程序员经验分享-hwhale

k8s非高可用环境搭建

2023-11-17

k8s非高可用环境搭建

环境准备

准备三台机器
配置好网络，内网互通，可通外网
同步时间

集群信息

1.节点规划
主机名 节点ip 角色 部署组件
k8s-master 192.168.31.200 master etcd；kube-apiserver；kube-controller-manager；kubectl；kubeadm；kubelet；kube-proxy；flannel
k8s-slave1 192.168.31.201 slave kubectl；kubelet；kube-proxy；flannel
k8s-slave2 192.168.31.202 slave kubectl；kubelet；kube-proxy；flannel
2.修改hostname

操作节点：master和slave

# 在k8s-master
hostnamectl set-hostname k8s-master && bash

#在k8s-slave
hostnamectl set-hostname k8s-slave1 && bash
hostnamectl set-hostname k8s-slave2 && bash
3.添加hosts解析

操作节点：所有

cat >> /etc/hosts<<EOF
192.168.31.200 k8s-master
192.168.31.201 k8s-slave1
192.168.31.202 k8s-slave2
EOF
4.调整系统配置

操作节点：所有节点

  • 设置iptables

    ipatbles -F
iptables -P FORWARD ACCEPT

  • 关闭swap,并禁止开机自动挂载

    swapoff -a 
sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

  • 关闭selinux防火墙

    sed -i  's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config 
setenforce 0
systemctl disable firewalld && systemctl stop firewalld

  • 修改内核参数

    # 修改转发参数
cat <<EOF >  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward=1
vm.max_map_count=262144
EOF

# 自动加载br_netfilter模块
modprobe br_netfilter

#加载内核参数
sysctl -p /etc/sysctl.d/k8s.conf

  • 设置yum源

备份
mkdir -p /etc/yum.repos.d/bak
mv /etc/yum.repos.d/*.repo  /etc/yum.repos.d/bak

curl -o /etc/yum.repos.d/Centos-7.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/docker-ce.repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo


cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
        http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum clean all && yum makecache
5.安装docker

操作节点：all

# 最新版本
yum install docker-ce  -y

# 配置docker加速
mkdir -p /etc/docker
vi /etc/docker/daemon.json
{
  "registry-mirrors": [
    "https://8xpk5wnt.mirror.aliyuncs.com"
  ]
}


#启动docker
 systemctl enable docker && systemctl start docker
 ps aux | grep docker

部署kubernetes

1.安装kubernetes，kubelet和kubectl

操作节点：all

yum install -y kubelet-1.16.2 kubeadm-1.16.2 kubectl-1.16.2 --disableexcludes=kubernetes

# 设置开机启动
systemctl enable kubelet
2.初始化配置文件

操作的：master

kubeadm config print init-defaults > kubeadm.yaml

# 修改后如下：
[root@k8s-master k8s]# vi kubeadm.yaml 
[root@k8s-master k8s]# cat kubeadm.yaml 
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 192.168.31.200  # 配置master节点的内网ip
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: k8s-master
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers  #修改成阿里源
kind: ClusterConfiguration
kubernetesVersion: v1.16.0
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16   #增加此行,flannel插件需要使用的网段
  serviceSubnet: 10.96.0.0/12
scheduler: {}
3.下载镜像

操作节点：master

# 没有问题的话可以查看到如下镜像列表
[root@k8s-master k8s]# kubeadm config images list --config kubeadm.yaml
registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.0
registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.0
registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.0
registry.aliyuncs.com/google_containers/kube-proxy:v1.16.0
registry.aliyuncs.com/google_containers/pause:3.1
registry.aliyuncs.com/google_containers/etcd:3.3.15-0
registry.aliyuncs.com/google_containers/coredns:1.6.2

