本機：CPU 4核，8G內(nèi)存筐赔，系統(tǒng)Ubuntu 18.04.3 LTS蹲盘。

關閉swap

swap打開的情況下，kubelet無法正常運行暑认，journalctl -xefu kubelet可查看日志困介；
關閉swap主要是為了性能考慮，kubernetes的想法是將實例緊密包裝到盡可能接近100％蘸际。 所有的部署應該與CPU /內(nèi)存限制固定在一起座哩。 所以如果調(diào)度程序發(fā)送一個pod到一臺機器，它不應該使用交換粮彤。 設計者不想交換根穷，因為它會減慢速度姜骡。
關于swap的討論1，2

$sudo swapoff -a
$ free -h
              total        used        free      shared  buff/cache   available
Mem:           7.7G        2.3G        3.3G        633M        2.0G        4.5G
Swap:            0B          0B          0B

安裝kubeadm

$ sudo apt update && sudo apt install -y apt-transport-https
$ curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | sudo apt-key add - 

/etc/apt/sources.list.d/kubernetes.list中添加aliyun的鏡像地址
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main

sudo apt update
sudo apt install -y kubelet kubeadm kubectl

安裝之后查看版本

$ kubelet --version
Kubernetes v1.16.2

其他組件安裝

Kubernetes主要由以下幾個核心組件組成：
etcd保存了整個集群的狀態(tài)屿良；
apiserver提供了資源操作的唯一入口溶浴，并提供認證、授權管引、訪問控制、API注冊和發(fā)現(xiàn)等機制闯两；
controller manager負責維護集群的狀態(tài)褥伴，比如故障檢測、自動擴展漾狼、滾動更新等重慢；
scheduler負責資源的調(diào)度，按照預定的調(diào)度策略將Pod調(diào)度到相應的機器上逊躁；
kubelet負責維護容器的生命周期似踱，同時也負責Volume（CVI）和網(wǎng)絡（CNI）的管理；
Container runtime負責鏡像管理以及Pod和容器的真正運行（CRI）稽煤；
kube-proxy負責為Service提供cluster內(nèi)部的服務發(fā)現(xiàn)和負載均衡核芽；
kubeadm init這個命令幫助你啟動跟Master相關的組件APIServer、Etcd酵熙、Scheduler轧简、Controller-Manager等。由于官方鏡像地址被墻匾二，所以我們需要首先獲取所需鏡像以及它們的版本哮独。然后從國內(nèi)鏡像站獲取。
手動拉取鏡像的方法如下（不推薦該方法察藐，推薦使用--image-repository參數(shù)）：

$ kubeadm config images list
W1021 16:18:10.509898   18535 version.go:101] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt": Get https://dl.k8s.io/release/stable-1.txt: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
W1021 16:18:10.509999   18535 version.go:102] falling back to the local client version: v1.16.2
k8s.gcr.io/kube-apiserver:v1.16.2
k8s.gcr.io/kube-controller-manager:v1.16.2
k8s.gcr.io/kube-scheduler:v1.16.2
k8s.gcr.io/kube-proxy:v1.16.2
k8s.gcr.io/pause:3.1
k8s.gcr.io/etcd:3.3.15-0
k8s.gcr.io/coredns:1.6.2

新建腳本從azure 鏡像倉庫拉取鏡像皮璧，腳本內(nèi)容如下：

images=(  # 下面的鏡像應該去除"k8s.gcr.io/"的前綴
    kube-apiserver:v1.16.2
    kube-controller-manager:v1.16.2
    kube-scheduler:v1.16.2
    kube-proxy:v1.16.2
    pause:3.1
    etcd:3.3.15-0
    coredns:1.6.2
)

for imageName in ${images[@]} ; do
    docker pull gcr.azk8s.cn/google_containers/$imageName
    docker tag gcr.azk8s.cn/google_containers/$imageName k8s.gcr.io/$imageName
    docker rmi gcr.azk8s.cn/google_containers/$imageName
done    

以上方法比較繁瑣，如果想直接從國內(nèi)鏡像倉庫拉取鏡像分飞，可以增加參數(shù)--image-repository registry.aliyuncs.com/google_containers悴务。
鏡像拉取之后，執(zhí)行kubeadm init浸须，需要指明pod網(wǎng)絡可以使用的IP地址段惨寿，即‘--pod-network-cidr’，如果安裝flannel删窒，參數(shù)為--pod-network-cidr=10.244.0.0/16裂垦，安裝calico，參數(shù)為‘--pod-network-cidr=192.168.0.0/16’肌索。

$ sudo kubeadm init  --pod-network-cidr=192.168.0.0/16 --image-repository registry.aliyuncs.com/google_containers
W1021 16:48:34.519499     697 version.go:101] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt": Get https://dl.k8s.io/release/stable-1.txt: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
W1021 16:48:34.519580     697 version.go:102] falling back to the local client version: v1.16.2
[init] Using Kubernetes version: v1.16.2
[preflight] Running pre-flight checks
    [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
    [WARNING SystemVerification]: this Docker version is not on the list of validated versions: 19.03.3. Latest validated version: 18.09
error execution phase preflight: [preflight] Some fatal errors occurred:
    [ERROR DirAvailable--var-lib-etcd]: /var/lib/etcd is not empty
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`

以上錯誤應該是之前通過rancher安裝過k8s蕉拢，運行過kubeadm init導致無法通過前置檢查，可以運行kubeadm reset，也可以選擇忽略此前置檢查錯誤--ignore-preflight-errors=DirAvailable--var-lib-etcd晕换，或者忽略所有的檢查錯誤--ignore-preflight-errors=all午乓。

$ sudo kubeadm reset
$ systemctl restart kubelet
$ sudo kubeadm init --pod-network-cidr=192.168.0.0/16
<.skip..>
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.0.4.138:6443 --token wy0tyv.ayarzeeykfv2xfdd \
    --discovery-token-ca-cert-hash sha256:8f621f384379c430340ef58ca1ea6c1fad1d1ebbec567a78de5f0b4572549b7e 

按照提示設置普通賬戶權限

 $ mkdir -p $HOME/.kube
 $ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
 $ sudo chown $(id -u):$(id -g) $HOME/.kube/config

查看安裝情況

$ kubectl get pods --all-namespaces
NAMESPACE     NAME                          READY   STATUS    RESTARTS   AGE
kube-system   coredns-5644d7b6d9-4zzqj      0/1     Pending   0          67m
kube-system   coredns-5644d7b6d9-xvr58      0/1     Pending   0          67m
kube-system   etcd-zml                      1/1     Running   0          66m
kube-system   kube-apiserver-zml            1/1     Running   0          66m
kube-system   kube-controller-manager-zml   1/1     Running   0          66m
kube-system   kube-proxy-fl79f              1/1     Running   0          67m
kube-system   kube-scheduler-zml            1/1     Running   0          66m

發(fā)現(xiàn)所有的coredns pod都處于Pending狀態(tài)，我們還需要安裝Pod Network插件闸准， kubeadm only supports Container Network Interface (CNI) based networks (and does not support kubenet).
這里使用calico網(wǎng)絡

$ kubectl apply -f https://docs.projectcalico.org/v3.10/manifests/calico.yaml
$ kubectl get pods --all-namespaces
NAMESPACE     NAME                                       READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-6d85fdfbd8-l6pfw   1/1     Running   0          6m55s
kube-system   calico-node-ql7gs                          1/1     Running   0          6m55s
kube-system   coredns-5644d7b6d9-4pwb2                   1/1     Running   0          17m
kube-system   coredns-5644d7b6d9-l69wv                   1/1     Running   0          17m
kube-system   etcd-zml                                   1/1     Running   0          17m
kube-system   kube-apiserver-zml                         1/1     Running   0          16m
kube-system   kube-controller-manager-zml                1/1     Running   0          17m
kube-system   kube-proxy-8nl2b                           1/1     Running   0          17m
kube-system   kube-scheduler-zml                         1/1     Running   0          17m

所有的pod狀態(tài)都變?yōu)?strong>Running
設置master節(jié)點也可以運行pod

$ kubectl taint nodes --all node-role.kubernetes.io/master-
node/zml untainted
$ kubectl get nodes -o wide
NAME   STATUS   ROLES    AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
zml    Ready    master   32m   v1.16.2   192.0.4.138   <none>        Ubuntu 18.04.3 LTS   4.15.0-65-generic   docker://19.3.3

到此益愈，說明kubernetes安裝完成啦。

部署Dashboard UI

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml

Creating sample user夷家，

$ kubectl apply -f dashboard-admin.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

dashboad-admin.yaml內(nèi)容如下：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

獲取登錄TOKEN

$ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
Name:         admin-user-token-gxt7q
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: c91be2ce-9bf8-4952-baa0-02502b88514f

Type:  kubernetes.io/service-account-token

Data
====
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImZLWlBRenZRSkREbjhBU3FOcTJjeEhwbFEzcGFhNGJ5Vlg4RU9uOVVtRG8ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWd4dDdxIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjOTFiZTJjZS05YmY4LTQ5NTItYmFhMC0wMjUwMmI4ODUxNGYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.HciWSZUhHpwVDjegxYvUsglOId6ooyn83PuyvwTQnnuI8_J_G7bwkC1XDU6WGJim7P1LoL2BtVSVV-Lgl16eZxhKg9LlLsdUwG5g6EUZTBoqbhogBpA7-OVkhehrftRodHun9qRvFSND470DSSfpJEj-5pu35Cw1HeLGwj7FCLaJ_Tuxgx-txhM160N7f59Zmt9Dj_FGLPKFMm-6HN4aUsl-dqigL53jXVgeIsEk3AJtTD9OaWRRRDYqViwGRlRg1pg5gePm_XWSH0RdlIExV0GaO6TLISYGBhKLmnDO9xNEnvHcdeANWlifBD5S4Risy1hi05vx43DHVbHJcx4X1A
ca.crt:     1025 bytes

訪問http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/蒸其， 輸入以上token即可登錄；

查看占用資源

參考

Creating a single control-plane cluster with kubeadm
Goto Kubernetes
azure 鏡像倉庫
Kubernetes網(wǎng)絡插件對比分析（Flannel库快、Calico摸袁、Weave）
Quickstart for Calico on Kubernetes
Web UI (Dashboard)