Kubernetes集群部署

最新推荐文章于 2024-06-13 15:17:08 发布

不断尝试

最新推荐文章于 2024-06-13 15:17:08 发布

阅读量47

点赞数

文章标签： kubernetes 容器云原生

本文链接：https://blog.csdn.net/Zxs4212/article/details/132871517

版权

Kubernetes安装

服务器资源准备

1、三台虚拟机、组建最小集群、一台作为master、两台作为worker

第一步虚拟机准备

1、修改host文件
cat <<EOF>>  /etc/hosts 
192.168.23.3 k8s-master
192.168.23.4 k8s-worker-1
192.168.23.5 k8s-worker-2
199.232.68.133 raw.githubusercontent.com
EOF

2、升级内核版本
导入key
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
安装yum源，使用elrepo源
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
安装内核
yum --enablerepo=elrepo-kernel install kernel-ml-devel kernel-ml -y
更改内核默认启动顺序
grub2-set-default 0
重启 
reboot
查看

3、更新安装ipvsadm
yum install ipvsadm ipset svsstat conntrack libseccomp -y
uname -r

第二步关闭并禁用防火墙以及swap交换分区

systemctl stop firewalld
systemctl disable firewalld
setenforce 0
sed -i 's/SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
swapoff -a
sed -i.bak '/swap/s/^/#/' /etc/fstab

第三步设置master免密登录到其他节点

ssh-keygen -t rsa -P ""
ssh-copy-id -i /root/.ssh/id_rsa.pub root@k8s-worker-1
ssh-copy-id -i /root/.ssh/id_rsa.pub root@k8s-worker-2

第四步安装docker

1、安装yum工具
yum install -y yum-utils
2、设置docker源
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
3、安装docker ce
yum list docker-ce --showduplicates | sort -r
yum install -y docker-ce-19.03.9 docker-ce-cli-19.03.9 containerd.io

4、修改docker的Cgroup Driver为systemd
vi /etc/docker/daemon.json
{
"exec-opts":["native.cgroupdriver=systemd"]
}

4、启动docker
systemctl daemon-reload
systemctl start docker
systemctl enable docker
docker --version
docker run hello-world

k8s-Master安装,在master机器上执行

1、修改内核参数，将每台服务器都设置将桥接的ipv4流量传递到iptables的链
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1
EOF
sysctl -p /etc/sysctl.d/k8s.conf

2、设置kubernetes源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enable=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum clean all
yum -y makecache

3、安装k8s版本1.17，启动kubelet并设置开机启动
yum list kubelet --showduplicates | sort -r
yum list kubelet --showduplicates | sort -r | grep 1.17.4
yum install -y kubelet-1.17.4 kubeadm-1.17.4 kubectl-1.17.4 --setopt=obsoletes=0
systemctl enable kubelet && systemctl start kubelet

4、编辑镜像的下载脚本，用脚本下载k8s所需的镜像
vim image.sh

#!/bin/bash
url=registry.cn-hangzhou.aliyuncs.com/google_containers
version=v1.17.4
images=(`kubeadm config images list --kubernetes-version=$version | awk -F '/' '{print $2}'`)
for imagename in ${images[@]}; do
    docker pull $url/$imagename
    docker tag $url/$imagename k8s.gcr.io/$imagename
done

# 删除原始镜像
imagesName=`docker images  | awk '{print $1}'`
for iname in $imagesName
do
  if [[ "${iname}" =~ "${url}" ]]; then
    # 查询tag
    tag_name=`docker images -f reference="${iname}" | awk '{print $2}'`
    # 将string转化为数组
    array=(${tag_name// / })
    docker rmi -f ${iname}:${array[1]}
  fi
done

chmod u+x image.sh
./image.sh

单独执行
docker pull quay.io/coreos/flannel:v0.14.0

docker images

Master配置

1、初始化Master
ip address | grep 24
# 解释：apiserver-adverties-address为主机地址 pod-network-cidr该参数指明了 Pod 网络的 CIDR
# 初始化集群  --pod-network-cidr=10.244.0.0/16    //使用flannel网络组件时必须添加
kubeadm init \
  --apiserver-advertise-address=192.168.23.3 \
  --image-repository=registry.aliyuncs.com/google_containers \
  --kubernetes-version=v1.17.4 \
  --service-cidr=10.1.0.0/16 \
  --pod-network-cidr=10.244.0.0/16

