kubeadm 安装最新 k8s 集群
最新版k8s环境搭建1.29、系统–Rocky9.3
master | 192.168.174.136 |
---|---|
node1 | 192.168.174.137 |
node2 | 192.168.174.138 |
一 、环境初始化
所有节点都需要操作
# 网卡配置
# cat /etc/NetworkManager/system-connections/ens160.nmconnection
[ipv4]
method=manual
address1=192.168.174.136/24,192.168.174.1
dns=114.114.114.114;8.8.8.8
# cat /etc/NetworkManager/system-connections/ens192.nmco**nnection
[connection]
autoconnect=false
# 调用 nmcli 重启设备和连接配置
nmcli d d ens33 # 断开设备
nmcli d r ens33 # 重启设备
nmcli c r ens33 # 重启或重新加载连接配置
# Rocky 系统软件源更换
sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
-i.bak \
/etc/yum.repos.d/[Rr]ocky*.repo
dnf makecache
# 防火墙修改 firewalld 为 iptables
systemctl stop firewalld
systemctl disable firewalld
yum -y install iptables-services
systemctl start iptables
systemctl enable iptables
# 禁用 Selinux
setenforce 0
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
grubby --update-kernel ALL --args selinux=0
# 查看是否禁用,grubby --info DEFAULT
# 回滚内核层禁用操作,grubby --update-kernel ALL --remove-args selinux
# 关闭swap分区
swapoff -a
sed -i 's:/dev/mapper/rl-swap:#/dev/mapper/rl-swap:g' /etc/fstab
# 安装依赖文件
yum install -y conntrack ipvsadm ipset jq iptables sysstat libseccomp wget vim net-tools
yum -y install net-tools vim lrzsz wget yum-utils telnet unzip tar iptables-services
# 设置时区
# 设置系统时区为 中国/上海
timedatectl set-timezone Asia/Shanghai
# 将当前的 UTC 时间写入硬件时钟
timedatectl set-local-rtc 0
# 重启依赖于系统时间的服务
systemctl restart rsyslog
systemctl restart crond
# 修改主机名
echo k8s-master > /etc/hostname
hostname k8s-master
vim /etc/hosts
192.168.174.136 k8s-master
192.168.174.137 k8s-node1
192.168.174.138 k8s-node2
二、安装 Docker 环境
# 加载 bridge
yum install -y epel-release
yum install -y bridge-utils
modprobe br_netfilter
echo 'br_netfilter' >> /etc/modules-load.d/bridge.conf
echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.conf
echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.conf
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
sysctl -p
# 添加 docker-ce yum 源
# 中科大(ustc)
dnf config-manager --add-repo https://mirrors.ustc.edu.cn/docker-ce/linux/centos/docker-ce.repo
cd /etc/yum.repos.d
# 切换中科大源
sed -e 's|download.docker.com|mirrors.ustc.edu.cn/docker-ce|g' docker-ce.repo > docker-ustc.repo
mv docker-ce.repo docker-ce.repo.bak
# 安装 docker-ce
yum -y install docker-ce
# 配置 daemon.
cat > /etc/docker/daemon.json <<EOF
{
"data-root": "/data/docker",
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m",
"max-file": "100"
},
"insecure-registries": ["harbor.xinxainghf.com"],
"registry-mirrors": [
"https://docker.mirrors.ustc.edu.cn",
"https://docker.cloudmessage.top",
"https://kfp63jaj.mirror.aliyuncs.com",
"https://j47dskil.mirror.aliyuncs.com"
]
}
EOF
mkdir -p /etc/systemd/system/docker.service.d
# 重启docker服务
systemctl daemon-reload && systemctl restart docker && systemctl enable docker
docker info
reboot
安装 cri-docker
wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.9/cri-dockerd-0.3.9.amd64.tgz
tar -xf cri-dockerd-0.3.9.amd64.tgz
cp cri-dockerd/cri-dockerd /usr/bin/
chmod +x /usr/bin/cri-dockerd
# 配置 cri-docker 服务
cat <<"EOF"> /usr/lib/systemd/system/cri-docker.service
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=cri-docker.socket
[Service]
Type=notify
ExecStart=/usr/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.9
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
StartLimitBurst=3
StartLimitInterval=60s
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
Delegate=yes
KillMode=process
[Install]
WantedBy=multi-user.target
EOF
cat <<"EOF"> /usr/lib/systemd/system/cri-docker.socket
[Unit]
Description=CRI Docker Socket for the API
PartOf=cri-docker.service
[Socket]
ListenStream=%t/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker
[Install]
WantedBy=sockets.target
EOF
# 分发到其他两台
scp /usr/lib/systemd/system/cri-docker.service /usr/lib/systemd/system/cri-docker.socket root@k8s-node1:/usr/lib/systemd/system/
scp /usr/lib/systemd/system/cri-docker.service /usr/lib/systemd/system/cri-docker.socket root@k8s-node2:/usr/lib/systemd/system/
#启动cri-docker并设置开机自动启动
systemctl daemon-reload
systemctl enable cri-docker --now
#查看状态
systemctl is-active cri-docker
三、安装kubeadm
# 配置k8s阿里云源
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key
# exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
EOF
yum clean all
yum makecache
# 安装
yum -y install kubelet-1.29.0 kubeadm-1.29.0 kubectl-1.29.0
systemctl enable kubelet.service
初始化集群
在主节点执行
kubeadm init \
--apiserver-advertise-address=192.168.174.136 \
--image-repository=registry.aliyuncs.com/google_containers \
--kubernetes-version=v1.29.2 \
--service-cidr=10.10.0.0/12 \
--pod-network-cidr=10.244.0.0/16 \
--ignore-preflight-errors=all \
--cri-socket=unix:///var/run/cri-dockerd.sock
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
执行结果如下:
从节点执行(加入集群)
kubeadm join 192.168.174.136:6443 --token mhfuk9.65rfx7qjfqcfezdl --discovery-token-ca-cert-hash sha256:a6548b6084cc8c6efc2ac116f13be3c89879366e620a627bd25eb99141b554a4 --cri-socket=unix:///var/run/cri-dockerd.sock
kubeadm join 192.168.174.136:6443 --token mhfuk9.65rfx7qjfqcfezdl --discovery-token-ca-cert-hash sha256:a6548b6084cc8c6efc2ac116f13be3c89879366e620a627bd25eb99141b554a4 --cri-socket=unix:///run/cri-dockerd.sock
执行结果如下:
如果不知道 token,请使用如下方法
获取token
分别在 k8s-node1 和 k8s-node2 执行
# 下方命令可以在 k8s master 控制台初始化成功后复制 join 命令
kubeadm join 192.168.113.120:6443 --token w34ha2.66if2c8nwmeat9o7 \
--discovery-token-ca-cert-hash \
sha256:20e2227554f8883811c01edd850f0cf2f396589d32b57b9984de3353a7389477
# 如果初始化的 token 不小心清空了,可以通过如下命令获取或者重新申请
# 如果 token 已经过期,就重新申请
kubeadm token create
# token 没有过期可以通过如下命令获取
kubeadm token list
# 获取 --discovery-token-ca-cert-hash 值,得到值后需要在前面拼接上 sha256:
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | \
openssl dgst -sha256 -hex | sed 's/^.* //'
部署网络插件
# 官网地址(calico插件)
https://docs.tigera.io/calico/latest/getting-started/kubernetes/self-managed-onprem/onpremises#install-calico-with-kubernetes-api-datastore-more-than-50-nodes
curl -o calicoctl -O -L https://github.com/projectcalico/calico/releases/download/v3.26.0/calicoctl-linux-amd64
chmod 755 calicoctl
ln -s /root/k8s/calico/calicoctl /usr/sbin/
# 所有节点都需要进行以下操作
wget https://github.com/projectcalico/calico/releases/download/v3.26.0/release-v3.26.0.tgz
tar -xf release-v3.26.0.tgz
cd release-v3.26.0/images
docker load -i calico-cni.tar
docker load -i calico-node.tar
docker load -i calico-typha.tar
docker load -i calico-kube-controllers.tar
# 主节点操作
curl https://raw.githubusercontent.com/projectcalico/calico/v3.26.3/manifests/calico-typha.yaml -o calico.yaml
vim calico.yaml
# 修改一:
# 取消掉注释
- name: CALICO_IPV4POOL_CIDR
value: "10.244.0.0/16"
# value的值改为和 初始化主节点 pod-network-cidr的值相同
# 修改二:
# 修改为 BGP 模式
# Enable IPIP
- name: CALICO_IPV4POOL_IPIP
value: "Off" # 将Always改成Off
kubectl apply -f calico.yaml (多等一会儿)
# 如果从节点也需要 kubectl get nodes 做以下操作
# 先去到 master节点
scp /etc/kubernetes/admin.conf node1:/etc/kubernetes/
scp /etc/kubernetes/admin.conf node2:/etc/kubernetes/
# 回到node节点
echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile
source ~/.bash_profile
kubectl get nodes
# 完成
# 报错
kubectl get pod -A
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system coredns-857d9ff4c9-dlbzn 0/1 ContainerCreating 0 23h
kube-system coredns-857d9ff4c9-dvw4v 0/1 ContainerCreating 0 23h
kubectl describe pod coredns-857d9ff4c9-dlbzn -n kube-system
Normal SandboxChanged 2m4s (x6510 over 23h) kubelet Pod sandbox changed, it will be killed and re-created.
处理:说明 网络附加组件没装
kubectl apply -f calico.yaml
# 如果都是pending,报错:
Warning Unhealthy 7m1s kubelet Liveness probe failed: calico/node is not ready: bird/confd is not live: Service confd is not running. Output << down: /etc/service/enabled/confd: 1s, normally up, want up >>
W1129 08:54:05.053187 1778 feature_gate.go:241] Setting GA feature gate ServiceInternalTrafficPolicy=true. It will be removed in a future release.
kubectl delete -f calico.yaml
# 清理历史配置
rm -rf /etc/cni/net.d/*
rm -rf /var/lib/calico/*
# 然后重新安装
kubectl apply -f calico.yaml
# 条件允许 重启服务器
原文地址:https://blog.csdn.net/yhl18931306541/article/details/144698649
免责声明:本站文章内容转载自网络资源,如本站内容侵犯了原著者的合法权益,可联系本站删除。更多内容请关注自学内容网(zxcms.com)!