资源列表
基础环境
关闭防火墙
systemctl stop firewalld
systemctl disable firewalld关闭内核安全机制
setenforce 0
sed -i "s/^SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config修改主机名
hostnamectl set-hostname master
hostnamectl set-hostname node1
hostnamectl set-hostname node2一、准备环境
在正式开始部署kubernetes集群之前，先要进行如下准备工作。基础环境相关配置操作，在三台主机master、node01、node02上都需要执行
1.1、绑定hosts
cat >> /etc/hosts << EOF
192.168.93.151 master
192.168.93.152 node1
192.168.93.153 node2
EOF1.2、安装常用软件
yum -y install vim lrzsz unzip wget net-tools tree bash-completion telnet ntpdate1.3、关闭交换分区
kubeadm不支持swap
# 临时关闭
swapoff -a
# 永久关闭
sed -i '/swap/s/^/#/' /etc/fstab 1.4、配置时间同步器
# 同步阿里云时间
ntpdate ntp.aliyun.com1.5、桥接IPv4流量传递给iptables的链
# 加载 overlay 内核模块
modprobe overlay
# 加载 br_netfilter 模块
modprobe br_netfilter
# 开启路由转发和网络配置
sed -i 's/net.ipv4.ip_forward=0/net.ipv4.ip_forward=1/g' /etc/sysctl.conf
cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF
# 加载配置
sysctl --system1.6、安装Runc
Runc是一个轻量级的容器运行环境
wget https://github.com/opencontainers/runc/releases/download/v1.1.9/runc.amd64
install -m 755 runc.amd64 /usr/local/sbin/runc1.7、安装cni-plugin
cni-plugin是容器网络接口插件
mkdir -p /opt/cni/bin
wget https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-amd64-v1.3.0.tgz
tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.3.0.tgz 二、准备Containerd容器运行时
三台主机都要操作
2.1、安装Containerd
# 添加 docker 源，containerd也在docker源内的
cat <<EOF | sudo tee /etc/yum.repos.d/docker-ce.repo
[docker]
name=docker-ce
baseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/x86_64/stable/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
EOF
# 重建yum缓存
yum makecache
# 安装Containerd容器
yum -y install containerd.io-1.6.6-3.1.el7.x86_642.2、配置Containerd
# 生成配置文件
mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
# 修改/etc/containerd/config.toml文件中sandbox_image的值
grep 'sandbox_image' /etc/containerd/config.toml
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"2.3、配置镜像加速器
# 创建所需目录
mkdir -p /etc/containerd/certs.d/docker.io/
# 添加如下内容
vim /etc/containerd/certs.d/docker.io/hosts.toml
####################################################
server = "https://docker.io"
[host."https://cf-workers-docker-io-8jv.pages.dev/"]
capabilities = ["pull", "resolve"]
##################################################### 在配置文件中找到配置段添加镜像地址目录
cat /etc/containerd/config.toml | grep config_path
config_path = "/etc/containerd/certs.d"2.4、启动Containerd
systemctl enable containerd
systemctl start containerd三、部署Kubernetes集群
准备好基础环境和Containerd环境后，下面就开始通过kubeadm来部署kubernetes集群
3.1、安装Kubeadm工具
所有节点都要操作
# 添加Kubernetes源
cat << EOF >> /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
# 重建yum缓存
yum makecache
# 安装 kubectl：命令行管理工具、kubeadm：安装K8S集群工具、kubelet管理容器工具
yum install -y kubelet-1.28.0 kubeadm-1.28.0 kubectl-1.28.0
# 切记这个时候不要启动，只需要设置为开机自启
systemctl enable kubelet.service 3.2、配置crictl工具
crictl是CRI兼容的容器运行时命令行接口。你可以使用它来检查和调试Kubernetes节点上的容器运行时和应用程序。crictl和它的源代码在 cri-tools 代码库
更好 Containerd后，以上我们常用的docker命令也不再使用了，取而代之恶的分别是 crictl 和 ctr 两个命令行客户端
crictl是遵循CRI接口规范的一个命令行工具，通常用它来检查和管理kubelet节点上的容器运行时和镜像
ctr是containerd的一个客户端工具
# 所有节点都要操作
cat << EOF >> /etc/crictl.yaml
runtime-endpoint: unix:///var/run/containerd/containerd.sock
image-endpoint: unix:///var/run/containerd/containerd.sock
timeout: 10
debug: false
EOF3.3、初始化Master节点
在master节点上操作
# 初始化配置文件填写如下内容即可,根据所需进行修改比如IP地址Pod网段,Service网段
[root@master ~]# vim init-k8s.yaml
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
bootstrapTokens:
- token: abcdef.0123456789abcdef
ttl: 24h0m0s
localAPIEndpoint:
advertiseAddress: 192.168.93.151
bindPort: 6443
nodeRegistration:
criSocket: unix:///var/run/containerd/containerd.sock
imagePullPolicy: IfNotPresent
taints: []
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
apiServer:
timeoutForControlPlane: 4m0s
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kubernetesVersion: 1.28.2
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
podSubnet: 10.244.0.0/16
scheduler: {}
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
failSwapOn: false
address: 0.0.0.0
enableServer: true
cgroupDriver: cgroupfs
