资讯专栏INFORMATION COLUMN

上云采购季！| 2核2G4M爆款云服务器低至59元/年，更有多台、长期优惠，快来选购！

立即前往
首页/文章专栏/centos7.2 安装k8s v1.11.0

centos7.2 安装k8s v1.11.0

X1nFLY / 2861人阅读

前言 
</>复制代码 
  1. 最近由于公司业务发展到了瓶颈，原有的技术架构已经逐渐无法满足业务开发和测试的需求，出现了应用测试环境搭建复杂，有许多套（真的很多很多）应用环境，应用在持续集成/持续交付也遇到了很大的困难，经过讨论研究决定对应用和微服务进行容器化，这就是我首次直面docker和k8s的契机（好吧，我是菜鸟）
Kubernetes 介绍 
</>复制代码 
  1. Kubernetes 是 Google 团队发起的开源项目，它的目标是管理跨多个主机的容器，提供基本的部署，维护以及运用伸缩，主要实现语言为
    Go 语言。
    Kubernetes的特点：
  2. 易学：轻量级，简单，容易理解
  3. 便携：支持公有云，私有云，混合云，以及多种云平台
  4. 可拓展：模块化，可插拔，支持钩子，可任意组合
  5. 自修复：自动重调度，自动重启，自动复制

好吧，这是从别人ppt上拷下来的=。=
下面就正式开始部署我们自己的k8s吧

准备工作

注：以下操作都是在root权限下执行的

安装docker-ce，这里使用docker-ce-17.09.0.c版本，安装方法见之前的教程

安装Kubeadm
安装 Kubeadm 首先我们要配置好阿里云的国内源，执行如下命令：

</>复制代码 
  1. cat < /etc/yum.repos.d/kubernetes.repo 
  2. [kubernetes] 
  3. name=Kubernetes 
  4. baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 
  5. enabled=1 
  6. gpgcheck=0 
  7. EOF

之后，执行以下命令来重建yum缓存：

</>复制代码 
  1. yum -y install epel-releaseyum 
  2. clean all 
  3. yum makecache

接下来需要安装指定版本的Kubeadm（这里要安装指定版本，因为后续依赖的镜像由于有墙无法拉取，这里我们只有指定版本的镜像），注意：这里是安装指定版本的Kubeadm，k8s的版本更新之快完全超出你的想象！

</>复制代码 
  1. yum -y install kubelet-1.11.0-0
  2. yum -y install kubeadm-1.11.0-0
  3. yum -y install kubectl-1.11.0-0
  4. yum -y install kubernetes-cni

执行命令启动Kubeadm服务：

</>复制代码 
  1. systemctl enable kubelet && systemctl start kubelet

配置 Kubeadm 所用到的镜像
这里是重中之重，因为在国内的原因，无法访问到 Google 的镜像库，所以我们需要执行以下脚本来从 Docker Hub 仓库中获取相同的镜像，并且更改 TAG 让其变成与 Google 拉去镜像一致。
新建一个 Shell 脚本，填入以下代码之后保存。

</>复制代码 
  1. #docker.sh
  2. #!/bin/bash
  3. images=(kube-proxy-amd64:v1.11.0 kube-scheduler-amd64:v1.11.0 kube-controller-manager-amd64:v1.11.0 kube-apiserver-amd64:v1.11.0 etcd-amd64:3.2.18 coredns:1.1.3 pause-amd64:3.1 kubernetes-dashboard-amd64:v1.8.3 k8s-dns-sidecar-amd64:1.14.9 k8s-dns-kube-dns-amd64:1.14.9 k8s-dns-dnsmasq-nanny-amd64:1.14.9 ) 
  4. for imageName in ${images[@]} ; do
  5. docker pull keveon/$imageName
  6. docker tag keveon/$imageName k8s.gcr.io/$imageName
  7. docker rmi keveon/$imageName
  8. done
  9. # 个人新加的一句，V 1.11.0 必加
  10. docker tag da86e6ba6ca1 k8s.gcr.io/pause:3.1

