kubeadm 双节点部署k8s v1.13.3+calico v3.3.4
一、部署环境
- VMware Workstation 10
- centos7
二、主机配置(每台主机都要做)
主机名 | ip | cpu | ram |
master | 192.168.137.10 | 2 | 3G |
node1 | 192.168.137.11 | 1 | 3G |
1、每台主机在 /etc/hosts 添加以下内容:
2、关闭防火墙、selinux、swap
systemctl stop firewalld
systemctl disable firewalld
修改:vim /etc/selinux/config
swapoff -a sed -i 's/.*swap.*/#&/' /etc/fstab
3、对2台主机进行免密设置
1)、CentOS7默认没有启动ssh无密登录,去掉/etc/ssh/sshd_config其中1行的注释,每台服务器都要设置
#PubkeyAuthentication yes
然后重启ssh服务
systemctl restart sshd
2)、在master机器的/root执行:ssh-keygen -t rsa命令,一直按回车。2台机器都要执行。
[root@master ~]# ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Created directory '/root/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:aMUO8b/EkylqTMb9+71ePnQv0CWQohsaMeAbMH+t87M root@master The key's randomart image is: +---[RSA 2048]----+ | o ... . | | = o= . o | | + oo=. . . | | =.Boo o . .| | . OoSoB . o | | =.+.+ o. ...| | + o o .. +| | . o . ..+.| | E ....+oo| +----[SHA256]-----+
3)、在master上合并公钥到authorized_keys文件
[root@master ~]# cd /root/.ssh/
[root@master .ssh]# cat id_rsa.pub>> authorized_keys
4)、将master的authorized_keys复制到node1和node2节点
scp /root/.ssh/authorized_keys root@192.168.137.11:/root/.ssh/
测试,master上可以用ip免密直接登录,但是用名字还需要输入一次yes,输入一次之后以后就可以了
[root@master]# ssh master The authenticity of host 'master (192.168.137.10)' can't be established. ECDSA key fingerprint is 5c:c6:69:04:26:65:40:7c:d0:c6:24:8d:ff:bd:5f:ef. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'master,192.168.137.10' (ECDSA) to the list of known hosts. Last login: Mon Dec 10 15:34:51 2018 from 192.168.137.1
[root@master]# ssh node1 The authenticity of host 'node1 (192.168.137.11)' can't be established. ECDSA key fingerprint is 8f:73:57:db:d8:3e:9e:22:52:ba:10:7a:6b:aa:5e:e2. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'node1' (ECDSA) to the list of known hosts. Last login: Mon Dec 10 16:25:53 2018 from master
4、加载 modprobe bridge
modprobe bridge
5、配置内核参数
cat > /etc/sysctl.d/k8s.conf <<EOF net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1
vm.swappiness=0 EOF
使文件生效
sysctl -p /etc/sysctl.d/k8s.conf
6、修改Linux 资源配置文件,调高ulimit最大打开数和systemctl管理的服务文件最大打开数
echo "* soft nofile 655360" >> /etc/security/limits.conf echo "* hard nofile 655360" >> /etc/security/limits.conf echo "* soft nproc 655360" >> /etc/security/limits.conf echo "* hard nproc 655360" >> /etc/security/limits.conf echo "* soft memlock unlimited" >> /etc/security/limits.conf echo "* hard memlock unlimited" >> /etc/security/limits.conf echo "DefaultLimitNOFILE=1024000" >> /etc/systemd/system.conf echo "DefaultLimitNPROC=1024000" >> /etc/systemd/system.conf
hard limits自AIX 4.1版本开始引入。hard limits 应由AIX系统管理员设置,只有security组的成员可以将此值增大,用户本身可以减小此限定值,但是其更改将随着该用户从系统退出而失效
soft limits 是AIX核心使用的限制进程对系统资源的使用的上限值。此值可由任何人更改,但不能超出hard limits值。这里要注意的是只有security组的成员可使更改永久生效普通用户的更改在其退出系统后将失效
1)soft nofile和hard nofile示,单个用用户的软限制为1000,硬限制为1200,即表示单用户能打开的最大文件数量为1000,不管它开启多少个shell。
2)soft nproc和hard nproc 单个用户可用的最大进程数量,软限制和硬限制
3)memlock 一个任务锁住的物理内存的最大值(这里设置成无限制)
7、配置国内 yum源地址、epel源地址、Kubernetes源地址
cp -r /etc/yum.repos.d/ /etc/yum-repos-d-bak yum install -y wget rm -rf /etc/yum.repos.d/* wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo wget -O /etc/yum.repos.d/epel-7.repo http://mirrors.aliyun.com/repo/epel-7.repo yum clean all yum makecache
cat <<EOF > /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
9、安装其他依赖包
yum install -y conntrack ipvsadm ipset jq sysstat curl iptables libseccomp bash-completion yum-utils device-mapper-persistent-data lvm2 net-tools conntrack-tools vim libtool-ltdl
10、配置时间同步
yum install chrony -y
修改vim /etc/chrony.conf
#server 0.centos.pool.ntp.org iburst #server 1.centos.pool.ntp.org iburst #server 2.centos.pool.ntp.org iburst #server 3.centos.pool.ntp.org iburst server 192.168.137.10 iburst
