準(zhǔn)備工作
體驗(yàn)下,準(zhǔn)備了3臺(tái)機(jī)器,正式應(yīng)該最少4臺(tái),2臺(tái)master,2臺(tái)node
1. 修改配置幾臺(tái) host
vim /etc/hosts
(內(nèi)網(wǎng)IP)
172.27.154.95 master01
172.27.154.96 node01
172.27.154.97 node02
關(guān)閉防火墻
（并未設(shè)置孵运，同賬號(hào)內(nèi)網(wǎng)）
systemctl stop firewalld
systemctl disable firewalld
關(guān)閉 Swap
swapoff -a # 臨時(shí)關(guān)閉
sed -ri 's/.*swap.*/#&/' /etc/fstab #永久關(guān)閉
關(guān)閉 SELinux
# 臨時(shí)禁用selinux
# 永久關(guān)閉 修改/etc/sysconfig/selinux文件設(shè)置
sed -i 's/SELINUX=permissive/SELINUX=disabled/' /etc/sysconfig/selinux
# 這里按回車搀绣，下面是第二條命令
setenforce 0
配置轉(zhuǎn)發(fā)參數(shù)
lsmod | grep br_netfilter #確認(rèn)是否有加載此模塊
sudo modprobe br_netfilter #沒有的話可以先加載
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system
正式安裝
Docker 安裝
官方
https://docs.docker.com/engine/install/centos/
阿里云
https://developer.aliyun.com/mirror/docker-ce?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE
配置鏡像加速器
https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors
您可以通過修改daemon配置文件/etc/docker/daemon.json來使用加速器
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF’
{
"registry-mirrors": ["https://***.mirror.aliyuncs.com”]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker
vim /etc/docker/daemon.json
{
"registry-mirrors": [
"https://***.mirror.aliyuncs.com"
],
"exec-opts": [
"native.cgroupdriver=systemd"
]
}
systemctl restart docker.service
安裝 Kubernetes
https://developer.aliyun.com/mirror/kubernetes?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE
kubeadm init --image-repository=registry.aliyuncs.com/google_containers
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.bridge.bridge-nf-call-iptables = 1\nEOF
報(bào)錯(cuò)：
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/coredns:v1.8.4: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/coredns:v1.8.4 not found: manifest unknown: manifest unknown
, error: exit status 1
kubeadm reset
docker pull coredns/coredns
docker tag coredns/coredns:latest registry.aliyuncs.com/google_containers/coredns:v1.8.4
kubeadm init --image-repository=registry.aliyuncs.com/google_containers
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
systemctl status kubelet
master 查看節(jié)點(diǎn)檢查token是否有效
kubeadm token list
生成新的token和命令。然后在node重新執(zhí)行
kubeadm token create --print-join-command
Node節(jié)點(diǎn)
join報(bào)錯(cuò)：
[preflight] Running pre-flight checks
[WARNING Hostname]: hostname "gkwc" could not be reached
[WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
[ERROR Port-10250]: Port 10250 is in use
[ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
kubeadm reset
kubeadm join 172.23.103.13:6443 --token oekgxb.kiqqr7a6egz9o39s \
--discovery-token-ca-cert-hash sha256:ef965eae9b886af2f538800d4e449572dc79330d1f85bc50219a33ec972e1e6f
輸出:
[preflight] Running pre-flight checks
[WARNING Hostname]: hostname "gkwc" could not be reached
[WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
安裝calico網(wǎng)絡(luò):
kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"
kubectl get nodes
kubectl get pods --all-namespaces
安裝CNI網(wǎng)絡(luò)插件:
kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"
部署 Dashboard UI
https://kubernetes.io/zh/docs/tasks/access-application-cluster/web-ui-dashboard/
https://github.com/kubernetes/dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml
本地端口映射服務(wù)器8001端口:
ssh -L localhost:8001:localhost:8001 root@master公網(wǎng)IP
然后本地打開
http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.
查看token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
此時(shí)能登錄進(jìn)入:
但頁(yè)面都是空的,并有錯(cuò)誤
出現(xiàn)上述問題的原因是因?yàn)槟乎澹琸ubernetes-dashboard 這個(gè)賬戶的角色權(quán)限不夠
新建 dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
然后:
kubectl apply -f dashboard-adminuser.yaml
再次查看 admin-user 的 token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
退出登錄,然后用新的token登錄:
