kubeadm是快速部署k8s 1.15和1.16版本集群
目录1 机器规划2 安装要求3 准备环境3.1 关闭防火墙(所有节点)3.2 关闭selinux(所有节点)3.3 关闭swap(所有节点)3.4 添加主机名与IP对应关系(所有节点)3.5 将桥接的IPv4流量传递到iptables的链(所有节点)4 安装Docker(所有节点)5所有节点安装Docker/kubeadm/kubelet5.1添加...
·
目录
3.5 将桥接的IPv4流量传递到iptables的链(所有节点)
5 所有节点安装Docker/kubeadm/kubelet
5.2 安装kubeadm，kubelet和kubectl(所有节点)
6.4 加入Kubernetes Node slave上执行
1 机器规划
| 机器 | ip | 角色 |
| wyl01 | 192.168.190.130 | master |
| wyl02 | 192.168.190.131 | node |
| wyl03 | 192.168.190.132 | node |
2 安装要求
在开始之前，部署Kubernetes集群机器需要满足以下几个条件：
- 硬件配置：2GB或更多RAM，2个CPU或更多CPU，硬盘30GB或更多
- 集群中所有机器之间网络互通
- 可以访问外网，需要拉取镜像
- 禁止swap分区
3 准备环境
3.1 关闭防火墙(所有节点)
systemctl stop firewalld
systemctl disable firewalld3.2 关闭selinux(所有节点)
sed -i 's/enforcing/disabled/' /etc/selinux/config
setenforce 03.3 关闭swap(所有节点)
swapoff -a # 临时关闭
vim /etc/fstab # 删除关于swap的那一行配置，永久关闭3.4 添加主机名与IP对应关系(所有节点)
vim /etc/hosts
192.168.190.130 wyl01
192.168.190.131 wyl02
192.168.190.132 wyl033.5 将桥接的IPv4流量传递到iptables的链(所有节点)
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
# 生效
sysctl --system4 安装Docker(所有节点)
# 获取yum源地址
wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
# 安装docker
yum -y install docker-ce-18.06.1.ce-3.el7
# 启动docker
systemctl enable docker && systemctl start docker
# 查看版本
docker --version
5 所有节点安装Docker/kubeadm/kubelet
5.1 添加阿里云YUM软件源(所有节点)
cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF5.2 安装kubeadm，kubelet和kubectl(所有节点)
# 15版本
yum install -y kubelet-1.15.0 kubeadm-1.15.0 kubectl-1.15.0
$ systemctl enable kubelet
# 16版本
yum install -y kubelet-1.16.0 kubeadm-1.16.0 kubectl-1.16.0
$ systemctl enable kubelet6 部署Kubernetes Master
6.1 初始化
在（Master）上执行。apiserver-advertise是内网地址（如果有多个网卡的情况下）
kubeadm init \
--apiserver-advertise-address=192.168.190.130 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.15.0 \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16执行报错：
invalid or incomplete external CA: failure loading certificate for API server: failed to load certificate: couldn't load the certificate file /etc/kubernetes/pki/apiserver.crt: open /etc/kubernetes/pki/apiserver.crt: no such file or directory
原因：之前这个机器部署过，所以要清空信息
kubeadm reset由于默认拉取镜像地址k8s.gcr.io国内无法访问，这里指定阿里云镜像仓库地址。
6.2 创建目录，并授权
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
export KUBECONFIG=$HOME/.kube/config
6.3 安装Pod网络插件（master）
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/a70459be0084506e4ec919aa1c114638878db11b/Documentation/kube-flannel.yml
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.extensions/kube-flannel-ds-amd64 created
daemonset.extensions/kube-flannel-ds-arm64 created
daemonset.extensions/kube-flannel-ds-arm created
daemonset.extensions/kube-flannel-ds-ppc64le created
daemonset.extensions/kube-flannel-ds-s390x created确保能够访问到quay.io这个registery，如果下载失败，可以改成这个镜像地址：lizhenliang/flannel:v0.11.0-amd64
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
6.4 加入Kubernetes Node slave上执行
向集群添加新节点，执行在kubeadm init输出的kubeadm join命令：
查看节点
7 部署 Dashboard
7.1 安装dashboard
wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml默认Dashboard只能集群内部访问，修改Service为NodePort类型，暴露到外部，修改如下：
vim kubernetes-dashboard.yaml
# image改成国内的
image: lizhenliang/kubernetes-dashboard-amd64:v1.10.1
# 修改部分内容
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort # 修改后
ports:
- port: 443
targetPort: 8443
nodePort: 30001 # 修改后
selector:
k8s-app: kubernetes-dashboard
# 创建dashboard
kubectl apply -f kubernetes-dashboard.yaml7.2 访问地址
浏览器输入：http://NodeIP:30001
创建service account并绑定默认cluster-admin管理员集群角色（master)：
[root@wyl01 ~]# kubectl create serviceaccount dashboard-admin -n kube-system
[root@wyl01 ~]# kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
[root@wyl01 ~]# kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/dashboard-admin/{print $1}')
Name: dashboard-admin-token-bkf7p
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 756edadb-1305-4603-b0e2-4e9fc7dcb97f
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYmtmN3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNzU2ZWRhZGItMTMwNS00NjAzLWIwZTItNGU5ZmM3ZGNiOTdmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.VYp4STidEfZGvCP1-T7QjB2iiAXxgROLVj-CD2Hey8WYT5_S7u2hGp1Nu_zCj2tRImrgEPNnoV1j_9qHLPYc0txk2lyYp5zJ2xaKVavIVIxFU4IWsFbf7hiZORzvIAVBfDN43BeUgUNgjf4ObEtx2Z8eYnfBY5vrPtDEhsTVyoH-Qms8ES_SoeXJQ6tf9PcF6P-4OVfQ7-JB-1DQdgS5IPkl2qm_Q4ZwFvrBhB3XYBtB9A2DMCZHPrTLwBX0Tqg4UF2fQpH_bOT9og0811n7VbMcu-FOP4Ky8UcN9BmuxmgZLEEYmZTkC_-HaZNuY7f0WNOFXibEnkPpUOU2-2uzdg
[root@wyl01 ~]# kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/dashboard-admin/{print $1}')
Name: dashboard-admin-token-bkf7p
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 756edadb-1305-4603-b0e2-4e9fc7dcb97f
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYmtmN3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNzU2ZWRhZGItMTMwNS00NjAzLWIwZTItNGU5ZmM3ZGNiOTdmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.VYp4STidEfZGvCP1-T7QjB2iiAXxgROLVj-CD2Hey8WYT5_S7u2hGp1Nu_zCj2tRImrgEPNnoV1j_9qHLPYc0txk2lyYp5zJ2xaKVavIVIxFU4IWsFbf7hiZORzvIAVBfDN43BeUgUNgjf4ObEtx2Z8eYnfBY5vrPtDEhsTVyoH-Qms8ES_SoeXJQ6tf9PcF6P-4OVfQ7-JB-1DQdgS5IPkl2qm_Q4ZwFvrBhB3XYBtB9A2DMCZHPrTLwBX0Tqg4UF2fQpH_bOT9og0811n7VbMcu-FOP4Ky8UcN9BmuxmgZLEEYmZTkC_-HaZNuY7f0WNOFXibEnkPpUOU2-2uzdg
7.3 登陆
将token的值，复制粘贴到上面图中的令牌密钥处。登陆
8.FAQ
8.1 k8s 机器重复部署pod网络不通
背景：机器之前部署过k8s集群，reset后，重新部署后，发现pod网络和主机网络之间不通。
解决方案：删除之前部署后生成的网络
K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容
更多推荐
1
0- 0
已为社区贡献7条内容
所有评论(0)