kubeadm?搭建?K8s的詳細(xì)過(guò)程

更新時(shí)間：2022年04月19日 09:58:55 作者：AskaJohnny

這篇文章主要介紹了kubeadm?搭建?K8s詳細(xì)過(guò)程，環(huán)境使用?VirtualBox?構(gòu)建的3臺(tái)虛擬機(jī)，虛擬機(jī)網(wǎng)絡(luò)配置的相關(guān)步驟給大家介紹的非常詳細(xì),需要的朋友可以參考下

kubeadm 搭建 K8s

本篇主要記錄一下使用 kubeadm 搭建 k8s 詳細(xì)過(guò)程，環(huán)境使用 VirtualBox 構(gòu)建的3臺(tái)虛擬機(jī)

1.環(huán)境準(zhǔn)備

操作系統(tǒng)：Centos7 （CentOS Linux release 7.9.2009）
Master 主節(jié)點(diǎn)： 1臺(tái) 虛擬機(jī)
Node 計(jì)算節(jié)點(diǎn)： 2臺(tái) 虛擬機(jī)
K8s version：v1.23.5 （選的較新的版本）
Docker version：20.10.14

虛擬機(jī)創(chuàng)建我就不詳細(xì)展開(kāi)了

2.虛擬機(jī)網(wǎng)絡(luò)配置(保證能訪問(wèn)外網(wǎng))

虛擬機(jī)網(wǎng)卡選擇的是 1.網(wǎng)絡(luò)地址轉(zhuǎn)換NAT （主要用來(lái)訪問(wèn)外網(wǎng)的） 2.僅主機(jī)網(wǎng)絡(luò) （主要用來(lái)宿主機(jī)訪問(wèn)虛擬機(jī)的）
把對(duì)應(yīng)的 ip 設(shè)置如下
kube-master 192.168.56.20
kube-node-1 192.168.56.21
kube-node-2 192.168.56.22

2.1 3臺(tái)虛擬機(jī) 靜態(tài)ip配置

cat /etc/sysconfig/network-scripts/ifcfg-enp0s3

TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="none" #關(guān)閉
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="enp0s3"
UUID="35eac2d4-234d-4859-848e-ed2a30a64a81"
DEVICE="enp0s3"
#添加部分 
IPADDR="10.0.2.20"
PREFIX="24"
GATEWAY="10.0.2.2"
DNS1="10.0.2.3"
DNS2="114.114.114.114"
ONBOOT="yes"

cat /etc/sysconfig/network-scripts/ifcfg-enp0s8

TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static #修改為 static 靜態(tài)ip
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp0s8
UUID=d06bac6d-294f-4bfe-bf08-5cb65c0a431f
DEVICE=enp0s8
#新增部分
IPADDR=192.168.56.20
PREFIX=24
ONBOOT=yes

2.2 虛擬機(jī)hosts 配置

在 3臺(tái)虛擬機(jī) /etc/hosts 中配置如下

192.168.56.20	kube-master
192.168.56.21	kube-node-1
192.168.56.22	kube-node-2

3.k8s 基礎(chǔ)環(huán)境設(shè)置

3.1 yum 換源(可選)

yum -y install wget

cd /etc/yum.repos.d
mv CentOS-Base.repo CentOS-Base.repo.bak
wget -O CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache #重新生成緩存

3.2 關(guān)閉 selinux

setenforce 0 #臨時(shí)關(guān)閉
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config #永久關(guān)閉

3.3 關(guān)閉swap分區(qū)或禁用swap文件

swapoff -a
# 注釋掉關(guān)于swap分區(qū)的行
yes | cp /etc/fstab /etc/fstab_bak
cat /etc/fstab_bak |grep -v swap > /etc/fstab

3.4 允許iptables 檢查橋接流量

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

sudo sysctl --system

3.5 關(guān)閉防火墻

systemctl stop firewalld
systemctl disable firewalld

3.6 /proc/sys/net/ipv4/ip_forward

echo 1 > /proc/sys/net/ipv4/ip_forward

4.kubectl、kubeadm、kubelet的安裝

注意先換源 https://developer.aliyun.com/mirror/kubernetes?spm=a2c6h.13651102.0.0.64be1b11iddYWH 阿里換源文檔

4.1 添加Kubernetes的alibaba yum源

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

yum install -y kubelet kubeadm kubectl

4.2 安裝 kubelet kubeadm kubectl

yum install -y kubelet kubeadm kubectl 
systemctl enable kubelet && systemctl start kubelet

由于官網(wǎng)未開(kāi)放同步方式, 可能會(huì)有索引gpg檢查失敗的情況, 這時(shí)請(qǐng)用 yum install -y --nogpgcheck kubelet kubeadm kubectl 安裝

