【笔记】使用 kubeadm 安装 1 Master 2 Worker 的 Kubernetes 集群
【笔记】使用 kubeadm 安装 1 Master 2 Worker 的 Kubernetes 集群
关键词： #Kubernetes 、 #部署手册
耗时： 20 分钟
碰到的难点：代理配置，Linux内核模块和参数，sed命令修改配置, systemctl daemon-reload的作用
实验目标
使用 kubeadm 部署一个
1 Master + 2 Worker 的 Kubernetes 集群。
实验环境
| 项目 | 配置 |
|---|---|
| 操作系统 | Rocky Linux release 9.4 (Blue Onyx) |
| 内核版本 | 5.14.0-427.13.1.el9_4.x86_64 |
| CPU 架构 | x86_64 |
| Kubernetes | v1.32.2 |
| Containerd | 1.7.29 |
| 网络插件 | Calico v3.29.2 |
| 容器网络 CIDR | 10.244.0.0/16 |
| Master 数量 | 1 |
| Worker 数量 | 2 |
网络规划
| 节点 | 主机名 | IP 地址 |
|---|---|---|
| Master | master-1 | 192.168.250.153 |
| Worker1 | worker-1 | 192.168.250.152 |
| Worker2 | worker-2 | 192.168.250.175 |
安装步骤
一、环境准备 ( Master 和 Worker 都 执行 )
关闭防火墙和selinux
1.1 分别配置主机名（每个节点执行的命令不同）
- master-1
hostnamectl set-hostname master-1
- worker-1
hostnamectl set-hostname worker-1
- worker-2
hostnamectl set-hostname worker-2
1.2 配置hosts文件本地解析
cat >> /etc/hosts << EOF
192.168.250.153 master-1
192.168.250.152 worker-1
192.168.250.175 worker-2
EOF
1.3 配置时钟同步
dnf -y install chrony
cat >> /etc/chrony.conf << EOF
server ntp.aliyun.com iburst
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst
EOF
systemctl enable --now chronyd
1.4 关闭交换分区
swapoff -a
sed -i '/swap/d' /etc/fstab
free -h
1.5 修改内核参数
cat >> /etc/modules-load.d/k8s.conf <<EOF
br_netfilter
EOF
modprobe br_netfilter
cat >>/etc/sysctl.d/kubernetes.conf<<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system
1.6 安装 容器运行时 Containerd
安装 containerd
dnf install -y yum-utils
dnf config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
dnf -y install containerd.io-1.7.29
修改 containerd 配置文件
创建默认配置文件
cd /etc/containerd
mv config.toml config.toml.orig
containerd config default > /etc/containerd/config.toml
修改配置
sed -i "s#SystemdCgroup\ \=\ false#SystemdCgroup\ \=\ true#g" /etc/containerd/config.toml
grep -i SystemdCgroup /etc/containerd/config.toml
sed -i "s#registry.k8s.io#registry.aliyuncs.com/google_containers#g" /etc/containerd/config.toml
grep -i sandbox_image /etc/containerd/config.toml
注：期望的配置状态： /etc/containerd/config.toml
...
[plugins."io.containerd.grpc.v1.cri"]
...
+ sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.8"
- sandbox_image = "registry.k8s.io/pause:3.8"
...
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
...
+ SystemdCgroup = true
- SystemdCgroup = false
...
