centos7上使用kubeadm创建Kubernetes1.10集群

    Kubernetes，简称 k8s（k，8 个字符，s——明白了？）或者 “kube”，是一个开源的 Linux 容器自动化运维平台，它消除了容器化应用程序在部署、伸缩时涉及到的许多手动操作。换句话说，你可以将多台主机组合成集群来运行 Linux 容器，而 Kubernetes 可以帮助你简单高效地管理那些集群。构成这些集群的主机还可以跨越公有云、私有云以及混合云。目前已经是容器编排的标准，背后主要有google和红帽支持。

    kubeadm是Kubernetes官方提供的快速搭建k8s集群的工具，比目前网上使用其他方法搭建要简单快速的多，而且碰都的问题也少。如果大家按照本文操作出现任何问题，请留言，我会尽量及时回复。本文主要是参考的Kubernetes官方文档Using kubeadm to Create a Cluster。按照本文搭建的集群不够安全，也做不到高可用，仅建议个人学习研究用途，不建议部署至生产环境。

前提条件

1. 2台以上安装了centos7 x64的服务器，可以是物理机，虚拟机或者vps。其中一台作为master节点，其他的作为node节点。
2. 每台机器至少2g内存，作为master的服务器至少要2个核。
3. 所有服务器之间的网络是互通的，hostname不能相同，并且不含有下划线。
4. 服务器是在墙外的，因为搭建的过程中要下载的一些文件，墙内可能会很慢或者根本下载不了，这意味着使用国内的阿里云，腾讯云之类的vps搭建会很麻烦。如果还没有墙外的服务器，可以去看下vultr，我用的就是这个，性价比比较高，也很稳定,   推荐使用东京或美国西部的节点，连接比较快，有时ip会ping不通，应该是被墙了，在其他区域再创建一个再试就ok了。
5. 会用ssh连接服务器，并能执行简单的命令，以及编辑保存文件。下文的命令有些可能需要root权限，如果提示没有权限，在命令行前面加sudo再执行一次。

搭建步骤

第1-6步是每台服务器都需要的。

1. 升级系统，在命令行运行

yum update -y

     2. 关闭防火墙,swap，因为k8s需要运行多个服务在不同的服务器上通讯，需要开放多个端口，简单起见，直接把防火墙关了，不推荐在生产环境这么做。关掉swap，k8s的组件kebelet才可以正常工作。

systemctl disable firewalld
systemctl stop firewalld
swapoff -a    

  3.安装docker

yum install -y docker
systemctl enable docker && systemctl start docker

    4.安装kubeadm,kubelet,kubectl

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF
setenforce 0
yum install -y kubelet kubeadm kubectl
systemctl enable kubelet && systemctl start kubelet

    5.关闭selinux，因为 kubelet目前支持selinux还有点问题

setenforce 0

打开/etc/sysconfig/selinux文件

vi /etc/sysconfig/selinux

找到 SELINUX那行，改为

SELINUX=disabled

保存文件

    6.设置net.bridge.bridge-nf-call-iptables为1

cat <<EOF >  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system

    7.初始化master，在master的节点上运行

kubeadm init --pod-network-cidr=192.168.0.0/16

如果你看到类似下面的信息说明master初始化成功了

[init] Using Kubernetes version: v1.8.0
[init] Using Authorization modes: [Node RBAC]
[preflight] Running pre-flight checks
[kubeadm] WARNING: starting in 1.8, tokens expire after 24 hours by default (if you require a non-expiring token use --token-ttl 0)
[certificates] Generated ca certificate and key.
[certificates] Generated apiserver certificate and key.
[certificates] apiserver serving cert is signed for DNS names [kubeadm-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.138.0.4]
[certificates] Generated apiserver-kubelet-client certificate and key.
[certificates] Generated sa key and public key.
[certificates] Generated front-proxy-ca certificate and key.
[certificates] Generated front-proxy-client certificate and key.
[certificates] Valid certificates and keys now exist in "/etc/kubernetes/pki"
[kubeconfig] Wrote KubeConfig file to disk: "admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "kubelet.conf"
[kubeconfig] Wrote KubeConfig file to disk: "controller-manager.conf"
[kubeconfig] Wrote KubeConfig file to disk: "scheduler.conf"
[controlplane] Wrote Static Pod manifest for component kube-apiserver to "/etc/kubernetes/manifests/kube-apiserver.yaml"
[controlplane] Wrote Static Pod manifest for component kube-controller-manager to "/etc/kubernetes/manifests/kube-controller-manager.yaml"
[controlplane] Wrote Static Pod manifest for component kube-scheduler to "/etc/kubernetes/manifests/kube-scheduler.yaml"
[etcd] Wrote Static Pod manifest for a local etcd instance to "/etc/kubernetes/manifests/etcd.yaml"
[init] Waiting for the kubelet to boot up the control plane as Static Pods from directory "/etc/kubernetes/manifests"
[init] This often takes around a minute; or longer if the control plane images have to be pulled.
[apiclient] All control plane components are healthy after 39.511972 seconds
[uploadconfig] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[markmaster] Will mark node master as master by adding a label and a taint
[markmaster] Master master tainted and labelled with key/value: node-role.kubernetes.io/master=""
[bootstraptoken] Using token: <token>
[bootstraptoken] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstraptoken] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstraptoken] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[addons] Applied essential addon: kube-dns
[addons] Applied essential addon: kube-proxy

Your Kubernetes master has initialized successfully!

To start using your cluster, you need to run (as a regular user):

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  http://kubernetes.io/docs/admin/addons/

You can now join any number of machines by running the following on each node
as root:

  kubeadm join --token <token> <master-ip>:<master-port> --discovery-token-ca-cert-hash sha256:<hash>

把上面输出的最后一行 kubeadm join复制保存下来，后面在node节点加入到集群中需要用到

运行下面的命令初始化kebectl配置文件

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

    8.安装网络插件，以使pod能相互通讯，这里我们安装的是Calico.在master节点运行

kubectl apply -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/kubeadm/1.7/calico.yaml

运行以下命令检查kube-dns pod 已经运行，一般需要几十秒

kubectl get pods --all-namespaces

如果输出中有名字以kube-dns的pod状态是Running，说明网络插件已经正常工作，然后就可以把node节点加入到集群

[root@kube-master ~]# kubectl get pods --all-namespaces
NAMESPACE     NAME                                      READY     STATUS    RESTARTS   AGE
kube-system   calico-etcd-dfpnn                         1/1       Running   0          13h
kube-system   calico-kube-controllers-5449fdfcd-z8n45   1/1       Running   0          13h
kube-system   calico-node-8jmzt                         2/2       Running   0          13h
kube-system   calico-node-b4x99                         2/2       Running   0          13h
kube-system   etcd-kube-master                          1/1       Running   0          13h
kube-system   kube-apiserver-kube-master                1/1       Running   0          13h
kube-system   kube-controller-manager-kube-master       1/1       Running   0          13h
kube-system   kube-dns-86f4d74b45-v6qr5                 3/3       Running   0          14h
kube-system   kube-proxy-8nl2w                          1/1       Running   0          13h
kube-system   kube-proxy-klnjb                          1/1       Running   0          14h
kube-system   kube-scheduler-kube-master                1/1       Running   0          13h

    9.使pod能运行在master上，在master运行如下命令。否则k8s不会调度非系统pod到master节点上

kubectl taint nodes --all node-role.kubernetes.io/master-

    10.kube-dns运行后加入node节点，在node节点运行第7步保存的kubeadm join，类似下面的语句。

kubeadm join --token <token> <master-ip>:<master-port> --discovery-token-ca-cert-hash sha256:<hash>

如果成功，输出类似下面

[preflight] Running pre-flight checks
[discovery] Trying to connect to API Server "10.138.0.4:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://10.138.0.4:6443"
[discovery] Requesting info from "https://10.138.0.4:6443" again to validate TLS against the pinned public key
[discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "10.138.0.4:6443"
[discovery] Successfully established connection with API Server "10.138.0.4:6443"
[bootstrap] Detected server version: v1.8.0
[bootstrap] The server supports the Certificates API (certificates.k8s.io/v1beta1)
[csr] Created API client to obtain unique certificate for this node, generating keys and certificate signing request
[csr] Received signed certificate from the API server, generating KubeConfig...

Node join complete:
* Certificate signing request sent to master and response
  received.
* Kubelet informed of new secure connection details.

Run 'kubectl get nodes' on the master to see this machine join.

    11.验证node成功加入集群， 在master命令行运行

kubectl get node

如果集群正常运行，输出类似

NAME          STATUS    ROLES     AGE       VERSION
kube-master   Ready     master    1h        v1.10.0
kube-node     Ready     <none>    2m        v1.10.0

恭喜你，已经拥有了一个可用的k8s集群！