-e5651c91ea8f4875ab4272337398cabe.JPG)
环境介绍
| 名称 | IP | 系统 | 服务 |
|---|---|---|---|
| Master | 192.168.160.123 | CentOS 8 | Kubeadm Docker kubelet |
| Node1 | 192.168.160.124 | CentOS 8 | Kubeadm Docker kubelet |
| Node2 | 192.168.160.125 | CentOS 8 | Kubeadm Docker kubelet |
准备工作
注意：准备工作需要在所有主机上进行（包括Master）
关闭防火墙
只在Master上做演示，但所有主机都得关闭！！！
[root@master ~]# systemctl disable --now firewalld.service
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
关闭SElinux
只在master上演示，但所有主机都得关闭！！！
[root@master ~]# setenforce 0
[root@master ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled //改为disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
[root@master ~]# reboot
注释swap分区
只在master上演示，但所有主机都得关闭！！！
[root@master ~]# cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Fri Dec 17 10:55:25 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/cl-root / xfs defaults 0 0
UUID=13189811-0cee-4908-b75c-0f6e581ac16c /boot xfs defaults 0 0
/dev/mapper/cl-home /home xfs defaults 0 0
#/dev/mapper/cl-swap none swap defaults 0 0 //注释此行
设置主机名
//master
[root@master ~]# hostnamectl set-hostname master.example.com
[root@master ~]# hostname
master.example.com
//node1
[root@node1 ~]# hostnamectl set-hostname node1.example.com
[root@node1 ~]# hostname
node1.example.com
//node2
[root@node2 ~]# hostnamectl set-hostname node2.example.com
[root@node2 ~]# hostname
node2.example.com
master配置DNS域名解析
[root@master ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.160.123 master.example.com //添加
192.168.160.124 node1.example.com //添加
192.168.160.125 node2.example.com //添加
master配置内核参数，将桥接的IPv4流量传递到iptables的链
[root@master ~]# cat > /etc/sysctl.d/k8s.conf <<EOF
> net.bridge.bridge-nf-call-ip6tables = 1
> net.bridge.bridge-nf-call-iptables = 1
> EOF
[root@master ~]# sysctl --system //使刚配置的命令生效
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /usr/lib/sysctl.d/50-coredump.conf ...
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
kernel.kptr_restrict = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.promote_secondaries = 1
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf ...
net.core.optmem_max = 81920
* Applying /etc/sysctl.d/50-libreswan.conf ...
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
kernel.pid_max = 4194304
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.d/k8s.conf ...
* Applying /etc/sysctl.conf ...
时间同步
//清除缓存&&重建缓存
[root@master ~]# yum clean all && yum makecache
21 文件已删除
CentOS Linux 8 - AppStream 5.5 MB/s | 8.2 MB 00:01
CentOS Linux 8 - BaseOS 3.1 MB/s | 3.5 MB 00:01
CentOS Linux 8 - Extras 14 kB/s | 10 kB 00:00
元数据缓存已建立。
[root@node1 ~]# yum clean all && yum makecache
21 文件已删除
CentOS Linux 8 - AppStream 4.4 MB/s | 8.2 MB 00:01
CentOS Linux 8 - BaseOS 3.0 MB/s | 3.5 MB 00:01
CentOS Linux 8 - Extras 13 kB/s | 10 kB 00:00
元数据缓存已建立。
[root@node2 ~]# yum clean all && yum makecache
21 文件已删除
CentOS Linux 8 - AppStream 4.0 MB/s | 8.2 MB 00:02
CentOS Linux 8 - BaseOS 3.5 MB/s | 3.5 MB 00:00
CentOS Linux 8 - Extras 8.6 kB/s | 10 kB 00:01
元数据缓存已建立。
//安装chrony时间同步
[root@master ~]# yum -y install chrony
[root@node1 ~]# yum -y install chrony
[root@node2 ~]# yum -y install chrony
//配置chrony、并设置开机自启
[root@master ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool time1.aliyun.com iburst
[root@master ~]# systemctl enable --now chronyd //开机自启
Created symlink /etc/systemd/system/multi-user.target.wants/chronyd.service → /usr/lib/systemd/system/chronyd.service.