4.3 啟動(dòng)kubelet 服務(wù)

systemctl enable kubelet && systemctl start kubelet

此時(shí)執(zhí)行systemctl status kubelet查看服務(wù)狀態(tài)，此時(shí)肯定有錯(cuò)誤（因?yàn)槲覀冞€未進(jìn)行初始化操作），錯(cuò)誤可使用journalctl -xe查看錯(cuò)誤信息。

5.Docker 安裝和配置

Docker centos 安裝文檔地址 https://docs.docker.com/engine/install/centos/

5.1 Docker 安裝

sudo yum install -y yum-utils

sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo
sudo yum install docker-ce docker-ce-cli containerd.io 
# 也可以安裝其他版本 yum list docker-ce --showduplicates | sort -r  
# sudo yum install docker-ce-<VERSION_STRING> docker-ce-cli-<VERSION_STRING> containerd.io

#啟動(dòng)docker
sudo systemctl enable docker && systemctl start docker

5.2 Docker 鏡像源更換

sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://9xxxx1clo.mirror.aliyuncs.com"] #請(qǐng)更換自己的 阿里云鏡像地址
}
EOF

5.3 Docker 配置cgroup-driver

由于 cgroup-driver ，默認(rèn)docker 是 cgroupfs ，而k8s 默認(rèn)是 systemd，所以需要設(shè)置 docker 的 cgroup 為 systemd

推薦使用方式二進(jìn)行修改

#查看cgroup-driver

 docker info | grep -i cgroup
# 方式一 追加 --exec-opt native.cgroupdriver=systemd 參數(shù)
 sed -i "s#^ExecStart=/usr/bin/dockerd.*#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd#g" /usr/lib/systemd/system/docker.service
 systemctl daemon-reload # 重新加載服務(wù)
 systemctl enable docker # 啟用docker服務(wù)(開(kāi)機(jī)自起)
 systemctl restart docker # 啟動(dòng)docker服務(wù)

# 方式二 修改docker配置文件
 vim /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"]
}

5.4 拉取k8s所需鏡像

可以通過(guò)

kubeadm config images list 查看所需的鏡像

kubeadm config images list 
k8s.gcr.io/kube-apiserver:v1.23.5
k8s.gcr.io/kube-controller-manager:v1.23.5
k8s.gcr.io/kube-scheduler:v1.23.5
k8s.gcr.io/kube-proxy:v1.23.5
k8s.gcr.io/pause:3.6
k8s.gcr.io/etcd:3.5.1-0
k8s.gcr.io/coredns/coredns:v1.8.6

如果拉取不到鏡像可以通過(guò) 去 docker hub 上查找對(duì)應(yīng)的鏡像

docker pull k8simage/kube-apiserver:v1.23.5 
 
docker tag k8simage/kube-apiserver:v1.23.5 k8s.gcr.io/kube-apiserver:v1.23.5 #重新tag改成上面所需的鏡像即可， 其他的都按照這樣來(lái)

Tips: 完成上面操作后你可以通過(guò) docker save 導(dǎo)出鏡像,以后再用的時(shí)候可以通過(guò) docker image load < 進(jìn)行離線加載鏡像

#導(dǎo)出鏡像 ，批量導(dǎo)出所有鏡像

docker save $(docker images --format '{{.Repository}}:{{.Tag}}') -o k8s.images.tar 
#導(dǎo)入鏡像 ，注意 是 < 不是 > 。。 > 后會(huì)導(dǎo)致tar 無(wú)法使用需要重新上傳
docker image load < ...tar/zip

6.kube-master 節(jié)點(diǎn) 初始化

我這里選的是 flannel 網(wǎng)絡(luò)插件，先來(lái)看看 flannel 的配置文件

6.1 查看flannel 網(wǎng)絡(luò)范圍

flannel.yml https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

不同的網(wǎng)絡(luò)插件網(wǎng)絡(luò)范圍不同

6.2 kubeadm init 初始化

kubeadm init --pod-network-cidr=10.244.0.0/16 \ #網(wǎng)卡插件的 網(wǎng)絡(luò)范圍  --apiserver-advertise-address=192.168.56.20 #master 的 ip 地址

等一會(huì)就會(huì)有如下結(jié)果

可以把 kubeadm join 命令記下來(lái) 便于后面使用保存輸出中的kubeadm join部分內(nèi)容，用于添加node節(jié)點(diǎn)，或者使用kubeadm token list 和kubeadm token create --print-join-command查看

執(zhí)行后續(xù)步驟，可以看到提示

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

6.3 網(wǎng)絡(luò)插件flannel 配置

前面提到了flannel 把對(duì)應(yīng)的flannel.yml文件下載到服務(wù)器中，可以使用wget

可以看到在沒(méi)配置 flannel 的時(shí)候 coredns 一直是 pending 狀態(tài)

wget https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml #可能會(huì)下載不到，文章最后我會(huì)提供內(nèi)容，直接copy過(guò)去即可

