Menu

在CentOS 7上使用kubeadm安装Kubernetes集群

这是续集。
您可以通过以下链接以PDF格式下载本文，以为我们提供支持。

以PDF格式下载指南

关
这是续集。

这是续集。
这是续集。

本指南描述了如何使用kubeadm工具在CentOS 7上部署最小的可运行Kubernetes集群。 Kubeadm是一个命令行工具，旨在允许用户引导符合最佳实践的Kubernetes集群。该工具支持以下群集生命周期管理功能： 引导令牌 和集群升级。

在CentOS 7上安装Kubernetes集群

下一节将详细介绍在CentOS 7服务器上部署最小的Kubernetes集群的过程。此安装 单控平面 聚会。还有其他有关使用RKE和Kubespray部署高可用性Kubernetes集群的指南。

步骤1：准备Kubernetes服务器

群集中使用的服务器的最低服务器要求为：

  • 2 GiB 每台计算机具有更多的RAM，几乎没有空间容纳应用程序。
  • 至少 2个CPU 在机器上用作 控制平面 节点。
  • 集群中所有计算机之间的完整网络连接–可以是私有的也可以是公共的

由于此设置是出于开发目的，因此我的服务器具有以下详细信息

服务器类型服务器主机名规格
主k8s-master01.computingforgeeks.com4GB内存，2vcpus
工人k8s-worker01.computingforgeeks.com4GB内存，2vcpus
工人k8s-worker02.computingforgeeks.com4GB内存，2vcpus

登录所有服务器并更新操作系统。

sudo yum -y update && sudo systemctl reboot

第2步：安装kubelet，kubeadm，kubectl

服务器重新启动后，将CentOS 7 Kubernetes存储库添加到所有服务器。

sudo tee /etc/yum.repos.d/kubernetes.repo<

然后安装所需的软件包。

sudo yum -y install epel-release vim git curl wget kubelet kubeadm kubectl --disableexcludes=kubernetes

检查kubectl的版本并确认安装。

$ kubectl version --client
Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.3", GitCommit:"2e7996e3e2712684bc73f0dec0200d64eec7fe40", GitTreeState:"clean", BuildDate:"2020-05-20T12:52:00Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}

步骤3：停用SELinux并交换

如果您将SELinux设置为强制模式，则将其关闭或使用许可模式。

sudo setenforce 0
sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config

关闭交换。

sudo sed -i '/ swap / s/^(.*)$/#1/g' /etc/fstab
sudo swapoff -a

配置sysctl。

sudo modprobe overlay
sudo modprobe br_netfilter

sudo tee /etc/sysctl.d/kubernetes.conf<

步骤4：安装容器运行时

Kubernetes使用容器运行时在Pod中运行容器。支持的容器运行时为：

  • 码头工人
  • CRI-O
  • 在一个容器中

注意：您必须一次选择一个运行时。

安装Docker运行时：

# Install packages
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo yum update -y && yum install -y containerd.io-1.2.13 docker-ce-19.03.8 docker-ce-cli-19.03.8

# Create required directories
sudo mkdir /etc/docker
sudo mkdir -p /etc/systemd/system/docker.service.d

# Create daemon json config file
sudo tee /etc/docker/daemon.json <

安装CRI-O：

# Ensure you load modules
sudo modprobe overlay
sudo modprobe br_netfilter

# Set up required sysctl params
sudo tee /etc/sysctl.d/kubernetes.conf<

安装容器：

# Configure persistent loading of modules
sudo tee /etc/modules-load.d/containerd.conf < /etc/containerd/config.toml

# restart containerd
sudo systemctl restart containerd
sudo systemctl enable containerd

要使用systemd cgroup驱动程序， plugins.cri.systemd_cgroup = true 至 /etc/containerd/config.toml..如果您使用kubeadm，请手动 kubelet cgroup驱动程序

步骤5：配置防火墙

如果防火墙服务处于活动状态，则需要启用某些端口。

主服务器端口：

sudo firewall-cmd --add-port={6443,2379-2380,10250,10251,10252,5473,179,5473}/tcp --permanent
sudo firewall-cmd --add-port={4789,8285,8472}/udp --permanent
sudo firewall-cmd --reload

工作节点端口：

sudo firewall-cmd --add-port={10250,30000-32767,5473,179,5473}/tcp --permanent
sudo firewall-cmd --add-port={4789,8285,8472}/udp --permanent
sudo firewall-cmd --reload

步骤6：初始化控制平面节点

登录到要用作主服务器的服务器，并确保已加载br_netfilter模块。

$ lsmod | grep br_netfilter
br_netfilter           22256  0 
bridge                151336  2 br_netfilter,ebtable_broute

