Kubernetes安装
服务器资源准备
1、三台虚拟机、组建最小集群、一台作为master、两台作为worker
第一步 虚拟机准备
1、修改host文件
cat <<EOF>> /etc/hosts
192.168.23.3 k8s-master
192.168.23.4 k8s-worker-1
192.168.23.5 k8s-worker-2
199.232.68.133 raw.githubusercontent.com
EOF
2、升级内核版本
导入key
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
安装yum源,使用elrepo源
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
安装内核
yum --enablerepo=elrepo-kernel install kernel-ml-devel kernel-ml -y
更改内核默认启动顺序
grub2-set-default 0
重启
reboot
查看
3、更新安装ipvsadm
yum install ipvsadm ipset svsstat conntrack libseccomp -y
uname -r
第二步 关闭并禁用防火墙以及swap交换分区
systemctl stop firewalld
systemctl disable firewalld
setenforce 0
sed -i 's/SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
swapoff -a
sed -i.bak '/swap/s/^/#/' /etc/fstab
第三步 设置master免密登录到其他节点
ssh-keygen -t rsa -P ""
ssh-copy-id -i /root/.ssh/id_rsa.pub root@k8s-worker-1
ssh-copy-id -i /root/.ssh/id_rsa.pub root@k8s-worker-2
第四步 安装docker
1、安装yum工具
yum install -y yum-utils
2、设置docker源
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
3、安装docker ce
yum list docker-ce --showduplicates | sort -r
yum install -y docker-ce-19.03.9 docker-ce-cli-19.03.9 containerd.io
4、修改docker的Cgroup Driver为systemd
vi /etc/docker/daemon.json
{
"exec-opts":["native.cgroupdriver=systemd"]
}
4、启动docker
systemctl daemon-reload
systemctl start docker
systemctl enable docker
docker --version
docker run hello-world
k8s-Master安装,在master机器上执行
1、修改内核参数,将每台服务器都设置将桥接的ipv4流量传递到iptables的链
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1
EOF
sysctl -p /etc/sysctl.d/k8s.conf
2、设置kubernetes源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enable=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum clean all
yum -y makecache
3、安装k8s版本1.17,启动kubelet并设置开机启动
yum list kubelet --showduplicates | sort -r
yum list kubelet --showduplicates | sort -r | grep 1.17.4
yum install -y kubelet-1.17.4 kubeadm-1.17.4 kubectl-1.17.4 --setopt=obsoletes=0
systemctl enable kubelet && systemctl start kubelet
4、编辑镜像的下载脚本,用脚本下载k8s所需的镜像
vim image.sh
#!/bin/bash
url=registry.cn-hangzhou.aliyuncs.com/google_containers
version=v1.17.4
images=(`kubeadm config images list --kubernetes-version=$version | awk -F '/' '{print $2}'`)
for imagename in ${images[@]}; do
docker pull $url/$imagename
docker tag $url/$imagename k8s.gcr.io/$imagename
done
# 删除原始镜像
imagesName=`docker images | awk '{print $1}'`
for iname in $imagesName
do
if [[ "${iname}" =~ "${url}" ]]; then
# 查询tag
tag_name=`docker images -f reference="${iname}" | awk '{print $2}'`
# 将string转化为数组
array=(${tag_name// / })
docker rmi -f ${iname}:${array[1]}
fi
done
chmod u+x image.sh
./image.sh
单独执行
docker pull quay.io/coreos/flannel:v0.14.0
docker images
Master配置
1、初始化Master
ip address | grep 24
# 解释:apiserver-adverties-address为主机地址 pod-network-cidr该参数指明了 Pod 网络的 CIDR
# 初始化集群 --pod-network-cidr=10.244.0.0/16 //使用flannel网络组件时必须添加
kubeadm init \
--apiserver-advertise-address=192.168.23.3 \
--image-repository=registry.aliyuncs.com/google_containers \
--kubernetes-version=v1.17.4 \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16
2、加载环境变量
echo "export KUBECONFIG=/etc/kubernetes"/admin.conf >> ~/.bash_profile
source ~/.bash_profile
#安装pod网络,raw.githubusercontent.com的ip地址已经添加到/etc/hosts文件
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
4、查看令牌
kubeadm token list
#生成新的令牌
kubeadm token create
#生成新的加密串
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
Worker节点安装
安装docker
1、安装yum工具
yum install -y yum-utils
2、设置docker源
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
3、安装docker ce
yum list docker-ce --showduplicates | sort -r
yum install -y docker-ce-19.03.9 docker-ce-cli-19.03.9 containerd.io
4、修改docker的Cgroup Driver为systemd
cat /etc/docker/daemon.json
{
"exec-opts":["native.cgroupdriver=systemd"]
}
4、启动docker
systemctl daemon-reload
systemctl start docker
systemctl enable docker
docker --version
docker run hello-world
安装k8s
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enable=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum clean all
yum -y makecache
3、安装k8s版本1.17,启动kubelet并设置开机启动
yum list kubelet --showduplicates | sort -r
yum list kubelet --showduplicates | sort -r | grep 1.17.4
yum install -y kubelet-1.17.4 kubeadm-1.17.4 kubectl-1.17.4 --setopt=obsoletes=0
systemctl enable kubelet && systemctl start kubelet
4、编辑镜像的下载脚本,用脚本下载k8s所需的镜像
vim image.sh
#!/bin/bash
url=registry.cn-hangzhou.aliyuncs.com/google_containers
version=v1.17.4
images=(`kubeadm config images list --kubernetes-version=$version | awk -F '/' '{print $2}'`)
for imagename in ${images[@]}; do
docker pull $url/$imagename
docker tag $url/$imagename k8s.gcr.io/$imagename
done
# 删除原始镜像
imagesName=`docker images | awk '{print $1}'`
for iname in $imagesName
do
if [[ "${iname}" =~ "${url}" ]]; then
# 查询tag
tag_name=`docker images -f reference="${iname}" | awk '{print $2}'`
# 将string转化为数组
array=(${tag_name// / })
docker rmi -f ${iname}:${array[1]}
fi
done
chmod u+x image.sh
./image.sh
docker images
Worker节点加入集群
1、worker运行
kubeadm join 192.168.23.3:6443 --token (来自master运行 kubeadm token create得到的令牌) --discovery-token-ca-cert-hash (来自于master节点运行的openssl得到的令牌加密字符串)
示例:
kubeadm join 192.168.23.3:6443 --token inrh4n.xze6qpozbkpnjrvp --discovery-token-cert-hash sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Master节点验证Worker节点状态
kubectl label node k8s-worker-1 node-role.kubernetes.io/worker=worker
kubectl label node k8s-worker-2 node-role.kubernetes.io/worker=worker
kubeadm get node
Dashboard安装,在主节点上运行
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc7/aio/deploy/recommended.yaml
kubectl get pods -n kubernetes-dashboard
kubectl get svc -n kubernetes-dashboard
kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard
kubectl get svc -n kubernetes-dashboard
集群中任意一台服务器地址+端口号
https://192.168.222.100:32435
token生成
kubectl create namespace accounttest
kubectl create serviceaccount myaccount -n accounttest
kubectl create clusterrolebinding myaccount --clusterrole=cluster-admin --serviceaccount=accounttest:myaccount
kubectl describe secrets -n accounttest $(kubectl -n accounttest get secret | awk '/myaccount/{print $1}')
kubectl config set-credentials myaccount --token=查到的token
kubectl config set-cluster mycluster --insecure-skip-tls-verify=true --server=集群地址
kubectl config set-context mycontext --cluster=mycluster --user=myaccount
kubectl config use-context mycontext
kubectl get pods -A