0.1.kubeadm快速部署kubernetes
目录
kubeadmin安装Kubernetes
kubeadm是官方社区推出的一个用于快速部署kubernetes集群的工具;使用staticPod(容器)
运行的管理组件,镜像使用gcr.io
域名仓库里的。
这个工具能通过两条指令完成一个kubernetes集群的部署:
# 创建一个 Master 节点
kubeadm init
# 将一个 Node 节点加入到当前集群中
kubeadm join <Master节点的IP和端口 >
1. 安装需求
在开始之前,部署Kubernetes集群机器需要满足以下几个条件:
- 一台或多台机器,操作系统 CentOS7.x-86_x64
- 硬件配置:2GB或更多RAM,2个CPU或更多CPU,硬盘30GB或更多
- 集群中所有机器之间网络互通
- 可以访问外网,需要拉取镜像
- 禁止swap分区
IP | Hostname | 内核 | CPU&Memory | 系统版本 | 备注 |
---|---|---|---|---|---|
192.168.121.81 | k8s-master01 | 4.4.206-1.el7.elrepo.x86_64 | 4C&8M | 7.6.1810 | master |
192.168.121.84 | k8s-node01 | 4.4.206-1.el7.elrepo.x86_64 | 4C&8M | 7.6.1810 | node |
192.168.121.85 | k8s-node02 | 4.4.206-1.el7.elrepo.x86_64 | 4C&8M | 7.6.1810 | node |
2. 准备环境
关闭防火墙:
# systemctl stop firewalld
# systemctl disable firewalld
关闭selinux:
# sed -i 's/enforcing/disabled/' /etc/selinux/config
# setenforce 0
关闭swap:
# swapoff -a # 临时
# vim /etc/fstab # 永久
添加主机名与IP对应关系):
# cat /etc/hosts
192.168.121.81 k8s-master
192.168.121.83 k8s-node1
192.168.121.84 k8s-node2
设置主机名:
# hostnamectl set-hostname k8s-master
将桥接的IPv4流量传递到iptables的链:
# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
# sysctl --system
3. 所有节点安装Docker/kubeadm/kubelet
Kubernetes默认CRI(容器运行时)为Docker,因此先安装Docker。
3.1 安装Docker
每台机器上安装Docker,建议使用18.09版本。
# wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
# yum list docker-ce --showduplicates | sort -r
# yum -y install docker-ce-18.09.9-3.el7
设置cgroup驱动,推荐systemd:
# mkdir -p /etc/docker
cat > /etc/docker/daemon.json <<EOF
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn","http://f1361db2.m.daocloud.io"],
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {"max-size": "100m"},
"storage-driver": "overlay2"
}
EOF
# systemctl enable docker
# systemctl start docker
镜像下载加速:
curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
查看docker镜像
]# docker --version
Docker version 18.09.9, build 039a7df9ba
3.2 添加阿里云YUM软件源
# cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
3.3 安装kubeadm,kubelet和kubectl
由于版本更新频繁,这里指定版本号部署:
# yum install -y kubelet-1.16.4 kubeadm-1.16.4 kubectl-1.16.4
# systemctl enable kubelet
4. 部署Kubernetes Master
在192.168.121.81(Master)执行。
# kubeadm init \
--apiserver-advertise-address=192.168.121.81 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.16.4 \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16
初始化成功
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.121.81:6443 --token jm4n7o.y0sggj3wr84xun46 \
--discovery-token-ca-cert-hash sha256:2db19d5005a1aca7b5a3e28b042686d4a48508b5578c412a90c281a17ec40cc0
由于默认拉取镜像地址k8s.gcr.io国内无法访问,这里指定阿里云镜像仓库地址。
使用kubectl工具
mkdir -p #HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf #HOME/.kube/config
sudo chown #(id -u):#(id -g) #HOME/.kube/config
#未部署网络插件;STATUS为NotReady
# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master01 NotReady master 2m19s v1.16.4
5. 安装Pod网络插件(CNI)
# kubectl apply -f kube-flannel.yml
# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-58cc8c89f4-t2znf 1/1 Running 0 6m1s
etcd-k8s-master01 1/1 Running 0 5m9s
kube-apiserver-k8s-master01 1/1 Running 0 5m17s
kube-controller-manager-k8s-master01 1/1 Running 0 5m10s
kube-flannel-ds-amd64-sx2s4 1/1 Running 0 30s
kube-proxy-7jkq9 1/1 Running 0 6m1s
kube-scheduler-k8s-master01 1/1 Running 0 5m
确保能够访问到quay.io这个registery。
6. 加入Kubernetes Node
在192.168.121.84/85(Node)执行。
向集群添加新节点,执行在kubeadm init输出的kubeadm join命令:
# kubeadm join 192.168.121.81:6443 --token jm4n7o.y0sggj3wr84xun46 \
--discovery-token-ca-cert-hash sha256:2db19d5005a1aca7b5a3e28b042686d4a48508b5578c412a90c281a17ec40cc0
默认token有效期为24小时,当过期之后,该token就不可用了。这时就需要重新创建token,操作如下:
# kubeadm token create
# kubeadm token list
# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
0b638f15e347a66a950c5a3f758e11b3f218dd0d4c2548c81d67c7933037a9fc
# kubeadm join 192.168.121.81:6443 --discovery-token vy90bp.rw79ncl4ir0pw3cb --discovery-token-ca-cert-hash sha256:0b638f15e347a66a950c5a3f758e11b3f218dd0d4c2548c81d67c7933037a9fc
https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-join/
7. 测试kubernetes集群
在Kubernetes集群中创建一个pod,验证是否正常运行:
# kubectl create deployment nginx --image=nginx
# kubectl expose deployment nginx --port=80 --type=NodePort
# kubectl get pod,svc
访问地址:http://NodeIP:Port
8. 部署 Dashboard
# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml
# kubectl apply -f recommended.yaml
# sed -i '/targetPort: 8443/a\ \ \ \ \ \ nodePort: 30001\n\ \ type: NodePort' recommended.yaml
# kubectl get pods -n kubernetes-dashboard
访问地址:http://NodeIP:30001
创建service account并绑定默认cluster-admin管理员集群角色:
# kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard
# kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin
# kubectl describe secrets -n kubernetes-dashboard $(kubectl -n kubernetes-dashboard get secret | awk '/dashboard-admin/{print $1}')
浏览器输入地址:http://NodeIP:30001
![https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114509788-1179520934.png](https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114509788-1179520934.png)
![https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114516174-36806865.png](https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114516174-36806865.png)
![https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114523885-258194300.png](https://img2020.cnblogs.com/blog/1363565/202005/1363565-20200518114523885-258194300.png)
使用输出的token登录Dashboard。