Kubernetes学习指南：保姆级实操手册06——部署kubernetes集群
1、配置YUM源
### 在所有Master节点执行
# 配置yum源
cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum clean all
yum repolist 2、配置kubelet参数
cat > /etc/sysconfig/kubelet <<EOF
KUBELET_EXTRA_ARGS="--fail-swap-on=false"
EOF3、安装kubeadm、kubelet和kubectl
yum list kubeadm --showduplicates | sort -r
yum install -y kubelet-1.28.2-0 kubeadm-1.28.2-0 kubectl-1.28.2-04、检测kubectl工具版本
kubectl version --client --output=yaml5、配置kubeadm文件
kubeadm在初始化控制平面时会生成部署Kubernetes集群中各个组件所需的相关配置文件在/etc/kubernetes目录下
5.1、生成默认配置文件 （master01）
kubeadm config print init-defaults > kubeadm-init.yaml5.2、根据默认的配置格式进行参数修改（cri-docker配置文件）
[root@k8s-master01 ~]# cat kubeadm-init.yaml
apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 10.255.210.1 # 修改为k8s-master01节点的IP
bindPort: 6443
nodeRegistration:
criSocket: unix:///var/run/cri-dockerd.sock # 修改为cri-docker的路径
imagePullPolicy: IfNotPresent
name: k8s-master01 # 修改为master01的主机名
taints: null
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
local:
dataDir: /var/lib/etcd
controlPlaneEndpoint: "10.255.210.99:16443" # 添加apiserver的IP
imageRepository: registry.aliyuncs.com/google_containers #修改为aliyun的镜像地址
kind: ClusterConfiguration
kubernetesVersion: 1.28.2
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
podSubnet: 10.100.0.0/16 # 新增pod节点的网段
scheduler: {}
## 增加下面配置
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd5.3检查配置文件是否有错误
kubeadm init --config kubeadm-init.yaml --dry-run5.4、镜像报取
[root@k8s-master01 ~]# kubeadm config images pull --config=kubeadm-init.yaml
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-apiserver:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-controller-manager:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-scheduler:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-proxy:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/pause:3.9
[config/images] Pulled registry.aliyuncs.com/google_containers/etcd:3.5.9-0
[config/images] Pulled registry.aliyuncs.com/google_containers/coredns:v1.10.1
[root@k8s-master01 ~]# docker image ls # 显示下载的镜像
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.aliyuncs.com/google_containers/kube-apiserver v1.28.2 cdcab12b2dd1 11 months ago 126MB
registry.aliyuncs.com/google_containers/kube-proxy v1.28.2 c120fed2beb8 11 months ago 73.1MB
registry.aliyuncs.com/google_containers/kube-controller-manager v1.28.2 55f13c92defb 11 months ago 122MB
registry.aliyuncs.com/google_containers/kube-scheduler v1.28.2 7a5d9d67a13f 11 months ago 60.1MB
registry.aliyuncs.com/google_containers/etcd 3.5.9-0 73deb9a3f702 15 months ago 294MB
registry.aliyuncs.com/google_containers/coredns v1.10.1 ead0a4a53df8 18 months ago 53.6MB
registry.aliyuncs.com/google_containers/pause 3.9 e6f181688397 22 months ago 744kB
[root@k8s-master01 ~]#5.5、kubeadm命令为源码安装，需要配置一下kubelet服务
[root@k8s-master01 ~]# kubeadm init phase kubelet-start --config kubeadm-init.yaml
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet5.6、基于kubeadm配置文件 初始化集群
[root@k8s-master01 ~]# kubeadm init --config kubeadm-init.yaml --upload-certs
[init] Using Kubernetes version: v1.28.2
[preflight] Running pre-flight checks
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [k8s-master01 kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.255.210.1 10.255.210.99]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [k8s-master01 localhost] and IPs [10.255.210.1 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [k8s-master01 localhost] and IPs [10.255.210.1 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
W0816 11:23:43.760627 30431 endpoint.go:57] [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Writing "admin.conf" kubeconfig file
W0816 11:23:43.876266 30431 endpoint.go:57] [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Writing "kubelet.conf" kubeconfig file
W0816 11:23:44.056103 30431 endpoint.go:57] [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
W0816 11:23:44.145409 30431 endpoint.go:57] [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 14.528431 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
8efbfd6e5068798c6d4a01fe56b0446ec8a357ca03fc31862192942a01b14ee9
[mark-control-plane] Marking the node k8s-master01 as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node k8s-master01 as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: abcdef.0123456789abcdef
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
W0816 11:24:05.436284 30431 endpoint.go:57] [endpoint] WARNING: port specified in controlPlaneEndpoint overrides bindPort in the controlplane address
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
You can now join any number of the control-plane node running the following command on each as root:
kubeadm join 10.255.210.99:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:5388538b15cb69bcb09e575aa569e753f8d4ed3fe70199ac8669686b039f4d29 \
--control-plane --certificate-key 8efbfd6e5068798c6d4a01fe56b0446ec8a357ca03fc31862192942a01b14ee9
Please note that the certificate-key gives access to cluster sensitive data, keep it secret!
As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use
"kubeadm init phase upload-certs --upload-certs" to reload certs afterward.
