kubeadm部署1.28版本k8s
一、初始化k8s实验环境
三台虚拟机基本配置：操作系统centos7.6，4G内存/4核CPU/60G硬盘。NAT网络。
注意开启虚拟机虚拟化引擎：Intel VT-x 、虚拟化CPU性能计算器、虚拟化IOMMU。
| K8s集群角色 | IP地址 | 主机名 | 安装的组件 |
|---|---|---|---|
| 控制节点 | 192.168.200.180 | k8s-master | kube-apiserver、kube-controller-manager、kube-scheduler、docker、etcd、calico |
| 工作节点 | 192.168.200.181 | k8s-node1 | kubelet、kube-proxy、docker、calico、coreDNS |
| 工作节点 | 192.168.200.182 | k8s-node2 | kubelet、kube-proxy、docker、calico、coreDNS |
1、kubeadm和二进制安装k8s适用场景分析
kubeadm是官方提供的开源工具，用于快速搭建kubernetes集群，目前比较方便和推荐使用的。
kubeadmi int 以及 kubeadm join 这两个命令可以快速创建 kubernetes集群。kubeadm 初始化 k8s，所有的组件都是以pod形式运行的，具备故障自恢复能力。
kubeadm 是工具，可以快速搭建集群，也就是相当于程序脚本自动部署，简化操作。证书、组件资源清单文件都是自动创建的，屏蔽了很多细节，使得对各个模块感知很少。
kubeadm适合经常部署k8s集群的场景，或对自动化要求比较高的场景。
二进制：在官网下载相关组件的二进制包，如果手动安装，对k8s理解更加清楚，对集群组件的安装部署更加了解。
kubeadm和二进制都适合生产环境，在生产环境运行很稳定，具体根据实际项目评估。
2、创建虚拟机，修改IP
如下所示修改网卡信息，下面是控制节点的配置信息，工作节点仅IP地址不同。
[root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
UUID=92c69021-2981-4c15-8c9a-2d1efb6bb011
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.200.180
NETMASK=255.255.255.0
GATEWAY=192.168.200.2
# 修改dns文件
[root@localhost ~]# vi /etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
# 重启网络
[root@localhost ~]# systemctl restart network
然后关闭虚拟机，克隆成node1和node2虚拟机。
3、配置主机名和hosts文件
配置机器主机名：
# 在192.168.200.180上执行
[root@localhost ~]# hostnamectl set-hostname k8s-master && bash
配置主机hosts文件，相互间通过主机名访问：
echo '''192.168.200.180 k8s-master
192.168.200.181 k8s-node1
192.168.200.182 k8s-node2''' >> /etc/hosts
4、关闭交换分区
SWAP是交换分区，如果机器内存不够，会使用swaq分区，但是swap分区的性能较低，k8s设计时为了提升性能，默认不允许使用交换分区。
kubeadm初始化的时候会监测swap是否关闭，若没有关闭，则初始化失败。如不想关闭交换分区，安装k8s的时候可以指定————ignore-preflight-error=Swap 来解决。
# 临时关闭交换分区
[root@k8s-master ~]# swapoff -a
[root@k8s-node1 ~]# swapoff -a
[root@k8s-node2 ~]# swapoff -a
[root@k8s-master ~]# free -m
total used free shared buff/cache available
Mem: 3934 151 3621 11 160 3556
Swap: 0 0 0
# 永久关闭交换分区
# 编辑/etc/fstab文件，注释掉swap分区的行
[root@k8s-master ~]# vim /etc/fstab
/dev/mapper/centos-root / xfs defaults 0 0
UUID=1f767b34-97e1-4fd0-a40e-f078e9535bfa /boot xfs defaults 0 0
/dev/mapper/centos-home /home xfs defaults 0 0
#/dev/mapper/centos-swap swap swap defaults 0 0
5、配置内核参数
三个机器均执行该操作。
[root@k8s-master ~]# modprobe br_netfilter
[root@k8s-master ~]# echo "modprobe br_netfilter" >> /etc/profile
[root@k8s-master ~]# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