启用kubelet服务。

sudo systemctl enable kubelet

接下来，初始化运行控制平面组件（包括etcd（集群数据库）和API服务器）的机器。

拉货柜图片：

$ sudo kubeadm config images pull
[config/images] Pulled k8s.gcr.io/kube-apiserver:v1.18.3
[config/images] Pulled k8s.gcr.io/kube-controller-manager:v1.18.3
[config/images] Pulled k8s.gcr.io/kube-scheduler:v1.18.3
[config/images] Pulled k8s.gcr.io/kube-proxy:v1.18.3
[config/images] Pulled k8s.gcr.io/pause:3.2
[config/images] Pulled k8s.gcr.io/etcd:3.4.3-0
[config/images] Pulled k8s.gcr.io/coredns:1.6.7

这些是基础 kubeadm init 用于引导集群的选项。

--control-plane-endpoint :  set the shared endpoint for all control-plane nodes. Can be DNS/IP
--pod-network-cidr : Used to set a Pod network add-on CIDR
--cri-socket : Use if have more than one container runtime to set runtime socket path
--apiserver-advertise-address : Set advertise address for this particular control-plane node's API server

设置群集终结点的DNS名称或将记录添加到/ etc / hosts文件。

$ sudo vim /etc/hosts
172.29.20.5 k8s-cluster.computingforgeeks.com

创建一个集群。

sudo kubeadm init 
  --pod-network-cidr=192.168.0.0/16 
  --control-plane-endpoint=k8s-cluster.computingforgeeks.com

注意：如果您的网络中已经使用了192.168.0.0/16，则需要在上述命令中替换192.168.0.0/16，然后选择另一个Pod Network CIDR。

容器运行时套接字：

Unix域套接字的RuntimePath
码头工人/var/run/docker.sock
容器/run/containerd/containerd.sock
CRI-O/var/run/crio/crio.sock

您可以选择将套接字文件传递给运行时，以根据您的配置发布地址。

这是我的初始化命令的输出。

....
[init] Using Kubernetes version: v1.18.3
[preflight] Running pre-flight checks
	[WARNING Firewalld]: firewalld is active, please ensure ports [6443 10250] are open or your cluster may not function correctly
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Using existing ca certificate authority
[certs] Using existing apiserver certificate and key on disk
[certs] Using existing apiserver-kubelet-client certificate and key on disk
[certs] Using existing front-proxy-ca certificate authority
[certs] Using existing front-proxy-client certificate and key on disk
[certs] Using existing etcd/ca certificate authority
[certs] Using existing etcd/server certificate and key on disk
[certs] Using existing etcd/peer certificate and key on disk
[certs] Using existing etcd/healthcheck-client certificate and key on disk
[certs] Using existing apiserver-etcd-client certificate and key on disk
[certs] Using the existing "sa" key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/admin.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/kubelet.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/controller-manager.conf"
[kubeconfig] Using existing kubeconfig file: "/etc/kubernetes/scheduler.conf"
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
W0611 22:34:23.276374    4726 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[control-plane] Creating static Pod manifest for "kube-scheduler"
W0611 22:34:23.278380    4726 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 8.008181 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.18" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node k8s-master01.computingforgeeks.com as control-plane by adding the label "node-role.kubernetes.io/master=''"
[mark-control-plane] Marking the node k8s-master01.computingforgeeks.com as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: zoy8cq.6v349sx9ass8dzyj
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:

  kubeadm join k8s-cluster.computingforgeeks.com:6443 --token zoy8cq.6v349sx9ass8dzyj 
    --discovery-token-ca-cert-hash sha256:14a6e33ca8dc9998f984150bc8780ddf0c3ff9cf6a3848f49825e53ef1374e24 
    --control-plane 

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join k8s-cluster.computingforgeeks.com:6443 --token zoy8cq.6v349sx9ass8dzyj 
    --discovery-token-ca-cert-hash sha256:14a6e33ca8dc9998f984150bc8780ddf0c3ff9cf6a3848f49825e53ef1374e24

在输出中使用命令配置kubectl。

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

检查集群的状态。

$ kubectl cluster-info
Kubernetes master is running at https://k8s-cluster.computingforgeeks.com:6443
KubeDNS is running at https://k8s-cluster.computingforgeeks.com:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

可以使用安装输出中的命令添加其他主节点。

kubeadm join k8s-cluster.computingforgeeks.com:6443 
  --token zoy8cq.6v349sx9ass8dzyj 
  --discovery-token-ca-cert-hash sha256:14a6e33ca8dc9998f984150bc8780ddf0c3ff9cf6a3848f49825e53ef1374e24 
  --control-plane

步骤7：安装网络插件

在本指南中， 印花布..您可以选择任何其他 支持的网络插件..

