Kubernetes多節點二進制線網部署(實例!!!)

時間  2020-02-10
標籤 kubernetes 節點 二進制 部署 實例 简体版
原文   原文鏈接

前情回顧

部署K8s多節點,首先得署單節master的k8s羣集
詳情參考:
blog.csdn.net/caozhengtao1213/article/details/103987039

本篇內容

1.部署Master2
2.Nginx負載均衡部署-keeplived服務
3.node節點修改配置文件統一VIP
4.建立Pod
5.建立UI顯示界面node

環境準備

角色 地址 安裝組件
master 192.168.142.129 kube-apiserver kube-controller-manager kube-scheduler etcd
master2 192.168.142.120 kube-apiserver kube-controller-manager kube-scheduler
node1 192.168.142.130 kubelet kube-proxy docker flannel etcd
node2 192.168.142.131 kubelet kube-proxy docker flannel etcd
nginx1(lbm) 192.168.142.140 nginx keepalived
nginx2(lbb) 192.168.142.150 nginx keepalived
VIP 192.168.142.20 -

1、部署Master2

1.遠程複製master的相關目錄nginx

  • 關閉防火牆及安全功能
systemctl stop firewalld.service
setenforce 0
  • 複製kubernetes目錄到master2
scp -r /opt/kubernetes/ root@192.168.142.120:/opt
  • 複製etcd目錄到master2(內含證書)
scp -r /opt/etcd/ root@192.168.142.120:/opt
  • 複製服務啓動腳本到master2
scp /usr/lib/systemd/system/{kube-apiserver,kube-controller-manager,kube-scheduler}.service root@192.168.142.120:/usr/lib/systemd/system/

2.修改kube-apiserver配置文件docker

vim /opt/kubernetes/cfg/kube-apiserver

#將第5和7行IP地址改成master2主機的地址
--bind-address=192.168.142.120 \
--advertise-address=192.168.142.120 \

3.啓動服務並設定開機自啓json

systemctl start kube-apiserver.service 
systemctl enable kube-apiserver.service

systemctl start kube-controller-manager.service 
systemctl enable kube-controller-manager.service

systemctl start kube-scheduler.service
systemctl enable kube-scheduler.service

4.追加環境變量並生效bootstrap

vim /etc/profile
#末尾追加
export PATH=$PATH:/opt/kubernetes/bin/

source /etc/profile

5.查看node節點vim

kubectl get node
NAME              STATUS   ROLES    AGE     VERSION
192.168.142.130   Ready    <none>   10d12h   v1.12.3
192.168.142.131   Ready    <none>   10d11h   v1.12.3

2、Nginx負載均衡部署-keeplived服務

1.在lbm&lbb端的操做,安裝nginx服務centos

  • 把nginx.sh和keepalived.conf腳本拷貝到家目錄(後面會用到)
#nginx.sh

cat > /etc/yum.repos.d/nginx.repo << EOF
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
EOF

stream {

   log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
    access_log  /var/log/nginx/k8s-access.log  main;

    upstream k8s-apiserver {
        server 10.0.0.3:6443;
        server 10.0.0.8:6443;
    }
    server {
                listen 6443;
                proxy_pass k8s-apiserver;
    }
    }
#keepalived.conf
! Configuration File for keepalived 

global_defs { 
   # 接收郵件地址 
   notification_email { 
     acassen@firewall.loc 
     failover@firewall.loc 
     sysadmin@firewall.loc 
   } 
   # 郵件發送地址 
   notification_email_from Alexandre.Cassen@firewall.loc  
   smtp_server 127.0.0.1 
   smtp_connect_timeout 30 
   router_id NGINX_MASTER 
} 

vrrp_script check_nginx {
    script "/usr/local/nginx/sbin/check_nginx.sh"
}

vrrp_instance VI_1 { 
    state MASTER 
    interface eth0
    virtual_router_id 51 # VRRP 路由 ID實例，每一個實例是惟一的 
    priority 100    # 優先級，備服務器設置 90 
    advert_int 1    # 指定VRRP 心跳包通告間隔時間，默認1秒 
    authentication { 
        auth_type PASS      
        auth_pass 1111 
    }  
    virtual_ipaddress { 
        10.0.0.188/24 
    } 
    track_script {
        check_nginx
    } 
}

mkdir /usr/local/nginx/sbin/ -p
vim /usr/local/nginx/sbin/check_nginx.sh

count=$(ps -ef |grep nginx |egrep -cv "grep|$$")

if [ "$count" -eq 0 ];then
    /etc/init.d/keepalived stop
fi

chmod +x /usr/local/nginx/sbin/check_nginx.sh
  • 編輯nginx.repo文件
vim /etc/yum.repos.d/nginx.repo

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
  • 安裝nginx服務
yum install nginx -y
  • 添加四層轉發
vim /etc/nginx/nginx.conf
#在第12行下追加如下內容
stream {

   log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
    access_log  /var/log/nginx/k8s-access.log  main;

    upstream k8s-apiserver {
        server 192.168.142.129:6443;        #此處爲master的ip地址
        server 192.168.142.120:6443;        #此處爲master2的ip地址
    }
    server {
                listen 6443;
                proxy_pass k8s-apiserver;
    }
    }

2.部署keeplived服務api

#安裝keepalived
yum install keepalived -y

複製前面的keepalived.conf配置文件，覆蓋安裝後原有的配置文件
cp keepalived.conf /etc/keepalived/keepalived.conf

vim /etc/keepalived/keepalived.conf

script "/etc/nginx/check_nginx.sh"      #18行,目錄改成/etc/nginx/，腳本後寫
interface ens33     #23行,eth0改成ens33，此處的網卡名稱可使用ifconfig命令查詢
virtual_router_id 51        #24行,vrrp路由ID實例，每一個實例是惟一的
priority 100            #25行,優先級，備服務器設置90
virtual_ipaddress {     #31行,
192.168.142.20/24   #32行,vip地址改成以前設定好的192.168.142.20
#38行如下所有刪除

vim /etc/nginx/check_nginx.sh
#統計數量       
count=$(ps -ef |grep nginx |egrep -cv "grep|$$")    #統計數量
#匹配爲0，關閉keepalived服務
if [ "$count" -eq 0 ];then
    systemctl stop keepalived
fi

chmod +x /etc/nginx/check_nginx.sh

#啓動服務
systemctl start keepalived
  • 查看地址信息
ip a
# lbm地址信息

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:eb:11:2a brd ff:ff:ff:ff:ff:ff
    inet 192.168.142.140/24 brd 192.168.142.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 192.168.142.20/24 scope global secondary ens33  //漂移地址在lb01中
       valid_lft forever preferred_lft forever
    inet6 fe80::53ba:daab:3e22:e711/64 scope link 
       valid_lft forever preferred_lft forever

#lbb地址信息

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:c9:9d:88 brd ff:ff:ff:ff:ff:ff
    inet 192.168.142.150/24 brd 192.168.142.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::55c0:6788:9feb:550d/64 scope link 
       valid_lft forever preferred_lft forever
  • 驗證地址漂移
#中止lbm端的nginx服務
pkill nginx

#查看服務狀態
systemctl status nginx
systemctl status keepalived.service

#此時判斷條件若爲0，keepalived服務則是中止的
ps -ef |grep nginx |egrep -cv "grep|$$"
  • 查看地址信息
ip a
# lbm地址信息

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:eb:11:2a brd ff:ff:ff:ff:ff:ff
    inet 192.168.142.140/24 brd 192.168.142.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::53ba:daab:3e22:e711/64 scope link 
       valid_lft forever preferred_lft forever

#lbb地址信息

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:c9:9d:88 brd ff:ff:ff:ff:ff:ff
    inet 192.168.142.150/24 brd 192.168.142.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 192.168.142.20/24 scope global secondary ens33  //漂移地址在lb01中
       valid_lft forever preferred_lft forever
    inet6 fe80::55c0:6788:9feb:550d/64 scope link 
       valid_lft forever preferred_lft forever
  • 恢復操做
#在lbm端啓動nginx和keepalived服務
systemctl start nginx
systemctl start keepalived
  • 漂移地址迴歸lbm端
ip a
# lbm地址信息

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:eb:11:2a brd ff:ff:ff:ff:ff:ff
    inet 192.168.142.140/24 brd 192.168.142.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 192.168.142.20/24 scope global secondary ens33  //漂移地址在lb01中
       valid_lft forever preferred_lft forever
    inet6 fe80::53ba:daab:3e22:e711/64 scope link 
       valid_lft forever preferred_lft forever

