版權(quán)聲明:原創(chuàng)作品锯仪,謝絕轉(zhuǎn)載!否則將追究法律責(zé)任铜异。
前言
最近中國和印度的局勢也是愈演愈烈哥倔。作為一個(gè)愛國青年我有些憤怒,但有時(shí)又及其的驕傲揍庄。不知道是因?yàn)橹袊饨粡?qiáng)勢還是軟弱咆蒿,怎樣也應(yīng)該有個(gè)態(tài)度吧?這是干嘛蚂子?就會抗議 在不就搞一些軍演蜡秽。有毛用啊缆镣?
自己判斷可能是國家有自己的打算吧芽突!就好比獅子和瘋狗一樣何必那!中國和印度的紛紛擾擾董瞻,也不知道怎樣霸氣側(cè)漏還是在傷仲永寞蚌。
霸氣側(cè)漏是航母的電子彈射還是核潛艇或者是無人機(jī).....
項(xiàng)目開始
我想大家都知道docker 但是也都玩過k8s吧!
搭建kubernetes集群時(shí)遇到一些問題钠糊,網(wǎng)上有不少搭建文檔可以參考挟秤,但是滿足以下網(wǎng)絡(luò)互通才能算k8s集群ready。
需求如下:
k8s結(jié)構(gòu)圖如下:
以下是版本和機(jī)器信息:
節(jié)點(diǎn)初始化
更新CentOS-Base.repo為阿里云yum源
mv?-f?/etc/yum.repos.d/CentOS-Base.repo?/etc/yum.repos.d/CentOS-Base.repo.bk;
curl?-o?/etc/yum.repos.d/CentOS-Base.repo?http://mirrors.aliyun.com/repo/Centos-7.repo
設(shè)置bridge
cat?<?/etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables?=?1
net.bridge.bridge-nf-call-iptables?=?1
net.bridge.bridge-nf-call-arptables?=?1
EOF
sudo?sysctl?--system
disable selinux (請不要用setenforce 0)
sed?-i?'s/SELINUX=enforcing/SELINUX=disabled/'?/etc/selinux/config
關(guān)閉防火墻
sudo?systemctl?disable?firewalld.service
sudo?systemctl?stop?firewalld.service
關(guān)閉iptables
sudo?yum?install?-y?iptables-services;iptables?-F;???#可略過sudo?systemctl?disable?iptables.service
sudo?systemctl?stop?iptables.service
安裝相關(guān)軟件
sudo?yum?install?-y?vim?wget?curl?screen?git?etcd?ebtables?flannel
sudo?yum?install?-y?socat?net-tools.x86_64?iperf?bridge-utils.x86_64
安裝docker (目前默認(rèn)安裝是1.12)
sudo?yum?install?-y?yum-utils?device-mapper-persistent-data?lvm2
sudo?yum?install?-y?libdevmapper*?docker
安裝kubernetes
方便復(fù)制粘貼如下:
##設(shè)置kubernetes.repo為阿里云源抄伍,適合國內(nèi)cat < /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled=1 gpgcheck=0 EOF##設(shè)置kubernetes.repo為阿里云源艘刚,適合能連通google的網(wǎng)絡(luò)cat < /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=http://yum.kubernetes.io/repos/kubernetes-el7-x86_64 enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg ? ?https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg EOF## 安裝k8s 1.7.2 (kubernetes-cni會作為依賴一并安裝,在此沒有做版本指定)exportK8SVERSION=1.7.2 sudo yum install -y"kubectl-${K8SVERSION}-0.x86_64""kubelet-${K8SVERSION}-0.x86_64""kubeadm-${K8SVERSION}-0.x86_64"
重啟機(jī)器 (這一步是需要的)
reboot
重啟機(jī)器后執(zhí)行如下步驟
配置docker daemon并啟動docker
cat?</etc/sysconfig/docker
OPTIONS="-H?unix:///var/run/docker.sock?-H?tcp://127.0.0.1:2375?--storage-driver=overlay?--exec-opt?native.cgroupdriver=cgroupfs?--graph=/localdisk/docker/graph?--insecure-registry=gcr.io?--insecure-registry=quay.io??--insecure-registry=registry.cn-hangzhou.aliyuncs.com?--registry-mirror=http://138f94c6.m.daocloud.io"EOF
systemctl?start?docker
systemctl?status?docker?-l
拉取k8s 1.7.2 需要的鏡像
quay.io/calico/node:v1.3.0
quay.io/calico/cni:v1.9.1
quay.io/calico/kube-policy-controller:v0.6.0
gcr.io/google_containers/pause-amd64:3.0
gcr.io/google_containers/kube-proxy-amd64:v1.7.2
gcr.io/google_containers/kube-apiserver-amd64:v1.7.2
gcr.io/google_containers/kube-controller-manager-amd64:v1.7.2
gcr.io/google_containers/kube-scheduler-amd64:v1.7.2
gcr.io/google_containers/etcd-amd64:3.0.17
gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.4
gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.4
gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.4
在非k8s master節(jié)點(diǎn) 10.12.0.22 上啟動ETCD (也可搭建成ETCD集群)
screen?etcd?-name="EtcdServer"?-initial-advertise-peer-urls=http://10.12.0.22:2380?-listen-peer-urls=http://0.0.0.0:2380?-listen-client-urls=http://10.12.0.22:2379?-advertise-client-urls?http://10.12.0.22:2379?-data-dir?/var/lib/etcd/default.etcd
