Kubernetes部署(一):架構及功能說明
Kubernetes部署(二):系統環境初始化
Kubernetes部署(三):CA證書製做
Kubernetes部署(四):ETCD集羣部署
Kubernetes部署(五):Haproxy、Keppalived部署
Kubernetes部署(六):Master節點部署
Kubernetes部署(七):Node節點部署
Kubernetes部署(八):Flannel網絡部署
Kubernetes部署(九):CoreDNS、Dashboard、Ingress部署
Kubernetes部署(十):儲存之glusterfs和heketi部署
Kubernetes部署(十一):管理之Helm和Rancher部署
Kubernetes部署(十二):helm部署harbor企業級鏡像倉庫node
[root@node-01 ~]# cd /usr/local/src/kubernetes [root@node-01 kubernetes]# cp server/bin/kube-apiserver /data/kubernetes/bin/ [root@node-01 kubernetes]# cp server/bin/kube-controller-manager /data/kubernetes/bin/ [root@node-01 kubernetes]# cp server/bin/kube-scheduler /data/kubernetes/bin/ [root@node-01 kubernetes]# scp server/bin/kube-apiserver 10.31.90.202:/data/kubernetes/bin/ [root@node-01 kubernetes]# scp server/bin/kube-apiserver 10.31.90.203:/data/kubernetes/bin/ [root@node-01 kubernetes]# scp server/bin/kube-controller-manager 10.31.90.202:/data/kubernetes/bin/ [root@node-01 kubernetes]# scp server/bin/kube-controller-manager 10.31.90.203:/data/kubernetes/bin/ [root@node-01 kubernetes]# scp server/bin/kube-scheduler 10.31.90.202:/data/kubernetes/bin [root@node-01 kubernetes]# scp server/bin/kube-scheduler 10.31.90.203:/data/kubernetes/bin/
[root@node-01 src]# vim kubernetes-csr.json { "CN": "kubernetes", "hosts": [ "127.0.0.1", "10.31.90.200", "10.31.90.201", "10.31.90.202", "10.31.90.203", "10.1.0.1", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] }
[root@node-01 src]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \ -ca-key=/data/kubernetes/ssl/ca-key.pem \ -config=/data/kubernetes/ssl/ca-config.json \ -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes [root@node-01 ssl]# cp kubernetes*.pem /data/kubernetes/ssl/ [root@node-01 ssl]# scp kubernetes*.pem 10.31.90.202:/data/kubernetes/ssl/ [root@node-01 ssl]# scp kubernetes*.pem 10.31.90.203:/data/kubernetes/ssl/
[root@node-01 ssl]# head -c 16 /dev/urandom | od -An -t x | tr -d ' ' cf25becebf64e3fffd7f3890a60ac16d [root@node-01 ssl]# vim /data/kubernetes/ssl/bootstrap-token.csv cf25becebf64e3fffd7f3890a60ac16d,kubelet-bootstrap,10001,"system:kubelet-bootstrap" [root@node-01 ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.202:/data/kubernetes/ssl/ [root@node-01 ssl]# scp /data/kubernetes/ssl/bootstrap-token.csv 10.31.90.203:/data/kubernetes/ssl/
[root@node-01 ssl]# vim /data/kubernetes/ssl/basic-auth.csv admin,admin,1 readonly,readonly,2 [root@node-01 ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.202:/data/kubernetes/ssl/ [root@node-01 ssl]# scp /data/kubernetes/ssl/basic-auth.csv 10.31.90.203:/data/kubernetes/ssl/
三個master節點都須要部署git
[root@node-01 ~]# vim /usr/lib/systemd/system/kube-apiserver.service [Unit] Description=Kubernetes API Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=network.target [Service] ExecStart=/data/kubernetes/bin/kube-apiserver \ --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,NodeRestriction \ --bind-address=10.31.90.201 \ --insecure-bind-address=10.31.90.201 \ --authorization-mode=Node,RBAC \ --runtime-config=rbac.authorization.k8s.io/v1 \ --kubelet-https=true \ --anonymous-auth=false \ --basic-auth-file=/data/kubernetes/ssl/basic-auth.csv \ --enable-bootstrap-token-auth \ --token-auth-file=/data/kubernetes/ssl/bootstrap-token.csv \ --service-cluster-ip-range=10.1.0.0/16 \ --service-node-port-range=20000-40000 \ --tls-cert-file=/data/kubernetes/ssl/kubernetes.pem \ --tls-private-key-file=/data/kubernetes/ssl/kubernetes-key.pem \ --client-ca-file=/data/kubernetes/ssl/ca.pem \ --service-account-key-file=/data/kubernetes/ssl/ca-key.pem \ --etcd-cafile=/data/kubernetes/ssl/ca.pem \ --etcd-certfile=/data/kubernetes/ssl/kubernetes.pem \ --etcd-keyfile=/data/kubernetes/ssl/kubernetes-key.pem \ --etcd-servers=https://10.31.90.201:2379,https://10.31.90.202:2379,https://10.31.90.203:2379 \ --enable-swagger-ui=true \ --allow-privileged=true \ --audit-log-maxage=30 \ --audit-log-maxbackup=3 \ --audit-log-maxsize=100 \ --audit-log-path=/data/kubernetes/log/api-audit.log \ --event-ttl=1h \ --v=2 \ --logtostderr=false \ --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 Type=notify LimitNOFILE=65536 [Install] WantedBy=multi-user.target