[root@k8s-master ~]# sysctl -p /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
（1）sysctl命令
在运行时配置内核参数
-p 从指定的文件加载系统参数，如不指定即从 /etc/sysctl.conf 文件中加载。
（2）modprobe br_netfilter
br_netfilter模块是docker网络插件的依赖模块，如果不加载，docker网络插件将无法工作。
（3）net.bridge.bridge-nf-call-iptables
在centos安装docker，执行 docker info 时，会提示如下警告：
Warning: bridge-nf-call-iptables is disabled
Warning: bridge-nf-call-ip6tables is disabled
警告提示表明，需要设置net.bridge.bridge-nf-call-iptables和net.bridge.bridge-nf-call-ip6tables参数为1，才能使docker网络插件正常工作。
（4）net.ipv4.ip_forward
默认情况下，内核不支持IP转发，需要设置net.ipv4.ip_forward为1，才能使docker网络插件正常工作。
如没配置，kubeadm初始化时，会提示如下报错：
ERROR FileContent--proc-sys-net-ipv4-ip_forward: /proc/sys/net/ipv4/ip_forward: contents are not set to 1
出于安全考虑，Linux 系统默认是禁止数据包转发的。所谓转发即当主机拥有多于一块的网卡时，其中一块收到数据包，根据数据包的目的 ip 地址将数据包发往本机另一块网卡，该网卡根据路由表继续发送数据包。这通常是路由器所要实现的功能。
要让 Linux 系统具有路由转发功能，需要配置一个 Linux 的内核参数 net.ipv4.ip_forward。这个参数指定了 Linux 系统当前对路由转发功能的支持情况；其值为 0 时表示禁止进行 IP 转发；如果是 1,则说明 IP 转发功能已经打开。
6、关闭防火墙和selinux
# 关闭防火墙
[root@k8s-master ~]# systemctl stop firewalld; systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
# 关闭selinux
[root@k8s-master ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
# 修改完selinux配置文件后，需要重启系统才生效
# 显示Disabled 说明已经关闭
[root@k8s-master ~]# getenforce
Disabled
7、配置repo源
# 备份基础源
[root@k8s-master ~]# mkdir /etc/yum.repos.d/repo.bak
[root@k8s-master ~]# mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/repo.bak/
# 添加阿里云源
[root@k8s-master ~]# curl -o /etc/yum.repos.d/CenOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2523 100 2523 0 0 34062 0 --:--:-- --:--:-- --:--:-- 34561
# 配置国内docker源
[root@k8s-master ~]# yum install yum-utils -y
[root@k8s-master ~]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
Loaded plugins: fastestmirror
adding repo from: http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
grabbing file http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo to /etc/yum.repos.d/docker-ce.repo
repo saved to /etc/yum.repos.d/docker-ce.repo
# 配置epel源
[root@k8s-master ~]# yum install -y wget
[root@k8s-master ~]# wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo
# 配置安装kubernetes组件需要的阿里云源
[root@k8s-master ~]# cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.28/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.28/rpm/repodata/repomd.xml.key
