k8s安装（抄的别人的）
#安装docker
•参考 http://www.cnblogs.com/freefei/p/9263998.html
yum install -y --setopt=obsoletes=0
docker-ce-17.12.1.ce-1.el7.centos.x86_64
docker-ce-selinux-17.12.1.ce-1.el7.centos.noarch
#开机启动
systemctl enable docker
#启动
systemctl start docker
配置
•关闭linux swap
第1步 编辑/etc/fstab
vim /etc/fstab （注释swap那行）
第2步 执行命令
echo “vm.swappiness = 0”>> /etc/sysctl.conf
第3步 执行命令
swapoff -a
•docker关闭selinux,增加"selinux-enabled"”": false
vim /etc/docker/daemon.json
{
“selinux-enabled”: false
}
systemctl daemon-reload
systemctl restart docker
•配置yum源
cat < /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
EOF
•编辑 kubeadm.yaml
apiVersion: kubeadm.k8s.io/v1alpha1
kind: MasterConfiguration
api:
advertiseAddress: “192.168.229.132”
networking:
podSubnet: “10.244.0.0/16”
kubernetesVersion: “v1.11.1”
imageRepository: “registry.cn-hangzhou.aliyuncs.com/google_containers”
•安装kubeadm kubectl kubelet
yum install -y kubeadm kubelet kubectl
初始化
•关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
•配置 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
Note: This dropin only works with kubeadm and kubelet v1.11+
[Service]
Environment=“KUBELET_KUBECONFIG_ARGS=–bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf”
Environment=“KUBELET_CONFIG_ARGS=–config=/var/lib/kubelet/config.yaml”
This is a file that “kubeadm init” and “kubeadm join” generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/sysconfig/kubelet
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS --cgroup-driver=cgroupfs --pod-infra-container-image=registry.cn-ha ngzhou.aliyuncs.com/google-containers/pause-amd64:3.0
最后一行加了 --cgroup-driver=cgroupfs --pod-infra-container-image=registry.cn-ha ngzhou.aliyuncs.com/google-containers/pause-amd64:3.0
•kubeadm init --config kubeadm.yaml
这个过程会下载一些镜像
◦失败重新init时请重置 kubeadm reset
◦可能会遇到的问题
- [preflight] Some fatal errors occurred:
/proc/sys/net/bridge/bridge-nf-call-iptables contents are not set to 1
解决方案：
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
◦再执行以下命令
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown ( i d − u ) : (id -u): (id−u):(id -g) $HOME/.kube/config
•安装网络
大多数网络代理，需要设置net.bridge.bridge-nf-call-iptables
cat < /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system
如果选择flannel作为pod网络代理，则执行
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
查看是否安装成功
kubectl get pod -n kube-system -o wide
•其它结点安装同主，只是不需要kubeadm init了
•其它结点加入cluster
kubeadm join 192.168.229.132:6443 --token 9bahe0.v8etmmcb2bo6djx4 --discovery-token-ca-cert-hash sha256:e577511a04d5c71daa2109fed13a8e0a7593092febbcef81479b9a08cb7b977f
•查看结点
显示结点列表
kubectl get nodes
示例
NAME STATUS ROLES AGE VERSION
k8s.master Ready master 1m v1.11.2
k8s.node1 Ready 35s v1.11.2
Master可以被调度
kubectl taint nodes --all node-role.kubernetes.io/k8s.master-
注：如果–all不认识，通过kubectl get nodes 获得主机名，比如：localhost.localdomain
kubectl taint nodes localhost.localdomain node-role.kubernetes.io/master-
•安装dashboard
◦认证准备
生成key
mkdir certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/dashboard.key -x509 -days 365 -out certs/dashboard.crt
设置 kubernetes-dashboard.yaml 下面的注释地方替换成hostPath
volumes:
这里映射的目录需要不同的结点上也要存在，因为不确定dashboard会分到哪个节点上
