K8S（二）集群搭建(kubeadm 方式)

绝地灬酷狼 2023-01-10 14:41 219阅读 0赞

# 一、背景 #

由于之前没有接触过K8S，对K8S的了解少之又少，因此想着搭建一个简单的先熟悉一下。我看了一下kubeadm的简介，两条命令实现集群的部署，是不是很诱人，于是乎就先用这种方式先部署一下，试炼结果如下：

# 二、安装要求 #

在开始之前，部署Kubernetes集群机器需要满足以下几个条件：

*  一台或多台机器，操作系统 CentOS7.x-86\_x64
 *  硬件配置：2GB或更多RAM，2个CPU或更多CPU，硬盘30GB或更多
 *  可以访问外网，需要拉取镜像，如果服务器不能上网，需要提前下载镜像并导入节点
 *  禁止swap分区

# 三、环境准备 #

![image][]

<table> 
 <thead> 
  <tr> 
   <th>角色</th> 
   <th>ip</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>k8smaster</td> 
   <td>192.168.1.8</td> 
  </tr> 
  <tr> 
   <td>k8snodes1</td> 
   <td>192.168.1.4</td> 
  </tr> 
 </tbody> 
</table>

# 四、系统初始化 #

## 4.1 关闭防火墙(master+node) ##

$ systemctl stop firewalld
    $ systemctl disable firewalld

## 4.2 关闭selinux：(master+node) ##

$ sed -i 's/enforcing/disabled/' /etc/selinux/config # 永久
    $ setenforce 0 # 临时

## 4.3 关闭swap分区(master+node) ##

$ swapoff -a # 临时
    $ vim /etc/fstab # 永久
    ...
    /dev/mapper/cl-root     /                       xfs     defaults        0 0
    UUID=f384615e-7c71-43b0-876c-45e8f08cfa6e /boot                   ext4    defaults        1 2
    /dev/mapper/cl-home     /home                   xfs     defaults        0 0
    /dev/mapper/cl-swap     swap                    swap    defaults        0 0

把加载swap分区的那行记录注释掉即可

## 4.4 设置主机名(master+node) ##

$ hostnamectl set-hostname <hostname>

## 4.5 在 master 添加 hosts：(master only) ##

$ cat >> /etc/hosts << EOF
    192.168.1.8 k8smaster
    192.168.1.4 k8snode1
    EOF

## 4.6 将桥接的 IPv4 流量传递到 iptables 的链：(master+node) ##

$ cat > /etc/sysctl.d/k8s.conf << EOF
    net.bridge.bridge-nf-call-ip6tables = 1
    net.bridge.bridge-nf-call-iptables = 1
    EOF
    $ sysctl --system # 生效

## 4.7 时间同步(master+node) ##

$ yum install ntpdate -y
    $ ntpdate time.windows.com

## 4.8 安装 Docker/kubeadm/kubelet(master+node) ##

1.  Kubernetes 默认 CRI（容器运行时）为 Docker，因此先安装 Docker。

$ wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O
    /etc/yum.repos.d/docker-ce.repo
    $ yum -y install docker-ce-18.06.1.ce-3.el7
    $ systemctl enable docker && systemctl start docker
    $ docker --version

1.  添加阿里云 YUM 软件源

# cat > /etc/docker/daemon.json << EOF
    {
    "registry-mirrors": ["https://b9pmyelo.mirror.aliyuncs.com"]
    }
    EOF

1.  添加 yum 源

$ cat > /etc/yum.repos.d/kubernetes.repo << EOF
    [kubernetes]
    name=Kubernetes
    baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
    enabled=1
    gpgcheck=0
    repo_gpgcheck=0
    gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
    https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
    EOF

1.  安装 kubeadm，kubelet 和 kubectl

$ yum install -y kubelet kubeadm kubectl
    $ systemctl enable kubelet

# 五、部署 Kubernetes Master #

1.  在 192.168.1.8（Master）执行初始化

$ kubeadm init \
    --apiserver-advertise-address=192.168.1.8 \
    --image-repository registry.aliyuncs.com/google_containers \
    --kubernetes-version v1.17.0 \
    --service-cidr=10.96.0.0/12 \
    --pod-network-cidr=10.244.0.0/16

1.  使用 kubectl 工具：

mkdir -p $HOME/.kube
    sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
    sudo chown $(id -u):$(id -g) $HOME/.kube/config
    $ kubectl get nodes

# 六、安装 Pod 网络插件（CNI） #

## 1. 通过网络下载 ##

$ kubectl apply –f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kubeflannel.yml

## 2. 创建kube-flannel.yml文件 ##

---
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: psp.flannel.unprivileged
      annotations:
        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
        seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
        apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
        apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    spec:
      privileged: false
      volumes:
      - configMap
      - secret
      - emptyDir
      - hostPath
      allowedHostPaths:
      - pathPrefix: "/etc/cni/net.d"
      - pathPrefix: "/etc/kube-flannel"
      - pathPrefix: "/run/flannel"
      readOnlyRootFilesystem: false
      # Users and groups
      runAsUser:
        rule: RunAsAny
      supplementalGroups:
        rule: RunAsAny
      fsGroup:
        rule: RunAsAny
      # Privilege Escalation
      allowPrivilegeEscalation: false
      defaultAllowPrivilegeEscalation: false
      # Capabilities
      allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
      defaultAddCapabilities: []
      requiredDropCapabilities: []
      # Host namespaces
      hostPID: false
      hostIPC: false
      hostNetwork: true
      hostPorts:
      - min: 0
        max: 65535
      # SELinux
      seLinux:
        # SELinux is unused in CaaSP
        rule: 'RunAsAny'
    ---
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: flannel
    rules:
    - apiGroups: ['extensions']
      resources: ['podsecuritypolicies']
      verbs: ['use']
      resourceNames: ['psp.flannel.unprivileged']
    - apiGroups:
      - ""
      resources:
      - pods
      verbs:
      - get
    - apiGroups:
      - ""
      resources:
      - nodes
      verbs:
      - list
      - watch
    - apiGroups:
      - ""
      resources:
      - nodes/status
      verbs:
      - patch
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: flannel
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: flannel
    subjects:
    - kind: ServiceAccount
      name: flannel
      namespace: kube-system
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: flannel
      namespace: kube-system
    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: kube-flannel-cfg
      namespace: kube-system
      labels:
        tier: node
        app: flannel
    data:
      cni-conf.json: |
        {
          "name": "cbr0",
          "cniVersion": "0.3.1",
          "plugins": [
            {
              "type": "flannel",
              "delegate": {
                "hairpinMode": true,
                "isDefaultGateway": true
              }
            },
            {
              "type": "portmap",
              "capabilities": {
                "portMappings": true
              }
            }
          ]
        }
      net-conf.json: |
        {
          "Network": "10.244.0.0/16",
          "Backend": {
            "Type": "vxlan"
          }
        }
    ---
    apiVersion: apps/v1
    kind: DaemonSet
    metadata:
      name: kube-flannel-ds
      namespace: kube-system
      labels:
        tier: node
        app: flannel
    spec:
      selector:
        matchLabels:
          app: flannel
      template:
        metadata:
          labels:
            tier: node
            app: flannel
        spec:
          affinity:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                - matchExpressions:
                  - key: kubernetes.io/os
                    operator: In
                    values:
                    - linux
          hostNetwork: true
          priorityClassName: system-node-critical
          tolerations:
          - operator: Exists
            effect: NoSchedule
          serviceAccountName: flannel
          initContainers:
          - name: install-cni
            image: quay.io/coreos/flannel:v0.13.1-rc1
            command:
            - cp
            args:
            - -f
            - /etc/kube-flannel/cni-conf.json
            - /etc/cni/net.d/10-flannel.conflist
            volumeMounts:
            - name: cni
              mountPath: /etc/cni/net.d
            - name: flannel-cfg
              mountPath: /etc/kube-flannel/
          containers:
          - name: kube-flannel
            image: quay.io/coreos/flannel:v0.13.1-rc1
            command:
            - /opt/bin/flanneld
            args:
            - --ip-masq
            - --kube-subnet-mgr
            resources:
              requests:
                cpu: "100m"
                memory: "50Mi"
              limits:
                cpu: "100m"
                memory: "50Mi"
            securityContext:
              privileged: false
              capabilities:
                add: ["NET_ADMIN", "NET_RAW"]
            env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            volumeMounts:
            - name: run
              mountPath: /run/flannel
            - name: flannel-cfg
              mountPath: /etc/kube-flannel/
          volumes:
          - name: run
            hostPath:
              path: /run/flannel
          - name: cni
            hostPath:
              path: /etc/cni/net.d
          - name: flannel-cfg
            configMap:
              name: kube-flannel-cfg

进入文件所在目录，执行`kubectl apply -f kube-flannel.yml`

# 七、添加Kubernetes Node（Node only） #

$ kubeadm join 192.168.1.8:6443 --token esce21.q6hetwm8si29qxwn \
    --discovery-token-ca-cert-hash
    sha256:00603a05805807501d7181c3d60b478788408cfe6cedefedb1f97569708be9c5

# 八、测试 kubernetes 集群 #

$ kubectl create deployment nginx --image=nginx
    $ kubectl expose deployment nginx --port=80 --type=NodePort
    $ kubectl get pod,svc

![image][image 1]

[image]: /images/20221119/41b22a7c00054ba18e7b8475fdeac721.png
[image 1]: https://img-blog.csdnimg.cn/img_convert/42488fe4aae2db82e35dc451100c63ed.png