k8s 安装

K8S集群安装

设置hostname

sudo hostnamectl set-hostname master-node

sudo hostnamectl set-hostname node1

sudo hostnamectl set-hostname node2

sudo cat <<EOF>> /etc/hosts
192.168.164.11 master-node
192.168.164.12 node1
192.168.164.13 node2
EOF

关闭selinux

sudo setenforce 0
sudo sed -i --follow-symlinks 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux

它叫做“安全增强型 Linux（Security-Enhanced Linux）”，简称 SELinux，它是 Linux 的一个安全子系统

其主要作用就是最大限度地减小系统中服务进程可访问的资源（根据的是最小权限原则）。避免权限过大的角色给系统带来灾难性的结果。

关闭防火墙

systemctl disable firewalld
systemctl stop firewalld

开启桥接

cat <<EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system

设置ipvs clusterip 才可以访问

cat > /etc/sysconfig/modules/ipvs.modules <<EOF
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF

关闭系统交换区

sudo sed -i '/swap/d' /etc/fstab
sudo swapoff -a

Linux swapoff命令用于关闭系统交换区(swap area)

重启

reboot

安装docker

sudo yum check-update

sudo yum install -y yum-utils device-mapper-persistent-data lvm2

sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

sudo yum install docker-ce

sudo systemctl start docker

sudo systemctl enable docker

sudo systemctl status docker

安装kubelet

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

sudo yum install -y kubelet

sudo systemctl enable --now kubelet

安装kubeadm

sudo yum install -y kubeadm

### 由于k8s.gcr.io 需要连外网才可以拉取到，导致 k8s 的基础容器 pause 经常无法获取。k8s docker 可使用代理服拉取，再利用 docker tag 解决问题
docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6 k8s.gcr.io/pause:3.6

## 但是我们k8s集群中使用的CRI是containerd。所以只能通过 docker tag 镜像，再使用 ctr 导入镜像.
docker save k8s.gcr.io/pause -o pause.tar
ctr -n k8s.io images import pause.tar

初始化master节点

master执行：
kubeadm init \
--apiserver-advertise-address=192.168.164.11 \
--image-repository registry.aliyuncs.com/google_containers \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16

安装flannel网络插件

master执行：
https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl apply -f kube-flannel.yml 

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

获取节点信息

sudo kubectl get nodes

sudo kubectl get pods --all-namespaces -o wide

sudo kubectl get service --all-namespaces -o wide

添加node节点

sudo kubeadm token create --print-join-command

sudo kubectl label node node1 node-role.kubernetes.io/worker=worker

问题排查

kubectl describe pod kube-proxy-sfrsp -n kube-system # 查看为什么无法启动
kubectl logs kube-proxy-sfrsp -n kube-system # 查看为什么无法启动

很大一部分都是由于要FQ导致image如法下载，都可以使用aliyun镜像服务器

# 移除已经添加的节点 Run on Master
# kubectl cordon <node-name>
# kubectl drain <node-name> --force --ignore-daemonsets  --delete-emptydir-data
kubectl drain node2 --force --ignore-daemonsets  --delete-emptydir-data
# kubectl delete node <node-name>
kubectl delete node 

# Run on node
kubeadm reset

安装dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.6.1/aio/deploy/recommended.yaml

kubectl -n kubernetes-dashboard edit service kubernetes-dashboard
type: ClusterIP修改为type: NodePort

https://192.168.164.12:31483/#/workloads?namespace=default

添加用户角色

# dashboard-adminuser.yaml
----
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
----
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

kubectl apply -f dashboard-adminuser.yaml

获取token

kubectl -n kubernetes-dashboard create token admin-user