EOF
8、配置时区和时间同步
# 1.配置主节点为NTP时间服务器
[root@k8s-master ~]# yum install chrony -y
[root@k8s-master ~]# systemctl start chronyd && systemctl enable chronyd
[root@k8s-master ~]# vi /etc/chrony.conf
###### 注释默认同步服务器，添加阿里时间同步 #########
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
server ntp.aliyun.com iburst
###### 配置允许同网段主机使用本机的NTP服务 ###########
# Allow NTP client access from local network.
allow 192.168.200.0/24
# 3.重启时间同步服务让配置生效
[root@k8s-master ~]# systemctl restart chronyd
# 4.检查时间同步状态
[root@k8s-node1 ~]# chronyc sources
210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* k8s-master 3 6 17 34 +4386ns[ +40us] +/- 26ms
[root@k8s-master ~]# date
Tue Dec 24 22:32:16 CST 2024
9、开启ipvs
ipvs (IP Virtual Server) 实现了传输层负载均衡，也就是我们常说的 4 层 LAN 交换，作为 Linux 内核的一部分。ipvs 运行在主机上，在真实服务器集群前充当负载均衡器。ipvs 可以将基于 TCP 和 UDP的服务请求转发到真实服务器上，并使真实服务器的服务在单个 IP 地址上显示为虚拟服务。
[root@k8s-master ~]# vi /etc/sysconfig/modules/ipvs.modules
#!/bin/bash
ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
for kernel_module in ${ipvs_modules}; do
/sbin/modinfo -F filename ${kernel_module} > /dev/null 2>&1
if [ 0 -eq 0 ]; then
/sbin/modprobe ${kernel_module}
fi
done
[root@k8s-master ~]# chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs
ip_vs_ftp 13079 0
nf_nat 26787 1 ip_vs_ftp
ip_vs_sed 12519 0
ip_vs_nq 12516 0
ip_vs_sh 12688 0
ip_vs_dh 12688 0
ip_vs_lblcr 12922 0
ip_vs_lblc 12819 0
ip_vs_wrr 12697 0
ip_vs_rr 12600 0
ip_vs_wlc 12519 0
ip_vs_lc 12516 0
ip_vs 141432 22 ip_vs_dh,ip_vs_lc,ip_vs_nq,ip_vs_rr,ip_vs_sh,ip_vs_ftp,ip_vs_sed,ip_vs_wlc,ip_vs_wrr,ip_vs_lblcr,ip_vs_lblc
nf_conntrack 133053 2 ip_vs,nf_nat
libcrc32c 12644 4 xfs,ip_vs,nf_nat,nf_conntrack
（1）ipvs 和 iptable 对比分析:
kube-proxy 支持 iptables 和 ipvs 两种模式， 在 kubernetes v1.8 中引入了 ipvs 模式，在 v1.9 中处于 beta 阶段，在 v1.11 中已经正式可用了。iptables 模式在 v1.1 中就添加支持了，从 v1.2 版本开始 iptables 就是 kube-proxy 默认的操作模式，ipvs 和 iptables 都是基于 netfilter的，但是 ipvs 采用的是 hash 表，因此当 service 数量达到一定规模时，hash 查表的速度优势就会显现出来，从而提高 service 的服务性能。
那么 ipvs 模式和 iptables 模式之间有哪些差异呢？
- ipvs 为大型集群提供了更好的可扩展性和性能
- ipvs 支持比 iptables 更复杂的复制均衡算法（最小负载、最少连接、加权等等）
- ipvs 支持服务器健康检查和连接重试等功能
11、安装基础软件包
[root@k8s-master ~]# yum install -y yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack ntpdate telnet ipvsadm
如果 firewalld 不习惯，可以安装 iptables。
# 安装
yum install -y iptables-services
# 关闭
service iptables stop && systemctl disable iptables
# 清空默认规则
iptables -F
二、安装 docker 服务
1、安装docker-ce
[root@k8s-master ~]# yum install -y docker-ce-26.1.3 docker-ce-cli-26.1.3 containerd.io
[root@k8s-master ~]# systemctl start docker && systemctl enable docker.service
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
2、配置加速器
[root@k8s-master ~]# vi /etc/docker/daemon.json
{
"registry-mirrors": [ "https://d23993ac0d3d404abf3d96846337d9a7.mirror.swr.myhuaweicloud.com" ],
"exec-opts": ["native.cgroupdriver=systemd"]
}
# 修改 docker 文件驱动为 systemd，默认为 cgroupfs，kubelet 默认使用 systemd，两者必须一致才可以
[root@k8s-master ~]# systemctl daemon-reload && systemctl restart docker && systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2024-12-24 23:15:48 CST; 5ms ago
3、配置cri-docker环境（1.28的操作）
[root@k8s-master ~]# yum install -y libcgroup
[root@k8s-master ~]# ls
anaconda-ks.cfg cri-dockerd-0.3.2-3.el7.x86_64.rpm
[root@k8s-master ~]# rpm -ivh cri-dockerd-0.3.2-3.el7.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:cri-dockerd-3:0.3.2-3.el7 ################################# [100%]
[root@k8s-master ~]# vi /usr/lib/systemd/system/cri-docker.service
ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.9
# 重启cri-docker
[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl restart cri-docker && systemctl enable cri-docker
Created symlink from /etc/systemd/system/multi-user.target.wants/cri-docker.service to /usr/lib/systemd/system/cri-docker.service.
