Kubeadm部署 （2）完整搭建
$ wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
$ yum -y install epel-release
$ mkdir -p $HOME/.kube
$ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
$ sudo chown $(id -u):$(id -g) $HOME/.kube/config
$ kubeadm join 10.0.0.106:6443 --token pks66v.aqzuj7t3i4wbcezs \
--discovery-token-ca-cert-hash sha256:5b4d6d1ac4edb87676b185feefeee0aa6af3fae7c9d4018a770de34c43b0a613
验证节点是否加入集群：
$ kubectl get nodes
5.安装pod网络插件CNI-flannel（仅在Master执行）
#下面文本中蓝色备注的内容请删除，另外复制内容到vim中如出现大量乱码现象，请先执行" : set paste "执行后在粘贴。
截图示例：
下载官方yml文件，可能网络连接不上，那么手动写一个吧。
$ wget https://raw.githubusercontent.com/coreos/flannel/a70459be0084506e4ec919aa1c114638878db11b/Documentation/kube-flannel.yml
$ vim kube-flannel.yaml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unsed in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: flannel
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: flannel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flannel
subjects:
- kind: ServiceAccount
name: flannel
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: flannel
namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
name: kube-flannel-cfg
namespace: kube-system
labels:
tier: node
app: flannel
data:
cni-conf.json: |
{
"cniVersion": "0.2.0",
"name": "cbr0",
"plugins": [
{
"type": "flannel",
"delegate": {
"hairpinMode": true,
"isDefaultGateway": true
}
},
{
"type": "portmap",
"capabilities": {
"portMappings": true
}
}
]
}
net-conf.json: |
{
"Network": "10.89.0.0/16", #这里使用之前自定义的pod网络段地址
"Backend": {
"Type": "vxlan"
}
}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds-amd64
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: In
values:
- linux
- key: beta.kubernetes.io/arch
operator: In
values:
- amd64
hostNetwork: true
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: lizhenliang/flannel:v0.11.0-amd64 #官方源因网络愿意无法下载镜像，这里写入国内大神的仓库地址。
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: lizhenliang/flannel:v0.11.0-amd64 #官方源因网络愿意无法下载镜像，这里写入国内大神的仓库地址。
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
排错：
两条排错命令如下
$ kubectl describe pod 你的pod名称 -n kube-system
$ kubectl logs -f 你的pod名称 -n kube-system
如图镜像拉取失败。
解决方法：
①手动pull镜像
$ docker pull lizhenliang/flannel:v0.11.0-amd64
----------------------------------------------------------------------------------------------------------------------------
1.1）我这里没能pull下来，提示dns问题，原本用的阿里dns地址，换成电信的
$ vim /etc/sysconfig/network-scripts/ifcfg-ens33
114.114.114.114 好像更好，后面拉取dashboard镜像，使用这个dns地址很快就拉取下来了。
$systemctl restart network
1.2）还是没能pull下来，更换docker加速器，换成清华源
注意第一和第二行末尾的逗号要加逗号，记得删除蓝色注释内容。
$ vim /etc/docker/daemon.json
{
"registry-mirrors":["https://docker.mirrors.ustc.edu.cn"], #这里由原来的网易云换成清华源
"exec-opts":["native.cgroupdriver=systemd"],
"insecure-registries":["10.0.0.106:5000"] #这里写自己仓库的地址
}
$ systemctl daemon-reload
$ systemctl restart docker
----------------------------------------------------------------------------------------------------------------------------
②打标签
$ docker tag lizhenliang/flannel:v0.11.0-amd64 10.0.0.106:5000/flannel:v0.11.0
③下载仓库镜像
$ docker pull registry
④启动仓库
$ docker run -d -p 5000:5000 --restart=always --name youxiaoqing-registry -v /opt/registry:/var/lib/registry registry
⑤推送到仓库
$ scp /etc/docker/daemon.json 10.0.0.107:/etc/docker/
$ scp /etc/docker/daemon.json 10.0.0.108:/etc/docker/
$ systemctl daemon-reload
$ systemctl restart docker
⑦ vim kube-flannel.yaml
八 删除原来的pod，重新创建新的pod。
$ kubectl delete -f kube-flannel.yaml
$ kubectl create -f kube-flannel.yaml
$ kubectl get pod -n kube-system
flannel容器正常running
节点正常ready
$ kubectl get nodes
