K8s部署

部署k8s

准备工作

• 实验环境

角色	IP	系统	硬件
master	192.168.218.133	centos8	2核 3G内存
node1	192.168.218.130	centos8	4核 4G内存
node2	192.168.218.144	centos8	4核 4G内存

• 设置主机名、关闭三台主机的防火墙和selinux、还有swap分区空间
  三台主机都是需要做同样的配置，以下以master主机演示

//修改主机名
[root@localhost ~]# hostnamectl set-hostname master.example.com
[root@localhost ~]# bash
[root@master ~]# hostname
master.example.com

//关闭防火墙和selinux
[root@master ~]# systemctl --now disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@master ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
[root@master ~]# setenforce 0 

//关闭swap空间
[root@master ~]# vim /etc/fstab 


# 
# /etc/fstab
# Created by anaconda on Tue Jul 27 10:40:26 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/cs-root     /                       xfs     defaults        0 0
UUID=ffb38cf3-f514-4703-958d-254bb6ec8d61 /boot                   xfs     defaults        0 0

# 把下面一行删除掉即可
/dev/mapper/cs-swap     none                    swap    defaults        0 0

• master配置DNS域名解析、IPv4流量传递到iptables的链
  master主机操作，其他节点无需任何操作

//master主机上配置域名解析，让三台主机可以互通
[root@master ~]# vim /etc/hosts 

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

#添加以下三行内容
192.168.218.133 master master.example.com
192.168.218.130 node1 node1.example.com
192.168.218.144 node2 node2.example.com

//master上配置流量传递
[root@master ~]# cat > /etc/sysctl.d/k8s.conf << EOF
> net.bridge.bridge-nf-call-ip6tables = 1
> net.bridge.bridge-nf-call-iptables = 1
> EOF
[root@master ~]# cat /etc/sysctl.d/k8s.conf 
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1

[root@master ~]# sysctl --system    //让刚刚修改的配置生效
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /usr/lib/sysctl.d/50-coredump.conf ...
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
kernel.kptr_restrict = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.promote_secondaries = 1
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf ...
net.core.optmem_max = 81920
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
kernel.pid_max = 4194304
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.d/k8s.conf ...      //成功读取到新添加的配置文件
* Applying /etc/sysctl.conf ...

• 时间同步、免密登陆
  时间同步是所有主机都要做的，这里就拿master为例。而免密登陆是在master上操作,node节点无需任何操作

//时间同步
[root@master ~]# yum clean all     //清理缓存
37 files removed
[root@master ~]# yum makecache   //建立新的缓存，这样速度快而且还不会出现问题

//安装chrony时间同步
[root@master ~]# yum -y install chrony

//配置chrony、并设置开机自启
[root@master ~]# vim /etc/chrony.conf 
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool time1.aliyun.com iburst    //修改为阿里云的时间

[root@master ~]# systemctl enable --now chronyd
[root@master ~]# systemctl status chronyd
● chronyd.service - NTP client/server
   Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enab>
   Active: active (running) since Tue 2021-12-21 09:23:53 CST; 1>
     Docs: man:chronyd(8)
           man:chrony.conf(5)
  Process: 10521 ExecStartPost=/usr/libexec/chrony-helper update>
  Process: 10517 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exit>
 Main PID: 10519 (chronyd)
    Tasks: 1 (limit: 18672)
   Memory: 1.8M
   CGroup: /system.slice/chronyd.service
           └─10519 /usr/sbin/chronyd

Dec 21 09:23:53 master.example.com systemd[1]: Starting NTP clie>
Dec 21 09:23:53 master.example.com chronyd[10519]: chronyd versi>
Dec 21 09:23:53 master.example.com chronyd[10519]: Using right/U>
Dec 21 09:23:53 master.example.com systemd[1]: Started NTP clien>
Dec 21 09:23:57 master.example.com chronyd[10519]: Selected sour>
Dec 21 09:23:57 master.example.com chronyd[10519]: System clock >
Dec 21 09:24:01 master.example.com chronyd[10519]: System clock >
Dec 21 09:24:01 master.example.com chronyd[10519]: System clock 

//master上做免密登陆，做这一步前要确保可以在master上ping通每个node
[root@master ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:JSR1wFHCoylyhyGEg1iRC+REkRTw5kQONr2vHAq0LUU root@master.example.com
The key's randomart image is:
+---[RSA 3072]----+
|X&Xo  .+*+o      |
|X*+E.  o+o       |
| +*o.o o...      |
| =oo+ +  o       |
|. =o.o  S        |
|.o o .           |
|. + o            |
| . o             |
|                 |
+----[SHA256]-----+

//把master上密码传给所有人包括自己
[root&