在每個(gè)節(jié)點(diǎn)上check是否可通達(dá)ETCD, 必須可通才行, 不通需要看下防火墻是不是沒有關(guān)閉
etcdctl?--endpoint=http://10.12.0.22:2379?member?list
etcdctl?--endpoint=http://10.12.0.22:2379?cluster-health
在k8s master節(jié)點(diǎn)上使用kubeadm啟動截珍,
pod-ip網(wǎng)段設(shè)定為10.68.0.0/16, cluster-ip網(wǎng)段為默認(rèn)10.96.0.0/16
如下命令在master節(jié)點(diǎn)上執(zhí)行
cat?<<?EOF?>kubeadm_config.yaml
apiVersion:?kubeadm.k8s.io/v1alpha1
kind:?MasterConfiguration
api:
advertiseAddress:?10.12.0.18??bindPort:?6443
etcd:
endpoints:
-?http://10.12.0.22:2379
networking:
dnsDomain:?cluster.local
serviceSubnet:?10.96.0.0/16
podSubnet:?10.68.0.0/16
kubernetesVersion:?v1.7.2#token:?#tokenTTL:?0EOF##kubeadm?init?--config?kubeadm_config.yaml
執(zhí)行kubeadm init命令后稍等幾十秒攀甚,master上api-server, scheduler, controller-manager容器都啟動起來,以下命令來check下master
如下命令在master節(jié)點(diǎn)上執(zhí)行
rm?-rf?$HOME/.kube
mkdir?-p?$HOME/.kube
sudo?cp?-i?/etc/kubernetes/admin.conf?$HOME/.kube/config
sudo?chown?$(id?-u):$(id?-g)?$HOME/.kube/config
kubectl?get?cs?-o?wide?--show-labels
kubectl?get?nodes?-o?wide?--show-labels
節(jié)點(diǎn)加入, 需要kubeadm init命令輸出的token, 如下命令在node節(jié)點(diǎn)上執(zhí)行
systemctl?start?docker
systemctl?start?kubelet
kubeadm?join?--token?*{6}.*{16}?10.12.0.18:6443?--skip-preflight-checks
在master節(jié)點(diǎn)上觀察節(jié)點(diǎn)加入情況岗喉, 因?yàn)檫€沒有創(chuàng)建網(wǎng)絡(luò)秋度,所以,所有master和node節(jié)點(diǎn)都是NotReady狀態(tài)钱床, kube-dns也是pending狀態(tài)
kubectl?get?nodes?-o?wide
watch?kubectl?get?all?--all-namespaces?-o?wide
對calico.yaml做了修改
刪除ETCD創(chuàng)建部分荚斯,使用外部ETCD
修改CALICO_IPV4POOL_CIDR為10.68.0.0/16
calico.yaml如下:
# Calico Version v2.3.0
#http://docs.projectcalico.org/v2.3/releases#v2.3.0
# This manifest includes the following component versions:
# calico/node:v1.3.0
# calico/cni:v1.9.1
# calico/kube-policy-controller:v0.6.0
# This Config Map is used to configure a self-hosted Calico installation.kind:Config MapapiVersion:v1metadata:name:calico-confignamespace:kube-systemdata:
# The location of your etcd cluster. ?This uses the Service clusterIP defined below.etcd_endpoints:"http://10.12.0.22:2379"
# Configure the Calico backend to use.calico_backend:"bird"
# The CNI network configuration to install on each node.cni_network_config:|- ? ?{"name":"k8s-pod-network","cniVersion":"0.1.0","type":"calico","etcd_endpoints":"__ETCD_ENDPOINTS__","log_level":"info","ipam":{"type":"calico-ipam"},"policy":{"type":"k8s","k8s_api_root":"https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__","k8s_auth_token":"__SERVICEACCOUNT_TOKEN__"},"kubernetes":{"kubeconfig":"/etc/cni/net.d/__KUBECONFIG_FILENAME__"} ? ?}---
# This manifest installs the calico/node container, as well
# as the Calico CNI plugins and network config on
# each master and worker node in a Kubernetes cluster.kind:DaemonSetapiVersion:extensions/v1beta1metadata:name:calico-nodenamespace:kube-systemlabels:k8s-app:calico-nodespec:selector:matchLabels:k8s-app:calico-nodetemplate:metadata:labels:k8s-app:calico-nodeannotations:
# Mark this pod as a critical add-on; when enabled, the critical add-on scheduler
# reserves resources for critical add-on pods so that they can be rescheduled after
# a failure. ?This annotation works in tandem with the toleration below.scheduler.alpha.kubernetes.io/critical-pod:''spec:hostNetwork:truetolerations:- key:node-role.kubernetes.io/mastereffect:NoSchedule
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode.