免密登录
免密登录只用在master上做即可，node节点可以不用做
[root@master ~]# ssh-keygen -t rsa //获取秘钥
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:pAUcmCpPst4DpZvr3CotBjoxhSN3AzShqdrEXZ9GJl8 root@master.example.com
The key's randomart image is:
+---[RSA 3072]----+
| .+. +o. |
| o..o .. |
|o. o o = E |
|B.=oo. X o |
|oX=.... S |
|*=. . |
|=+* |
|*=oo |
|+Bo.. |
+----[SHA256]-----+
[root@master ~]# ssh-copy-id 192.168.160.123
[root@master ~]# ssh-copy-id 192.168.160.124
[root@master ~]# ssh-copy-id 192.168.160.125
记得重启所有主机
安装服务
以master做演示，但所有节点都需安装
安装docker
//卸载系统自带的podman容器
[root@master ~]# yum -y remove podman-manpages
//部署安装docker所需要的环境
[root@master ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
//配置docker的yum源
[root@master ~]# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
//安装docker-ce以及docker组件
[root@master ~]# yum install -y docker-ce docker-ce-cli containerd.io
//启动docker服务并设置开机自启
[root@master ~]# systemctl start docker.service
[root@master ~]# systemctl enable docker.service
//设置docker hub阿里云镜像加速
[root@master ~]# mkdir -p /etc/docker
[root@master ~]# tee /etc/docker/daemon.json <<-'EOF'
{
"registry-mirrors": ["https://1aq1u7oh.mirror.aliyuncs.com"],
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2"
}
EOF
//后面的地址应该放自己阿里云的镜像加速地址
[root@master ~]# systemctl daemon-reload
[root@master ~]# systemctl restart docker
安装kubeadm，kubelet和kubectl
添加阿里源
[root@master ~]# cat <<EOF > /etc/yum.repos.d/kubernetes.repo
> [kubernetes]
> name=Kubernetes
> baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
> enabled=1
> gpgcheck=0
> repo_gpgcheck=1
> gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
> EOF
开始安装
[root@master ~]# yum install -y kubelet-1.20.0 kubeadm-1.20.0 kubectl-1.20.0
[root@master ~]# systemctl enable --now kubelet
Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service → /usr/lib/systemd/system/kubelet.service.
初始化k8s集群
该操作只用在master上进行
[root@master ~]# kubeadm init --kubernetes-version=1.20.0 \
> --apiserver-advertise-address=192.168.160.123 \
> --image-repository registry.aliyuncs.com/google_containers \
> --service-cidr=10.96.0.0/16 --pod-network-cidr=10.244.0.0/16
POD的网段为: 10.244.0.0/12， api server地址就是master本机IP。
这一步很关键，由于kubeadm 默认从官网k8s.grc.io下载所需镜像，国内无法访问，因此需要通过–image-repository指定阿里云镜像仓库地址。
集群初始化成功后返回如下信息：
[init] Using Kubernetes version: v1.20.0
[preflight] Running pre-flight checks
[WARNING Service-Docker]: docker service is not enabled, please run 'systemctl enable docker.service'
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[WARNING FileExisting-tc]: tc not found in system path
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.12. Latest validated version: 19.03
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master.example.com] and IPs [10.10.0.1 192.168.160.123]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [localhost master.example.com] and IPs [192.168.160.123 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost master.example.com] and IPs [192.168.160.123 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 8.002172 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.20" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node master.example.com as control-plane by adding the labels "node-role.kubernetes.io/master=''" and "node-role.kubernetes.io/control-plane='' (deprecated)"
[mark-control-plane] Marking the node master.example.com as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: nhdghn.p0t5o79tgh7fdmx0
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
# 如果你是管理员用户就执行下面的操作，但是我们一般不会这样操作。
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.160.123:6443 --token nhdghn.p0t5o79tgh7fdmx0 \
--discovery-token-ca-cert-hash sha256:3a188161659e31a1f01a50333b03cfc1e247462029c9468f47cb3b2c43f24569
记录生成的最后部分内容，此内容需要在其它节点加入Kubernetes集群时执行。
kubeadm join 192.168.160.123:6443 --token nhdghn.p0t5o79tgh7fdmx0 \
--discovery-token-ca-cert-hash sha256:3a188161659e31a1f01a50333b03cfc1e247462029c9468f47cb3b2c43f24569
写环境变量
根据官方提示，使用管理员，将命令设置为环境变量
[root@master ~]# cd /etc/kubernetes/
[root@master kubernetes]# echo 'export KUBECONFIG=/etc/kubernetes/admin.conf' > /etc/profile.d/k8s.sh
[root@master kubernetes]# source /etc/profile.d/k8s.sh
