安装Kubernetes单Master节点

布满荆棘的人生 2021-10-13 22:28 322阅读 0赞

参考文档： [https://kuboard.cn/install/install-k8s.html][https_kuboard.cn_install_install-k8s.html]

## 一、安装架构图 ##

安装后的拓扑图如下：[下载拓扑图源文件][Link 1]

![image-20190805230643974][]

##  二、安装前准备 ##

### 安装docker ###

将以下代码框中所有内容（包括 \#及其后的备注）一次性拷贝到 centos 命令行终端执行

# 在 master 节点和 worker 节点都要执行
    
    # 卸载旧版本
    sudo yum remove -y docker \
    docker-client \
    docker-client-latest \
    docker-common \
    docker-latest \
    docker-latest-logrotate \
    docker-logrotate \
    docker-selinux \
    docker-engine-selinux \
    docker-engine
    
    # 设置 yum repository
    sudo yum install -y yum-utils \
    device-mapper-persistent-data \
    lvm2
    sudo yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
    
    # 安装并启动 docker
    sudo yum install -y docker-ce-18.09.7 docker-ce-cli-18.09.7 containerd.io
    sudo systemctl enable docker
    sudo systemctl start docker
    
    # 检查 docker 版本
    docker version

> **参考文档**
> 
> https://docs.docker.com/install/linux/docker-ce/centos/
> 
> https://docs.docker.com/install/linux/linux-postinstall/

### 安装 nfs-utils ###

**执行安装命令**

# 在 master 节点和 worker 节点都要执行
    sudo yum install -y nfs-utils

必须先安装 nfs-utils 才能挂载 nfs 网络存储

## 三、开始安装  ##

将以下代码框中所有内容（包括 \#及其后的备注）一次性拷贝到 完成安装脚本install.sh

#!/bin/bash
    # 在 master 节点和 worker 节点都要执行
    
    # 关闭 防火墙
    systemctl stop firewalld
    systemctl disable firewalld
    
    # 关闭 SeLinux
    setenforce 0
    sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
    
    # 关闭 swap
    swapoff -a
    yes | cp /etc/fstab /etc/fstab_bak
    cat /etc/fstab_bak |grep -v swap > /etc/fstab
    
    # 修改 /etc/sysctl.conf
    # 如果有配置，则修改
    sed -i "s#^net.ipv4.ip_forward.*#net.ipv4.ip_forward=1#g"  /etc/sysctl.conf
    sed -i "s#^net.bridge.bridge-nf-call-ip6tables.*#net.bridge.bridge-nf-call-ip6tables=1#g"  /etc/sysctl.conf
    sed -i "s#^net.bridge.bridge-nf-call-iptables.*#net.bridge.bridge-nf-call-iptables=1#g"  /etc/sysctl.conf
    # 可能没有，追加
    echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
    echo "net.bridge.bridge-nf-call-ip6tables = 1" >> /etc/sysctl.conf
    echo "net.bridge.bridge-nf-call-iptables = 1" >> /etc/sysctl.conf
    # 执行命令以应用
    sysctl -p
    
    # 配置K8S的yum源
    cat <<EOF > /etc/yum.repos.d/kubernetes.repo
    [kubernetes]
    name=Kubernetes
    baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
    enabled=1
    gpgcheck=0
    repo_gpgcheck=0
    gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
           http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
    EOF
    
    # 安装kubelet、kubeadm、kubectl
    yum install -y kubelet-1.15.2 kubeadm-1.15.2 kubectl-1.15.2
    
    # 修改docker Cgroup Driver为systemd
    # # 将/usr/lib/systemd/system/docker.service文件中的这一行 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
    # # 修改为 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd
    # 如果不修改，在添加 worker 节点时可能会碰到如下错误
    # [WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". 
    # Please follow the guide at https://kubernetes.io/docs/setup/cri/
    sed -i "s#^ExecStart=/usr/bin/dockerd.*#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd#g" /usr/lib/systemd/system/docker.service
    
    # 设置 docker 镜像，提高 docker 镜像下载速度和稳定性
    # 如果您访问 https://hub.docker.io 速度非常稳定，亦可以跳过这个步骤
    curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
    
    # 重启 docker，并启动 kubelet
    systemctl daemon-reload
    systemctl restart docker
    systemctl enable kubelet && systemctl start kubelet

执行脚本

Complete!
    docker version >= 1.12
    {"registry-mirrors": ["http://f1361db2.m.daocloud.io"],
      "insecure-registries": ["https://reg.server01.com"]
    }
    Success.
    You need to restart docker to take effect: sudo systemctl restart docker 
    Created symlink from /etc/systemd/system/multi-user.target.wants/kubelet.service to /usr/lib/systemd/system/kubelet.service.

看到以上结果说明执行成功，在主从服务器上都执行安装。

## 四、初始化Master节点 ##

*  以 root 身份在 demo-master-a-1 机器上执行
 *  初始化 master 节点时，如果因为中间某些步骤的配置出错，想要重新初始化 master 节点，请先执行 `kubeadm reset` 操作

**配置 apiserver.demo 的域名**

# 只在 master 节点执行
    echo "x.x.x.x  reg.server01.com" >> /etc/hosts

请替换其中的 x.x.x.x 为您的 demo-master-a-1 的实际 ip 地址。（如果 demo-master-a-1 同时有内网IP和外网IP，此处请使用内网IP）

**创建 ./kubeadm-config.yaml**

# 只在 master 节点执行
    cat <<EOF > ./kubeadm-config.yaml
    apiVersion: kubeadm.k8s.io/v1beta1
    kind: ClusterConfiguration
    kubernetesVersion: v1.15.2
    imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
    controlPlaneEndpoint: "reg.server01.com:6443"
    networking:
      podSubnet: "10.100.0.1/20"
    EOF

podSubnet 所使用的网段不能与 ***master节点/worker节点*** 所在的网段重叠

该字段的取值为一个 [CIDR][] 值，如果您对 CIDR 这个概念还不熟悉，请不要修改这个字段的取值 10.100.0.1/20

**初始化 apiserver**

# 只在 master 节点执行
    kubeadm init --config=kubeadm-config.yaml --upload-certs

根据您服务器网速的情况，您需要等候 3 - 10 分钟

执行结果如下所示：

Your Kubernetes control-plane has initialized successfully!
    
