写在最前

前面已经完整地试验过搭建 1.21.x 版本，可以参考前文快速回顾部署流程。对于 1.24.x 版本，部署过程可以加速执行，省略其中一些 中间步骤的细节。

1. 前置条件

  1. Kubernetes 构建指南：二进制部署 v1.21.x

  2. etcd 集群安装与配置

  3. haproxy、keepalived 安装与配置

2. 部署流程

2.1 证书生成

统一将所有内容放在 /data/k8s-work 目录下进行管理，并使用 cfssl 工具生成证书。如果链接失效无法下载，你可以使用我已经下载好的 cfssl.zip 文件。

cd /data/k8s-work && cd /data/k8s-work
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

chmod +x cfssl*

mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

2.1.1 创建ca证书

cat > ca-csr.json <<"EOF"
{
  "CN": "kubernetes",
  "key": {
      "algo": "rsa",
      "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "kubemsb",
      "OU": "CN"
    }
  ],
  "ca": {
          "expiry": "87600h"
  }
}
EOF

# 生成
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

2.1.2 创建etcd证书

cat > etcd-csr.json <<"EOF"
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "172.31.0.12",
    "172.31.0.13",
    "172.31.0.14"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "kubemsb",
    "OU": "CN"
  }]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson  -bare etcd

2.1.3 创建kube-apiserver证书

cat > kube-apiserver-csr.json << "EOF"
{
"CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "172.31.0.12",
    "172.31.0.13",
    "172.31.0.14",
    "172.31.0.15",
    "172.31.0.16",
    "172.31.0.17",
    "172.31.0.18",
    "172.31.0.19",
    "172.31.0.20",
    "172.31.0.21",
    "172.31.0.22",
    "172.31.0.23",
    "172.31.0.24",
    "172.31.0.25",
    "172.31.0.26",
    "172.31.0.27",
    "172.31.0.28",
    "172.31.0.29",
    "172.31.0.30",
    "172.31.0.100",
    "10.96.0.1",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "kubemsb",
      "OU": "CN"
    }
  ]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-apiserver-csr.json | cfssljson -bare kube-apiserver

2.1.4 创建kubectl证书

cat > admin-csr.json << "EOF"
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "system:masters",             
      "OU": "system"
    }
  ]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

2.1.5 创建kube-scheduler证书

cat > kube-scheduler-csr.json << "EOF"
{
    "CN": "system:kube-scheduler",
    "hosts": [
      "127.0.0.1",
      "172.31.0.12",
      "172.31.0.13",
      "172.31.0.14"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
      {
        "C": "CN",
        "ST": "Beijing",
        "L": "Beijing",
        "O": "system:kube-scheduler",
        "OU": "system"
      }
    ]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-scheduler-csr.json | cfssljson -bare kube-scheduler

2.1.6 创建kube-controller-manager证书

cat > kube-controller-manager-csr.json << "EOF"
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
      "127.0.0.1",
      "172.31.0.12",
      "172.31.0.13",
      "172.31.0.14"
    ],
    "names": [
      {
        "C": "CN",
        "ST": "Beijing",
        "L": "Beijing",
        "O": "system:kube-controller-manager",
        "OU": "system"
      }
    ]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

2.1.7 创建kube-proxy证书

cat > kube-proxy-csr.json << "EOF"
{
  "CN": "system:kube-proxy",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "kubemsb",
      "OU": "CN"
    }
  ]
}
EOF

# 生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

2.2 下载安装

你可以查看所有大版本及其对应的最终版本，选择一个合适的最终版本进行下载即可。

https://kubernetes.io/zh-cn/releases/patch-releases/
# 下载1.24.17二进制文件
cd /data/k8s-work/ && wget https://dl.k8s.io/v1.24.17/kubernetes-server-linux-amd64.tar.gz

2.3 文件分发