kubernetes百分百安装成功入门

Kubernetes

一、什么是Kubernetes？

部署应用的多种方式：

1. 单机版
   在以前想把多个应用部署在一个服务器上，就会出现一个应用占用过高导致其他的应用资源减少，资源不隔离，一个应用出现问题会导致其他的应用出现连带反应。
2. 虚拟化
   使用虚拟机的方式来部署应用，解决了第一种问题，【缺点】虚拟机体积大，环境部署麻烦【优点】资源隔离。
3. 容器化
   为了解决第二个问题，在之后出现了docker，只需要把应用打包成dockerFile在docker上进行容器化运行，等于一个小型虚拟机，但速度快，部署方便不需要安装多余环境只需要这dockerfile声明要运行在哪个环境下即可(如：java应用只需要指明在jdk哪个版本上运行，docker会自动下载好环境)，资源隔离，更容易管理。

【意】虽然容器化解决了资源隔离问题，使得部署更方便，但如果一个应用有几十个微服务，这样又会使得管理非常困难。所以我们急需一个大规模的容器编排系统（调控系统），能够自动创建新容器， 删除现有容器并将它们的所有资源用于新容器。这就是Kubernetes。

kubernetes具有以下特性：

• 服务发现和负载均衡
  Kubernetes 可以使用 DNS 名称或自己的 IP 地址公开容器，如果进入容器的流量很大， Kubernetes 可以负载均衡并分配网络流量，从而使部署稳定。
• 存储编排
  Kubernetes 允许你自动挂载你选择的存储系统，例如本地存储、公共云提供商等（控制应用的使用的存储空间。）。
• 自动部署和回滚
  你可以使用 Kubernetes 描述已部署容器的所需状态，它可以以受控的速率将实际状态 更改为期望状态。例如，你可以自动化 Kubernetes 来为你的部署创建新容器， 删除现有容器并将它们的所有资源用于新容器。（可以回滚到上一个版本，所有的占用资源指标k8s都可以控制）
• 自动完成装箱计算
  Kubernetes 允许你指定每个容器所需 CPU 和内存（RAM）。 当容器指定了资源请求时，Kubernetes 可以做出更好的决策来管理容器的资源。
• 自我修复
  Kubernetes 重新启动失败的容器、替换容器、杀死不响应用户定义的 运行状况检查的容器，并且在准备好服务之前不将其通告给客户端。
• 密钥与配置管理（类似配置中心）
  Kubernetes 允许你存储和管理敏感信息，例如密码、OAuth 令牌和 ssh 密钥。 你可以在不重建容器镜像的情况下部署和更新密钥和应用程序配置，也无需在堆栈配置中暴露密钥。

二、安装kubernetes

1、创建3个青云服务器，绑顶vpc

省略服务器创建，就是让3台服务器通过内网ip就可以ping通。

2、安装docker

#1、移除以前docker相关包
sudo yum remove docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine
#2、配置yum源
sudo yum install -y yum-utils
sudo yum-config-manager \
--add-repo \
http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

#3、安装docker
yum install -y docker-ce-20.10.7 docker-ce-cli-20.10.7  containerd.io-1.4.6

3、启动docker

#systemctl enable=现在启动，--now= 开机启动
systemctl enable docker --now 

#配置加速
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://wzu988tq.mirror.aliyuncs.com"]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

4、安装kubernetes集群

【安装注意事项】：

• 一台兼容的 Linux 主机。Kubernetes 项目为基于 Debian 和 Red Hat 的 Linux 发行版以及一些不提供包管理器的发行版提供通用的指令

• 每台机器 2 GB 或更多的 RAM （如果少于这个数字将会影响你应用的运行内存)

• 2 CPU 核或更多

• 集群中的所有机器的网络彼此均能相互连接(公网和内网都可以)

