角色 | IP |
k8s-master
|
192.168.1.31 |
k8s-node1
|
192.168.1.32 |
k8s-node2 | 192.168.1.33 |
systemctl stop firewalld
systemctl disable firewalld
sed -i 's/enforcing/disabled/' /etc/selinux/config # 永久
setenforce 0 # 临时
swapoff -a # 临时
sed -ri 's/.*swap.*/#&/' /etc/fstab # 永久
hostnamectl set-hostname
cat >> /etc/hosts << EOF
192.168.1.31 k8smaster
192.168.1.32 k8snode1
192.168.1.33 k8snode2
EOF
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system # 生效
yum install ntpdate -y
ntpdate time.windows.com
wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo
yum -y install docker-ce-18.06.1.ce-3.el7
systemctl enable docker && systemctl start docker
docker --version
Docker version 18.06.1-ce, build e68fc7a
cat > /etc/docker/daemon.json << EOF
{
"registry-mirrors": ["https://b9pmyelo.mirror.aliyuncs.com"]
}
EOF
systemctl restart docker
添加 yum 源
cat > /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum install -y kubelet-1.18.0 kubeadm-1.18.0 kubectl-1.18.0
systemctl enable kubelet
kubeadm init --apiserver-advertise-address=192.168.1.31 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.18.0 --service-cidr=10.96.0.0/12 --pod-network-cidr=10.244.0.0/16
[root@k8smaster ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.aliyuncs.com/google_containers/kube-proxy v1.18.0 43940c34f24f 3 years ago 117MB
registry.aliyuncs.com/google_containers/kube-apiserver v1.18.0 74060cea7f70 3 years ago 173MB
registry.aliyuncs.com/google_containers/kube-controller-manager v1.18.0 d3e55153f52f 3 years ago 162MB
registry.aliyuncs.com/google_containers/kube-scheduler v1.18.0 a31f78c7c8ce 3 years ago 95.3MB
registry.aliyuncs.com/google_containers/pause 3.2 80d28bedfe5d 3 years ago 683kB
registry.aliyuncs.com/google_containers/coredns 1.6.7 67da37a9a360 3 years ago 43.8MB
registry.aliyuncs.com/google_containers/etcd 3.4.3-0 303ce5db0e90 4 years ago 288MB
(2)使用 kubectl 工具:
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
kubectl get nodes
kubeadm join 192.168.1.31:6443 --token p7bbz2.854x4kf9hvy3tbnc --discovery-token-ca-cert-hash sha256:7fb11503642078ab3eaa586286e5e6cd1219e4ad368b2d7f60818b7eec2ca91b
如果有问题:error execution phase preflight: couldn't validate the identity of the API Server: Get https://192.168.1.31:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s: x509: certificate has expired or is not yet valid
问题1:token 过期
此时需要通过kubedam
重新生成token
//解决方法
//master主机上重新生成token
[root@k8smaster ~]# kubeadm token generate #生成toke
xeqcbp.3nc76rjngebtqer0 #下面这条命令中会用到该结果
[root@k8smaster ~]# kubeadm token create xeqcbp.3nc76rjngebtqer0 --print-join-command --ttl=0 #根据token输出添加命令
kubeadm join 192.168.1.31:6443 --token xeqcbp.3nc76rjngebtqer0 --discovery-token-ca-cert-hash sha256:7fb11503642078ab3eaa586286e5e6cd1219e4ad368b2d7f60818b7eec2ca91b
然后用上面输出的kubeadm
join
命令放到想要添加的节点中执行
[root@k8snode1 ~]# kubeadm join 192.168.1.31:6443 --token xeqcbp.3nc76rjngebtqer0 --discovery-token-ca-cert-hash sha256:7fb11503642078ab3eaa586286e5e6cd1219e4ad368b2d7f60818b7eec2ca91b
W1120 22:51:37.787600 19907 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
[preflight] Running pre-flight checks
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
问题2:k8s api server不可达
此时需要检查和关闭所有服务器的firewalld
和selinux
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
默认镜像地址无法访问,sed命令修改为docker hub镜像仓库。
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
报错:The connection to the server raw.githubusercontent.com was refused - did you specify the right host or port?
解决办法:
#在https://www.ipaddress.com/查询raw.githubusercontent.com的真实IP。
vi /etc/hosts
199.232.28.133 raw.githubusercontent.com
[root@k8smaster ~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
namespace/kube-flannel created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created
[root@k8smaster ~]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-7ff77c879f-gt6z4 1/1 Running 0 3h56m
coredns-7ff77c879f-n2w4j 1/1 Running 0 3h56m
etcd-k8smaster 1/1 Running 1 3h56m
kube-apiserver-k8smaster 1/1 Running 1 3h56m
kube-controller-manager-k8smaster 1/1 Running 1 3h56m
kube-proxy-98wxv 1/1 Running 0 19m
kube-proxy-n8js9 1/1 Running 0 19m
kube-proxy-tp6ks 1/1 Running 1 3h56m
kube-scheduler-k8smaster 1/1 Running 1 3h56m
[root@k8smaster ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8smaster Ready master 3h58m v1.18.0
k8snode1 Ready 20m v1.18.0
k8snode2 Ready 20m v1.18.0
[root@k8smaster ~]# kubectl create deployment nginx --image=nginx
deployment.apps/nginx created
[root@k8smaster ~]# kubectl expose deployment nginx --port=80 --type=NodePort
service/nginx exposed
[root@k8smaster ~]# kubectl get pod,svc
NAME READY STATUS RESTARTS AGE
pod/nginx-f89759699-mtrjf 1/1 Running 0 2m43s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.96.0.1 443/TCP 4h3m
service/nginx NodePort 10.110.82.49 80:30867/TCP 33s
访问地址:http://192.168.1.32:30867/,http://192.168.1.33:30867/ (两个节点中任意节点的对应端口)