Kubernetes（k8s）centos7和8快速部署
Posted 养了一只皮卡丘
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Kubernetes（k8s）centos7和8快速部署相关的知识，希望对你有一定的参考价值。
Kubernetes快速部署
kubeadm是官方社区推出的一个用于快速部署kubernetes集群的工具。
这个工具能通过两条指令完成一个kubernetes集群的部署：
# 创建一个 Master 节点
$ kubeadm init
# 将一个 Node 节点加入到当前集群中
$ kubeadm join <Master节点的IP和端口>
1. 安装要求
在开始之前，部署Kubernetes集群机器需要满足以下几个条件：
-至少3台机器，操作系统 CentOS7+
- 硬件配置：2GB或更多RAM，2个CPU或更多CPU，硬盘20GB或更多
- 集群中所有机器之间网络互通
- 可以访问外网，需要拉取镜像
- 禁止swap分区
2. 学习目标
- 在所有节点上安装Docker和kubeadm
- 部署Kubernetes Master
- 部署容器网络插件
- 部署 Kubernetes Node，将节点加入Kubernetes集群中
- 部署Dashboard Web页面，可视化查看Kubernetes资源
3. 准备环境
ps：建议三台centos7，我用kubeletv1.23.1也做出来了。虽然kubeadm源是7，
也可以用三台centos8，kubeletv1.20.0稳定版（最新版可安装不一定能运行）
环境：三台centos7
| 角色 | IP | 配置 |
|---|---|---|
| master | 192.168.143.140 | 2G 4核 |
| node1 | 192.168.143.141 | 3G 4核 |
| node2 | 192.168.143.142 | 3G 4核 |
//给三台主机修改名字
[root@master ~]# hostname
master.example.com
[root@node1 ~]# hostname
node1.example.com
[root@node2 ~]# hostname
node2.example.com
//给三台主机关闭防火墙，selinux
systemctl disable firewalld
sed -i 's/enforcing/disabled/' /etc/selinux/config
//给三台主机关闭swap：
vim /etc/fstab
#/dev/mapper/centos-swap swap swap defaults 0 0
注释掉swap分区
在master添加hosts：
[root@master ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
//后面添加此三行
192.168.143.140 master master.example.com
192.168.143.141 node1 node1.example.com
192.168.143.142 node2 node2.example.com
//将桥接的IPv4流量传递到iptables的链：
[root@master ~]# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
//生效
[root@master ~]# sysctl --system
* Applying /usr/lib/sysctl.d/00-system.conf ...
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.all.promote_secondaries = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
* Applying /etc/sysctl.conf ...
//给三台主机做时间同步：
yum -y install chrony
vim /etc/chrony.conf
pool time1.aliyun.com iburst //时间同步删除原有的4条，修改为此行
systemctl enable chronyd
//免密认证：
[root@master ~]# ssh-keygen -t rsa
[root@master ~]# ssh-copy-id master
[root@master ~]# ssh-copy-id node1
[root@master ~]# ssh-copy-id node2
//检查状态
[root@master ~]# for i in node1 node2 master;do ssh root@$i 'reboot';done
[root@master ~]# for i in master node1 node2;do ssh root@$i 'getenforce';done
Disabled
Disabled
Disabled
[root@master ~]# for i in master node1 node2;do ssh root@$i 'date';done
[root@master ~]# for i in master node1 node2;do ssh root@$i 'free -h';done
total used free shared buff/cache available
Mem: 1.8G 105M 1.5G 9.6M 197M 1.5G
Swap: 0B 0B 0B
total used free shared buff/cache available
Mem: 2.8G 108M 2.5G 9.4M 194M 2.5G
Swap: 0B 0B 0B
total used free shared buff/cache available
Mem: 2.8G 111M 2.5G 9.4M 194M 2.5G
Swap: 0B 0B 0B
4. 所有节点安装Docker/kubeadm/kubelet
Kubernetes默认CRI（容器运行时）为Docker，因此先安装Docker。
4.1 配置kubeadm源安装Docker
//给三台主机配置kubeadm源
# cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
//给三台主机做docker源
# wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
//建立缓存
# rm -rf /var/cache/yum/*
# yum makecache
//给三台主机配置docker-ce
# yum install -y docker-ce
# systemctl enable --now docker
# cat > /etc/docker/daemon.json << EOF
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"],
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts":
"max-size": "100m"
,
"storage-driver": "overlay2"
EOF
# systemctl daemon-reload
# systemctl restart docker
# docker info //查看有无配置
4.2 安装kubeadm，kubelet和kubectl
//不指定版本为最新版本，也可以使用
由于版本更新频繁，这里指定版本号部署：
//给三台主机做
# yum install -y kubelet-1.20.0 kubeadm-1.20.0 kubectl-1.20.0
# systemctl enable kubelet
5. 部署Kubernetes Master
在Master执行。
//注意 ip是master的 。version是kuber的版本。可以变
