kubernetes集群管理系列讲座（八）使用kubeadm安装

作者: 炼狱腾蛇Eric | 来源:发表于2020-06-24 17:51 被阅读0次

1. 介绍

1.1. kubeadm

前面讲kubeadm的时候，我们已经介绍过kubeadm的功能的，我么这里只说一下kubeadm创建集群时候的操作

2 架构图

2.1. 整体架构图

file

3. 资源清单

3.1. 测试环境

机器名	IP	组件	CPU	内存	磁盘	操作系统
master1	10.0.11.73	etcd1，master1	2C	4G	64G	ubuntu16/ubuntu18/raspberryPi
master2	10.0.12.20	etcd2，master2	2C	4G	64G	ubuntu16/ubuntu18/raspberryPi
master3	10.0.13.199	etcd3，master3	2C	4G	64G	ubuntu16/ubuntu18/raspberryPi
worker1	10.0.12.91	worker1	2C	4G	128G	ubuntu16/ubuntu18/raspberryPi
worker2	10.0.13.162	worker2	2C	4G	128G	ubuntu16/ubuntu18/raspberryPi
lb	10.0.1.152	loadbalancer（nginx）	1C	2G	64G	ubuntu16/ubuntu18/raspberryPi

3.2. 生产环境

4. 安装与配置

4.1. 初始化

修改机器名

hostnamectl set-hostname XXX

关闭防火墙

#停止当前防火墙服务
systemctl stop firewalld.service
#禁用防火墙启动
systemctl disable firewalld.service
#查看防火墙状态
firewall-cmd --state

配置host文件/etc/hosts，在生产系统中，我们通常会使用DNS服务器，但是为了简化，我们这里就使用本地的解析

10.0.11.73 master1
10.0.12.20 master2
10.0.13.199 master3
10.0.12.91 worker1
10.0.13.162 worker2
10.0.1.152 lb-server

（有的系统已经配置好了，检查一下就好）桥接网络配置

# 加载模块
$ modprobe br_netfilter
# 验证模块是否生效
$ lsmod | grep br_netfilter
br_netfilter           24576  0
bridge                172032  1 br_netfilter

#新建k8s.conf文件，并添加以下内容，这个是防止由于 iptables 被绕过而导致流量无法正确路由的问题。
$ cat <<EOF >  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

#执行修改的桥接网络设置
$ sysctl -p /etc/sysctl.d/k8s.conf

# 验证桥接的参数
$ ls /proc/sys/net/bridge
bridge-nf-call-arptables  bridge-nf-call-iptables        bridge-nf-filter-vlan-tagged
bridge-nf-call-ip6tables  bridge-nf-filter-pppoe-tagged  bridge-nf-pass-vlan-input-dev

4.2. 配置apt源

(可选，apt的国外源也OK，就是稍微有点慢)更换apt源为国内源

修改/etc/apt/sources.list中的内容，把原来的注释掉，添加国内源，例如，ubuntu更换阿里云的源，看这里。

我使用的是树莓派，所以我更换了下面的源

deb http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse

添加docker国内源，例如，添加阿里云的docker源，可以参考这个

我使用的是官方的源

curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -

cat <<EOF >/etc/apt/sources.list.d/docker.list
deb [arch=armhf] https://download.docker.com/linux/raspbian buster stable
EOF

apt-get update

使用kubernetes国内源

apt-get update && apt-get install -y apt-transport-https

curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -

cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
EOF

apt-get update

4.3. 安装软件

Docker

$ apt-get -y install docker-ce

kubectl, kubelet和kubeadm

$ apt-get -y install kubectl kubelet kubeadm

4.4. 修改Docker的源为国内的源

cat > /etc/docker/daemon.json <<EOF
{
  "registry-mirrors": ["https://gvfjy25r.mirror.aliyuncs.com"]
}
EOF

记得systemctl daemon-reload和systemctl restart docker

4.5. 负载均衡器

负载均衡可以选择Nginx，Haproxy，lvs或者traefik甚至apache都可以，基本上所有的4层负载均衡或者7层负载均衡都可以，负载均衡的主要作用就是前端使用一个统一的IP地址，后端映射api-server。让每个node通讯的时候，都通过负载均衡器来调度请求。