#Tips: 可能需要指定一下網(wǎng)卡 ，在kube-flannel.yml中 - /opt/bin/flanneld args: 后面添加
#- --iface=enp0s8 # 需要指定網(wǎng)卡，否則可能k8s會(huì)導(dǎo)致使用錯(cuò)誤的網(wǎng)卡 

kubectl apply -f kube-flannel.yml #應(yīng)用該文件

kubectl get pods --all-namespaces -o wide #查看是否安裝成功，它會(huì)在 master 和 node 節(jié)點(diǎn)上都會(huì)自動(dòng)部署

最后通過(guò) kubectl get nodes -o wide 查看節(jié)點(diǎn)

7.kube-node 節(jié)點(diǎn)初始化

7.1 查看token

可以通過(guò)該命令進(jìn)行查看 token

kubeadm token create --print-join-command

#kubeadm join kube-master:6443 --token ii5xyw.mywlktar1e8f60cu --discovery-token-ca-cert-hash sha256:358f92418178342f79aa7b049e6c18a423f0fb88186189142459016fe6efb8e7

7.2 node節(jié)點(diǎn)上執(zhí)行 kubeadmin join

kubeadm join kube-master:6443 --token ii5xyw.mywlktar1e8f60cu --discovery-token-ca-cert-hash sha256:358f92418178342f79aa7b049e6c18a423f0fb88186189142459016fe6efb8e7

7.3 在master 上查看結(jié)果

watch kubectl get nodes -o wide #可以通過(guò)watch 實(shí)時(shí)監(jiān)聽(tīng) 加入情況

至此使用 kubeadm 已經(jīng)成功搭建k8s 集群

總結(jié)

本篇主要講解了如何使用 kubeadm 進(jìn)行搭建 k8s 集群，搭建的是 k8s 較新版本 v1.23.5 版本，使用kubeadm 搭建相對(duì)來(lái)說(shuō)還是比較簡(jiǎn)單的。

flannel.yml 文件

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: psp.flannel.unprivileged
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
  privileged: false
  volumes:
  - configMap
  - secret
  - emptyDir
  - hostPath
  allowedHostPaths:
  - pathPrefix: "/etc/cni/net.d"
  - pathPrefix: "/etc/kube-flannel"
  - pathPrefix: "/run/flannel"
  readOnlyRootFilesystem: false
  # Users and groups
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  # Privilege Escalation
  allowPrivilegeEscalation: false
  defaultAllowPrivilegeEscalation: false
  # Capabilities
  allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
  defaultAddCapabilities: []
  requiredDropCapabilities: []
  # Host namespaces
  hostPID: false
  hostIPC: false
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  # SELinux
  seLinux:
    # SELinux is unused in CaaSP
    rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
rules:
- apiGroups: ['extensions']
  resources: ['podsecuritypolicies']
  verbs: ['use']
  resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/status
  verbs:
  - patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flannel
subjects:
- kind: ServiceAccount
  name: flannel
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flannel
  namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "cniVersion": "0.3.1",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      hostNetwork: true
      priorityClassName: system-node-critical
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni-plugin
       #image: flannelcni/flannel-cni-plugin:v1.0.1 for ppc64le and mips64le (dockerhub limitations may apply)
        image: rancher/mirrored-flannelcni-flannel-cni-plugin:v1.0.1
        command:
        - cp
        args:
        - -f
        - /flannel
        - /opt/cni/bin/flannel
        volumeMounts:
        - name: cni-plugin
          mountPath: /opt/cni/bin
      - name: install-cni
       #image: flannelcni/flannel:v0.17.0 for ppc64le and mips64le (dockerhub limitations may apply)
        image: rancher/mirrored-flannelcni-flannel:v0.17.0
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
       #image: flannelcni/flannel:v0.17.0 for ppc64le and mips64le (dockerhub limitations may apply)
        image: rancher/mirrored-flannelcni-flannel:v0.17.0
        command:
        - /opt/bin/flanneld
        args:
        #- --iface=enp0s8 # 需要指定網(wǎng)卡，否則可能會(huì)導(dǎo)致問(wèn)題
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN", "NET_RAW"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: EVENT_QUEUE_DEPTH
          value: "5000"
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
        - name: xtables-lock
          mountPath: /run/xtables.lock
      volumes:
      - name: run
        hostPath:
          path: /run/flannel
      - name: cni-plugin
        hostPath:
          path: /opt/cni/bin
      - name: cni
        hostPath:
          path: /etc/cni/net.d
      - name: flannel-cfg
        configMap:
          name: kube-flannel-cfg
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate

到此這篇關(guān)于kubeadm 搭建 K8s的文章就介紹到這了,更多相關(guān)kubeadm 搭建 K8s內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

您可能感興趣的文章: