K8S构建1台master2台node+Harbor
部署环境:
master、node:centos7虚拟机
网络使用本地网卡共享到VMnet1(仅主机),虚拟机使用VMnet1。
准备文件:
CentOS-7-x86_64-Minimal-1810.iso
kubeadm-basic.images.tar.gz
网卡配置:
VMnet1配置:
vmware网络配置:
关闭DHCP,网段改为192.168.66.0
master、node虚拟机配置:
安装过程略过,最小化安装,全部默认,设置root密码。
master01网络配置
node01 192.168.66.20
node02 192.168.66.21
设置主机名:
master01\node01\node02:
hostnamectl set-hostname master01
hostnamectl set-hostname node01
hostnamectl set-hostname node02
各节点配置:
hosts:
echo "192.168.66.10 master01
192.168.66.20 node01
192.168.66.21 node02" >> /etc/hosts
安装依赖包:
yum install -y conntrack ntpdate ntp ipvsadm ipset jq iptables curl sysstat libseccomp wget vim net-tools git
设置防火墙为 Iptables 并设置空规则
systemctl stop firewalld && systemctl disable firewalld
yum -y install iptables-services && systemctl start iptables && systemctl enable iptables && iptables -F && service iptables save
关闭swap
swapoff -a && sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
关闭selinux
setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
调整内核参数,对于 K8S
cat > kubernetes.conf <<EOF
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0 # 禁止使用 swap 空间,只有当系统 OOM 时才允许使用它
vm.overcommit_memory=1 # 不检查物理内存是否够用
vm.panic_on_oom=0 # 开启 OOM
fs.inotify.max_user_instances=8192
fs.inotify.max_user_watches=1048576
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF
cp kubernetes.conf /etc/sysctl.d/kubernetes.conf
sysctl -p /etc/sysctl.d/kubernetes.conf
# 设置系统时区为 中国/上海
timedatectl set-timezone Asia/Shanghai
# 将当前的 UTC 时间写入硬件时钟
timedatectl set-local-rtc 0
# 重启依赖于系统时间的服务
systemctl restart rsyslog
systemctl restart crond
关闭系统不需要服务
systemctl stop postfix && systemctl disable postfix
设置 rsyslogd 和 systemd journald
mkdir /var/log/journal
# 持久化保存日志的目录
mkdir /etc/systemd/journald.conf.d
cat > /etc/systemd/journald.conf.d/99-prophet.conf <<EOF
[Journal]
# 持久化保存到磁盘
Storage=persistent
# 压缩历史日志
Compress=yes
SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000
# 最大占用空间 10G
SystemMaxUse=10G
# 单日志文件最大 200M
SystemMaxFileSize=200M
# 日志保存时间 2 周
MaxRetentionSec=2week
# 不将日志转发到 syslog
ForwardToSyslog=no
EOF
uname -r
systemctl restart systemd-journald
升级系统内核为 4.44
CentOS 7.x 系统自带的 3.10.x 内核存在一些 Bugs,导致运行的 Docker、Kubernetes 不稳定,例如:
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
# 安装完成后检查 /boot/grub2/grub.cfg 中对应内核 menuentry 中是否包含 initrd16 配置,如果没有,再安装 一次!
yum --enablerepo=elrepo-kernel install -y kernel-lt
cat /etc/grub2.cfg
# 设置开机从新内核启动
grub2-set-default 'CentOS Linux (4.4.243-1.el7.elrepo.x86_64) 7 (Core)'
rebo
uname -r
升级成功
kube-proxy开启ipvs的前置条件
modprobe br_netfilter
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4
安装 Docker 软件
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager \
--add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum update -y && yum install -y docker-ce
uname -r
rebo
uname -r
grub2-set-default 'CentOS Linux (4.4.243-1.el7.elrepo.x86_64) 7 (Core)'
rebo
uname -r
systemctl start docker
systemcel enable docker
## 创建 /etc/docker 目录
#mkdir /etc/docker
# 配置 daemon.
cat > /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
}
}
EOF
mkdir -p /etc/systemd/system/docker.service.d
# 重启docker服务
systemctl daemon-reload && systemctl restart docker && systemctl enable docker
安装 Kubeadm (主从配置)
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum -y install kubeadm-1.15.1 kubectl-1.15.1 kubelet-1.15.1
systemctl enable kubelet.service
导入kubeadm-basic.images.tar.gz 到 /root
vi /root/load-images.sh
#!/bin/bash
cd /root
tar xzvf kubeadm-basic.images.tar.gz
ls /root/kubeadm-basic.images > /tmp/image-list.txt
cd /root/kubeadm-basic.images
for i in $( cat /tmp/image-list.txt )
do
docker load -i $i
done
rm -rf /tmp/image-list.txt
scp -r kubeadm-basic.images.tar.gz load-images.sh root@node01:/root/
scp -r kubeadm-basic.images.tar.gz load-images.sh root@node02:/root/
sh load-images.sh
初始化主节点
kubeadm config print init-defaults > kubeadm-config.yaml
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 192.168.66.10
bindPort: 6443
nodeRegistration:
criSocket: /var/run/dockershim.sock
name: master01
taints:
- effect: NoSchedule
key: node-role.kubernetes.io/master
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
type: CoreDNS
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: k8s.gcr.io
kind: ClusterConfiguration
kubernetesVersion: v1.15.1
networking:
dnsDomain: cluster.local
podSubnet: "10.244.0.0/16"
serviceSubnet: 10.96.0.0/12
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
featureGates:
SupportIPVSProxyMode: true
mode: ipvs
kubeadm init --config=kubeadm-config.yaml --experimental-upload-certs | tee kubeadm-init.log
加入主节点以及其余工作节点
执行安装日志中的加入命令即可
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
kubectl get node
mkdir -p install-k8s/core/pluginflannel
mv kubeadm-init.log kubeadm-config.yaml install-k8s/core/
cd install-k8s/core/pluginflannel
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
echo "151.101.76.133 raw.githubusercontent.com" >> /etc/hosts
kubectl create -f kube-flannel.yml
kubectl get pod -n kube-system
等待
kubectl get node
cat /root/install-k8s/core/kubeadm-init.log
最后一行复制到其它节点执行
kubeadm join 192.168.66.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:ad7a47f32e31817c0544708e380ddf55909542517280ac0abc74aac378795423
kubectl get node
kubectl get pod -n kube-system
kubectl get pod -n kube-system -o wide
等待全run
kubectl get pod -n kube-system -o wide -w
https://www.bilibili.com/video/BV1w4411y7Go?p=10
主机名不一致是因为之前测试环境是笔记本现在在台式机
+Harbor:
主机名:hostnamectl set-hostname hub
需要互相添加hosts
其他配置相同,主机名:hub
IP:192.168.66.100
yum install -y conntrack ntpdate ntp ipvsadm ipset jq iptables curl sysstat libseccomp wget vim net-tools git
systemctl stop firewalld && systemctl disable firewalld
yum -y install iptables-services && systemctl start iptables && systemctl enable iptables && iptables -F && service iptables save
swapoff -a && sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
cat > kubernetes.conf <<EOF
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0 # 禁止使用 swap 空间,只有当系统 OOM 时才允许使用它
vm.overcommit_memory=1 # 不检查物理内存是否够用
vm.panic_on_oom=0 # 开启 OOM
fs.inotify.max_user_instances=8192
fs.inotify.max_user_watches=1048576
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF
cp kubernetes.conf /etc/sysctl.d/kubernetes.conf
sysctl -p /etc/sysctl.d/kubernetes.conf
timedatectl set-timezone Asia/Shanghai
timedatectl set-local-rtc 0
systemctl restart rsyslog
systemctl restart crond
systemctl stop postfix && systemctl disable postfix
mkdir /var/log/journal
mkdir /etc/systemd/journald.conf.d
cat > /etc/systemd/journald.conf.d/99-prophet.conf <<EOF
[Journal]
45 Storage=persistent
Compress=yes
SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000
SystemMaxUse=10G
SystemMaxFileSize=200M
MaxRetentionSec=2week
ForwardToSyslog=no
EOF
systemctl restart systemd-journald
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
yum --enablerepo=elrepo-kernel install -y kernel-lt
cat /etc/grub2.cfg | grep "4.4"
grub2-set-default 'CentOS Linux (4.4.243-1.el7.elrepo.x86_64) 7 (Core)'
uname -r
reboot
uname -r
modprobe br_netfilter
cat > /etc/sysconfig/modules/ipvs.modules <<EOF modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum update -y && yum install -y docker-ce
reboot
uname -r
grub2-set-default 'CentOS Linux (4.4.243-1.el7.elrepo.x86_64) 7 (Core)' && reboot
uname -r
systemctl start docker
systemctl enable docker
cat > /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"insecure-registries": ["https://hub.yyq.com"]
}
EOF
各节点都需要添加
systemctl restart docker
导入 docker-compose
harbor-offline-installer-v1.2.0.tgz
yum -y install lrzsz
mv docker-compose /usr/local/bin/
chmod a+x /usr/local/bin/docker-compose
tar xzvf harbor-offline-installer-v1.2.0.tgz
mv harbor /usr/local
cd /usr/local/harbor
vi harbor.cfg
hostname = hub.yyq.com
ui_url_protocol = https
db_password = root123
ssl_cert = /data/cert/server.crt
ssl_cert_key = /data/cert/server.key
clair_db_password = password
harbor_admin_password = Harbor12345
mkdir -p /data/cert/
cd /data/cert/
创建 https 证书以及配置相关目录权限
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
chmod a+x *
cd -
ls
./install.sh
docker ps -a
使用PC浏览器访问hub.yyq.com
使用node节点访问
docker login https://hub.yyq.com
随便下载一个镜像
docker run -d --name nginx01 -p:3344:80 nginx
docker tag nginx hub.yyq.com/library/mynginx:v1
[root@k8s-node01 ~]# docker push hub.yyq.com/library/mynginx:v1
The push refers to repository [hub.yyq.com/library/mynginx]
7b5417cae114: Pushed
aee208b6ccfb: Pushed
2f57e21e4365: Pushed
2baf69a23d7a: Pushed
d0fe97fa8b8c: Pushed
v1: digest: sha256:34f3f875e745861ff8a37552ed7eb4b673544d2c56c7cc58f9a9bec5b4b3530e size: 1362
测试通过
docker stop fb469ac8ff40
docker rmi -f hub.yyq.com/library/mynginx:v1
docker rmi -f nginx
继续测试:
master节点
kubectl run nginx-deployment --image=hub.yyq.com/library/mynginx:v1 --port=80 --replicas=1
kubectl get deployment
kubectl get rs
kubectl get pod
kubectl get pod -o wide
history
发现在node1上运行
访问curl 10.244.1.2
get pod
delete pod nginx-deployment-78c96968df-7wrmv
get pod
之前启动pod设置的replicas=1 副本数量=1 删除后会自己马上运行一个新的,保持副本数。
调整副本数为3个
kubectl get deployment
kubectl scale --replicas=3 deployment/nginx-deployment
kubectl get pod
任意删除1个,查看效果
发现k8s继续创建一个新的,维持副本数
kubectl expose --help
kubectl get deployment
kubectl expose deployment nginx-deployment --port=30000 --target-port=80
80是刚才kubectl run设置的端口 30000是为svc设置的端口
kubectl get svc
curl 10.99.244.170:30000
测试通过
查看轮询规则
ipvsadm -Ln
调整 svc配置供外部访问
kubectl get svc
kubectl edit svc nginx-deployment
调整type: NodePort
验证: