参考:https://developer.aliyun.com/article/748412
https://my.oschina.net/u/4197945/blog/3134071
https://blog.csdn.net/qq_26897321/article/details/124127198
一、安装docker
1.基础包
yum install -y yum-utils device-mapper-persistent-data lvm2
2.设置仓库
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
3.安装Docker Engine - Community --此命令会安装最新版本(latest)
yum install docker-ce docker-ce-cli containerd.io
4.启动docker
sudo systemctl start docker
systemctl enable docker.service
5.使用docker 加速,到/etc/docker/ 目录下,增加daemon.json 文件
cd /etc/docker/
编辑文件 /etc/docker/daemon.json
{
"registry-mirrors" : ["https://mj9kvemk.mirror.aliyuncs.com"],
"exec-opts":["native.cgroupdriver=systemd"]
}
6.重启Docker
systemctl daemon-reload
systemctl restart docker
二、环境配置
#查看 hostname
hostnamectl
#设置每个机器自己的hostname (可以不设置)
hostnamectl set-hostname xxx
# 将 SELinux 设置为 permissive 模式(相当于将其禁用)
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
# 关闭交换分区
swapoff -a
sed -ri 's/.*swap.*/#&/' /etc/fstab
#允许 iptables 检查桥接流量
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
# 从所有系统配置文件中加载参数
sysctl --system
关闭防火墙
systemctl stop firewalld.service
systemctl disable firewalld.service
配置系统基本安装源(注意centos8阿里云的镜像已经没有了,需要使用下面的)
由于centos-8 镜像已经移除了,换成这个
curl -o /etc/yum.repos.d/CentOS-Base.repo curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo
现在这个源有点问题,切换成这个
curl -O http://mirrors.aliyun.com/repo/Centos-7.repo
yum clean all
yum makecache
添加K8s安装源
新增文件 /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
三、正式安装 kubectl、kubelet、kubeadm
1.安装kubectl、kubelet、kubeadm
一定要指定版本,我这里使用1.23.1 ,之前使用1.24.2后面的镜像一直装不上,折腾好久
yum install -y kubelet-1.23.1 kubeadm-1.23.1 kubectl-1.23.1
systemctl enable kubelet
systemctl start kubelet
2.查看版本
kubeadm version
kubectl version --client
kubelet --version
3. 初始化kubernetes集群
由于国内网络原因,kubeadm init会卡住不动,所以先设置国内镜像
kubeadm config images pull --image-repository=registry.aliyuncs.com/google_containers
kubeadm init
或
# 10.206.0.13 是本机的ip,其他不用修改
kubeadm init \
--apiserver-advertise-address=10.206.0.13 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.23.1 \
--service-cidr=10.96.0.0/12 \
--pod-network-cidr=10.244.0.0/16
初始化出错解决:
[init] Using Kubernetes version: v1.24.2
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml]: /etc/kubernetes/manifests/kube-apiserver.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml]: /etc/kubernetes/manifests/kube-controller-manager.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml]: /etc/kubernetes/manifests/kube-scheduler.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-etcd.yaml]: /etc/kubernetes/manifests/etcd.yaml already exists
[ERROR CRI]: container runtime is not running: output: E0623 15:54:44.777054 1088530 remote_runtime.go:925] "Status from runtime service failed" err="rpc error: code = Unimplemented desc = unknown service runtime.v1alpha2.RuntimeService"
time="2022-06-23T15:54:44+08:00" level=fatal msg="getting status of runtime: rpc error: code = Unimplemented desc = unknown service runtime.v1alpha2.RuntimeService"
, error: exit status 1
[ERROR FileContent--proc-sys-net-ipv4-ip_forward]: /proc/sys/net/ipv4/ip_forward contents are not set to 1
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
这里提示服务未启动,运行下面命令
systemctl enable kubelet.service
再继续执行初始化命令:kubeadm init
[init] Using Kubernetes version: v1.24.2
[preflight] Running pre-flight checks
[WARNING FileExisting-tc]: tc not found in system path
