kubeadm-install-kubernetes-1.14

---yum repo
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
baseurl=http://mirrors.aliyun.com/docker-ce/linux/centos/7/x86_64/stable/
baseurl=http://mirrors.aliyun.com/epel/7/x86_64
baseurl=http://mirrors.aliyun.com/centos/7/extras/x86_64/

#1. 配置系统相关参数
cat <<EOF> /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
vm.swappiness=0
EOF
sysctl -p /etc/sysctl.d/k8s.conf

cat <<EOF> /etc/modules-load.d/k8s.conf
br_netfilter
ip_vs
ip_vs_sh
ip_vs_rr
ip_vs_wrr
EOF
/usr/lib/systemd/systemd-modules-load

swapoff -a
sed -i '/ swap / s/^/#/' /etc/fstab

#2. 增加k8s repo
yum-config-manager --add-repo http://10.245.254.93/linux/soft/epel/7
echo "gpgcheck=0" >> /etc/yum.repos.d/10.245.254.93_linux_soft_epel_7.repo

#3. 安装kubeadm & docker
#yum -y install docker-ce kubeadm kubelet kubectl
yum -y install docker-ce-18.06.3.ce-3.el7 kubeadm-1.14.3 kubelet-1.14.3 kubectl-1.14.3

systemctl enable docker kubelet
sed -i "17a\ExecStartPost=/usr/sbin/iptables -P FORWARD ACCEPT" /usr/lib/systemd/system/docker.service

#https://kubernetes.io/docs/setup/cri
mkdir /etc/docker /etc/systemd/system/docker.service.d
cat <<EOF> /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}
EOF

systemctl daemon-reload
systemctl restart docker

#4. 下载registry 访问证书
wget -P /etc/docker/certs.d/ispcdocker.com http://10.245.254.93/linux/soft/docker/ispcdocker.com.crt
echo '10.247.15.90 ispcdocker.com' >> /etc/hosts
echo '10.247.15.75 node01' >> /etc/hosts
echo '10.247.15.89 node02' >> /etc/hosts
echo '10.247.15.92 node03' >> /etc/hosts

#5. ----for Master site install
kubeadm init \
  --kubernetes-version=v1.14.3 \
  --apiserver-advertise-address=10.247.15.75 \
  --pod-network-cidr=10.244.0.0/16 \
  --service-cidr=192.168.0.0/16 \
  --image-repository=ispcdocker.com/k8s

  
# https://github.com/coreos/flannel
# https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
curl http://10.245.254.93/linux/soft/docker/kubernetes/kube-flannel-v0.11.0.yml > /tmp/flannel.yaml
sed -i '212,$d' /tmp/flannel.yaml
sed -i "s#quay.io/coreos#ispcdocker.com/k8s#g" /tmp/flannel.yaml
kubectl --kubeconfig=/etc/kubernetes/admin.conf apply -f /tmp/flannel.yaml

mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config  
kubectl get nodes
kubectl get cs

kubectl get pods --all-namespaces -o wide       # 查看dashboard被k8s分配到了哪一台机器上
kubectl get services --all-namespaces             # 查看dashboard的集群内部IP
kubectl get services -n kube-system
kubectl -n kube-system get all
kubectl -n kube-system top pods

#6. ----for Minion site
# kubeadm token create --print-join-command | sed 's/${LOCAL_IP}/${VIP}/g'
kubeadm join 10.247.15.75:6443 --token 662w0d.roh2btd0g6cbxc5y \
    --discovery-token-ca-cert-hash sha256:b700f04ead542060189e02581f5463d50b4f003c78a8c118d6e6a14884e09d83
    
    
#7. ----for Dashboard
# https://github.com/kubernetes/dashboard
# https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config/influxdb

# https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
# https://docs.giantswarm.io/guides/install-kubernetes-dashboard/
# https://stackoverflow.com/questions/46664104/how-to-sign-in-kubernetes-dashboard
# https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard---1.7.X-and-above
# https://github.com/kubernetes/dashboard/wiki/Certificate-management
# https://sunwfrk.com/k8s-dashboard-installation/
# https://docs.aws.amazon.com/eks/latest/userguide/dashboard-tutorial.html
# https://github.com/kubernetes-retired/heapster

