请注意，本文编写于 1517 天前，最后修改于 1421 天前，其中某些信息可能已经过时。
环境准备
操作系统：centos 7 1908 mini
设置主机名
hostnamectl set-hostname k8s-sh-21.vm.90.vc
hostnamectl set-hostname k8s-sh-22.vm.90.vc
hostnamectl set-hostname k8s-sh-23.vm.90.vc配置hosts
vim /etc/hosts
10.0.2.21 k8s-sh-21.vm.90.vc
10.0.2.22 k8s-sh-22.vm.90.vc
10.0.2.23 k8s-sh-23.vm.90.vc防火墙与selinux
主机防火墙需要开放相应端口，具体可参考kubernetes官方文档 Check required ports 一节。
这里为了方便，直接关闭防火墙
systemctl stop firewalld
systemctl disable firewalld目前为止，kubernetes还不支持selinux，所以必须将selinux关闭。
将 SELinux 设置为 permissive 模式（相当于将其禁用）
setenforce 0
sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config关闭swap分区
自kubernetes1.8版本开始，要求必须关闭swap，否则kubelet无法启动
修改/etc/fstab配置文件，注释掉swap行。
执行以下操作，关闭swap。
swapoff -a
sysctl -w vm.swappiness=0
echo "vm.swappiness=0">> /etc/sysctl.conf
sysctl -p调整系统参数
确保系统加载了 br_netfilter 模块。这可以通过运行 lsmod | grep br_netfilter 来检测。如没有加载则运行如下命令加载
modprobe br_netfilter在 RHEL/CentOS 7 中：由于 iptables 可能被绕过而导致流量无法正确路由的问题。因此需要确保 在 sysctl 配置中的 net.bridge.bridge-nf-call-iptables 被设置为 1,在sysctl中添加如下配置
cat <<EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF运行 sysctl --system 生效
安装docker
从 v1.6.0 版本起，Kubernetes 开始默认允许使用 CRI（容器运行时接口）。
从 v1.14.0 版本起，kubeadm 将通过观察已知的 UNIX 域套接字来自动检测 Linux 节点上的容器运行时。如果同时检测到 docker 和 containerd，则优先选择 docker。
kubernetes 1.17官方推荐安装 docker 19.03.4 版本，但 1.13.1、17.03、17.06、17.09、18.06 和 18.09 版本也是可以的。
安装docker依赖及yum配置工具
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo安装docker
yum -y install docker-ce-19.03.4-3.el7修改docker cgroup driver为systemd，以及一些docker的其他设置
cat > /etc/docker/daemon.json <<EOF
{
"graph": "/data/docker",
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
]
}
EOF重启docker并运行 docker info |grep cgroup 验证修改
kubernetes 安装
配置kubernetes的yum源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF安装kubeadm、kubelet、kubectl
yum -y install kubeadm kubelet kubectlkubernetes初始化
打印集群默认初始化配置
kubeadm config print init-defaults > k8s-init.yaml编辑得到的k8s-init.yaml配置文件，修改如下项：
advertiseAddress，将其修改为master的IP地址。imageRepository，因为k8s.gcr.io在国内不可用，因此，将的值修改为azure中国的镜像k8s.azure.cn/google_containers，否则，kubernetes需要的一些docker镜像拉不下来，kubernetes初始化会一直挂起。- etcd相关设置，这里只修改一下etcd本地的存储目录。
serviceSubnet子网掩码的范围，这里保持默认。- 新增配置项
podSubnet，在network配置中增加pod的子网范围。
修改后的初始化配置如下
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 10.14.230.21
bindPort: 6443
nodeRegistration:
criSocket: /var/run/dockershim.sock
name: k8s-sh-21.vm.90.vc
taints:
- effect: NoSchedule
key: node-role.kubernetes.io/master
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
type: CoreDNS
etcd:
local:
dataDir: /data/k8s/etcd
imageRepository: k8s.azk8s.cn/google_containers
kind: ClusterConfiguration
kubernetesVersion: v1.17.0
networking:
dnsDomain: k8s.90.vc
serviceSubnet: 10.96.0.0/12
podSubnet: 10.244.0.0/16
scheduler: {}执行kubeadm init --config k8s-init.yaml 进行初始化
返回结果如下
W0229 21:02:26.431332 41307 validation.go:28] Cannot validate kube-proxy config - no validator is available
W0229 21:02:26.431451 41307 validation.go:28] Cannot validate kubelet config - no validator is available
[init] Using Kubernetes version: v1.17.0
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [k8s-sh-21.vm.90.vc kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.k8s.90.vc] and IPs [10.96.0.1 10.14.230.21]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [k8s-sh-21.vm.90.vc localhost] and IPs [10.14.230.21 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [k8s-sh-21.vm.90.vc localhost] and IPs [10.14.230.21 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
W0229 21:02:30.970566 41307 manifests.go:214] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[control-plane] Creating static Pod manifest for "kube-scheduler"
