CentOS-8构建K8s高可用集群搭建

部署环境版本：

• Mware_Fusion_Pro版本:VMware_Fusion_Pro_12.1.0_Build_17195230
• CentOS8版本:CentOS-Stream-8-x86_64-20210204
• Docker version: 20.10.3

安装注意事项：

• centos8默认安装podman和docker有冲突需要卸载掉

yum erase podman

• 配置阿里yum
• 关闭selinux
  SELinux：即安全增强型 Linux（Security-Enhanced Linux）
  它是一个 Linux 内核模块，也是 Linux 的一个安全子系统
  它主要由美国国家安全局开发,
  它的主要作用:最大限度地减小系统中服务进程可访问的资源（最小权限原则）
  有的软件对于selinux的安全规则支持不够好，就会建议在安装前把selinux先关闭

vim /etc/selinux/config

• 关闭swap

swapoff -a
vim /etc/fstab 注释掉swap项

安装docker version 20.10.3

yum install yum-utils device-mapper-persistent-data lvm2
官方地址：
sudo yum-config-manager --add-repo  https://download.docker.com/linux/centos/docker-ce.repo
阿里：
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
设置环境变量：
echo "export LC_ALL=en_US.UTF-8"  >>  /etc/profile
source /etc/profile

yum install --allowerasing docker-ce

Set up the Docker daemon

mkdir /etc/docker

cat <<EOF | sudo tee /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}
EOF

mkdir -p /etc/systemd/system/docker.service.d
sudo systemctl daemon-reload
sudo systemctl restart docker
systemctl enable docker

修改驱动

docker info

安装kubernetes

配置kubernetes 国内yum源

vim /etc/yum.repos.d/kubernetes.repo

[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

安装kubeadm、kubectl、kubelet

yum install -y kubelet kubeadm kubectl

启动kubelet服务

systemctl enable kubelet
systemctl start kubelet
systemctl restart kubelet

初始化kubernetes集群

kubeadm init \
    --apiserver-advertise-address=192.168.43.122 \   # 当前机器的IP
    --image-repository registry.aliyuncs.com/google_containers \
    --kubernetes-version v1.20.0 \
    --pod-network-cidr=10.244.0.0/16 \
    --ignore-preflight-errors=docker
    
kubeadm init --apiserver-advertise-address=192.168.43.122 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.20.0 --pod-network-cidr=10.244.0.0/16 --ignore-preflight-errors=docker

卸载

kubeadm reset

要使kubectl适用于您的非root用户，请运行以下命令，这些命令也是kubeadm init输出的一部分

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

export KUBECONFIG=/etc/kubernetes/admin.conf

安装网络插件flannel(网络插件有很多)

wget --no-check-certificate https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

问题处理

kubeadm token list
ps -ef | grep flannel
查看状态
kubectl get cs

cd /etc/kubernetes/manifests/
etcd.yaml kube-apiserver.yaml kube-controller-manager.yaml kube-scheduler.yaml
修改清单文件，注释掉--port=0这一行，在对清单文件进行修改时先做备份操作
systemctl restart kubelet

常用命令

#获取类型为Deployment的资源列表
kubectl get deployments --all-namespaces
#获取类型为Pod的资源列表
kubectl get pods --all-namespaces
#获取类型为Node的资源列表
kubectl get nodes --all-namespaces
#查看名称为nginx-XXXXXX的Pod的信息
kubectl describe pod nginx-XXXXXX
#本案例中的 nginx-pod 没有输出日志，所以您看到的结果是空的
kubectl logs -f nginx-pod-XXXXXXX
kubectl exec -it nginx-pod-xxxxxx /bin/bash
kubectl version 
client代表kubectl版本信息，server代表的是master节点的k8s版本信息
删除pod
kubectl get pod -n kubernetes-dashboard
kubectl delete pod kubernetes-dashboard-7448ffc97b-vvsgv  -n kubernetes-dashboard
kubectl get deployment -n kubernetes-dashboard
kubectl delete deployment deplymentname -n kubernetes-dashboard

kubernetes dashboard部署

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.1.0/aio/deploy/recommended.yaml

映射外部访问

kubectl apply -f recommended.yaml

查看服务部署

kubectl get svc -n kubernetes-dashboard

Creating a Service Account

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
EOF

Creating a ClusterRoleBinding

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
EOF

Getting a Bearer Token

kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

eyJhbGciOiJSUzI1NiIsImtpZCI6IkloWVNHdEVqOWUyYzR5aGZaWlpMTU5mZkJDRzA0Y2xrelBtMy1nWVBCVDQifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXAybmJ0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkZGFkMWNjYi04ZWMzLTQwNWEtOGNlNS05ZmM5MGNjZTQ0MGUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.fnaJEHGHQAgBdWuvkDKY5crZfZUt0R7GpFqw7nDUufhcoGN7AR1NMqULye4Sr9uD_ZS6Xp4NLeCGUwQViwosDwgptoAeloGPz26uj21pBZyPzzVVtiq9lkgj7FWnND1lzO7TMStEfw5OIScv6dSM1OzgtIdOSq0BqHyw78xHFysAES5_B1smG-qZrsVUFAzLaNRfXpAmVcc6_0T3-SewAuYvrCehXSbu17mvR4a7eJK9koexE5C3NeLMtGMHXtTHM5hHNlZBMyrAmMC61xhdXXxprVb_FSwals7quVyUfvtFI2_py-HtrQomt7eorOPYfdvm3YW9gFOg0Y0x-Cwcu

清除用户信息

kubectl -n kubernetes-dashboard delete serviceaccount admin-user
kubectl -n kubernetes-dashboard delete clusterrolebinding admin-user

重装

kubectl get svc -n kubernetes-dashboard
kubectl get pod -n kubernetes-dashboard
kubectl get deployment -n kubernetes-dashboard
kubectl delete -f recommended.yaml
kubectl create -f recommended.yaml

安装rancher v1.6.30

使用内部数据库

sudo docker run -d --restart=no -p 8080:8080 rancher/server:stable

使用外部数据库

sudo docker run -d --restart=unless-stopped -p 8080:8080 rancher/server:stable --db-host 192.168.43.121 --db-port 3306 --db-user  root --db-pass root --db-name rancher