小白指南-kubeadm部署K8S集群1.14.3

阳光穿透心脏的1/2处 2022-01-11 17:43 263阅读 0赞

1、环境准备

*  主机规划

<table> 
 <tbody> 
 <tr> 
 <td> hostname </td> 
 <td> IP </td> 
 <td> CentOS </td> 
 <td> 部署 </td> 
 <td> pod网段 </td> 
 <td> service网段 </td> 
 </tr> 
 <tr> 
 <td> k8s-master </td> 
 <td> 192.168.2.51 </td> 
 <td> 7.6 </td> 
 <td> docker , kubeadm, kubelet , kubectl </td> 
 <td> 10.1.0.0/16 </td> 
 <td> 172.16.0.0/16 </td> 
 </tr> 
 <tr> 
 <td> k8s-node01 </td> 
 <td> 192.168.2.52 </td> 
 <td> 7.6 </td> 
 <td> docker , kubeadm , kubelet </td> 
 <td> 10.1.0.0/16 </td> 
 <td> 172.16.0.0/16 </td> 
 </tr> 
 <tr> 
 <td> k8s-node02 </td> 
 <td> 192.168.2.53 </td> 
 <td> 7.6 </td> 
 <td> docker , kubeadm , kubelet </td> 
 <td> 10.1.0.0/16 </td> 
 <td> 172.16.0.0/16 </td> 
 </tr> 
 </tbody> 
</table>

*  节点检查：主机名、MAC、uuid唯一

hostname

ip link 或 ifconfig -a

cat /sys/class/dmi/id/product\_uuid

*  关闭防火墙(所有节点)

systemctl stop firewalld && systemctl disable firewalld

*  关闭selinux(所有节点)

setenforce 0 && sed -i 's/enforcing/disabled/g' /etc/selinux/config

*  同步服务器时间(所有节点)

yum install ntpdate -y && ntpdate ntp.api.bz

\#先用ntpdate强制同步时间，然后配置ntpd服务持续同步

*  关闭swap(所有节点)

swapoff -a && sed -i 's/^.\*swap/\#&/g' /etc/fstab

\#永久关闭swap，在/etc/fstab 中含有swap的行前加\#

*  集群所有节点可以互相解析(所有节点)

cat <<EOF >> /etc/hosts

192.168.2.51 k8s-master

192.168.2.52 k8s-node01

192.168.2.53 k8s-node02

EOF

*  master对node节点ssh公钥分发(master)

ssh-keygen

ssh-copy-id k8s-node01

ssh-copy-id k8s-node02

*  系统参数调整(所有节点)

cat <<EOF > /etc/sysctl.d/k8s.conf

net.ipv4.ip\_forward = 1

net.bridge.bridge-nf-call-iptables = 1

net.bridge.bridge-nf-call-ip6tables = 1

EOF

sysctl -p

2、安装

*  准备源(所有节点)

yum install -y wget &&cd /etc/yum.repos.d/ && wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

cat <<EOF > /etc/yum.repos.d/kubernetes.repo

\[kubernetes\]

name=Kubernetes

baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86\_64/

enabled=1

gpgcheck=1

repo\_gpgcheck=1

gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

EOF

scp /etc/yum.repos.d/\{docker-ce.repo,kubernetes.repo\} k8s-node01:/etc/yum.repos.d/

scp /etc/yum.repos.d/\{docker-ce.repo,kubernetes.repo\} k8s-node02:/etc/yum.repos.d/

*  yum安装docker和kube相关

yum install -y docker-ce kubelet kubeadm kubectl \#master

yum install -y docker-ce kubelet kubeadm \#node\*

*  启动docker，添加镜像加速(所有节点)

systemctl start docker && systemctl enable docker

登陆阿里云[https://cr.console.aliyun.com/][https_cr.console.aliyun.com]（需要注册），获取到专属加速地址：[https://xxxxxx.mirror.aliyuncs.com][https_xxxxxx.mirror.aliyuncs.com]

tee /etc/docker/daemon.json <<-'EOF' \{ "registry-mirrors": \["https://xxxxxxx.mirror.aliyuncs.com"\] \} EOF systemctl daemon-reload && systemctl restart docker

systemctl enable kubelet && systemctl restart kubelet

*  拉取镜像（所有节点）

查看kube\*版本

yum list kube\*

根据版本配置下述脚本，指定需拉取的镜像的版本

tee /root/getimage.sh <<-'EOF' echo "Pull Kubernetes v1.14.2 Images from aliyuncs.com ......"

