[TOC]
一匆帚、安裝先決條件和集群規(guī)劃
1.1 環(huán)境配置
以下操作在所有節(jié)點(diǎn)執(zhí)行
- 關(guān)閉防火墻：
systemctl stop firewalld
systemctl disable firewalld
- 禁用SELinux 酿炸，讓容器可以讀取主機(jī)文件系統(tǒng)：
setenforce 0
sed -i 's/enforcing/disabled/' /etc/selinux/config
- 校正時(shí)間：
date
- 安裝ntp
yum install -y ntp
- 同步時(shí)間
ntpdate cn.pool.ntp.org
- 關(guān)閉swap K8S中不支持swap分區(qū)
swapoff -a
vim /etc/fstab
#/dev/mapper/centos-swap swap swap defaults 0 0
1.2 集群規(guī)劃
- docker 版本： 19.03.5
- kubelet 版本： V1.16.3
- kubeadm 版本： v1.16.3
| 角色 | 主機(jī)名 | IP 地址 | 配置信息 |
|---|---|---|---|
| Master | k8s-master | 192.168.92.10 | 2核4G內(nèi)存 |
| Node | k8s-slave01 | 192.168.92.11 | 2核4G內(nèi)存 |
| Node | k8s-slave02 | 192.168.92.12 | 2核4G內(nèi)存 |
以下操作在所有節(jié)點(diǎn)執(zhí)行
更改hosts文件添加主機(jī)名與IP映射關(guān)系
vim /etc/hosts
192.168.92.10 k8s-master
192.169.92.11 k8s-slave01
192.168.92.12 k8s-slave02
將橋接的IPV4流量傳遞到iptables的鏈
cat <<EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
vm.swappiness = 0
net.ipv4.ip_forward= 1
EOF
載入配置：
sysctl --system
允許自動登錄：
sed -i "s/PasswordAuthentication no/PasswordAuthentication yes/g" /etc/ssh/sshd_config
二吨凑、安裝Docker
以下操作在所有節(jié)點(diǎn)執(zhí)行
1.卸載舊版本
sudo yum remove docker \
docker-client \
docker-client-latest \
docker-common \
docker-latest \
docker-latest-logrotate \
docker-logrotate \
docker-selinux \
docker-engine-selinux \
docker-engine
2.安裝并運(yùn)行Docker[使用存儲庫進(jìn)行安裝]
sudo yum install -y yum-utils \
device-mapper-persistent-data \
lvm2
3.設(shè)置穩(wěn)定的存儲庫竖哩。
sudo yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
4. 安裝docker
sudo yum install docker-ce
sudo systemctl start docker
sudo systemctl enable docker
5.檢查安裝結(jié)果
# docker info
出現(xiàn)如下信息该抒，則docker安裝成功
Kernel Version: 3.10.0-693.17.1.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
Number of Docker Hooks: 3
CPUs: 1
Total Memory: 1.359 GiB
Name: localhost.localdomain
ID: KE6P:FAHI:ZYWT:AUWU:NVFG:6JRF:33ZS:AT4X:63QZ:ICYW:PUTO:V4ZB
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Registries: docker.io (secure)
三郑原、安裝kubeadm工具
以下操作所有節(jié)點(diǎn)進(jìn)行
1.添加kerbernets鏡像文件信息
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
2.安裝kubeadm工具
yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
2.設(shè)置開機(jī)自啟動
systemctl enable kubelet && systemctl start kubelet
3.查看kubeadm腌紧、kubelet版本
kubelet --version
kubeadm version
三茸习、安裝master節(jié)點(diǎn)
以下步驟在主節(jié)點(diǎn)進(jìn)行
1.初始化配置安裝參數(shù)
kubeadm config print init-defaults > init.default.yaml
初始化結(jié)果如下：
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 1.2.3.4
bindPort: 6443
nodeRegistration:
criSocket: /var/run/dockershim.sock
name: localhost.localdomain
taints:
- effect: NoSchedule
key: node-role.kubernetes.io/master
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
type: CoreDNS
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: k8s.gcr.io
kind: ClusterConfiguration
kubernetesVersion: v1.16.0
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
scheduler: {}
2.下載kubernetes相關(guān)鏡像
添加docker鏡像倉庫信息：
echo '{"registry-mirrors":["https://registry.docker-cn.com"]}' > /etc/docker/daemon.json
cat /etc/docker/daemon.json
重啟docker容器
systemctl restart docker
修改初始化打印文件名為：init-config.yaml
mv init-default.yaml intit-config.yaml
修改init-config.yaml 文件，修改鏡像地址信息：
imageRepository: registry.aliyuncs.com/google_containers
刪除無用信息壁肋，最終配置文件如下号胚，如多配置，會導(dǎo)致Master節(jié)點(diǎn)安裝失斀拧：
