Kubernetes快速部署
kubeadm是官方社區推出的一個用于快速部署kubernetes集群的工具，
這個工具能通過兩條指令完成一個kubernetes集群的部署：
# 創建一個 Master 節點
$ kubeadm init
# 將一個 Node 節點加入到當前集群中
$ kubeadm join <Master節點的IP和埠>
1. 安裝要求
在開始之前，部署Kubernetes集群機器需要滿足以下幾個條件：
-至少3臺機器，作業系統 CentOS7+
- 硬體配置：2GB或更多RAM，2個CPU或更多CPU，硬碟20GB或更多
- 集群中所有機器之間網路互通
- 可以訪問外網，需要拉取鏡像
- 禁止swap磁區
2. 學習目標
- 在所有節點上安裝Docker和kubeadm
- 部署Kubernetes Master
- 部署容器網路插件
- 部署 Kubernetes Node，將節點加入Kubernetes集群中
- 部署Dashboard Web頁面，可視化查看Kubernetes資源
3. 準備環境
ps：建議用三臺三臺centos7，我用kubeletv1.23.1做出來了，雖然kubeadm源是7，
也可以用三臺centos8，kubeletv1.20.0穩定版
環境：三臺centos7
| 角色 | IP | 配置 |
|---|---|---|
| master | 192.168.143.140 | 2G 4核 |
| node1 | 192.168.143.141 | 3G 4核 |
| node2 | 192.168.143.142 | 3G 4核 |
//給三臺主機修改名字
[root@master ~]# hostname
master.example.com
[root@node1 ~]# hostname
node1.example.com
[root@node2 ~]# hostname
node2.example.com
//給三臺主機關閉防火墻，selinux
systemctl disable firewalld
sed -i 's/enforcing/disabled/' /etc/selinux/config
//給三臺主機關閉swap：
vim /etc/fstab
#/dev/mapper/centos-swap swap swap defaults 0 0
注釋掉swap磁區
在master添加hosts：
[root@master ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
//后面添加此三行
192.168.143.140 master master.example.com
192.168.143.141 node1 node1.example.com
192.168.143.142 node2 node2.example.com
//將橋接的IPv4流量傳遞到iptables的鏈：
[root@master ~]# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
//生效
[root@master ~]# sysctl --system
* Applying /usr/lib/sysctl.d/00-system.conf ...
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.all.promote_secondaries = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
* Applying /etc/sysctl.conf ...
//給三臺主機做時間同步：
yum -y install chrony
vim /etc/chrony.conf
pool time1.aliyun.com iburst //時間同步洗掉原有的4條，修改為此行
systemctl enable chronyd
//免密認證：
[root@master ~]# ssh-keygen -t rsa
[root@master ~]# ssh-copy-id master
[root@master ~]# ssh-copy-id node1
[root@master ~]# ssh-copy-id node2
//檢查狀態
[root@master ~]# for i in node1 node2 master;do ssh root@$i 'reboot';done
[root@master ~]# for i in master node1 node2;do ssh root@$i 'getenforce';done
Disabled
Disabled
Disabled
[root@master ~]# for i in master node1 node2;do ssh root@$i 'date';done
[root@master ~]# for i in master node1 node2;do ssh root@$i 'free -h';done
total used free shared buff/cache available
Mem: 1.8G 105M 1.5G 9.6M 197M 1.5G
Swap: 0B 0B 0B
total used free shared buff/cache available
Mem: 2.8G 108M 2.5G 9.4M 194M 2.5G
Swap: 0B 0B 0B
total used free shared buff/cache available
Mem: 2.8G 111M 2.5G 9.4M 194M 2.5G
Swap: 0B 0B 0B
4. 所有節點安裝Docker/kubeadm/kubelet
Kubernetes默認CRI（容器運行時）為Docker，因此先安裝Docker，
4.1 配置kubeadm源安裝Docker
//給三臺主機配置kubeadm源
# cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
//給三臺主機做docker源
# wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
//建立快取
# rm -rf /var/cache/yum/*
# yum makecache
//給三臺主機配置docker-ce
# yum install -y docker-ce
# systemctl enable --now docker
# cat > /etc/docker/daemon.json << EOF
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"],
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2"
}
EOF
# systemctl daemon-reload
# systemctl restart docker
# docker info //查看有無配置
4.2 安裝kubeadm，kubelet和kubectl
//不指定版本為最新版本，也可以使用
由于版本更新頻繁，這里指定版本號部署：
//給三臺主機做
# yum install -y kubelet-1.20.0 kubeadm-1.20.0 kubectl-1.20.0
# systemctl enable kubelet
5. 部署Kubernetes Master
在Master執行，
//注意 ip是master的 ，version是kuber的版本，可以變
[root@master ~]# kubeadm init --apiserver-advertise-address 192.168.143.140 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.20.0 --service-cidr=10.96.0.0/12 --pod-network-cidr=10.244.0.0/16
//存盤資訊，此行內容是，init完成后產生后，最后一行資料，添加集群時要用到，
[root@master ~]# vi init
kubeadm join 192.168.143.140:6443 --token arkgcf.smaj7konv41yifxd \
--discovery-token-ca-cert-hash sha256:30e1b03d7112abc8ed8b84bf0c69ef4bdb3498911ac468f3a2c7887bdd38918c
[root@master ~]# echo 'export KUBECONFIG=/etc/kubernetes/admin.conf' > /etc/profile.d/k8s.sh
[root@master ~]# source /etc/profile.d/k8s.sh
由于默認拉取鏡像地址k8s.gcr.io國內無法訪問，這里指定阿里云鏡像倉庫地址，
//普通用戶要做的事，使用kubectl工具：
# mkdir -p $HOME/.kube
# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
# sudo chown $(id -u):$(id -g) $HOME/.kube/config
# kubectl get nodes
6. 安裝Pod網路插件（CNI）
[root@master ~]# vim flannel.yaml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unused in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flannel
subjects:
- kind: ServiceAccount
name: flannel
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: flannel
namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
name: kube-flannel-cfg
namespace: kube-system
labels:
tier: node
app: flannel
data:
cni-conf.json: |
{
"name": "cbr0",
"cniVersion": "0.3.1",
"plugins": [
{
"type": "flannel",
"delegate": {
"hairpinMode": true,
"isDefaultGateway": true
}
},
{
"type": "portmap",
"capabilities": {
"portMappings": true
}
}
]
}
net-conf.json: |
{
"Network": "10.244.0.0/16",
"Backend": {
"Type": "vxlan"
}
}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
hostNetwork: true
priorityClassName: system-node-critical
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni-plugin
image: rancher/mirrored-flannelcni-flannel-cni-plugin:v1.0.0
command:
- cp
args:
- -f
- /flannel
- /opt/cni/bin/flannel
volumeMounts:
- name: cni-plugin
mountPath: /opt/cni/bin
- name: install-cni
image: quay.io/coreos/flannel:v0.15.1
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.15.1
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN", "NET_RAW"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni-plugin
hostPath:
path: /opt/cni/bin
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
[root@master ~]# kubectl apply -f flannel.yaml
確保能夠訪問到quay.io這個registery，
7. 加入Kubernetes Node
在node1 和node2執行，
向集群添加新節點，執行在kubeadm init輸出的kubeadm join命令：
kubeadm join 192.168.143.140:6443 --token arkgcf.smaj7konv41yifxd \
> --discovery-token-ca-cert-hash sha256:30e1b03d7112abc8ed8b84bf0c69ef4bdb3498911ac468f3a2c7887bdd38918c
8. 測驗kubernetes集群
在Kubernetes集群中創建一個pod，驗證是否正常運行：
[root@master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master.example.com Ready control-plane,master 21m v1.20.0
node1.example.com Ready <none> 5m44s v1.20.0
node2.example.com Ready <none> 5m39s v1.20.0
[root@master ~]# kubectl create deployment nginx --image=nginx
deployment.apps/nginx created
[root@master ~]# kubectl expose deployment nginx --port=80 --type=NodePort
service/nginx exposed
//獲取svc，pods的資訊
[root@master ~]# kubectl get svc,pods
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 28m
service/nginx NodePort 10.109.147.208 <none> 80:32432/TCP 5m20s
NAME READY STATUS RESTARTS AGE
pod/nginx-6799fc88d8-wk29t 1/1 Running 0 6m18s
//測驗主機ip訪問
[root@master ~]# curl 192.168.143.140:32432
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
//建議使用server的ip來訪問，因為不會改變
[root@master ~]# curl 10.109.147.208
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
訪問地址：http://NodeIP:Port
轉載請註明出處，本文鏈接：https://www.uj5u.com/ruanti/386052.html
標籤：其他
上一篇：raise真的是一個關鍵詞嗎？