Cài đặt Kubernetes và triển khai ứng dụng trên onprimse

sudo tee /etc/modules-load.d/containerd.conf <<EOF
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

echo "net.bridge.bridge-nf-call-ip6tables = 1" | sudo tee -a /etc/sysctl.d/kubernetes.conf
echo "net.bridge.bridge-nf-call-iptables = 1" | sudo tee -a /etc/sysctl.d/kubernetes.conf
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.d/kubernetes.conf

sudo apt install -y curl gnupg2 software-properties-common apt-transport-https ca-certificates
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/docker.gpg
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

sudo apt update -y
sudo apt install -y containerd.io

containerd config default | sudo tee /etc/containerd/config.toml >/dev/null 2>&1
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml

sudo systemctl restart containerd
sudo systemctl enable containerd

echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

sudo apt update -y
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl 

sudo kubeadm reset -f
sudo rm -rf /var/lib/etcd
sudo rm -rf /etc/kubernetes/manifests/*

sudo kubeadm init
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/calico.yaml

sudo kubeadm join 10.100.1.24:6443 --token your_token --discovery-token-ca-cert-hash your_sha

iadmin@k8s-master01:~$ kubectl get nodes
NAME           STATUS   ROLES           AGE     VERSION
k8s-master01   Ready    control-plane   3d22h   v1.30.14
k8s-worker01   Ready    worker          3d22h   v1.30.14
k8s-worker02   Ready    worker          3d22h   v1.30.14

sudo apt update
sudo apt upgrade -y
sudo apt install apt-transport-https ca-certificates curl software-properties-common -y
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list> /dev/null

sudo apt update
sudo apt install docker-ce docker-compose docker-ce-cli containerd.io -y

docker network create -d macvlan --subnet=10.100.1.0/24 --ip-range=10.100.1.0/28 --gateway=10.100.1.1 -o macvlan_mode=bridge -o parent=ens33 rancher_network

version: '3.9'

services:
  rancher:
    image: rancher/rancher:v2.12.0
    container_name: rancher
    restart: always
    volumes:
      - /data/rancher/data:/var/lib/rancher
    environment:
      CATTLE_BOOTSTRAP_PASSWORD: "BeoBeo@2025"
    networks:
      rancher_network:
        ipv4_address: 10.100.1.54
    privileged: true
  
networks:
  rancher_network:
    external: true

wget https://get.helm.sh/helm-v3.17.4-linux-amd64.tar.gz
tar vxf helm-v3.17.4-linux-amd64.tar.gz
mv linux-amd64/helm /usr/bin/

apiVersion: v1
kind: Namespace
metadata:
  labels:
    name: beobeo
  name: beobeo

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    workloadselector: apps.deployment-beobeo-shoping-cart
  name: shoping-cart
  namespace: beobeo
spec:
  progressDeadlineSeconds: 600
  replicas: 2
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      workloadselector: apps.deployment-beobeo-shoping-cart
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        workloadselector: apps.deployment-beobeo-shoping-cart
      namespace: beobeo
    spec:
      containers:
        - image: beobeo/shoes-shop:latest
          imagePullPolicy: Always
          name: shoping-cart
          ports:
            - containerPort: 8080
              name: tcp
              protocol: TCP

apiVersion: v1
kind: Service
metadata:
  name: tcp
  namespace: beobeo
spec:
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: tcp
      nodePort: 31234
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    workloadselector: apps.deployment-beobeo-shoping-cart
  sessionAffinity: None
  type: NodePort

apiVersion: v1
kind: Service
metadata:
  name: sp-clusterip
  namespace: beobeo
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: tcp
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    workloadselector: apps.deployment-beobeo-shoping-cart
  sessionAffinity: None
  type: ClusterIP

file Ingres.yml (cần cài Ingress Nginx trước khi cài Ingress)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  generation: 2
  namespace: beobeo
spec:
  ingressClassName: nginx
  rules:
    - host: shoping-shoes.lc
      http:
        paths:
          - backend:
              service:
                name: sp-clusterip
                port:
                  number: 80
            path: /
            pathType: Prefix

Chaỵ các lệnh:

kubectl apply -f Namespace.yml
kubectl apply -f Deployment.yml
kubectl apply -f NodePort.yml
kubectl apply -f ClusterIP.yml
kubectl apply -f Ingress.yml

version: '3.9'
services:
  nginx-proxy-manager:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy-manager
    restart: always
    ports:
      - '80:80'         # HTTP
      - '81:81'         # Web UI
      - '443:443'       # HTTPS
    environment:
      DB_MYSQL_HOST: "10.100.1.54"
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: "npm"
      DB_MYSQL_PASSWORD: "npm_password"
      DB_MYSQL_NAME: "npm_db_1"
    volumes:
      - ./data/nginx/data:/data
      - ./data/nginx/letsencrypt:/etc/letsencrypt
    networks:
      rancher_network:
        ipv4_address: 10.100.1.55

  npm-db-1:
    image: 'mariadb:10.5'
    container_name: npm-db-1
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: 'npm_rootpass'
      MYSQL_DATABASE: 'npm_db_1'
      MYSQL_USER: 'npm'
      MYSQL_PASSWORD: 'npm_password'
    volumes:
      - ./data/mysql:/var/lib/mysql
    networks:
      rancher_network:
        ipv4_address: 10.100.1.54
   
   rancher:
    image: rancher/rancher:v2.12.0
    container_name: rancher
    restart: always
    privileged: true
    environment:
      CATTLE_BOOTSTRAP_PASSWORD: "BeoBeo@2025"
    volumes:
      - /data/rancher/data:/var/lib/rancher
    networks:
      rancher_network:
        ipv4_address: 10.100.1.56
    ports:
      - "443:443"

  nginx-lb:
    image: nginx:stable-alpine
    container_name: nginx-lb
    restart: always
    ports:
      - "80:80"
    volumes:
      - ./nginx-lb/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx-lb/conf.d:/etc/nginx/conf.d:ro
    networks:
      rancher_network:
        ipv4_address: 10.100.1.57
  
networks:
  rancher_network:
    external: true

worker_processes auto;

events { worker_connections 4096; }

http {
  include       mime.types;
  default_type  application/octet-stream;
  sendfile      on;

  access_log /var/log/nginx/access.log;
  error_log  /var/log/nginx/error.log;

  include /etc/nginx/conf.d/*.conf;
}

Tạo file ./nginx-lb/conf.d/ingress-lb.conf

upstream my_servers {
    least_conn;
    server 10.100.1.25:30080 max_fails=3 fail_timeout=10s;
    server 10.100.1.26:30080 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ""      close;
}

server {
    listen 80;
    client_max_body_size 50m;

    location / {
        proxy_pass http://my_servers;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;

        proxy_next_upstream error timeout http_502 http_503 http_504;
        proxy_next_upstream_tries 2;

        proxy_buffering on;
    }
}

# ip nginx lb -> shop-shoes.lc
10.100.1.57 shop-shose.lc