保存后使用chmod命令赋予脚本执行权限

</>复制代码 
  1. chmod -R 777 ./docker.sh

执行脚本拉取镜像

</>复制代码 
  1. sh docker.sh
  2. #这里就开始了漫长的拉取镜像之路

关闭swap

</>复制代码 
  1. sudo swapoff -a
  2. #要永久禁掉swap分区，打开如下文件注释掉swap那一行 
  3. # sudo vi /etc/stab

关闭selinux

</>复制代码 
  1. # 临时禁用selinux
  2. # 永久关闭 修改/etc/sysconfig/selinux文件设置
  3. sed -i "s/SELINUX=permissive/SELINUX=disabled/" /etc/sysconfig/selinux 
  4. # 这里按回车，下面是第二条命令
  5. setenforce 0

关闭防火墙

</>复制代码 
  1. systemctl disable firewalld.service && systemctl stop firewalld.service

配置转发参数

</>复制代码 
  1. # 配置转发相关参数，否则可能会出错 
  2. cat < /etc/sysctl.d/k8s.conf 
  3. net.bridge.bridge-nf-call-ip6tables = 1
  4. net.bridge.bridge-nf-call-iptables = 1
  5. vm.swappiness=0
  6. EOF 
  7. # 这里按回车，下面是第二条命令 
  8. sysctl --system

这里就完成了k8s集群搭建的准备工作，集群搭建的话以上操作结束后将操作完的系统制作成系统镜像，方便集群搭建

正式安装 
</>复制代码 
  1. 以下的操作都只在主节点上进行：

正式开始安装k8s
初始化镜像，执行以下命令：

</>复制代码 
  1. kubeadm init --kubernetes-version=v1.11.0 #这里是之前所安装K8S的版本号 --pod-network-cidr=10.10.0.0/16  #这里填写集群所在网段

之后的输出会是这样：

</>复制代码 
  1. I0712 10:46:30.938979   13461 feature_gate.go:230] feature gates: &{map[]}
  2. [init] using Kubernetes version: v1.11.0
  3. [preflight] running pre-flight checks
  4. I0712 10:46:30.961005   13461 kernel_validator.go:81] Validating kernel version
  5. I0712 10:46:30.961061   13461 kernel_validator.go:96] Validating kernel config
  6.     [WARNING SystemVerification]: docker version is greater than the most recently validated version. Docker version: 18.03.1-ce. Max validated version: 17.03
  7.     [WARNING Hostname]: hostname "g2-apigateway" could not be reached
  8.     [WARNING Hostname]: hostname "g2-apigateway" lookup g2-apigateway on 100.100.2.138:53: no such host
  9. [preflight/images] Pulling images required for setting up a Kubernetes cluster
  10. [preflight/images] This might take a minute or two, depending on the speed of your internet connection
  11. [preflight/images] You can also perform this action in beforehand using "kubeadm config images pull"
  12. [kubelet] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
  13. [kubelet] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
  14. [preflight] Activating the kubelet service
  15. [certificates] Generated ca certificate and key.
  16. [certificates] Generated apiserver certificate and key.
  17. [certificates] apiserver serving cert is signed for DNS names [g2-apigateway kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 172.16.8.62]
  18. [certificates] Generated apiserver-kubelet-client certificate and key.
  19. [certificates] Generated sa key and public key.
  20. [certificates] Generated front-proxy-ca certificate and key.
  21. [certificates] Generated front-proxy-client certificate and key.
  22. [certificates] Generated etcd/ca certificate and key.
  23. [certificates] Generated etcd/server certificate and key.
  24. [certificates] etcd/server serving cert is signed for DNS names [g2-apigateway localhost] and IPs [127.0.0.1 ::1]
  25. [certificates] Generated etcd/peer certificate and key.
  26. [certificates] etcd/peer serving cert is signed for DNS names [g2-apigateway localhost] and IPs [172.16.8.62 127.0.0.1 ::1]
  27. [certificates] Generated etcd/healthcheck-client certificate and key.
  28. [certificates] Generated apiserver-etcd-client certificate and key.
  29. [certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"
  30. [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
  31. [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
  32. [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"
  33. [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"
  34. [controlplane] wrote Static Pod manifest for component kube-apiserver to "/etc/kubernetes/manifests/kube-apiserver.yaml"
  35. [controlplane] wrote Static Pod manifest for component kube-controller-manager to "/etc/kubernetes/manifests/kube-controller-manager.yaml"
  36. [controlplane] wrote Static Pod manifest for component kube-scheduler to "/etc/kubernetes/manifests/kube-scheduler.yaml"
  37. [etcd] Wrote Static Pod manifest for a local etcd instance to "/etc/kubernetes/manifests/etcd.yaml"
  38. [init] waiting for the kubelet to boot up the control plane as Static Pods from directory "/etc/kubernetes/manifests" 
  39. [init] this might take a minute or longer if the control plane images have to be pulled
  40. [apiclient] All control plane components are healthy after 41.001672 seconds
  41. [uploadconfig] storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
  42. [kubelet] Creating a ConfigMap "kubelet-config-1.11" in namespace kube-system with the configuration for the kubelets in the cluster
  43. [markmaster] Marking the node g2-apigateway as master by adding the label "node-role.kubernetes.io/master="""
  44. [markmaster] Marking the node g2-apigateway as master by adding the taints [node-role.kubernetes.io/master:NoSchedule]
  45. [patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "g2-apigateway" as an annotation
  46. [bootstraptoken] using token: o337m9.ceq32wg9g2gro7gx
  47. [bootstraptoken] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
  48. [bootstraptoken] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
  49. [bootstraptoken] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
  50. [bootstraptoken] creating the "cluster-info" ConfigMap in the "kube-public" namespace
  51. [addons] Applied essential addon: CoreDNS
  52. [addons] Applied essential addon: kube-proxy
  53. Your Kubernetes master has initialized successfully!
  54. To start using your cluster, you need to run the following as a regular user:
  55.   mkdir -p $HOME/.kube
  56.   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  57.   sudo chown $(id -u):$(id -g) $HOME/.kube/config
  58. You should now deploy a pod network to the cluster.
  59. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  60.   https://kubernetes.io/docs/concepts/cluster-administration/addons/
  61. You can now join any number of machines by running the following on each node
  62. as root:
  63. kubeadm join 10.10.207.253:6443 --token t69z6h.lr2etdbg9mfx5r15 --discovery-token-ca-cert-hash sha256:90e3a748c0eb4cb7058f3d0ee8870ee5d746214ab0589b5e841fd5d68fec8f00

这里注意最后一行：

</>复制代码 
  1. kubeadm join 10.10.207.253:6443 --token t69z6h.lr2etdbg9mfx5r15 --discovery-token-ca-cert-hash sha256:90e3a748c0eb4cb7058f3d0ee8870ee5d746214ab0589b5e841fd5d68fec8f00

证明集群主节点安装成功，这里要记得保存这条命令，以便之后各个节点加入集群

配置kubetl认证信息

</>复制代码 
  1. export KUBECONFIG=/etc/kubernetes/admin.conf 
  2. # 如果你想持久化的话，直接执行以下命令【推荐】
  3. echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile

安装flanel网络
依次执行以下命令：

</>复制代码 
  1. mkdir -p /etc/cni/net.d/
  2. cat < /etc/cni/net.d/10-flannel.conf 
  3. { 
  4. “name”: “cbr0”,
  5. “type”: “flannel”,
  6. “delegate”: { 
  7. “isDefaultGateway”: true
  8. } 
  9. } 
  10. EOF
  11. mkdir /usr/share/oci-umount/oci-umount.d -p
  12. mkdir /run/flannel/
  13. cat < /run/flannel/subnet.env 
  14. FLANNEL_NETWORK=10.244.0.0/16 
  15. FLANNEL_SUBNET=10.244.1.0/24 
  16. FLANNEL_MTU=1450 
  17. FLANNEL_IPMASQ=true 
  18. EOF

