1、环境介绍及准备:
1.1 物理机操作系统
物理机操作系统采用Centos7.3 64位,细节如下。
-
[root@localhost ~]# uname -a
-
Linux localhost.localdomain 3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18 13:06:36 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
-
[root@localhost ~]# cat /etc/redhat-release
-
CentOS Linux release 7.3.1611 (Core)
1.2 主机信息
本文准备了三台机器用于部署k8s的运行环境,细节如下:
节点及功能 |
主机名 |
IP |
kube-apiserver、kube-controller-manager、kube-scheduler、docker、etcd、registry、flannel |
K8s-master |
10.0.251.148 |
kubelet、kubeproxy、docker、flannel |
K8s-node-1 |
10.0.251.153 |
kubelet、kubeproxy、docker、flannel |
K8s-node-2 |
10.0.251.155 |
设置三台机器的主机名:
Master上执行:
[root@localhost ~]# hostnamectl --static set-hostname k8s-master
Node1上执行:
[root@localhost ~]# hostnamectl --static set-hostname k8s-node-1
Node2上执行:
[root@localhost ~]# hostnamectl --static set-hostname k8s-node-2
在三台机器上设置hosts,均执行如下命令:
-
echo '10.0.251.148 k8s-master
-
10.0.251.148 etcd
-
10.0.251.148 registry
-
10.0.251.153 k8s-node-1
-
10.0.251.155 k8s-node-2' >> /etc/hosts
1.3 关闭三台机器上的防火墙
-
systemctl disable firewalld.service
-
systemctl stop firewalld.service
2、部署etcd
k8s运行依赖etcd,需要先部署etcd,本文采用yum方式安装:
[root@localhost ~]# yum install etcd -y
yum安装的etcd默认配置文件在/etc/etcd/etcd.conf。编辑配置文件,更改以下带颜色部分信息:
-
[root@localhost ~]# vi /etc/etcd/etcd.conf
-
# [member]
-
ETCD_NAME=master
-
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
-
#ETCD_WAL_DIR=""
-
#ETCD_SNAPSHOT_COUNT="10000"
-
#ETCD_HEARTBEAT_INTERVAL="100"
-
#ETCD_ELECTION_TIMEOUT="1000"
-
#ETCD_LISTEN_PEER_URLS="http://0.0.0.0:2380"
-
ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379,http://0.0.0.0:4001"
-
#ETCD_MAX_SNAPSHOTS="5"
-
#ETCD_MAX_WALS="5"
-
#ETCD_CORS=""
-
#
-
#[cluster]
-
#ETCD_INITIAL_ADVERTISE_PEER_URLS="http://localhost:2380"
-
# if you use different ETCD_NAME (e.g. test), set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
-
#ETCD_INITIAL_CLUSTER="default=http://localhost:2380"
-
#ETCD_INITIAL_CLUSTER_STATE="new"
-
#ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
-
ETCD_ADVERTISE_CLIENT_URLS="http://etcd:2379,http://etcd:4001"
-
#ETCD_DISCOVERY=""
-
#ETCD_DISCOVERY_SRV=""
-
#ETCD_DISCOVERY_FALLBACK="proxy"
-
#ETCD_DISCOVERY_PROXY=""
启动并验证状态
-
[root@localhost ~]# systemctl start etcd
-
[root@localhost ~]# etcdctl set testdir/testkey0 0
-
0
-
[root@localhost ~]# etcdctl get testdir/testkey0
-
0
-
[root@localhost ~]# etcdctl -C http://etcd:4001 cluster-health
-
member 8e9e05c52164694d is healthy: got healthy result from http://0.0.0.0:2379
-
cluster is healthy
-
[root@localhost ~]# etcdctl -C http://etcd:2379 cluster-health
-
member 8e9e05c52164694d is healthy: got healthy result from http://0.0.0.0:2379
-
cluster is healthy
3、部署master
3.1 安装Docker
[root@k8s-master ~]# yum install docker
配置Docker配置文件,使其允许从registry中拉取镜像。
-
[root@k8s-master ~]# vim /etc/sysconfig/docker
-
# /etc/sysconfig/docker
-
# Modify these options if you want to change the way the docker daemon runs
-
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'
-
if [ -z "${DOCKER_CERT_PATH}" ]; then
-
DOCKER_CERT_PATH=/etc/docker
-
fi
-
OPTIONS='--insecure-registry registry:5000'
设置开机自启动并开启服务
-
[root@k8s-master ~]# chkconfig docker on
-
[root@k8s-master ~]# service docker start
3.2 安装kubernets
配置kubernetes安装的镜像源:
-
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
-
[kubernetes]
-
name=Kubernetes
-
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
-
enabled=1
-
gpgcheck=1
-
repo_gpgcheck=1
-
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
-
EOF
-
setenforce 0
[root@k8s-master ~]# yum install kubernetes
3.3 配置并启动kubernetes
在kubernetes master上需要运行以下组件:
Kubernets API Server
Kubernets Controller Manager
Kubernets Scheduler
相应的要更改以下几个配置中带颜色部分信息:
3.3.1 /etc/kubernetes/apiserver
-
[root@k8s-master ~]# vim /etc/kubernetes/apiserver
-
###
-
# kubernetes system config
-
#
-
# The following values are used to configure the kube-apiserver
-
#
-
# The address on the local server to listen to.
-
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
-
# The port on the local server to listen on.
-
KUBE_API_PORT="--port=8080"
-
# Port minions listen on
-
# KUBELET_PORT="--kubelet-port=10250"
-
# Comma separated list of nodes in the etcd cluster
-
KUBE_ETCD_SERVERS="--etcd-servers=http://etcd:2379"
-
# Address range to use for services
-
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
-
# default admission control policies
-
#KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"
-
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota"
-
# Add your own!
-
KUBE_API_ARGS=""
3.3.2 /etc/kubernetes/config
-
[root@k8s-master ~]# vim /etc/kubernetes/config
-
###
-
# kubernetes system config
-
#
-
# The following values are used to configure various aspects of all
-
# kubernetes services, including
-
#
-
# kube-apiserver.service
-
# kube-controller-manager.service
-
# kube-scheduler.service
-
# kubelet.service
-
# kube-proxy.service
-
# logging to stderr means we get it in the systemd journal
-
KUBE_LOGTOSTDERR="--logtostderr=true"
-
# journal message level, 0 is debug
-
KUBE_LOG_LEVEL="--v=0"
-
# Should this cluster be allowed to run privileged docker containers
-
KUBE_ALLOW_PRIV="--allow-privileged=false"
-
# How the controller-manager, scheduler, and proxy find the apiserver
-
KUBE_MASTER="--master=http://k8s-master:8080"
启动服务并设置开机自启动
-
[root@k8s-master ~]# systemctl enable kube-apiserver.service
-
[root@k8s-master ~]# systemctl start kube-apiserver.service
-
[root@k8s-master ~]# systemctl enable kube-controller-manager.service
-
[root@k8s-master ~]# systemctl start kube-controller-manager.service
-
[root@k8s-master ~]# systemctl enable kube-scheduler.service
-
[root@k8s-master ~]# systemctl start kube-scheduler.service
4、部署node
4.1 安装docker
参见3.1
4.2 安装kubernets
参见3.2
4.3 配置并启动kubernetes
在kubernetes node上需要运行以下组件:
Kubelet
Kubernets Proxy
相应的要更改以下几个配置文中带颜色部分信息:
4.3.1 /etc/kubernetes/config
-
[root@K8s-node-1 ~]# vim /etc/kubernetes/config
-
###
-
# kubernetes system config
-
#
-
# The following values are used to configure various aspects of all
-
# kubernetes services, including
-
#
-
# kube-apiserver.service
-
# kube-controller-manager.service
-
# kube-scheduler.service
-
# kubelet.service
-
# kube-proxy.service
-
# logging to stderr means we get it in the systemd journal
-
KUBE_LOGTOSTDERR="--logtostderr=true"
-
# journal message level, 0 is debug
-
KUBE_LOG_LEVEL="--v=0"
-
# Should this cluster be allowed to run privileged docker containers
-
KUBE_ALLOW_PRIV="--allow-privileged=false"
-
# How the controller-manager, scheduler, and proxy find the apiserver
-
KUBE_MASTER="--master=http://k8s-master:8080"
4.3.2 /etc/kubernetes/kubelet
-
[root@K8s-node-1 ~]# vim /etc/kubernetes/kubelet
-
###
-
# kubernetes kubelet (minion) config
-
# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces)
-
KUBELET_ADDRESS="--address=0.0.0.0"
-
# The port for the info server to serve on
-
# KUBELET_PORT="--port=10250"
-
# You may leave this blank to use the actual hostname
-
KUBELET_HOSTNAME="--hostname-override=k8s-node-1"
-
# location of the api-server
-
KUBELET_API_SERVER="--api-servers=http://k8s-master:8080"
-
# pod infrastructure container
-
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest"
-
# Add your own!
-
KUBELET_ARGS=""
启动服务并设置开机自启动
-
[root@k8s-master ~]# systemctl enable kubelet.service
-
[root@k8s-master ~]# systemctl start kubelet.service
-
[root@k8s-master ~]# systemctl enable kube-proxy.service
-
[root@k8s-master ~]# systemctl start kube-proxy.service
4.4 查看状态
在master上查看集群中节点及节点状态
-
[root@k8s-master ~]# kubectl -s http://k8s-master:8080 get node
-
NAME STATUS AGE
-
k8s-node-1 Ready 3m
-
k8s-node-2 Ready 16s
-
[root@k8s-master ~]# kubectl get nodes
-
NAME STATUS AGE
-
k8s-node-1 Ready 3m
-
k8s-node-2 Ready 43s
至此,已经搭建了一个kubernetes集群,但目前该集群还不能很好的工作,请继续后续的步骤。
5、创建覆盖网络——Flannel
5.1 安装Flannel
在master、node上均执行如下命令,进行安装
[root@k8s-master ~]# yum install flannel
版本为0.0.5
5.2 配置Flannel
master、node上均编辑/etc/sysconfig/flanneld,修改红色部分
-
[root@k8s-master ~]# vi /etc/sysconfig/flanneld
-
# Flanneld configuration options
-
# etcd url location. Point this to the server where etcd runs
-
FLANNEL_ETCD_ENDPOINTS="http://etcd:2379"
-
# etcd config key. This is the configuration key that flannel queries
-
# For address range assignment
-
FLANNEL_ETCD_PREFIX="/atomic.io/network"
-
# Any additional options that you want to pass
-
#FLANNEL_OPTIONS=""
5.3 配置etcd中关于flannel的key
Flannel使用Etcd进行配置,来保证多个Flannel实例之间的配置一致性,所以需要在etcd上进行如下配置:(‘/atomic.io/network/config’这个key与上文/etc/sysconfig/flannel中的配置项FLANNEL_ETCD_PREFIX是相对应的,错误的话启动就会出错)
-
[root@k8s-master ~]# etcdctl mk /atomic.io/network/config '{ "Network": "10.0.0.0/16" }'
-
{ "Network": "10.0.0.0/16" }
5.4 启动
启动Flannel之后,需要依次重启docker、kubernete。
在master执行:
-
systemctl enable flanneld.service
-
systemctl start flanneld.service
-
service docker restart
-
systemctl restart kube-apiserver.service
-
systemctl restart kube-controller-manager.service
-
systemctl restart kube-scheduler.service
在node上执行:
-
systemctl enable flanneld.service
-
systemctl start flanneld.service
-
service docker restart
-
systemctl restart kubelet.service
-
systemctl restart kube-proxy.service
6.安装kube-dns
6.1创建kubedns-rc.yaml和kubedns-svc.yaml
主要是在master上安装
vi kubedns-rc.yaml
-
apiVersion: extensions/v1beta1
-
kind: Deployment
-
metadata:
-
name: kube-dns
-
namespace: kube-system
-
labels:
-
k8s-app: kube-dns
-
kubernetes.io/cluster-service: "true"
-
spec:
-
#指定副本数
-
replicas: 1
-
# replicas: not specified here:
-
# 1. In order to make Addon Manager do not reconcile this replicas parameter.
-
# 2. Default is 1.
-
# 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
-
strategy:
-
rollingUpdate:
-
maxSurge: 10%
-
maxUnavailable: 0
-
selector:
-
matchLabels:
-
k8s-app: kube-dns
-
template:
-
metadata:
-
labels:
-
k8s-app: kube-dns
-
annotations:
-
scheduler.alpha.kubernetes.io/critical-pod: ''
-
scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
-
spec:
-
containers:
-
- name: kubedns
-
#修改image地址,默认是google的仓库地址,如果不担心被墙,可以直接使用,我这里使用的私有仓库地址,如果要使用国内其他仓库地址,推荐使用阿里云镜像库
-
image: myhub.fdccloud.com/library/kubedns-amd64:1.9
-
resources:
-
# TODO: Set memory limits when we've profiled the container for large
-
# clusters, then set request = limit to keep this container in
-
# guaranteed class. Currently, this container falls into the
-
# "burstable" category so the kubelet doesn't backoff from restarting it.
-
limits:
-
memory: 170Mi
-
requests:
-
cpu: 100m
-
memory: 70Mi
-
livenessProbe:
-
httpGet:
-
path: /healthz-kubedns
-
port: 8080
-
scheme: HTTP
-
initialDelaySeconds: 60
-
timeoutSeconds: 5
-
successThreshold: 1
-
failureThreshold: 5
-
readinessProbe:
-
httpGet:
-
path: /readiness
-
port: 8081
-
scheme: HTTP
-
# we poll on pod startup for the Kubernetes master service and
-
# only setup the /readiness HTTP server once that's available.
-
initialDelaySeconds: 3
-
timeoutSeconds: 5
-
args:
-
# --domain指定一级域名,可自定义
-
- --domain=cluster.local.
