在Mac上离线安装k3s

目录

首先是安装multipass。

1. 系统要求

2. 环境准备

---

本来想照着网上文档学习安装一下k3s，没想到在docker被封了之后，现在想通过命令行去下载github的资源也不行了（如果有网友看到这个文档、并且知道问题原因的，请留言告知，感谢）。所以本人通过以下方法安装。

一：安装multipass。

因本人的Mac还是老款的2015的MacPro（是的，我对电脑保护的很好，所以现在老款笔记本依然在发光发热），经多次尝试，可以使用v1.12x以下的版本，这个版本依然支持10.15的macOS系统。

用迅雷下载之后，重命名下载文件添加.pkg后缀，再一直点就可以了。

安装好之后，我们来创建一个虚拟机。

multipass launch -n node-1 -c 1 -d 10G -m 1G

为了方便传文件，挂载本机目录home目录到虚拟机

multipass mount $HOME/Download node-1:/home/ubuntu/download

二：安装k3s

2.1 先下载文件

1、 从https://github.com/k3s-io/k3s/releases页面获取你所运行的 K3s 版本的镜像 tar 文件。

2、将 tar 文件放在images目录下

sudo mkdir -p /var/lib/rancher/k3s/agent/images/
sudo cp ./k3s-airgap-images-amd64.tar /var/lib/rancher/k3s/agent/images/

3、将 k3s 二进制文件放在 /usr/local/bin/k3s路径下，并确保拥有可执行权限。

sudo chmod +x k3s
sudo mv k3s /usr/local/bin/k3s

2.2 开始安装

1、下载 K3s 安装脚本：https://get.k3s.io

#!/bin/sh
set -e
set -o noglob# Usage:
#   curl ... | ENV_VAR=... sh -
#       or
#   ENV_VAR=... ./install.sh
#
# Example:
#   Installing a server without traefik:
#     curl ... | INSTALL_K3S_EXEC="--disable=traefik" sh -
#   Installing an agent to point at a server:
#     curl ... | K3S_TOKEN=xxx K3S_URL=https://server-url:6443 sh -
#
# Environment variables:
#   - K3S_*
#     Environment variables which begin with K3S_ will be preserved for the
#     systemd service to use. Setting K3S_URL without explicitly setting
#     a systemd exec command will default the command to "agent", and we
#     enforce that K3S_TOKEN is also set.
#
#   - INSTALL_K3S_SKIP_DOWNLOAD
#     If set to true will not download k3s hash or binary.
#
#   - INSTALL_K3S_FORCE_RESTART
#     If set to true will always restart the K3s service
#
#   - INSTALL_K3S_SYMLINK
#     If set to 'skip' will not create symlinks, 'force' will overwrite,
#     default will symlink if command does not exist in path.
#
#   - INSTALL_K3S_SKIP_ENABLE
#     If set to true will not enable or start k3s service.
#
#   - INSTALL_K3S_SKIP_START
#     If set to true will not start k3s service.
#
#   - INSTALL_K3S_VERSION
#     Version of k3s to download from github. Will attempt to download from the
#     stable channel if not specified.
#
#   - INSTALL_K3S_COMMIT
#     Commit of k3s to download from temporary cloud storage.
#     * (for developer & QA use)
#
#   - INSTALL_K3S_PR
#     PR build of k3s to download from Github Artifacts.
#     * (for developer & QA use)
#
#   - INSTALL_K3S_BIN_DIR
#     Directory to install k3s binary, links, and uninstall script to, or use
#     /usr/local/bin as the default
#
#   - INSTALL_K3S_BIN_DIR_READ_ONLY
#     If set to true will not write files to INSTALL_K3S_BIN_DIR, forces
#     setting INSTALL_K3S_SKIP_DOWNLOAD=true
#
#   - INSTALL_K3S_SYSTEMD_DIR
#     Directory to install systemd service and environment files to, or use
#     /etc/systemd/system as the default
#
#   - INSTALL_K3S_EXEC or script arguments
#     Command with flags to use for launching k3s in the systemd service, if
#     the command is not specified will default to "agent" if K3S_URL is set
#     or "server" if not. The final systemd command resolves to a combination
#     of EXEC and script args ($@).
#
#     The following commands result in the same behavior:
#       curl ... | INSTALL_K3S_EXEC="--disable=traefik" sh -s -
#       curl ... | INSTALL_K3S_EXEC="server --disable=traefik" sh -s -
#       curl ... | INSTALL_K3S_EXEC="server" sh -s - --disable=traefik
#       curl ... | sh -s - server --disable=traefik
#       curl ... | sh -s - --disable=traefik
#
#   - INSTALL_K3S_NAME
#     Name of systemd service to create, will default from the k3s exec command
#     if not specified. If specified the name will be prefixed with 'k3s-'.
#
#   - INSTALL_K3S_TYPE
#     Type of systemd service to create, will default from the k3s exec command
#     if not specified.
#
#   - INSTALL_K3S_SELINUX_WARN
#     If set to true will continue if k3s-selinux policy is not found.
#
#   - INSTALL_K3S_SKIP_SELINUX_RPM
#     If set to true will skip automatic installation of the k3s RPM.
#
#   - INSTALL_K3S_CHANNEL_URL
#     Channel URL for fetching k3s download URL.
#     Defaults to 'https://update.k3s.io/v1-release/channels'.
#
#   - INSTALL_K3S_CHANNEL
#     Channel to use for fetching k3s download URL.
#     Defaults to 'stable'.GITHUB_URL=${GITHUB_URL:-https://github.com/k3s-io/k3s/releases}
GITHUB_PR_URL=""
STORAGE_URL=https://k3s-ci-builds.s3.amazonaws.com
DOWNLOADER=# --- helper functions for logs ---
info()
{echo '[INFO] ' "$@"
}
warn()
{echo '[WARN] ' "$@" >&2
}
fatal()
{echo '[ERROR] ' "$@" >&2exit 1
}# --- fatal if no systemd or openrc ---
verify_system() {if [ -x /sbin/openrc-run ]; thenHAS_OPENRC=truereturnfiif [ -x /bin/systemctl ] || type systemctl > /dev/null 2>&1; thenHAS_SYSTEMD=truereturnfifatal 'Can not find systemd or openrc to use as a process supervisor for k3s'
}# --- add quotes to command arguments ---
quote() {for arg in "$@"; doprintf '%s\n' "$arg" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"done
}# --- add indentation and trailing slash to quoted args ---
quote_indent() {printf ' \\\n'for arg in "$@"; doprintf '\t%s \\\n' "$(quote "$arg")"done
}# --- escape most punctuation characters, except quotes, forward slash, and space ---
escape() {printf '%s' "$@" | sed -e 's/\([][!#$%&()*;<=>?\_`{|}]\)/\\\1/g;'
}# --- escape double quotes ---
escape_dq() {printf '%s' "$@" | sed -e 's/"/\\"/g'
}# --- ensures $K3S_URL is empty or begins with https://, exiting fatally otherwise ---
verify_k3s_url() {case "${K3S_URL}" in"");;https://*);;*)fatal "Only https:// URLs are supported for K3S_URL (have ${K3S_URL})";;esac
}# --- define needed environment variables ---
setup_env() {# --- use command args if passed or create default ---case "$1" in# --- if we only have flags discover if command should be server or agent ---(-*|"")if [ -z "${K3S_URL}" ]; thenCMD_K3S=serverelseif [ -z "${K3S_TOKEN}" ] && [ -z "${K3S_TOKEN_FILE}" ]; thenfatal "Defaulted k3s exec command to 'agent' because K3S_URL is defined, but K3S_TOKEN or K3S_TOKEN_FILE is not defined."fiCMD_K3S=agentfi;;# --- command is provided ---(*)CMD_K3S=$1shift;;esacverify_k3s_urlCMD_K3S_EXEC="${CMD_K3S}$(quote_indent "$@")"# --- use systemd name if defined or create default ---if [ -n "${INSTALL_K3S_NAME}" ]; thenSYSTEM_NAME=k3s-${INSTALL_K3S_NAME}elseif [ "${CMD_K3S}" = server ]; thenSYSTEM_NAME=k3selseSYSTEM_NAME=k3s-${CMD_K3S}fifi# --- check for invalid characters in system name ---valid_chars=$(printf '%s' "${SYSTEM_NAME}" | sed -e 's/[][!#$%&()*;<=>?\_`{|}/[:space:]]/^/g;' )if [ "${SYSTEM_NAME}" != "${valid_chars}"  ]; theninvalid_chars=$(printf '%s' "${valid_chars}" | sed -e 's/[^^]/ /g')fatal "Invalid characters for system name:${SYSTEM_NAME}${invalid_chars}"fi# --- use sudo if we are not already root ---SUDO=sudoif [ $(id -u) -eq 0 ]; thenSUDO=fi# --- use systemd type if defined or create default ---if [ -n "${INSTALL_K3S_TYPE}" ]; thenSYSTEMD_TYPE=${INSTALL_K3S_TYPE}elseSYSTEMD_TYPE=notifyfi# --- use binary install directory if defined or create default ---if [ -n "${INSTALL_K3S_BIN_DIR}" ]; thenBIN_DIR=${INSTALL_K3S_BIN_DIR}else# --- use /usr/local/bin if root can write to it, otherwise use /opt/bin if it existsBIN_DIR=/usr/local/binif ! $SUDO sh -c "touch ${BIN_DIR}/k3s-ro-test && rm -rf ${BIN_DIR}/k3s-ro-test"; thenif [ -d /opt/bin ]; thenBIN_DIR=/opt/binfififi# --- use systemd directory if defined or create default ---if [ -n "${INSTALL_K3S_SYSTEMD_DIR}" ]; thenSYSTEMD_DIR="${INSTALL_K3S_SYSTEMD_DIR}"elseSYSTEMD_DIR=/etc/systemd/systemfi# --- set related files from system name ---SERVICE_K3S=${SYSTEM_NAME}.serviceUNINSTALL_K3S_SH=${UNINSTALL_K3S_SH:-${BIN_DIR}/${SYSTEM_NAME}-uninstall.sh}KILLALL_K3S_SH=${KILLALL_K3S_SH:-${BIN_DIR}/k3s-killall.sh}# --- use service or environment location depending on systemd/openrc ---if [ "${HAS_SYSTEMD}" = true ]; thenFILE_K3S_SERVICE=${SYSTEMD_DIR}/${SERVICE_K3S}FILE_K3S_ENV=${SYSTEMD_DIR}/${SERVICE_K3S}.envelif [ "${HAS_OPENRC}" = true ]; then$SUDO mkdir -p /etc/rancher/k3sFILE_K3S_SERVICE=/etc/init.d/${SYSTEM_NAME}FILE_K3S_ENV=/etc/rancher/k3s/${SYSTEM_NAME}.envfi# --- get hash of config & exec for currently installed k3s ---PRE_INSTALL_HASHES=$(get_installed_hashes)# --- if bin directory is read only skip download ---if [ "${INSTALL_K3S_BIN_DIR_READ_ONLY}" = true ]; thenINSTALL_K3S_SKIP_DOWNLOAD=truefi# --- setup channel valuesINSTALL_K3S_CHANNEL_URL=${INSTALL_K3S_CHANNEL_URL:-'https://update.k3s.io/v1-release/channels'}INSTALL_K3S_CHANNEL=${INSTALL_K3S_CHANNEL:-'stable'}
}# --- check if skip download environment variable set ---
can_skip_download_binary() {if [ "${INSTALL_K3S_SKIP_DOWNLOAD}" != true ] && [ "${INSTALL_K3S_SKIP_DOWNLOAD}" != binary ]; thenreturn 1fi
}can_skip_download_selinux() {if [ "${INSTALL_K3S_SKIP_DOWNLOAD}" != true ] && [ "${INSTALL_K3S_SKIP_DOWNLOAD}" != selinux ]; thenreturn 1fi
}# --- verify an executable k3s binary is installed ---
verify_k3s_is_executable() {if [ ! -x ${BIN_DIR}/k3s ]; thenfatal "Executable k3s binary not found at ${BIN_DIR}/k3s"fi
}# --- set arch and suffix, fatal if architecture not supported ---
setup_verify_arch() {if [ -z "$ARCH" ]; thenARCH=$(uname -m)ficase $ARCH inamd64)ARCH=amd64SUFFIX=;;x86_64)ARCH=amd64SUFFIX=;;arm64)ARCH=arm64SUFFIX=-${ARCH};;s390x)ARCH=s390xSUFFIX=-${ARCH};;aarch64)ARCH=arm64SUFFIX=-${ARCH};;arm*)ARCH=armSUFFIX=-${ARCH}hf;;*)fatal "Unsupported architecture $ARCH"esac
}# --- verify existence of network downloader executable ---
verify_downloader() {# Return failure if it doesn't exist or is no executable[ -x "$(command -v $1)" ] || return 1# Set verified executable as our downloader program and return successDOWNLOADER=$1return 0
}# --- create temporary directory and cleanup when done ---
setup_tmp() {TMP_DIR=$(mktemp -d -t k3s-install.XXXXXXXXXX)TMP_HASH=${TMP_DIR}/k3s.hashTMP_ZIP=${TMP_DIR}/k3s.zipTMP_BIN=${TMP_DIR}/k3s.bincleanup() {code=$?set +etrap - EXITrm -rf ${TMP_DIR}exit $code}trap cleanup INT EXIT
}# --- use desired k3s version if defined or find version from channel ---
get_release_version() {if [ -n "${INSTALL_K3S_PR}" ]; thenVERSION_K3S="PR ${INSTALL_K3S_PR}"get_pr_artifact_urlelif [ -n "${INSTALL_K3S_COMMIT}" ]; thenVERSION_K3S="commit ${INSTALL_K3S_COMMIT}"elif [ -n "${INSTALL_K3S_VERSION}" ]; thenVERSION_K3S=${INSTALL_K3S_VERSION}elseinfo "Finding release for channel ${INSTALL_K3S_CHANNEL}"version_url="${INSTALL_K3S_CHANNEL_URL}/${INSTALL_K3S_CHANNEL}"case $DOWNLOADER incurl)VERSION_K3S=$(curl -w '%{url_effective}' -L -s -S ${version_url} -o /dev/null | sed -e 's|.*/||');;wget)VERSION_K3S=$(wget -SqO /dev/null ${version_url} 2>&1 | grep -i Location | sed -e 's|.*/||');;*)fatal "Incorrect downloader executable '$DOWNLOADER'";;esacfiinfo "Using ${VERSION_K3S} as release"
}# --- get k3s-selinux version ---
get_k3s_selinux_version() {available_version="k3s-selinux-1.2-2.${rpm_target}.noarch.rpm"info "Finding available k3s-selinux versions"# run verify_downloader in case it binary installation was skippedverify_downloader curl || verify_downloader wget || fatal 'Can not find curl or wget for downloading files'case $DOWNLOADER incurl)DOWNLOADER_OPTS="-s";;wget)DOWNLOADER_OPTS="-q -O -";;*)fatal "Incorrect downloader executable '$DOWNLOADER'";;esacfor i in {1..3}; doset +eif [ "${rpm_channel}" = "testing" ]; thenversion=$(timeout 5 ${DOWNLOADER} ${DOWNLOADER_OPTS} https://api.github.com/repos/k3s-io/k3s-selinux/releases |  grep browser_download_url | awk '{ print $2 }' | grep -oE "[^\/]+${rpm_target}\.noarch\.rpm" | head -n 1)elseversion=$(timeout 5 ${DOWNLOADER} ${DOWNLOADER_OPTS} https://api.github.com/repos/k3s-io/k3s-selinux/releases/latest |  grep browser_download_url | awk '{ print $2 }' | grep -oE "[^\/]+${rpm_target}\.noarch\.rpm")fiset -eif [ "${version}" != "" ]; thenbreakfisleep 1doneif [ "${version}" == "" ]; thenwarn "Failed to get available versions of k3s-selinux..defaulting to ${available_version}"returnfiavailable_version=${version}
}# --- download from github url ---
download() {[ $# -eq 2 ] || fatal 'download needs exactly 2 arguments'# Disable exit-on-error so we can do custom error messages on failureset +e# Default to a failure statusstatus=1case $DOWNLOADER incurl)curl -o $1 -sfL $2status=$?;;wget)wget -qO $1 $2status=$?;;*)# Enable exit-on-error for fatal to executeset -efatal "Incorrect executable '$DOWNLOADER'";;esac# Re-enable exit-on-errorset -e# Abort if download command failed[ $status -eq 0 ] || fatal 'Download failed'
}# --- download hash from github url ---
download_hash() {if [ -n "${INSTALL_K3S_PR}" ]; theninfo "Downloading hash ${GITHUB_PR_URL}"curl -s -o ${TMP_ZIP} -H "Authorization: Bearer $GITHUB_TOKEN" -L ${GITHUB_PR_URL}unzip -p ${TMP_ZIP} k3s.sha256sum > ${TMP_HASH}elseif [ -n "${INSTALL_K3S_COMMIT}" ]; thenHASH_URL=${STORAGE_URL}/k3s${SUFFIX}-${INSTALL_K3S_COMMIT}.sha256sumelseHASH_URL=${GITHUB_URL}/download/${VERSION_K3S}/sha256sum-${ARCH}.txtfiinfo "Downloading hash ${HASH_URL}"download ${TMP_HASH} ${HASH_URL}fiHASH_EXPECTED=$(grep " k3s${SUFFIX}$" ${TMP_HASH})HASH_EXPECTED=${HASH_EXPECTED%%[[:blank:]]*}
}# --- check hash against installed version ---
installed_hash_matches() {if [ -x ${BIN_DIR}/k3s ]; thenHASH_INSTALLED=$(sha256sum ${BIN_DIR}/k3s)HASH_INSTALLED=${HASH_INSTALLED%%[[:blank:]]*}if [ "${HASH_EXPECTED}" = "${HASH_INSTALLED}" ]; thenreturnfifireturn 1
}# Use the GitHub API to identify the artifact associated with a given PR
get_pr_artifact_url() {github_api_url=https://api.github.com/repos/k3s-io/k3s# Check if jq is installedif ! [ -x "$(command -v jq)" ]; thenfatal "Installing PR builds requires jq"fi# Check if unzip is installedif ! [ -x "$(command -v unzip)" ]; thenfatal "Installing PR builds requires unzip"fiif [ -z "${GITHUB_TOKEN}" ]; thenfatal "Installing PR builds requires GITHUB_TOKEN with k3s-io/k3s repo permissions"fi# GET request to the GitHub API to retrieve the latest commit SHA from the pull requestset +ecommit_id=$(curl -f -s -H "Authorization: Bearer ${GITHUB_TOKEN}" "${github_api_url}/pulls/${INSTALL_K3S_PR}" | jq -r '.head.sha')set -eif [ -z "${commit_id}" ]; thenfatal "Installing PR builds requires GITHUB_TOKEN with k3s-io/k3s repo permissions"fi# GET request to the GitHub API to retrieve the Build workflow associated with the commitrun_id=$(curl -s -H "Authorization: Bearer ${GITHUB_TOKEN}" "${github_api_url}/commits/${commit_id}/check-runs?check_name=build%20%2F%20Build" | jq -r '[.check_runs | sort_by(.id) | .[].details_url | split("/")[7]] | last')# Extract the artifact ID for the "k3s" artifactGITHUB_PR_URL=$(curl -s -H "Authorization: Bearer ${GITHUB_TOKEN}" "${github_api_url}/actions/runs/${run_id}/artifacts" | jq -r '.artifacts[] | select(.name == "k3s") | .archive_download_url')