注释掉原有的server内容,把原有的时钟同步服务设置为master结点上的时钟同步
rm -rf /etc/localtime /usr/share/zoneinfo/Asia/Shanghai /etc/localtime echo 'Asia/Shanghai' >/etc/timezone systemctl enable chronyd.service systemctl start chronyd.service chronyc sources
三、安装docker(2台主机)
1、删除老docker
1)查询已安装的docker
yum list installed | grep docker
2)如果有,就yum remove
3) 删除docker文件
rm -rf /var/lib/docker
2、设置docker yum源
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
3、列出版本
yum list docker-ce --showduplicates | sort -r
4、安装18.06.1版本(注意,最好不要安装最新版本,特别是18.06.3,这个版本会导致后面初始化master的时候报错)
yum install -y docker-ce-18.06.1.ce-3.el7
5、配置镜像加速器和docker数据存放路径
新建:/etc/docker/daemon.json
mkdir -p /etc/docker
cat > /etc/docker/daemon.json <<EOF { "registry-mirrors": ["https://s5klxlmp.mirror.aliyuncs.com"], "graph": "/home/docker-data" } EOF
说明:https://s5klxlmp.mirror.aliyuncs.com 这个地址是登录阿里云后,拿到的
6、启动docker
systemctl daemon-reload
systemctl restart docker
systemctl enable docker
systemctl status docker
如果报以下错误:
[root@node1 ~]# journalctl -xe Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21+08:00" level=info msg="loading plugin "io.containerd.grpc.v1.introspection"..." type=io.containerd.grpc.v1 Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21+08:00" level=info msg=serving... address="/var/run/docker/containerd/docker-containerd-debug.sock" Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21+08:00" level=info msg=serving... address="/var/run/docker/containerd/docker-containerd.sock" Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21+08:00" level=info msg="containerd successfully booted in 0.006065s" Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.620543305+08:00" level=info msg="pickfirstBalancer: HandleSubConnStateChange: 0xc4203c3870, READY" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621314464+08:00" level=info msg="parsed scheme: \"unix\"" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621323002+08:00" level=info msg="scheme \"unix\" not registered, fallback to default scheme" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621345935+08:00" level=info msg="ccResolverWrapper: sending new addresses to cc: [{unix:///var/run/docker/containerd/docker-containerd.sock 0 <nil>}]" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621352865+08:00" level=info msg="ClientConn switching balancer to \"pick_first\"" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621374447+08:00" level=info msg="pickfirstBalancer: HandleSubConnStateChange: 0xc42017e3c0, CONNECTING" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.621481017+08:00" level=info msg="pickfirstBalancer: HandleSubConnStateChange: 0xc42017e3c0, READY" module=grpc Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.629882317+08:00" level=warning msg="Usage of loopback devices is strongly discouraged for production use. Please use `--storage-opt dm.thinpooldev` or use `man dockerd` to refer to dm.thinpooldev section." s Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.775919807+08:00" level=info msg="Creating filesystem xfs on device docker-253:1-201421627-base, mkfs args: [-m crc=0,finobt=0 /dev/mapper/docker-253:1-201421627-base]" storage-driver=devicemapper Mar 04 21:22:21 node1 dockerd[3925]: time="2019-03-04T21:22:21.776837868+08:00" level=info msg="Error while creating filesystem xfs on device docker-253:1-201421627-base: exit status 1" storage-driver=devicemapper Mar 04 21:22:21 node1 dockerd[3925]: Error starting daemon: error initializing graphdriver: exit status 1 Mar 04 21:22:21 node1 systemd[1]: docker.service: main process exited, code=exited, status=1/FAILURE Mar 04 21:22:21 node1 systemd[1]: Failed to start Docker Application Container Engine. -- Subject: Unit docker.