Kubernetes集群节点介绍
一个Kubernetes集群由多个工作节点(worker node)和一个或多个集群控制节点(Master)以及一个集群状态存储系(etcd)组成
Master系统组件
- Master主要负责整个集群的管理工作，为集群提供管理接口，并监控和编排集群中的各个工作节点。各节点负责以 Pod 形式运行Docker容器。
- Master节点主要由 apiserver、scheduler、contrller三个系统组件以及一个集群存储系统 etcd 组成。而API、UI、CLI则为管理员客户端操作方式。
- kube-apiserver：Kubernetes API，集群的统一入口，各组件协调者，以RESTful API提供接口服务，所有对象资源的增删改查和监听操作都交给APIServer处理后再提交给Etcd存储。
- kube-controller-manager（RC）：处理集群中常规后台任务，一个资源对应一个控制器，而ControllerManager就是负责管理这些控制器的。
- kube-scheduler：根据调度算法为新创建的Pod选择一个Node节点，可以任意部署,可以部署在同一个节点上,也可以部署在不同的节点上。
- etcd：分布式键值存储系统。用于保存集群状态数据，比如Pod、Service等对象信息。
Node系统组件
- Node节点主要负责提供运行容器的各种依赖环境，并接受 Master 管理。每个Node主要由 Kubelet、容器、kube-proxy三个组件组成。
- kubelet：kubelet是Master在Node节点上的Agent，管理本机运行容器的生命周期，比如创建容器、Pod挂载数据卷、下载secret、获取容器和节点状态等工作。kubelet将每个Pod转换成一组容器。cadvise:监控容器和节点资源
- 容器：Docker，容器引擎负责接收来自kubelet的指令并执行它
- kube-proxy：service 在逻辑上代表了后端的多个 Pod，外界通过 service 访问 Pod。service 接收到的请求是如何转发到 Pod 的呢？这就是 kube-proxy 要完成的工作。每个 Node 都会运行 kube-proxy 服务，它负责将访问 service 的 TCP/UPD 数据流转发到后端的容器。如果有多个副本，kube-proxy 会实现负载均衡。
环境配置
设置hosts文件
#vi /etc/hosts
192.168.0.1 k8s-master
192.168.0.2 k8s-node1
关闭防火墙、SeLinux及虚拟交换内存
1.关闭防火墙
systemctl disable firewalld
systemctl stop firewalld
用firewall-cmd --state查看状态,状态为not running 为关闭
2.清空iptables策略及修改SeLinux状态
临时方式
iptables -F
setenforce 0 #将Selinux设置为关闭
getenforce #查看状态
永久关闭（将Selinux设置为禁用)
sed -i 's/SELINUX=Enforcing/SELINUX=Disabled/g' /etc/sysconfig/selinux
关闭交换内存
swapoff -a
安装docker
安装依赖组件
yum install -y yum-utils device-mapper-persistent-data lvm2
添加docker软件源(此处用阿里源)
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
安装docker-ce
yum -y install docker-ce-18.09.9
在启动之前需要把cgroup-driver修改为systemd
sed -i "s#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd#g" /usr/lib/systemd/system/docker.service
systemctl daemon-reload #重载服务
systemctl enable docker #设置服务为开机自启
systemctl start docker #启动docker服务
docker info | grep -i cgroup #使用此命令查看cgroup-driver状态
安装kubeadm kubelet kubectl
添加Kubernetes镜像源
#vi /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
如果不指定版本会自动安装最新版本，1.18.X由于在阿里镜像站中yum源里有包但没有相应的docker镜像所以我们指定版本为1.16.3
yum -y install kubelet-1.16.3 kubeadm-1.16.3 kubectl-1.16.3 #安装组件
systemctl start kubelet #启动服务
systemctl enable kubelet #将服务设置为开机自启
systemctl status kubelet
现在kubelet的状态应为错误状态error代码为255,因为kubelet组件在初始化节点之前会不断重启，所以待之后初始化后会正常
拉取所需镜像
#使用Kubeadm查看需要的镜像及相应版本
[root@k8s-master ~]# kubeadm config images list
k8s.gcr.io/kube-apiserver:v1.16.3
k8s.gcr.io/kube-controller-manager:v1.16.3
k8s.gcr.io/kube-scheduler:v1.16.3
k8s.gcr.io/kube-proxy:v1.16.3
k8s.gcr.io/pause:3.1
k8s.gcr.io/etcd:3.3.15-0
k8s.gcr.io/coredns:1.6.2
由于直接拉取官方源需要科学上网所以本次我们使用阿里源镜像
docker pull registry.aliyuncs.com/google_containers/kube-apiserver-amd64:v1.16.3
docker pull registry.aliyuncs.com/google_containers/kube-controller-manager-amd64:v1.16.3
docker pull registry.aliyuncs.com/google_containers/kube-scheduler-amd64:v1.16.3
docker pull registry.aliyuncs.com/google_containers/kube-proxy-amd64:v1.16.3
docker pull registry.aliyuncs.com/google_containers/pause-amd64:3.1
docker pull registry.aliyuncs.com/google_containers/etcd-amd64:3.3.15-0
docker pull registry.aliyuncs.com/google_containers/coredns:1.6.2
修改镜像的名字
docker tag registry.aliyuncs.com/google_containers/kube-apiserver-amd64:v1.16.3 k8s.gcr.io/kube-apiserver:v1.16.3
docker tag registry.aliyuncs.com/google_containers/kube-controller-manager-amd64:v1.16.3 k8s.gcr.io/kube-controller-manager:v1.16.3
