Kubernetes部署流程（学习版）

第一步 ：准备环境

#配置网卡

vi /etc/sysconfig/network-scripts/
---------------------------------->
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.1.251
NETMASK=255.255.252.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8

#重启网卡

service network restart
vi /etc/selinux/config
SELINUX=disabled
setenforce 0   /生效关闭selinux
systemctl stop firewalld // 关闭防火墙
iptables -vnL // 查看状态
#其他虚拟机重复以上m

#修改主机名

vi /etc/hostname //修改主机name
hostname k8s-master // 修改生效
hostname k8s-node01 // 修改生效
hostname k8s-node02 // 修改生效

exit //退出

第二步 ：自签Etcd SSL证书 及部署集群

mkdir k8s
mkdir k8s/k8s-cert -p
mkdir k8s/etcd-cert -p

yum install -y wget //下载安装wget

//CFSSL工具的安装
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo
ls /usr/local/bin/cfssl*

ntpdate time.windows.com //更新系统时间

生成ca文件
cat > ca-config.json <<EOF
{
“signing”: {
“default”: {
“expiry”: “87600h”
},
“profiles”: {
“www”: {
“expiry”: “87600h”,
“usages”: [
“signing”,
“key encipherment”,
“server auth”,
“client auth”
]
}
}
}
}
EOF

cat > ca-csr.json <<EOF
{
“CN”: “etcd CA”,
“key”: {
“algo”: “rsa”,
“size”: 2048
},
“names”: [
{
“C”: “CN”,
“L”: “Beijing”,
“ST”: “Beijing”
}
]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

cat > server-csr.json <<EOF
{
“CN”: “etcd”,
“hosts”: [
“192.168.1.251”,
“192.168.1.253”,
“192.168.1.254”
],
“key”: {
“algo”: “rsa”,
“size”: 2048
},
“names”: [
{
“C”: “CN”,
“L”: “BeiJing”,
“ST”: “BeiJing”
}
]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

mkdir soft

mkdir /opt/etcd/{cfg,bin,ssl} -p

下载、解压 etcd-v3.3.10-linux-amd64.tar.gz
tar zxvf etcd-v3.3.10-linux-amd64.tar.gz
mv etcd etcdctl /opt/etcd/bin/
ls /opt/etcd/bin/

// 上传etcd.sh /root/k8s/
chmod +x etcd.sh

cat etcd.sh
./etcd.sh etcd01 192.168.1.251 etcd02=https://192.168.1.253:2380,etcd03=https://192.168.1.254:2380

cp /root/k8s/etcd-cert/{ca,server-key,server}.pem /opt/etcd/ssl/
ls /opt/etcd/ssl/

systemctl start etcd
tail /var/log/messages -f \or\ journalctl -f -u etcd.service

scp -r /opt/etcd/ root@192.168.1.253:/opt/
scp -r /usr/lib/systemd/system/etcd.service root@192.168.1.253:/usr/lib/systemd/system
// 修改对应node节点
vi /opt/etcd/cfg/etcd

systemctl daemon-reload
systemctl start etcd
tail /var/log/messages -f

// 检验Etcd集群状态
/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints=“https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379” cluster-health

// 访问地址 --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints=“https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379”

第三步 Node安装Docker
// 安装系统工具
yum install -y yum-utils device-mapper-persistent-data lvm2
// 配置官方源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
// 更新并安装Docker-CE
yum makecache fast
yum -y install docker-ce
// 引用docker 加速
curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io

//开启Docker服务
service docker start (start, stop, restart, try-restart, reload, force-reload, status)

// 其他节点安装docker复制第三步

第四步 部署kubernetes网络 -Flannel（没有其他需要只安装在Node节点）

//写入分配的子网段到etcd,供flannels使用
/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints=“https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379” set /coreos.com/network/config ‘{ “Network”: “172.17.0.0/16”, “Backend”: {“Type”: “vxlan”}}’

//导入flannel.sh文件
chmod +x flannel.sh
mkdir /opt/kubernetes/{bin,cfg,ssl} -p
./flannel.sh https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379

//导入flannel安装包并解压
tar zxvf flannel-v0.10.0-linux-amd64.tar.gz
mv flanneld mk-docker-opts.sh /opt/kubernetes/bin/
systemctl start flanneld
ps -ef |grep flanneld // 查看flanneld是否启动
ps -ef |grep docker // 查看docker是否引用flannel分配的IP

vi /usr/lib/systemd/system/docker.service //
cat /run/flannel/subnet.env //

systemctl restart docker 重启docker
ps -ef |grep docker //已经引用flannel分配的IP

//将当前节点flannel 的配置文件copy到其他节点上
scp -r /opt/kubernetes/ root@192.168.1.254:/opt/
scp -r /usr/lib/systemd/system/{flanneld,docker}.service root@192.168.1.254:/usr/lib/systemd/system/

// 验证flannels是否部署成功
/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints=“https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379” ls /coreos.com/network/subnets

/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints=“https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379” get /coreos.com/network/subnets/172.17.60.0-24 {“PublicIP”:“192.168.1.248”,“BackendType”:“vxlan”,“BackendData”:{“VtepMAC”:“16:d9:18:a2:92:49”}}

第五步 部署master组件（部署到master节点）
//上传master.zip文件
yum install unzip -y
unzip master.zip

//上传kubernetes安装包
tar zxvf kubernetes-server-linux-amd64.tar.gz

mkdir -p /opt/kubernetes/{bin,cfg,ssl}

cp kube-apiserver kube-controller-manager kube-scheduler /opt/kubernetes/bin/

chmod +x apiserver.sh
./apiserver.sh 192.168.1.251 https://192.168.1.251:2379,https://192.168.1.253:2379,https://192.168.1.254:2379
vi /opt/kubernetes/cfg/kube-apiserver

KUBE_APISERVER_OPTS="–logtostderr=false \ //修改日志存储
–log-dir=/opt/kubernetes/logs \ // 添加日志存储目录
mkdir /opt/kubernetes/logs
/opt/kubernetes/bin/kube-apiserver --help | grep logs

//上传k8s-cert.sh文件
vi k8s-cert.sh // 添加k8s所有的ip地址
bash k8s-cert.sh //生成相关配置文件
cp ca.pem ca-key.pem server.pem server-key.pem /opt/kubernetes/ssl/

// 上传kubuconfig.sh
chmod +x kubeconfig.sh

//执行下面命令
BOOTSTRAP_TOKEN=0fb61c46f8991b718eb38d27b605b008
cat > token.csv <<EOF
${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,“system:kubelet-bootstrap”
EOF

cat token.csv //查看文件是否生成
mv token.csv /opt/kubernetes/cfg/
systemctl restart kube-apiserver
ps -ef |grep kube-apiserver

netstat -antp |grep 8080 // 查看监听状态

#---------------------- //日志排错
vi /opt/kubernetes/logs/kube-apiserver.INFO
source /opt/kubernetes/cfg/kube-apiserver
/opt/kubernetes/bin/kube-apiserver $KUBE_APISERVER_OPTS
#----------------------

chmod +x controller-manager.sh
cat controller-manager.sh
./controller-manager.sh 127.0.0.1
./scheduler.sh 127.0.0.1

cp /root/soft/kubernetes/server/bin/kubectl /usr/bin/

kubectl get cs //查看当前etcd节点的状态 和(controller-manager, scheduler)

kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

// 上传kubeconfig.sh文件

vi kubeconfig.sh //删除以下
#----------------------

创建 TLS Bootstrapping Token

#BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ’ ')
cat > token.csv <<EOF
${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,“system:kubelet-bootstrap”
EOF
#----------------------

vi kubeconfig.sh //添加以下
#----------------------
BOOTSTRAP_TOKEN=0fb61c46f8991b718eb38d27b605b008
#----------------------

bash kubeconfig.sh 192.168.1.251 /root/k8s/k8s-cert

scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.1.254:/opt/kubernetes/cfg/

cd /root/soft/kubernetes/server/bin/
scp kubelet kube-proxy root@192.168.1.253:/opt/kubernetes/bin/
scp kubelet kube-proxy root@192.168.1.254:/opt/kubernetes/bin/

