准备工作
确保唯一
# 查看主机名
hostname
# 查看网络
ip link
# 或
ifconfig -a
# 查看product_uuid
cat /sys/class/dmi/id/product_uuid
# 一般情况下都会有唯一地址
检查所需端口
控制平面节点
协议 | 方向 | 端口范围 | 作用 | 使用者 |
---|---|---|---|---|
TCP | 入站 | 6443 | Kubernetes API 服务器 | 所有组件 |
TCP | 入站 | 2379-2380 | etcd 服务器客户端 API | kube-apiserver, etcd |
TCP | 入站 | 10250 | Kubelet API | kubelet 自身、控制平面组件 |
TCP | 入站 | 10251 | kube-scheduler | kube-scheduler 自身 |
TCP | 入站 | 10252 | kube-controller-manager | kube-controller-manager 自身 |
工作节点
协议 | 方向 | 端口范围 | 作用 | 使用者 |
---|---|---|---|---|
TCP | 入站 | 10250 | Kubelet API | kubelet 自身、控制平面组件 |
TCP | 入站 | 30000-32767 | NodePort 服务† | 所有组件 |
其他端口
10248
关闭swap
swapoff -a
sed -ri 's/.*swap.*/#&/' /etc/fstab
允许 iptables 检查桥接流量
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system
将 SELinux 设置为 permissive 模式
# 将 SELinux 设置为 permissive 模式(相当于将其禁用)
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
安装 kubeadm、kubelet 和 kubectl
你需要在每台机器上安装以下的软件包:
kubeadm
:用来初始化集群的指令。kubelet
:在集群中的每个节点上用来启动 Pod 和容器等。kubectl
:用来与集群通信的命令行工具。
安装
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF
sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
sudo systemctl enable --now kubelet
无法从 /var/lib/rpm 打开软件包数据库
cd /var/lib/rpm
rm -rf __db.*
rpm --rebuilddb
使用kubeadm引导集群
下载各个机器需要的镜像
sudo tee ./images.sh <<-'EOF'
#!/bin/bash
images=(
kube-apiserver
kube-proxy
kube-controller-manager
kube-scheduler
coredns
etcd
pause
)
for imageName in ${images[@]} ;do
docker pull registry.aliyuncs.com/google_containers/$imageName
done
EOF
chmod +x ./images.sh && ./images.sh
初始化主节点
# 所有机器添加master域名映射,以下需要修改为自己的
echo "39.103.233.115 cluster-endpoint" >> /etc/hosts
#主节点初始化
kubeadm init \
--apiserver-advertise-address=39.103.233.115 \
--control-plane-endpoint=cluster-endpoint \
--image-repository registry.aliyuncs.com/google_containers \
--service-cidr=10.96.0.0/16 \
--pod-network-cidr=192.169.0.0/16
#所有网络范围不重叠
改配置
kubectl -n kube-system edit cm kubeadm-config
如果报错连不上容器
# 解决kubeadm init初始化时dial tcp 127.0.0.1:10248: connect: connection refused
vim /etc/docker/daemon.json
# 里面加一行
{"exec-opts": ["native.cgroupdriver=systemd"]}
# 重启
systemctl daemon-reload
systemctl restart docker
systemctl restart kubelet
# 重新初始化
kubeadm reset
# 再用上面的命令初始化
看到Your Kubernetes control-plane has initialized successfully!
说明初始化成功
保存初始化成功后面的信息,后面要用
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:
kubeadm join cluster-endpoint:6443 --token aedzgz.zl1pio6oo06k7ajn \
--discovery-token-ca-cert-hash sha256:eded5d6f262d427e9ef9df1e248e33ba08ec08d9bbceb6a45e6432851af65186 \
--control-plane
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join cluster-endpoint:6443 --token aedzgz.zl1pio6oo06k7ajn \
--discovery-token-ca-cert-hash sha256:eded5d6f262d427e9ef9df1e248e33ba08ec08d9bbceb6a45e6432851af65186
重新创建令牌
kubeadm token create --print-join-command
在主节点运行
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
主节点安装网络插件
# 下载配置
curl https://docs.projectcalico.org/manifests/calico.yaml -O
# 前面初始化如果pod-network-cidr改了的话,这里配置也要改
- name: CALICO_IPV4POOL_CIDR
value: "192.169.0.0/16"
# 添加
kubectl apply -f calico.yaml
部署dashboard
kubernetes官方提供的可视化界面
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml
修改配置
kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
修改type:
节点值改为NodePort
查看端口
kubectl get svc -A | grep kubernetes-dashboard
访问
https://任意集群ip:端口
创建访问账号
# 创建访问账号 vi dash.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
kubectl apply -f dash.yaml
获取访问令牌
# 获取访问令牌
kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"