使用kubeadm部署k8s集群（单节点）
一、准备4台服务器本次部署单masterk8s：（建议服务器配置在2核2G以上，否则会应为配置不够出现部署失败）
1、服务器相关信息
| 操作系统 | IP地址 | 主机名 |
| Linux 3.10.0-957.el7.x86_64 | 192.168.111.158 | k8s-master |
| Linux 3.10.0-957.el7.x86_64 | 192.168.111.159 | k8s-node-01 |
| Linux 3.10.0-957.el7.x86_64 | 192.168.111.160 | k8s-node-02 |
| Linux 3.10.0-957.el7.x86_64 | 192.168.111.162 | k8s-node-03 |
注意：（服务器IP地址一定设置静态IP地址，否则IP地址变化会导致k8s集群异常）
二、修改主机名
hostnamectl set-hostname k8s-master hostnamectl set-hostname k8s-node-01 hostnamectl set-hostname k8s-node-02 hostnamectl set-hostname k8s-node-03
三、关闭防火墙和交互分区以及配置hosts文件（每台服务器都需要设置）
systemctl stop firewalld && systemctl disable firewalld && setenforce 0 sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config swapoff -a && sysctl -w vm.swappiness=0 cat >> /etc/hosts <<EOF 192.168.111.158 k8s-master 192.168.111.159 k8s-node-01 192.168.111.160 k8s-node-02 192.168.111.162 k8s-node-03 EOF
四、优化内核参数：（每台服务器都需要设置）
cat <<EOF > /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 EOF sysctl --system
五、设置 yum repository
yum install -y yum-utils \ device-mapper-persistent-data \ lvm2 下载docker仓库 yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
安装docker：(每台服务器上面都需要安装）
yum -y install docker-ce systemctl start docker # 启动docker systemctl enable docker #设置为开机自启
创建k8s镜像源：（每台服务器都需添加）
cat >>/etc/yum.repos.d/kubernetes.repo <<EOF [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF
六、安装K8S组件（每台服务器都需要安装）
yum install -y kubelet kubeadm kubectlhi systemctl start kubelet && systemctl start kubectl systemctl enable kubelet && systemctl enable kubectl
七、开始初始化master节点（该操作只在master上面执行）
kubeadm init --kubernetes-version=v1.17.0 --apiserver-advertise-address 192.168.111.158 --pod-network-cidr=10.244.0.0/16 相关参数说明：（在国内部署k8s时候，初始化集群会从谷歌拉取相关插件镜像失败）
--image-repository=registry.aliyuncs.com/google_containers #加上阿里云仓库源就可以解决 --kubernetes-version=v1.17.0 # 指定安装k8s版本，如果不指定默认使用最新版本 --apiserver-advertise-address 192.168.111.158 #这里是apiserver的地址，也就master主机IP地址 --pod-network-cidr=10.244.0.0/16# 这个是后期创建pod时候使用IP地址段
初始化完成后会有以下提示说明部署成功：
kubeadm init --apiserver-advertise-address 92.168.111.158 --pod-network-cidr=10.244.0.0/16W0514 01:38:38.881607 16953 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io] [init] Using Kubernetes version: v1.18.2 [preflight] Running pre-flight checks [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/ [preflight] Pulling images required for setting up a Kubernetes cluster [preflight] This might take a minute or two, depending on the speed of your internet connection [preflight] You can also perform this action in beforehand using 'kubeadm config images pull' [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" [kubelet-start] Starting the kubelet [certs] Using certificateDir folder "/etc/kubernetes/pki" [certs] Generating "ca" certificate and key [certs] Generating "apiserver" certificate and key [certs] apiserver serving cert is signed for DNS names [k8s-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.40.132] [certs] Generating "apiserver-kubelet-client" certificate and key [certs] Generating "front-proxy-ca" certificate and key [certs] Generating "front-proxy-client" certificate and key [certs] Generating "etcd/ca" certificate and key [certs] Generating "etcd/server" certificate and key [certs] etcd/server serving cert is signed for DNS names [k8s-master localhost] and IPs [192.168.40.132 127.0.0.1 ::1] [certs] Generating "etcd/peer" certificate and key [certs] etcd/peer serving cert is signed for DNS names [k8s-master localhost] and IPs [192.168.40.132 127.0.0.1 ::1] [certs] Generating "etcd/healthcheck-client" certificate and key [certs] Generating "apiserver-etcd-client" certificate and key [certs] Generating "sa" key and public key [kubeconfig] Using kubeconfig folder "/etc/kubernetes" [kubeconfig] Writing "admin.conf" kubeconfig file [kubeconfig] Writing "kubelet.conf" kubeconfig file [kubeconfig] Writing "controller-manager.conf" kubeconfig file [kubeconfig] Writing "scheduler.conf" kubeconfig file [control-plane] Using manifest folder "/etc/kubernetes/manifests" [control-plane] Creating static Pod manifest for "kube-apiserver" [control-plane] Creating