三、安装 k8s
1、安装初始化k8s需要的软件包
Kubeadm: kubeadm 是一个工具，用来初始化 k8s 集群的。
kubelet: 安装在集群所有节点上，用于启动 Pod 的。
kubectl: 通过 kubectl 可以部署和管理应用，查看各种资源，创建、删除和更新各种组件。
# 查看可用的k8s版本
[root@k8s-master ~]# yum list kubelet --showduplicates | sort -r
Loading mirror speeds from cached hostfile
Loaded plugins: fastestmirror
kubelet.x86_64 1.28.9-150500.2.1 kubernetes
kubelet.x86_64 1.28.8-150500.1.1 kubernetes
kubelet.x86_64 1.28.7-150500.1.1 kubernetes
kubelet.x86_64 1.28.6-150500.1.1 kubernetes
kubelet.x86_64 1.28.5-150500.1.1 kubernetes
kubelet.x86_64 1.28.4-150500.1.1 kubernetes
kubelet.x86_64 1.28.3-150500.1.1 kubernetes
kubelet.x86_64 1.28.2-150500.1.1 kubernetes
kubelet.x86_64 1.28.2-150500.1.1 @kubernetes
kubelet.x86_64 1.28.15-150500.1.1 kubernetes
kubelet.x86_64 1.28.14-150500.2.1 kubernetes
kubelet.x86_64 1.28.13-150500.1.1 kubernetes
kubelet.x86_64 1.28.12-150500.1.1 kubernetes
kubelet.x86_64 1.28.1-150500.1.1 kubernetes
kubelet.x86_64 1.28.11-150500.1.1 kubernetes
kubelet.x86_64 1.28.10-150500.1.1 kubernetes
kubelet.x86_64 1.28.0-150500.1.1 kubernetes
Installed Packages
Available Packages
# 安装k8s
[root@k8s-master ~]# yum install -y kubelet-1.28.2 kubeadm-1.28.2 kubectl-1.28.2
# 修改/etc/sysconfig/kubelet文件，实现cgroupdriver和kubelet的cgroup的一致
[root@k8s-master ~]# vi /etc/sysconfig/kubelet
KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"
[root@k8s-master ~]# systemctl enable kubelet && systemctl start kubelet && systemctl status kubelet
Created symlink from /etc/systemd/system/multi-user.target.wants/kubelet.service to /usr/lib/systemd/system/kubelet.service.
● kubelet.service - kubelet: The Kubernetes Node Agent
Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled)
# 上传 离线镜像包
[root@k8s-master ~]# yum install -y lrzsz
[root@k8s-master ~]# rz
[root@k8s-master ~]# ls
anaconda-ks.cfg etcd-3.5.9.tar kube-proxy-v1.28.2.tar
coredns-v1.10.1.tar kube-apiserver-v1.28.2.tar kube-scheduler-v1.28.2.tar
cri-dockerd-0.3.2-3.el7.x86_64.rpm kube-controller-manager-v1.28.2.tar pause-3.9.tar
[root@k8s-master ~]# du -sh *
4.0K anaconda-ks.cfg
52M coredns-v1.10.1.tar
9.2M cri-dockerd-0.3.2-3.el7.x86_64.rpm
282M etcd-3.5.9.tar
122M kube-apiserver-v1.28.2.tar
118M kube-controller-manager-v1.28.2.tar
72M kube-proxy-v1.28.2.tar
59M kube-scheduler-v1.28.2.tar
740K pause-3.9.tar
# 如果已经有三台虚拟机，需要scp传递镜像包
[root@k8s-master ~]# scp ./*.tar k8s-node1:/root
coredns-v1.10.1.tar 100% 51MB 127.1MB/s 00:00
etcd-3.5.9.tar 100% 282MB 107.5MB/s 00:02
kube-apiserver-v1.28.2.tar 100% 121MB 91.7MB/s 00:01
kube-controller-manager-v1.28.2.tar 100% 117MB 96.6MB/s 00:01
kube-proxy-v1.28.2.tar 100% 71MB 87.5MB/s 00:00
kube-scheduler-v1.28.2.tar 100% 59MB 101.9MB/s 00:00
pause-3.9.tar 100% 739KB 90.1MB/s 00:00
[root@k8s-master ~]# scp ./*.tar k8s-node2:/root
...略
# 加载 镜像包
[root@k8s-master ~]# docker load -i etcd-3.5.9.tar
e023e0e48e6e: Loading layer [==================================================>] 327.7kB/327.7kB
...略
a4563151d59b: Loading layer [==================================================>] 19.67MB/19.67MB
Loaded image: registry.aliyuncs.com/google_containers/etcd:3.5.9-0
[root@k8s-master ~]# docker load -i kube-proxy-v1.28.2.tar
d2a4b045f3d0: Loading layer [==================================================>] 19.63MB/19.63MB
5e8877c87d9f: Loading layer [==================================================>] 55.05MB/55.05MB
Loaded image: registry.aliyuncs.com/google_containers/kube-proxy:v1.28.2
[root@k8s-master ~]# docker load -i coredns-v1.10.1.tar
6a4a177e62f3: Loading layer [==================================================>] 203.8kB/203.8kB
398c9baff0ce: Loading layer [==================================================>] 53.41MB/53.41MB
Loaded image: registry.aliyuncs.com/google_containers/coredns:v1.10.1
[root@k8s-master ~]# docker load -i kube-apiserver-v1.28.2.tar
47c446271f8d: Loading layer [==================================================>] 1.607MB/1.607MB