启动 containerd 服务
systemctl enable --now containerd
systemctl status containerd --no-pager
ctr version
1.7 安装 kubeadm 和 k8s 组件
cat >> /etc/yum.repos.d/kubernetes.repo << EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.32/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.32/rpm/repodata/repomd.xml.key
EOF
dnf install -y kubeadm-1.32.2 kubelet-1.32.2 kubectl-1.32.2
systemctl enable --now kubelet
二、Master节点初始化
2.1 生成 kubeadm 初始化的配置文件
cd
kubeadm config print init-defaults > kubeadm-config.yaml
sed -ri "s|(advertiseAddress:[[:space:]]*).*|\1192.168.250.153|" kubeadm-config.yaml
sed -ri "s|(name:[[:space:]]*).*|\1master-1|" kubeadm-config.yaml
sed -ri "s|(imageRepository:[[:space:]]*).*|\1registry.aliyuncs.com/google_containers|" kubeadm-config.yaml
sed -ri "s|(kubernetesVersion:[[:space:]]*).*|\11.32.2|" kubeadm-config.yaml
sed -ri '/(serviceSubnet:[[:space:]]*).*/a\ \ podSubnet: 10.244.0.0/16' kubeadm-config.yaml
期望的配置
apiVersion: kubeadm.k8s.io/v1beta4
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
+ advertiseAddress: 192.168.250.153
- advertiseAddress: 1.2.3.4
bindPort: 6443
nodeRegistration:
criSocket: unix:///var/run/containerd/containerd.sock
imagePullPolicy: IfNotPresent
imagePullSerial: true
+ name: master-1
- name: node
taints: null
timeouts:
controlPlaneComponentHealthCheck: 4m0s
discovery: 5m0s
etcdAPICall: 2m0s
kubeletHealthCheck: 4m0s
kubernetesAPICall: 1m0s
tlsBootstrap: 5m0s
upgradeManifests: 5m0s
---
apiServer: {}
apiVersion: kubeadm.k8s.io/v1beta4
caCertificateValidityPeriod: 87600h0m0s
certificateValidityPeriod: 8760h0m0s
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
encryptionAlgorithm: RSA-2048
etcd:
local:
dataDir: /var/lib/etcd
+ imageRepository: registry.aliyuncs.com/google_containers
- imageRepository: registry.k8s.io
kind: ClusterConfiguration
+ kubernetesVersion: 1.32.2
- kubernetesVersion: 1.32.0
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
+ podSubnet: 10.244.0.0/16
proxy: {}
scheduler: {}
2.2 下载集群初始化所需镜像
kubeadm config --config=kubeadm-config.yaml images list
kubeadm config --config=kubeadm-config.yaml images pull
ctr -n k8s.io image list
2.3 集群初始化
kubeadm init --config=kubeadm-config.yaml
2.4 配置 kubectl 的认证文件
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
三、Worker 节点加入集群 （在 worker 节点执行）
在 Master 节点运行如下命令，生成Worker节点加入集群命令的命令，然后在各个 Worker 节点上运行
kubeadm token create --print-join-command
注：示例命令
kubeadm join 192.168.250.153:6443 --token wg0ev4.cz{{placehold}}oyq --discovery-token-ca-cert-hash sha256:ba{{placehold}}07e
四、安装网络插件 Calico
4.1 配置代理（在所有节点配置代理）
注：接下来，为了避免安装网络插件 Calico 因网络不好需要导入离线镜像的麻烦，我在这次实验中在这里配置代理，方便拉取相关镜像
全局代理
cat >> /etc/profile.d/proxy.sh << 'EOF'
PROXY_URL=http://192.168.250.1:10090
NO_PROXY_URL=localhost,127.0.0.1,::1,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,.svc,.cluster.local,.localdomain,.example.com
export HTTP_PROXY=$PROXY_URL
export HTTPS_PROXY=$PROXY_URL
export ALL_PROXY=$PROXY_URL
export http_proxy=$PROXY_URL
export https_proxy=$PROXY_URL
export all_proxy=$PROXY_URL
export NO_PROXY=$NO_PROXY_URL
export no_proxy=$NO_PROXY_URL
EOF
. /etc/profile.d/proxy.sh
containerd代理
mkdir /usr/lib/systemd/system/containerd.service.d
cat >> /usr/lib/systemd/system/containerd.service.d/http-proxy.conf << EOF
[Service]
Environment="no_proxy=localhost,127.0.0.1,::1,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,.svc,.cluster.local,.localdomain,.example.com"
Environment="https_proxy=http://192.168.250.1:10090"
Environment="NO_PROXY=localhost,127.0.0.1,::1,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,.svc,.cluster.local,.localdomain,.example.com"
Environment="HTTPS_PROXY=http://192.168.250.1:10090"
Environment="HTTP_PROXY=http://192.168.250.1:10090"
Environment="http_proxy=http://192.168.250.1:10090"
Environment="ALL_PROXY=http://192.168.250.1:10090"
Environment="all_proxy=http://192.168.250.1:10090"
EOF
systemctl daemon-reload
systemctl restart containerd
4.2 安装网络插件 Calico （仅在一个 master 节点执行）
curl https://raw.githubusercontent.com/projectcalico/calico/v3.29.2/manifests/calico.yaml -O
kubectl create -f calico.yaml
验证
kubectl get po -n kube-system -o wide
kubectl get po -A
kubectl get no
kubectl get cs
浙公网安备 33010602011771号