第六步 部署node组件 kubelet
上传node.zip文件
unzip node.zip

bash kubelet.sh 192.168.1.253

vi /opt/kubernetes/cfg/kubelet // 修改文件日志路径

KUBELET_OPTS="–logtostderr=false
–log-dir=/opt/kubernetes/logs \

mkdir /opt/kubernetes/logs

systemctl restart kubelet

journalctl -u kubelet // 查看日志

第七步 部署node组件 kube-proxy

bash proxy.sh 192.168.1.253
ps -ef | grep proxy

// copy到其他node节点上
scp -r /opt/kubernetes/ root@192.168.1.254:/opt/
scp -r /usr/lib/systemd/system/{kubelet,kube-proxy}.service root@192.168.1.254:/usr/lib/systemd/system/

// cd /opt/kubernetes/cfg 修改对应的ip节点
vi kubelet
vi kubelet.config
vi kube-proxy

cd /opt/kubernetes/ssl/ //删除上一个节点颁发的证书
rm -f *

kubectl get csr //获取请求签名(master节点执行命令)
kubectl certificate approve +请求签名 允许加入集群
// 如：kubectl certificate approve node-csr-WxFdb6gcM_uA7ySEtQ8bn16X04XBuKVoLz8L7Tlu4CM

kubectl get node //查看节点

第八步 部署管理页面

下载并修改Dashboard安装脚本
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta5/aio/deploy/recommended.yaml
修改recommended.yaml文件内容：

#增加直接访问端口
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
type: NodePort #增加
ports:
- port: 443
targetPort: 8443
nodePort: 30008 #增加
selector:
k8s-app: kubernetes-dashboard

##因为自动生成的证书很多浏览器无法使用，
##所以我们自己创建，注释掉kubernetes-dashboard-certs对象声明
#—
#apiVersion: v1
#kind: Secret
#metadata:

labels:

k8s-app: kubernetes-dashboard

name: kubernetes-dashboard-certs

namespace: kubernetes-dashboard

#type: Opaque

---

…
创建证书
mkdir dashboard-certs

cd dashboard-certs/

创建key文件

openssl genrsa -out dashboard.key 2048

#证书请求
openssl req -days 36000 -new -out dashboard.csr -key dashboard.key -subj ‘/CN=dashboard-cert’

#自签证书
openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt

#创建kubernetes-dashboard-certs对象
kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard

安装Dashboard

#安装
kubectl create -f ~/recommended.yaml

#创建命名空间
kubectl create namespace kubernetes-dashboard

#检查结果
[root@k8s-master ~]# kubectl get service -n kubernetes-dashboard -o wide

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
dashboard-metrics-scraper ClusterIP 10.96.113.127 8000/TCP 16s k8s-app=dashboard-metrics-scraper
kubernetes-dashboard NodePort 10.96.203.158 443:30008/TCP 16s k8s-app=kubernetes-dashboard

新建一个yaml文件：
#创建账号：
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: dashboard-admin
namespace: kubernetes-dashboard

---

#为用户分配权限：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-admin-bind-cluster-role
labels:
k8s-app: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:

• kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

保存退出后执行
kubectl create -f dashboard-admin.yaml // 查看并复制用户Token

登录Dashboard
访问：https://192.168.174.137:30008，选择Token登录，复制刚才生成的密钥。
注意，IP为任意node节点的对外的IP.

第九步 Kubernetes Dashboard 设置用户密码登陆