2、加载环境变量
echo "export KUBECONFIG=/etc/kubernetes"/admin.conf >> ~/.bash_profile
source ~/.bash_profile
#安装pod网络,raw.githubusercontent.com的ip地址已经添加到/etc/hosts文件
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

4、查看令牌
kubeadm token list
#生成新的令牌
kubeadm token create
#生成新的加密串
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

Worker节点安装

安装docker

1、安装yum工具
yum install -y yum-utils
2、设置docker源
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
3、安装docker ce
yum list docker-ce --showduplicates | sort -r
yum install -y docker-ce-19.03.9 docker-ce-cli-19.03.9 containerd.io

4、修改docker的Cgroup Driver为systemd
cat /etc/docker/daemon.json
{
"exec-opts":["native.cgroupdriver=systemd"]
}

4、启动docker
systemctl daemon-reload
systemctl start docker
systemctl enable docker
docker --version
docker run hello-world

安装k8s

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enable=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum clean all
yum -y makecache

3、安装k8s版本1.17，启动kubelet并设置开机启动
yum list kubelet --showduplicates | sort -r
yum list kubelet --showduplicates | sort -r | grep 1.17.4
yum install -y kubelet-1.17.4 kubeadm-1.17.4 kubectl-1.17.4 --setopt=obsoletes=0
systemctl enable kubelet && systemctl start kubelet

4、编辑镜像的下载脚本，用脚本下载k8s所需的镜像
vim image.sh

#!/bin/bash
url=registry.cn-hangzhou.aliyuncs.com/google_containers
version=v1.17.4
images=(`kubeadm config images list --kubernetes-version=$version | awk -F '/' '{print $2}'`)
for imagename in ${images[@]}; do
    docker pull $url/$imagename
    docker tag $url/$imagename k8s.gcr.io/$imagename
done

# 删除原始镜像
imagesName=`docker images  | awk '{print $1}'`
for iname in $imagesName
do
  if [[ "${iname}" =~ "${url}" ]]; then
    # 查询tag
    tag_name=`docker images -f reference="${iname}" | awk '{print $2}'`
    # 将string转化为数组
    array=(${tag_name// / })
    docker rmi -f ${iname}:${array[1]}
  fi
done

chmod u+x image.sh
./image.sh


docker images

Worker节点加入集群

1、worker运行
kubeadm join 192.168.23.3:6443 --token (来自master运行 kubeadm token create得到的令牌) --discovery-token-ca-cert-hash (来自于master节点运行的openssl得到的令牌加密字符串)
示例：
kubeadm join 192.168.23.3:6443 --token inrh4n.xze6qpozbkpnjrvp --discovery-token-cert-hash sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Master节点验证Worker节点状态

kubectl label node k8s-worker-1 node-role.kubernetes.io/worker=worker

kubectl label node k8s-worker-2 node-role.kubernetes.io/worker=worker

kubeadm get node

Dashboard安装,在主节点上运行


kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc7/aio/deploy/recommended.yaml

kubectl get pods -n kubernetes-dashboard
kubectl get svc -n kubernetes-dashboard

kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard

kubectl get svc -n kubernetes-dashboard

集群中任意一台服务器地址+端口号
　　https://192.168.222.100:32435

token生成

kubectl create namespace accounttest
kubectl create serviceaccount myaccount -n accounttest 
kubectl create clusterrolebinding myaccount --clusterrole=cluster-admin --serviceaccount=accounttest:myaccount

kubectl describe secrets -n accounttest $(kubectl -n accounttest get secret | awk '/myaccount/{print $1}')

kubectl config set-credentials myaccount --token=查到的token
kubectl config set-cluster mycluster --insecure-skip-tls-verify=true --server=集群地址
kubectl config set-context mycontext --cluster=mycluster --user=myaccount

kubectl config use-context mycontext
kubectl get pods -A