二进制方式部署k8s集群(超详细)

环境准备

主机名	IP	操作系统	硬件配置
k8s-master	192.168.0.150	CentOS7.3 3.10	cpu:2核 内存:4G 硬盘:30G
k8s-node01	192.168.0.151	CentOS7.3 3.10	cpu:2核 内存:4G 硬盘:30G
k8s-node02	192.168.0.152	CentOS7.3 3.10	cpu:2核 内存:4G 硬盘:30G

 操作系统环境准备(k8s-master,k8s-node01,k8s-node02)

         禁用Selinux

 sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

        禁用SWAP分区

 注释掉/etc/fstab中关于swap的内容

       确保三台服务器时间一致

 yum -y install ntpdate && ntpdate cn.ntp.org.cn

      修改内核参数

 cat > /etc/sysctl.d/k8s.conf << EOF

net.ipv4.ip_forward = 1

net.bridge.bridge-nf-call-ip6tables = 1

net.bridge.bridge-nf-call-iptables = 1

EOF

sysctl --system

 加载ipvs模块

 modprobe -- ip_vs

modprobe -- ip_vs_rr

modprobe -- ip_vs_wrr

modprobe -- ip_vs_sh

modprobe -- nf_conntrack_ipv4

lsmod | grep ip_vs

lsmod | grep nf_conntrack_ipv4

yum install -y ipvsadm

 确保三台服务器可以上外网

 修改/etc/hosts

 cat >>/etc/hosts <

192.168.0.150 k8s-master

192.168.0.151 k8s-node01

192.168.0.152 k8s-node02

EOF

 更新系统systemd工具包

 yum -y update systemd

 关闭并且禁用防火墙

 systemctl stop firewalld && systemctl disable  firewalld

 安装Docker

 #移除旧版本docker
 yum remove docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine
#安装docker repo源
 yum install -y yum-utils
 yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo
#安装docker
  yum install -y docker-ce
#启动docker并设置开机启动
 systemctl start docker && systemctl enable docker
#测试docker
 docker info
#配置镜像加速器
 cat>/etc/docker/daemon.json <<EOF
{
  "registry-mirrors": ["https://m81hcukn.mirror.aliyuncs.com"]
}
EOF
#更改Docker的Cgroup为systemd
cat /etc/docker/daemon.json
 {
 "exec-opts": ["native.cgroupdriver=systemd"]
 }
#重启docker
 systemctl restart docker

配置ssh进行免密登录(k8s-master)

 [root@k8s-master ~]# ssh-keygen -t rsa
[root@k8s-master ~]# ssh-copy-id root@192.168.1.107
[root@k8s-master ~]# ssh-copy-id root@192.168.1.108

 重启三台服务器

 reboot

 配置工作目录（k8s-master）

 #每台机器都需要配置证书文件、组件的配置文件、组件的服务启动文件，现专门选择 k8s-master 来统一生成这些文件，然后再分发到其他机器

mkdir -p /data/work

 部署etcd集群

配置etcd工作目录

 mkdir -p /etc/etcd    #配置文件存放目录
mkdir -p /etc/etcd/ssl   #证书文件存放目录

 创建etcd证书

 #上传证书制作工具
[root@k8s-master work]# ls /data/work/
cfssl  cfssl-certinfo  cfssljson
#工具配置
[root@k8s-master work]# chmod +x cfssl*
[root@k8s-master work]# mv * /usr/local/bin/
#配置ca请求文件
[root@k8s-master work]# vim ca-csr.json 
{
  "CN": "kubernetes",
  "key": {
      "algo": "rsa",
      "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Shanghai",
      "L": "Shanghai",
      "O": "k8s",
      "OU": "system"
    }
  ],
  "ca": {
          "expiry": "87600h"
  }
}
#创建ca证书
[root@k8s-master work]# cfssl gencert -initca ca-csr.json  | cfssljson -bare ca
#配置ca证书策略
[root@k8s-master work]# vim ca-config.json
{
  "signing": {
      "default": {
          "expiry": "87600h"
        },
      "profiles": {
          "kubernetes": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth",
                  "client auth"
              ],
              "expiry": "87600h"
          }
      }
  }
}
#配置etcd请求csr文件
[root@k8s-master work]# vim etcd-csr.json
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.1.104",
    "192.168.1.107",
    "192.168.1.108"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Shanghai",
    "L": "Shanghai",
    "O": "k8s",
    "OU": "system"
  }]
}
#生成证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson  -bare etcd

 下载etcd软件包

 #下载
[root@master1 work]# wget https://github.com/etcd-io/etcd/releases/download/v3.4.13/etcd-v3.4.13-linux-amd64.tar.gz
#解压
[root@master1 work]# tar -xf etcd-v3.4.13-linux-amd64.tar.gz 
#拷贝二进制文件
[root@master1 work]# cp -p etcd-v3.4.13-linux-amd64/etcd* /usr/local/bin/
#拷贝二进制到node01和node02
[root@master1 work]# scp etcd-v3.4.13-linux-amd64/etcd* 192.168.1.107:/usr/local/bin/
[root@master1 work]# scp etcd-v3.4.13-linux-amd64/etcd* 192.168.1.108:/usr/local/bin/

 创建配置文件

 

[root@k8s-master work]# vim etcd.conf
#[Member]
ETCD_NAME="etcd1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.1.104:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.1.104:2379,http://127.0.0.1:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.104:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.104:2379"
ETCD_INITIAL_CLUSTER="etcd1=https://192.168.1.104:2380,etcd2=https://192.168.1.107:2380,etcd3=https://192.168.1.108:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

注释:
ETCD_NAME：节点名称，集群中唯一
ETCD_DATA_DIR：数据目录
ETCD_LISTEN_PEER_URLS：集群通信监听地址
ETCD_LISTEN_CLIENT_URLS：客户端访问监听地址
ETCD_INITIAL_ADVERTISE_PEER_URLS：集群通告地址
ETCD_ADVERTISE_CLIENT_URLS：客户端通告地址
ETCD_INITIAL_CLUSTER：集群节点地址
ETCD_INITIAL_CLUSTER_TOKEN：集群Token
ETCD_INITIAL_CLUSTER_STATE：加入集群的当前状态，new是新集群，existing表示加入已有集群

创建启动服务文件

 

[root@k8s-master work]# vim etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
EnvironmentFile=-/etc/etcd/etcd.conf
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/local/bin/etcd \
  --cert-file=/etc/etcd/ssl/etcd.pem \
  --key-file=/etc/etcd/ssl/etcd-key.pem \
  --trusted-ca-file=/etc/etcd/ssl/ca.pem \
  --peer-cert-file=/etc/etcd/ssl/etcd.pem \
  --peer-key-file=/etc/etcd/ssl/etcd-key.pem \
  --peer-trusted-ca-file=/etc/etcd/ssl/ca.pem \
  --peer-client-cert-auth \
  --client-cert-auth
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target