使用kubeadm部署k8s集群

最新推荐文章于 2024-05-21 15:25:54 发布

WL大大

最新推荐文章于 2024-05-21 15:25:54 发布

阅读量367

点赞数 9

分类专栏： k8s 文章标签： kubernetes linux 容器

本文链接：https://blog.csdn.net/qq_45589444/article/details/135095239

版权

k8s 专栏收录该内容

11 篇文章 0 订阅

订阅专栏

须知：正式环境不建议这种方法安装推荐二进制

1、环境准备

测试环境哈！资源划分按具体情况定！这里使用的龙蜥系统

master（管理主机）：2CPU、4G  10.211.55.5    longxi-01
node01（计算节点）：2CPU、4G  10.211.55.6    longxi-02
node02（计算节点）：2CPU、4G  10.211.55.7    longxi-03

2、基本环境设置

所有节点需关闭swap、selinux、firewalld

[root@longxi-01 ~]# swapoff -a && sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
[root@longxi-01 ~]# setenforce 0 && sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
setenforce: SELinux is disabled
[root@longxi-01 ~]# systemctl stop firewalld && systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@longxi-01 ~]# systemctl stop postfix.service && systemctl disable postfix.service
Failed to stop postfix.service: Unit postfix.service not loaded.

所有节点设置host

[root@longxi-01 ~]# vim /etc/hosts
10.211.55.5 longxi-01
10.211.55.6 longxi-02
10.211.55.7 longxi-03

调整内核

[root@longxi-01 ~]# vim /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1    # 开启桥设备内核监控（ipv6）
net.bridge.bridge-nf-call-iptables = 1     # 开启桥设备内核监控（ipv4）
net.ipv4.ip_forward = 1                            # 开启路由转发
[root@longxi-01 ~]# modprobe br_netfilter
[root@longxi-01 ~]# sysctl --system

设置时间同步

[root@longxi-01 ~]# vim /etc/chrony.conf
server 210.72.145.44 iburst
server ntp.aliyun.com iburst
#pool ntp.aliyun.com iburst              //注释掉这个添加上面两行

[root@longxi-01 ~]# systemctl restart chronyd.service
[root@longxi-01 ~]# systemctl enable chronyd.service
[root@longxi-01 ~]# chronyc sources -v

安装IPVS代理软件包

[root@longxi-01 ~]# yum install -y ipvsadm ipset        # 使用lvs负载均衡调用集群的负载均衡
[root@longxi-01 ~]# ipvsadm -Ln         #查看规则

master节点上安装docker、kubeadm、kubelet、kubectl
node节点上安装docker、kubeadm、kubelet
目前三台服务器docker已经安装了

添加k8s的yum源

[root@longxi-01 ~]#cat << EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

软件安装

[root@longxi-01 ~]# yum -y install kubelet-1.23.0 kubeadm-1.23.0 kubectl-1.23.0
[root@longxi-01 ~]# systemctl enable kubelet

检查docker驱动是否使用systemd，如果不一致会导致镜像启动不起来

[root@longxi-01 ~]# docker info | grep "Cgroup Driver"
 Cgroup Driver: cgroupfs
 不一致需要更改,顺便加个源
 [root@longxi-01 ~]# vim /etc/docker/daemon.json
 {
"exec-opts": ["native.cgroupdriver=systemd"],
"registry-mirrors": ["http://f1361db2.m.daocloud.io"]
}
[root@longxi-01 ~]# systemctl daemon-reload
[root@longxi-01 ~]# systemctl restart docker

设置tab键，可以时kubeadm键tab出来

[root@longxi-01 ~]# kubectl completion bash >/etc/bash_completion.d/kubectl
[root@longxi-01 ~]# kubeadm completion bash >/etc/bash_completion.d/kubeadm

