kubernetes安裝（基於CentOS7，kubeadm）

kubeadm能夠幫助你快速部署一套kubernetes集羣。kubeadm設計目的爲新用戶開始嘗試kubernetes提供一種簡單的方法。不適用於生產環境。

一、安裝要求及目標

• 禁止swap分區（kubernetes不支持）
• 能夠訪問外網
• 集羣機器之間網絡互通

• 因此節點上安裝Docker和kubeadm
• 部署Kubernetes Master
• 部署網絡管理插件
• 部署Kubernetes Node，將節點加入Kubenetes集羣中
• 部署Dashboard Web頁面，可視化查看Kubernetes資源

• 關閉防火牆：

systemctl stop firewalld && systemctl disable firewalld

• 關閉selinux：

sed -i 's/enforcing/disabled/' /etc/selinux/config setenforce 0　 　　# 使設置生效
getenforce　　　　　# 查看

• 關閉swap：

swapoff -a # 臨時關閉 

sed -i 's/.\\*swap.\\*/#&/' /etc/fstab # 永久關閉

• 添加主機名與IP對應關係：

vim /etc/hosts
192.168.174.138 k8s-master 192.168.174.139 k8s-node1 192.168.174.140 k8s-node2

• 將橋接的IPV4流量傳遞到iptables鏈：

cat > /etc/sysctl.d/k8s.conf << EOF net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 EOF sysctl --system　　# 是配置生效

二、集羣節點安裝Docker/Kubeadm/kubelet

• 安裝Docker：

yum install -y wget

yum install yum-utils device-mapper-persistent-data lvm2

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

yum update && yum install docker-ce-18.06.2.ce

mkdir /etc/docker

cat > /etc/docker/daemon.json <<EOF
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}
EOF

mkdir -p /etc/systemd/system/docker.service.d

&& systemctl daemon-reloadsystemctl restart docker &&systemctl enable docker

docker --version

• 安裝Kubernetes：

cat > /etc/yum.repos.d/kubernetes.repo << EOF [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum install -y kubelet kubeadm kubectl

systemctl enable kubelet && systemctl start kubelet

# 在Master上執行
kubeadm init \
--apiserver-advertise-address=192.168.174.138 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.14.2 \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

　mkdir -p $HOME/.kube
　sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
　sudo chown $(id -u):$(id -g) $HOME/.kube/config

　# 在Node上執行

　kubeadm join 192.168.174.138:6443 --token 0605l0.mezfbd5bq517d8mp \
  --discovery-token-ca-cert-hash sha256:a1fdab515df1ce5cb5ff5994c910e7a2aa9625d025469af06c15edccd5208a35

  # 查看kubernetes運行狀態

　kubectl get pod -n kube-system

  kubectl get node

 三、部署kubernetes-dashboard

docker pull k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

# Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0
# # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ------------------- Dashboard Secret ------------------- # apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-certs namespace: kube-system type: Opaque --- # ------------------- Dashboard Service Account ------------------- # apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system --- # ------------------- Dashboard Role & Role Binding ------------------- # kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: kubernetes-dashboard-minimal namespace: kube-system rules: # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. - apiGroups: [""] resources: ["secrets"] verbs: ["create"] # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. - apiGroups: [""] resources: ["configmaps"] verbs: ["create"] # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""] resources: ["secrets"] resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"] verbs: ["get", "update", "delete"] # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: [""] resources: ["configmaps"] resourceNames: ["kubernetes-dashboard-settings"] verbs: ["get", "update"] # Allow Dashboard to get metrics from heapster. - apiGroups: [""] resources: ["services"] resourceNames: ["heapster"] verbs: ["proxy"] - apiGroups: [""] resources: ["services/proxy"] resourceNames: ["heapster", "http:heapster:", "https:heapster:"] verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kubernetes-dashboard-minimal namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard-minimal subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kube-system --- # ------------------- Dashboard Deployment ------------------- # kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: - name: kubernetes-dashboard image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1 ports: - containerPort: 8443 protocol: TCP args: - --auto-generate-certificates # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. # - --apiserver-host=http://my-address:port
 volumeMounts: - name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs - mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 volumes: - name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs - name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule --- # ------------------- Dashboard Service ------------------- # kind: Service apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec:
 type: NodePort ports: - port: 443 targetPort: 8443
　　　 nodePort: 30000 selector: k8s-app: kubernetes-dashboard

kubectl apply -f kubernetes-dashboard.yaml

  建立令牌：受權，對全部名稱空間都有admin的權限

# 建立serviceaccount kubectl create serviceaccount dashboard-serviceaccount-admin -n kube-system # 建立clusterrolebinding kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-serviceaccount-admin # 獲取令牌 kubectl get secret -n kube-system |grep dashboard-serviceaccount-admin-token # 查看dashboard-serviceaccount中的口令 kubectl describe secret dashboard-serviceaccount-admin-token-5vc54 -n kube-system

建立Kubeconfig，只對default名稱空間有admin的權限

# 建立serviceaccount kubectl create serviceaccount def-ns-dashboard-sa -n default # 建立rolebinding kubectl create rolebinding def-ns-dashboard-rb --clusterrole=cluster-admin --serviceaccount=default:def-ns-dashboard-sa # 在secret中查找def-ns-dashboard-sa kubectl get secret # 查看def-ns-dashboard-sa中的口令 kubectl describe secret def-ns-dashboard-sa-token-b8plm

 

騰訊雲CVM上用kubeadm安裝Kubernetes集羣（版本1.14.0）

使用harbor搭建私有docker鏡像倉庫