# This, along with the annotation above marks this pod as a critical add-on.key:CriticalAddonsOnlyoperator:ExistsserviceAccountName:calico-cni-plugincontainers:
# Runs calico/node container on each Kubernetes node. ?This# container programs network policy and routes on each# host.- name:calico-nodeimage:quay.io/calico/node:v1.3.0env:
# The location of the Calico etcd cluster.- name:ETCD_ENDPOINTSvalueFrom:configMapKeyRef:name:calico-configkey:etcd_endpoints
# Enable BGP. ?Disable to enforce policy only.- name:CALICO_NETWORKING_BACKENDvalueFrom:config MapKeyRef:name:calico-configkey:calico_backend
# Disable file logging so `kubectl logs` works.- name:CALICO_DISABLE_FILE_LOGGINGvalue:"true"
# Set Felix endpoint to host default action to ACCEPT.- name:FELIX_DEFAULTENDPOINTTOHOSTACTIONvalue:"ACCEPT"
# Configure the IP Pool from which Pod IPs will be chosen.- name:CALICO_IPV4POOL_CIDRvalue:"10.68.0.0/16"- name:CALICO_IPV4POOL_IPIPvalue:"always"
# Disable IPv6 on Kubernetes.- name:FELIX_IPV6SUPPORTvalue:"false"
# Set Felix logging to "info"- name:FELIX_LOGSEVERITYSCREENvalue:"info"
# Auto-detect the BGP IP address.- name:IPvalue:""securityContext:privileged:trueresources:requests:cpu:250mvolumeMounts:- mountPath:/lib/modulesname:lib-modulesreadOnly:true- mountP/var/run/caliconame:var-run-calicoreadOnly:false
# This container installs the Calico CNI binaries
# and CNI network config file on each node.- name:install-cniimage:quay.io/calico/cni:v1.9.1command:["/install-cni.sh"]env:
# The location of the Calico etcd cluster.- name:ETCD_ENDPOINTSvalueFrom:configMapKeyRef:name:calico-configkey:etcd_endpoints
# The CNI network config to install on each node.- name:CNI_NETWORK_CONFIGvalueFrom:configMapKeyRef:name:calico-configkey:cni_network_configvolumeMounts:- mountPath:/host/opt/cni/biname:cni-bin-dir- mountPath:/host/etc/cni/net.dname:cni-net-dirvolumes:
# Used by calico/node.- name:lib-moduleshostPath:path:/lib/modules- name:var-run-calicohostPath:path:/var/run/calico# Used to install CNI.- name:cni-bin-dirhostPath:path:/opt/cni/bin- name:cni-net-dirhostPath:path:/etc/cni/net.d---# This manifest deploys the Calico policy controller on Kubernetes.
# See https://github.com/projectcalico/k8s-policyapiVersion:extensions/v1beta1kind:Deploymentmetadata:name:calico-policy-controllernamespace:kube-systemlabels:k8s-app:calico-policyspec:
# The policy controller can only have a single active instance.replicas:1strategy:type:Recreatetemplate:metadata:name:calico-policy-controllernamespace:kube-systemlabels:k8s-app:calico-policy-controllerannotations:
# Mark this pod as a critical add-on; when enabled, the critical add-on scheduler
# reserves resources for critical add-on pods so that they can be rescheduled after
# a failure. ?This annotation works in tandem with the toleration below.scheduler.alpha.kubernetes.io/critical-pod:''spec:
# The policy controller must run in the host network namespace so that
# it isn't governed by policy that would prevent it from working.hostNetwork:truetolerations:- key:node-role.kubernetes.io/mastereffect:NoSchedule# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode.
# This, along with the annotation above marks this pod as a critical add-on.- key:CriticalAddonsOnlyoperator:ExistsserviceAccountName:calico-policy-controllercontainers:- name:calico-policy-controllerimage:quay.io/calico/kube-policy-controller:v0.6.0env:
# The location of the Calico etcd cluster.- name:ETCD_ENDPOINTSvalueFrom:configMapKeyRef:name:calico-configkey:etcd_endpoints
# The location of the Kubernetes API. ?Use the default Kubernetes
# service for API access.- name:K8S_APIvalue:"https://kubernetes.default:443"
# Since we're running in the host namespace and might not have KubeDNS
# access, configure the container's /etc/hosts to resolve
# kubernetes.default to the correct service clusterIP.- name:CONFIGURE_ETC_HOSTSvalue:"true"---apiVersion:rbac.authorization.k8s.io/v1beta1kind:ClusterRoleBindingmetadata:name:calico-cni-pluginroleRef:apiGroup:rbac.authorization.k8s.iokind:ClusterRolename:calico-cni-pluginsubjects:- kind:ServiceAccountname:calico-cni-pluginnamespace:kube-system---kind:ClusterRoleapiVersion:rbac.authorization.k8s.io/v1beta1metadata:name:calico-cni-pluginnamespace:kube-systemrules:- apiGroups:[""]resources:-pods-nodesverbs:-get---apiVersion:v1kind:ServiceAccountmetadata:name:calico-cni-pluginnamespace:kube-system---apiVersion:rbac.authorization.k8s.io/v1beta1kind:ClusterRoleBindingmetadata:name:calico-policy-controllerroleRef:apiGroup:rbac.authorization.k8s.iokind:ClusterRolename:calico-policy-controllersubjects:- kind:ServiceAccountname:calico-policy-controllernamespace:kube-system---kind:ClusterRoleapiVersion:rbac.authorization.k8s.io/v1beta1metadata:name:calico-policy-controllernamespace:kube-systemrules:- apiGroups:-""-extensionsresources:-pods-namespaces-networkpoliciesverbs:-watch-list---apiVersion:v1kind:ServiceAccountmetadata:name:calico-policy-controllernamespace:kube-system
創(chuàng)建calico跨主機(jī)網(wǎng)絡(luò), 在master節(jié)點(diǎn)上執(zhí)行如下命令
kubectl?apply?-f?calico.yaml
注意觀察每個(gè)節(jié)點(diǎn)上會有名為calico-node-****的pod起來, calico-policy-controller和kube-dns也會起來, 這些pod都在kube-system名字空間里
>kubectl?get?all?--all-namespaces
NAMESPACE?????NAME?????????????????????????????????????????????????READY?????STATUS????RESTARTS???AGE
kube-system???po/calico-node-2gqf2?????????????????????????????????2/2???????Running???0??????????19h
kube-system???po/calico-node-fg8gh?????????????????????????????????2/2???????Running???0??????????19h
kube-system???po/calico-node-ksmrn?????????????????????????????????2/2???????Running???0??????????19h
kube-system???po/calico-policy-controller-1727037546-zp4lp?????????1/1???????Running???0??????????19h
kube-system???po/etcd-izuf6fb3vrfqnwbct6ivgwz??????????????????????1/1???????Running???0??????????19h
kube-system???po/kube-apiserver-izuf6fb3vrfqnwbct6ivgwz????????????1/1???????Running???0??????????19h
kube-system???po/kube-controller-manager-izuf6fb3vrfqnwbct6ivgwz???1/1???????Running???0??????????19h
kube-system???po/kube-dns-2425271678-3t4g6?????????????????????????3/3???????Running???0??????????19h
kube-system???po/kube-proxy-6fg1l??????????????????????????????????1/1???????Running???0??????????19h
kube-system???po/kube-proxy-fdbt2??????????????????????????????????1/1???????Running???0??????????19h
kube-system???po/kube-proxy-lgf3z??????????????????????????????????1/1???????Running???0??????????19h
kube-system???po/kube-scheduler-izuf6fb3vrfqnwbct6ivgwz????????????1/1???????Running???0??????????19h
NAMESPACE?????NAME???????????????????????CLUSTER-IP??????EXTERNAL-IP???PORT(S)?????????AGE
default???????svc/kubernetes?????????????10.96.0.1???????????????443/TCP?????????19h
kube-system???svc/kube-dns???????????????10.96.0.10??????????????53/UDP,53/TCP???19h
NAMESPACE?????NAME??????????????????????????????DESIRED???CURRENT???UP-TO-DATE???AVAILABLE???AGE
kube-system???deploy/calico-policy-controller???1?????????1?????????1????????????1???????????19h
kube-system???deploy/kube-dns???????????????????1?????????1?????????1????????????1???????????19h
NAMESPACE?????NAME?????????????????????????????????????DESIRED???CURRENT???READY?????AGE
kube-system???rs/calico-policy-controller-1727037546???1?????????1?????????1?????????19h
kube-system???rs/kube-dns-2425271678???????????????????1?????????1?????????1?????????19h
部署dash-board
wget?https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/kubernetes-dashboard.yaml
kubectl?create?-f?kubernetes-dashboard.yaml
部署heapster
wget?https://github.com/kubernetes/heapster/archive/v1.4.0.tar.gz
tar?-zxvf?v1.4.0.tar.gzcd?heapster-1.4.0/deploy/kube-config/influxdb
kubectl?create?-f?./
其他命令
強(qiáng)制刪除某個(gè)pod
kubectl?delete?pod??--namespace=??--grace-period=0?--force
重置某個(gè)node節(jié)點(diǎn)
kubeadm?reset
systemctl?stop?kubelet;
docker?ps?-aq?|?xargs?docker?rm?-fv
find?/var/lib/kubelet?|?xargs?-n?1?findmnt?-n?-t?tmpfs?-o?TARGET?-T?|?uniq?|?xargs?-r?umount?-v;
rm?-rf?/var/lib/kubelet?/etc/kubernetes/?/var/lib/etcd
systemctl?start?kubelet;
訪問dashboard (在master節(jié)點(diǎn)上執(zhí)行)
kubectl?proxy?--address=0.0.0.0?--port=8001?--accept-hosts='^.*'
or
kubectl?proxy?--port=8011?--address=192.168.61.100?--accept-hosts='^192\.168\.61\.*'
access?to?http://0.0.0.0:8001/ui
Access to API with authentication token
APISERVER=$(kubectl?config?view?|?grep?server?|?cut?-f?2-?-d?":"?|?tr?-d?"?")
TOKEN=$(kubectl?describe?secret?$(kubectl?get?secrets?|?grep?default?|?cut?-f1?-d?'?')?|?grep?-E?'^token'?|?cut?-f2?-d':'?|?tr?-d?'\t')
curl?$APISERVER/api?--header?"Authorization:?Bearer?$TOKEN"?--insecure
讓master節(jié)點(diǎn)參與調(diào)度事期,默認(rèn)master是不參與到任務(wù)調(diào)度中的
kubectl?taint?nodes?--all?node-role.kubernetes.io/master-
or
kubectl?taint?nodes?--all?dedicated-
kubernetes master 消除隔離之前 Annotations
Name:???????????izuf6fb3vrfqnwbct6ivgwzRole:Labels:?????????beta.kubernetes.io/arch=amd64
beta.kubernetes.io/os=linux
kubernetes.io/hostname=izuf6fb3vrfqnwbct6ivgwz
node-role.kubernetes.io/master=Annotations:????????node.alpha.kubernetes.io/ttl=0
volumes.kubernetes.io/controller-managed-attach-detach=true
kubernetes master 消除隔離之后 Annotations
Name:???????????izuf6fb3vrfqnwbct6ivgwzRole:Labels:?????????beta.kubernetes.io/arch=amd64
beta.kubernetes.io/os=linux
kubernetes.io/hostname=izuf6fb3vrfqnwbct6ivgwz
node-role.kubernetes.io/master=Annotations:????????node.alpha.kubernetes.io/ttl=0
volumes.kubernetes.io/controller-managed-attach-detach=trueTaints:?????????
總結(jié):通過測試已經(jīng)完成但是還有錯(cuò)看過文檔的伙伴能猜到嗎滥壕?
本文出自 “李世龍” 博客,謝絕轉(zhuǎn)載兽泣!