當(dāng)前位置：首頁 > 编程资源 > 编程问答 >内容正文

编程问答

k8s(1)-使用kubeadm安装Kubernetes

發(fā)布時間：2025/7/25 编程问答 22 豆豆

生活随笔收集整理的這篇文章主要介紹了 k8s(1)-使用kubeadm安装Kubernetes 小編覺得挺不錯的,現(xiàn)在分享給大家,幫大家做個參考.

安裝前準(zhǔn)備

1. 一臺或多臺主機(jī)，這里準(zhǔn)備三臺機(jī)器

角色	IP	Hostname	配置（最低）	操作系統(tǒng)版本
主節(jié)點(diǎn)	192.168.0.10	master	2核2G	CentOS7.6.1810
工作節(jié)點(diǎn)	192.168.0.11	node1	2核2G	CentOS7.6.1810
工作節(jié)點(diǎn)	192.168.0.12	node2	2核2G	CentOS7.6.1810

2. 驗(yàn)證MAC地址和product_uuid對于每個節(jié)點(diǎn)都是唯一的

您可以使用命令ip link或ifconfig -a獲取網(wǎng)絡(luò)接口的MAC地址
可以使用?sudo cat /sys/class/dmi/id/product_uuid 查看product_uuid

3. 檢查所需端口

主節(jié)點(diǎn)

?子節(jié)點(diǎn)

?4. 所有節(jié)點(diǎn)同步時間

yum install ntpdate -y ntpdate 0.asia.pool.ntp.org

5. 修改主機(jī)名，分別在三個節(jié)點(diǎn)下執(zhí)行

hostnamectl set-hostname master hostnamectl set-hostname node1 hostnamectl set-hostname node2

6. 在三個節(jié)點(diǎn)下修改hosts文件

192.168.0.10 master 192.168.0.11 node1 192.168.0.12 node2

7. 關(guān)閉所有節(jié)點(diǎn)的防火墻及SELinux

systemctl stop firewalld systemctl disable firewalld setenforce 0 sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

8. CentOS7需要確保確保?net.bridge.bridge-nf-call-iptables在sysctl配置中設(shè)置為1，在所有節(jié)點(diǎn)執(zhí)行

cat <<EOF > /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.ipv4.ip_forward = 1 vm.swappiness=0 EOF sysctl --system

9. 關(guān)閉SWAP

swapoff -a

　注釋掉/etc/fstab中的swap掛載那一行

安裝Docker CE

yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate yum install -y yum-utils device-mapper-persistent-data lvm2 yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum install docker-ce -y systemctl start docker systemctl enable docker

安裝kubeadm，kubelet和kubectl

kubeadm：引導(dǎo)群集的命令。
kubelet：在群集中的所有計(jì)算機(jī)上運(yùn)行的組件，并執(zhí)行諸如啟動pod和容器之類的操作。
kubectl：用于與群集通信的命令行util。

?1. 編輯版本庫

在每個節(jié)點(diǎn)執(zhí)行

cat <<EOF > /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF

2. 安裝，并設(shè)置kubelet開機(jī)自啟動

yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetessystemctl enable kubelet && systemctl start kubelet

從安裝結(jié)果可以看出還安裝了cri-tools, kubernetes-cni, socat三個依賴：
　　官方從Kubernetes 1.9開始就將cni依賴升級到了0.6.0版本，在當(dāng)前1.12中仍然是這個版本
　　socat是kubelet的依賴
　　cri-tools是CRI(Container Runtime Interface)容器運(yùn)行時接口的命令行工具

創(chuàng)建集群

1. 初始化

kubeadm init \--pod-network-cidr=10.244.0.0/16 \--apiserver-advertise-address=192.168.0.10

　　參數(shù)解釋注解：

　　　　為了flannel網(wǎng)絡(luò)正常工作，你必須通過--pod-network-cidr=10.244.0.0/16

? ? ? ? ? ? ? ?kubeadm使用與默認(rèn)網(wǎng)關(guān)關(guān)聯(lián)的網(wǎng)絡(luò)接口來通告主IP，使用其他網(wǎng)絡(luò)接口，請加上--apiserver-advertise-address=<ip-address>

初始化報錯，鏡像拉取錯誤，這是由于國內(nèi)的防火墻測原因

error execution phase preflight: [preflight] Some fatal errors occurred:[ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-apiserver:v1.13.0: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-controller-manager:v1.13.0: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-scheduler:v1.13.0: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-proxy:v1.13.0: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/pause:3.1: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/etcd:3.2.24: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1[ERROR ImagePull]: failed to pull image k8s.gcr.io/coredns:1.2.6: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) , error: exit status 1 [preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`

　　解決方法如下，這些鏡像也應(yīng)該下載到工作節(jié)點(diǎn)

