製做ACK集羣自定義節點鏡像的正確姿式

隨着雲原生時代的到來，用戶應用、業務上雲的需求也愈來愈多，不一樣的業務場景對容器平臺的需求也不盡相同，其中一個很是重要的需求就是使用自定義鏡像建立ACK集羣。

ACK支持用戶使用自定義鏡像建立Kubernetes集羣，但用戶在製做打包自定義鏡像時，每每會遇到如下痛點：
（1）人工操做步驟，效率低
（2）鏡像變動歷史記錄缺失，不便於故障定位
（3）沒法對自定義鏡像進行校驗並判斷是否符合ACK集羣節點要求

基於以上痛點，咱們開源了ack-image-builder項目幫助用戶快速製做符合ACK集羣節點要求的自定義鏡像。

ack-image-builder項目基於開源工具HashiCorp Packer，提供默認配置模板和校驗腳本。

使用ack-image-builder項目建立ACK集羣自定義節點鏡像的步驟以下：

1. 安裝Packer

從官方下載頁面選擇操做系統對應的軟件版本，並按照安裝說明文檔安裝和驗證packer。

$ packer version
Packer v1.4.1

說明packer已安裝成功。

2. 定義Packer模板

使用Packer建立自定義鏡像時，須要建立一個JSON格式的模板文件。在該模板文件中，您須要指定建立自定義鏡像的 Alicloud Image Builder（生成器） 和 Provisioners（配置器）。

{
  "variables": {
    "region": "cn-hangzhou",
    "image_name": "test_image{{timestamp}}",
    "source_image": "centos_7_06_64_20G_alibase_20190711.vhd",
    "instance_type": "ecs.n1.large",
    "access_key": "{{env `ALICLOUD_ACCESS_KEY`}}",
    "secret_key": "{{env `ALICLOUD_SECRET_KEY`}}"
  },
  "builders": [
    {
      "type": "alicloud-ecs",
      "access_key": "{{user `access_key`}}",
      "secret_key": "{{user `secret_key`}}",
      "region": "{{user `region`}}",
      "image_name": "{{user `image_name`}}",
      "source_image": "{{user `source_image`}}",
      "ssh_username": "root",
      "instance_type": "{{user `instance_type`}}",
      "io_optimized": "true"
    }
  ],
  "provisioners": [
    {
      "type": "shell",
      "scripts": [
        "scripts/updateKernel.sh",
        "scripts/reboot.sh",
        "scripts/cleanUpKerneles.sh",
        "config/default.sh",
        "scripts/updateDNS.sh",
        "scripts/verify.sh"
      ],
      "expect_disconnect": true
    }
  ]
}

參數	描述
access_key	您的AccessKeyID
secret_key	您的AccessKeySecret
region	建立自定義鏡像時使用臨時資源的地域
image_name	自定義鏡像的名稱
source_image	基礎鏡像的名稱，能夠從阿里雲公共鏡像列表得到
instance_type	建立自定義鏡像時生成的臨時實例的類型
provisioners	建立自定義鏡像時使用的 Packer 配置器 類型

3. 建立子帳號並生成AK

製做自定義鏡像的權限要求較大，通常建議用戶建立子帳戶並受權Packer須要的對應RAM Policy,並建立AK。

4. 導入AK信息並製做自定義鏡像

導入AK：

export ALICLOUD_ACCESS_KEY=XXXXXX
export ALICLOUD_SECRET_KEY=XXXXXX

製做自定義鏡像：

$ packer build alicloud.json
alicloud-ecs output will be in this color.

==> alicloud-ecs: Prevalidating source region and copied regions...
==> alicloud-ecs: Prevalidating image name...
    alicloud-ecs: Found image ID: centos_7_06_64_20G_alibase_20190711.vhd
==> alicloud-ecs: Creating temporary keypair: xxxxxx
==> alicloud-ecs: Creating vpc...
    alicloud-ecs: Created vpc: xxxxxx
==> alicloud-ecs: Creating vswitch...
    alicloud-ecs: Created vswitch: xxxxxx
==> alicloud-ecs: Creating security group...
    alicloud-ecs: Created security group: xxxxxx
==> alicloud-ecs: Creating instance...
    alicloud-ecs: Created instance: xxxxxx
==> alicloud-ecs: Allocating eip...
    alicloud-ecs: Allocated eip: xxxxxx
    alicloud-ecs: Attach keypair xxxxxx to instance: xxxxxx
==> alicloud-ecs: Starting instance: xxxxxx
==> alicloud-ecs: Using ssh communicator to connect: 47.111.127.54
==> alicloud-ecs: Waiting for SSH to become available...
==> alicloud-ecs: Connected to SSH!
==> alicloud-ecs: Provisioning with shell script: scripts/verify.sh
    alicloud-ecs: [20190726 11:04:10]: Check if kernel version >= 3.10.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if systemd version >= 219.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if sshd is running and listen on port 22.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if cloud-init is installed.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if wget is installed.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if curl is installed.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if kubeadm is cleaned up.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if kubelet is cleaned up.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if kubectl is cleaned up.  Verify Passed!
    alicloud-ecs: [20190726 11:04:10]: Check if kubernetes-cni is cleaned up.  Verify Passed!
==> alicloud-ecs: Stopping instance: xxxxxx
==> alicloud-ecs: Waiting instance stopped: xxxxxx
==> alicloud-ecs: Creating image: test_image1564110199
    alicloud-ecs: Detach keypair xxxxxx from instance: xxxxxxx
==> alicloud-ecs: Cleaning up 'EIP'
==> alicloud-ecs: Cleaning up 'instance'
==> alicloud-ecs: Cleaning up 'security group'
==> alicloud-ecs: Cleaning up 'vSwitch'
==> alicloud-ecs: Cleaning up 'VPC'
==> alicloud-ecs: Deleting temporary keypair...
Build 'alicloud-ecs' finished.

==> Builds finished. The artifacts of successful builds are:
--> alicloud-ecs: Alicloud images were created:

cn-hangzhou: m-bp1aifbnupnaktj00q7s

其中scripts/verify.sh爲對檢查項的校驗部分。

5. 使用自定義鏡像建立ACK集羣

登陸容器服務控制檯，選擇建立 Kubernetes 專有版 集羣， 配置集羣建立須要的相關基礎信息後，點開 顯示高級選項 並選擇自定義鏡像進行集羣建立。

原文連接 本文爲雲棲社區原創內容，未經容許不得轉載。