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit docker.service has failed. -- -- The result is failed. Mar 04 21:22:21 node1 systemd[1]: Unit docker.service entered failed state. Mar 04 21:22:21 node1 systemd[1]: docker.service failed. Mar 04 21:22:22 node1 systemd[1]: docker.service holdoff time over, scheduling restart. Mar 04 21:22:22 node1 systemd[1]: Stopped Docker Application Container Engine. -- Subject: Unit docker.service has finished shutting down -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit docker.service has finished shutting down. Mar 04 21:22:22 node1 systemd[1]: start request repeated too quickly for docker.service Mar 04 21:22:22 node1 systemd[1]: Failed to start Docker Application Container Engine. -- Subject: Unit docker.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit docker.service has failed. -- -- The result is failed. Mar 04 21:22:22 node1 systemd[1]: Unit docker.service entered failed state. Mar 04 21:22:22 node1 systemd[1]: docker.service failed. Mar 04 21:30:01 node1 systemd[1]: Started Session 6 of user root. -- Subject: Unit session-6.scope has finished start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit session-6.scope has finished starting up. -- -- The start-up result is done. Mar 04 21:30:01 node1 CROND[3961]: (root) CMD (/usr/lib64/sa/sa1 1 1)
那么执行以下语句
yum update xfsprogs -y
systemctl start docker.service
systemctl enable docker.service
systemctl status docker.service
四、安装kubeadm、kubelet、kubectl(2台主机)
yum install -y kubelet-1.13.3 kubeadm-1.13.3 kubectl-1.13.3 --disableexcludes=kubernetes
--disableexcludes 指跳过特定安装包
修改kubelet配置文件
sed -i "s/KUBELET_EXTRA_ARGS=/KUBELET_EXTRA_ARGS=\"--fail-swap-on=false\"/" /etc/sysconfig/kubelet
启动
systemctl enable kubelet
systemctl start kubelet
kubelet 服务会暂时启动不了,先不用管它
五、下载镜像(只在master上执行)
1、生成默认配置
kubeadm config print init-defaults > /root/kubeadm.conf
2、修改 /root/kubeadm.conf,使用国内阿里的imageRepository: registry.aliyuncs.com/google_containers
3、下载镜像
kubeadm config images pull --config /root/kubeadm.conf
[root@master ~]# docker images|grep ali registry.aliyuncs.com/google_containers/kube-proxy v1.13.3 8fa56d18961f 3 months ago 80.2MB registry.aliyuncs.com/google_containers/kube-scheduler v1.13.3 9508b7d8008d 3 months ago 79.6MB registry.aliyuncs.com/google_containers/kube-controller-manager v1.13.3 d82530ead066 3 months ago 146MB registry.aliyuncs.com/google_containers/kube-apiserver v1.13.3 f1ff9b7e3d6e 3 months ago 181MB registry.aliyuncs.com/google_containers/coredns 1.2.6 f59dcacceff4 4 months ago 40MB registry.aliyuncs.com/google_containers/etcd 3.2.24 3cab8e1b9802 5 months ago 220MB registry.aliyuncs.com/google_containers/pause 3.1 da86e6ba6ca1 14 months ago 742kB
tag镜像为k8s.gcr.io的形式
docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.13.3 k8s.gcr.io/kube-proxy:v1.13.3 docker tag registry.aliyuncs.com/google_containers/kube-controller-manager:v1.13.3 k8s.gcr.io/kube-controller-manager:v1.13.3 docker tag registry.aliyuncs.com/google_containers/kube-apiserver:v1.13.3 k8s.gcr.io/kube-apiserver:v1.13.3 docker tag registry.aliyuncs.com/google_containers/kube-scheduler:v1.13.3 k8s.gcr.io/kube-scheduler:v1.13.3 docker tag registry.aliyuncs.com/google_containers/coredns:1.2.6 k8s.gcr.io/coredns:1.2.6 docker tag registry.aliyuncs.com/google_containers/etcd:3.2.24 k8s.gcr.io/etcd:3.2.24
docker tag registry.aliyuncs.com/google_containers/pause:3.1 k8s.gcr.io/pause:3.1
docker rmi -f registry.aliyuncs.com/google_containers/kube-proxy:v1.13.3
docker rmi -f registry.aliyuncs.com/google_containers/kube-controller-manager:v1.13.3
docker rmi -f registry.aliyuncs.com/google_containers/kube-apiserver:v1.13.3
docker rmi -f registry.aliyuncs.com/google_containers/kube-scheduler:v1.13.3
docker rmi -f registry.aliyuncs.com/google_containers/coredns:1.2.6
docker rmi -f registry.aliyuncs.com/google_containers/etcd:3.2.24