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
ipvs:
strictARP: true# 拉取所需镜像
[root@master ~]# kubeadm config images pull --config=init-k8s.yaml
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-apiserver:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-controller-manager:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-scheduler:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-proxy:v1.28.2
[config/images] Pulled registry.aliyuncs.com/google_containers/pause:3.9
[config/images] Pulled registry.aliyuncs.com/google_containers/etcd:3.5.9-0
[config/images] Pulled registry.aliyuncs.com/google_containers/coredns:v1.10.1# 初始化Master节点
[root@master ~]# kubeadm init --config=init-k8s.yaml
[init] Using Kubernetes version: v1.28.2
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master] and IPs [10.96.0.1 192.168.93.151]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [localhost master] and IPs [192.168.93.151 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost master] and IPs [192.168.93.151 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 6.002290 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node master as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[bootstrap-token] Using token: abcdef.0123456789abcdef
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
####################################################
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
####################################################
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
####################################################
kubeadm join 192.168.93.151:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:c4f318538fe20291780266d53687be756a6e4908431be4cd157cfec63329fece ####################################################3.4、master节点复制k8s认证文件到用户的home目录
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config3.5、Node节点加入集群
直接把master节点初始化之后的最后回显的token复制粘贴到node节点回车即可，无须做任何配置
# node1
[root@node1 ~]# kubeadm join 192.168.93.151:6443 --token abcdef.0123456789abcdef \
> --discovery-token-ca-cert-hash sha256:c4f318538fe20291780266d53687be756a6e4908431be4cd157cfec63329fece
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.# node2
[root@node2 ~]# kubeadm join 192.168.93.151:6443 --token abcdef.0123456789abcdef \
> --discovery-token-ca-cert-hash sha256:c4f318538fe20291780266d53687be756a6e4908431be4cd157cfec63329fece
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.四、部署calico网络插件（CNI）
# 只需在master节点执行即可
[root@master ~]# kubectl apply -f calico.yaml五、验证集群
5.1、Master打污点
master节点操作即可
Euler操作系统安装的K8S集群默认情况下master节点也会接受Pod，为了确保集群的稳定性，须给master节点打污点
给节点 master节点增加一个污点，它的键名是 key1，键值是 value1，效果是NoSchedule，此污点动作为该节点不会接受任何Pod的调度
[root@master ~]# kubectl taint nodes master key1=value1:NoSchedule
node/master tainted5.2、查看节点状态
master节点操作即可
[root@master ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
master Ready control-plane 10h v1.28.0
node1 Ready <none> 10h v1.28.0
node2 Ready <none> 10h v1.28.05.3、查看默认Pod状态
master节点操作即可
[root@master ~]# kubectl get pod -A
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system calico-kube-controllers-658d97c59c-dp9jz 1/1 Running 1 (110s ago) 6m11s
kube-system calico-node-4jf7h 1/1 Running 1 (110s ago) 6m11s
kube-system calico-node-js549 1/1 Running 1 (114s ago) 6m11s
kube-system calico-node-qtznm 1/1 Running 0 11s
kube-system coredns-66f779496c-mkjr9 1/1 Running 1 (110s ago) 42m
kube-system coredns-66f779496c-nfncj 1/1 Running 3 (110s ago) 13h
kube-system etcd-master 1/1 Running 3 (114s ago) 13h
kube-system kube-apiserver-master 1/1 Running 3 (114s ago) 13h
kube-system kube-controller-manager-master 1/1 Running 3 (114s ago) 13h
kube-system kube-proxy-f4xck 1/1 Running 3 (114s ago) 13h
kube-system kube-proxy-hfv9v 1/1 Running 3 (110s ago) 13h
kube-system kube-proxy-lnh5z 1/1 Running 3 (110s ago) 13h
kube-system kube-scheduler-master 1/1 Running 3 (114s ago) 13h5.4、查看组件状态
master节点操作即可
[root@master ~]# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME STATUS MESSAGE ERROR
controller-manager Healthy ok
etcd-0 Healthy ok
scheduler Healthy ok