Kubernetes部署（十一）：管理之Helm和Rancher部署

時間 2019-11-07

標籤 kubernetes 部署十一管理 helm rancher 简体版

原文原文鏈接

Helm部署

helm官方下載地址：https://github.com/helm/helm/releasesnode

官方可用的chart列表：https://hub.kubeapps.comlinux

全部的軟件及配置文件都保存在前面文章提到的百度網盤裏：百度共享連接在此文章裏git

helm簡介

Helm是一種簡化Kubernetes應用程序安裝和管理的工具。能夠把它想象成apt/yum/homebrew。github

Helm有兩部分：client(helm)和server(tiller)
,Tiller在您的Kubernetes集羣內部運行，並管理chart的發佈(安裝)。
Helm可在您的筆記本電腦，或在任何位置運行。docker
chart是包含至少兩件事的Helm包：
- 包的描述（Chart.yaml）
- 一個或多個模板，包含Kubernetes清單文件
chart能夠存儲在磁盤上，也能夠從遠程chart存儲庫（如Debian或RedHat包）中獲取.

核心術語

Chart：一個helm程序包;
Repository：Charts倉庫，https/http服務器；
Release：特定的Chart部署於目標集羣上的一個實例；
程序架構
helm：客戶端，管理本地的Chart倉庫，管理Chart, 與Tiller服務器交互，發送Chart，實例安裝、查詢、卸載等操做；
Tiller：服務端，接收helm發來的Charts與Config，合併生成relase；

helm部署

helm能夠部署在任何機器上，不必定要在kubernetes的服務器上,可是須要安裝kubectl，也就是說用戶家目錄下要有kube的配置文件，由於helm須要和apiServer通訊。
```
[root@node-01 ~]# ll .kube/
total 12
drwxr-xr-x 3 root root   23 Dec 25 11:28 cache
-rw------- 1 root root 6264 Dec 25 16:15 config
drwxr-xr-x 3 root root 4096 Jan  2 15:09 http-cache
```

開始部署

[root@node-01 k8s]# wget https://storage.googleapis.com/kubernetes-helm/helm-v2.12.1-linux-amd64.tar.gz
[root@node-01 k8s]# tar zxf helm-v2.12.1-linux-amd64.tar.gz 
[root@node-01 k8s]# cd linux-amd64/
[root@node-01 linux-amd64]# mv helm /usr/bin/

因某些緣由咱們沒法直接從google下載tiller鏡像，因此須要下載我網盤共享的鏡像tiller-image-v2.12.1.tar.gz，而後在每一個node節點加載鏡像api

[root@node-04 ~]# docker load < tiller-image-v2.12.1.tar.gz

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

[root@node-01 helm]# kubectl create -f rbac-config.yaml

[root@node-01 helm]# helm init --service-account tiller
Creating /root/.helm 
Creating /root/.helm/repository 
Creating /root/.helm/repository/cache 
Creating /root/.helm/repository/local 
Creating /root/.helm/plugins 
Creating /root/.helm/starters 
Creating /root/.helm/cache/archive 
Creating /root/.helm/repository/repositories.yaml 
Adding stable repo with URL: https://kubernetes-charts.storage.googleapis.com 
Adding local repo with URL: http://127.0.0.1:8879/charts 
$HELM_HOME has been configured at /root/.helm.

Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.

Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy.
To prevent this, run `helm init` with the --tiller-tls-verify flag.
For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation
Happy Helming!

[root@node-01 helm]# kubectl -n kube-system get pod|grep tiller
tiller-deploy-85744d9bfb-cm5jz         1/1       Running   0          11m

[root@node-01 helm]# helm version
Client: &version.Version{SemVer:"v2.12.1", GitCommit:"02a47c7249b1fc6d8fd3b94e6b4babf9d818144e", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.12.1", GitCommit:"02a47c7249b1fc6d8fd3b94e6b4babf9d818144e", GitTreeState:"clean"}

helm經常使用命令：

release管理：瀏覽器
- install
- delete
- upgrade/rollback
- list
- history：release的歷史信息；
- status：獲取release狀態信息；
chart管理：
- create
- fetch
- get
- inspect
- package
- verify