# 從dockerhub下載需要的鏡像docker pull mirrorgooglecontainers/kube-apiserver:v1.13.2docker pull mirrorgooglecontainers/kube-controller-manager:v1.13.2docker pull mirrorgooglecontainers/kube-scheduler:v1.13.2docker pull mirrorgooglecontainers/kube-proxy:v1.13.2docker pull mirrorgooglecontainers/pause:3.1docker pull mirrorgooglecontainers/etcd:3.2.24docker pull coredns/coredns:1.2.6# 修改dockerhub鏡像tag為k8s.gcr.iodocker tag docker.io/mirrorgooglecontainers/kube-apiserver:v1.13.2 k8s.gcr.io/kube-apiserver:v1.13.2docker tag docker.io/mirrorgooglecontainers/kube-controller-manager:v1.13.2 k8s.gcr.io/kube-controller-manager:v1.13.2docker tag docker.io/mirrorgooglecontainers/kube-scheduler:v1.13.2 k8s.gcr.io/kube-scheduler:v1.13.2docker tag docker.io/mirrorgooglecontainers/kube-proxy:v1.13.2 k8s.gcr.io/kube-proxy:v1.13.2docker tag docker.io/mirrorgooglecontainers/pause:3.1 k8s.gcr.io/pause:3.1docker tag docker.io/mirrorgooglecontainers/etcd:3.2.24 k8s.gcr.io/etcd:3.2.24docker tag docker.io/coredns/coredns:1.2.6 k8s.gcr.io/coredns:1.2.6# 刪除多余鏡像docker rmi mirrorgooglecontainers/kube-apiserver:v1.13.2docker rmi mirrorgooglecontainers/kube-controller-manager:v1.13.2docker rmi mirrorgooglecontainers/kube-scheduler:v1.13.2docker rmi mirrorgooglecontainers/kube-proxy:v1.13.2docker rmi mirrorgooglecontainers/pause:3.1docker rmi mirrorgooglecontainers/etcd:3.2.24docker rmi coredns/coredns:1.2.6

再次執(zhí)行初始化，成功，日志如下，記錄了完成的初始化輸出的內(nèi)容，根據(jù)輸出的內(nèi)容基本上可以看出手動初始化安裝一個Kubernetes集群所需要的關(guān)鍵步驟。

[root@master ~]# kubeadm init \ > --kubernetes-version=v1.13.0 \ > --pod-network-cidr=10.244.0.0/16 \ > --apiserver-advertise-address=192.168.0.10 [init] Using Kubernetes version: v1.13.0 [preflight] Running pre-flight checks[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 18.09.1. Latest validated version: 18.06 [preflight] Pulling images required for setting up a Kubernetes cluster [preflight] This might take a minute or two, depending on the speed of your internet connection [preflight] You can also perform this action in beforehand using 'kubeadm config images pull' [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" [kubelet-start] Activating the kubelet service [certs] Using certificateDir folder "/etc/kubernetes/pki" [certs] Generating "ca" certificate and key [certs] Generating "apiserver" certificate and key [certs] apiserver serving cert is signed for DNS names [master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.0.10] [certs] Generating "apiserver-kubelet-client" certificate and key [certs] Generating "front-proxy-ca" certificate and key [certs] Generating "front-proxy-client" certificate and key [certs] Generating "etcd/ca" certificate and key [certs] Generating "etcd/server" certificate and key [certs] etcd/server serving cert is signed for DNS names [master localhost] and IPs [192.168.0.10 127.0.0.1 ::1] [certs] Generating "etcd/healthcheck-client" certificate and key [certs] Generating "etcd/peer" certificate and key [certs] etcd/peer serving cert is signed for DNS names [master localhost] and IPs [192.168.0.10 127.0.0.1 ::1] [certs] Generating "apiserver-etcd-client" certificate and key [certs] Generating "sa" key and public key [kubeconfig] Using kubeconfig folder "/etc/kubernetes" [kubeconfig] Writing "admin.conf" kubeconfig file [kubeconfig] Writing "kubelet.conf" kubeconfig file [kubeconfig] Writing "controller-manager.conf" kubeconfig file [kubeconfig] Writing "scheduler.conf" kubeconfig file [control-plane] Using manifest folder "/etc/kubernetes/manifests" [control-plane] Creating static Pod manifest for "kube-apiserver" [control-plane] Creating static Pod manifest for "kube-controller-manager" [control-plane] Creating static Pod manifest for "kube-scheduler" [etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests" [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s [apiclient] All control plane components are healthy after 30.506947 seconds [uploadconfig] storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace [kubelet] Creating a ConfigMap "kubelet-config-1.13" in namespace kube-system with the configuration for the kubelets in the cluster [patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "master" as an annotation [mark-control-plane] Marking the node master as control-plane by adding the label "node-role.kubernetes.io/master=''" [mark-control-plane] Marking the node master as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule] [bootstrap-token] Using token: k9bohf.6zl3ovmlkf4iwudg [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles [bootstraptoken] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials [bootstraptoken] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token [bootstraptoken] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster [bootstraptoken] creating the "cluster-info" ConfigMap in the "kube-public" namespace [addons] Applied essential addon: CoreDNS [addons] Applied essential addon: kube-proxyYour Kubernetes master has initialized successfully!To start using your cluster, you need to run the following as a regular user:mkdir -p $HOME/.kubesudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/configYou should now deploy a pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:https://kubernetes.io/docs/concepts/cluster-administration/addons/You can now join any number of machines by running the following on each node as root:kubeadm join 192.168.0.10:6443 --token k9bohf.6zl3ovmlkf4iwudg --discovery-token-ca-cert-hash sha256:e73fe78ac9a961582a0ad81e3bffbebfa1d81b37b2f0cd7aacbfa6c1a1de351c

