0-worker-key.pem<\/ul>\n<p>vps\u3067\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u4f5c\u308a\u3001\u751f\u6210\u3057\u305f\u30ad\u30fc\u3092\u7f6e\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>scp <span class=\"nt\">-r<\/span> tls-assets core@<span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span>:\/home\/core\/\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">rm<\/span> ~\/.ssh\/known_hosts\r\n<span class=\"nv\">$ <\/span>ssh <span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span> <span class=\"nt\">-l<\/span> core\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">mkdir<\/span> <span class=\"nt\">-p<\/span> \/etc\/kubernetes\/ssl\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo cp <\/span>tls-assets\/<span class=\"k\">*<\/span>.pem \/etc\/kubernetes\/ssl\r\n<\/code><\/pre>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/ca.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/ca-key.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/apiserver.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/apiserver-key.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/kube-worker-0-worker.pem<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">File: \/etc\/kubernetes\/ssl\/kube-worker-0-worker-key.pem<\/ul>\n<p>\u8bf7\u4e3a\u5bc6\u94a5\u8bbe\u7f6e\u6b63\u786e\u7684\u6743\u9650\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo chmod <\/span>600 \/etc\/kubernetes\/ssl\/<span class=\"k\">*<\/span><span class=\"nt\">-key<\/span>.pem\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo chown <\/span>root:root \/etc\/kubernetes\/ssl\/<span class=\"k\">*<\/span><span class=\"nt\">-key<\/span>.pem\r\n<\/code><\/pre>\n<p>\u521b\u5efa\u7b26\u53f7\u94fe\u63a5<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">cd<\/span> \/etc\/kubernetes\/ssl\/\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo ln<\/span> <span class=\"nt\">-s<\/span> kube-worker-0-worker.pem worker.pem\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sudo ln<\/span> <span class=\"nt\">-s<\/span> kube-worker-0-worker-key.pem worker-key.pem\r\n<\/code><\/pre>\n<p>\u91cd\u542fVPS<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>reboot\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>ssh <span class=\"k\">${<\/span><span class=\"nv\">MASTER_IP<\/span><span class=\"k\">}<\/span> <span class=\"nt\">-l<\/span> core\r\n<\/code><\/pre>\n<p>\u786e\u8ba4etcd3\u6b63\u5728\u8fd0\u884c<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>systemctl status etcd3\r\n<span class=\"nv\">$ <\/span>curl http:\/\/127.0.0.1:8080\/version\r\n<\/code><\/pre>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/45-0.png\" alt=\"268____.png\" \/><\/div>\n<p>\u79bb\u5f00VPS\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">exit<\/span>\r\n<\/code><\/pre>\n<h1>\u5b89\u88c5kubectl<\/h1>\n<p>\u4e0b\u8f7d kubectl\u3002<br \/>\n\u5bf9\u4e8e Linux\uff0c\u53ef\u4ee5\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>curl <span class=\"nt\">-O<\/span> https:\/\/storage.googleapis.com\/kubernetes-release\/release\/v1.13.1\/bin\/linux\/amd64\/kubectl\r\n<\/code><\/pre>\n<p>\u4e0b\u8f7d\u540e\uff0c\u8bf7\u786e\u8ba4\u6267\u884c\u6743\u9650\uff0c\u5e76\u5c06\u5176\u79fb\u52a8\u5230\u9002\u5f53\u7684\u8def\u5f84\u4e0a\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">chmod<\/span> +x kubectl\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">mv <\/span>kubectl \/usr\/local\/bin\/kubectl\r\n<\/code><\/pre>\n<p>\u914d\u7f6ekubectl\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Replace ${MASTER_HOST} with the master node address or name used in previous steps<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Replace ${CA_CERT} with the absolute path to the ca.pem created in previous steps<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Replace ${ADMIN_KEY} with the absolute path to the admin-key.pem created in previous steps<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">Replace ${ADMIN_CERT} with the absolute path to the admin.pem created in previous steps<\/ul>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl config set-cluster default-cluster <span class=\"nt\">--server<\/span><span class=\"o\">=<\/span>https:\/\/<span class=\"k\">${<\/span><span class=\"nv\">MASTER_HOST<\/span><span class=\"k\">}<\/span>:6443 <span class=\"nt\">--certificate-authority<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">CA_CERT<\/span><span class=\"k\">}<\/span>\r\n<span class=\"nv\">$ <\/span>kubectl config set-credentials default-admin <span class=\"nt\">--certificate-authority<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">CA_CERT<\/span><span class=\"k\">}<\/span> <span class=\"nt\">--client-key<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">ADMIN_KEY<\/span><span class=\"k\">}<\/span> <span class=\"nt\">--client-certificate<\/span><span class=\"o\">=<\/span><span class=\"k\">${<\/span><span class=\"nv\">ADMIN_CERT<\/span><span class=\"k\">}<\/span>\r\n<span class=\"nv\">$ <\/span>kubectl config set-context default-system <span class=\"nt\">--cluster<\/span><span class=\"o\">=<\/span>default-cluster <span class=\"nt\">--user<\/span><span class=\"o\">=<\/span>default-admin\r\n<span class=\"nv\">$ <\/span>kubectl config use-context default-system\r\n<\/code><\/pre>\n<p>\u68c0\u67e5kubectl\u7684\u914d\u7f6e\u548c\u8fde\u63a5\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl get nodes\r\nNAME          STATUS          AGE\r\nX.X.X.X       Ready           1d\r\n<\/code><\/pre>\n<h1>\u90e8\u7f72 Canal<\/h1>\n<p>\u5982\u679c\u9700\u8981\u91cd\u65b0\u5b89\u88c5\uff0c\u8bf7\u5728\u6bcf\u4e2a\u670d\u52a1\u5668\u4e0a\u5220\u9664\u4e0ecalico\u76f8\u5173\u7684\u76ee\u5f55\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo rm<\/span> <span class=\"nt\">-r<\/span> \/etc\/cni\/net.d \/opt\/cni\/bin \/var\/lib\/calico\r\n<\/code><\/pre>\n<p>\u6309\u7167https:\/\/docs.projectcalico.org\/getting-started\/kubernetes\/flannel\/flannel\u4e2d\u7684\u6b65\u9aa4\uff0c\u90e8\u7f72Canal\uff08\u7528\u4e8e\u7b56\u7565\u7684Calico\u548c\u7528\u4e8e\u7f51\u7edc\u7684flannel\uff09\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>curl https:\/\/docs.projectcalico.org\/manifests\/canal.yaml <span class=\"nt\">-O<\/span>\r\n<span class=\"nv\">$ <\/span><span class=\"nb\">sed<\/span> <span class=\"nt\">-i<\/span> <span class=\"nt\">-e<\/span> <span class=\"s2\">\"s?\/usr\/libexec\/kubernetes\/kubelet-plugins?\/var\/lib\/kubernetes\/kubelet-plugins?g\"<\/span> canal.yaml\r\n<span class=\"nv\">$ <\/span>kubectl apply <span class=\"nt\">-f<\/span> canal.yaml\r\n<\/code><\/pre>\n<h1>\u90e8\u7f72CoreDNS<\/h1>\n<p>\u6309\u7167 https:\/\/github.com\/coredns\/deployment\/tree\/master\/kubernetes \u4e2d\u7684\u6b65\u9aa4\u90e8\u7f72 CoreDNS\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span><span class=\"nb\">sudo <\/span>apt <span class=\"nt\">-y<\/span> <span class=\"nb\">install <\/span>jq\r\n<span class=\"nv\">$ <\/span>curl <span class=\"nt\">-O<\/span> https:\/\/raw.githubusercontent.com\/coredns\/deployment\/master\/kubernetes\/coredns.yaml.sed\r\n<span class=\"nv\">$ <\/span>curl <span class=\"nt\">-O<\/span> https:\/\/raw.githubusercontent.com\/coredns\/deployment\/master\/kubernetes\/deploy.sh\r\n<span class=\"nv\">$ <\/span>.\/deploy.sh <span class=\"nt\">-i<\/span> 10.3.0.10 | kubectl apply <span class=\"nt\">-f<\/span> -\r\n<\/code><\/pre>\n<p>\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u540e\uff0c\u5e94\u8be5\u4f1a\u51fa\u73b0\u5982\u4e0b\u6240\u793a\u7684\u5c4f\u5e55\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl get pods <span class=\"nt\">-n<\/span> kube-system <span class=\"nt\">-o<\/span><span class=\"o\">=<\/span>wide <span class=\"nt\">-a<\/span>\r\n<\/code><\/pre>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/68-0.png\" alt=\"kakunin.png\" \/><\/div>\n<h1>\u786e\u8ba4 Pod \u53ef\u4ee5\u90e8\u7f72\u3002<\/h1>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Pod<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">busybox<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">image<\/span><span class=\"pi\">:<\/span> <span class=\"s\">busybox<\/span>\r\n    <span