# 提前下载镜像到本地
[root@k8s-master k8s]# kubeadm config images pull --config kubeadm.yaml
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-apiserver:v1.16.0
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-controller-manager:v1.16.0
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-scheduler:v1.16.0
[config/images] Pulled registry.aliyuncs.com/google_containers/kube-proxy:v1.16.0
[config/images] Pulled registry.aliyuncs.com/google_containers/pause:3.1
[config/images] Pulled registry.aliyuncs.com/google_containers/etcd:3.3.15-0
[config/images] Pulled registry.aliyuncs.com/google_containers/coredns:1.6.2

# 查看本地镜像
[root@k8s-master k8s]# docker images
REPOSITORY                                                        TAG        IMAGE ID       CREATED         SIZE
registry.aliyuncs.com/google_containers/kube-apiserver            v1.16.0    b305571ca60a   20 months ago   217MB
registry.aliyuncs.com/google_containers/kube-controller-manager   v1.16.0    06a629a7e51c   20 months ago   163MB
registry.aliyuncs.com/google_containers/kube-proxy                v1.16.0    c21b0c7400f9   20 months ago   86.1MB
registry.aliyuncs.com/google_containers/kube-scheduler            v1.16.0    301ddc62b80b   20 months ago   87.3MB
registry.aliyuncs.com/google_containers/etcd                      3.3.15-0   b2756210eeab   20 months ago   247MB
registry.aliyuncs.com/google_containers/coredns                   1.6.2      bf261d157914   21 months ago   44.1MB
registry.aliyuncs.com/google_containers/pause                     3.1        da86e6ba6ca1   3 years ago     742kB
4.初始化master节点

操作节点：master

kubeadm init --config kubeadm.yaml

若成功可以看到如下信息

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.31.200:6443 --token abcdef.0123456789abcdef \
    --discovery-token-ca-cert-hash sha256:04ee1177f973ac71c0533f1e2ecf2b1f4436bde487027d0713c0f1fcfbead4ef

按照上述提示信息操作，配置kubectl客户端的认证

操作节点：master

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
5.添加slave节点到集群中

操作节点：所有slave

kubeadm join 192.168.31.200:6443 --token abcdef.0123456789abcdef \
    --discovery-token-ca-cert-hash sha256:04ee1177f973ac71c0533f1e2ecf2b1f4436bde487027d0713c0f1fcfbead4ef 
    
 #检查接入情况
  kubectl get nodes
6.安装flannel插件

操作节点：master

  • 下载flannet的yaml文件
https://raw.githubusercontent.com/coreos/flannel/2140ac876ef134e0ed5af15c65e414cf26827915/Documentation/kube-flannel.yml
  • 修改配置，指定网卡名称，大概在文件的191行，添加一行配置：
$ vi kube-flannel.yml
...      
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        - --iface=ens192  # 如果机器存在多网卡的话，指定内网网卡的名称，默认不指定的话会找第一块网
        resources:
          requests:
            cpu: "100m"
...
  • 执行安装flannel网络插件
所有节点都需拉取
# 先拉取镜像，此过程国内速度比较慢
docker pull quay.io/coreos/flannel:v0.11.0-amd64

主节点操作
# 执行flannel安装
 kubectl create -f kube-flannel.yml
 
此时集群已经正常，不再是notready
[root@k8s-master ~]#  kubectl get nodes
NAME         STATUS   ROLES    AGE   VERSION
k8s-master   Ready    master   33m   v1.16.2
k8s-slave1   Ready    <none>   19m   v1.16.2
k8s-slave2   Ready    <none>   19m   v1.16.2
7.设置master节点是否可调度

操作节点：master

默认部署成功后，master节点无法调度业务pod，如需设置master节点参与pod调度，需执行如下：

kubectl taint node k8s-master node-role.kubernetes.io/master:NoSchedule-
8.验证集群

操作节点：master

创建测试nginx服务
kubectl run test-nginx  --image=nginx:alpine

查询
[root@k8s-master ~]# kubectl get pods -n default
NAME                          READY   STATUS    RESTARTS   AGE
test-nginx-5bd8859b98-wsfkc   1/1     Running   0          36s