查看现在是否有被管理节点和pod
[root@master kubernetes]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master.example.com NotReady control-plane,master 5m17s v1.20.0
[root@master kubernetes]# kubectl get pod --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system coredns-7f89b7bc75-f6hr5 0/1 Pending 0 6m31s
kube-system coredns-7f89b7bc75-wwbms 0/1 Pending 0 6m31s
kube-system etcd-master.example.com 1/1 Running 0 6m47s
kube-system kube-apiserver-master.example.com 1/1 Running 0 6m47s
kube-system kube-controller-manager-master.example.com 1/1 Running 0 6m47s
kube-system kube-proxy-bf9nw 1/1 Running 0 6m31s
kube-system kube-scheduler-master.example.com 1/1 Running 0 6m47s
node节点为NotReady，因为corednspod没有启动，缺少网络pod
安装Pod网络插件（CNI）
做一步前要确保主机可以正常访问quay.io这个registery(仓库)，因为是从红帽官方的quay.io拉取镜像
[root@master ~]# kubectl apply -f /root/kube-flannel.yml
podsecuritypolicy.policy/psp.flannel.unprivileged created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created
这里因为拉取不下来，所以将文件下载到本地再指定路径
加入Kubernetes Node
这里在node1和node2上执行
[root@node1 ~]# kubeadm join 192.168.160.123:6443 --token nhdghn.p0t5o79tgh7fdmx0 \
> --discovery-token-ca-cert-hash sha256:3a188161659e31a1f01a50333b03cfc1e247462029c9468f47cb3b2c43f24569
[preflight] Running pre-flight checks
[WARNING Service-Docker]: docker service is not enabled, please run 'systemctl enable docker.service'
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[WARNING FileExisting-tc]: tc not found in system path
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.12. Latest validated version: 19.03
[WARNING Hostname]: hostname "node1.example.com" could not be reached
[WARNING Hostname]: hostname "node1.example.com": lookup node1.example.com on 192.168.160.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
[root@node2 ~]# kubeadm join 192.168.160.123:6443 --token nhdghn.p0t5o79tgh7fdmx0 \
> --discovery-token-ca-cert-hash sha256:3a188161659e31a1f01a50333b03cfc1e247462029c9468f47cb3b2c43f24569
[preflight] Running pre-flight checks
[WARNING Service-Docker]: docker service is not enabled, please run 'systemctl enable docker.service'
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup driver. The recommended driver is "systemd". Please follow the guide at https://kubernetes.io/docs/setup/cri/
[WARNING FileExisting-tc]: tc not found in system path
[WARNING SystemVerification]: this Docker version is not on the list of validated versions: 20.10.12. Latest validated version: 19.03
[WARNING Hostname]: hostname "node2.example.com" could not be reached
[WARNING Hostname]: hostname "node2.example.com": lookup node2.example.com on 192.168.160.2:53: no such host
[WARNING Service-Kubelet]: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
在master上查看节点信息
[root@master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master.example.com Ready control-plane,master 18m v1.20.0
node1.example.com NotReady <none> 89s v1.20.0
node2.example.com NotReady <none> 46s v1.20.0
这个时候node1和node2是没有准备好的转态，这是正常的，因为后台还在拉取一些镜像，需要等待一会
[root@master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master.example.com Ready control-plane,master 19m v1.20.0
node1.example.com Ready <none> 2m12s v1.20.0
node2.example.com Ready <none> 89s v1.20.0
管理容器
[root@master ~]# kubectl get ns ////查看所有的名称空间类型
NAME STATUS AGE
default Active 22m
kube-node-lease Active 22m
kube-public Active 22m
kube-system Active 22m
//查看现有的容器状态
查看容器的状态的时候要指定名称空间
[root@master ~]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-7f89b7bc75-f6hr5 1/1 Running 0 22m
coredns-7f89b7bc75-wwbms 1/1 Running 0 22m
etcd-master.example.com 1/1 Running 0 22m
kube-apiserver-master.example.com 1/1 Running 0 22m
kube-controller-manager-master.example.com 1/1 Running 0 22m
kube-flannel-ds-kcj6v 1/1 Running 0 4m35s
kube-flannel-ds-mbdx5 1/1 Running 0 9m32s
kube-flannel-ds-t7ck6 1/1 Running 0 5m18s
kube-proxy-2p78h 1/1 Running 0 5m18s
kube-proxy-6hcqt 1/1 Running 0 4m35s
kube-proxy-bf9nw 1/1 Running 0 22m
kube-scheduler-master.example.com 1/1 Running 0 22m
//查看容器在哪个节点上运行
[root@master ~]# kubectl get pods -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
coredns-7f89b7bc75-f6hr5 1/1 Running 0 23m 10.160.0.2 master.example.com <none> <none>