- name: kubernetes-dashboard-certs
hostPath:
path: /home/jcmiao/software/k8s/certs
type: Directory
secret:
secretName: kubernetes-dashboard-certs
参考 https://blog.csdn.net/gunner2014/article/details/80966671
◦先下载镜像，因为需要墙，所以手动下载一下，再打tag
下载其它仓库的dashboard
docker pull siriuszg/kubernetes-dashboard-amd64:v1.10.0
打成官方的tag
docker tag siriuszg/kubernetes-dashboard-amd64:v1.10.0 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.0
下载yaml文件
wget https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml
修改配置 添加type: Nodeport 和nodePort: 30001
参考最好几行
spec:
type: NodePort
ports:
- port: 443
targetPort: 8443
nodePort: 30001
selector:
k8s-app: kubernetes-dashboard
运行dashboard
kubectl create -f kubernetes-dashboard.yaml
•授予dashboard账户集群管理权限 vi kubernetes-dashboard-admin.rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-admin
namespace: kube-system
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard-admin
labels:
k8s-app: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard-admin
namespace: kube-system
◦运行 bash
kubectl apply -f kubernetes-dashboard-admin.rbac.yaml
•浏览器打开 https://192.168.229.139:30001
◦选择口令登录，获取口令，在master上运行
kubectl -n kube-system get secret | grep kubernetes-dashboard-admin|awk ‘{print “secret/”$1}’|xargs kubectl describe -n kube-system|grep token:|awk -F : ‘{print $2}’|xargs echo
输出
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbi10b2tlbi01bW4ybiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjRlYWFlYWUxLWIyYjgtMTFlOC04ZTdiLTAwMGMyOWFkNWU2ZSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiJ9.BRkFqz3NVAglqePlOeUf1hy8he2eUb7rQKJV9xX1qLHJ0mmtdw7FNQLreQxHNM17sYDXZa6q6h9KVCS-7E9tmpO8rXozFGUZpVfhVu6LHPLcMGL5DPG6hxWLKGW82nvlYlgm8wOQ6C_h2IkULNagKa1BkweUICsRanKQgCYnLCaaB52JlBeUUVtGo48zlGnyUxSZw8ovFEHY6EXq8xLtcG7XGI_mcbR9Lo4Bglx1yh_J0biX5Ta41s22udZuESLJ83GSF07ZwoMpoCzx1u5YWjigRjeJRtLtTuh_IyJl47pV42_-bc_aY3HUzqfbNAgDSVSCWD15aeHQbL5lS-QXTg
复制输出的令牌在浏览器登录
•为dashboard指定用户名密码
◦添加目录/etc/kubernetes/dashboard/ ◾添加文件dashboard-abac.json如下 bash
cat /etc/kubernetes/dashboard/dashboard-abac.json
{“apiVersion”: “abac.authorization.kubernetes.io/v1beta1”, “kind”: “Policy”, “spec”: {“user”: “admin”, “namespace”: “", “resource”: "”, “apiGroup”: “*”}}
◾添加文件dashboard.basic如下 bash
cat /etc/kubernetes/dashboard/dashboard.basic
123456,admin,1,system:authenticated
dashboard.basic文件格式: password,user,uid,“group1,group2,group3”
◦kubernetes-dashboard.yaml配置 ◾添加–authentication-mode=basic > 在- --auto-generate-certificates的后面
◦/etc/kubernetes/manifests/kube-apiserver.yaml bash
- –authorization-mode=Node,RBAC,ABAC
- –authorization-policy-file=/etc/kubernetes/dashboard/dashboard-abac.json
- –basic-auth-file=/etc/kubernetes/dashboard/dashboard.basic
… - mountPath: /etc/kubernetes/dashboard
name: k8s-dashboard
readOnly: true
…- hostPath:
# 这里映射的目录需要不同的结点上也要存在，因为不确定dashboard会分到哪个节点上
path: /etc/kubernetes/dashboard
type: DirectoryOrCreate
name: k8s-dashboard
- hostPath:
注意：执行kubeadm reset后，kube-apiserver.yaml会还原
新加ABAC以及以列出的，具体参考https://blog.csdn.net/mailjoin/article/details/79679853
◦删除旧的dashboard容器，重新运行 bash
kubectl delete -f kubernetes-dashboard.yaml
kubectl create -f kubernetes-dashboard.yaml