c5af401a13b1: Loading layer [==================================================>] 121.7MB/121.7MB
Loaded image: registry.aliyuncs.com/google_containers/kube-apiserver:v1.28.2
[root@k8s-master ~]# docker load -i kube-scheduler-v1.28.2.tar
86adbf8edefb: Loading layer [==================================================>] 56.01MB/56.01MB
Loaded image: registry.aliyuncs.com/google_containers/kube-scheduler:v1.28.2
[root@k8s-master ~]# docker load -i kube-controller-manager-v1.28.2.tar
5a79e3f66baa: Loading layer [==================================================>] 117.7MB/117.7MB
Loaded image: registry.aliyuncs.com/google_containers/kube-controller-manager:v1.28.2
[root@k8s-master ~]# docker load -i pause-3.9.tar
e3e5579ddd43: Loading layer [==================================================>] 746kB/746kB
Loaded image: registry.aliyuncs.com/google_containers/pause:3.9
# 如有三台虚拟机，在node1和node2上加载镜像包
[root@k8s-node1 ~]# for i in /root/*.tar;do docker load -i $i;done
[root@k8s-node2 ~]# for i in /root/*.tar;do docker load -i $i;done
# 查看镜像
[root@k8s-master ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.aliyuncs.com/google_containers/kube-proxy v1.20.6 9a1ebfd8124d 3 years ago 118MB
registry.aliyuncs.com/google_containers/kube-controller-manager v1.20.6 560dd11d4550 3 years ago 116MB
registry.aliyuncs.com/google_containers/kube-scheduler v1.20.6 b93ab2ec4475 3 years ago 47.3MB
registry.aliyuncs.com/google_containers/kube-apiserver v1.20.6 b05d611c1af9 3 years ago 122MB
calico/pod2daemon-flexvol v3.18.0 2a22066e9588 3 years ago 21.7MB
calico/node v3.18.0 5a7c4970fbc2 3 years ago 172MB
calico/cni v3.18.0 727de170e4ce 3 years ago 131MB
calico/kube-controllers v3.18.0 9a154323fbf7 3 years ago 53.4MB
registry.aliyuncs.com/google_containers/etcd 3.4.13-0 0369cf4303ff 4 years ago 253MB
registry.aliyuncs.com/google_containers/coredns 1.7.0 bfe3a36ebd25 4 years ago 45.2MB
registry.aliyuncs.com/google_containers/pause 3.2 80d28bedfe5d 4 years ago 683kB
补充说明，如果没有镜像文件包，可以用如下命令拉取镜像：
kubeadm config images pull --image-repository registry.aliyuncs.com/google_containers --cri-socket=unix:///var/run/cri-dockerd.sock
``
### 1-2、如果在此处克隆两个node配置操作
关闭master机器，完整克隆出node1和node2。先开启node1进行配置
```bash
[root@k8s-master ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens33
# 克隆的机器需要删除uuid
IPADDR=192.168.200.181
NETMASK=255.255.255.0
GATEWAY=192.168.200.2
# 改主机名
[root@k8s-master ~]# hostnamectl set-hostname k8s-node1
[root@k8s-master ~]# bash
bash
[root@k8s-node1 ~]# systemctl restart network
# 与master时间同步
[root@k8s-node1 ~]# vi /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
server k8s-master iburst
[root@k8s-node1 ~]# systemctl restart chronyd
[root@k8s-node1 ~]# chronyc sources
210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? k8s-master 0 7 0 - +0ns[ +0ns] +/- 0ns
再开启node2进行配置
[root@k8s-master ~]# hostnamectl set-hostname k8s-node2
[root@k8s-master ~]# bash
bash
[root@k8s-node2 ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens33
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.200.182
NETMASK=255.255.255.0
GATEWAY=192.168.200.2
[root@k8s-node2 ~]# systemctl restart network
[root@k8s-node2 ~]# vi /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
server k8s-master iburst
[root@k8s-node2 ~]# systemctl restart chronyd
然后开启master，三台机器配置免密登录
# 1、三台机器都生成ssh密钥，一路回车
[root@k8s-master ~]# ssh-keygen
[root@k8s-node1 ~]# ssh-keygen
[root@k8s-node2 ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:56kFtc+z1a7/cWTg9Hlh7xLcf8PHLh/LSQF113kK8os root@k8s-master
The keys randomart image is:
+---[RSA 2048]----+
| .=|
| . . ..=|
| .o oo+.|
| . ..++++|
| S o. .+oB|
| +E+. .B+|
| + + o*O|
| o +++X|
| . . .OB|
+----[SHA256]-----+
# 三台机器都执行将公钥拷贝到其他机器
[root@k8s-master ~]# ssh-copy-id k8s-master
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'k8s-master (192.168.200.180)' can't be established.