MY\_REGISTRY=registry.cn-hangzhou.aliyuncs.com/openthings

\#\# 拉取镜像

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-kube-apiserver:v1.14.2

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-kube-controller-manager:v1.14.2

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-kube-scheduler:v1.14.2

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-kube-proxy:v1.14.2

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-etcd:3.3.10

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-pause:3.1

docker pull $\{MY\_REGISTRY\}/k8s-gcr-io-coredns:1.3.1

\#\# 添加Tag

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-kube-apiserver:v1.14.2 k8s.gcr.io/kube-apiserver:v1.14.2

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-kube-scheduler:v1.14.2 k8s.gcr.io/kube-scheduler:v1.14.2

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-kube-controller-manager:v1.14.2 k8s.gcr.io/kube-controller-manager:v1.14.2

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-kube-proxy:v1.14.2 k8s.gcr.io/kube-proxy:v1.14.2

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-etcd:3.3.10 k8s.gcr.io/etcd:3.3.10

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-pause:3.1 k8s.gcr.io/pause:3.1

docker tag $\{MY\_REGISTRY\}/k8s-gcr-io-coredns:1.3.1 k8s.gcr.io/coredns:1.3.1

echo "Pull Kubernetes v1.14.2 Images FINISHED."

EOF

PS：yum安装的kube\*相关版本为1.14.3，但阿里镜像库里最新的为1.14.2，所以此脚本k8s-gcr-io-kube-\*采用版本v1.14.2

chmod +x /root/getimage.sh && /root/getimage.sh

查看镜像：docker images

*  master初始化（master）

kubeadm init --kubernetes-version=v1.14.2 --apiserver-advertise-address=192.168.2.51 --pod-network-cidr=10.1.0.0/16 --service-cidr=172.16.0.0/16

执行 kubeadm init时：

1.  自动化的集群机器合规检查
2.  自动化生成集群运行所需的各类证书及各类配置，并将Master节点信息保存在名为cluster-info的ConfigMap中。
3.  通过static Pod方式，运行API server, controller manager 、scheduler及etcd组件。
4.  生成Token以便其他节点加入集群
5.  执行 kubeadm join时：
6.  节点通过token访问kube-apiserver，获取cluster-info中信息，主要是apiserver的授权信息（节点信任Master）。
7.  通过授权信息，kubelet可执行TLS bootstrapping，与apiserver真正建立互信任关系（Master信任节点）。

简单来说，kubeadm做的事就是把大部分组件都容器化，并通过StaticPod方式运行，同时大大简化了集群的配置及认证等工作。

初始化完成：

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.

Run "kubectl apply -f \[podnetwork\].yaml" with one of the options listed at:

https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.2.51:6443 --token ssgjgk.wkyzh31xk4vsjdbf \\

\--discovery-token-ca-cert-hash sha256:072e10437de940fbc0f7203abb86c9b85d8c2e0d7af8dcf5e1e7d85154f1139b

上述红色字体部分为node节点加入命令

配置加载：

echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash\_profile

source ~/.bash\_profile

查看集群状态：kubectl get cs

NAME STATUS MESSAGE ERROR

scheduler Healthy ok

controller-manager Healthy ok

etcd-0 Healthy \{"health":"true"\}

查看节点：kubectl get node

NAME STATUS ROLES AGE VERSION

k8s-master NotReady master 46m v1.14.3

查看pod状态

kubectl get pod --all-namespaces -o wide

coredns显示为pending状态

flannel网络安装（master）

wget [https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml][https_raw.githubusercontent.com_coreos_flannel_master_Documentation_kube-flannel.yml]

kubectl apply -f kube-flannel.yml

再次查看pod状态（等待几分钟）

kubectl get pod --all-namespaces -o wide

coredns显示为running

node节点加入集群（node\*）

kubeadm join 192.168.2.51:6443 --token ssgjgk.wkyzh31xk4vsjdbf \\

\--discovery-token-ca-cert-hash sha256:072e10437de940fbc0f7203abb86c9b85d8c2e0d7af8dcf5e1e7d85154f1139b

\[root@k8s-master ~\]\# kubectl get nodes

NAME STATUS ROLES AGE VERSION

k8s-master Ready master 4h50m v1.14.3

k8s-node01 Ready <none> 35m v1.14.3

k8s-node02 Ready <none> 35m v1.14.3

PS：如果要主节点同时作为工作节点，参与负载。

查看master状态：kubectl describe node k8s-master | grep Taint Taints: node-role.kubernetes.io/master:NoSchedule

修改Taints，以使master加入调度：

kubectl taint node k8s-master node-role.kubernetes.io/master-

修改Taints，以使master退出调度：

kubectl taint node k8s-master node-role.kubernetes.io/master=:NoSchedule

kubectl taint node \[node\] key=value\[effect\] 其中\[effect\] 可取值: \[ NoSchedule | PreferNoSchedule | NoExecute \]

NoSchedule: 一定不能被调度

PreferNoSchedule: 尽量不要调度

NoExecute: 不仅不会调度, 还会驱逐Node上已有的Pod

[https_cr.console.aliyun.com]: https://cr.console.aliyun.com/
[https_xxxxxx.mirror.aliyuncs.com]: https://xxxxxx.mirror.aliyuncs.com
[https_raw.githubusercontent.com_coreos_flannel_master_Documentation_kube-flannel.yml]: https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml