kubeadm方式安装k8s

[root@k8s-master ~]# vim /etc/hosts

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.80.200 k8s-master master
192.168.80.201 k8s-node1 node1
192.168.80.202 k8s-node2 node2

在三台节点上安装docker
[root@k8s-node1 ~]# yum -y install yum-utils device-mapper-persistent-data lvm2
[root@k8s-node1 ~]# yum-config-manager --add-repo
https://download.docker.com/linux/centos/docker-ce.repo
已加载插件：fastestmirror
adding repo from: https://download.docker.com/linux/centos/docker-ce.repo
grabbing file https://download.docker.com/linux/centos/docker-ce.repo to /etc/yum.repos.d/docker-ce.repo
repo saved to /etc/yum.repos.d/docker-ce.repo

[root@k8s-node1 ~]# yum -y install docker-ce
[root@k8s-node1 ~]# systemctl start docker
[root@k8s-node1 ~]# systemctl enable docker

将docker的镜像仓库改为国内的
[root@k8s-node1 ~]# vim /etc/docker/daemon.json
{
“registry-mirrors”: [“https://registry.docker-cn.com”]
}

[root@k8s-node1 ~]# systemctl restart docker

Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
[root@k8s-node1 ~]# docker info #查看docker版本信息

master、node2与node1节点配置相同，略。

3、关闭swap
三台节点执行

[root@k8s-master ~]# swapoff -a
[root@k8s-master ~]# echo "/usr/sbin/swapoff -a" >> /etc/rc.local 
[root@k8s-master ~]# chmod +x /etc/rc.local

4、配置内核参数
三台节点上执行

[root@k8s-master ~]# vim /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.ip_forward = 1
vm.swappiness=0
[root@k8s-master ~]# sysctl --system

5、加载必要的内核模块

[root@k8s-master ~]# vim /etc/sysconfig/modules/ipvs.modules
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4

[root@k8s-master ~]# chmod +x /etc/sysconfig/modules/ipvs.modules 
[root@k8s-master ~]# /etc/sysconfig/modules/ipvs.modules

6、添加kubeadm的yum源
在三个节点上操作
由于某种原因，我们无法访问kubeadm官网上提供的源，所以我们选择阿里的镜像站

[root@k8s-master ~]# vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

7、配置master节点
安装所需软件包
[root@k8s-master ~]# yum install kubeadm kubectl kubelet ipvsadm

使用kubeadm config print init-defaults > kubeadm-init.yaml 打印出默认配置，然后在根据自己的环境修改配置，尤其是镜像，在国外，默认的下不下来

[root@k8s-master ~]# kubeadm config print init-defaults > kubeadm-init.yaml
[root@k8s-master ~]# vim kubeadm-init.yaml

apiVersion: kubeadm.k8s.io/v1beta1
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 192.168.80.200
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: k8s-master
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta1
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controlPlaneEndpoint: ""
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.14.0
networking:
  dnsDomain: cluster.local
  podSubnet: ""
  serviceSubnet: 10.96.0.0/12
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: "ipvs"

可以预下载镜像

[root@k8s-master ~]# kubeadm config images pull --config kubeadm-init.yaml

[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.14.0
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.14.0
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.14.0
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.14.0
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.1
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.3.10
[config/images] Pulled registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:1.3.1

或者用我下载好的images
[root@k8s-master ~]# cat load_images.sh
#!/bin/bash

[ -d ./kube_images ] || mkdir ./kube_images
if [ ! -f ./kubenetes-system-image-v1.14.0.tar.gz ] ;then
echo ‘Can not find kubenetes-system-image-v1.14.0.tar.gz.’
exit 1
fi
tar xf kubenetes-system-image-v1.14.0.tar.gz -C ./kube_images
cd ./kube_images
for img in $(ls | column -t)
do
docker image load < $img
done
[root@k8s-master ~]# ./load_images.sh
……
[root@k8s-node1 kubenetes_img]# docker image ls
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy v1.14.0 5cd54e388aba 3 days ago 82.1MB
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver v1.14.0 ecf910f40d6e 3 days ago 210MB
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler v1.14.0 00638a24688b 3 days ago 81.6MB
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager v1.14.0 b95b1efa0436 3 days ago 158MB
registry.cn-hangzhou.aliyuncs.com/google_containers/coredns 1.3.1 eb516548c180 2 months ago 40.3MB
registry.cn-hangzhou.aliyuncs.com/google_containers/etcd 3.3.10 2c4adeb21b4f 3 months ago 258MB
registry.cn-hangzhou.aliyuncs.com/google_containers/pause 3.1 da86e6ba6ca1 15 months ago 742kB

8、初始化master节点

[root@k8s-master ~]# systemctl start kubelet
[root@k8s-master ~]# systemctl enable kubelet

[root@k8s-master ~]# kubeadm init --pod-network-cidr=10.244.0.0/16 --image-repository=registry.cn-hangzhou.aliyuncs.com/google_containers