最后需要新建一个flannel.yml文件：

</>复制代码 
  1. ---
  2. kind: ClusterRole
  3. apiVersion: rbac.authorization.k8s.io/v1beta1
  4. metadata:
  5.   name: flannel
  6. rules:
  7.   - apiGroups:
  8.       - ""
  9.     resources:
  10.       - pods
  11.     verbs:
  12.       - get
  13.   - apiGroups:
  14.       - ""
  15.     resources:
  16.       - nodes
  17.     verbs:
  18.       - list
  19.       - watch
  20.   - apiGroups:
  21.       - ""
  22.     resources:
  23.       - nodes/status
  24.     verbs:
  25.       - patch
  26. ---
  27. kind: ClusterRoleBinding
  28. apiVersion: rbac.authorization.k8s.io/v1beta1
  29. metadata:
  30.   name: flannel
  31. roleRef:
  32.   apiGroup: rbac.authorization.k8s.io
  33.   kind: ClusterRole
  34.   name: flannel
  35. subjects:
  36. - kind: ServiceAccount
  37.   name: flannel
  38.   namespace: kube-system
  39. ---
  40. apiVersion: v1
  41. kind: ServiceAccount
  42. metadata:
  43.   name: flannel
  44.   namespace: kube-system
  45. ---
  46. kind: ConfigMap
  47. apiVersion: v1
  48. metadata:
  49.   name: kube-flannel-cfg
  50.   namespace: kube-system
  51.   labels:
  52.     tier: node
  53.     app: flannel
  54. data:
  55.   cni-conf.json: |
  56.     {
  57.       "name": "cbr0",
  58.       "type": "flannel",
  59.       "delegate": {
  60.         "isDefaultGateway": true
  61.       }
  62.     }
  63.   net-conf.json: |
  64.     {
  65.       "Network": "10.10.0.0/16",    #这里换成集群所在的网段
  66.       "Backend": {
  67.         "Type": "vxlan"
  68.       }
  69.     }
  70. ---
  71. apiVersion: extensions/v1beta1
  72. kind: DaemonSet
  73. metadata:
  74.   name: kube-flannel-ds
  75.   namespace: kube-system
  76.   labels:
  77.     tier: node
  78.     app: flannel
  79. spec:
  80.   template:
  81.     metadata:
  82.       labels:
  83.         tier: node
  84.         app: flannel
  85.     spec:
  86.       hostNetwork: true
  87.       nodeSelector:
  88.         beta.kubernetes.io/arch: amd64
  89.       tolerations:
  90.       - key: node-role.kubernetes.io/master
  91.         operator: Exists
  92.         effect: NoSchedule
  93.       serviceAccountName: flannel
  94.       initContainers:
  95.       - name: install-cni
  96.         image: quay.io/coreos/flannel:v0.9.1-amd64
  97.         command:
  98.         - cp
  99.         args:
  100.         - -f
  101.         - /etc/kube-flannel/cni-conf.json
  102.         - /etc/cni/net.d/10-flannel.conf
  103.         volumeMounts:
  104.         - name: cni
  105.           mountPath: /etc/cni/net.d
  106.         - name: flannel-cfg
  107.           mountPath: /etc/kube-flannel/
  108.       containers:
  109.       - name: kube-flannel
  110.         image: quay.io/coreos/flannel:v0.9.1-amd64
  111.         command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ]
  112.         securityContext:
  113.           privileged: true
  114.         env:
  115.         - name: POD_NAME
  116.           valueFrom:
  117.             fieldRef:
  118.               fieldPath: metadata.name
  119.         - name: POD_NAMESPACE
  120.           valueFrom:
  121.             fieldRef:
  122.               fieldPath: metadata.namespace
  123.         volumeMounts:
  124.         - name: run
  125.           mountPath: /run
  126.         - name: flannel-cfg
  127.           mountPath: /etc/kube-flannel/
  128.       volumes:
  129.         - name: run
  130.           hostPath:
  131.             path: /run
  132.         - name: cni
  133.           hostPath:
  134.             path: /etc/cni/net.d
  135.         - name: flannel-cfg
  136.           configMap:
  137.             name: kube-flannel-cfg