W0229 21:02:30.971420 41307 manifests.go:214] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 33.501703 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.17" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node k8s-sh-21.vm.90.vc as control-plane by adding the label "node-role.kubernetes.io/master=''"
[mark-control-plane] Marking the node k8s-sh-21.vm.90.vc as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: abcdef.0123456789abcdef
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.0.2.21:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:8248b6235e0ecf9cb8579dfefce45b6c1d2b3de928cebdf5582621e022f28963
如果执行结果返回Your Kubernetes control-plane has initialized successfully!的话，则说明kubernetes初始化成功。
接下来，依据提示，分别进行添加kubectl的配置文件、网络插件、添加其他节点等操作。
管理配置文件
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config部署flannel网络插件
执行如下操作
curl -O https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl apply -f kube-flannel.yml返回如下信息
podsecuritypolicy.policy/psp.flannel.unprivileged created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds-amd64 created
daemonset.apps/kube-flannel-ds-arm64 created
daemonset.apps/kube-flannel-ds-arm created
daemonset.apps/kube-flannel-ds-ppc64le created
daemonset.apps/kube-flannel-ds-s390x created这里可能会遇到quay.io无法访问的情况，可以修改kube-flannel文件中的镜像地址，采用国内镜像源获取相关的docker镜像即可。
在其余节点上执行如下操作，加入kubernetes集群
kubeadm join 10.0.2.21:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:8248b6235e0ecf9cb8579dfefce45b6c1d2b3de928cebdf5582621e022f28963检查kubernetes集群运行状态
[root@k8s-sh-21 ~]# kubectl get cs
NAME STATUS MESSAGE ERROR
scheduler Healthy ok
controller-manager Healthy ok
etcd-0 Healthy {"health":"true"}
[root@k8s-sh-21 ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-sh-21.vm.90.vc Ready master 101m v1.17.3
k8s-sh-22.vm.90.vc Ready <none> 99m v1.17.3
k8s-sh-23.vm.90.vc Ready <none> 99m v1.17.3
[root@k8s-sh-21 ~]# kubectl get pods -A -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kube-system coredns-6cd559f5d5-8vkm8 1/1 Running 0 101m 10.244.0.4 k8s-sh-21.vm.90.vc <none> <none>
kube-system coredns-6cd559f5d5-clhrt 1/1 Running 0 101m 10.244.0.3 k8s-sh-21.vm.90.vc <none> <none>
kube-system etcd-k8s-sh-21.vm.90.vc 1/1 Running 0 101m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>
kube-system kube-apiserver-k8s-sh-21.vm.90.vc 1/1 Running 0 101m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>
kube-system kube-controller-manager-k8s-sh-21.vm.90.vc 1/1 Running 0 101m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>
kube-system kube-flannel-ds-amd64-6mvlf 1/1 Running 0 100m 10.14.230.23 k8s-sh-23.vm.90.vc <none> <none>
kube-system kube-flannel-ds-amd64-dxpgk 1/1 Running 0 100m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>
kube-system kube-flannel-ds-amd64-mjmzz 1/1 Running 0 100m 10.14.230.22 k8s-sh-22.vm.90.vc <none> <none>
kube-system kube-proxy-2xtwb 1/1 Running 0 100m 10.14.230.22 k8s-sh-22.vm.90.vc <none> <none>
kube-system kube-proxy-fl9bs 1/1 Running 0 101m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>
kube-system kube-proxy-thhn8 1/1 Running 0 100m 10.14.230.23 k8s-sh-23.vm.90.vc <none> <none>
kube-system kube-scheduler-k8s-sh-21.vm.90.vc 1/1 Running 0 101m 10.14.230.21 k8s-sh-21.vm.90.vc <none> <none>确保以上node、pod等均为ready和running即可。
将kube-proxy改为ipvs模式
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack_ipv4
编辑configmap中kube-proxy的配置文件。将mode字段修改为ipvs
kubectl edit cm kube-proxy -n kube-system修改后重启kube-proxy
kubectl get pod -n kube-system | grep kube-proxy | awk '{system("kubectl delete pod "$1" -n kube-system")}'检查修改结果，kube-proxy日志中输出ipvs即表示已经启用ipvs模式，反之则是iptables
kubectl get pod -n kube-system | grep kube-proxy |awk '{system("kubectl logs "$1" -n kube-system")}'|grep Proxier