?要使kubectl為非root用戶工作，請運(yùn)行以下命令，這些命令也是kubeadm init輸出的一部分

mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config

　　或者，如果您是root用戶，則可以運(yùn)行：

export KUBECONFIG=/etc/kubernetes/admin.conf

2. 安裝pod網(wǎng)絡(luò)附加組件

這里選擇flannel作為Pod的網(wǎng)絡(luò)，在管理節(jié)點(diǎn)下執(zhí)行

[root@master ~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml clusterrole.rbac.authorization.k8s.io/flannel created clusterrolebinding.rbac.authorization.k8s.io/flannel created serviceaccount/flannel created configmap/kube-flannel-cfg created daemonset.extensions/kube-flannel-ds-amd64 created daemonset.extensions/kube-flannel-ds-arm64 created daemonset.extensions/kube-flannel-ds-arm created daemonset.extensions/kube-flannel-ds-ppc64le created daemonset.extensions/kube-flannel-ds-s390x created

安裝了pod網(wǎng)絡(luò)后，您可以通過運(yùn)行下面命令檢查CoreDNS pod是否正常工作

[root@master ~]# kubectl get pods --all-namespaces -o wide NAMESPACE NAME READY STATUS RESTARTS AGE kube-system coredns-86c58d9df4-fvrfv 1/1 Running 0 17m kube-system coredns-86c58d9df4-lgsxd 1/1 Running 0 17m kube-system etcd-master 1/1 Running 0 16m kube-system kube-apiserver-master 1/1 Running 0 16m kube-system kube-controller-manager-master 1/1 Running 0 16m kube-system kube-flannel-ds-amd64-h56rl 1/1 Running 0 92s kube-system kube-proxy-99hmp 1/1 Running 0 17m kube-system kube-scheduler-master 1/1 Running 0 16m

　　如果報錯，下面的方法排錯：

? ? ? 查看日志：? /var/log/messages

? ? ??kubectl --namespace kube-system logs kube-flannel-ds-amd64-wdqsl

3.? 加入工作節(jié)點(diǎn)

在工作節(jié)點(diǎn)執(zhí)行初始化時日志的輸出。

kubeadm join 192.168.0.10:6443 --token qrduq2.24km2r56xg24o6yw --discovery-token-ca-cert-hash sha256:54c981ec4220202107b1ef89907d31af94840ed75a1e9f352f9288245760ac83

更新令牌

默認(rèn)情況下令牌24小時過期，使用下面方法創(chuàng)建新的令牌

kubeadm token create kubeadm token list

?4. 查看節(jié)點(diǎn)的狀態(tài)

狀態(tài)為Ready表示和Master節(jié)點(diǎn)正常通信

[root@master ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION master Ready master 104m v1.13.2 node1 Ready <none> 34m v1.13.2 node2 Ready <none> 29m v1.13.2

?5. 將主節(jié)點(diǎn)加入工作負(fù)載（可選操作）

默認(rèn)情況下，出于安全原因，您的群集不會在主服務(wù)器上安排pod。如果您希望能夠在主服務(wù)器上安排pod，例如，對于用于開發(fā)的單機(jī)Kubernetes集群，請運(yùn)行：

[root@master ~]# kubectl describe node master | grep Taint Taints: node-role.kubernetes.io/master:NoSchedule [root@master ~]# kubectl taint nodes --all node-role.kubernetes.io/master- node/master untainted taint "node-role.kubernetes.io/master:" not found taint "node-role.kubernetes.io/master:" not found

6.?從主服務(wù)器以外的計(jì)算機(jī)控制您的群集（可選操作）

在工作節(jié)點(diǎn)上運(yùn)行

scp root@<master ip>:/etc/kubernetes/admin.conf . kubectl --kubeconfig ./admin.conf get nodes

移除集群

在控制節(jié)點(diǎn)上運(yùn)行

kubectl drain <node name> --delete-local-data --force --ignore-daemonsets kubectl delete node <node name>

　然后，在要刪除的節(jié)點(diǎn)上，重置所有kubeadm安裝狀態(tài)：

kubeadm reset

　　重置過程不會重置或清除iptables規(guī)則或IPVS表。如果您想重置iptables，必須手動執(zhí)行：

iptables -F && iptables -t nat -F && iptables -t mangle -F && iptables -X

　　如果要重置IPVS表，則必須運(yùn)行以下命令：

ipvsadm -C

參考文檔：https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/

轉(zhuǎn)載于:https://www.cnblogs.com/zydev/p/10302639.html

總結(jié)

以上是生活随笔為你收集整理的k8s(1)-使用kubeadm安装Kubernetes的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。

上一篇：深入剖析 css
下一篇： UIAlertController 简单