1. 环境（Centos）
master：Centos7，192.168.99.110
node：Centos，192.168.99.151
node：Centos，192.168.99.177
镜像准备：
docker pull k8s.gcr.io/kube-apiserver:v1.20.1
docker pull k8s.gcr.io/kube-controller-manager:v1.20.1
docker pull k8s.gcr.io/kube-scheduler:v1.20.1
docker pull k8s.gcr.io/kube-proxy:v1.20.1
docker pull k8s.gcr.io/pause:3.2
docker pull k8s.gcr.io/etcd:3.4.13-0
docker pull k8s.gcr.io/coredns:1.7.0
到目前为止（2020-12-26号），v1.20.1的各个组件的镜像还没有同步到hub 上https://hub.docker.com/u/mirrorgooglecontainers，可以从下面拉取镜像列表
docker pull rekca/kube-apiserver:v1.20.1
docker pull rekca/kube-controller-manager:v1.20.1
docker pull rekca/kube-scheduler:v1.20.1
docker pull rekca/kube-proxy:v1.20.1
docker pull rekca/pause:3.2
docker pull rekca/etcd:3.4.13-0
docker pull rekca/coredns:1.7.0
# tag
docker tag rekca/kube-apiserver:v1.20.1 k8s.gcr.io/kube-apiserver:v1.20.1
docker tag rekca/kube-controller-manager:v1.20.1 k8s.gcr.io/kube-controller-manager:v1.20.1
docker tag rekca/kube-scheduler:v1.20.1 k8s.gcr.io/kube-scheduler:v1.20.1
docker tag rekca/kube-proxy:v1.20.1 k8s.gcr.io/kube-proxy:v1.20.1
docker tag rekca/pause:3.2 k8s.gcr.io/pause:3.2
docker tag rekca/etcd:3.4.13-0 k8s.gcr.io/etcd:3.4.13-0
docker tag rekca/coredns:1.7.0 k8s.gcr.io/coredns:1.7.0
2. 安装docker，master，node节点都需要安装，因为kubecadm默认用容器方式启动各个组件，所以master上也要安装docker
# (Install Docker CE)
## Set up the repository
### Install required packages
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
## Add the Docker repository
sudo yum-config-manager --add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
# Install Docker CE
sudo yum update -y && sudo yum install -y \
containerd.io-1.2.13 \
docker-ce-19.03.11 \
docker-ce-cli-19.03.11
## Create /etc/docker
sudo mkdir /etc/docker
# Set up the Docker daemon
cat <<EOF | sudo tee /etc/docker/daemon.json
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
]
}
EOF
# Create /etc/systemd/system/docker.service.d
sudo mkdir -p /etc/systemd/system/docker.service.d
# Restart Docker
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl enable docker
遇到问题：启动docker后，执行docker命令，报错 dial unix /var/run/docker.sock: connect: permission denied，这是由于当前用户与启动docker的用户不是一个，造成的权限访问问题
解决方案：
# 添加docker用户组
groupadd docker
# 把当前用户加入docker用户组
gpasswd -a ${USER} docker
# 查看是否添加成功
cat /etc/group | grep ^docker
# 重启docker
systemctl restart docker
# 更新用户组
newgrp docker
# 再执行docker命令，就不会报错了
docker images
3. 安装kubernetes
通过部署工具安装k8s
Bootstrapping clusters with kubeadm
Installing Kubernetes with kops
Installing Kubernetes with Kubespray
使用kubeadm安装的优势：
- 第一次用简单的方法尝试k8s
- 为现有用户自动设置群集并测试其应用程序的方法
- 在其他生态系统和/或安装工具中具有更大范围的构建块
安装kubeadm：
让iptables看到桥接流量
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system
配置k8s阿里云源
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
安装kubelet、kubeadm、kubectl
# Set SELinux in permissive mode (effectively disabling it)
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
sudo systemctl enable --now kubelet
启动kebelet
sudo systemctl daemon-reload
sudo systemctl restart kubelet
使用kubeadm创建k8s集群
sudo kubeadm init --pod-network-cidr=192.168.0.0/16
运行完后有如下提示内容
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.99.110:6443 --token 9wv08y.fapyc97l762n6lya \
--discovery-token-ca-cert-hash sha256:93b8cab714eae4c41ad4a139c4f3969f8b1be9d7036091aeda36e8ce975b77b9
获取token
kubeadm token list
默认情况下，token在24h后过期，过期后如果还想加入新的node节点，可以执行
kubeadm token create
获取--discovery-token-ca-cert-hash的值
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | \
openssl dgst -sha256 -hex | sed 's/^.* //'
最后组装kubeadm join的各个参数即可：
kubeadm join 192.168.99.110:6443 --token token
--discovery-token-ca-cert-hash sha256:hash
安装pod网络附加组件（calico、flannel二选一）
calico
wiki：https://docs.projectcalico.org/getting-started/kubernetes/quickstart
kubectl create -f https://docs.projectcalico.org/manifests/tigera-operator.yaml
kubectl create -f https://docs.projectcalico.org/manifests/custom-resources.yaml
watch kubectl get pods -n calico-system # 一直等到所有pod running
flannel
https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml
static pod
static pod是k8s中一种特殊的pod，kubelet原生支持static pod的调度（kubelet无法独立创建Deployment，只能创建pod）
static pod的yaml配置放到了节点下面的文件：/etc/kubernetes/manifests
用kubeadm默认安装的etcd、kube-apiserver、kube-controller-manager、kube-scheduler 都是static pod
/etc/kubernetes/manifests
etcd.yaml
kube-apiserver.yaml
kube-controller-manager.yaml
kube-scheduler.yaml
安装遇到的坑
- node节点kube-proxy一直处于ContainerCreating状态
原因：网络原因，k8s.gcr.io/kube-proxy:v1.20.1，k8s.gcr.io/pause镜像需要提前下载到各个节点上