# https://github.com/kubernetes-incubator/metrics-server
# docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-server-amd64:v0.3.3

# 7.1 install metrics-server
# https://blog.codewithdan.com/enabling-metrics-server-for-kubernetes-on-docker-desktop/
# https://blog.csdn.net/oyym_mv/article/details/87166639
  https://blog.csdn.net/zyl290760647/article/details/83041991
wget http://10.245.254.93/linux/soft/docker/kubernetes/metrics/metrics-server-0.3.3.tar.gz
tar zxpf metrics-server-0.3.3.tar.gz
cd metrics-server-0.3.3

sed -i '32,$d' deploy/1.8+/metrics-server-deployment.yaml
cat <<EOF>> deploy/1.8+/metrics-server-deployment.yaml
        image: ispcdocker.com/dashboard/metrics-server-amd64:v0.3.3
        imagePullPolicy: IfNotPresent 
        command:
        - /metrics-server
        - --metric-resolution=30s
        - --kubelet-insecure-tls
        - --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP
        volumeMounts:
        - name: tmp-dir
          mountPath: /tmp
EOF

kubectl create -f deploy/1.8+/
cd
kubectl -n kube-system get deployment metrics-server
kubectl -n kube-system get pods
kubectl -n kube-system top pods   # This command need wait after 30 secend for system conllect performence dadta, else will give some error !

#7.2 dashboard v1.10.1
wget http://10.245.254.93/linux/soft/docker/kubernetes/heapster/v110/kubernetes-dashboard-1.10.1.yaml -O /root/kubernetes-dashboard.yaml
sed -i "s|k8s.gcr.io|ispcdocker.com/dashboard|g" /root/kubernetes-dashboard.yaml
sed -i "s|Opaque|NodePort|g" /root/kubernetes-dashboard.yaml
# Define Use fixed ports instead of dynamic ports
sed -i "160a \ \ \ \ \ \ nodePort: 30521" /root/kubernetes-dashboard.yaml
sed -i "161a \ \ type:\ NodePort" /root/kubernetes-dashboard.yaml

#7.3 --- https://github.com/kubernetes/dashboard/wiki/Certificate-management
openssl req -x509 -nodes -newkey rsa:2048 -sha256 -days 999 \
    -keyout dashboard.key \
    -out dashboard.crt \
    -subj "/C=CN/ST=docker/L=wuhan/O=ispc/OU=New site/CN=ispcdocker.com/emailAddress=macj@ispcdocker.com"
mkdir /root/certs && mv dashboard.* /root/certs

#7.4 --- https://github.com/kubernetes/dashboard/wiki/Installation#recommended-setup
kubectl create secret generic kubernetes-dashboard-certs --type=NodePort --from-file=$HOME/certs -n kube-system
sed -i 15,26d /root/kubernetes-dashboard.yaml
kubectl create -f /root/kubernetes-dashboard.yaml

#7.5. change confg , and check dashboard web port
kubectl -n kube-system get service kubernetes-dashboard
NAME                   TYPE       CLUSTER-IP        EXTERNAL-IP   PORT(S)         AGE
kubernetes-dashboard   NodePort   192.168.176.140   <none>        443:30521/TCP   32s

#7.6 If you don't want to grant admin permission to dashboard service account, you can create cluster admin service account.
# https://stackoverflow.com/questions/46664104/how-to-sign-in-kubernetes-dashboard

# Create service account
kubectl create serviceaccount dashboard-sa-u1

# Bind ClusterAdmin role to the service account
kubectl create clusterrolebinding dashboard-sa-u1 \
  --clusterrole=cluster-admin \
  --serviceaccount=default:dashboard-sa-u1
  
# And then, you can use the token of just created cluster admin service account.
kubectl describe secret $(
  kubectl get secret | awk '/^dashboard-sa-u1-token-/{print $1}'
  ) | awk '$1=="token:"{print $2}'

#7.7 web login
https://10.247.15.75:30521/#!/login

转载于:https://my.oschina.net/u/3362827/blog/3064585