docker tag registry.aliyuncs.com/google_containers/kube-scheduler-amd64:v1.16.3 k8s.gcr.io/kube-scheduler:v1.16.3
docker tag registry.aliyuncs.com/google_containers/kube-proxy-amd64:v1.16.3 k8s.gcr.io/kube-proxy:v1.16.3
docker tag registry.aliyuncs.com/google_containers/pause-amd64:3.1 k8s.gcr.io/pause:3.1
docker tag registry.aliyuncs.com/google_containers/etcd-amd64:3.3.15-0 k8s.gcr.io/etcd:3.3.15-0
docker tag registry.aliyuncs.com/google_containers/coredns:1.6.2 k8s.gcr.io/coredns:1.6.2
删除aliyun镜像
docker rmi registry.aliyuncs.com/google_containers/kube-apiserver-amd64:v1.16.3
docker rmi registry.aliyuncs.com/google_containers/kube-controller-manager-amd64:v1.16.3
docker rmi registry.aliyuncs.com/google_containers/kube-scheduler-amd64:v1.16.3
docker rmi registry.aliyuncs.com/google_containers/kube-proxy-amd64:v1.16.3
docker rmi registry.aliyuncs.com/google_containers/pause-amd64:3.1
docker rmi registry.aliyuncs.com/google_containers/etcd-amd64:3.3.15-0
docker rmi registry.aliyuncs.com/google_containers/coredns:1.6.2
配置Master节点
之前步骤需要在所有节点上执行，此步骤只需要在Master节点上执行即可
初始化Master节点
kubeadm init --pod-network-cidr=10.244.0.0/16 \ #指定网络组件的网段
--kubernetes-version=v1.16.3 \ #指定集群版本
--apiserver-advertise-address=192.168.0.1 #指定本地IP也可用域名
出现下述内容为初始化成功
kubeadm join 192.168.0.1:6443 --token kl1dcx.7bvt5cebx614xh74 \
--discovery-token-ca-cert-hash sha256:4364eaba6c47c705e3e650a34553169ab4ddc696a8d3166a9e4ac284aa14e175 --ignore-preflight-errors=all
保存输出中kubeadm join的内容，可用于添加Node节点
创建相应配置文件
rm -rf $HOME/.kube
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
配置flannel网络插件
安装flannel插件
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
直接使用命令由于网络原因可能会连接超时，这里将flannel.yml文件贴在下面，可直接复制
#vi flannel.yml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unused in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: flannel
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: flannel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flannel
subjects:
- kind: ServiceAccount
name: flannel
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: flannel
namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
name: kube-flannel-cfg
namespace: kube-system
labels:
tier: node
app: flannel
data:
cni-conf.json: |
{
"name": "cbr0",
"cniVersion": "0.3.1",
"plugins": [
{
"type": "flannel",
"delegate": {
"hairpinMode": true,
"isDefaultGateway": true
}
},
{
"type": "portmap",
"capabilities": {
"portMappings": true
}
}
]
}
net-conf.json: |
{
"Network": "10.244.0.0/16",
"Backend": {
"Type": "vxlan"
}
}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-amd64
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- amd64
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.12.0-amd64
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.12.0-amd64
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-arm64
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- arm64
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.12.0-arm64
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.12.0-arm64
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-arm
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- arm
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.12.0-arm
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.12.0-arm
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-ppc64le
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- ppc64le
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.12.0-ppc64le
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.12.0-ppc64le
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-s390x
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- s390x
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.12.0-s390x
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.12.0-s390x
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
将文件保存后执行kubectl apply -f flannel.yml即可直接安装flannel网络组件
有下述回执为成功
[root@k8s-master ~]# kubectl get pods -A -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kube-system coredns-5644d7b6d9-75cls 1/1 Running 0 66m 10.244.1.2 k8s-node1 <none> <none>
kube-system coredns-5644d7b6d9-9j6vw 1/1 Running 0 66m 10.244.1.3 k8s-node1 <none> <none>
kube-system etcd-k8s-master 1/1 Running 0 65m 192.168.0.254 k8s-master <none> <none>
kube-system kube-apiserver-k8s-master 1/1 Running 0 65m 192.168.0.254 k8s-master <none> <none>
kube-system kube-controller-manager-k8s-master 1/1 Running 0 65m 192.168.0.254 k8s-master <none> <none>
kube-system kube-flannel-ds-amd64-6w5rr 1/1 Running 0 60m 192.168.0.100 k8s-node1 <none> <none>
kube-system kube-flannel-ds-amd64-qwg9c 1/1 Running 0 60m 192.168.0.254 k8s-master <none> <none>
kube-system kube-proxy-b9vnz 1/1 Running 0 66m 192.168.0.254 k8s-master <none> <none>
kube-system kube-proxy-xmmm9 1/1 Running 0 61m 192.168.0.100 k8s-node1 <none> <none>
kube-system kube-scheduler-k8s-master 1/1 Running 0 65m 192.168.0.254 k8s-master <none> <none>
将Node节点加入集群
执行加入集群命令
kubeadm join 192.168.0.1:6443 --token a4dfnt.7e6c642y8iyvr0p2 \
--discovery-token-ca-cert-hash sha256:c531fa1ed82e5bb8161db56c08b89
在Master节点上查看Node节点是否成功加入集群
[root@k8s-master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master Ready master 70m v1.16.3
k8s-node1 Ready <none> 65m v1.16.3
部署cailo网络组件
直接执行安装命令即可
kubectl apply -f https://docs.projectcalico.org/v3.10/manifests/calico.yaml
有如下回执为安装成功
[root@k8s-master ~]# kubectl get pods -A -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kube-system calico-kube-controllers-7994b948dd-56szw 1/1 Running 0 20s 10.244.1.4 k8s-node1 <none> <none>
kube-system calico-node-9gphk 0/1 Running 0 20s 192.168.0.100 k8s-node1 <none> <none>
kube-system calico-node-nnjdp 0/1 Running 0 20s 192.168.0.254 k8s-master <none> <none>
kube-system coredns-5644d7b6d9-75cls 1/1 Running 0 77m 10.244.1.2 k8s-node1 <none> <none>
kube-system coredns-5644d7b6d9-9j6vw 1/1 Running 0 77m 10.244.1.3 k8s-node1 <none> <none>
kube-system etcd-k8s-master 1/1 Running 0 76m 192.168.0.254 k8s-master <none> <none>
kube-system kube-apiserver-k8s-master 1/1 Running 0 76m 192.168.0.254 k8s-master <none> <none>
kube-system kube-controller-manager-k8s-master 1/1 Running 0 75m 192.168.0.254 k8s-master <none> <none>
kube-system kube-flannel-ds-amd64-6w5rr 1/1 Running 0 71m 192.168.0.100 k8s-node1 <none> <none>
kube-system kube-flannel-ds-amd64-qwg9c 1/1 Running 0 71m 192.168.0.254 k8s-master <none> <none>
kube-system kube-proxy-b9vnz 1/1 Running 0 77m 192.168.0.254 k8s-master <none> <none>
kube-system kube-proxy-xmmm9 1/1 Running 0 72m 192.168.0.100 k8s-node1 <none> <none>
kube-system kube-scheduler-k8s-master 1/1 Running 0 76m 192.168.0.254 k8s-master <none> <none>
安装kubernetes Dashboard
创建Dahabord文件
```lua
#vi dashboard.yml
apiVersion: v1
kind: Namespace
metadata:
name: kubernetes-dashboard
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
type: NodePort
ports:
- port: 443
targetPort: 8443
nodePort: 30100
selector:
k8s-app: kubernetes-dashboard
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kubernetes-dashboard
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-csrf
namespace: kubernetes-dashboard
type: Opaque
data:
csrf: ""
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-key-holder
namespace: kubernetes-dashboard
type: Opaque
---
kind: ConfigMap
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-settings
namespace: kubernetes-dashboard
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster", "dashboard-metrics-scraper"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
verbs: ["get"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
rules:
# Allow Metrics Scraper to get metrics from the Metrics server
- apiGroups: ["metrics.k8s.io"]
resources: ["pods", "nodes"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: kubernetesui/dashboard:v2.0.0
imagePullPolicy: Always
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
- --namespace=kubernetes-dashboard
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 1001
runAsGroup: 2001
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
nodeSelector:
"kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
ports:
- port: 8000
targetPort: 8000
selector:
k8s-app: dashboard-metrics-scraper
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: dashboard-metrics-scraper
template:
metadata:
labels:
k8s-app: dashboard-metrics-scraper
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
spec:
containers:
- name: dashboard-metrics-scraper
image: kubernetesui/metrics-scraper:v1.0.4
ports:
- containerPort: 8000
protocol: TCP
livenessProbe:
httpGet:
scheme: HTTP
path: /
port: 8000
initialDelaySeconds: 30
timeoutSeconds: 30
volumeMounts:
- mountPath: /tmp
name: tmp-volume
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 1001
runAsGroup: 2001
serviceAccountName: kubernetes-dashboard
nodeSelector:
"kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
volumes:
- name: tmp-volume
emptyDir: {}
执行安装命令
kubectl apply -f dashboard.yml
也可以直接执行如下命令即可
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml ----网络原因一般无法成功
通过宿主机的ip地址+noePort来访问dashboard
出现这个界面为搭建成功
使用token登录Dashboard
kubectl create serviceaccount dashboard-admin -n kube-system --创建一个用户登录的账号
kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin --绑定账号
kubectl get secret -n kube-system --查看secret找到dashboard开头的字段
kubectl describe secret dashboard-admin-token-j52xn -n kube-system --查看详细信息，截取其中token字段，复制到Web中登录
图上为Dashboard搭建成功
备注：dashboard认证有两种方式：
1、通过我们刚刚获取的token直接认证
2、通过Kubeconfig文件认证，需要在kubeadm生成的admin.conf文件末尾加上刚刚获取的token就好了。
- name: kubernetes-admin
user:
client-certificate-data: xxxxxxxx
client-key-data: xxxxxx
token: "在这里加上token"
部署过程中遇到的问题
解决k8s集群在节点运行kubectl出现的错误：The connection to the server localhost:8080 was refused - did you specify the right host or port?
出现这个问题的原因是kubectl命令需要使用kubernetes-admin来运行
将主节点（master节点）中的【/etc/kubernetes/admin.conf】文件拷贝到从节点相同目录下
sudo scp -r /etc/kubernetes/admin.conf root@192.168.0.1:/etc/kubernetes/admin.conf
然后配置环境变量：
echo "export" KUBECONFIG=/etc/kubernetes/admin.conf >> ~/ .bash_profile
source ~/ .bash_profile
430
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