[root@node-01 ~]# systemctl daemon-reload [root@node-01 ~]# systemctl enable kube-apiserver [root@node-01 ~]# systemctl start kube-apiserver
查看API Server服務狀態github
[root@node-01 ~]# systemctl status kube-apiserver
三個master節點都須要部署json
[root@node-01 ~]# vim /usr/lib/systemd/system/kube-controller-manager.service [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/data/kubernetes/bin/kube-controller-manager \ --address=127.0.0.1 \ --master=http://10.31.90.200:8080 \ --allocate-node-cidrs=true \ --service-cluster-ip-range=10.1.0.0/16 \ --cluster-cidr=10.2.0.0/16 \ --cluster-name=kubernetes \ --cluster-signing-cert-file=/data/kubernetes/ssl/ca.pem \ --cluster-signing-key-file=/data/kubernetes/ssl/ca-key.pem \ --service-account-private-key-file=/data/kubernetes/ssl/ca-key.pem \ --root-ca-file=/data/kubernetes/ssl/ca.pem \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target
[root@node-01 ~]# systemctl daemon-reload [root@node-01 scripts]# systemctl enable kube-controller-manager [root@node-01 scripts]# systemctl start kube-controller-manager
[root@node-01 scripts]# systemctl status kube-controller-manager
三個master節點都須要部署bootstrap
[root@node-01 ~]# vim /usr/lib/systemd/system/kube-scheduler.service [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/GoogleCloudPlatform/kubernetes [Service] ExecStart=/data/kubernetes/bin/kube-scheduler \ --address=127.0.0.1 \ --master=http://10.31.90.200:8080 \ --leader-elect=true \ --v=2 \ --logtostderr=false \ --log-dir=/data/kubernetes/log Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target
[root@node-01 ~]# systemctl daemon-reload [root@node-01 ~]# systemctl enable kube-scheduler [root@node-01 ~]# systemctl start kube-scheduler [root@node-01 ~]# systemctl status kube-scheduler
這隻需在其中一臺部署便可,用來管理k8s集羣。vim
1.準備二進制命令包api
[root@node-01 ~]# cd /usr/local/src/kubernetes/client/bin [root@node-01 bin]# cp kubectl /opt/kubernetes/bin/
2.建立 admin 證書籤名請求網絡
[root@node-01 ~]# cd /usr/local/src/ssl/ [root@node-01 ssl]# vim admin-csr.json { "CN": "admin", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "system:masters", "OU": "System" } ] }
3.生成 admin 證書和私鑰:架構
[root@node-01 ssl]# cfssl gencert -ca=/data/kubernetes/ssl/ca.pem \ -ca-key=/data/kubernetes/ssl/ca-key.pem \ -config=/data/kubernetes/ssl/ca-config.json \ -profile=kubernetes admin-csr.json | cfssljson -bare admin [root@node-01 ssl]# ls -l admin* [root@node-01 ssl]# ls -l admin* -rw-r--r-- 1 root root 1009 Dec 25 11:26 admin.csr -rw-r--r-- 1 root root 229 Dec 25 11:24 admin-csr.json -rw------- 1 root root 1679 Dec 25 11:26 admin-key.pem -rw-r--r-- 1 root root 1399 Dec 25 11:26 admin.pem [root@node-01 ssl]# cp admin*.pem /data/kubernetes/ssl/
4.設置集羣參數dom
[root@node-01 src]# kubectl config set-cluster kubernetes \ --certificate-authority=/data/kubernetes/ssl/ca.pem \ --embed-certs=true \ --server=https://10.31.90.200:6443 Cluster "kubernetes" set.
5.設置客戶端認證參數
[root@node-01 ssl]# kubectl config set-credentials admin \ --client-certificate=/data/kubernetes/ssl/admin.pem \ --embed-certs=true \ --client-key=/data/kubernetes/ssl/admin-key.pem User "admin" set.
6.設置上下文參數
[root@node-01 ssl]# kubectl config set-context kubernetes \ --cluster=kubernetes \ --user=admin Context "kubernetes" created.
7.設置默認上下文
[root@node-01 src]# kubectl config use-context kubernetes Switched to context "kubernetes".
8.使用kubectl工具
[root@node-01 ssl]# kubectl get cs NAME STATUS MESSAGE ERROR scheduler Healthy ok controller-manager Healthy ok etcd-1 Healthy {"health": "true"} etcd-0 Healthy {"health": "true"} etcd-2 Healthy {"health": "true"}
後續會陸續更新全部的安裝文檔,若是你以爲我寫的不錯,但願你們多多關注點贊,很是感謝!