执行：

</>复制代码 
  1. kubectl create -f ./flannel.yml

默认情况下，master节点不参与工作负载，但如果希望安装出一个all-in-one的k8s环境，则可以执行以下命令，让master节点成为一个node节点：

</>复制代码 
  1. kubectl taint nodes --all node-role.kubernetes.io/master-

执行之后，运行以下命令，查看节点信息：

</>复制代码 
  1. kubectl get nodes

会看到如下的输出：

</>复制代码 
  1. NAME            STATUS     ROLES     AGE       VERSION
  2. k8s-master      Ready      master    18h       v1.11.0
</>复制代码 
  1. 以下是节点配置

在配置好主节点之后，就可以配置集群的其他节点了，这里建议直接安装之前做好准备工作的系统镜像
进入节点机器之后，直接执行之前保存好的命令

</>复制代码 
  1. kubeadm join 10.10.207.253:6443 --token t69z6h.lr2etdbg9mfx5r15 --discovery-token-ca-cert-hash sha256:90e3a748c0eb4cb7058f3d0ee8870ee5d746214ab0589b5e841fd5d68fec8f00

执行完后会看到：

</>复制代码 
  1. [preflight] running pre-flight checks
  2.         [WARNING RequiredIPVSKernelModulesAvailable]: the IPVS proxier will not be used, because the following required kernel modules are not loaded: [ip_vs_wrr ip_vs_sh ip_vs ip_vs_rr] or no builtin kernel ipvs support: map[ip_vs_rr:{} ip_vs_wrr:{} ip_vs_sh:{} nf_conntrack_ipv4:{} ip_vs:{}]
  3. you can solve this problem with following methods:
  4.  1. Run "modprobe -- " to load missing kernel modules;
  5. 2. Provide the missing builtin kernel ipvs support
  6. I0725 09:59:27.929247   10196 kernel_validator.go:81] Validating kernel version
  7. I0725 09:59:27.929356   10196 kernel_validator.go:96] Validating kernel config
  8. [discovery] Trying to connect to API Server "10.10.207.253:6443"
  9. [discovery] Created cluster-info discovery client, requesting info from "https://10.10.207.253:6443"
  10. [discovery] Requesting info from "https://10.10.207.253:6443" again to validate TLS against the pinned public key
  11. [discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "10.10.207.253:6443"
  12. [discovery] Successfully established connection with API Server "10.10.207.253:6443"
  13. [kubelet] Downloading configuration for the kubelet from the "kubelet-config-1.11" ConfigMap in the kube-system namespace
  14. [kubelet] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
  15. [kubelet] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
  16. [preflight] Activating the kubelet service
  17. [tlsbootstrap] Waiting for the kubelet to perform the TLS Bootstrap...
  18. [patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "k8s-node1" as an annotation
  19. This node has joined the cluster:
  20. * Certificate signing request was sent to master and a response
  21.   was received.
  22. * The Kubelet was informed of the new secure connection details.
  23. Run "kubectl get nodes" on the master to see this node join the cluster.