查询ip
[root@k8s-master ~]# kubectl get po -o wide
NAME                          READY   STATUS    RESTARTS   AGE   IP           NODE         NOMINATED NODE   READINESS GATES
test-nginx-5bd8859b98-wsfkc   1/1     Running   0          72s   10.244.1.3   k8s-slave1   <none>           <none>

访问测试
curl  10.244.1.3
9.部署dashboard仪表盘

操作节点：master

  • 配置服务
# 推荐使用如下方式：
$ wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
$ vi recommended.yaml
# 修改Service为NodePort类型，文件的45行上下
......
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
  type: NodePort  # 加上type=NodePort变成NodePort类型的服务
......
  • 查看访问地址
[root@k8s-master ~]# kubectl create -f recommended.yaml

获取ip与端口
[root@k8s-master ~]# kubectl -n kubernetes-dashboard get svc
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.104.236.88   <none>        8000/TCP        5s
kubernetes-dashboard        NodePort    10.107.35.154   <none>        443:32593/TCP   6s
  • 使用浏览器访问 https://192.168.31.200.32593，其中192.168.31.81为master节点的外网ip地址，chrome目前由于安全限制，测试访问不了，使用firefox可以进行访问。出现如下页面即可：

在这里插入图片描述

  • 创建ServiceAccount服务账号进行访问
[root@k8s-master ~]# vi admin.conf
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kubernetes-dashboard

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kubernetes-dashboard
  
 #创建
[root@k8s-master ~]# kubectl create -f admin.conf
 
[root@k8s-master ~]# kubectl -n kubernetes-dashboard get secret |grep admin-token
admin-token-45q5l                  kubernetes.io/service-account-token   3      23s

# 获取上面的 admin-token-45q5l 
kubectl -n kubernetes-dashboard get secret admin-token-45q5l -o jsonpath={.data.token}|base64 -d

[root@k8s-master ~]# kubectl -n kubernetes-dashboard get secret admin-token-45q5l -o jsonpath={.data.token}|base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6ImFma2tpSWJzcFF3OW1VRkVFclhHcFdMcDZvcExFM0hneGNsVHBGd1B4ZG8ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi00NXE1bCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImExZDAzZTVjLTVlNzUtNGJlZi04ZmMyLTJmMTJjODIzZWE4ZCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDphZG1pbiJ9.iRnOLfAabFRB61cBpxUF4aK9Q8BxHoiqc_zY5s4Z6C7x1hzlAUPxeUCHk51870H1RWHJvIhXD_U5bzcByriQs8UScU0HNp1IiL3esn5vS-Mitn_RaUCaSZnJVLdwSf_mh9GUBSQBfA_xFhr9BI0JvmbBvPuVUX3iMDhqizYjIi1uS46rjVg7_zEfTmiWqATKLENq074Dg2XYSRRqo5tEzVLKEfoILi1gAyEKas6-0UQ0oJZVsByoMdEtYKIabgmnci79sgg5bLdlRr5rkXNKLFYrajprqUYcm8rcgSxVWNZ_vxSCX2QjVO-TNllSzJ6MDEKVJbFZl-Ft32wwVHXKBw

Zi04ZmMyLTJmMTJjODIzZWE4ZCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDphZG1pbiJ9.iRnOLfAabFRB61cBpxUF4aK9Q8BxHoiqc_zY5s4Z6C7x1hzlAUPxeUCHk51870H1RWHJvIhXD_U5bzcByriQs8UScU0HNp1IiL3esn5vS-Mitn_RaUCaSZnJVLdwSf_mh9GUBSQBfA_xFhr9BI0JvmbBvPuVUX3iMDhqizYjIi1uS46rjVg7_zEfTmiWqATKLENq074Dg2XYSRRqo5tEzVLKEfoILi1gAyEKas6-0UQ0oJZVsByoMdEtYKIabgmnci79sgg5bLdlRr5rkXNKLFYrajprqUYcm8rcgSxVWNZ_vxSCX2QjVO-TNllSzJ6MDEKVJbFZl-Ft32wwVHXKBw


输入token登录即可
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)

k8s部署系列

k8s非高可用环境搭建 的相关文章

随机推荐

热门标签