AWS EKS1.26+kubesphere3.4.1-编程知识

1、前提准备

1台EC2服务器Amazon Linux2，设置admin的角色

安装 aws cli V2


curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"unzip awscliv2.zipsudo ./aws/installexport PATH=/usr/local/bin:$PATHsource ~/.bash_profile

安装kubectl 1.27


curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.27.1/2023-04-19/bin/linux/amd64/kubectlchmod +x ./kubectlmkdir -p $HOME/bin && cp ./kubectl $HOME/bin/kubectl && export PATH=$PATH:$HOME/binecho 'export PATH=$PATH:$HOME/bin' >> ~/.bashrckubectl version --short --client

安装 eksctl 最新版本


使用以下命令下载并提取最新版本的 eksctl。curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp将提取的二进制文件移至 /usr/local/bin。sudo mv /tmp/eksctl /usr/local/bin使用以下命令测试您的安装是否成功。eksctl version

安装helm


wget https://get.helm.sh/helm-v3.11.1-linux-amd64.tar.gztar -zxvf helm-v3.11.1-linux-amd64.tar.gz sudo mv linux-amd64/helm /usr/local/bin/helm

2、创建集群

使用eksctl安装EKS集群（这里自动新建了一个VPC，以及对应的子网。自动创建的子网，EKS 相关的标签已自动打好)

修改下面的集群名字

sudo yum install -y jqexport AWS_REGION=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r '.region')echo "export AWS_REGION=${AWS_REGION}" | tee -a ~/.bash_profileaws configure set default.region ${AWS_REGION}export ACCOUNT_ID=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r '.accountId')echo "export ACCOUNT_ID=${ACCOUNT_ID}" | tee -a ~/.bash_profileexport CLUSTER_NAME="eks-demo2"

需要根据实际场景修改下面的实例类型

cat << EOF > ${CLUSTER_NAME}-cluster.yaml---apiVersion: eksctl.io/v1alpha5kind: ClusterConfigmetadata:name: ${CLUSTER_NAME} # EKS Cluster nameregion: ${AWS_REGION} # Region Code to place EKS Clusterversion: "1.26"tags:karpenter.sh/discovery: ${CLUSTER_NAME}vpc:cidr: "10.101.0.0/16" # CIDR of VPC for use in EKS Clusternat:gateway: Disable # Disable NAT Gatewaykarpenter:version: 'v0.30.0'createServiceAccount: true # default is falsedefaultInstanceProfile: 'KarpenterNodeInstanceProfile' # default is to use the IAM instance profile created by eksctlwithSpotInterruptionQueue: true # adds all required policies and rules for supporting Spot Interruption Queue, default is falseiam:withOIDC: true # requiredmanagedNodeGroups:- name: node-group # Name of node group in EKS ClusterinstanceType: t3.xlarge # Instance type for node groupdesiredCapacity: 2 # The number of worker node in EKS ClustervolumeSize: 100  # EBS Volume for worker node (unit: GiB)volumeType: 'gp3'maxPodsPerNode: 100privateNetworking: falsessh:enableSsm: trueiam:withAddonPolicies:imageBuilder: true # Add permission for Amazon ECRalbIngress: true  # Add permission for ALB IngresscloudWatch: true # Add permission for CloudWatchautoScaler: true # Add permission Auto Scalingebs: true # Add permission EBS CSI driverEOFeksctl create cluster -f ${CLUSTER_NAME}-cluster.yaml

3、安装应的LB Controller

获取ID，确认 OIDC 是否已安装

aws eks describe-cluster --name ${CLUSTER_NAME} --query "cluster.identity.oidc.issuer" --output text

输出如下文本：

https://oidc.eks.cn-northwest-1.amazonaws.com.cn/id/36A3B4C5ED098358C3C724DA105EBC86

若没有安装，则执行：

安装OIDC

eksctl utils associate-iam-oidc-provider \

--region ${AWS_REGION} \

--cluster ${CLUSTER_NAME} \

--approve

创建一个 IAM policy。

下载 Amazon Load Balancer Controller 的 IAM policy，该策略允许负载均衡器代表您调用 Amazon API。

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.5.4/docs/install/iam_policy.json