coredns-7f89b7bc75-wwbms 1/1 Running 0 23m 10.160.0.3 master.example.com <none> <none>
etcd-master.example.com 1/1 Running 0 23m 192.168.160.123 master.example.com <none> <none>
kube-apiserver-master.example.com 1/1 Running 0 23m 192.168.160.123 master.example.com <none> <none>
kube-controller-manager-master.example.com 1/1 Running 0 23m 192.168.160.123 master.example.com <none> <none>
kube-flannel-ds-kcj6v 1/1 Running 0 5m11s 192.168.160.125 node2.example.com <none> <none>
kube-flannel-ds-mbdx5 1/1 Running 0 10m 192.168.160.123 master.example.com <none> <none>
kube-flannel-ds-t7ck6 1/1 Running 0 5m54s 192.168.160.124 node1.example.com <none> <none>
kube-proxy-2p78h 1/1 Running 0 5m54s 192.168.160.124 node1.example.com <none> <none>
kube-proxy-6hcqt 1/1 Running 0 5m11s 192.168.160.125 node2.example.com <none> <none>
kube-proxy-bf9nw 1/1 Running 0 23m 192.168.160.123 master.example.com <none> <none>
kube-scheduler-master.example.com 1/1 Running 0 23m 192.168.160.123 master.example.com <none> <none>
测试K8s集群
//创建容器
[root@master ~]# kubectl create deployment nginx --image nginx
deployment.apps/nginx created
//暴露端口号
[root@master ~]# kubectl expose deployment nginx --port=80 --type=NodePort
service/nginx exposed
//查看service的IP地址、端口号等
[root@master ~]# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.10.0.1 <none> 443/TCP 25m
nginx NodePort 10.10.144.226 <none> 80:30369/TCP 45s
//访问测试
[root@master ~]# curl http://10.10.144.226
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
开启Web
官方部署dashboard的服务没使用nodeport，将yaml文件下载到本地，在service里添加nodeport
安装kubernetes-dashboard
[root@master ~]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc7/aio/deploy/recommended.yaml
[root@master ~]# kubectl apply -f /root/recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
拉取不了的，可以自己创建一个recommended.yaml文件，并复制下面的内容到文件中，然后再指定文件地址
# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: v1
kind: Namespace
metadata:
name: kubernetes-dashboard
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
ports:
- port: 443
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kubernetes-dashboard
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-csrf
namespace: kubernetes-dashboard
type: Opaque
data:
csrf: ""
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-key-holder
namespace: kubernetes-dashboard
type: Opaque
---
kind: ConfigMap
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-settings
namespace: kubernetes-dashboard
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster", "dashboard-metrics-scraper"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
verbs: ["get"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
rules:
# Allow Metrics Scraper to get metrics from the Metrics server
- apiGroups: ["metrics.k8s.io"]
resources: ["pods", "nodes"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: kubernetesui/dashboard:v2.2.0
imagePullPolicy: Always
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
- --namespace=kubernetes-dashboard
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 1001
runAsGroup: 2001
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
nodeSelector:
"kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
ports:
- port: 8000
targetPort: 8000
selector:
k8s-app: dashboard-metrics-scraper
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: dashboard-metrics-scraper
template:
metadata:
labels:
k8s-app: dashboard-metrics-scraper
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
spec:
containers:
- name: dashboard-metrics-scraper
image: kubernetesui/metrics-scraper:v1.0.6
ports:
- containerPort: 8000
protocol: TCP
livenessProbe:
httpGet:
scheme: HTTP
path: /
port: 8000
initialDelaySeconds: 30
timeoutSeconds: 30
volumeMounts:
- mountPath: /tmp
name: tmp-volume
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 1001
runAsGroup: 2001
serviceAccountName: kubernetes-dashboard
nodeSelector:
"kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
volumes:
- name: tmp-volume
emptyDir: {}
查看pod，service
[root@master ~]# kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.10.229.199 <none> 8000/TCP 2m36s
kubernetes-dashboard ClusterIP 10.10.110.220 <none> 443/TCP 2m36s
评论区