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.255.210.99:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:5388538b15cb69bcb09e575aa569e753f8d4ed3fe70199ac8669686b039f4d295.7、配置 kubectl 命令行工具以便管理和使用 Kubernetes 集群
- 作为普通用户：你需要将
admin.conf文件复制到你自己的.kube目录，并确保你有权访问和使用它。这允许你以非root用户身份管理集群。 - 作为
root用户：你可以直接设置KUBECONFIG环境变量来指向admin.conf，从而使用该文件来管理集群，而不需要复制文件。
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf6、添加master控制平台节点到集群
kubeadm join 10.255.210.99:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:5388538b15cb69bcb09e575aa569e753f8d4ed3fe70199ac8669686b039f4d29 \
--control-plane --certificate-key 194d3f66187040195a509af9f350f914d62c23cab12e4724147b885115c0414a\
--cri-socket unix:///var/run/cri-dockerd.sock7、将work节点添加到集群
yum install -y kubelet-1.28.2-0 kubeadm-1.28.2-0
kubeadm join 10.255.210.99:16443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:5388538b15cb69bcb09e575aa569e753f8d4ed3fe70199ac8669686b039f4d29 \
--cri-socket unix:///var/run/cri-dockerd.sock8、查看kubeadm-config的configmap信息
# kubectl -n kube-system get cm kubeadm-config -o yaml
apiVersion: v1
data:
ClusterConfiguration: |
apiServer:
extraArgs:
authorization-mode: Node,RBAC
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controlPlaneEndpoint: 10.255.210.99:16443
controllerManager: {}
dns: {}
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.28.2
networking:
dnsDomain: cluster.local
podSubnet: 10.200.0.0/16
serviceSubnet: 10.96.0.0/12
scheduler: {}
kind: ConfigMap
metadata:
creationTimestamp: "2024-08-16T03:23:58Z"
name: kubeadm-config
namespace: kube-system
resourceVersion: "236"
uid: 3402d8fe-8c2b-45f4-a701-2b18db32f5a89、查看集群状态
9.1、查看node资源
[root@k8s-master01 ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master01 NotReady control-plane 3h37m v1.28.2
k8s-master02 NotReady control-plane 3h4m v1.28.2
k8s-master03 NotReady control-plane 22m v1.28.2
k8s-node01 NotReady <none> 9m49s v1.28.2
k8s-node02 NotReady <none> 9m31s v1.28.2
k8s-node03 NotReady <none> 9m22s v1.28.29.2、查看pod资源
[root@k8s-master01 ~]# kubectl get all -A
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system pod/coredns-66f779496c-9ttn2 0/1 Pending 0 3h39m
kube-system pod/coredns-66f779496c-zq8k5 0/1 Pending 0 3h39m
kube-system pod/etcd-k8s-master01 1/1 Running 0 3h39m
kube-system pod/etcd-k8s-master02 1/1 Running 0 3h6m
kube-system pod/etcd-k8s-master03 1/1 Running 0 24m
kube-system pod/kube-apiserver-k8s-master01 1/1 Running 0 3h39m
kube-system pod/kube-apiserver-k8s-master02 1/1 Running 0 3h6m
kube-system pod/kube-apiserver-k8s-master03 1/1 Running 0 24m
kube-system pod/kube-controller-manager-k8s-master01 1/1 Running 1 (3h6m ago) 3h39m
kube-system pod/kube-controller-manager-k8s-master02 1/1 Running 0 3h6m
kube-system pod/kube-controller-manager-k8s-master03 1/1 Running 0 24m
kube-system pod/kube-proxy-cm5dq 1/1 Running 0 3h39m
kube-system pod/kube-proxy-hd72m 1/1 Running 0 3h6m
kube-system pod/kube-proxy-lp5ds 1/1 Running 0 11m
kube-system pod/kube-proxy-nddj7 1/1 Running 0 24m
kube-system pod/kube-proxy-v68jh 1/1 Running 0 11m
kube-system pod/kube-proxy-zdz2s 1/1 Running 0 11m
kube-system pod/kube-scheduler-k8s-master01 1/1 Running 1 (3h6m ago) 3h39m
kube-system pod/kube-scheduler-k8s-master02 1/1 Running 0 3h6m
kube-system pod/kube-scheduler-k8s-master03 1/1 Running 0 24m
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
default service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 3h39m
kube-system service/kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 3h39m
NAMESPACE NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
kube-system daemonset.apps/kube-proxy 6 6 6 6 6 kubernetes.io/os=linux 3h39m
NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE
kube-system deployment.apps/coredns 0/2 2 0 3h39m
NAMESPACE NAME DESIRED CURRENT READY AGE
kube-system replicaset.apps/coredns-66f779496c 2 2 0 3h39m9.3、查看k8s证书有效期
[root@k8s-master01 ~]# kubeadm certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Aug 16, 2025 03:23 UTC 364d ca no
apiserver Aug 16, 2025 03:23 UTC 364d ca no
apiserver-etcd-client Aug 16, 2025 03:23 UTC 364d etcd-ca no
apiserver-kubelet-client Aug 16, 2025 03:23 UTC 364d ca no
controller-manager.conf Aug 16, 2025 03:23 UTC 364d ca no
etcd-healthcheck-client Aug 16, 2025 03:23 UTC 364d etcd-ca no
etcd-peer Aug 16, 2025 03:23 UTC 364d etcd-ca no
etcd-server Aug 16, 2025 03:23 UTC 364d etcd-ca no
front-proxy-client Aug 16, 2025 03:23 UTC 364d front-proxy-ca no
scheduler.conf Aug 16, 2025 03:23 UTC 364d ca no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Aug 14, 2034 03:23 UTC 9y no
etcd-ca Aug 14, 2034 03:23 UTC 9y no
front-proxy-ca Aug 14, 2034 03:23 UTC 9y no9.4、查看token资源
kubeadm token list10、命令自动补全
yum –y install bash-completion
kubectl completion bash > ~/.kube/completion.bash.inc
echo "source '$HOME/.kube/completion.bash.inc'" >> $HOME/.bash_profile
source $HOME/.bash_profile
224
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