使用上一步中下载的策略创建一个 IAM policy。

aws iam create-policy \

--policy-name AWSLoadBalancerControllerIAMPolicy_${CLUSTER_NAME} \

--policy-document file://iam_policy.json

创建serviceaccount

eksctl create iamserviceaccount \

--cluster=${CLUSTER_NAME} \

--namespace=kube-system \

--name=aws-load-balancer-controller \

--role-name AmazonEKSLoadBalancerControllerRole_${CLUSTER_NAME} \

--attach-policy-arn=arn:aws:iam::${ACCOUNT_ID}:policy/AWSLoadBalancerControllerIAMPolicy_${CLUSTER_NAME} \

--approve

添加 eks-charts 存储库。

helm repo add eks https://aws.github.io/eks-charts

更新您的本地存储库，以确保您拥有最新的图表。

helm repo update

进行安装

helm install aws-load-balancer-controller eks/aws-load-balancer-controller \-n kube-system \--set clusterName=${CLUSTER_NAME} \--set serviceAccount.create=false \--set serviceAccount.name=aws-load-balancer-controller \--set enableShield=false \--set enableWaf=false \--set enableWafv2=false \

验证控制器是否已安装。

kubectl get deployment -n kube-system aws-load-balancer-controller

输出示例如下。

NAME READY UP-TO-DATE AVAILABLE AGE

aws-load-balancer-controller 2/2 2 2 84s

安装EBS CSI驱动

eksctl create iamserviceaccount \--name ebs-csi-controller-sa \--namespace kube-system \--cluster ${CLUSTER_NAME} \--role-name AmazonEKS_EBS_CSI_DriverRole_${CLUSTER_NAME} \--role-only \--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \--approveeksctl create addon --name aws-ebs-csi-driver --cluster ${CLUSTER_NAME} --service-account-role-arn  arn:aws:iam::${ACCOUNT_ID}:role/AmazonEKS_EBS_CSI_DriverRole_${CLUSTER_NAME} –force

4、安装kubesphere

4.1、最小化安装

使用 kubectl 安装 KubeSphere，

以下命令仅用于默认的最小安装。

kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.1/kubesphere-installer.yamlkubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.1/cluster-configuration.yaml

检查安装日志：

kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}') -f

安装完成后，您会看到以下消息：

#####################################################
###              Welcome to KubeSphere!           ###
#####################################################
Account: admin
Password: P@88w0rd
NOTES：1. After logging into the console, please check themonitoring status of service components inthe "Cluster Management". If any service is notready, please wait patiently until all componentsare ready.2. Please modify the default password after login.
#####################################################
https://kubesphere.io             2020-xx-xx xx:xx:xx

访问 KubeSphere 控制台

现在已经安装了 KubeSphere，您可以按照以下步骤访问 KubeSphere 的 Web 控制台。

查看 ks-console 服务。

kubectl get svc -n kubesphere-system

但是这种内网 IP 无法直接用于外部访问，需要通过NodePort来暴露external-ip

执行kubectl edit ks-console将 service 类型NodePort 更改为LoadBalancer，并且增加三条注解，完成后保存文件。

kubectl edit svc ks-console -n kubesphere-system

    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ipservice.beta.kubernetes.io/aws-load-balancer-scheme: internet-facingservice.beta.kubernetes.io/aws-load-balancer-type: external

#
......
spec:clusterIP: 10.100.160.240externalTrafficPolicy: Clusterports:- name: nginxnodePort: 30880port: 80protocol: TCPtargetPort: 8000selector:app: ks-consoletier: frontendversion: v3.0.0sessionAffinity: Nonetype: LoadBalancer

执行kubectl get svc -n kubesphere-system获取您的 EXTERNAL-IP。

# kubectl get svc -n kubesphere-system
NAME                    TYPE           CLUSTER-IP       EXTERNAL-IP                                                               PORT(S)        AGE
ks-apiserver            ClusterIP      10.100.108.212   <none>                                                                    80/TCP         6m28s
ks-console              LoadBalancer   10.100.160.240   ad107c54ee456744c91c8da0b9321f2c-1235661477.ap-east-1.elb.amazonaws.com   80:30880/TCP   6m25s
ks-controller-manager   ClusterIP      10.100.126.96    <none>                                                                    443/TCP        6m28s
openldap                ClusterIP      None             <none>                                                                    389/TCP        6m54s
redis                   ClusterIP      10.100.218.34    <none>                                                                    6379/TCP       6m59s