class=\"na\">command<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">sleep<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">3600\"<\/span>\r\n    <span class=\"na\">imagePullPolicy<\/span><span class=\"pi\">:<\/span> <span class=\"s\">IfNotPresent<\/span>\r\n    <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">busybox<\/span>\r\n  <span class=\"na\">restartPolicy<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Always<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl create <span class=\"nt\">-f<\/span> busybox.yaml\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl get pods busybox\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl <span class=\"nb\">exec <\/span>busybox <span class=\"nt\">--<\/span> nslookup kubernetes.default\r\n<\/code><\/pre>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/74-0.png\" alt=\"zzzzzzzzzzzzz222.png\" \/><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u9996\u5148 \u4f7f\u7528CoreOS Container Linux\u5728 Sakura VPS \u4e0a\u90e8\u7f72 Kubernetes\u3002 [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-35699","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u5728\u6a31\u82b1vps\u4e0a\u4f7f\u7528coreos-container-linux\u642d\u5efakubernetes\u3002\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes\" \/>\n<meta property=\"og:description\" content=\"\u9996\u5148 \u4f7f\u7528CoreOS Container Linux\u5728 Sakura VPS \u4e0a\u90e8\u7f72 Kubernetes\u3002 [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u5728\u6a31\u82b1vps\u4e0a\u4f7f\u7528coreos-container-linux\u642d\u5efakubernetes\u3002\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-03T11:02:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-30T07:41:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/5-0.png\" \/>\n<meta name=\"author\" content=\"\u6e05, \u626c\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6e05, \u626c\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/\",\"name\":\"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-02-03T11:02:27+00:00\",\"dateModified\":\"2024-04-30T07:41:05+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\",\"name\":\"\u6e05, \u626c\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"caption\":\"\u6e05, \u626c\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u5728\u6a31\u82b1vps\u4e0a\u4f7f\u7528coreos-container-linux\u642d\u5efakubernetes\u3002\/","og_locale":"zh_CN","og_type":"article","og_title":"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes","og_description":"\u9996\u5148 \u4f7f\u7528CoreOS Container Linux\u5728 Sakura VPS \u4e0a\u90e8\u7f72 Kubernetes\u3002 [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u5728\u6a31\u82b1vps\u4e0a\u4f7f\u7528coreos-container-linux\u642d\u5efakubernetes\u3002\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-02-03T11:02:27+00:00","article_modified_time":"2024-04-30T07:41:05+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d24ff37434c4406c311e4\/5-0.png"}],"author":"\u6e05, \u626c","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6e05, \u626c","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/","name":"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-02-03T11:02:27+00:00","dateModified":"2024-04-30T07:41:05+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u5728\u6a31\u82b1VPS\u4e0a\u4f7f\u7528CoreOS Container Linux\u642d\u5efakubernetes"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461","name":"\u6e05, \u626c","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","caption":"\u6e05, \u626c"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%9c%a8%e6%a8%b1%e8%8a%b1vps%e4%b8%8a%e4%bd%bf%e7%94%a8coreos-container-linux%e6%90%ad%e5%bb%bakubernetes%e3%80%82\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=35699"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35699\/revisions"}],"predecessor-version":[{"id":92787,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35699\/revisions\/92787"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=35699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=35699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=35699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}