}# --- download binary from github url ---
download_binary() {if [ -n "${INSTALL_K3S_PR}" ]; then# Since Binary and Hash are zipped together, check if TMP_ZIP already existsif ! [ -f ${TMP_ZIP} ]; theninfo "Downloading K3s artifact ${GITHUB_PR_URL}"curl -s -f -o ${TMP_ZIP} -H "Authorization: Bearer $GITHUB_TOKEN" -L ${GITHUB_PR_URL}fi# extract k3s binary from zipunzip -p ${TMP_ZIP} k3s > ${TMP_BIN}returnelif [ -n "${INSTALL_K3S_COMMIT}" ]; thenBIN_URL=${STORAGE_URL}/k3s${SUFFIX}-${INSTALL_K3S_COMMIT}elseBIN_URL=${GITHUB_URL}/download/${VERSION_K3S}/k3s${SUFFIX}fiinfo "Downloading binary ${BIN_URL}"download ${TMP_BIN} ${BIN_URL}
}# --- verify downloaded binary hash ---
verify_binary() {info "Verifying binary download"HASH_BIN=$(sha256sum ${TMP_BIN})HASH_BIN=${HASH_BIN%%[[:blank:]]*}if [ "${HASH_EXPECTED}" != "${HASH_BIN}" ]; thenfatal "Download sha256 does not match ${HASH_EXPECTED}, got ${HASH_BIN}"fi
}# --- setup permissions and move binary to system directory ---
setup_binary() {chmod 755 ${TMP_BIN}info "Installing k3s to ${BIN_DIR}/k3s"$SUDO chown root:root ${TMP_BIN}$SUDO mv -f ${TMP_BIN} ${BIN_DIR}/k3s
}# --- setup selinux policy ---
setup_selinux() {case ${INSTALL_K3S_CHANNEL} in*testing)rpm_channel=testing;;*latest)rpm_channel=latest;;*)rpm_channel=stable;;esacrpm_site="rpm.rancher.io"if [ "${rpm_channel}" = "testing" ]; thenrpm_site="rpm-testing.rancher.io"fi[ -r /etc/os-release ] && . /etc/os-releaseif [ `expr "${ID_LIKE}" : ".*suse.*"` != 0 ]; thenrpm_target=slerpm_site_infix=microospackage_installer=zypperif [ "${ID_LIKE:-}" = suse ] && ( [ "${VARIANT_ID:-}" = sle-micro ] || [ "${ID:-}" = sle-micro ] ); thenrpm_target=slerpm_site_infix=slemicropackage_installer=zypperfielif [ "${ID_LIKE:-}" = coreos ] || [ "${VARIANT_ID:-}" = coreos ] || [ "${VARIANT_ID:-}" = "iot" ] || \{ { [ "${ID:-}" = fedora ] || [ "${ID_LIKE:-}" = fedora ]; } && [ -n "${OSTREE_VERSION:-}" ]; }; thenrpm_target=coreosrpm_site_infix=coreospackage_installer=rpm-ostreeelif [ "${VERSION_ID%%.*}" = "7" ] || ( [ "${ID:-}" = amzn ] && [ "${VERSION_ID%%.*}" = "2" ] ); thenrpm_target=el7rpm_site_infix=centos/7package_installer=yumelif [ "${VERSION_ID%%.*}" = "8" ] || [ "${VERSION_ID%%.*}" = "V10" ] || [ "${VERSION_ID%%.*}" -gt "36" ]; thenrpm_target=el8rpm_site_infix=centos/8package_installer=yumelserpm_target=el9rpm_site_infix=centos/9package_installer=yumfiif [ "${package_installer}" = "rpm-ostree" ] && [ -x /bin/yum ]; thenpackage_installer=yumfiif [ "${package_installer}" = "yum" ] && [ -x /usr/bin/dnf ]; thenpackage_installer=dnffipolicy_hint="please install:${package_installer} install -y container-selinux${package_installer} install -y https://${rpm_site}/k3s/${rpm_channel}/common/${rpm_site_infix}/noarch/${available_version}
"if [ "$INSTALL_K3S_SKIP_SELINUX_RPM" = true ] || can_skip_download_selinux || [ ! -d /usr/share/selinux ]; theninfo "Skipping installation of SELinux RPM"returnfiget_k3s_selinux_versioninstall_selinux_rpm ${rpm_site} ${rpm_channel} ${rpm_target} ${rpm_site_infix}policy_error=fatalif [ "$INSTALL_K3S_SELINUX_WARN" = true ] || [ "${ID_LIKE:-}" = coreos ] ||[ "${VARIANT_ID:-}" = coreos ] || [ "${VARIANT_ID:-}" = iot ]; thenpolicy_error=warnfiif ! $SUDO chcon -u system_u -r object_r -t container_runtime_exec_t ${BIN_DIR}/k3s >/dev/null 2>&1; thenif $SUDO grep '^\s*SELINUX=enforcing' /etc/selinux/config >/dev/null 2>&1; then$policy_error "Failed to apply container_runtime_exec_t to ${BIN_DIR}/k3s, ${policy_hint}"fielif [ ! -f /usr/share/selinux/packages/k3s.pp ]; thenif [ -x /usr/sbin/transactional-update ] || [ "${ID_LIKE:-}" = coreos ] || \{ { [ "${ID:-}" = fedora ] || [ "${ID_LIKE:-}" = fedora ]; } && [ -n "${OSTREE_VERSION:-}" ]; }; thenwarn "Please reboot your machine to activate the changes and avoid data loss."else$policy_error "Failed to find the k3s-selinux policy, ${policy_hint}"fifi
}install_selinux_rpm() {if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ] ||[ -r /etc/fedora-release ] || [ -r /etc/system-release ] || [ "${ID_LIKE%%[ ]*}" = "suse" ]; thenrepodir=/etc/yum.repos.dif [ -d /etc/zypp/repos.d ]; thenrepodir=/etc/zypp/repos.dfiset +o noglob$SUDO rm -f ${repodir}/rancher-k3s-common*.reposet -o noglobif [ -r /etc/redhat-release ] && [ "${3}" = "el7" ]; then$SUDO yum install -y yum-utils$SUDO yum-config-manager --enable rhel-7-server-extras-rpmsfi$SUDO tee ${repodir}/rancher-k3s-common.repo >/dev/null << EOF
[rancher-k3s-common-${2}]
name=Rancher K3s Common (${2})
baseurl=https://${1}/k3s/${2}/common/${4}/noarch
enabled=1
gpgcheck=1
repo_gpgcheck=0
gpgkey=https://${1}/public.key
EOFcase ${3} insle)rpm_installer="zypper --gpg-auto-import-keys"if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; thentransactional_update_run="transactional-update --no-selfupdate -d run"rpm_installer="transactional-update --no-selfupdate -d run ${rpm_installer}": "${INSTALL_K3S_SKIP_START:=true}"fi# create the /var/lib/rpm-state in SLE systems to fix the prein selinux macro$SUDO ${transactional_update_run} mkdir -p /var/lib/rpm-state;;coreos)rpm_installer="rpm-ostree --idempotent"# rpm_install_extra_args="--apply-live": "${INSTALL_K3S_SKIP_START:=true}";;*)rpm_installer="yum";;esacif [ "${rpm_installer}" = "yum" ] && [ -x /usr/bin/dnf ]; thenrpm_installer=dnffiif rpm -q --quiet k3s-selinux; then# remove k3s-selinux module before upgrade to allow container-selinux to upgrade safelyif check_available_upgrades container-selinux ${3} && check_available_upgrades k3s-selinux ${3}; thenMODULE_PRIORITY=$($SUDO semodule --list=full | grep k3s | cut -f1 -d" ")if [ -n "${MODULE_PRIORITY}" ]; then$SUDO semodule -X $MODULE_PRIORITY -r k3s || truefififi# shellcheck disable=SC2086$SUDO ${rpm_installer} install -y "k3s-selinux"fireturn
}check_available_upgrades() {set +ecase ${2} insle)available_upgrades=$($SUDO zypper -q -t -s 11 se -s -u --type package $1 | tail -n 1 | grep -v "No matching" | awk '{print $3}');;coreos)# currently rpm-ostree does not support search functionality https://github.com/coreos/rpm-ostree/issues/1877;;*)available_upgrades=$($SUDO yum -q --refresh list $1 --upgrades | tail -n 1 | awk '{print $2}');;esacset -eif [ -n "${available_upgrades}" ]; thenreturn 0fireturn 1
}
# --- download and verify k3s ---
download_and_verify() {if can_skip_download_binary; theninfo 'Skipping k3s download and verify'verify_k3s_is_executablereturnfisetup_verify_archverify_downloader curl || verify_downloader wget || fatal 'Can not find curl or wget for downloading files'setup_tmpget_release_versiondownload_hashif installed_hash_matches; theninfo 'Skipping binary downloaded, installed k3s matches hash'returnfidownload_binaryverify_binarysetup_binary
}# --- add additional utility links ---
create_symlinks() {[ "${INSTALL_K3S_BIN_DIR_READ_ONLY}" = true ] && return[ "${INSTALL_K3S_SYMLINK}" = skip ] && returnfor cmd in kubectl crictl ctr; doif [ ! -e ${BIN_DIR}/${cmd} ] || [ "${INSTALL_K3S_SYMLINK}" = force ]; thenwhich_cmd=$(command -v ${cmd} 2>/dev/null || true)if [ -z "${which_cmd}" ] || [ "${INSTALL_K3S_SYMLINK}" = force ]; theninfo "Creating ${BIN_DIR}/${cmd} symlink to k3s"$SUDO ln -sf k3s ${BIN_DIR}/${cmd}elseinfo "Skipping ${BIN_DIR}/${cmd} symlink to k3s, command exists in PATH at ${which_cmd}"fielseinfo "Skipping ${BIN_DIR}/${cmd} symlink to k3s, already exists"fidone
}# --- create killall script ---
create_killall() {[ "${INSTALL_K3S_BIN_DIR_READ_ONLY}" = true ] && returninfo "Creating killall script ${KILLALL_K3S_SH}"$SUDO tee ${KILLALL_K3S_SH} >/dev/null << \EOF
#!/bin/sh
[ $(id -u) -eq 0 ] || exec sudo --preserve-env=K3S_DATA_DIR $0 $@K3S_DATA_DIR=${K3S_DATA_DIR:-/var/lib/rancher/k3s}for bin in ${K3S_DATA_DIR}/data/**/bin/; do[ -d $bin ] && export PATH=$PATH:$bin:$bin/aux
doneset -xfor service in /etc/systemd/system/k3s*.service; do[ -s $service ] && systemctl stop $(basename $service)
donefor service in /etc/init.d/k3s*; do[ -x $service ] && $service stop
donepschildren() {ps -e -o ppid= -o pid= | \sed -e 's/^\s*//g; s/\s\s*/\t/g;' | \grep -w "^$1" | \cut -f2
}pstree() {for pid in $@; doecho $pidfor child in $(pschildren $pid); dopstree $childdonedone
}killtree() {kill -9 $({ set +x; } 2>/dev/null;pstree $@;set -x;) 2>/dev/null
}remove_interfaces() {# Delete network interface(s) that match 'master cni0'ip link show 2>/dev/null | grep 'master cni0' | while read ignore iface ignore; doiface=${iface%%@*}[ -z "$iface" ] || ip link delete $ifacedone# Delete cni related interfacesip link delete cni0ip link delete flannel.1ip link delete flannel-v6.1ip link delete kube-ipvs0ip link delete flannel-wgip link delete flannel-wg-v6# Restart tailscaleif [ -n "$(command -v tailscale)" ]; thentailscale set --advertise-routes=fi
}getshims() {ps -e -o pid= -o args= | sed -e 's/^ *//; s/\s\s*/\t/;' | grep -w "${K3S_DATA_DIR}"'/data/[^/]*/bin/containerd-shim' | cut -f1
}killtree $({ set +x; } 2>/dev/null; getshims; set -x)do_unmount_and_remove() {set +xwhile read -r _ path _; docase "$path" in $1*) echo "$path" ;; esacdone < /proc/self/mounts | sort -r | xargs -r -t -n 1 sh -c 'umount -f "$0" && rm -rf "$0"'set -x
}do_unmount_and_remove '/run/k3s'
do_unmount_and_remove '/var/lib/kubelet/pods'
do_unmount_and_remove '/var/lib/kubelet/plugins'
do_unmount_and_remove '/run/netns/cni-'# Remove CNI namespaces
ip netns show 2>/dev/null | grep cni- | xargs -r -t -n 1 ip netns deleteremove_interfacesrm -rf /var/lib/cni/
iptables-save | grep -v KUBE- | grep -v CNI- | grep -iv flannel | iptables-restore
ip6tables-save | grep -v KUBE- | grep -v CNI- | grep -iv flannel | ip6tables-restore
EOF$SUDO chmod 755 ${KILLALL_K3S_SH}$SUDO chown root:root ${KILLALL_K3S_SH}
}# --- create uninstall script ---
create_uninstall() {[ "${INSTALL_K3S_BIN_DIR_READ_ONLY}" = true ] && returninfo "Creating uninstall script ${UNINSTALL_K3S_SH}"$SUDO tee ${UNINSTALL_K3S_SH} >/dev/null << EOF
#!/bin/sh
set -x
[ \$(id -u) -eq 0 ] || exec sudo --preserve-env=K3S_DATA_DIR \$0 \$@K3S_DATA_DIR=\${K3S_DATA_DIR:-/var/lib/rancher/k3s}${KILLALL_K3S_SH}if command -v systemctl; thensystemctl disable ${SYSTEM_NAME}systemctl reset-failed ${SYSTEM_NAME}systemctl daemon-reload
fi
if command -v rc-update; thenrc-update delete ${SYSTEM_NAME} default
firm -f ${FILE_K3S_SERVICE}
rm -f ${FILE_K3S_ENV}remove_uninstall() {rm -f ${UNINSTALL_K3S_SH}
}
trap remove_uninstall EXITif (ls ${SYSTEMD_DIR}/k3s*.service || ls /etc/init.d/k3s*) >/dev/null 2>&1; thenset +x; echo 'Additional k3s services installed, skipping uninstall of k3s'; set -xexit
fifor cmd in kubectl crictl ctr; doif [ -L ${BIN_DIR}/\$cmd ]; thenrm -f ${BIN_DIR}/\$cmdfi
doneclean_mounted_directory() {if ! grep -q " \$1" /proc/mounts; thenrm -rf "\$1"return 0fifor path in "\$1"/*; doif [ -d "\$path" ]; thenif grep -q " \$path" /proc/mounts; thenclean_mounted_directory "\$path"elserm -rf "\$path"fielserm "\$path"fidone
}rm -rf /etc/rancher/k3s
rm -rf /run/k3s
rm -rf /run/flannel
clean_mounted_directory \${K3S_DATA_DIR}
rm -rf /var/lib/kubelet
rm -f ${BIN_DIR}/k3s
rm -f ${KILLALL_K3S_SH}if type yum >/dev/null 2>&1; thenyum remove -y k3s-selinuxrm -f /etc/yum.repos.d/rancher-k3s-common*.repo
elif type rpm-ostree >/dev/null 2>&1; thenrpm-ostree uninstall k3s-selinuxrm -f /etc/yum.repos.d/rancher-k3s-common*.repo
elif type zypper >/dev/null 2>&1; thenuninstall_cmd="zypper remove -y k3s-selinux"if [ "\${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; thenuninstall_cmd="transactional-update --no-selfupdate -d run \$uninstall_cmd"fi$SUDO \$uninstall_cmdrm -f /etc/zypp/repos.d/rancher-k3s-common*.repo
fi
EOF$SUDO chmod 755 ${UNINSTALL_K3S_SH}$SUDO chown root:root ${UNINSTALL_K3S_SH}
}# --- disable current service if loaded --
systemd_disable() {$SUDO systemctl disable ${SYSTEM_NAME} >/dev/null 2>&1 || true$SUDO rm -f /etc/systemd/system/${SERVICE_K3S} || true$SUDO rm -f /etc/systemd/system/${SERVICE_K3S}.env || true
}# --- capture current env and create file containing k3s_ variables ---
create_env_file() {info "env: Creating environment file ${FILE_K3S_ENV}"$SUDO touch ${FILE_K3S_ENV}$SUDO chmod 0600 ${FILE_K3S_ENV}sh -c export | while read x v; do echo $v; done | grep -E '^(K3S|CONTAINERD)_' | $SUDO tee ${FILE_K3S_ENV} >/dev/nullsh -c export | while read x v; do echo $v; done | grep -Ei '^(NO|HTTP|HTTPS)_PROXY' | $SUDO tee -a ${FILE_K3S_ENV} >/dev/null
}# --- write systemd service file ---
create_systemd_service_file() {info "systemd: Creating service file ${FILE_K3S_SERVICE}"$SUDO tee ${FILE_K3S_SERVICE} >/dev/null << EOF
[Unit]
Description=Lightweight Kubernetes
Documentation=https://k3s.io
Wants=network-online.target
After=network-online.target[Install]
WantedBy=multi-user.target[Service]
Type=${SYSTEMD_TYPE}
EnvironmentFile=-/etc/default/%N
EnvironmentFile=-/etc/sysconfig/%N
EnvironmentFile=-${FILE_K3S_ENV}
KillMode=process
Delegate=yes
User=root
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=1048576
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
TimeoutStartSec=0
Restart=always
RestartSec=5s
ExecStartPre=/bin/sh -xc '! /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service 2>/dev/null'
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=${BIN_DIR}/k3s \\${CMD_K3S_EXEC}EOF
}# --- write openrc service file ---
create_openrc_service_file() {LOG_FILE=/var/log/${SYSTEM_NAME}.loginfo "openrc: Creating service file ${FILE_K3S_SERVICE}"$SUDO tee ${FILE_K3S_SERVICE} >/dev/null << EOF
#!/sbin/openrc-rundepend() {after network-onlinewant cgroups
}start_pre() {rm -f /tmp/k3s.*
}supervisor=supervise-daemon
name=${SYSTEM_NAME}
command="${BIN_DIR}/k3s"
command_args="$(escape_dq "${CMD_K3S_EXEC}")>>${LOG_FILE} 2>&1"output_log=${LOG_FILE}
error_log=${LOG_FILE}pidfile="/var/run/${SYSTEM_NAME}.pid"
respawn_delay=5
respawn_max=0set -o allexport
if [ -f /etc/environment ]; then . /etc/environment; fi
if [ -f ${FILE_K3S_ENV} ]; then . ${FILE_K3S_ENV}; fi
set +o allexport
EOF$SUDO chmod 0755 ${FILE_K3S_SERVICE}$SUDO tee /etc/logrotate.d/${SYSTEM_NAME} >/dev/null << EOF
${LOG_FILE} {missingoknotifemptycopytruncate
}
EOF
}# --- write systemd or openrc service file ---
create_service_file() {[ "${HAS_SYSTEMD}" = true ] && create_systemd_service_file && restore_systemd_service_file_context[ "${HAS_OPENRC}" = true ] && create_openrc_service_filereturn 0
}restore_systemd_service_file_context() {$SUDO restorecon -R -i ${FILE_K3S_SERVICE} 2>/dev/null || true$SUDO restorecon -R -i ${FILE_K3S_ENV} 2>/dev/null || true
}# --- get hashes of the current k3s bin and service files
get_installed_hashes() {$SUDO sha256sum ${BIN_DIR}/k3s ${FILE_K3S_SERVICE} ${FILE_K3S_ENV} 2>&1 || true
}# --- enable and start systemd service ---
systemd_enable() {info "systemd: Enabling ${SYSTEM_NAME} unit"$SUDO systemctl enable ${FILE_K3S_SERVICE} >/dev/null$SUDO systemctl daemon-reload >/dev/null
}systemd_start() {info "systemd: Starting ${SYSTEM_NAME}"$SUDO systemctl restart ${SYSTEM_NAME}
}# --- enable and start openrc service ---
openrc_enable() {info "openrc: Enabling ${SYSTEM_NAME} service for default runlevel"$SUDO rc-update add ${SYSTEM_NAME} default >/dev/null
}openrc_start() {info "openrc: Starting ${SYSTEM_NAME}"$SUDO ${FILE_K3S_SERVICE} restart
}has_working_xtables() {if $SUDO sh -c "command -v \"$1-save\"" 1> /dev/null && $SUDO sh -c "command -v \"$1-restore\"" 1> /dev/null; thenif $SUDO $1-save 2>/dev/null | grep -q '^-A CNI-HOSTPORT-MASQ -j MASQUERADE$'; thenwarn "Host $1-save/$1-restore tools are incompatible with existing rules"elsereturn 0fielseinfo "Host $1-save/$1-restore tools not found"fireturn 1
}# --- startup systemd or openrc service ---
service_enable_and_start() {if ! grep -qs memory /sys/fs/cgroup/cgroup.controllers && ! [ "$(grep -s memory /proc/cgroups | while read -r n n n enabled; do echo $enabled; done)" = "1" ]; theninfo 'Failed to find memory cgroup, you may need to add "cgroup_memory=1 cgroup_enable=memory" to your linux cmdline (/boot/cmdline.txt on a Raspberry Pi)'fi[ "${INSTALL_K3S_SKIP_ENABLE}" = true ] && return[ "${HAS_SYSTEMD}" = true ] && systemd_enable[ "${HAS_OPENRC}" = true ] && openrc_enable[ "${INSTALL_K3S_SKIP_START}" = true ] && returnPOST_INSTALL_HASHES=$(get_installed_hashes)if [ "${PRE_INSTALL_HASHES}" = "${POST_INSTALL_HASHES}" ] && [ "${INSTALL_K3S_FORCE_RESTART}" != true ]; theninfo 'No change detected so skipping service start'returnfifor XTABLES in iptables ip6tables; doif has_working_xtables ${XTABLES}; then$SUDO ${XTABLES}-save 2>/dev/null | grep -v KUBE- | grep -iv flannel | $SUDO ${XTABLES}-restorefidone[ "${HAS_SYSTEMD}" = true ] && systemd_start[ "${HAS_OPENRC}" = true ] && openrc_startreturn 0
}# --- re-evaluate args to include env command ---
eval set -- $(escape "${INSTALL_K3S_EXEC}") $(quote "$@")# --- run the install process --
{verify_systemsetup_env "$@"download_and_verifysetup_selinuxcreate_symlinkscreate_killallcreate_uninstallsystemd_disablecreate_env_filecreate_service_fileservice_enable_and_start
}

2.3 单节点安装（一主多从或者只需要一主的话就采用该方式）

1、要在单个服务器上安装 K3s，只需在 server 节点上执行以下操作（从节点不需要执行该语句）：

INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC="--embedded-registry" ./install.sh
或者
# 如需要关闭 traefik 和 需要开放NodePort端口范围为443-32767的则采用以下写法：
INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC="--embedded-registry --disable=traefik --service-node-port-range=443-32767" ./install.sh