安装

相较于常用的 flannel ， calico  提供更高的性能和稳定性。更适合用于生产环境

官方安装说明：

https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-onprem/onpremises#install-calico-with-etcd-datastore

使用 manifest  etcd 的方式安装
这种方式需要为 calico 提供 etcd 数据库存放数据，可以使用 k8s 集群自带的 etcd

1 下载 yaml 文件

#!/bin/sh

curl https://raw.githubusercontent.com/projectcalico/calico/v3.27.3/manifests/calico-etcd.yaml -o calico-etcd.yaml
# curl https://nas.liu12.com/k8s/calico/v3.27.3/calico-etcd.yaml -o calico-etcd.yaml

2 修改配置

更改 calico-etcd.yaml 中的配置，另存为：calico-etcd-optimize.yaml

etcd的连接以及证书存放在etcd上面的位置

etcd_endpoints: "https://master-node-name-or-domain:2379"
etcd_ca: "/calico-secrets/etcd-ca"
etcd_cert: "/calico-secrets/etcd-cert"
etcd_key: "/calico-secrets/etcd-key"

禁用IPIP模式

- name: CALICO_IPV4POOL_IPIP
  value: "Never"  # 从 Aways 改为 Never

设置IP段

需要跟kubeadm 初始化的pod的IP段一致

- name: CALICO_IPV4POOL_CIDR
  value: "10.20.0.0/16"

禁用snat

"snat": false

从true改为false

3 创建 calico-etcd-secrets

calico 直接使用 k8s 自带的 etcd

导入 etcd 的证书到 k8s secret：calico-etcd-secrets

#!/bin/sh

rm -rf etcd-certs
mkdir etcd-certs

cp /etc/kubernetes/pki/etcd/ca.crt etcd-certs/etcd-ca
cp /etc/kubernetes/pki/etcd/peer.crt  etcd-certs/etcd-cert 
cp /etc/kubernetes/pki/etcd/peer.key  etcd-certs/etcd-key

# kubectl delete secret calico-etcd-secrets  -n kube-system
kubectl create secret -n kube-system generic calico-etcd-secrets \
  --from-file=etcd-certs/etcd-ca \
  --from-file=etcd-certs/etcd-cert \
  --from-file=etcd-certs/etcd-key

4 创建 calico 网络

#!/bin/sh

kubectl create -f calico-etcd-optimize.yaml

calico 安装失败，重置集群时，calico 网卡不会自动删掉，需手动删除

#!/bin/sh

# 查看网卡
# ip addr

ip link delete calicoxxxxx

导入 calico crds

#!/bin/sh

kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.3/manifests/operator-crds.yaml
# kubectl apply --server-side --force-conflicts -f https://nas.liu12.com/k8s/calico/v3.27.3/operator-crds.yaml

#!/bin/sh

calicoctl create -f bgp.yaml

bgp.yaml 内容

apiVersion: projectcalico.org/v3
kind: BGPConfiguration
metadata:
    name: default
spec:
    nodeToNodeMeshEnabled: false
    asNumber: 64567

#!/bin/sh

calicoctl create -f bgp-peer.yaml

bgp-peer.yaml

apiVersion: projectcalico.org/v3
kind: BGPPeer
metadata:
  name: my-global-peer
spec:
  peerIP: 10.18.0.254
  asNumber: 64567