前置要求

  • 系统 Centos8
  • 内存推荐3G或以上（这个很重要，否则有可能导致初始化不成功）

1.查询系统版本

  1. [root@localhost ~]# cat /etc/centos-release
  2. CentOS Linux release 8.2.2004 (Core)

2.确定IP地址

  1. [root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
  2. TYPE="Ethernet"
  3. PROXY_METHOD="none"
  4. BROWSER_ONLY="no"
  5. BOOTPROTO="static"
  6. DEFROUTE="yes"
  7. IPV4_FAILURE_FATAL="no"
  8. IPV6INIT="yes"
  9. IPV6_AUTOCONF="yes"
  10. IPV6_DEFROUTE="yes"
  11. IPV6_FAILURE_FATAL="no"
  12. IPV6_ADDR_GEN_MODE="stable-privacy"
  13. NAME="ens33"
  14. UUID="bce8c979-9f30-4b67-819e-cae1ef0b70c0"
  15. DEVICE="ens33"
  16. ONBOOT="yes"
  17. IPADDR="192.168.0.127"
  18. NETMASK="255.255.255.0"
  19. GATEWAY="192.168.0.1"
  20. DNS1="8.8.8.8"

3.添加阿里云

  1. [root@localhost ~]# rm -rfv /etc/yum.repos.d/*
  2. [root@localhost ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-8.repo

注：这里需要添加阿里云地址，否则可能会导致镜像拉取不出来的情况

4.修改host

  1. [root@localhost ~]# vim /etc/hosts
  2. 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
  3. ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
  5. 192.168.0.127 master01.paas.com master01

5. 关闭swapoff,注释swapoff 分区

  1. [root@localhost ~]# swapoff -a
  3. [root@localhost ~]# cat /etc/fstab 
  5. #
  6. # /etc/fstab
  7. # Created by anaconda on Thu May 13 00:46:53 2021
  8. #
  9. # Accessible filesystems, by reference, are maintained under '/dev/disk/'.
  10. # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
  11. #
  12. # After editing this file, run 'systemctl daemon-reload' to update systemd
  13. # units generated from this file.
  14. #
  15. UUID=d5aed907-ab30-47d1-af47-f76abea61f07 /                       xfs     defaults        0 0
  16. UUID=0e24ccd7-4b02-4873-bfa8-83ba1f1e676b /boot                   ext4    defaults        1 2
  17. #UUID=dedd03a8-0500-4383-b868-cec55f4dd8bd swap                    swap    defaults        0 0

6.配置内核参数，将桥接的IPv4流量传递到iptables的链

  1. [root@localhost ~]# cat > /etc/sysctl.d/k8s.conf << EOF
  2. > net.bridge.bridge-nf-call-ip6tables = 1
  3. > net.bridge.bridge-nf-call-iptables = 1
  4. > EOF
  1. [root@localhost ~]# sysctl --system
  2. * Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
  3. kernel.yama.ptrace_scope = 0
  4. * Applying /usr/lib/sysctl.d/50-coredump.conf ...
  5. kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e
  6. * Applying /usr/lib/sysctl.d/50-default.conf ...
  7. kernel.sysrq = 16
  8. kernel.core_uses_pid = 1
  9. kernel.kptr_restrict = 1
  10. net.ipv4.conf.all.rp_filter = 1
  11. net.ipv4.conf.all.accept_source_route = 0
  12. net.ipv4.conf.all.promote_secondaries = 1
  13. net.core.default_qdisc = fq_codel
  14. fs.protected_hardlinks = 1
  15. fs.protected_symlinks = 1
  16. * Applying /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf ...
  17. net.core.optmem_max = 81920
  18. * Applying /usr/lib/sysctl.d/50-pid-max.conf ...
  19. kernel.pid_max = 4194304
  20. * Applying /usr/lib/sysctl.d/60-libvirtd.conf ...
  21. fs.aio-max-nr = 1048576
  22. * Applying /etc/sysctl.d/99-sysctl.conf ...
  23. * Applying /etc/sysctl.d/k8s.conf ...
  24. * Applying /etc/sysctl.conf ...

7.安装常用包

  1. [root@localhost ~]# yum install vim bash-completion net-tools gcc -y

8.使用aliyun源安装docker-ce

  1. [root@localhost ~]#  yum install -y yum-utils device-mapper-persistent-data lvm2
  2. [root@localhost ~]#  yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
  3. [root@localhost ~]#  yum -y install docker-ce

安装docker-ce如果出现以下错

  1. [root@localhost ~]# yum -y install docker-ce
  2. CentOS-8 - Base - mirrors.aliyun.com                                                                               14 kB/s | 3.8 kB     00:00
  3. CentOS-8 - Extras - mirrors.aliyun.com                                                                            6.4 kB/s | 1.5 kB     00:00
  4. CentOS-8 - AppStream - mirrors.aliyun.com                                                                          16 kB/s | 4.3 kB     00:00
  5. Docker CE Stable - x86_64                                                                                          40 kB/s |  22 kB     00:00
  6. Error:
  7.  Problem: package docker-ce-3:19.03.8-3.el7.x86_64 requires containerd.io >= 1.2.2-3, but none of the providers can be installed
  8.   - cannot install the best candidate for the job
  9.   - package containerd.io-1.2.10-3.2.el7.x86_64 is excluded
  10.   - package containerd.io-1.2.13-3.1.el7.x86_64 is excluded
  11.   - package containerd.io-1.2.2-3.3.el7.x86_64 is excluded
  12.   - package containerd.io-1.2.2-3.el7.x86_64 is excluded
  13.   - package containerd.io-1.2.4-3.1.el7.x86_64 is excluded
  14.   - package containerd.io-1.2.5-3.1.el7.x86_64 is excluded
  15.   - package containerd.io-1.2.6-3.3.el7.x86_64 is excluded
  16. (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

解决方法

  1. [root@localhost ~]# wget https://download.docker.com/linux/centos/7/x86_64/edge/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm
  2. [root@localhost ~]# yum install containerd.io-1.2.6-3.3.el7.x86_64.rpm

docker-ce安装成功

  1. [root@localhost ~]# systemctl start docker
  2. [root@localhost ~]# systemctl enable docker

添加aliyundocker仓库加速器
登录阿里云账号获取镜像信息，网址：https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors
针对Docker客户端版本大于 1.10.0 的用户

您可以通过修改daemon配置文件/etc/docker/daemon.json来使用加速器

  1. sudo mkdir -p /etc/docker
  2. sudo tee /etc/docker/daemon.json <<-'EOF'
  3. {
  4.   "registry-mirrors": ["https://lso20XXX.mirror.aliyuncs.com"]
  5. }
  6. EOF
  7. sudo systemctl daemon-reload
  8. sudo systemctl restart docker

9.安装kubectl、kubelet、kubeadm

  1. [root@localhost ~]# cat <<EOF > /etc/yum.repos.d/kubernetes.repo
  2. > [kubernetes]
  3. > name=Kubernetes
  4. > baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
  5. > enabled=1
  6. > gpgcheck=1
  7. > repo_gpgcheck=1
  8. > gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
  9. > EOF

10.安装

  1. [root@localhost ~]# yum -y install  kubelet-1.18.0 kubeadm-1.18.0  kubectl-1.18.0
  1. systemctl enable kubelet && systemctl start kubelet

11.初始化集群（此时会需要较长时间，耐心等待）

  1. [root@localhost ~]# kubeadm init --kubernetes-version=1.18.0 \
  2. > --apiserver-advertise-address=192.168.0.127 \
  3. > --image-repository registry.aliyuncs.com/google_containers  \
  4. > --service-cidr=10.10.0.0/16 --pod-network-cidr=10.122.0.0/16

POD的网段为: 10.122.0.0/16， api server地址就是master本机IP。

这一步很关键，由于kubeadm 默认从官网k8s.grc.io下载所需镜像，国内无法访问，因此需要通过–image-repository指定阿里云镜像仓库地址。

  1. [apiclient] All control plane components are healthy after 20.502515 seconds
  2. [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
  3. [kubelet] Creating a ConfigMap "kubelet-config-1.18" in namespace kube-system with the configuration for the kubelets in the cluster
  4. [upload-certs] Skipping phase. Please see --upload-certs
  5. [mark-control-plane] Marking the node master01.paas.com as control-plane by adding the label "node-role.kubernetes.io/master=''"
  6. [mark-control-plane] Marking the node master01.paas.com as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
  7. [bootstrap-token] Using token: fvdmel.61fjcb4ej591sujj
  8. [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
  9. [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
  10. [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
  11. [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
  12. [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
  13. [bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
  14. [kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
  15. [addons] Applied essential addon: CoreDNS
  16. [addons] Applied essential addon: kube-proxy
  18. Your Kubernetes control-plane has initialized successfully!
  20. To start using your cluster, you need to run the following as a regular user:
  22.   mkdir -p $HOME/.kube
  23.   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  24.   sudo chown $(id -u):$(id -g) $HOME/.kube/config
  26. You should now deploy a pod network to the cluster.
  27. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  28.   https://kubernetes.io/docs/concepts/cluster-administration/addons/
  30. Then you can join any number of worker nodes by running the following on each as root:
  32. kubeadm join 192.168.0.127:6443 --token fvdmel.61fjcb4ej591sujj \
  33.     --discovery-token-ca-cert-hash sha256:f36a0ec6acd67259e8f86a6a882bdf445685341a4c2b52cebc7e9651d3de7ec6

