[TOC] image 版本与 calico-node 版本修改成一致即可。 # 安装在操作系统 ## k8s作为数据面 ```shell $ curl -L https://github.com/projectcalico/calico/releases/download/v3.23.5/calicoctl-linux-amd64 -o /usr/local/bin/calicoctl $ chmod +x /usr/local/bin/calicoctl ``` ## etcd作为数据面 ```shell $ curl -L https://github.com/projectcalico/calico/releases/download/v3.23.5/calicoctl-linux-amd64 -o /usr/local/bin/calicoctl $ chmod +x /usr/local/bin/calicoctl $ mkdir /etc/calico $ cat <<'EOF' | tee /etc/calico/calicoctl.cfg > /dev/null apiVersion: projectcalico.org/v3 kind: CalicoAPIConfig metadata: spec: etcdEndpoints: https://192.168.32.127:2379,https://192.168.32.128:2379,https://192.168.32.129:2379 etcdKeyFile: /etc/kubernetes/pki/etcd/calico-etcd-client.key etcdCertFile: /etc/kubernetes/pki/etcd/calico-etcd-client.crt etcdCACertFile: /etc/kubernetes/pki/etcd/ca.crt EOF ``` # 安装在POD方案 ## k8s作为数据面 ```shell $ cat <<'EOF' | kubectl apply -f - apiVersion: v1 kind: ServiceAccount metadata: name: calicoctl namespace: kube-system --- apiVersion: apps/v1 kind: Deployment metadata: name: calicoctl namespace: kube-system spec: replicas: 1 selector: matchLabels: app: calicoctl strategy: {} template: metadata: labels: app: calicoctl spec: nodeSelector: kubernetes.io/os: linux hostNetwork: true serviceAccountName: calicoctl containers: - image: calico/ctl:v3.23.5 command: - calicoctl args: - version - --poll=1m env: - name: DATASTORE_TYPE value: kubernetes --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: calicoctl rules: - apiGroups: [""] resources: - namespaces - nodes verbs: - get - list - update - apiGroups: [""] resources: - nodes/status verbs: - update - apiGroups: [""] resources: - pods - serviceaccounts verbs: - get - list - apiGroups: [""] resources: - pods/status verbs: - update - apiGroups: ["crd.projectcalico.org"] resources: - bgppeers - bgpconfigurations - clusterinformations - felixconfigurations - globalnetworkpolicies - globalnetworksets - ippools - ipreservations - kubecontrollersconfigurations - networkpolicies - networksets - hostendpoints - ipamblocks - blockaffinities - ipamhandles - ipamconfigs verbs: - create - get - list - update - delete - apiGroups: ["networking.k8s.io"] resources: - networkpolicies verbs: - get - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: calicoctl roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: calicoctl subjects: - kind: ServiceAccount name: calicoctl namespace: kube-system EOF $ alias calicoctl="kubectl -n kube-system exec deployment/calicoctl -- /calicoctl" ``` ## etcd作为数据面 ```shell $ cat <<'EOF' | kubectl apply -f - apiVersion: v1 kind: Pod metadata: name: calicoctl namespace: kube-system spec: nodeSelector: kubernetes.io/os: linux hostNetwork: true containers: - name: calicoctl image: calico/ctl:v3.23.5 command: - /calicoctl args: - version - --poll=1m # 使用到的 calico-config 的configMap，在安装calico插件期间已经创建 env: - name: ETCD_ENDPOINTS valueFrom: configMapKeyRef: name: calico-config key: etcd_endpoints - name: ETCD_CA_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_ca - name: ETCD_KEY_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_key - name: ETCD_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_cert volumeMounts: - mountPath: /calico-secrets name: etcd-certs # 使用到的 calico-etcd-secrets 的secret，在安装calico插件期间已经创建 volumes: - name: etcd-certs secret: secretName: calico-etcd-secrets EOF $ alias calicoctl="kubectl -n kube-system exec -it calicoctl -- /calicoctl" ```