3、master节点初始化集群

[root@longxi-01 ~]# kubeadm config images list       查看集群k8s清单用docker pull下载下来
[root@longxi-01 ~]# kubeadm init \
--apiserver-advertise-address=10.211.55.5 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.23.0 \
--service-cidr=10.254.0.0/16 \
--pod-network-cidr=10.244.0.0/16 
参数说明：
--apiserver-advertise-address 集群通告地址
--image-repository 由于默认拉取镜像地址k8s.gcr.io国内无法访问，这里指定阿里云镜像仓库地址
--kubernetes-version K8s版本，与上面安装的一致
--service-cidr 集群内部虚拟网络，Pod统一访问入口
--pod-network-cidr Pod网络，与下面部署的CNI网络组件yaml中保持一致

根据提示完成集群授权

[root@longxi-01 ~]# mkdir -p $HOME/.kube
[root@longxi-01 ~]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@longxi-01 ~]# sudo chown $(id -u):$(id -g) $HOME/.kube/config

检查kubectl安装

[root@longxi-01 ~]# kubectl version
[root@longxi-01 ~]# kubectl get componentstatuses

获取master的token，认证文件token存放在/etc/kubernetes/pki/ca.crt里

[root@longxi-01 ~]# cat /etc/kubernetes/pki/ca.crt
[root@longxi-01 ~]# kubeadm token list 
TOKEN                     TTL         EXPIRES                USAGES                   DESCRIPTION                                                EXTRA GROUPS
zqqd3t.veoxykcxu9wey2qx   23h         2023-11-17T08:19:32Z   authentication,signing   The default bootstrap token generated by 'kubeadm init'.   system:bootstrappers:kubeadm:default-node-token
[root@longxi-01 ~]# kubeadm token delete zqqd3t.veoxykcxu9wey2qx      删除时间限制的token
[root@longxi-01 ~]# kubeadm token create --ttl=0 --print-join-command     创建无限制的token
kubeadm join 10.211.55.5:6443 --token nfekb8.x4z8i690yd25jhzr --discovery-token-ca-cert-hash sha256:e6d4e4080bfdab40c955114fad899d8edaffd256eb9f5c56cc3ddce54bfd42b4
[root@longxi-01 ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt |openssl rsa -pubin -outform der |openssl dgst -sha256 -hex  获取token的hash
writing RSA key
(stdin)= e6d4e4080bfdab40c955114fad899d8edaffd256eb9f5c56cc3ddce54bfd42b4

4、所有node节点执行

加入集群

[root@longxi-02 ~]# kubeadm join 10.211.55.5:6443 --token  nfekb8.x4z8i690yd25jhzr --discovery-token-ca-cert-hash sha256:e6d4e4080bfdab40c955114fad899d8edaffd256eb9f5c56cc3ddce54bfd42b4
[root@longxi-03 ~]# kubeadm join 10.211.55.5:6443 --token  nfekb8.x4z8i690yd25jhzr --discovery-token-ca-cert-hash sha256:e6d4e4080bfdab40c955114fad899d8edaffd256eb9f5c56cc3ddce54bfd42b4

格式：
kubeadm join 10.211.55.5:6443 --token <token> \--discovery-token-ca-cert-hash sha256:<token ca hash>

验证kubectl get nodes 报错

E1116 16:34:31.733156 35984 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused

处理报错：
[root@longxi-03 ~]# echo "export KUBECONFIG=/etc/kubernetes/kubelet.conf" >> /etc/profile
[root@longxi-03 ~]# source /etc/profile
[root@longxi-03 ~]# kubectl get nodes
NAME        STATUS     ROLES                  AGE     VERSION
longxi-01   NotReady   control-plane,master   17m     v1.23.0
longxi-02   NotReady   <none>                 4m40s   v1.23.0
longxi-03   NotReady   <none>                 3m4s    v1.23.0

5、安装flannel网络

[root@longxi-01 ~]# wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
[root@longxi-01 ~]# vim kube-flannel.yml
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",          修改网段--pod-network-cidr=10.244.0.0/16  保持一致
      "Backend": { 
        "Type": "vxlan"
      }
    }
[root@longxi-01 ~]# kubectl apply -f kube-flannel.yml
[root@longxi-01 ~]# kubectl get pods -n kube-flannel