这里，我们就使用最常见，最容器实现的nginx来做负载均衡。

下面的步骤在负载均衡节点master-lb上做

$ apt-get install -y nginx

在/etc/nginx/nginx.conf里面添加一个include，让nginx读取目录下的配置文件

include /etc/nginx/conf.d/tcp.d/*.conf;

添加kubernetes的4层代理配置文件/etc/nginx/conf.d/tcp.d/kube-api-server.conf

stream {
    log_format main '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
    access_log /var/log/nginx/k8s-access.log main;
    upstream k8s-apiserver {
        server 10.0.11.73:6443;
        server 10.0.12.20:6443;
        server 10.0.13.199:6443;
    }
    server {
        listen 10.0.1.152:6443;
        proxy_pass k8s-apiserver;
    }
}

查看端口是否在监听了

netstat -untlp|grep 6443
tcp        0      0 10.0.1.152:6443         0.0.0.0:*               LISTEN      15105/nginx: master

上面的步骤在负载均衡节点master-lb上做

4.6. 使用kubeadm初始化第一个master节点

检查网络是否通畅(使用telnet也可以)

nc -v 10.0.1.152 6443
Connection to 10.0.1.152 6443 port [tcp/*] succeeded!

把LOAD_BALANCER_DNS:LOAD_BALANCER_PORT替换成刚才nginx的IP和端口

kubeadm init --control-plane-endpoint "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT" --upload-certs

kubeadm init --control-plane-endpoint "10.0.1.152:6443" --upload-certs --pod-network-cidr=192.168.0.0/16 --image-repository registry.cn-hangzhou.aliyuncs.com/google_containers

注意：在国内是没办法直接下载的，我们需要先把镜像拉下来再做的这种方法是不正确的！！，新版的kubeadm命令支持在初始化的时候直接指定镜像仓库的方法--image-repository

成功之后，会有下面的提示，找个小本本记下来吧

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of the control-plane node running the following command on each as root:

  kubeadm join 10.0.1.152:6443 --token bh7okr.gp161f6cdrfgx1o3 \
    --discovery-token-ca-cert-hash sha256:f0845e17f83581113fb3643a6f30c07cb6e3e8145fb5795c4ce483387bf0eaf5 \
    --control-plane --certificate-key c999218aecb003e11bcc36fea534c1439fcbab4290380d7b2260c626cf778bbf

Please note that the certificate-key gives access to cluster sensitive data, keep it secret!
As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use
"kubeadm init phase upload-certs --upload-certs" to reload certs afterward.

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 10.0.1.152:6443 --token bh7okr.gp161f6cdrfgx1o3 \
    --discovery-token-ca-cert-hash sha256:f0845e17f83581113fb3643a6f30c07cb6e3e8145fb5795c4ce483387bf0eaf5

4.7. 初始化master2和master3

kubeadm join 10.0.1.152:6443 --token bh7okr.gp161f6cdrfgx1o3 \
    --discovery-token-ca-cert-hash sha256:f0845e17f83581113fb3643a6f30c07cb6e3e8145fb5795c4ce483387bf0eaf5 \
    --control-plane --certificate-key c999218aecb003e11bcc36fea534c1439fcbab4290380d7b2260c626cf778bbf

4.8. 初始化worker1和worker2

kubeadm join 10.0.1.152:6443 --token bh7okr.gp161f6cdrfgx1o3 \
    --discovery-token-ca-cert-hash sha256:f0845e17f83581113fb3643a6f30c07cb6e3e8145fb5795c4ce483387bf0eaf5

4.9. 最后是网络方案，这次我们用calico

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

为了方便大家学习，请大家加我的微信，我会把大家加到微信群（微信群的二维码会经常变）和qq群821119334，问题答案云原生技术课堂，有问题可以一起讨论

个人微信
640.jpeg
腾讯课堂
640-20200506145837072.jpeg
微信公众号
640-20200506145842007.jpeg
专题讲座

2020 CKA考试视频真题讲解 https://www.bilibili.com/video/BV167411K7hp

2020 CKA考试指南 https://www.bilibili.com/video/BV1sa4y1479B/

2020年 5月CKA考试真题 https://mp.weixin.qq.com/s/W9V4cpYeBhodol6AYtbxIA

网友评论

本文标题：kubernetes集群管理系列讲座（八）使用kubeadm安装

本文链接：https://www.haomeiwen.com/subject/tfcdfktx.html

延伸阅读

深度阅读

您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！