第一篇 kubernetes V1.19.4 部署教程

1.安装环境

操作系统版本：
#cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
内核版本：
#uname -a
Linux master.k8s.com 3.10.0-957.27.2.el7.x86_64 #1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

主机名 IP                    地址 
master.k8s.com       192.168.25.65
node.k8s.com          192.168.25.66

2.修改master和node的hosts文件

# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.25.65 master.k8s.com
192.168.25.66 node.k8s.com

3.安装chrony实现所有服务器间的时间同步

# yum install chrony -y
# systemctl  start chronyd
# sed -i -e '/^server/s/^/#/' -e '1a server ntp.aliyun.com iburst' /etc/chrony.conf
# systemctl  restart chronyd
# timedatectl set-timezone Asia/Shanghai
# timedatectl
      Local time: Fri 2020-11-27 16:06:42 CST
  Universal time: Fri 2020-11-27 08:06:42 UTC
        RTC time: Fri 2020-11-27 08:06:42
       Time zone: Asia/Shanghai (CST, +0800)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: n/a

4.关闭master和node的防火墙和selinux

# systemctl stop firewalld && systemctl disable  firewalld
# sed -ri 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
# 主要查看SELINUX=disabled，如果SELINUX=eabled 需要修改为disabled
# setenforce 0
# getenforce
# 关掉swap
# swapoff -a
# 要永久禁掉swap分区，打开如下文件注释掉swap那一行
# vi /etc/fstab

5.配置系统内核参数和调优

配置sysctl内核参数
$ cat > /etc/sysctl.conf <<EOF
vm.max_map_count=262144
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
生效文件
$ sysctl -p 
修改Linux 资源配置文件，调高ulimit最大打开数和systemctl管理的服务文件最大打开数
$ echo "* soft nofile 655360" >> /etc/security/limits.conf
$ echo "* hard nofile 655360" >> /etc/security/limits.conf
$ echo "* soft nproc 655360"  >> /etc/security/limits.conf
$ echo "* hard nproc 655360"  >> /etc/security/limits.conf
$ echo "* soft  memlock  unlimited"  >> /etc/security/limits.conf
$ echo "* hard memlock  unlimited"  >> /etc/security/limits.conf
$ echo "DefaultLimitNOFILE=1024000"  >> /etc/systemd/system.conf 
$ echo "DefaultLimitNPROC=1024000"  >> /etc/systemd/system.conf

6.master和node上安装docker

# 安装依赖包
# yum install -y yum-utils device-mapper-persistent-data lvm2
# 添加docker软件包的yum源
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# 关闭测试版本list（只显示稳定版）
# yum-config-manager --enable docker-ce-edge
# yum-config-manager --enable docker-ce-test
# 更新yum包索引
#  yum makecache fast
# 安装docker
# 直接安装Docker CE
#  yum install docker-ce
# 若需要安装指定版本的Docker CE
# yum list docker-ce --showduplicates|sort -r      #找到需要安装的
# yum install docker-ce-18.06.0.ce -y    
#启动docker
# systemctl start docker & systemctl enable docker


#配置docker 使用阿里云加速
#vi /etc/docker/daemon.json 
{  
 "registry-mirrors": ["https://q2hy3fzi.mirror.aliyuncs.com"]
}
#systemctl daemon-reload && systemctl restart docker

7. 配置节点间ssh互信

配置ssh互信，那么节点之间就能无密访问，方便日后执行自动化部署
# ssh-keygen     # 每台机器执行这个命令， 一路回车即可
# ssh-copy-id  node      # 到master上拷贝公钥到其他节点，这里需要输入 yes和密码

8.master和node上安装k8s 工具

更换yum源为阿里源
# vi /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg


# yum安装k8s工具
# yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
# 或指定版本安装
# yum install -y kubelet-1.19.4 kubeadm-1.19.4 kubectl-1.19.4  --disableexcludes=kubernetes
# 启动k8s服务
# systemctl enable kubelet && systemctl start kubelet
# 查看版本号
# kubeadm version

配置iptable
# vi  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
vm.swappiness=0
# 保存后执行
# sysctl --system

9.master节点获取要下载的镜像列表及初始化

# kubeadm config images list
W1127 16:52:01.979405   19281 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
k8s.gcr.io/kube-apiserver:v1.19.4
k8s.gcr.io/kube-controller-manager:v1.19.4
k8s.gcr.io/kube-scheduler:v1.19.4
k8s.gcr.io/kube-proxy:v1.19.4
k8s.gcr.io/pause:3.2
k8s.gcr.io/etcd:3.4.13-0
k8s.gcr.io/coredns:1.7.0

# 制作下载镜像的脚本 可按照如下的设置
# vi docker.sh
#!/bin/bash
docker pull registry.aliyuncs.com/google_containers/kube-apiserver:v1.19.4
docker tag registry.aliyuncs.com/google_containers/kube-apiserver:v1.19.4  k8s.gcr.io/kube-apiserver:v1.19.4
docker rmi   registry.aliyuncs.com/google_containers/kube-apiserver:v1.19.4

docker pull registry.aliyuncs.com/google_containers/kube-controller-manager:v1.19.4
docker tag   registry.aliyuncs.com/google_containers/kube-controller-manager:v1.19.4    k8s.gcr.io/kube-controller-manager:v1.19.4
docker rmi  registry.aliyuncs.com/google_containers/kube-controller-manager:v1.19.4

docker pull registry.aliyuncs.com/google_containers/kube-scheduler:v1.19.4
docker tag  registry.aliyuncs.com/google_containers/kube-scheduler:v1.19.4   k8s.gcr.io/kube-scheduler:v1.19.4
docker rmi   registry.aliyuncs.com/google_containers/kube-scheduler:v1.19.4

docker pull registry.aliyuncs.com/google_containers/kube-proxy:v1.19.4
docker tag  registry.aliyuncs.com/google_containers/kube-proxy:v1.19.4   k8s.gcr.io/kube-proxy:v1.19.4
docker rmi   registry.aliyuncs.com/google_containers/kube-proxy:v1.19.4

docker pull registry.aliyuncs.com/google_containers/etcd:3.4.13-0
docker tag  registry.aliyuncs.com/google_containers/etcd:3.4.13-0      k8s.gcr.io/etcd:3.4.13-0
docker rmi   registry.aliyuncs.com/google_containers/etcd:3.4.13-0

docker pull registry.aliyuncs.com/google_containers/pause:3.2
docker tag registry.aliyuncs.com/google_containers/pause:3.2  k8s.gcr.io/pause:3.2
docker rmi registry.aliyuncs.com/google_containers/pause:3.2

docker pull coredns/coredns:1.7.0
docker tag   coredns/coredns:1.7.0      k8s.gcr.io/coredns:1.7.0
docker rmi  coredns/coredns:1.7.0



# docker images
REPOSITORY                           TAG        IMAGE ID       CREATED        SIZE
k8s.gcr.io/kube-proxy                v1.19.4    635b36f4d89f   2 weeks ago    118MB
k8s.gcr.io/kube-controller-manager   v1.19.4    4830ab618586   2 weeks ago    111MB
k8s.gcr.io/kube-apiserver            v1.19.4    b15c6247777d   2 weeks ago    119MB
k8s.gcr.io/kube-scheduler            v1.19.4    14cd22f7abe7   2 weeks ago    45.7MB
k8s.gcr.io/etcd                      3.4.13-0   0369cf4303ff   3 months ago   253MB
k8s.gcr.io/coredns                   1.7.0      bfe3a36ebd25   5 months ago   45.2MB
k8s.gcr.io/pause                     3.2        80d28bedfe5d   9 months ago   683kB


#master 初始化操作 
#kubeadm init --kubernetes-version=1.19.4 \
--apiserver-advertise-address=192.168.25.65 \
--service-cidr=10.1.0.0/16 \
--pod-network-cidr=10.244.0.0/16

执行输出；
# mkdir -p $HOME/.kube
# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
# sudo chown $(id -u):$(id -g) $HOME/.kube/config


#集群主节点安装成功，这里要记得保存这条命令，以便之后各个节点加入集群：
You can now join any number of machines by running the following on each node
as root:
kubeadm join 192.168.25.65:6443 --token ygn0n5.6yutikspk9y64rdt \
    --discovery-token-ca-cert-hash sha256:602fc447acaa422ce73a1ec1b506e219d90ace3de1c23a4f563e7151cc7def50


#配置kubetl认证信息
#echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile
#source ~/.bash_profile
或
#export KUBECONFIG=/etc/kubernetes/admin.conf
#source ~/.bash_profile


#查看一下集群pod，确认个组件都处于Running 状态
#注意由于master节点上存在污点，所以coredns 暂时还无法正常启动。
[root@master ~]# kubectl  get pod -n kube-system
NAME                                     READY   STATUS    RESTARTS   AGE
coredns-f9fd979d6-24cl7                  0/1     Pending   0          3m34s
coredns-f9fd979d6-fp8gh                  0/1     Pending   0          3m34s
etcd-master.k8s.com                      1/1     Running   0          3m44s
kube-apiserver-master.k8s.com            1/1     Running   0          3m44s
kube-controller-manager-master.k8s.com   1/1     Running   0          3m44s
kube-proxy-gxqxq                         1/1     Running   0          3m34s
kube-scheduler-master.k8s.com            1/1     Running   0          3m44s

10.给集群部署flannel 网络组件

#配置flannel网络
#mkdir -p /root/k8s/
#cd /root/k8s
#wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
查看需要下载的镜像
# cat kube-flannel.yml |grep image|uniq
image: quay.io/coreos/flannel:v0.13.1-rc1
下载镜像
# docker pull quay.io/coreos/flannel:v0.13.1-rc1 
部署插件
# kubectl apply -f  kube-flannel.yml

注意：如果 https://raw.githubusercontent.com 不能访问请使用：
 # 打开https://site.ip138.com/raw.Githubusercontent.com/ 输入raw.githubusercontent.com 查询IP地址

 # 修改hosts Ubuntu，CentOS及macOS直接在终端输入
# vi /etc/hosts
151.101.76.133 raw.githubusercontent.com

如果yml中的"Network": "10.244.0.0/16"和kubeadm init xxx --pod-network-cidr不一样，就需要修改成一样的。不然可能会使得Node间Cluster IP不通。
由于我上面的kubeadm init xxx --pod-network-cidr就是10.244.0.0/16。所以此yaml文件就不需要更改了。

11.配置 k8s集群 命令补全

#（仅master）
#yum install -y bash-completion

#source <(kubectl completion bash)
#echo "source <(kubectl completion bash)" >> ~/.bashrc
#source  ~/.bashrc

12.node加入集群

# kubeadm join 192.168.25.65:6443 --token ygn0n5.6yutikspk9y64rdt \
>     --discovery-token-ca-cert-hash sha256:602fc447acaa422ce73a1ec1b506e219d90ace3de1c23a4f563e7151cc7def50

检查下集群的状态：
 # kubectl get cs
 # kubectl get pod  --all-namespaces
 # kubectl get node

若出现如下的报错，可以参考这篇博文解决：https://llovewxm1314.blog.csdn.net/article/details/108458197

13.部署Dashboard插件

下载Dashboard插件配置文件
#node节点下载镜像
#docker pull kubernetesui/dashboard:v2.0.0
#docker pull kubernetesui/metrics-scraper:v1.0.4
#下载配置
#wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
编辑kubernetes-dashboard.yaml文件，在Dashboard Service中添加type: NodePort，暴露Dashboard服务
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
执行命令
# kubectl create -f recommended.yaml 
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
创建sa并绑定默认的cluster-admin管理员集群角色：
#kubectl create serviceaccount dashboard-admin -n  kubernetes-dashboard

#kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin
登陆kubernetes-dashboard：
#kubectl get secret -n kubernetes-dashboard
#kubectl describe secret dashboard-admin-token-bwdjj  -n kubernetes-dashboard
注意：查看kubernetes-dashboard 命令：
#kubectl --namespace=kubernetes-dashboard get service kubernetes-dashboard
解决Google浏览器不能打开kubernetes dashboard方法
执行命令
#mkdir key && cd key
生成证书
#openssl genrsa -out dashboard.key 2048
#openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=192.168.25.65'
#openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt
删除原有的证书secret
#kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
创建新的证书secret
#kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard
查看pod
#kubectl get pod -n kubernetes-dashboard
重启pod
#kubectl delete pod  kubernetes-dashboard-7b544877d5-d76kd -n kubernetes-dashboard

14.部署metrics server

下载配置文件
#wget https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.4.1/components.yaml

# cat components.yaml  | grep image
        image: k8s.gcr.io/metrics-server/metrics-server:v0.4.1
#docker pull  registry.aliyuncs.com/google_containers/metrics-server:v0.4.1
#docker tag registry.aliyuncs.com/google_containers/metrics-server:v0.4.1  k8s.gcr.io/metrics-server/metrics-server:v0.4.1
#docker rmi registry.aliyuncs.com/google_containers/metrics-server:v0.4.1  

#修改文件内容
# vi components.yaml 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: metrics-server
  namespace: kube-system
  labels:
    k8s-app: metrics-server
spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
  template:
    metadata:
      name: metrics-server
      labels:
        k8s-app: metrics-server
    spec:
      serviceAccountName: metrics-server
      volumes:
      # mount in tmp so we can safely use from-scratch images and/or read-only containers
      - name: tmp-dir
        emptyDir: {}
      hostNetwork: true  #增加
      containers:
      - name: metrics-server
        image: k8s.gcr.io/metrics-server-arm64:v0.3.6
        imagePullPolicy: IfNotPresent
        command:  #增加
          - /metrics-server #增加
          - --metric-resolution=30s #增加
          - --requestheader-allowed-names=aggregator  #增加
          - --kubelet-insecure-tls  #增加
          - --kubelet-preferred-address-types=InternalDNS,InternalIP,ExternalDNS,ExternalIP,Hostname #增加

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: system:metrics-server
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  - nodes/stats
  - namespaces
  - configmaps
  verbs:
  - get
  - list
  - watch  
  
 #kubectl create -f components.yaml

15.登录集群dashboard面板

#查看svc地址的nodeport  端口
# kubectl  get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.1.131.57   <none>        8000/TCP        5h25m
kubernetes-dashboard        NodePort    10.1.227.79   <none>        443:30591/TCP   5h25m

#获取令牌登录token
#kubectl describe secret/$(kubectl get secret -n kubernetes-dashboard |grep admin|awk '{print $1}') -n  kubernetes-dashboard
#记录：
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IktHT3cwbWpuUkZhc3BqTG5LamFtYzV3STc1SDRPaERGbWV6SG5WUW5KRkEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tamdncjYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMjU3NTRjYzQtNjNiNS00YTM0LThlYzgtNzIwNjE4MDE1MjE1Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.7nTKEYPMw0mh1C53KfanP-fadtt9OEnmVbKpfaztJmBBDlKphuT4NBkqqEyQDZ0TyOF8naB9vHF4RmdNZWEBCGQh8YrsdfMyLOMnZSMIkMAxqdMv52zuSzxVOYjW5EzWl7YOhNKHglTp78LwQw7CvGuc8lNqp6Qij2iakxghq6yIs5deUonnCxvKXGfeoZ2NV2xu8A9UYffM6_gvNdpuf7DpUMXNsYglMOwY4uu5FGrH4rcPizdId6Il227wOs9PAJ4XOQEHJYY2xcbU7H1GbV297t16o95msXHkQD7SdhgkKNCeaL4NWJ67K5cIKJNr_i2ISNFWXZ6g9scejce-cg

#打开浏览器访问地址  https://master.k8s.com:30591  并使用token登录

#注意注意:若谷歌浏览器提示网站返回是乱码,认为网站非安全, 如下图所示可以使用这种办法
   ----->>>在界面任意位置执行     thisisunsafe

问题现象：
10.34.254.7 通常会使用加密技术来保护您的信息。Google Chrome 此次尝试连接到 10.34.254.7 时，此网站发回了异常的错误凭据。这可能是因为有攻击者在试图冒充 10.34.254.7，或 Wi-Fi 登录屏幕中断了此次连接。请放心，您的信息仍然是安全的，因为 Google Chrome 尚未进行任何数据交换便停止了连接。
您目前无法访问 10.34.254.7，因为此网站发送了 Google Chrome 无法处理的杂乱凭据。网络错误和攻击通常是暂时的，因此，此网页稍后可能会恢复正常。

16.结尾

#至此kubernetes V1.19.4 版本就部署成功了。当然还有很多很多的小细节还没有写，从头走一遍才能有更深的体会吧。
第一篇就更新到这儿了。感谢大家坚持看完。来给生活比个✌️

登录成功后的界面如下：