ECDSA key fingerprint is SHA256:u7nlxwc8AwCbT5fFs2kWLcQQJpZ4cTlLBhl8qWRZtis.
ECDSA key fingerprint is MD5:80:39:be:e6:78:40:82:6b:30:de:69:74:64:11:a0:7d.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@k8s-master's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'k8s-master'"
and check to make sure that only the key(s) you wanted were added.
[root@k8s-master ~]# ssh-copy-id k8s-node1
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'k8s-node1 (192.168.200.181)' can't be established.
ECDSA key fingerprint is SHA256:u7nlxwc8AwCbT5fFs2kWLcQQJpZ4cTlLBhl8qWRZtis.
ECDSA key fingerprint is MD5:80:39:be:e6:78:40:82:6b:30:de:69:74:64:11:a0:7d.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@k8s-node1's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'k8s-node1'"
and check to make sure that only the key(s) you wanted were added.
[root@k8s-master ~]# ssh-copy-id k8s-node2
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'k8s-node2 (192.168.200.182)' can't be established.
ECDSA key fingerprint is SHA256:u7nlxwc8AwCbT5fFs2kWLcQQJpZ4cTlLBhl8qWRZtis.
ECDSA key fingerprint is MD5:80:39:be:e6:78:40:82:6b:30:de:69:74:64:11:a0:7d.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@k8s-node2's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'k8s-node2'"
and check to make sure that only the key(s) you wanted were added.
2、初始化 k8s 集群
把初始化 k8s 集群需要的离线镜像包上传到 master1、node1、node2 机器上，手动解压：
# 初始化 k8s 集群
# 注：--image-repository registry.aliyuncs.com/google_containers：手动指定仓库地址为registry.aliyuncs.com/google_containers。kubeadm 默认从 k8s.grc.io 拉取镜像，但是 k8s.gcr.io访问不到，所以需要指定从 registry.aliyuncs.com/google_containers 仓库拉取镜像。
[root@k8s-master ~]# kubeadm init --kubernetes-version=v1.28.2 --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.200.180 --image-repository registry.aliyuncs.com/google_containers --cri-socket=unix:///var/run/cri-dockerd.sock
# 显示如下信息，表示初始化成功
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.200.180:6443 --token ic9mur.14n0sj64gv6rjc84 \
--discovery-token-ca-cert-hash sha256:2392db8eba82ba84fc0153599aa161c40448f7f64fe0c531a2f98c48fb147d7a
# 上面这个命令是把 node 节点加入集群，需要保存下来，每个人的都不一样
配置 kubectl 的配置文件 config，相当于对 kubectl 进行授权，这样 kubectl 命令可以使用这个证书对 k8s 集群进行管理。
[root@k8s-master ~]# mkdir -p $HOME/.kube
[root@k8s-master ~]# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@k8s-master ~]# chown $(id -u):$(id -g) $HOME/.kube/config
[root@k8s-master ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady control-plane 2m13s v1.28.2
# 此时集群状态还是 NotReady 状态，因为没有安装网络插件。
3、扩容集群
（1）添加第一个工作节点
# 当token过期或丢失，可以使用如下查看加入节点的命令
[root@k8s-master ~]# kubeadm token create --print-join-command
kubeadm join 192.168.200.180:6443 --token dgzhsb.ngeaupe77fd1lr2y --discovery-token-ca-cert-hash sha256:47b8eb2f92736a73f4358e6e7f286c88f80db91fcae29e81c6055e1fc0b37c71
# 将node1加入集群：
[root@k8s-node1 ~]# kubeadm join 192.168.200.180:6443 --token ic9mur.14n0sj64gv6rjc84 --discovery-token-ca-cert-hash sha256:2392db8eba82ba84fc0153599aa161c40448f7f64fe0c531a2f98c48fb147d7a --cri-socket=unix:///var/run/cri-dockerd.sock
# 查看集群状态
[root@k8s-master ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady control-plane 3m48s v1.28.2
k8s-node1 NotReady <none> 14s v1.28.2
（2）添加第二个工作节点
# 将node2加入集群：
[root@k8s-node2 ~]# kubeadm join 192.168.200.180:6443 --token ic9mur.14n0sj64gv6rjc84 --discovery-token-ca-cert-hash sha256:2392db8eba82ba84fc0153599aa161c40448f7f64fe0c531a2f98c48fb147d7a --cri-socket=unix:///var/run/cri-dockerd.sock
# 查看集群状态
[root@k8s-master ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady control-plane 6m49s v1.28.2
k8s-node1 NotReady <none> 21s v1.28.2
k8s-node2 NotReady <none> 9s v1.28.2
看到上面说明 node1、node2 节点已经加入到集群了,充当工作节点。
（3）将工作节点ROLES设置为worker
[root@k8s-master ~]# kubectl label node k8s-node1 node-role.kubernetes.io/worker=worker
node/k8s-node1 labeled
[root@k8s-master ~]# kubectl label node k8s-node2 node-role.kubernetes.io/worker=worker
node/k8s-node2 labeled
[root@k8s-master ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady control-plane 8m49s v1.28.2
k8s-node1 NotReady worker 2m21s v1.28.2
k8s-node2 NotReady worker 2m9s v1.28.2
注意：上面状态都是 NotReady 状态，说明没有安装网络插件
4、安装网络组件-Calico
上传 calico.yaml 到 k8s-master 上，使用 yaml 文件安装 calico 网络插件。
在线下载配置文件地址是： https://docs.projectcalico.org/manifests/calico.yaml
calico.yaml 文件适配 3.25 版本。
# calico.yaml文件
[root@k8s-master ~]# ls
calico.yaml
[root@k8s-master ~]# du -sh *
236K calico.yaml
# 下载calico.yaml
wget https://projectcalico.docs.tigera.io/archive/v3.25/manifests/calico.yaml
[root@k8s-master ~]# kubectl apply -f calico.yaml
# STATUS 状态是 Running，说明安装成功。
[root@k8s-master ~]# kubectl get pod -n kube-system
NAME READY STATUS RESTARTS AGE
calico-kube-controllers-658d97c59c-ht2wn 1/1 Running 0 2m32s
calico-node-2fbw6 1/1 Running 0 2m32s
calico-node-kvf8p 1/1 Running 0 2m32s
calico-node-t9995 1/1 Running 0 2m32s
coredns-66f779496c-8xqqj 1/1 Running 0 48m
coredns-66f779496c-spg62 1/1 Running 0 48m
etcd-k8s-master 1/1 Running 0 49m
kube-apiserver-k8s-master 1/1 Running 0 49m
kube-controller-manager-k8s-master 1/1 Running 0 49m
kube-proxy-bh6b8 1/1 Running 0 48m
kube-proxy-f6m77 1/1 Running 0 42m
kube-proxy-ggpth 1/1 Running 0 42m
kube-scheduler-k8s-master 1/1 Running 0 49m
# STATUS 状态是 Ready，说明节点已经就绪。
[root@k8s-master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master Ready control-plane 49m v1.28.2
k8s-node1 Ready worker 43m v1.28.2
k8s-node2 Ready worker 42m v1.28.2
5、测试 k8s 网络和 dns 是否正常
把 busybox-1-28.tar.gz 上传到 xianchaonode1、xianchaonode2 节点，手动解压
首先测试网络：
# 上传 busybox-1-28.tar.gz，传递给 k8s-node1、k8s-node2 节点
[root@k8s-master ~]# rz
[root@k8s-master ~]# scp busybox-1-28.tar.gz k8s-node1:/root
busybox-1-28.tar.gz 100% 1338KB 88.6MB/s 00:00
[root@k8s-master ~]# scp busybox-1-28.tar.gz k8s-node2:/root
busybox-1-28.tar.gz 100% 1338KB 19.6MB/s 00:00
# 解压 busybox-1-28.tar.gz
[root@k8s-node1 ~]# docker load -i busybox-1-28.tar.gz
432b65032b94: Loading layer [==================================================>] 1.36MB/1.36MB
Loaded image: busybox:1.28
[root@k8s-node2 ~]# docker load -i busybox-1-28.tar.gz
432b65032b94: Loading layer [==================================================>] 1.36MB/1.36MB
Loaded image: busybox:1.28
# 创建 busybox pod
# -- sh：作用是启动一个交互式 shell，这样在容器中就可以执行命令了。
[root@k8s-master ~]# kubectl run busybox --image busybox:1.28 --restart=Never --rm -it busybox -- sh
If you dont see a command prompt, try pressing enter.