docker rmi -f registry.aliyuncs.com/google_containers/pause:3.1
六、部署master(只在master上执行)
1、初始化master节点
kubeadm init --kubernetes-version=v1.13.3 --pod-network-cidr=10.244.0.0/16
可以看到上面部署成功了
2、为了普通用户使用,需要执行下面
mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
3、记住最后的一句语,后面将node加入master的时候用到
kubeadm join 192.168.137.10:6443 --token v6zife.f06w6ub82vsmi0ql --discovery-token-ca-cert-hash sha256:29a613c18f8f9aa655de7f59149757b0ee844ae1a3650e9cdf4875fddc080c76
上面这句,其实也不一定用记住,用下面的方法也可以获得token和hash值
1)获取token
[root@master ~]# kubeadm token list TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS v6zife.f06w6ub82vsmi0ql 23h 2019-03-12T20:49:26Z authentication,signing The default bootstrap token generated by 'kubeadm init'. system:bootstrappers:kubeadm:default-node-token
默认情况下 Token
过期是时间是24小时,如果 Token
过期以后,可以输入以下命令,生成新的 Token
kubeadm token create
2)获取hash值
[root@master ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //' 29a613c18f8f9aa655de7f59149757b0ee844ae1a3650e9cdf4875fddc080c76
4、验证
[root@master ~]# kubectl get pods --all-namespaces NAMESPACE NAME READY STATUS RESTARTS AGE kube-system coredns-78d4cf999f-99fpq 0/1 Pending 0 22m kube-system coredns-78d4cf999f-cz8b6 0/1 Pending 0 22m kube-system etcd-master 1/1 Running 0 21m kube-system kube-apiserver-master 1/1 Running 0 21m kube-system kube-controller-manager-master 1/1 Running 0 21m kube-system kube-proxy-56pxn 1/1 Running 0 22m kube-system kube-scheduler-master 1/1 Running 0 21m
发现 coredns pod处于Pending状态,先不管
七、部署calico网络(只在master上执行)
1、下载相关文件
1)下载rbac-kdd.yaml并部署
curl https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml -O
上面的方式下载的文件版本可能是最新的,不一定跟我安装的版本兼容,我将本版本的文件内容粘贴如下:
然后执行:
kubectl apply -f rbac-kdd.yaml
2)下载calico.yaml,并修改配置,然后部署
curl https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/kubernetes-datastore/calico-networking/1.7/calico.yaml -O
修改typha_service_name
calico网络,默认是ipip模式(在每台node主机创建一个tunl0网口,这个隧道链接所有的node容器网络,官网推荐不同的ip网段适合,比如aws的不同区域主机),
修改成BGP模式,它会以daemonset方式安装在所有node主机,每台主机启动一个bird(BGP client),它会将calico网络内的所有node分配的ip段告知集群内的主机,并通过本机的网卡eth0或者ens160转发数据;
修改replicas
修改pod的网段(和第五节的3小节的podSubnet一致)
2、下载calico网络需要的docker镜像,版本可以看calico.yaml里面的
docker pull calico/node:v3.3.4
docker pull calico/cni:v3.3.4
docker pull calico/typha:v3.3.4
3、部署calico.yaml
kubectl apply -f calico.yaml
[root@master ~]# kubectl get po --all-namespaces NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-node-mnzxh 1/2 Running 0 5m51s kube-system calico-typha-64f566d6c9-j4rwc 0/1 Pending 0 5m51s kube-system coredns-86c58d9df4-67xbh 1/1 Running 0 36m kube-system coredns-86c58d9df4-t9xgt 1/1 Running 0 36m kube-system etcd-master 1/1 Running 0 35m kube-system kube-apiserver-master 1/1 Running 0 35m kube-system kube-controller-manager-master 1/1 Running 0 35m kube-system kube-proxy-8xg28 1/1 Running 0 36m kube-system kube-scheduler-master 1/1 Running 0 35m
这里calico-typha 没起来,那是因为我们的node节点还没安装,这里先不管。
八、部署node(只在node节点上执行)
1、下载node需要的镜像
docker pull registry.aliyuncs.com/google_containers/kube-proxy:v1.13.3 docker pull registry.aliyuncs.com/google_containers/pause:3.1 docker pull calico/node:v3.3.4 docker pull calico/cni:v3.3.4 docker pull calico/typha:v3.3.4
2、tag镜像
docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.13.3 k8s.gcr.io/kube-proxy:v1.13.3 docker tag registry.aliyuncs.com/google_containers/pause:3.1 k8s.gcr.io/pause:3.1 docker rmi -f registry.aliyuncs.com/google_containers/kube-proxy:v1.13.3 docker rmi -f registry.aliyuncs.com/google_containers/pause:3.1
3、将node加入集群(命令请看第六大节的第3小节)
kubeadm join 192.168.137.10:6443 --token v6zife.f06w6ub82vsmi0ql --discovery-token-ca-cert-hash sha256:29a613c18f8f9aa655de7f59149757b0ee844ae1a3650e9cdf4875fddc080c76
[root@node1 ~]# kubeadm join 192.168.137.10:6443 --token v6zife.f06w6ub82vsmi0ql --discovery-token-ca-cert-hash sha256:29a613c18f8f9aa655de7f59149757b0ee844ae1a3650e9cdf4875fddc080c76 [preflight] Running pre-flight checks [discovery] Trying to connect to API Server "192.168.137.10:6443" [discovery] Created cluster-info discovery client, requesting info from "https://192.168.137.10:6443" [discovery] Requesting info from "https://192.168.137.10:6443" again to validate TLS against the pinned public key [discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "192.168.137.10:6443" [discovery] Successfully established connection with API Server "192.168.137.10:6443" [join] Reading configuration from the cluster... [join] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' [kubelet] Downloading configuration for the kubelet from the "kubelet-config-1.13" ConfigMap in the kube-system namespace [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" [kubelet-start] Activating the kubelet service [tlsbootstrap] Waiting for the kubelet to perform the TLS Bootstrap... [patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "node1" as an annotation This node has joined the cluster: * Certificate signing request was sent to apiserver and a response was received. * The Kubelet was informed of the new secure connection details. Run 'kubectl get nodes' on the master to see this node join the cluster.
出现上面的信息,表示node加入集群成功,去master执行以下命令:
状态都是Ready,说明集群部署成功了
九、部署 Dashboard(只在master节点上执行)
从版本1.7开始,仪表板不再具有默认授予的完全管理员权限。所有权限都被撤销,并且只授予了使 Dashboard
工作所需的最小权限。
1、部署dashboard之前,我们需要生成证书,不然后面会https访问登录不了。
mkdir -p /etc/kubernetes/certs cd /etc/kubernetes/certs
[root@master certs]# openssl genrsa -des3 -passout pass:x -out dashboard.pass.key 2048 Generating RSA private key, 2048 bit long modulus ......+++ ............+++ e is 65537 (0x10001)
[root@master certs]# openssl rsa -passin pass:x -in dashboard.pass.key -out dashboard.key writing RSA key
下面这步一路回车就可以
[root@master certs]# openssl req -new -key dashboard.key -out dashboard.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]: State or Province Name (full name) []: Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []: Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
[root@master certs]# openssl x509 -req -sha256 -days 365 -in dashboard.csr -signkey dashboard.key -out dashboard.crt Signature ok subject=/C=XX/L=Default City/O=Default Company Ltd Getting Private key
2、创建secret
kubectl create secret generic kubernetes-dashboard-certs --from-file=/etc/kubernetes/certs -n kube-system
3、下载kubernetes-dashboard.yaml
curl https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml -O
4、注释掉kubernetes-dashboard.yaml里面的Secret,因为我们上面自己创建了一个,不需要自带的了
5、修改yaml配置文件image部分,指定镜像从阿里云镜像仓库拉取
镜像:registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
6、修改yaml的service为NodePort方式
7、部署kubernetes-dashboard.yaml
kubectl apply -f kubernetes-dashboard.yaml
查看是否部署成功
查看svc
8、用google浏览器查看
Dashboard 支持 Kubeconfig 和 Token 两种认证方式,我们这里选择Token认证方式登录,为了能用Token登录,我们必须先创建一个叫admin-user的服务账号
1)在master节点上创建 dashboard-adminuser.yaml
apiVersion: v1 kind: ServiceAccount metadata: name: admin-user namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: admin-user roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: admin-user namespace: kube-system
然后执行
kubectl create -f dashboard-adminuser.yaml
说明:上面创建了一个叫admin-user的服务账号,并放在kube-system命名空间下,并将cluster-admin角色绑定到admin-user账户,这样admin-user账户就有了管理员的权限。默认情况下,kubeadm创建集群时已经创建了cluster-admin角色,我们直接绑定即可。
2)查看admin-user账户的token
kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
将上面的token放入浏览器里面的 “令牌”,登录即可
注意:出于安全考虑,默认配置下Kubernetes不会将Pod调度到Master节点。如果希望将k8s-master也当作Node使用,可以执行如下命令:
kubectl taint node master node-role.kubernetes.io/master-
如果要恢复 Master Only 状态,执行如下命令:
kubectl taint node master node-role.kubernetes.io/master="":NoSchedule