这里就表示执行完毕了，可以去主节点执行命令：

</>复制代码 
  1. kubectl get nodes

可以看到节点已加入集群：

</>复制代码 
  1. NAME        STATUS    ROLES     AGE       VERSION
  2. k8s-master  Ready     master    20h       v1.11.0
  3. k8s-node1   Ready         20h       v1.11.0
  4. k8s-node2   Ready         20h       v1.11.0

这期间可能需要等待一段时间，状态才会全部变为ready

kubernetes-dashboard安装

详见：kubernetes安装dashboard

采坑指南

有时会出现master节点一直处于notready的状态，这里可能是没有启动flannel，只需要按照上面的教程配置好flannel，然后执行：

</>复制代码 
  1. kubectl create -f ./flannel.yml

结语

参考资料：https://blog.myzony.com/cento...

GPU云服务器 云服务器 linux系统 centos7.2镜像 k8s安装 docker k8s 安装 k8s

文章版权归作者所有，未经允许请勿转载,若此文章存在违规行为，您可以联系管理员删除。

转载请注明本文地址：https://www.ucloud.cn/yun/32686.html

相关文章

  • centos7.2 安装k8s v1.11.0

    前言 最近由于公司业务发展到了瓶颈，原有的技术架构已经逐渐无法满足业务开发和测试的需求，出现了应用测试环境搭建复杂，有许多套（真的很多很多）应用环境，应用在持续集成/持续交付也遇到了很大的困难，经过讨论研究决定对应用和微服务进行容器化，这就是我首次直面docker和k8s的契机（好吧，我是菜鸟） Kubernetes 介绍 Kubernetes 是 Google 团队发起的开源项目，它的目标是管...

    Kyxy 评论0 收藏0

  • kubernetes安装dashboard

    摘要：前言在安装搭建的时候，往往会遇到各种各样的问题，而安装的展示组件则是困难中的困难，本人在实际搭建中则被整整卡住了天，和百度轮番搜索，各种技术博客和技术视频反复研究才勉强搭建成功开始安装在安装好集群之后，确保集群各个节点都处于状态的时候，就 前言 在安装搭建k8s的时候，往往会遇到各种各样的问题，而安装k8s的web展示组件kubernetes-dashboard则是困难中的困难，本人在...

    Guakin_Huang 评论0 收藏0

  • kubernetes安装dashboard

    摘要：前言在安装搭建的时候，往往会遇到各种各样的问题，而安装的展示组件则是困难中的困难，本人在实际搭建中则被整整卡住了天，和百度轮番搜索，各种技术博客和技术视频反复研究才勉强搭建成功开始安装在安装好集群之后，确保集群各个节点都处于状态的时候，就 前言 在安装搭建k8s的时候，往往会遇到各种各样的问题，而安装k8s的web展示组件kubernetes-dashboard则是困难中的困难，本人在...

    darryrzhong 评论0 收藏0

  • K8S新安全漏洞的应对之策：API Server拒绝服务漏洞

    摘要：爆出中等严重性安全漏洞拒绝服务漏洞。本文将进行漏洞解读和情景再现，并分享漏洞修复方案，用户来看应对之策了漏洞美国当地时间年月日，社区发布了拒绝服务的漏洞，即有写入权限的用户在写入资源时会导致过度消耗资源，此漏洞被评级为中等严重性。 Kubernetes爆出中等严重性安全漏洞——Kubernetes API Server拒绝服务漏洞CVE-2019-1002100。 本文将进行漏洞解读和...

    defcon 评论0 收藏0

  • 深入K8S Job(三)：cronJob controller源码分析

    摘要：如果没有指定，则没有期限。取消当前正在运行的，然后新建来替换。和这两个字段也是可选的。设置限制值为，相关类型的完成后将不会被保留。列出所有的列出所有的遍历所有的根据字段确定该是否由所创建。 k8s version: v1.11.0author: lbl167612@alibaba-inc.com 源码流程图 showImg(https://segmentfault.com/img/r...

    Enlightenment 评论0 收藏0

发表评论

登陆后可评论

0条评论

X1nFLY

男|高级讲师
我要私信

TA的文章

阅读更多
最新活动
阅读需要支付1元查看
<