    To start using your cluster, you need to run the following as a regular user:
    
      mkdir -p $HOME/.kube
      sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
      sudo chown $(id -u):$(id -g) $HOME/.kube/config
    
    You should now deploy a pod network to the cluster.
    Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
      https://kubernetes.io/docs/concepts/cluster-administration/addons/
    
    You can now join any number of the control-plane node running the following command on each as root:
    
      kubeadm join reg.server01.com:6443 --token 8x0y7t.2gy2z6xycw6bbiw6 \
        --discovery-token-ca-cert-hash sha256:3594228c862aecfb71b79cc1341ef8c062eb478f9d280fb4dd4e10e185ca0fe3 \
        --control-plane --certificate-key d569a1cc280170f8ed7a937cc938445409d82233e1e5cc2ea6abc326d5c80352
    
    Please note that the certificate-key gives access to cluster sensitive data, keep it secret!
    As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use 
    "kubeadm init phase upload-certs --upload-certs" to reload certs afterward.
    
    Then you can join any number of worker nodes by running the following on each as root:
    
    kubeadm join reg.server01.com:6443 --token 8x0y7t.2gy2z6xycw6bbiw6 \
        --discovery-token-ca-cert-hash sha256:3594228c862aecfb71b79cc1341ef8c062eb478f9d280fb4dd4e10e185ca0fe3

**初始化 root 用户的 kubectl 配置**

# 只在 master 节点执行
    rm -rf /root/.kube/
    mkdir /root/.kube/
    cp -i /etc/kubernetes/admin.conf /root/.kube/config

**安装 calico**

# 只在 master 节点执行
    kubectl apply -f https://docs.projectcalico.org/v3.6/getting-started/kubernetes/installation/hosted/kubernetes-datastore/calico-networking/1.7/calico.yaml

> 安装calico， 请参考https://docs.projectcalico.org/v3.6/getting-started/kubernetes/

**等待calico安装就绪：**

执行如下命令，等待 3-10 分钟，直到所有的容器组处于 Running 状态

# 只在 master 节点执行
    watch kubectl get pod -n kube-system -o wide

**检查 master 初始化结果**

在 master 节点 demo-master-a-1 上执行

# 只在 master 节点执行
    kubectl get nodes

## 五、初始化 worker节点 ##

**在 master 节点 demo-master-a-1 节点执行**

# 只在 master 节点执行
    kubeadm token create --print-join-command

可获取kubeadm join 命令及参数，如下所示

# kubeadm token create 命令的输出
    kubeadm join apiserver.demo:6443 --token mpfjma.4vjjg8flqihor4vt     --discovery-token-ca-cert-hash sha256:6f7a8e40a810323672de5eee6f4d19aa2dbdb38411845a1bf5dd63485c43d303

## ##

**针对所有的 worker 节点执行**

# 只在 worker 节点执行
    echo "x.x.x.x  apiserver.demo" >> /etc/hosts
    kubeadm join apiserver.demo:6443 --token mpfjma.4vjjg8flqihor4vt     --discovery-token-ca-cert-hash sha256:6f7a8e40a810323672de5eee6f4d19aa2dbdb38411845a1bf5dd63485c43d303

**检查初始化结果**

*  将 x.x.x.x 替换为 demo-master-a-1 的实际 ip。（如果 demo-master-a-1 同时有内网IP和外网IP，此处请使用内网IP）
 *  将 kubeadm join 命令后的参数替换为上一个步骤中实际从 demo-master-a-1 节点获得的参数

在 master 节点 demo-master-a-1 上执行

# 只在 master 节点执行
    kubectl get nodes

输出结果如下所示：

[root@demo-master-a-1 ~]# kubectl get nodes
    NAME     STATUS   ROLES    AGE     VERSION
    demo-master-a-1   Ready    master   5m3s    v1.15.2
    demo-worker-a-1   Ready    <none>   2m26s   v1.15.2
    demo-worker-a-2   Ready    <none>   3m56s   v1.15.2

**移除 worker 节点**

正常情况下，您无需移除 worker 节点，如果添加到集群出错，您可以移除 worker 节点，再重新尝试添加

在准备移除的 worker 节点上执行

# 只在 worker 节点执行
    kubeadm reset

在 master 节点 demo-master-a-1 上执行

# 只在 master 节点执行
    kubectl delete node demo-worker-x-x

*  将 demo-worker-x-x 替换为要移除的 worker 节点的名字
 *  worker 节点的名字可以通过在节点 demo-master-a-1 上执行 kubectl get nodes 命令获得

[https_kuboard.cn_install_install-k8s.html]: https://kuboard.cn/install/install-k8s.html
[Link 1]: https://kuboard.cn/kuboard.rp
[image-20190805230643974]: /images/20211013/2c7c703d87324053b3122cfde90c59d5.png
[CIDR]: https://kuboard.cn/glossary/cidr.html