轻量化安装 TKEStack：让已有 K8s 集群拥有企业级容器云平台的能力

git clone https://github.com/tkestack/tke.git

kind create cluster --config kindConfig.yaml --name {your cluster name} 

kubectl create namespace tke

go build -o gen

# 必填，etcd 访问地址，形式如 https://172.19.0.2:2379
etcd:
  host: https://172.18.0.2:2379 
# 必填，服务器内网 IP，数组形式
serverIPs:
  - 172.18.0.2
# 必填，公网可访问的 IP 地址以及要使用的域名，数组形式
dnsNames:
  - tke.gateway
# 必填，集群 front-proxy-ca.crt 文件地址，默认位置为 /etc/kubernetes/pki/front-proxy-ca.crt
frontProxyCaCrtAbsPath: /etc/kubernetes/pki/front-proxy-ca.crt
# 必填，集群 etcd 的 ca.crt 文件地址，默认位置为 /etc/kubernetes/pki/etcd/ca.crt
etcdCrtAbsPath: /etc/kubernetes/pki/etcd/ca.crt
# 必填，集群 etcd 的 ca.key文件地址，默认位置为 /etc/kubernetes/pki/etcd/ca.key
etcdKeyAbsPath: /etc/kubernetes/pki/etcd/ca.key
tke-auth:
  api:
    # 必填
    replicas: 1
    # 必填
    image: tkestack/tke-auth-api-amd64:74592a3bceb5bebca602bea21aaebf78007a3bb2
    # 必填，数组形式，auth 的重定向访问地址，包括集群服务器 IP 地址（必填）、tke-gateway 的域名（可选）、集群高可用的 VIP 地址（可选，有的话需要填写）和集群的公共可访问域名（可选，有的话需要填写）
    redirectHosts: 
      - 172.18.0.2
    enableAudit: 
    # tke-auth-api 组件在 node 上的对外暴露端口，默认31138
    nodePort: 
    # 集群的租户 id，默认 default
    tenantID: 
    # OIDC 认证方式的 secret，默认自动生成
    oIDCClientSecret: 
    # authentication 用户名，默认为 admin
    adminUsername: 
  controller:
    # 必填
    replicas: 1
    # 必填
    image: tkestack/tke-auth-controller-amd64:74592a3bceb5bebca602bea21aaebf78007a3bb2
    # 控制台登陆的用户名，默认为 admin
    adminUsername: 
    # 控制台登陆的密码，默认自动生成
    adminPassword: 
tke-platform:
  # 必填，VIP 或者公网可访问的集群 IP
  publicIP:
  metricsServerImage: metrics-server:v0.3.6
  addonResizerImage: addon-resizer:1.8.11
  api:
    # 必填
    replicas: 1
    # 必填
    image: tkestack/tke-platform-api-amd64:bc48bed59bff2022d87db5e1484481715357ee7c
    enableAuth: true
    enableAudit: 
    # OIDC 认证方式客户端 id，默认为 default
    oIDCClientID: 
    # OIDC 认证方式的 issuer_url，默认为 https://tke-auth-api/oidc
    oIDCIssuerURL: 
    # 是否开启 OIDC 认证，默认不开启，值为空
    useOIDCCA:
  controller:
    # 必填
    replicas: 1
    # 必填
    providerResImage: tkestack/provider-res-amd64:v1.21.4-1
    # 必填
    image: tkestack/tke-platform-controller-amd64:bc48bed59bff2022d87db5e1484481715357ee7c
    # 默认为 docker.io
    registryDomain:
    # 默认为 tkestack
    registryNamespace:
    # 监控存储类型，默认为 influxdb
    monitorStorageType: 
    # 监控存储地址，默认为集群 master IP 地址加8086端口
    monitorStorageAddresses:
tke-gateway:
  # 必填
  image: tkestack/tke-gateway-amd64:bc48bed59bff2022d87db5e1484481715357ee7c
  # 默认为 docker.io
  registryDomainSuffix:
  # 集群的租户 id，默认为 default
  tenantID:
  # OIDC 认证方式的 secret，默认自动生成
  oIDCClientSecret:
  # 是否开启自签名，默认为 true
  selfSigned: true
  # 第三方 cert 证书，在 selfSigned 为 false 时需要填值
  serverCrt:
  # 第三方 certKey 密钥，在 selfSigned 为 false 时需要填值
  serverKey:
  enableAuth: true
  enableBusiness:
  enableMonitor:
  enableRegistry:
  enableLogagent:
  enableAudit:
  enableApplication:
  enableMesh:

./gen

# tke-auth 的安装
helm install -f auth-chart-values.yaml tke-auth tke-auth/

# tke-platform 的安装
helm install -f platform-chart-values.yaml tke-platform tke-platform/

# tke-gateway 的安装
helm install -f gateway-chart-values.yaml tke-gateway tke-gateway/

helm list

apiVersion: v1
kind: Config
clusters:
  - name: tke
    cluster:
      server: https://172.19.0.2:31138/auth/authz
      insecure-skip-tls-verify: true
users:
  - name: admin-cert
    user:
      client-certificate: /etc/kubernetes/pki/webhook.crt
      client-key: /etc/kubernetes/pki/webhook.key
current-context: tke
contexts:
- context:
    cluster: tke
    user: admin-cert
  name: tke

# 如果已有这两个参数，则将其按照以下内容修改
- --authorization-mode=Node,RBAC,Webhook
- --authorization-webhook-config-file=/etc/kubernetes/pki/tke-authz-webhook.yaml

data:
  k8sValidVersions: '["1.21.4-tke.1","1.20.4-tke.1"]'