//10.244.0.0/16是flannel网络的默认网段
……
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id-u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run “kubectl apply -f [podnetwork].yaml” with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.80.200:6443 --token abcdef.0123456789abcdef
–discovery-token-ca-cert-hash sha256:4bbba8502d00df0e724700750619525f892d0b1d4dd17815893602f8273cf995

kubeadm init主要执行了以下操作：

[init]：指定版本进行初始化操作
[preflight] ：初始化前的检查和下载所需要的Docker镜像文件
[kubelet-start] ：生成kubelet的配置文件”/var/lib/kubelet/config.yaml”，没有这个文件kubelet无法启动，所以初始化之前的kubelet实际上启动失败。
[certificates]：生成Kubernetes使用的证书，存放在/etc/kubernetes/pki目录中。
[kubeconfig] ：生成 KubeConfig 文件，存放在/etc/kubernetes目录中，组件之间通信需要使用对应文件。
[control-plane]：使用/etc/kubernetes/manifest目录下的YAML文件，安装 Master 组件。
[etcd]：使用/etc/kubernetes/manifest/etcd.yaml安装Etcd服务。
[wait-control-plane]：等待control-plan部署的Master组件启动。
[apiclient]：检查Master组件服务状态。
[uploadconfig]：更新配置
[kubelet]：使用configMap配置kubelet。
[patchnode]：更新CNI信息到Node上，通过注释的方式记录。
[mark-control-plane]：为当前节点打标签，打了角色Master，和不可调度标签，这样默认就不会使用Master节点来运行Pod。
[bootstrap-token]：生成token记录下来，后边使用kubeadm join往集群中添加节点时会用到
[addons]：安装附加组件CoreDNS和kube-proxy

为kubectl准备Kubeconfig文件
kubectl默认会在执行的用户家目录下面的.kube目录下寻找config文件。这里是将在初始化时[kubeconfig]步骤生成的admin.conf拷贝到.kube/config

[root@k8s-master ~]# mkdir -p $HOME/.kube
[root@k8s-master ~]# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@k8s-master ~]# chown $(id -u):$(id -g) $HOME/.kube/config

在该配置文件中，记录了API Server的访问地址，所以后面直接执行kubectl命令就可以正常连接到API Server中

9、验证master各组件运行状态

[root@k8s-master ~]# kubectl get cs

NAME STATUS MESSAGE ERROR
controller-manager Healthy ok
scheduler Healthy ok
etcd-0 Healthy {“health”:“true”}

[root@k8s-master ~]# kubectl get pods -A

NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system coredns-d5947d4b-954bx 0/1 Pending 0 6m14s
kube-system coredns-d5947d4b-ccwlj 0/1 Pending 0 6m15s
kube-system etcd-k8s-master 1/1 Running 0 5m15s
kube-system kube-apiserver-k8s-master 1/1 Running 0 5m28s
kube-system kube-controller-manager-k8s-master 1/1 Running 0 5m12s
kube-system kube-proxy-nngxs 1/1 Running 0 6m15s
kube-system kube-scheduler-k8s-master 1/1 Running 0 5m24s

[root@k8s-master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master NotReady master 5m22s v1.14.0

10、配置两台node节点
在节点上安装kubeadm kubelet ipvsadm

[root@k8s-node1 ~]# yum install kubeadm kubelet ipvsadm
[root@k8s-node2 ~]# yum install kubeadm kubelet ipvsadm

[root@k8s-node1 ~]# kubeadm join 192.168.80.200:6443 --token abcdef.0123456789abcdef     --discovery-token-ca-cert-hash sha256:4bbba8502d00df0e724700750619525f892d0b1d4dd17815893602f8273cf995

看见这段话表示成功：
This node has joined the cluster:

• Certificate signing request was sent to apiserver and a response was received.
• The Kubelet was informed of the new secure connection details.

Run ‘kubectl get nodes’ on the control-plane to see this node join the cluster.

回到master节点看看node信息

[root@k8s-master ~]# kubectl get nodes

NAME STATUS ROLES AGE VERSION
k8s-master NotReady master 12m v1.14.0
k8s-node1 NotReady 2m38s v1.14.0
k8s-node2 NotReady 28s v1.14.0

11、部署网络插件flannel
Master节点NotReady的原因就是因为没有使用任何的网络插件，此时Node和Master的连接还不正常。目前最流行的Kubernetes网络插件有Flannel、Calico、Canal、Weave这里选择使用flannel。

在master节点上都有执行，执行完成后需要等flannel的pods运行起来，这需要点时间：在这里插入代码片

```powershell
[root@k8s-master ~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

podsecuritypolicy.extensions/psp.flannel.unprivileged created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.extensions/kube-flannel-ds-amd64 created
daemonset.extensions/kube-flannel-ds-arm64 created
daemonset.extensions/kube-flannel-ds-arm created
daemonset.extensions/kube-flannel-ds-ppc64le created
daemonset.extensions/kube-flannel-ds-s390x created