-
- --dns-port=10053
-
- --config-map=kube-dns
-
#增加--kube-master-url,指向kube master的地址
-
- --kube-master-url=http://10.0.251.148:8080
-
# This should be set to v=2 only after the new image (cut from 1.5) has
-
# been released, otherwise we will flood the logs.
-
- --v=0
-
#__PILLAR__FEDERATIONS__DOMAIN__MAP__
-
env:
-
- name: PROMETHEUS_PORT
-
value: "10055"
-
ports:
-
- containerPort: 10053
-
name: dns-local
-
protocol: UDP
-
- containerPort: 10053
-
name: dns-tcp-local
-
protocol: TCP
-
- containerPort: 10055
-
name: metrics
-
protocol: TCP
-
- name: dnsmasq
-
image: myhub.fdccloud.com/library/kube-dnsmasq-amd64:1.4
-
livenessProbe:
-
httpGet:
-
path: /healthz-dnsmasq
-
port: 8080
-
scheme: HTTP
-
initialDelaySeconds: 60
-
timeoutSeconds: 5
-
successThreshold: 1
-
failureThreshold: 5
-
args:
-
- --cache-size=1000
-
- --no-resolv
-
- --server=127.0.0.1#10053
-
#- --log-facility=- #注释掉该行
-
ports:
-
- containerPort: 53
-
name: dns
-
protocol: UDP
-
- containerPort: 53
-
name: dns-tcp
-
protocol: TCP
-
# see: https://github.com/kubernetes/kubernetes/issues/29055 for details
-
resources:
-
requests:
-
cpu: 150m
-
memory: 10Mi
-
- name: dnsmasq-metrics
-
image: myhub.fdccloud.com/library/dnsmasq-metrics-amd64:1.0
-
livenessProbe:
-
httpGet:
-
path: /metrics
-
port: 10054
-
scheme: HTTP
-
initialDelaySeconds: 60
-
timeoutSeconds: 5
-
successThreshold: 1
-
failureThreshold: 5
-
args:
-
- --v=2
-
- --logtostderr
-
ports:
-
- containerPort: 10054
-
name: metrics
-
protocol: TCP
-
resources:
-
requests:
-
memory: 10Mi
-
- name: healthz
-
image: myhub.fdccloud.com/library/exechealthz-amd64:1.2
-
resources:
-
limits:
-
memory: 50Mi
-
requests:
-
cpu: 10m
-
# Note that this container shouldn't really need 50Mi of memory. The
-
# limits are set higher than expected pending investigation on #29688.
-
# The extra memory was stolen from the kubedns container to keep the
-
# net memory requested by the pod constant.
-
memory: 50Mi
-
args:
-
- --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1 >/dev/null
-
- --url=/healthz-dnsmasq
-
- --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1:10053 >/dev/null
-
- --url=/healthz-kubedns
-
- --port=8080
-
- --quiet
-
ports:
-
- containerPort: 8080
-
protocol: TCP
-
dnsPolicy: Default # Don't use cluster DNS.
vi kubedns-svc.yaml内容如下:
-
apiVersion: v1
-
kind: Service
-
metadata:
-
name: kube-dns
-
namespace: kube-system
-
labels:
-
k8s-app: kube-dns
-
kubernetes.io/cluster-service: "true"
-
kubernetes.io/name: "KubeDNS"
-
spec:
-
selector:
-
k8s-app: kube-dns
-
#指定clusterIP,后面各pod的dns地址都会指向该地址
-
clusterIP: 10.254.0.100
-
ports:
-
- name: dns
-
port: 53
-
protocol: UDP
-
- name: dns-tcp
-
port: 53
-
protocol: TCP
6.2启动dns
-
kubectl create -f skydns-rc.yaml
-
kubectl create -f skydns-svc.yaml
修改各node节点上的/etc/kubernetes/kubelet配置文件,增加如下行:
KUBELET_ARGS="--cluster_dns=10.254.0.100 --cluster_domain=cluster.local"
重启各节点:
systemctl restart kubelet
7.本部署dashboard服务
7.1使用http方式访问api server的部署
cat dashboard-controller.yaml
-
apiVersion: extensions/v1beta1
-
kind: Deployment
-
metadata:
-
labels:
-
k8s-app: kubernetes-dashboard
-
kubernetes.io/cluster-service: "true"
-
name: kubernetes-dashboard
-
namespace: kube-system
-
selfLink: /apis/extensions/v1beta1/namespaces/kube-system/deployments/kubernetes-dashboard
-
spec:
-
replicas: 1
-
selector:
-
matchLabels:
-
k8s-app: kubernetes-dashboard
-
strategy:
-
rollingUpdate:
-
maxSurge: 1
-
maxUnavailable: 1
-
type: RollingUpdate
-
template:
-
metadata:
-
labels:
-
k8s-app: kubernetes-dashboard
-
spec:
-
containers:
-
- args:
-
- --apiserver-host=http://10.0.251.148:8080
-
image: docker.io/googlecontainer/kubernetes-dashboard-amd64:v1.6.1
-
imagePullPolicy: IfNotPresent
-
livenessProbe:
-
failureThreshold: 3
-
httpGet:
-
path: /
-
port: 9090
-
scheme: HTTP
-
initialDelaySeconds: 30
-
periodSeconds: 10
-
successThreshold: 1
-
timeoutSeconds: 30
-
name: kubernetes-dashboard
-
ports:
-
- containerPort: 9090
-
protocol: TCP
-
resources:
-
limits:
-
cpu: 100m
-
memory: 50Mi
-
requests:
-
cpu: 100m
-
memory: 50Mi
-
dnsPolicy: ClusterFirst
-
restartPolicy: Always
7.2使用https访问api server部署
cat dashboard-controller.yaml
-
apiVersion: extensions/v1beta1
-
kind: Deployment
-
metadata:
-
name: kubernetes-dashboard
-
namespace: kube-system
-
labels:
-
k8s-app: kubernetes-dashboard
-
kubernetes.io/cluster-service: "true"
-
spec:
-
selector:
-
matchLabels:
-
k8s-app: kubernetes-dashboard
-
template:
-
metadata:
-
labels:
-
k8s-app: kubernetes-dashboard
-
annotations:
-
scheduler.alpha.kubernetes.io/critical-pod: ''
-
scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
-
spec:
-
containers:
-
- name: kubernetes-dashboard
-
image: docker.io/googlecontainer/kubernetes-dashboard-amd64:v1.6.1
-
imagePullPolicy: IfNotPresent
-
resources:
-
limits:
-
cpu: 100m
-
memory: 512Mi
-
requests:
-
cpu: 100m
-
memory: 128Mi
-
livenessProbe:
-
httpGet:
-
path: /
-
port: 9090
-
initialDelaySeconds: 30
-
timeoutSeconds: 30
-
ports:
-
- containerPort: 9090
-
args:
-
- --apiserver-host=https://10.0.251.148:6443
-
- --kubeconfig=/etc/kubernetes/kubelet-config
-
volumeMounts:
-
- name: config
-
mountPath: /etc/kubernetes/kubelet-config
-
readOnly: True
-
- name: certs
-
mountPath: /etc/ssl/kube
-
readOnly: True
-
volumes:
-
- name: certs
-
hostPath:
-
path: /etc/ssl/kube
-
- name: config
-
hostPath:
-
path: /etc/kubernetes/kubelet-config
7.3service
cat dashboard-service.yaml
-
apiVersion: v1
-
kind: Service
-
metadata:
-
name: kubernetes-dashboard
-
namespace: kube-system
-
labels:
-
k8s-app: kubernetes-dashboard
-
kubernetes.io/cluster-service: "true"
-
spec:
-
selector:
-
k8s-app: kubernetes-dashboard
-
ports:
-
- port: 80
-
targetPort: 9090
7.4启动dashboard
kubectl create -f dashboard-controller.yaml
kubectl create -f dashboard-service.yaml
7.5访问地址
http:http://10.0.251.148:8080/ui
https:https://10.0.251.148:6443/ui
如果API Server配置文件中没有配置登陆账号和密码(--basic-auth-file=/etc/kubernetes/useraccount.csv),登陆失败; 如果配置了,账号和密码为/etc/kubernetes/useraccount.csv任意中的一个
微信公众号ID(feiutech)
微信公众号ID:feiutech