• 设置防火墙放行规则
  节点之中不可以有重复的主机名、MAC 地址或 product_uuid。请参见这里了解更多详细信息。

• 设置不同hostname
  开启机器上的某些端口。请参见这里 了解更多详细信息。

• 内网互信
  禁用交换分区。为了保证 kubelet 正常工作，你 必须 禁用交换分区。

  永久关闭

开始安装：

1、在创建服务器就分配id和内网互信

2、分别设置3台的主机名

hostnamectl set-hostname k8s-node1
hostnamectl set-hostname k8s-node2
hostnamectl set-hostname k8s-node3

​

3、关闭交互分区（虚拟内存）

# 将 SELinux 设置为 permissive 模式（相当于将其禁用）
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

#关闭swap
swapoff -a  
sed -ri 's/.*swap.*/#&/' /etc/fstab

#允许 iptables 检查桥接流量
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system

4、安装kubelet、kubeadm、kubectl

#配置kubelet、kubeadm、kubectl的下载地址
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
   http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

#安装kubelet、kubeadm、kubectl
sudo yum install -y kubelet-1.20.9 kubeadm-1.20.9 kubectl-1.20.9 --disableexcludes=kubernetes
#启动 kubelet服务 就是厂长
sudo systemctl enable --now kubelet
#kubelet 现在每隔几秒就会重启，因为它陷入了一个等待 kubeadm 指令的死循环

5、下载各个机器需要的镜像

#自动下载shell脚本，自动安装docker镜像
sudo tee ./images.sh <<-'EOF'
#!/bin/bash
images=(
kube-apiserver:v1.20.9
kube-proxy:v1.20.9
kube-controller-manager:v1.20.9
kube-scheduler:v1.20.9
coredns:1.7.0
etcd:3.4.13-0
pause:3.2
)
for imageName in ${images[@]} ; do
docker pull registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/$imageName
done
EOF
#给运行权限，并且运行
chmod +x ./images.sh && ./images.sh

6、初始化主节点

#所有机器添加master域名映射，ip需要修改为自己的master节点IP
echo "172.31.0.3  cluster-endpoint" >> /etc/hosts

只在主节点运行下面命令

#主节点初始化（只在主节点）
#masterIP地址
#上面映射的域名地址
#阿里云镜像仓库
#版本
#网络范围
kubeadm init \
--apiserver-advertise-address=172.31.0.3 \
--control-plane-endpoint=cluster-endpoint \
--image-repository registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images \
--kubernetes-version v1.20.9 \
--service-cidr=10.96.0.0/16 \ #service层网络的范围
--pod-network-cidr=192.168.0.0/16 #每个Pod都会被k8s分配一个人ip，这里是设置ip的网段范围，集群中的任意一个机器以及任意的应用都能通过Pod分配的ip来访问这个Pod


#上面的注释会不能运行，这里命令一样为了方便复制
kubeadm init \
--apiserver-advertise-address=172.31.0.4 \
--control-plane-endpoint=k8s-master \
--image-repository registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images \
--kubernetes-version v1.20.9 \
--service-cidr=10.96.0.0/16 \
--pod-network-cidr=192.168.0.0/16
#所有网络范围不重叠

#这是上面运行成功的提示，最好复制出来有需要运行的命令
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

#运行下面命令，把k8s的admin.conf文件，移动到root用户下的config目录，这样就能使用kubectl命令了
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:
#多个master命令
  kubeadm join cluster-endpoint:6443 --token f9tktf.0ua13cj9f8jn493r \
    --discovery-token-ca-cert-hash sha256:711e2715c4011d5c3bdf09496ab4221513c931621b9de3086345bad310645565 \
    --control-plane 

Then you can join any number of worker nodes by running the following on each as root:
#子节点加入主节点命令
kubeadm join cluster-endpoint:6443 --token f9tktf.0ua13cj9f8jn493r \
    --discovery-token-ca-cert-hash Your Kubernetes control-plane has initialized successfully!


