kubeadm部署k8s

kubeadm部署

环境准备

配置主机

[root@2020-yan ~]# cat /etc/hosts
127.0.0.1 VM-0-9-centos VM-0-9-centos
127.0.0.1 localhost.localdomain localhost
127.0.0.1 localhost4.localdomain4 localhost4
172.21.0.9 yoxiaoxi
::1 VM-0-9-centos VM-0-9-centos
::1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6

yum源配置

[root@2020-yan ~]# cat /etc/yum.repos.d/kubernetes.repo 
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

关闭swap

#暂时关闭
swapoff -a
#永久关闭
sed -ri 's/.*swap.*/#&/' /etc/fstab

关闭selinux

#临时关闭
setenforce 0
#永久关闭
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config 

关闭防火墙

systemctl stop firewalld &&systemctl disable firewalld

配置内核参数

配置内核参数，将桥接的IPv4、IPv6流量传递到iptables的链

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1

部署docker

yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install docker-ce docker-ce-cli containerd.io

修改docker驱动

[root@2020-yan cron]# cat /etc/docker/daemon.json
{
  "exec-opts":["native.cgroupdriver=systemd"],
}

重启docker

systemctl daemon-reload && systemctl restart docker && systemctl enable docker

安装ipvs

yum -y install ipvsadm  ipset
#ipvsadm管理工具
#ipset每个节点都需要部署
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4

安装kubelet、kubeadm、kubectl

添加yum源

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

安装

yum install kubectl-1.18.10 kubelet-1.18.10 kubeadm-1.18.10

查看初始化配置

kubeadm config print init-defaults > kubeadm.yaml

查看配置文件内容

apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 172.21.0.9
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: yoxiaoxi
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.18.10
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
  podSubnet: 10.243.0.0/16
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs 

修改kube-proxy路由规则为ipvs

初始化集群

• 使用配置文件

kubeadm init --config=kubeadm.yaml

• 使用配置

kubeadm init --kubernetes-version=1.18.10  \
--apiserver-advertise-address=172.21.0.9   \
--image-repository registry.aliyuncs.com/google_containers  \
--service-cidr=10.10.0.0/16 --pod-network-cidr=10.244.0.0/16

配置kubeconfig

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

配置kubectl自动补齐

source <(kubectl completion bash)
echo "source <(kubectl completion bash)" >> ~/.bashrc

检查集群状态

#查看node
kubectl get node 
#查看pod
kubectl get pod -nkube-system
#查看组件状态

节点状态为NotReady

node节点为NotReady，因为corednspod没有启动，缺少网络pod

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

controller、scheduler组件Unhealthy

应为禁用了非安全端口

cat /etc/kubernetes/manifests/kube-controller-manager.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-controller-manager
    tier: control-plane
  name: kube-controller-manager
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-controller-manager
    - --allocate-node-cidrs=true
    - --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
    - --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf
    - --bind-address=127.0.0.1
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --cluster-cidr=10.244.0.0/16
    - --cluster-name=kubernetes
    - --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt
    - --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
    - --controllers=*,bootstrapsigner,tokencleaner
    - --kubeconfig=/etc/kubernetes/controller-manager.conf
    - --leader-elect=true
    - --node-cidr-mask-size=24
    #- --port=0 #开启端口即可

master调度设置

#出于安全考虑，默认配置下Kubernetes不会将Pod调度到Master节点。如果希望将k8s-master也当作Node使用
kubectl taint node k8s-master node-role.kubernetes.io/master-
#其中k8s-master是主机节点hostname如果要恢复Master Only状态
kubectl taint node k8s-master node-role.kubernetes.io/master=""