准备工作
体验下,准备了3台机器,正式应该最少4台,2台master,2台node
1. 修改配置几台 host
vim /etc/hosts
(内网IP)
172.27.154.95 master01
172.27.154.96 node01
172.27.154.97 node02
关闭防火墙
（并未设置，同账号内网）
systemctl stop firewalld
systemctl disable firewalld
关闭 Swap
swapoff -a # 临时关闭
sed -ri 's/.*swap.*/#&/' /etc/fstab #永久关闭
关闭 SELinux
# 临时禁用selinux
# 永久关闭 修改/etc/sysconfig/selinux文件设置
sed -i 's/SELINUX=permissive/SELINUX=disabled/' /etc/sysconfig/selinux
# 这里按回车，下面是第二条命令
setenforce 0
配置转发参数
lsmod | grep br_netfilter #确认是否有加载此模块
sudo modprobe br_netfilter #没有的话可以先加载
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system
正式安装
Docker 安装
官方
https://docs.docker.com/engine/install/centos/
阿里云
https://developer.aliyun.com/mirror/docker-ce?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE
配置镜像加速器
https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors
您可以通过修改daemon配置文件/etc/docker/daemon.json来使用加速器
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF’
{
"registry-mirrors": ["https://***.mirror.aliyuncs.com”]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker
vim /etc/docker/daemon.json
{
"registry-mirrors": [
"https://***.mirror.aliyuncs.com"
],
"exec-opts": [
"native.cgroupdriver=systemd"
]
}
systemctl restart docker.service
安装 Kubernetes
https://developer.aliyun.com/mirror/kubernetes?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE
kubeadm init --image-repository=registry.aliyuncs.com/google_containers
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.bridge.bridge-nf-call-iptables = 1\nEOF
报错：
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/coredns:v1.8.4: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/coredns:v1.8.4 not found: manifest unknown: manifest unknown
, error: exit status 1
kubeadm reset
docker pull coredns/coredns
docker tag coredns/coredns:latest registry.aliyuncs.com/google_containers/coredns:v1.8.4
kubeadm init --image-repository=registry.aliyuncs.com/google_containers
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
systemctl status kubelet
master 查看节点检查token是否有效
kubeadm token list
生成新的token和命令。然后在node重新执行
kubeadm token create --print-join-command
Node节点
join报错：
[preflight] Running pre-flight checks
[WARNING Hostname]: hostname "gkwc" could not be reached
[WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
[ERROR Port-10250]: Port 10250 is in use
[ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
kubeadm reset
kubeadm join 172.23.103.13:6443 --token oekgxb.kiqqr7a6egz9o39s \
--discovery-token-ca-cert-hash sha256:ef965eae9b886af2f538800d4e449572dc79330d1f85bc50219a33ec972e1e6f
输出:
[preflight] Running pre-flight checks
[WARNING Hostname]: hostname "gkwc" could not be reached
[WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
安装calico网络:
kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"
kubectl get nodes
kubectl get pods --all-namespaces
安装CNI网络插件:
kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"
部署 Dashboard UI
https://kubernetes.io/zh/docs/tasks/access-application-cluster/web-ui-dashboard/
https://github.com/kubernetes/dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml
本地端口映射服务器8001端口:
ssh -L localhost:8001:localhost:8001 root@master公网IP
然后本地打开
http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.
查看token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
此时能登录进入:
但页面都是空的,并有错误
出现上述问题的原因是因为，kubernetes-dashboard 这个账户的角色权限不够
新建 dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
然后:
kubectl apply -f dashboard-adminuser.yaml
再次查看 admin-user 的 token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
退出登录,然后用新的token登录:
