k3s

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

k3s (by Rancher/SUSE) packs the control plane, containerd, Flannel networking, CoreDNS, the Traefik ingress, a local-path storage class and a service load balancer into one ~70 MB binary. A server node runs the control plane (SQLite by default, embedded etcd for HA); agent nodes join with a token. It runs well on 2 GB VMs and Raspberry Pis, so it fits the DevSecOps path lab (phase Kubernetes).

The service is k3s.service (server) or k3s-agent.service. k3s kubectl, k3s crictl and k3s ctr are built in.

طريقة الكتابة

curl -sfL https://get.k3s.io | sh -s - [server|agent] [FLAGS]
k3s kubectl|crictl|ctr|etcd-snapshot|certificate|token ...

الأجزاء الرئيسية

Subcommands

server: Run a control-plane node.
agent: Run a worker node.
kubectl: Built-in kubectl.
crictl / ctr: Built-in container runtime tools.
etcd-snapshot save|ls|prune: Back up embedded etcd.
certificate rotate|check: Renew the cluster certificates.
token create|list: Manage join tokens.
check-config: Check kernel and host settings.

الخيارات 11

الأكثر استخدامًا

Install and server flags

INSTALL_K3S_VERSION=v1.31.4+k3s1: Pin the version (env var for the script).
K3S_URL=https://SERVER:6443 / K3S_TOKEN=…: Join an agent (env vars).
--cluster-init: Start an embedded-etcd HA cluster.
--server https://SERVER:6443: Join as an extra server.
--disable traefik|servicelb|local-storage: Turn off a built-in part.
--write-kubeconfig-mode 644: Rights of the kubeconfig file.
--tls-san NAME: Extra name/IP in the API certificate.
--node-taint KEY=VAL:NoSchedule: Taint the node.
--secrets-encryption: Encrypt Secrets in the datastore.
--protect-kernel-defaults: CIS hardening flag.
--flannel-backend wireguard-native: Encrypt pod traffic between nodes.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Install a single-node cluster

#curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=v1.31.4+k3s1 sh -s - --write-kubeconfig-mode 600
#k3s kubectl get nodes
#systemctl status k3s

2Use it from your normal user

$mkdir -p ~/.kube && sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config && sudo chown $USER: ~/.kube/config
$kubectl get pods -A

3Join a worker node

#cat /var/lib/rancher/k3s/server/node-token
#curl -sfL https://get.k3s.io | K3S_URL=https://192.168.122.11:6443 K3S_TOKEN=K10…::server:… sh -
$kubectl get nodes

4Build a 3-server HA cluster with etcd

#curl -sfL https://get.k3s.io | sh -s - server --cluster-init --tls-san k3s.lab.local
#curl -sfL https://get.k3s.io | K3S_TOKEN=K10… sh -s - server --server https://192.168.122.11:6443

5Disable Traefik to use ingress-nginx instead

#curl -sfL https://get.k3s.io | sh -s - --disable traefik

6Turn on Secrets encryption and check it

#curl -sfL https://get.k3s.io | sh -s - --secrets-encryption
#k3s secrets-encrypt status

7Back up and list etcd snapshots

#k3s etcd-snapshot save --name before-upgrade
#k3s etcd-snapshot ls

8See containers on the node
```
#k3s crictl ps
#k3s crictl images
```

9Open the firewall on RHEL

#firewall-cmd --permanent --add-port={6443,10250}/tcp --add-port=8472/udp
#firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 --add-source=10.43.0.0/16 && firewall-cmd --reload

10Uninstall

#/usr/local/bin/k3s-uninstall.sh
#/usr/local/bin/k3s-agent-uninstall.sh

انتبه

Read the install script before you pipe it into sh, and pin the version.
/etc/rancher/k3s/k3s.yaml is a cluster-admin credential.
The node token joins nodes to your cluster; keep it secret.

الملفات

/etc/rancher/k3s/k3s.yaml: Admin kubeconfig.
/etc/rancher/k3s/config.yaml: Flags as a config file.
/var/lib/rancher/k3s/: Data, images, etcd, manifests.
/var/lib/rancher/k3s/server/manifests/: YAML here is applied automatically.

نصائح للحفظ

Put flags in /etc/rancher/k3s/config.yaml instead of long install lines.
For upgrades use the system-upgrade-controller or rerun the script with a newer version, one node at a time.

رموز الخروج

`0`	Success.
`1`	Error.

`k3s`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Subcommands

الخيارات 11

Install and server flags

أمثلة 10

1Install a single-node cluster

2Use it from your normal user

3Join a worker node

4Build a 3-server HA cluster with etcd

5Disable Traefik to use ingress-nginx instead

6Turn on Secrets encryption and check it

7Back up and list etcd snapshots

8See containers on the node

9Open the firewall on RHEL

10Uninstall

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Subcommands

الخيارات 11

Install and server flags

أمثلة 10

1Install a single-node cluster

2Use it from your normal user

3Join a worker node

4Build a 3-server HA cluster with etcd

5Disable Traefik to use ingress-nginx instead

6Turn on Secrets encryption and check it

7Back up and list etcd snapshots

8See containers on the node

9Open the firewall on RHEL

10Uninstall

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`k3s`