podSubnet(pod网段) 10.244.0.0/16
serviceSubnet(service网段): 10.96.0.0/12
实验环境规划:
操作系统:centos7.5
配置: 2Gib内存/4vCPU/50G硬盘
hostnamectl set-hostname k8smaster1 && bash #k8smaster1 为服务器名称
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
yum makecache
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动
firewall-cmd --state #查看防火墙状态
yum install -y iptables-services #安装iptables
service iptables stop && systemctl disable iptables #停用iptables并关闭开机启动iptables
service iptables status
iptables -F #清空防火墙规则
setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
getenforce #查看是否为Disabled
swapoff -a #关闭交换分区swap,提升性能
yum install -y ntpdate ntp
ntpdate cn.pool.ntp.org
#每小时进行时间同步
echo "* */1 * * * /usr/sbin/ntpdate cn.pool.ntp.org" >>/var/spool/cron/root
systemctl restart crond #重启计划任务
rm -rf /etc/hosts
cat > /etc/hosts <<EOF
192.168.40.180 k8smaster1
192.168.40.181 k8snode1
EOF
modprobe br_netfilter
echo "modprobe br_netfilter" >> /etc/profile
cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p /etc/sysctl.d/k8s.conf
cat> /etc/rc.sysinit <<EOF
#!/bin/bash
for file in /etc/sysconfig/modules/*.modules ; do
[ -x $file ] && $file
done
EOF
在/etc/sysconfig/modules/目录下 新建文件如下
cat> /etc/sysconfig/modules/br_netfilter.modules <<EOF
modprobe br_netfilter
EOF
#增加权限
chmod 755 /etc/sysconfig/modules/br_netfilter.modules
lsmod |grep br_netfilter #重启机器模块也会自动加载
cat > /etc/yum.repos.d/kubernetes.repo<<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
EOF
yum install -y device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack telnet ipvsadm
yum install yum-utils -y
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install docker-ce -y
systemctl enable docker --now
配置docker镜像加速器和驱动
cat> /etc/docker/daemon.json <<EOF
{
"registry-mirrors":["https://vh3bm52y.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"]
}
EOF
systemctl restart docker #重启docker
yum install containerd.io-1.6.6 -y
mkdir -p /etc/containerd #生成 containerd 的配置文件
containerd config default > /etc/containerd/config.toml
vim /etc/containerd/config.toml
#把SystemdCgroup = false修改成SystemdCgroup = true
#把sandbox_image = "k8s.gcr.io/pause:3.6"修改成sandbox_image="registry.aliyuncs.com/google_containers/pause:3.7"
systemctl enable containerd --now #配置 containerd 开机启动,并启动 containerd
cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF
配置containerd镜像加速器,k8s所有节点均按照以下配置:
vim /etc/containerd/config.toml
#找到config_path = "",修改成如下目录:
config_path = "/etc/containerd/certs.d"
mkdir /etc/containerd/certs.d/docker.io/ -p
cat>/etc/containerd/certs.d/docker.io/hosts.toml<<EOF
[host."https://vh3bm52y.mirror.aliyuncs.com",host."https://registry.docker-cn.com"]
capabilities = ["pull"]
EOF
systemctl restart containerd #重启containerd
安装1.25
yum install -y kubelet-1.25.0 kubeadm-1.25.0 kubectl-1.25.0
systemctl enable kubelet
crictl config runtime-endpoint /run/containerd/containerd.sock
k8s_1.25.0.tar.gz链接:https://pan.baidu.com/s/1ytLFwRB3oHxTGu1DPG9YIg?pwd=r5p1
提取码:r5p1
ctr -n=k8s.io images import k8s_1.25.0.tar.gz
crictl images #查看镜像
上传calico.tar.gz到k8smaster1上,使用yaml文件安装calico 网络插件 。
链接:https://pan.baidu.com/s/17MW_un5N1-3w-yJOSNUYhw?pwd=seoz
提取码:seoz
ctr -n=k8s.io images import calico.tar.gz
使用kubeadm初始化k8s集群
在master执行,确认服务启动正常
systemctl restart docker
systemctl restart containerd
kubeadm config print init-defaults > kubeadm.yaml
使用kubeadm初始化k8s集群
根据我们自己的需求修改配置,比如修改 imageRepository 的值,kube-proxy 的模式为 ipvs,初始化节点的时候需要指定cgroupDriver为systemd
cat> kubeadm.yaml <<EOF
apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 192.168.40.180 #控制节点的 ip
bindPort: 6443
nodeRegistration:
criSocket: unix:///run/containerd/containerd.sock
imagePullPolicy: IfNotPresent
name: k8smaster1 #控制节点主机名
taints: null
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
local:
dataDir: /var/lib/etcd
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers #指定阿里云镜像仓库地址
kind: ClusterConfiguration
kubernetesVersion: 1.25.0 #k8s 版本
networking:
dnsDomain: cluster.local
podSubnet: 10.244.0.0/16 #指定 pod 网段, 需要新增加这个
serviceSubnet: 10.96.0.0/12 #指定 Service 网段
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
EOF
基于kubeadm.yaml初始化k8s集群
kubeadm init --config=kubeadm.yaml --ignore-preflight-errors=SystemVerification
出现如下截图就成功了
如果遗忘了节点的token可以在master节点执行下列命令获取token
kubeadm token create --print-join-command
配置kubectl的配置文件config,相当于对kubectl进行授权,这样kubectl命令可以使用这个证书对k8s集群进行管理
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
kubectl get nodes
kubeadm reset
rm -rf /root/.kube
rm -rf /etc/cni/net.d
修改完一些配置比如kubeadm-config.yaml 后,重新初始化
kubeadm init --config kubeadm.yaml --ignore-preflight-errors=SystemVerification
在k8snode1服务器上修改主机名
hostnamectl set-hostname k8snode1 && bash #k8snode1 为服务器名称
在k8snode1节点执行上面获取到的值,并添加参数–ignore-preflight-errors=SystemVerification
kubeadm join 172.27.0.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:5d85ecacdc1520befa8fc33dfac4f16d03893888ba65949a02c293b26336efc4 –ignore-preflight-errors=SystemVerification
出现下列截图证明成功加入了
镜像已经在 “上传calico.tar.gz到k8smaster1上” 这一步上传了
仍需上传calico.yaml到k8smaster1上,使用yaml文件安装calico 网络插件 。
链接:https://pan.baidu.com/s/1MzhaKeNdaHB7gwvhPTCMOg?pwd=91vs
提取码:91vs
kubectl apply -f calico.yaml
#注:在线下载配置文件地址是:https://docs.projectcalico.org/manifests/calico.yaml
等两分钟查看集群状态
kubectl get pod -n kube-system
kubectl get nodes
#STATUS状态是Ready,说明k8s集群正常运行了
可以看到k8snode1的ROLES角色为空,就表示这个节点是工作节点。
按照如下方法:
kubectl label node k8snode1 node-role.kubernetes.io/worker=worker
把busybox-1-28.tar.gz上传到k8snode1、k8snode2节点,手动解压
链接:https://pan.baidu.com/s/1HdG5Zv3LThn4H5n6-bOxDQ?pwd=kyue
提取码:kyue
busybox要用指定的1.28版本,不能用最新版本,最新版本,nslookup会解析不到dns和ip
k8smaster1和k8snode1节点都需要执行
ctr -n k8s.io images import busybox-1-28.tar.gz
在k8smaster1 执行
kubectl run busybox --image docker.io/library/busybox:1.28 --image-pull-policy=IfNotPresent --restart=Never --rm -it busybox -- sh
ping www.baidu.com