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

显示以下输出。

configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrolebinding.rbac.authorization.k8s.io/calico-node created
daemonset.apps/calico-node created
serviceaccount/calico-node created
deployment.apps/calico-kube-controllers created
serviceaccount/calico-kube-controllers created

确保所有Pod正在运行。

$ kubectl get pods --all-namespaces
NAMESPACE     NAME                                                         READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-76d4774d89-nfqrr                     1/1     Running   0          2m52s
kube-system   calico-node-kpprr                                            1/1     Running   0          2m52s
kube-system   coredns-66bff467f8-9bxgm                                     1/1     Running   0          7m43s
kube-system   coredns-66bff467f8-jgwln                                     1/1     Running   0          7m43s
kube-system   etcd-k8s-master01.computingforgeeks.com                      1/1     Running   0          7m58s
kube-system   kube-apiserver-k8s-master01.computingforgeeks.com            1/1     Running   0          7m58s
kube-system   kube-controller-manager-k8s-master01.computingforgeeks.com   1/1     Running   0          7m58s
kube-system   kube-proxy-bt7ff                                             1/1     Running   0          7m43s
kube-system   kube-scheduler-k8s-master01.computingforgeeks.com            1/1     Running   0          7m58s

确保主节点准备就绪。

$ kubectl get nodes -o wide
NAME                                 STATUS   ROLES    AGE     VERSION   INTERNAL-IP     EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION                CONTAINER-RUNTIME
k8s-master01.computingforgeeks.com   Ready    master   8m38s   v1.18.3   95.217.235.35           CentOS Linux 7 (Core)   3.10.0-1127.10.1.el7.x86_64   docker://19.3.8

步骤8：添加工作程序节点

一旦控制平面准备就绪，就可以将工作节点添加到群集中以运行计划的工作负载。

如果端点地址不在DNS中，则将一条记录添加到/ etc / hosts中。

$ sudo vim /etc/hosts
172.29.20.5 k8s-cluster.computingforgeeks.com

指定的join命令用于将工作程序节点添加到集群。

kubeadm join k8s-cluster.computingforgeeks.com:6443 
  --token zoy8cq.6v349sx9ass8dzyj 
  --discovery-token-ca-cert-hash sha256:14a6e33ca8dc9998f984150bc8780ddf0c3ff9cf6a3848f49825e53ef1374e24

输出：

[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

通过在控制平面中运行以下命令，检查节点是否已加入集群。

$ kubectl get nodes
NAME                                 STATUS   ROLES    AGE   VERSION
k8s-master01.computingforgeeks.com   Ready    master   18m   v1.18.3
k8s-worker01.computingforgeeks.com   Ready       98s   v1.18.3

如果您的加入令牌已过期，请参阅有关如何加入工作程序节点的指南。

将新的Kubernetes工作节点加入现有集群

步骤9：将应用程序部署到集群

您需要部署应用程序并验证集群是否正常运行。

kubectl apply -f https://k8s.io/examples/pods/commands.yaml

检查广告连播是否已启动

$ kubectl get pods
NAME           READY   STATUS      RESTARTS   AGE
command-demo   0/1     Completed   0          40s

步骤10：安装Kubernetes仪表板（可选）

您可以使用Kubernetes仪表板将容器化的应用程序部署到Kubernetes集群，对容器化的应用程序进行故障排除以及管理集群资源。

请参阅安装指南：如何使用NodePort安装Kubernetes仪表板

储存指南：

使用Cephfs的Kubernetes的Ceph永久存储

使用Ceph RBD的Kubernetes持久存储

如何使用Heketi和GlusterFS配置Kubernetes动态卷配置

学习课程：


Kubernetes的绝对初学者实践

★★★★★
（13730）

$ 14.63

$ 225.05

有现货

立即购买

在CentOS 7上使用kubeadm安装Kubernetes集群Udemy.com


Kubernetes管理员（CKA）认证和认证测试

Kubernetes管理员（CKA）认证和认证测试

★★★★★
（11259）

$ 14.63

$ 225.05

有现货

立即购买

在CentOS 7上使用kubeadm安装Kubernetes集群Udemy.com

类似的Kubernetes部署指南：

  • 使用Rancher RKE安装生产Kubernetes集群
  • 如何使用K3在5分钟内部署轻量级Kubernetes集群
  • 使用Ansible和Kubespray部署可用于生产的Kubernetes集群

这是续集。
您可以通过以下链接以PDF格式下载本文，以为我们提供支持。

以PDF格式下载指南

关
这是续集。

这是续集。
这是续集。

近期更新

Sidebar