centos7.6安装Kubernetes-V1.21

一：所有节点优化

curl -o  /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

yum clean all && yum makecache    #配置阿里源并生成缓存

swapoff -a   #临时关闭swap分区
vim /etc/fstab  #删除swap行，永久关闭swap分区

yum install net-tools  vim git  wget netstat -y  #安装常用工具

setenforce 0  #临时关闭selinux
sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/sysconfig/selinux #永久关闭selinux

systemctl stop firewalld && systemctl disable firewalld   #临时加永久关闭防火墙

#所有节点设置域名解析
10.10.43.93 paas-ci.abc.com
10.10.43.95 by-k8s-node01.abc.com
10.10.43.96 by-k8s-node02.abc.com

#br_netfilter模块加载
lsmod |grep br_netfilter

# 如果系统没有br_netfilter模块则执行下面的新增命令，如有则忽略
# 临时新增br_netfilter模块:
$ modprobe br_netfilter

$ lsmod |grep br_netfilter
br_netfilter           22256  0 
bridge                151336  1 br_netfilter
# 该方式重启后会失效

# 永久新增br_netfilter模块：
cat > /etc/rc.sysinit << EOF
#!/bin/bash
for file in /etc/sysconfig/modules/*.modules ; do
[ -x $file ] && $file
done
EOF

cat > /etc/sysconfig/modules/br_netfilter.modules << EOF
modprobe br_netfilter
EOF

chmod 755 /etc/sysconfig/modules/br_netfilter.modules

#临时加永久修改内核转发
sysctl net.bridge.bridge-nf-call-iptables=1
sysctl net.bridge.bridge-nf-call-ip6tables=1

cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

#生效
sysctl --system

二：所有节点安装docker

#安装依赖
yum install -y yum-utils device-mapper-persistent-data lvm2

#添加docker源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

#更新源
yum update

#安装
yum -y install docker-ce docker-ce-cli containerd.io


#启动
systemctl start docker &&  systemctl enable docker


#添加镜像加速
touch /etc/docker/daemon.json
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://ogeydad1.mirror.aliyuncs.com"]
}
EOF
```bash
  "registry-mirrors": ["http://hub-mirror.c.163.com"]

systemctl daemon-reload && systemctl restart docker

测试

docker info && docker run hello-world


##三：所有节点安装Kubelet，kubeadm，Kubectl
```bash
#设置国内K8S源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

#更新缓存
yum clean && yum makecache

#安装
yum install -y kubelet-1.21.0-0 kubeadm-1.21.0-0 kubectl-1.21.0-0

#设置开机启动Kubelet，但是不要启动kubelet,不然加入集群时会导致kubelet丢失config.yaml文件，导致起不来，就报10248端口连接拒绝
systemctl enable kubelet 

#设置Kubelet命令补全
yum -y install bash-completion
source /usr/share/bash-completion/bash-completion
source <(kubectl completion bash)

四：master节点配置和初始化集群

4.1：导出默认文件并修改

mkdir  -p /usr/local/docker/kubernetes 
cd /usr/local/docker/kubernetes/
kubeadm config print init-defaults --component-configs KubeletConfiguration > kubeadm.yaml     # 1 导出默认配置文件

root@kubernetes-master:/usr/local/docker/kubernetes# vim kubeadm.yaml  # 2 编辑配置文件 kubeadm.yaml，内容如下

apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 10.10.43.93       #master机器所在IP
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: node
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers   #国内只能使用该镜像站拉取相关镜像
kind: ClusterConfiguration
kubernetesVersion: 1.21.0
networking:
  dnsDomain: cluster.local
  podSubnet: "192.168.0.0/16"     #Pod的子网
  serviceSubnet: 10.96.0.0/12       #SVC的子网规划
scheduler: {}
---
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 0s
    cacheUnauthorizedTTL: 0s
cgroupDriver: cgroupfs
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
cpuManagerReconcilePeriod: 0s
evictionPressureTransitionPeriod: 0s
fileCheckFrequency: 0s
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 0s
imageMinimumGCAge: 0s
kind: KubeletConfiguration
logging: {}
nodeStatusReportFrequency: 0s
nodeStatusUpdateFrequency: 0s
rotateCertificates: true
runtimeRequestTimeout: 0s
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 0s
syncFrequency: 0s
volumeStatsAggPeriod: 0s

4.2：查看yaml文件中需要的镜像并下载

kubeadm config images list --config kubeadm.yml
kubeadm config images pull --config kubeadm.yml

4.3：根据修改好的配置文件开始初始化

kubeadm init --config=kubeadm.yaml --upload-certs | tee kubeadm-init.log

#成功
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 10.10.43.93:6443 --token abcdef.0123456789abcdef \
        --discovery-token-ca-cert-hash sha256:9c5f73d434edfbcfa538a864d430ef1563c511b43c1752f90d733a7b88d0cbba

4.3：设置kubeconfig

#5.1 非ROOT用户执行
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
#5.2 ROOT用户执行
export KUBECONFIG=/etc/kubernetes/admin.conf

五：K8S网络解决方案

5.1：master节点下载flannel

cd /usr/local/docker/kubernetes
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

六：node节点加入集群

6.1：

kubeadm join 10.10.43.93:6443 --token abcdef.0123456789abcdef         --discovery-token-ca-cert-hash sha256:9c5f73d434edfbcfa538a864d430ef1563c511b43c1752f90d733a7b88d0cbba

七：master节点查看集群信息

kubectl get node
kubectl get pod -n kube-system

八：常见报错

1：未join集群时就启动kubelet，导致连接超时。
2：下图是/etc/docker/daemon.json中的"exec-opts": ["native.cgroupdriver=cgroupfs"]和/var/lib/kubelet/config.yaml文件中的cgroupDriver: cgroupfs配置不同，一般建议cgroupfs，或者systemd，改为一致后systemctl daemon-reload，重启docker和kubelet

image.png

九：证书过期，重新添加新的token

slave节点加入集群失败