[root@master ~]# kubeadm init --apiserver-advertise-address 192.168.143.140 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.20.0 --service-cidr=10.96.0.0/12 --pod-network-cidr=10.244.0.0/16
//存储信息。此行内容是。init完成后产生后，最后一行数据，添加集群时要用到。
[root@master ~]# vi init
kubeadm join 192.168.143.140:6443 --token arkgcf.smaj7konv41yifxd \\
--discovery-token-ca-cert-hash sha256:30e1b03d7112abc8ed8b84bf0c69ef4bdb3498911ac468f3a2c7887bdd38918c
[root@master ~]# echo 'export KUBECONFIG=/etc/kubernetes/admin.conf' > /etc/profile.d/k8s.sh
[root@master ~]# source /etc/profile.d/k8s.sh
由于默认拉取镜像地址k8s.gcr.io国内无法访问，这里指定阿里云镜像仓库地址。
//普通用户要做的事，使用kubectl工具：
# mkdir -p $HOME/.kube
# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
# sudo chown $(id -u):$(id -g) $HOME/.kube/config
# kubectl get nodes
6. 安装Pod网络插件（CNI）
[root@master ~]# vim flannel.yaml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unused in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flannel
subjects:
- kind: ServiceAccount
name: flannel
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: flannel
namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
name: kube-flannel-cfg
namespace: kube-system
labels:
tier: node
app: flannel
data:
cni-conf.json: |
"name": "cbr0",
"cniVersion": "0.3.1",
"plugins": [
"type": "flannel",
"delegate":
"hairpinMode": true,
"isDefaultGateway": true
,
"type": "portmap",
"capabilities":
"portMappings": true
]
net-conf.json: |
"Network": "10.244.0.0/16",
"Backend":
"Type": "vxlan"
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
hostNetwork: true
priorityClassName: system-node-critical
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni-plugin
image: rancher/mirrored-flannelcni-flannel-cni-plugin:v1.0.0
command:
- cp
args:
- -f
- /flannel
- /opt/cni/bin/flannel
volumeMounts:
- name: cni-plugin
mountPath: /opt/cni/bin
- name: install-cni
image: quay.io/coreos/flannel:v0.15.1
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.15.1
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN", "NET_RAW"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni-plugin
hostPath:
path: /opt/cni/bin
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
[root@master ~]# kubectl apply -f flannel.yaml
确保能够访问到quay.io这个registery。
7. 加入Kubernetes Node
在node1 和node2执行。
向集群添加新节点，执行在kubeadm init输出的kubeadm join命令：
kubeadm join 192.168.143.140:6443 --token arkgcf.smaj7konv41yifxd \\
> --discovery-token-ca-cert-hash sha256:30e1b03d7112abc8ed8b84bf0c69ef4bdb3498911ac468f3a2c7887bdd38918c
8. 测试kubernetes集群
在Kubernetes集群中创建一个pod，验证是否正常运行：
[root@master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master.example.com Ready control-plane,master 21m v1.20.0
node1.example.com Ready <none> 5m44s v1.20.0
node2.example.com Ready <none> 5m39s v1.20.0
[root@master ~]# kubectl create deployment nginx --image=nginx
deployment.apps/nginx created
[root@master ~]# kubectl expose deployment nginx --port=80 --type=NodePort
service/nginx exposed
//获取svc，pods的信息
[root@master ~]# kubectl get svc,pods
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 28m
service/nginx NodePort 10.109.147.208 <none> 80:32432/TCP 5m20s
NAME READY STATUS RESTARTS AGE
pod/nginx-6799fc88d8-wk29t 1/1 Running 0 6m18s
//测试主机ip访问
[root@master ~]# curl 192.168.143.140:32432
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html color-scheme: light dark;
body width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
//建议使用server的ip来访问，因为不会改变
[root@master ~]# curl 10.109.147.208
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html color-scheme: light dark;
body width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
访问地址：http://NodeIP:Port
以上是关于Kubernetes（k8s）centos7和8快速部署的主要内容，如果未能解决你的问题，请参考以下文章
centos7下的k8s+dashboard集群部署---k8s部署