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml]: /etc/kubernetes/manifests/kube-apiserver.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml]: /etc/kubernetes/manifests/kube-controller-manager.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml]: /etc/kubernetes/manifests/kube-scheduler.yaml already exists
[ERROR FileAvailable--etc-kubernetes-manifests-etcd.yaml]: /etc/kubernetes/manifests/etcd.yaml already exists
[ERROR CRI]: container runtime is not running: output: E0623 15:55:37.984948 1090481 remote_runtime.go:925] "Status from runtime service failed" err="rpc error: code = Unimplemented desc = unknown service runtime.v1alpha2.RuntimeService"
time="2022-06-23T15:55:37+08:00" level=fatal msg="getting status of runtime: rpc error: code = Unimplemented desc = unknown service runtime.v1alpha2.RuntimeService"
, error: exit status 1
[ERROR FileContent--proc-sys-net-ipv4-ip_forward]: /proc/sys/net/ipv4/ip_forward contents are not set to 1
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
很明显“kube-apiserver.yaml,kube-controller-manager.yaml,kube-scheduler.yaml,etcd.yaml” 这几个已经存在了,只要重置一下即可。
kubeadm reset
mv /etc/containerd/config.toml /tmp/
systemctl restart containerd
# 再次执行
kubeadm init
如果镜像还是拉取失败,请参考:k8s拉取镜像失败最简单最快最完美解决方法 [ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-apiserver - 灰信网(软件开发博客聚合)
4.配置环境变量(只在master执行)
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
5.添加k8s的Node节点
# 在master节点获取token:
kubeadm token create --print-join-command --ttl 0
# 在node1和node2添加如下的命令向k8s集群中添加Node节点(为上方命令返回的内容,复制即可):
kubeadm join 192.168.40.136:6443 --token yruyio.n4hal2qdb5iweknf --discovery-token-ca-cert-hash sha256:0ac7ed632224e1e07cef223b1159d03b2231dfc0456817db7eaf3c8651eef49c
# 获取所有节点(正常可以获取到master,node1和node2)
kubectl get nodes
6.在master节点部署CNI网络插件:
# 此链接如果下载不了,可以下面提供的地址下载
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl apply -f kube-flannel.yml
# 查看部署进度(可能会出现镜像拉取失败的情况,耐心等待一会就好了)
kubectl get pods -n kube-system
K8S部署资源文件,包含kube-flannel+kubernetes-dashboard+ingress-Linux文档类资源-CSDN下载
检查状态是否成功:
kubectl get cs
kubectl cluster-info
四、Dashboard 部署
需要下载kubernetes-dashboard.yaml 文件,可以通过上面给的链接下载
1.在master执行以下命令:
kubectl apply -f kubernetes-dashboard.yaml
# 开启代理 ip写自己实际ip
kubectl proxy --address=192.168.100.36 --disable-filter=true &
访问https://192.168.100.36:30002
2.在K8S 上使用域名访问
现在域名管理配置域名解析,并申请SSL证书
新建一个certs目录,专门放SSL证书,
mkdir certs && cd certs
把申请好SSL证书放到certs目录,继续下面操作
#删除原有的证书secret
kubectl delete secret kubernetes-dashboard-certs -n kube-system
#使用新的证书secret
kubectl -n kube-system create secret tls kubernetes-dashboard-certs --key k8s-dashboard.ipwe.net.cn.key --cert k8s-dashboard.ipwe.net.cn_bundle.crt
#查看pod复制dashboard的pod名称
kubectl get pod -n kube-system
#重启pod(删除会自动重启) pod name 是上面查到的 kubernetes-dashboard-XXXXXXXXXXX
kubectl delete pod <pod name> -n kube-system
获取token:
kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/cluster-admin/
通过令牌方式访问
kubectl apply -f kubernetes-dashboard-ingress.yaml
出现错误:
error when creating "kubernetes-dashboard-ingress.yaml": Internal error occurred: failed calling webhook "validate.nginx.ingress.kubernetes.io": failed to call webhook: Post "https://ingress-nginx-controller-admission.ingress-nginx.svc:443/networking/v1/ingresses?timeout=10s": dial tcp 10.107.233.56:443: connect: connection refused
解决方案:
1使用下面的命令查看 webhook
kubectl get validatingwebhookconfigurations ingress-nginx-admission
2 .删除ingress-nginx-admission
kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission