Kubeadm部署Kubernetes
1、环境准备
主机名 | IP | 说明 | 宿主机系统 |
k8s-master | 10.0.0.101 | Kubernetes集群的master节点 | Ubuntu2004 |
k8s-node1 | 10.0.0.102 | Kubernetes集群的node节点 | Ubuntu2004 |
1-1、关闭防火墙、iptables、centos系列需要关闭selinux
#所有节点执行：
[root@ubuntu2004 ~]#systemctl stop ufw
[root@ubuntu2004 ~]#iptables -nvL
1-2、各节点主机名相互解析
#所有节点执行：
[root@ubuntu2004 ~]#hostnamectl set-hostname k8s-master
[root@ubuntu2004 ~]#vim /etc/hosts
10.0.0.101 master
10.0.0.102 node
1-3、时间同步
#所有节点执行：
[root@master ~]#apt install -y chrony
[root@master ~]#vim /etc/chrony/chrony.conf
server ntp.aliyun.com iburst
[root@master ~]#systemctl enable --now chrony
[root@master ~]#chronyc sources
1-4、禁用swap
#所有节点执行：
[root@master ~]#swapoff -a
[root@master ~]#vim /etc/fstab
#/swap.img none swap sw 0 0
1-5、修改网桥内核参数
#所有节点执行：
#允许 iptables 检查桥接流量
[root@master ~]#apt install -y bridge-utils #默认没有该模块，需要安装
[root@master ~]#cat <<EOF | tee /etc/modules-load.d/modules.conf
br_netfilter
EOF
[root@master ~]#modprobe br_netfilter
[root@master ~]#lsmod | grep br_netfilter
[root@master ~]#cat > /etc/sysctl.d/kubernetes.conf <<EOF
net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
user.max_user_namespaces=28633
EOF
[root@master ~]#sysctl -p /etc/sysctl.d/kubernetes.conf
2、安装docker
#所有节点执行：
[root@master ~]#apt install docker.io -y
#ubuntu默认自动启动并开机启动，如果未设置请收到设置
#配置加速器，使用 systemd 来管理容器的 cgroup
[root@master ~]#vim /etc/docker/daemon.json
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
],
"experimental": false,
"debug": false,
"max-concurrent-downloads": 10,
"registry-mirrors": ["https://pgavrk5n.mirror.aliyuncs.com"]
}
[root@master ~]#systemctl daemon-reload
[root@master ~]#systemctl restart docker
3、部署k8sMaster节点
# 所有节点执行：
# 可参考阿里云官网：https://developer.aliyun.com/mirror/kubernetes
# 使apt支持ssl传输 并安装kubelet kubeadm kubectl
[root@master ~]#apt-get install -y ca-certificates curl software-properties-common apt-transport-https curl
[root@master ~]#apt-get update && apt-get install -y apt-transport-https
curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -
cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
EOF
apt-get update
apt-get install -y kubelet=1.23.1-00 kubeadm=1.23.1-00 kubectl=1.23.1-00
# 阻止自动更新(apt upgrade时忽略)。所以更新的时候先unhold，更新完再hold。
apt-mark hold kubelet kubeadm kubectl
# 先不要启动，如果启动会报错
#master上执行（10.0.0.101）：
[root@master ~]#vim kubeadm-config.yaml
apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 10.0.0.101 #当前机器的局域网地址
bindPort: 6443
nodeRegistration:
criSocket: /var/run/dockershim.sock
imagePullPolicy: IfNotPresent
name: master
taints: null
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: 1.23.1
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
scheduler: {}
---
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
#cgroupDriver: systemd
cgroupDriver: cgroupfs
#master上执行（10.0.0.101）：
# 在运行 kubeadm init 之前先执行 kubeadm config images pull 来测试与 gcr.io 的连接，kubeadm config images pull尝试是否可以拉取镜像，如果你的服务器再国内，由于某些原因，是无法访问"k8s.gcr.io", "gcr.io", "quay.io"
[root@k8s-master ~]#kubeadm config images list #查看kubeadm config 依赖的images有哪些
#执行结果如下
k8s.gcr.io/kube-apiserver:v1.23.8
k8s.gcr.io/kube-controller-manager:v1.23.8
k8s.gcr.io/kube-scheduler:v1.23.8
k8s.gcr.io/kube-proxy:v1.23.8
k8s.gcr.io/pause:3.6
k8s.gcr.io/etcd:3.5.1-0
k8s.gcr.io/coredns/coredns:v1.8.6
#从国内镜像拉取
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.23.8
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.23.8
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.23.8
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.23.8
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
[root@master ~]#docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.1-0
[root@master ~]#docker pull coredns/coredns:1.8.6
#或者拉取最新版，一条命令如下：
[root@k8s-master ~]#kubeadm config images pull --image-repository=registry.aliyuncs.com/google_containers #拉取镜像
#master上执行（10.0.0.101）：
#将拉取下来的images重命名为kubeadm config所需的镜像名字
#注意版本号有的是带v的，有的不带的v
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.23.8 k8s.gcr.io/kube-apiserver:v1.23.8
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.23.8 k8s.gcr.io/kube-controller-manager:v1.23.8
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.23.8 k8s.gcr.io/kube-scheduler:v1.23.8
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.23.8 k8s.gcr.io/kube-proxy:v1.23.8
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6 k8s.gcr.io/pause:3.6
[root@master ~]#docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.1-0 k8s.gcr.io/etcd:3.5.1-0
[root@master ~]#docker tag coredns/coredns:1.8.6 k8s.gcr.io/coredns/coredns:v1.8.6
#master上执行（10.0.0.101）：
#初始化
[root@master ~]#kubeadm init --config kubeadm-config.yaml
#如果提示以下信息，安装成功，如果安装失败，请卸载kubectl、kubeadm、kubelet 然后再重新执行
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.0.0.101:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:415922bb8c4fd6768756559cdabc18bacc8661c86ebd411be9e6cd1036041c09
#记住上边的node加入集群的命令，如果忘记，可以使用如下命令获取：
kubeadm token create --print-join-command
4、部署node节点
#所有node节点执行：
#请确保基础环境已经部署好（时间同步，防火墙，解析，swap，内核参数）
[root@node ~]#apt-get install -y ca-certificates curl software-properties-common apt-transport-https curl
[root@node ~]#apt-get update && apt-get install -y apt-transport-https
[root@node ~]#curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -
[root@node ~]# cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
EOF
[root@node ~]#apt update
[root@node ~]#apt install -y kubelet=1.23.1-00 kubeadm=1.23.1-00 kubectl=1.23.1-00
[root@node2 ~]#apt-mark hold kubelet kubeadm kubectl
# 所有node节点执行：
# 加入集群（master节点安装完成后的提示命令）
[root@node ~]#kubeadm join 10.0.0.101:6443 --token abcdef.0123456789abcdef \
> --discovery-token-ca-cert-hash sha256:415922bb8c4fd6768756559cdabc18bacc8661c86ebd411be9e6cd1036041c09
#提示以下信息，表示加入集群成功
......
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
# 如果此处报错，则需要执行kubeadm reset重启
5、部署 Calico
#master上执行（10.0.0.101）：
[root@master ~]#kubectl apply -f https://docs.projectcalico.org/v3.21/manifests/calico.yaml
#安装完成后需要等待k8s重新拉起节点
[root@master ~]#kubectl get nodes
NAME STATUS ROLES AGE VERSION
master Ready control-plane,master 53m v1.23.1
node Ready <none> 8m26s v1.23.1
