Merge pull request labring#592 from oldthreefeng/requirement

Requirements and Recommendations for labring#591
jinyanroot · Jan 27, 2021 · 0310d35 · 0310d35
2 parents 245e9e5 + 3ce8e4c
commit 0310d35
Show file tree

Hide file tree

Showing 5 changed files with 347 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -32,6 +32,43 @@
 
 [English Docs](/README_en.md)
 
+# 支持的环境
+
+## Linux 发行版, CPU架构
+
+- Ubuntu 16.04， 18.04， 20.04 ,  x86_64/ arm64
+- Centos/RHEL 7.6+,  x86_64/ arm64
+- 其他支持 systemd 的系统环境.  x86_64/ arm64
+
+## kubernetes 版本
+
+- 1.16+
+- 1.17+
+- 1.18+
+- 1.19+
+- 1.20+
+
+更多版本支持, 详细查看[sealyun.com](https://www.sealyun.com)
+
+## 要求和建议
+
+- 最低资源要求
+   - 2 vCpu
+   - 4G Ram
+   - 40G+ 存储
+
+- 操作系统要求
+   - ssh 可以访问各安装节点
+   - 各节点主机名不相同，并满足kubernetes的主机名要求。
+   - 各节点时间同步
+   - 网卡名称如果是不常见的，建议修改成规范的网卡名称， 如(eth.*|en.*|em.*)
+   - kubernetes1.20+ 使用containerd作为cri. 不需要用户安装docker/containerd. sealos会安装1.3.9版本containerd。
+   - kubernetes1.19及以下 使用docker作为cri。 也不需要用户安装docker。 sealos会安装1.19.03版本docker
+ - 网络和 DNS 要求：
+   - 确保 /etc/resolv.conf 中的 DNS 地址可用。否则，可能会导致群集中coredns异常。 
+   - 如果使用阿里云/华为云主机部署。 默认的pod网段会和阿里云的dns网段冲突， 建议自定义修改pod网段, 在init的时候指定`--podcidr` 来修改。
+   - sealos 默认会关闭防火墙， 如果需要打开防火墙， 建议手动放行相关的端口。
+
 # 🚀 快速开始
 
 > 环境信息

diff --git a/README_en.md b/README_en.md
@@ -11,6 +11,44 @@ Build a production kubernetes HA cluster.
 * If any master is down, lvscare will remove the ipvs realserver, when master recover it will add it back.
 * Sealos will send package and apply install commands, so we needn't ansible.
 
+# Supported Environment
+
+## Linux Distributions 
+
+- Ubuntu 16.04， 18.04， 20.04 ,  x86_64/ arm64
+- Centos/RHEL 7.6+,  x86_64/ arm64
+- 99% systemd manage linux system。 x86_64/ arm64
+
+## kubernetes Versions
+
+- 1.16+
+- 1.17+
+- 1.18+
+- 1.19+
+- 1.20+
+
+Looking for more supported versions，[sealyun.com](https://www.sealyun.com)。
+sealos is currently supported the latest k8s 1.20+
+
+## Requirements and Recommendations
+
+- Minimum resource requirements 
+   - 2 vCpu
+   - 4G RAM
+   - 40G+ Storage
+
+- OS requirements
+   - SSH can access to all nodes.
+   - hostname is uniq ，and satisfied kubernetes requirements。
+   - Time synchronization for all nodes.
+   - network Iface has a stranger name, change it to (eth.*|en.*|em.*)
+   - kubernetes1.20+, use containerd for default cri. user should not to install containerd or docker-ce. sealos will do it
+   - kubernetes1.19-, use docker for default cri. user should not to install docker-ce. sealos will do it for you
+ - Networking and DNS requirements：
+   - Make sure the DNS address in /etc/resolv.conf is available. Otherwise, it may cause some issues of DNS in cluster。 
+   - if you use aliyun/huawei cloud to deploy kubernetes 。 default pod cidr is confilct with dns cidr， we recommand you install kubernetes init flag to add  `--podcidr`  to aviod this problem。
+   - sealos default to disable firewalld ，It's recommended that you turn off the firewall. if you want to use firewalld , remember to allow kubernetes port traffic。
+
 # Quick Start
 ## PreInstall
 * Install and start docker

diff --git a/README_zh.md b/README_zh.md
@@ -32,6 +32,44 @@
 
 [English Docs](/README_en.md)
 
+
+# 支持的环境
+
+## Linux 发行版, CPU架构
+
+- Ubuntu 16.04， 18.04， 20.04 ,  x86_64/ arm64
+- Centos/RHEL 7.6+,  x86_64/ arm64
+- 其他支持 systemd 的系统环境.  x86_64/ arm64
+
+## kubernetes 版本
+
+- 1.16+
+- 1.17+
+- 1.18+
+- 1.19+
+- 1.20+
+
+更多版本支持, 详细查看[sealyun.com](https://www.sealyun.com)
+
+## 要求和建议
+
+- 最低资源要求
+   - 2 vCpu
+   - 4G Ram
+   - 40G+ 存储
+
+- 操作系统要求
+   - ssh 可以访问各安装节点
+   - 各节点主机名不相同，并满足kubernetes的主机名要求。
+   - 各节点时间同步
+   - 网卡名称如果是不常见的，建议修改成规范的网卡名称， 如(eth.*|en.*|em.*)
+   - kubernetes1.20+ 使用containerd作为cri. 不需要用户安装docker/containerd. sealos会安装1.3.9版本containerd。
+   - kubernetes1.19及以下 使用docker作为cri。 也不需要用户安装docker。 sealos会安装1.19.03版本docker
+ - 网络和 DNS 要求：
+   - 确保 /etc/resolv.conf 中的 DNS 地址可用。否则，可能会导致群集中coredns异常。 
+   - 如果使用阿里云/华为云主机部署。 默认的pod网段会和阿里云的dns网段冲突， 建议自定义修改pod网段, 在init的时候指定`--podcidr` 来修改。
+   - sealos 默认会关闭防火墙， 如果需要打开防火墙， 建议手动放行相关的端口。
+
 # 🚀 快速开始
 
 > 环境信息

diff --git a/install/init.go b/install/init.go
@@ -182,8 +182,8 @@ func (s *SealosInstaller) InstallMaster0() {
 	}
 	//cmd = `kubectl apply -f /root/kube/conf/net/calico.yaml || true`
 
-	// can-reach is used by calico multi network
-	if k8s.IsIpv4(Interface) {
+	// can-reach is used by calico multi network , flannel has nothing to add. just Use it. 
+	if k8s.IsIpv4(Interface) && Network == "calico" {
 		Interface = "can-reach=" + Interface
 	} else {
 		Interface = "interface=" + Interface

diff --git a/net/flannel.go b/net/flannel.go
@@ -22,6 +22,10 @@ func (Flannel) Template() string {
 	return FlannelManifests
 }
 
+// kube-flannel.yaml uses ClusterRole & ClusterRoleBinding of rbac.authorization.k8s.io/v1. When you use Kubernetes v1.16, 
+// you should replace rbac.authorization.k8s.io/v1 to rbac.authorization.k8s.io/v1beta1 
+// because rbac.authorization.k8s.io/v1 had become GA from Kubernetes v1.17. 
+// TODO v1.16- 如果使用flannel 需要使用另外的yaml
 const FlannelManifests = `
 ---
 apiVersion: policy/v1beta1
@@ -631,3 +635,231 @@ spec:
           configMap:
             name: kube-flannel-cfg
 `
+
+// lastet flannel k8s manifests. For Kubernetes v1.17+ 
+const newFlannelYaml = `
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: psp.flannel.unprivileged
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+spec:
+  privileged: false
+  volumes:
+  - configMap
+  - secret
+  - emptyDir
+  - hostPath
+  allowedHostPaths:
+  - pathPrefix: "/etc/cni/net.d"
+  - pathPrefix: "/etc/kube-flannel"
+  - pathPrefix: "/run/flannel"
+  readOnlyRootFilesystem: false
+  # Users and groups
+  runAsUser:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  # Privilege Escalation
+  allowPrivilegeEscalation: false
+  defaultAllowPrivilegeEscalation: false
+  # Capabilities
+  allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
+  defaultAddCapabilities: []
+  requiredDropCapabilities: []
+  # Host namespaces
+  hostPID: false
+  hostIPC: false
+  hostNetwork: true
+  hostPorts:
+  - min: 0
+    max: 65535
+  # SELinux
+  seLinux:
+    # SELinux is unused in CaaSP
+    rule: 'RunAsAny'
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: flannel
+rules:
+- apiGroups: ['extensions']
+  resources: ['podsecuritypolicies']
+  verbs: ['use']
+  resourceNames: ['psp.flannel.unprivileged']
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes/status
+  verbs:
+  - patch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: flannel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flannel
+subjects:
+- kind: ServiceAccount
+  name: flannel
+  namespace: kube-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flannel
+  namespace: kube-system
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: kube-flannel-cfg
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+data:
+  cni-conf.json: |
+    {
+      "name": "cbr0",
+      "cniVersion": "0.3.1",
+      "plugins": [
+        {
+          "type": "flannel",
+          "delegate": {
+            "hairpinMode": true,
+            "isDefaultGateway": true
+          }
+        },
+        {
+          "type": "portmap",
+          "capabilities": {
+            "portMappings": true
+          }
+        }
+      ]
+    }
+  net-conf.json: |
+    {
+      "Network": "{{ .CIDR }}",
+      "Backend": {
+        "Type": "vxlan"
+      }
+    }
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  selector:
+    matchLabels:
+      app: flannel
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                - linux
+      hostNetwork: true
+      priorityClassName: system-node-critical
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      initContainers:
+      - name: install-cni
+        image: quay.io/coreos/flannel:v0.13.1-rc1
+        command:
+        - cp
+        args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        volumeMounts:
+        - name: cni
+          mountPath: /etc/cni/net.d
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.13.1-rc1
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        - --iface-regex={{ .Interface }}
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: false
+          capabilities:
+            add: ["NET_ADMIN", "NET_RAW"]
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run/flannel
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+      - name: run
+        hostPath:
+          path: /run/flannel
+      - name: cni
+        hostPath:
+          path: /etc/cni/net.d
+      - name: flannel-cfg
+        configMap:
+          name: kube-flannel-cfg
+`