Kubernetes - Kubernetes安装——CentOS - 《CloudNative》

docker安装
主节点安装
节点加入
参考

设置系统主机名以及 Host 文件的相互解析

[root@localhost ~]# hostnamectl set-hostname k8s-master01
[root@localhost ~]# hostname
k8s-master01

安装依赖包

yum install -y conntrack ntpdate ntp ipvsadm ipset jq iptables curl sysstat libseccomp wget
vim net-tools git

关闭防火墙

systemctl stop firewalld && systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

设置防火墙为 Iptables 并设置空规则

systemctl stop firewalld && systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

关闭交换空间

swapoff -a
sed -i '/swap/s/^\(.*\)$/#\1/g' /etc/fstab

# 关闭selinux
$ setenforce 0

配置内核

[root@centos01 ~]# vim /etc/sysctl.d/k8s.conf
## 添加如下内容
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
## 执行命令生效
[root@localhost ~]# modprobe br_netfilter
[root@localhost ~]# sysctl --system

docker安装

卸载旧版本，首次安装docker不需要执行下面的卸载的命令

# sudo yum remove docker \
>                   docker-common \
>                   docker-selinux \
>                   docker-engine

安装docker工具

sudo yum install -y yum-utils \
  device-mapper-persistent-data \
  lvm2

国内建议安装阿里云的镜像仓库

#yum-config-manager \
--add-repo \
http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
#yum update -y

yum list docker-ce --showduplicates | sort -r

选择安装18.3 版本的

# yum install -y docker-ce-18.09.8-3.el7.x86_64

查看安装结果

# docker version
Client:
 Version:           18.06.3-ce
 API version:       1.38
 Go version:        go1.10.3
 Git commit:        d7080c1
 Built:             Wed Feb 20 02:26:51 2019
 OS/Arch:           linux/amd64
 Experimental:      false
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

创建 /etc/docker 目录

mkdir /etc/docker

配置 daemon.

[root@localhost ~]# mkdir /etc/docker
[root@localhost ~]# cat > /etc/docker/daemon.json <<EOF
 {
 "exec-opts": ["native.cgroupdriver=systemd"],
 "registry-mirrors": ["https://5tiu40w5.mirror.aliyuncs.com"]
 }
 EOF
[root@localhost ~]# mkdir -p /etc/systemd/system/docker.service.d
[root@localhost ~]# systemctl daemon-reload && systemctl restart docker && systemctl enable docker
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.

安装 Kubeadm (主从配置)

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

查看版本

 yum list kubeadm --showduplicates | sort -r

选择稳定版本安装

 yum install -y kubelet-1.15.4 kubeadm-1.15.4 kubectl-1.15.4

查看安装结果

[root@localhost ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.4", GitCommit:"67d2fcf276fcd9cf743ad4be9a9ef5828adc082f", GitTreeState:"clean", BuildDate:"2019-09-18T14:48:18Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"

# systemctl enable kubelet && systemctl start kubelet

主节点安装

参数含义
https://kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/
主要需要把镜像转成中国区的镜像地址

# kubeadm init \
 --apiserver-advertise-address 172.17.245.18 \
 --image-repository registry.aliyuncs.com/google_containers \
 --kubernetes-version v1.15.4 \
 --pod-network-cidr=10.240.0.0/16

如果中途有什么安装错误可以选择重新安装

# kubeadm reset
[reset] Reading configuration from the cluster...
[reset] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[reset] WARNING: Changes made to this host by 'kubeadm init' or 'kubeadm join' will be reverted.
[reset] Are you sure you want to proceed? [y/N]:

设置权限

To start using your cluster, you need to run the following as a regular user:
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

其他节点加入

kubeadm join 172.17.245.18:6443 --token hqzu0y.ensdbjnqay0au02f \
    --discovery-token-ca-cert-hash sha256:46d0ff368b08e14204b8965475b4829ae6a957c6c7f57f4c789327c1ec4af71a

coredns 一直会处于pending状态需要安装网络插件

[root@localhost ~]# kubectl get pods --all-namespaces
NAMESPACE     NAME                                   READY   STATUS    RESTARTS   AGE
kube-system   coredns-bccdc95cf-dm67t                0/1     Pending   0          111s
kube-system   coredns-bccdc95cf-l4tmd                0/1     Pending   0          111s
kube-system   etcd-k8s-master01                      1/1     Running   0          59s
kube-system   kube-apiserver-k8s-master01            1/1     Running   0          70s
kube-system   kube-controller-manager-k8s-master01   1/1     Running   0          62s
kube-system   kube-proxy-rwtb8                       1/1     Running   0          111s
kube-system   kube-scheduler-k8s-master01            1/1     Running   0

安装网络插件

[root@localhost ~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
podsecuritypolicy.policy/psp.flannel.unprivileged created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds-amd64 created
daemonset.apps/kube-flannel-ds-arm64 created
daemonset.apps/kube-flannel-ds-arm created
daemonset.apps/kube-flannel-ds-ppc64le created
daemonset.apps/kube-flannel-ds-s390x created

第一次安装需要在等待个几分钟左右，需要下载kube-flannel-ds镜像在查看

# kubectl get pods --all-namespaces
NAMESPACE     NAME                                   READY   STATUS    RESTARTS   AGE
kube-system   coredns-58cc8c89f4-4nw8s               0/1     Running   0          7m35s
kube-system   coredns-58cc8c89f4-frtwx               0/1     Running   0          7m35s
kube-system   etcd-k8s-master01                      1/1     Running   0          6m41s
kube-system   kube-apiserver-k8s-master01            1/1     Running   0          6m29s
kube-system   kube-controller-manager-k8s-master01   1/1     Running   0          6m42s
kube-system   kube-flannel-ds-amd64-74gqm            1/1     Running   0          2m24s
kube-system   kube-proxy-xcdfm                       1/1     Running   0          7m35s
kube-system   kube-scheduler-k8s-master01            1/1     Running   0          6m57s

节点加入

下面这段会在主节点创建的时候在成功的最后会显示出来有效时长是24小时

# kubeadm join 172.17.245.18:6443 --token 1abton.yf83y8sqq9jucdzn \
    --discovery-token-ca-cert-hash sha256:ce53505a8f73f16cd73da51437c68581bb01235be96f4a5b0f87e09df5788108

在主机上查看token

# kubeadm token list
TOKEN                     TTL       EXPIRES                     USAGES                   DESCRIPTION                                                EXTRA GROUPS
1abton.yf83y8sqq9jucdzn   23h       2019-10-18T20:36:03+08:00   authentication,signing   The default bootstrap token generated by 'kubeadm init'.   system:bootstrappers:kubeadm:default-node-token

查看—discovery-token-ca-cert-hash

# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
ce53505a8f73f16cd73da51437c68581bb01235be96f4a5b0f87e09df5788108

重新创建token

# kubeadm token create --print-join-command

查看安装节点

# kubectl get nodes
NAME           STATUS   ROLES    AGE   VERSION
k8s-master01   Ready    master   35m   v1.15.4
k8s-node01     Ready    <none>   13s   v1.16.1

参考

https://juejin.im/post/5df712d06fb9a0160770a01e
https://juejin.im/post/5d7fb46d5188253264365dcf
https://blog.51cto.com/9095441/2442378