static Pod manifest for "kube-controller-manager" W0514 01:38:43.059512 16953 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC" [control-plane] Creating static Pod manifest for "kube-scheduler" W0514 01:38:43.060586 16953 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC" [etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests" [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s [apiclient] All control plane components are healthy after 14.007312 seconds [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace [kubelet] Creating a ConfigMap "kubelet-config-1.18" in namespace kube-system with the configuration for the kubelets in the cluster [upload-certs] Skipping phase. Please see --upload-certs [mark-control-plane] Marking the node k8s-master as control-plane by adding the label "node-role.kubernetes.io/master=''" [mark-control-plane] Marking the node k8s-master as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule] [bootstrap-token] Using token: dabrve.y72jo4b1e1r25wrq [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster [bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace [kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key [addons] Applied essential addon: CoreDNS [addons] Applied essential addon: kube-proxy Your Kubernetes control-plane has initialized successfully! To start using your cluster, you need to run the following as a regular user: mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config You should now deploy a pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: https://kubernetes.io/docs/concepts/cluster-administration/addons/ Then you can join any number of worker nodes by running the following on each as root: kubeadm join 192.168.111.158:6443 --token dabrve.y72jo4b1e1r25wrq \ --discovery-token-ca-cert-hash sha256:05bc30f3e5b8be2953a79bfa5a8927bd39591fab0c9f4eccb0498706efa9860e
在master上面执行
mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
八、安装网络插件：
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml kubectl apply -f kube-flannel.yml
九、加入集群：（这步在每个node节点上面执行）当初始化完成后会有以下加入节点token信息，需要自己进行保存
kubeadm join 192.168.111.158:6443 --token enbt7c.4fhr7awhq6o8afmj \
--discovery-token-ca-cert-hash sha256:5e543b91ea4130254da47e5706e536e4df53a089f02769e128ad207a166d808a
提示一下信息说明加入成功
root@k8s-node1 ~]# kubeadm join 192.168.111.158:6443 --token dabrve.y72jo4b1e1r25wrq \ > --discovery-token-ca-cert-hash sha256:05bc30f3e5b8be2953a79bfa5a8927bd39591fab0c9f4eccb0498706efa9860e W0514 02:01:11.699023 14855 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set. [preflight] Running pre-flight checks [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/ [preflight] Reading configuration from the cluster... [preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' [kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" [kubelet-start] Starting the kubelet [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap... This node has joined the cluster: * Certificate signing request was sent to apiserver and a response was received. * The Kubelet was informed of the new secure connection details. Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
十、集群加入完成后使用以下命令查看集群是否正常：
[root@k8s-master jenkins-slave-mvnconfig]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master Ready master 160d v1.17.0 k8s-node-01 Ready <none> 160d v1.17.0 k8s-node-02 Ready <none> 160d v1.17.0 k8s-node-03 Ready <none> 160d v1.17.0
以下注意事项：
kubeadm生成的token一般24小时后就过期；所以后面再集群内部加入node需要重新创建新的token；命令如下
1.重新生成新的token
kubeadm token create
2.查看生成的token
kubeadm token list
3.获取ca证书sha256编码hash值
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
相关问题；这里只是举例了自己遇到的问题
如果在初始化master时候出现以下报错；
error execution phase upload-config/kubelet: Error writing Crisocket information for the control-plane node: timed out waiting for the condition
首先你需要将/etc/kubernetes/的所有文件删除
然后在执行：swapoff -a && kubeadm reset && systemctl daemon-reload && systemctl restart kubelet && iptables -F && iptables -t nat -F && iptables -t mangle -F && iptables -X
最后在重新初始化master：
kubeadm init --apiserver-advertise-address=192.168.111.158 --pod-network-cidr=10.244.0.0/16