apiVersion: kubeadm.k8s.io/v1beta2
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.16.0
networking:
serviceSubnet: 10.96.0.0/12
podSubnet: 10.244.0.0/16
根據(jù)初始化的參數(shù)文件進(jìn)行相關(guān)鏡像下載：
kubeadm config images pull --config=init-config.yaml
根據(jù)下載的鏡像安裝Master
kubeeadm init --config=init-config.yaml
安裝成功后會有如下類似提示：
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.92.10:6443 --token 4nmcwj.ebrnxqyks0rmkgki \
--discovery-token-ca-cert-hash sha256:3d246361bc34b33cd7c60eb6a19e74a13842a4a810128b890c0f06c23065a28a
按提示操作：
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
此時(shí)查看雁陣kubeadm-config 的ConfigMap對象：
kubectl get -n kube-system configmap
查看安裝狀態(tài)：
[root@k8s-master k8s]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master NotReady master 17m v1.16.3
四猫胁、安裝CNI網(wǎng)絡(luò)通信插件
1.安裝CNI插件
此處采用kube-flannel
mkdir flannel && cd flannel
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubekubectl apply -f kube-flannel.yml
flannel支持的模式：
flannel支持多種模型
VxLAN #vxLAN有以下兩種模式
(1) vxlan #疊加網(wǎng)絡(luò)或者隧道網(wǎng)絡(luò)，通過封裝網(wǎng)絡(luò)報(bào)文的方式使不同網(wǎng)段的pod之間可以通訊
(2) Directrouting #直接使用主機(jī)的IP地作為網(wǎng)關(guān)跛锌，通過主機(jī)路由的方式與目標(biāo)pod進(jìn)行通訊弃秆，當(dāng)目標(biāo)pod與當(dāng)前pod不在同一三層網(wǎng)絡(luò)內(nèi)，會自動降級為VxLAN模式
host-gw: Host GateWay #與VxLAN的Directrouting模式相同髓帽，當(dāng)目標(biāo)pod與當(dāng)前pod不在同一三層網(wǎng)絡(luò)內(nèi)時(shí)菠赚，pod之間無法通訊
UDP: #早期由于Linux內(nèi)核不支持VxLAN，host-gw又有非常高的入門門檻郑藏，udp是flannel最早期使用的模式衡查，由于使用普通的udp報(bào)文通訊，性能非常差必盖，在可以使用前面兩種模式的情況下請勿使用該模式
查看集群狀態(tài)：
[root@k8s-master flannel]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master Ready master 5m43s v1.16.3
TIPS:
- 如果master安裝失敗,執(zhí)行
kubeadm reset #重置主機(jī)拌牲，之后重新執(zhí)行kubeadm init再次安裝
- 如果 Pod 錯(cuò)誤俱饿，需要執(zhí)行
kubectl --namespace=kube-system describe pod <pod_name>
五、node節(jié)點(diǎn)加入集群
先決條件： 已經(jīng)安裝kubelet kubeadm
1.創(chuàng)建節(jié)點(diǎn)加入配置文件 join-config.yaml
vim /home/k8s/join-config.yaml
apiVersion: kubeadm.k8s.io/v1beta2
kind: JoinConfiguration
discovery:
bootstrapToken:
apiServerEndpoint: 192.168.92.10:6443
token: 4nmcwj.ebrnxqyks0rmkgki
unsafeSkipCAVerification: true
tlsBootstrapToken: 4nmcwj.ebrnxqyks0rmkgki
其中 token 和 tlsBootstrapToken 來自Master安裝后的提示末尾信息, 如果忘記了token信息和證書信息可使用以下命令查詢：
- 查詢token信息
kubeadm token list
token 24小時(shí)失效
可使用如下命令重新創(chuàng)建
kubeadm token create
- 查詢ca證書hash值
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
2.node節(jié)點(diǎn)加入集群
以下操作適用于node1和node2
kubeadm join --config=join-config.yaml
節(jié)點(diǎn)加入成功會有如下信息：
[preflight] Running pre-flight checks
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 19.03.5. Latest validated version: 18.09
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.16" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Activating the kubelet service
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
如果節(jié)點(diǎn)加入超時(shí)塌忽，請執(zhí)行如下命令：
swapoff -a
kubeadm reset
systemctl daemon-reload
systemctl restart kubelet
節(jié)點(diǎn)剔除：
kubectl drain k8s-slave2 --delete-local-data --ignore-daemonsets
kubectl delete node k8s-slave2
六拍埠、常用命令：
1.查看所加入節(jié)點(diǎn)
[root@k8s-master kubernetes]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master Ready master 101m v1.16.3
k8s-slave1 Ready <none> 41s v1.16.3
k8s-slave2 Ready <none> 11m v1.16.3
2.查看所有Pod命令
kubectl get pod --all-namespaces
本文由博客一文多發(fā)平臺 OpenWrite 發(fā)布！