至此helm就已經部署完了，下面會經過helm安裝k8s的管理平臺，也順便演示helm的使用。服務器

Rancher部署

rancher簡介

Rancher是一個企業級多集羣Kubernetes管理平臺；
用戶能夠在Rancher上配置和管理公有云(如GKE、EKS、AKS、阿里雲、華爲雲等)上託管的Kubernetes服務，亦可向Rancher中導入已有集羣。

對於全部Kubernetes集羣與服務，用戶都可以在Rancher上進行集中身份認證(包括GitHub、AD/LDAP、SAML等)。

添加chart倉庫

helm官方倉庫沒有rancher的chart包，因此咱們須要添加rancher官方chart倉庫。網絡

[root@node-01 helm]# helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
"rancher-stable" has been added to your repositories
[root@node-01 helm]# helm search rancher-stable/rancher                                            
NAME                    CHART VERSION   APP VERSION     DESCRIPTION                                                 
rancher-stable/rancher  2018.12.4       v2.1.4          Install Rancher Server to manage Kubernetes clusters acro...

安裝cert-manager

安裝成功後會詳細顯示安裝的全部資源

[root@node-01 helm]# helm install stable/cert-manager  --name cert-manager --namespace kube-system
NAME:   cert-manager
LAST DEPLOYED: Thu Jan  3 15:35:22 2019
NAMESPACE: kube-system
STATUS: DEPLOYED

RESOURCES:
==> v1/ServiceAccount
NAME          SECRETS  AGE
cert-manager  1        1s

==> v1beta1/ClusterRole
NAME          AGE
cert-manager  1s

==> v1beta1/ClusterRoleBinding
NAME          AGE
cert-manager  1s

==> v1beta1/Deployment
NAME          DESIRED  CURRENT  UP-TO-DATE  AVAILABLE  AGE
cert-manager  1        1        1           0          1s

==> v1/Pod(related)
NAME                           READY  STATUS             RESTARTS  AGE
cert-manager-7d4bfc44ff-5flvg  0/1    ContainerCreating  0         0s

NOTES:
cert-manager has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://cert-manager.readthedocs.io/en/latest/reference/issuers.html

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html

[root@node-01 helm]#

安裝rancher server

[root@node-01 helm]# helm install rancher-stable/rancher --name rancher --namespace cattle-system --set hostname=rancher.cnlinux.club

默認狀況下，Rancher會自動生成CA根證書並使用cert-manager頒發證書，所以，這裏設置了 hostname=rancher.cnlinux.club，後續只能經過域名訪問UI

爲Agent Pod添加主機別名(可選)

若是你沒有內部DNS服務器而是經過添加/etc/hosts主機別名的方式指定的Rancher server域名，那麼無論經過哪一種方式(自定義、導入、Host驅動等)建立K8S集羣，K8S集羣運行起來以後，由於cattle-cluster-agent Pod和cattle-node-agent沒法經過DNS記錄找到Rancher server,最終致使沒法通訊。

能夠經過給cattle-cluster-agent Pod和cattle-node-agent添加主機別名(/etc/hosts)，讓其能夠正常通訊(前提是IP地址能夠互通)。

注意：替換如下命令中的域名和IP

cattle-cluster-agent pod

[root@node-01 helm]#  kubectl -n cattle-system patch  deployments cattle-cluster-agent --patch '{
    "spec": {
        "template": {
            "spec": {
                "hostAliases": [
                    {
                        "hostnames":
                        [
                            "rancher.cnlinux.club"
                        ],
                            "ip": "10.31.90.200"
                    }
                ]
            }
        }
    }
}'

cattle-node-agent pod

[root@node-01 helm]#  kubectl -n cattle-system patch  daemonsets cattle-node-agent --patch '{
    "spec": {
        "template": {
            "spec": {
                "hostAliases": [
                    {
                        "hostnames":
                        [
                            "rancher.cnlinux.club"
                        ],
                            "ip": "10.31.90.200"
                    }
                ]
            }
        }
    }
}'