出现上述信息，代表安装成功

记录生成的最后部分内容，此内容需要在其它节点加入Kubernetes集群时执行。

11.根据提示创建kubectl

  1. [root@localhost ~]# mkdir -p $HOME/.kube
  2. [root@localhost ~]#   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  3. [root@localhost ~]#   sudo chown $(id -u):$(id -g) $HOME/.kube/config

执行下面命令，使kubectl可以自动补充

  1. [root@localhost ~]# source <(kubectl completion bash)

12.查看节点，pod

  1. [root@localhost ~]# kubectl get node
  2. NAME                STATUS     ROLES    AGE    VERSION
  3. master01.paas.com   NotReady   master   5m4s   v1.18.0
  1. [root@localhost ~]# kubectl get pod --all-namespaces
  2. NAMESPACE     NAME                                        READY   STATUS    RESTARTS   AGE
  3. kube-system   coredns-7ff77c879f-g9cqf                    0/1     Pending   0          7m30s
  4. kube-system   coredns-7ff77c879f-st5h7                    0/1     Pending   0          7m30s
  5. kube-system   etcd-master01.paas.com                      1/1     Running   0          7m41s
  6. kube-system   kube-apiserver-master01.paas.com            1/1     Running   0          7m41s
  7. kube-system   kube-controller-manager-master01.paas.com   1/1     Running   0          7m41s
  8. kube-system   kube-proxy-bb58h                            1/1     Running   0          7m30s
  9. kube-system   kube-scheduler-master01.paas.com            1/1     Running   0          7m41s

13.node节点为NotReady，因为corednspod没有启动，缺少网络pod

  1. [root@localhost ~]# kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
  2. configmap/calico-config created
  3. customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
  4. customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
  5. customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
  6. customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
  7. customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
  8. customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
  9. customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
  10. customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
  11. customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
  12. customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
  13. customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
  14. customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
  15. customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
  16. customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
  17. customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
  18. clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
  19. clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
  20. clusterrole.rbac.authorization.k8s.io/calico-node created
  21. clusterrolebinding.rbac.authorization.k8s.io/calico-node created
  22. daemonset.apps/calico-node created
  23. serviceaccount/calico-node created
  24. deployment.apps/calico-kube-controllers created
  25. serviceaccount/calico-kube-controllers created
  26. poddisruptionbudget.policy/calico-kube-controllers created

查看pod和node

  1. [root@localhost ~]# kubectl get pod --all-namespaces
  2. NAMESPACE     NAME                                        READY   STATUS    RESTARTS   AGE
  3. kube-system   calico-kube-controllers-6566c5b7d8-hcm8j    1/1     Running   0          2m32s
  4. kube-system   calico-node-hv6wl                           1/1     Running   0          2m32s
  5. kube-system   coredns-7ff77c879f-g9cqf                    1/1     Running   0          10m
  6. kube-system   coredns-7ff77c879f-st5h7                    1/1     Running   0          10m
  7. kube-system   etcd-master01.paas.com                      1/1     Running   0          11m
  8. kube-system   kube-apiserver-master01.paas.com            1/1     Running   0          11m
  9. kube-system   kube-controller-manager-master01.paas.com   1/1     Running   0          11m
  10. kube-system   kube-proxy-bb58h                            1/1     Running   0          10m
  11. kube-system   kube-scheduler-master01.paas.com            1/1     Running   0          11m

查看时，会出现没有启动成功的情况，可以使用下面的命令：

  1. [root@localhost ~]# systemctl restart kubelet

然后在查询

  1. [root@localhost ~]#  kubectl get pod --all-namespaces

多次尝试直到全部启动成功

14.安装kubernetes-dashboard

官方部署dashboard的服务没使用nodeport，将yaml文件下载到本地，在service里修改nodeport
在40行左右添加
type: NodePort
在44行左右添加
nodePort: 30000
整体代码如下：

  1. # Copyright 2018 The Kubernetes Authors.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. #     http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  15. apiVersion: v1
  16. kind: Namespace
  17. metadata:
  18.   name: kubernetes-dashboard
  20. ---
  22. apiVersion: v1
  23. kind: ServiceAccount
  24. metadata:
  25.   labels:
  26.     k8s-app: kubernetes-dashboard
  27.   name: kubernetes-dashboard
  28.   namespace: kubernetes-dashboard
  30. ---
  32. kind: Service
  33. apiVersion: v1
  34. metadata:
  35.   labels:
  36.     k8s-app: kubernetes-dashboard
  37.   name: kubernetes-dashboard
  38.   namespace: kubernetes-dashboard
  39. spec:
  40.   type: NodePort
  41.   ports:
  42.     - port: 443
  43.       targetPort: 8443
  44.       nodePort: 30000
  45.   selector:
  46.     k8s-app: kubernetes-dashboard
  48. ---
  50. apiVersion: v1
  51. kind: Secret
  52. metadata:
  53.   labels:
  54.     k8s-app: kubernetes-dashboard
  55.   name: kubernetes-dashboard-certs
  56.   namespace: kubernetes-dashboard
  57. type: Opaque
  59. ---
  61. apiVersion: v1
  62. kind: Secret
  63. metadata:
  64.   labels:
  65.     k8s-app: kubernetes-dashboard
  66.   name: kubernetes-dashboard-csrf
  67.   namespace: kubernetes-dashboard
  68. type: Opaque
  69. data:
  70.   csrf: ""
  72. ---
  74. apiVersion: v1
  75. kind: Secret
  76. metadata:
  77.   labels:
  78.     k8s-app: kubernetes-dashboard
  79.   name: kubernetes-dashboard-key-holder
  80.   namespace: kubernetes-dashboard
  81. type: Opaque
  83. ---
  85. kind: ConfigMap
  86. apiVersion: v1
  87. metadata:
  88.   labels:
  89.     k8s-app: kubernetes-dashboard
  90.   name: kubernetes-dashboard-settings
  91.   namespace: kubernetes-dashboard
  93. ---
  95. kind: Role
  96. apiVersion: rbac.authorization.k8s.io/v1
  97. metadata:
  98.   labels:
  99.     k8s-app: kubernetes-dashboard
  100.   name: kubernetes-dashboard
  101.   namespace: kubernetes-dashboard
  102. rules:
  103.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  104.   - apiGroups: [""]
  105.     resources: ["secrets"]
  106.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
  107.     verbs: ["get", "update", "delete"]
  108.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  109.   - apiGroups: [""]
  110.     resources: ["configmaps"]
  111.     resourceNames: ["kubernetes-dashboard-settings"]
  112.     verbs: ["get", "update"]
  113.     # Allow Dashboard to get metrics.
  114.   - apiGroups: [""]
  115.     resources: ["services"]
  116.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
  117.     verbs: ["proxy"]
  118.   - apiGroups: [""]
  119.     resources: ["services/proxy"]
  120.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
  121.     verbs: ["get"]
  123. ---
  125. kind: ClusterRole
  126. apiVersion: rbac.authorization.k8s.io/v1
  127. metadata:
  128.   labels:
  129.     k8s-app: kubernetes-dashboard
  130.   name: kubernetes-dashboard
  131. rules:
  132.   # Allow Metrics Scraper to get metrics from the Metrics server
  133.   - apiGroups: ["metrics.k8s.io"]
  134.     resources: ["pods", "nodes"]
  135.     verbs: ["get", "list", "watch"]
  137. ---
  139. apiVersion: rbac.authorization.k8s.io/v1
  140. kind: RoleBinding
  141. metadata:
  142.   labels:
  143.     k8s-app: kubernetes-dashboard
  144.   name: kubernetes-dashboard
  145.   namespace: kubernetes-dashboard
  146. roleRef:
  147.   apiGroup: rbac.authorization.k8s.io
  148.   kind: Role
  149.   name: kubernetes-dashboard
  150. subjects:
  151.   - kind: ServiceAccount
  152.     name: kubernetes-dashboard
  153.     namespace: kubernetes-dashboard
  155. ---
  157. apiVersion: rbac.authorization.k8s.io/v1
  158. kind: ClusterRoleBinding
  159. metadata:
  160.   name: kubernetes-dashboard
  161. roleRef:
  162.   apiGroup: rbac.authorization.k8s.io
  163.   kind: ClusterRole
  164.   name: kubernetes-dashboard
  165. subjects:
  166.   - kind: ServiceAccount
  167.     name: kubernetes-dashboard
  168.     namespace: kubernetes-dashboard
  170. ---
  172. kind: Deployment
  173. apiVersion: apps/v1
  174. metadata:
  175.   labels:
  176.     k8s-app: kubernetes-dashboard
  177.   name: kubernetes-dashboard
  178.   namespace: kubernetes-dashboard
  179. spec:
  180.   replicas: 1
  181.   revisionHistoryLimit: 10
  182.   selector:
  183.     matchLabels:
  184.       k8s-app: kubernetes-dashboard
  185.   template:
  186.     metadata:
  187.       labels:
  188.         k8s-app: kubernetes-dashboard
  189.     spec:
  190.       containers:
  191.         - name: kubernetes-dashboard
  192.           image: kubernetesui/dashboard:v2.0.0-rc7
  193.           imagePullPolicy: Always
  194.           ports:
  195.             - containerPort: 8443
  196.               protocol: TCP
  197.           args:
  198.             - --auto-generate-certificates
  199.             - --namespace=kubernetes-dashboard
  200.             # Uncomment the following line to manually specify Kubernetes API server Host
  201.             # If not specified, Dashboard will attempt to auto discover the API server and connect
  202.             # to it. Uncomment only if the default does not work.
  203.             # - --apiserver-host=http://my-address:port
  204.           volumeMounts:
  205.             - name: kubernetes-dashboard-certs
  206.               mountPath: /certs
  207.               # Create on-disk volume to store exec logs
  208.             - mountPath: /tmp
  209.               name: tmp-volume
  210.           livenessProbe:
  211.             httpGet:
  212.               scheme: HTTPS
  213.               path: /
  214.               port: 8443
  215.             initialDelaySeconds: 30
  216.             timeoutSeconds: 30
  217.           securityContext:
  218.             allowPrivilegeEscalation: false
  219.             readOnlyRootFilesystem: true
  220.             runAsUser: 1001
  221.             runAsGroup: 2001
  222.       volumes:
  223.         - name: kubernetes-dashboard-certs
  224.           secret:
  225.             secretName: kubernetes-dashboard-certs
  226.         - name: tmp-volume
  227.           emptyDir: {}
  228.       serviceAccountName: kubernetes-dashboard
  229.       nodeSelector:
  230.         "beta.kubernetes.io/os": linux
  231.       # Comment the following tolerations if Dashboard must not be deployed on master
  232.       tolerations:
  233.         - key: node-role.kubernetes.io/master
  234.           effect: NoSchedule
  236. ---
  238. kind: Service
  239. apiVersion: v1
  240. metadata:
  241.   labels:
  242.     k8s-app: dashboard-metrics-scraper
  243.   name: dashboard-metrics-scraper
  244.   namespace: kubernetes-dashboard
  245. spec:
  246.   ports:
  247.     - port: 8000
  248.       targetPort: 8000
  249.   selector:
  250.     k8s-app: dashboard-metrics-scraper
  252. ---
  254. kind: Deployment
  255. apiVersion: apps/v1
  256. metadata:
  257.   labels:
  258.     k8s-app: dashboard-metrics-scraper
  259.   name: dashboard-metrics-scraper
  260.   namespace: kubernetes-dashboard
  261. spec:
  262.   replicas: 1
  263.   revisionHistoryLimit: 10
  264.   selector:
  265.     matchLabels:
  266.       k8s-app: dashboard-metrics-scraper
  267.   template:
  268.     metadata:
  269.       labels:
  270.         k8s-app: dashboard-metrics-scraper
  271.       annotations:
  272.         seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
  273.     spec:
  274.       containers:
  275.         - name: dashboard-metrics-scraper
  276.           image: kubernetesui/metrics-scraper:v1.0.4
  277.           ports:
  278.             - containerPort: 8000
  279.               protocol: TCP
  280.           livenessProbe:
  281.             httpGet:
  282.               scheme: HTTP
  283.               path: /
  284.               port: 8000
  285.             initialDelaySeconds: 30
  286.             timeoutSeconds: 30
  287.           volumeMounts:
  288.           - mountPath: /tmp
  289.             name: tmp-volume
  290.           securityContext:
  291.             allowPrivilegeEscalation: false
  292.             readOnlyRootFilesystem: true
  293.             runAsUser: 1001
  294.             runAsGroup: 2001
  295.       serviceAccountName: kubernetes-dashboard
  296.       nodeSelector:
  297.         "beta.kubernetes.io/os": linux
  298.       # Comment the following tolerations if Dashboard must not be deployed on master
  299.       tolerations:
  300.         - key: node-role.kubernetes.io/master
  301.           effect: NoSchedule
  302.       volumes:
  303.         - name: tmp-volume
  304.           emptyDir: {}
  1. [root@localhost soft]# kubectl create -f recommended.yaml 
  2. namespace/kubernetes-dashboard created
  3. serviceaccount/kubernetes-dashboard created
  4. service/kubernetes-dashboard created
  5. secret/kubernetes-dashboard-certs created
  6. secret/kubernetes-dashboard-csrf created
  7. secret/kubernetes-dashboard-key-holder created
  8. configmap/kubernetes-dashboard-settings created
  9. role.rbac.authorization.k8s.io/kubernetes-dashboard created
  10. clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
  11. rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  12. clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  13. deployment.apps/kubernetes-dashboard created
  14. service/dashboard-metrics-scraper created
  15. deployment.apps/dashboard-metrics-scraper created

查看pod，service

  1. [root@localhost soft]# kubectl get pod --all-namespaces
  2. NAMESPACE              NAME                                        READY   STATUS    RESTARTS   AGE
  3. kube-system            calico-kube-controllers-6566c5b7d8-hcm8j    1/1     Running   0          17m
  4. kube-system            calico-node-hv6wl                           1/1     Running   0          17m
  5. kube-system            coredns-7ff77c879f-g9cqf                    1/1     Running   0          25m
  6. kube-system            coredns-7ff77c879f-st5h7                    1/1     Running   0          25m
  7. kube-system            etcd-master01.paas.com                      1/1     Running   0          25m
  8. kube-system            kube-apiserver-master01.paas.com            1/1     Running   0          25m
  9. kube-system            kube-controller-manager-master01.paas.com   1/1     Running   0          25m
  10. kube-system            kube-proxy-bb58h                            1/1     Running   0          25m
  11. kube-system            kube-scheduler-master01.paas.com            1/1     Running   0          25m
  12. kubernetes-dashboard   dashboard-metrics-scraper-dc6947fbf-qhh7s   1/1     Running   0          2m27s
  13. kubernetes-dashboard   kubernetes-dashboard-5d4dc8b976-nklpk       1/1     Running   0          2m27s

同样的，如果有服务没启动，重启kubelet

  1. systemctl restart kubelet

浏览器访问
https://192.168.0.127:30000/
注意是https请求
浏览器会提示有风险，忽略，点击高级访问网站

  1. [root@localhost ~]# find / -name kubernetes-dashboard-token*
  2. /var/lib/kubelet/pods/5c6451f1-94c3-4061-be65-267467a24b8c/volumes/kubernetes.io~secret/kubernetes-dashboard-token-njb8k
  3. /var/lib/kubelet/pods/521c3913-a71b-498e-b7e3-8fa9c5ffe282/volumes/kubernetes.io~secret/kubernetes-dashboard-token-njb8k
  4. [root@localhost ~]# kubectl describe secrets -n kubernetes-dashboard kubernetes-dashboard-token-njb8k  | grep token | awk 'NR==3{print $2}' 
  5. eyJhbGciOiJSUzI1NiIsImtpZCI6IlQyU3l3Z09PWnZ6ajJwdzNJTUlISTJrSHZmUkE0ckhuSnMxMnBpNDVDV1UifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1uamI4ayIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjE3MTk0ZmNlLTM1YWYtNGY3MC1iYWI5LWUzZTBkMzRiOTMwZCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.HtGK9YDQlS4dBalBbBhydQzmInyGiYFhGPi8AJxGpVeU5kap_NLU4PKDA3vvd2xaQd8g6KtFl75fL9AgMcDetzzTLOJwWWNDxMkq9qeSQojLN9380XP4XQhkIFu5GxSLYEnGNdjUAS_Y9D7WVNJjJBjL-vEQKsxX6Gj7ybNVIJk82T4E0cc-YBydyfWzSRVYDu6YoFSx_GtdjBYknHM2VsZeimS7_2ojdrWptS4QoBhF1QgtvYRP1ggwm3i8l_7lT3-P6Efh-YVDLW3TXtnlKpZtRYz2XbrUkGrGIev-ihxSKEvsYREKL28SR0geDq3vxWMq3RNLRPYak4Q_XtxKsQ

找到并复制上述token
在浏览器中粘贴即可

点击确定，即可登录dashboard