Kubernetes 安装(备忘)

准备工作

体验下,准备了3台机器,正式应该最少4台,2台master,2台node

1. 修改配置几台 host

vim /etc/hosts

(内网IP)

172.27.154.95   master01
172.27.154.96   node01
172.27.154.97   node02

关闭防火墙

（并未设置，同账号内网）

systemctl stop firewalld
systemctl disable firewalld

关闭 Swap

swapoff -a # 临时关闭
sed -ri 's/.*swap.*/#&/' /etc/fstab  #永久关闭

关闭 SELinux

# 临时禁用selinux

# 永久关闭 修改/etc/sysconfig/selinux文件设置
sed -i 's/SELINUX=permissive/SELINUX=disabled/' /etc/sysconfig/selinux

# 这里按回车，下面是第二条命令
setenforce 0

配置转发参数

lsmod | grep br_netfilter #确认是否有加载此模块
sudo modprobe br_netfilter  #没有的话可以先加载


cat <

---

正式安装

Docker 安装

官方

https://docs.docker.com/engine/install/centos/

阿里云

https://developer.aliyun.com/mirror/docker-ce?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE

配置镜像加速器

https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors

您可以通过修改daemon配置文件/etc/docker/daemon.json来使用加速器

sudo mkdir -p /etc/docker 

sudo tee /etc/docker/daemon.json <<-'EOF’ 
{ 
    "registry-mirrors": ["https://***.mirror.aliyuncs.com”] 
} 
EOF 

sudo systemctl daemon-reload 

sudo systemctl restart docker

vim /etc/docker/daemon.json

{
    "registry-mirrors": [
        "https://***.mirror.aliyuncs.com"
    ],
    "exec-opts": [
        "native.cgroupdriver=systemd"
    ]
}

systemctl restart docker.service

---

安装 Kubernetes

https://developer.aliyun.com/mirror/kubernetes?spm=a2c6h.13651102.0.0.2fee1b11WmG5YE

kubeadm init --image-repository=registry.aliyuncs.com/google_containers

cat <

报错：

error execution phase preflight: [preflight] Some fatal errors occurred:
        [ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/coredns:v1.8.4: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/coredns:v1.8.4 not found: manifest unknown: manifest unknown
, error: exit status 1

kubeadm reset

docker pull coredns/coredns
docker tag coredns/coredns:latest registry.aliyuncs.com/google_containers/coredns:v1.8.4

kubeadm init --image-repository=registry.aliyuncs.com/google_containers

mkdir -p $HOME/.kube

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

sudo chown $(id -u):$(id -g) $HOME/.kube/config

systemctl status kubelet

master 查看节点检查token是否有效

kubeadm token list

生成新的token和命令。然后在node重新执行

kubeadm token create --print-join-command

Node节点

join报错：

[preflight] Running pre-flight checks
        [WARNING Hostname]: hostname "gkwc" could not be reached
        [WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
error execution phase preflight: [preflight] Some fatal errors occurred:
        [ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
        [ERROR Port-10250]: Port 10250 is in use
        [ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher

kubeadm reset

kubeadm join 172.23.103.13:6443 --token oekgxb.kiqqr7a6egz9o39s \
        --discovery-token-ca-cert-hash sha256:ef965eae9b886af2f538800d4e449572dc79330d1f85bc50219a33ec972e1e6f

输出:

[preflight] Running pre-flight checks
        [WARNING Hostname]: hostname "gkwc" could not be reached
        [WARNING Hostname]: hostname "gkwc": lookup gkwc on 100.100.2.138:53: no such host
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...




This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.




Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

安装calico网络:

kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"
  
kubectl get nodes
  
kubectl get pods --all-namespaces

安装CNI网络插件:

kubectl apply -f "https://docs.projectcalico.org/manifests/calico.yaml"

部署 Dashboard UI

https://kubernetes.io/zh/docs/tasks/access-application-cluster/web-ui-dashboard/

https://github.com/kubernetes/dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml 

本地端口映射服务器8001端口:

ssh -L localhost:8001:localhost:8001 root@master公网IP
然后本地打开
http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.
查看token

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

此时能登录进入:

image.png

但页面都是空的,并有错误
出现上述问题的原因是因为，kubernetes-dashboard 这个账户的角色权限不够

新建 dashboard-adminuser.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard


---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

然后:
kubectl apply -f dashboard-adminuser.yaml
再次查看 admin-user 的 token

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

退出登录,然后用新的token登录:

image.png

image.png

image.png