3、node節點修改配置文件統一VIP（bootstrap.kubeconfig,kubelet.kubeconfig）

cd /opt/kubernetes/cfg/
#配置文件統一修改成VIP
vim /opt/kubernetes/cfg/bootstrap.kubeconfig

server: https://192.168.142.20:6443     
#第5行改成Vip的地址

vim /opt/kubernetes/cfg/kubelet.kubeconfig
server: https://192.168.142.20:6443 
#第5行改成Vip的地址

vim /opt/kubernetes/cfg/kube-proxy.kubeconfig
server: https://192.168.142.20:6443     
#第5行改成Vip的地址
  • 替換完成後自檢
grep 20 *
bootstrap.kubeconfig:    server: https://192.168.142.20:6443
kubelet.kubeconfig:    server: https://192.168.142.20:6443
kube-proxy.kubeconfig:    server: https://192.168.142.20:6443
  • 在lb01上查看nginx的k8s日誌
tail /var/log/nginx/k8s-access.log
192.168.142.140 192.168.142.129:6443 - [08/Feb/2020:19:20:40 +0800] 200 1119
192.168.142.140 192.168.142.120:6443 - [08/Feb/2020:19:20:40 +0800] 200 1119
192.168.142.150 192.168.142.129:6443 - [08/Feb/2020:19:20:44 +0800] 200 1120
192.168.142.150 192.168.142.120:6443 - [08/Feb/2020:19:20:44 +0800] 200 1120

4、建立Pod

  • 測試建立Pod
kubectl run nginx --image=nginx
  • 查看狀態
kubectl get pods
  • 綁定羣集中的匿名用戶賦予管理員權限(解決日誌不可看問題)
kubectl create clusterrolebinding cluster-system-anonymous --clusterrole=cluster-admin --user=system:anonymous
  • 查看Pod網絡
kubectl get pods -o wid

5、建立UI顯示界面

  • 在master1上建立dashborad工做目錄
mkdir /k8s/dashboard

cd /k8s/dashboard
#上傳官方的文件到該目錄中
  • 建立頁面，注意順序
#受權訪問api
kubectl create -f dashboard-rbac.yaml

#進行加密
kubectl create -f dashboard-secret.yaml

#配置應用
kubectl create -f dashboard-configmap.yaml

#控制器
kubectl create -f dashboard-controller.yaml

#發佈出去進行訪問
kubectl create -f dashboard-service.yaml
  • 完成後查看建立在指定的kube-system命名空間下
kubectl get pods -n kube-system
  • 查看如何訪問
kubectl get pods,svc -n kube-system
  • 在瀏覽器中輸入nodeIP地址就能夠訪問(谷歌瀏覽器沒法訪問題解決方法)

1.在master端操做,編寫進行證書自籤瀏覽器

vim dashboard-cert.sh

cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
   },
   "names": [
       {
           "C": "CN",
           "L": "NanJing",
           "ST": "NanJing"
       }
   ]
}
EOF

K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

2.從新應用新的自簽證書安全

bash dashboard-cert.sh /root/k8s/apiserver/

3.修改yaml文件

vim dashboard-controller.yaml
#在47行下追加如下內容
          - --tls-key-file=dashboard-key.pem
          - --tls-cert-file=dashboard.pem

4.從新進行部署

kubectl apply -f dashboard-controller.yaml

5.生成登陸令牌

  • 生成令牌
kubectl create -f k8s-admin.yaml
  • 將令牌保存
kubectl get secret -n kube-system
NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-drs7c        kubernetes.io/service-account-token   3      60s
default-token-mmvcg                kubernetes.io/service-account-token   3      55m
kubernetes-dashboard-certs         Opaque                                10     10m
kubernetes-dashboard-key-holder    Opaque                                2      23m
kubernetes-dashboard-token-crqvs   kubernetes.io/service-account-token   3      23m
  • 查看令牌
kubectl describe secret dashboard-admin-token-drs7c -n kube-system

6.複製粘貼令牌後,登陸到UI界面

在這裏插入圖片描述

在這裏插入圖片描述

謝謝閱讀!

相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程