#查看集群所有节点
kubectl get nodes

#根据配置文件，给集群创建资源
kubectl apply -f xxx.yaml

#查看集群部署了哪些应用等于docker的docker ps 
kubectl get pods -A 
#运行中的应用在docker叫容器，在k8s叫Pod

7、安装网络插件(只在主节点运行下面命令)

#下载calico网络插件
curl https://docs.projectcalico.org/manifests/calico.yaml -O
#下载好后会有一个配置文件，k8s想创建资源只需要应用配置文件就行了
kubectl apply -f calico.yaml

8、子节点加入主节点

#就是上面主节点运行成功最后的一段，这个需要令牌，令牌是24小时有效
kubeadm join cluster-endpoint:6443 --token j521hh.3vrz4lj88px8qa5o     --discovery-token-ca-cert-hash sha256:d412501e0a07b62eff09c876e7be24eaf4badc18cf0377afda67589f251d9d5d
#过期后在主节点创建新令牌
kubeadm token create --print-join-command

9、部署可视化界面dashboard（在主节点）

kubernetes官方提供的可视化界面

https://github.com/kubernetes/dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml

【注】如果不能下载可以使用下面的yaml文件

#创建dashboard.yaml
vi dashboard.yaml

# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: kubernetes-dashboard

---

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
type: Opaque

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
type: Opaque
data:
  csrf: ""

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
type: Opaque

---

kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
    # Allow Dashboard to get metrics.
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
rules:
  # Allow Metrics Scraper to get metrics from the Metrics server
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.3.1
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 8000
      targetPort: 8000
  selector:
    k8s-app: dashboard-metrics-scraper

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: dashboard-metrics-scraper
  template:
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    spec:
      containers:
        - name: dashboard-metrics-scraper
          image: kubernetesui/metrics-scraper:v1.0.6
          ports:
            - containerPort: 8000
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 8000
            initialDelaySeconds: 30
            timeoutSeconds: 30
          volumeMounts:
          - mountPath: /tmp
            name: tmp-volume
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      volumes:
        - name: tmp-volume
          emptyDir: {}

10、设置访问端口

#修改端口，相当于docker的端口映射
kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
#使用/type:搜索，改成
type: NodePort

#查看映射的端口，我的是30035
kubectl get svc -A |grep kubernetes-dashboard

然后修改安全组，开放这个端口号，使用任意服务器节点访问这个端口进入

#使用https加ip和端口号

https://139.198.106.119:30035

11、创建访问账号

#创建访问账号，准备一个yaml文件； vi dash.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
  
#保存退出后加载配置
kubectl apply -f dash.yaml

12、使用创建好的账号来获取令牌

#获取访问令牌
kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

eyJhbGciOiJSUzI1NiIsImtpZCI6IllwNV9WV0hDNWNaOFJ6bkpVNllKTzd5ZFR1S1dXRGJxV2RXNDAxaUxUWm8ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWoyYjQ1Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2NTBiYzViYS01MjdhLTRhNmYtYjNjZS1kYzgxOTdhYTM3N2EiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.nU6cL8Drm9PgVBcmDrMmlwhfmN7fYCaAOqMIeilK5xMIESD-eUxn6-IeHhaHjv1tKAtECE-tizYGlkFGhQ0Sh7qgcbVBid1jx9Pi-2AhOVpPnezVho4JEiGmHtQ2kmQuVsKciCV3H3D4QKQBxOxKR-AfE7G8ye4ln405tN5dtE1mQT9VoixChIGCQ9Pja1OzOz13jKz8WN-GWKqJI1V_vrpTkXd7d9AU6fOtRNjIF-PqDqHU7jIsU8Cl7iOEdHrzt8KSvjZ5OpuSm3ckuL3WkBB9xdhKWVrBOKlN_IEeDDy48fWciXV5jS4KWtf2_Ne_R9xQrn7_qnw3byAmhDIgLQ

13、删除节点

#假设我们需要删除 k8s-node1 这个节点，首先在 master 节点上依次执行以下两个命令：
kubectl drain k8s-node1 --delete-local-data --force --ignore-daemonsets
kubectl delete node  k8s-node1
#执行后通过 kubectl get node 命令可以看到 k8s-node1 已被成功删除：
 kubectl get nodes
#接着在 k8s-node1 这个 Node 节点上执行如下命令，这样该节点即完全从 Cluster 中脱离开来：
kubeadm reset

​