/ # ping www.baidu.com
PING www.baidu.com (183.2.172.42): 56 data bytes
64 bytes from 183.2.172.42: seq=0 ttl=127 time=27.719 ms
64 bytes from 183.2.172.42: seq=1 ttl=127 time=22.266 ms
64 bytes from 183.2.172.42: seq=2 ttl=127 time=23.727 ms
# 通过上面的命令，已经可以ping通了，说明 calico 网络插件安装成功。
然后测试dns：
/ # nslookup kubernetes.default.svc.cluster.local
Server: 10.96.0.10
Address 1: 10.96.0.10 kube-dns.kube-system.svc.cluster.local
Name: kubernetes.default.svc.cluster.local
Address 1: 10.96.0.1 kubernetes.default.svc.cluster.local
# ClusterIP 是 Kubernetes Service 的默认类型，它为服务分配一个集群内部的虚拟 IP 地址，这个地址只在集群网络中可达。每个服务都会获得一个唯一的 ClusterIP，用于访问该服务提供的资源或应用程序。
# 10.96.0.1 是k8s集群的 apiserver 的 clusterIP
[root@k8s-master ~]# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 54m
# 10.96.0.10 是k8s内部的 dns 服务
[root@k8s-master ~]# kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 54m
10.96.0.10 就是 coreDNS 的 clusterIP，说明 dns 已经配置好了。
解析内部 Service 的名称，是通过 coreDNS 来解析的。
kubernetes.default.svc.cluster.local的：是 Kubernetes 集群中的一种特殊的 DNS 名称，用于解析集群内的 API Server 的服务地址。这是 Kubernetes 服务发现机制的一部分，允许 Pod 内的应用通过这个预定义的 DNS 名称与 Kubernetes API Server 进行通信。
- kubernetes：这是默认的服务名称，对应于 Kubernetes API Server。
- default：这表示服务所在的命名空间（Namespace）。在这个例子中，它位于默认的命名空间中。
- svc：这是一个简写，代表“service”，表明这是一个 Kubernetes Service 类型的资源。
- cluster.local：这是集群的域后缀，通常配置在集群级别，用来标识集群内部的 DNS 查询。不同的集群可能会有不同的配置，但 cluster.local 是一个常见的默认值。
注意：busybox 要使用指定的1.28版本，不能用最新版本，最新版本，nslookup 会解析不到dns和ip。
四、k8s可视化UI界面dashboard
1、安装dashboard
仅需在k8s-master上操作。
# 下载dashboard所需的yaml文件
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
# 修改配置文件，配置 dashboard 访问端口
[root@k8s-master ~]# vim recommended.yaml
# 修改spec下的内容如下：
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
type: NodePort
ports:
- port: 443
targetPort: 8443
nodePort: 30000
selector:
k8s-app: kubernetes-dashboard
# 安装dashboard
[root@k8s-master ~]# kubectl apply -f recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
# 查看dashboard状态
[root@k8s-master ~]# kubectl get pods -n kubernetes-dashboard
NAME READY STATUS RESTARTS AGE
dashboard-metrics-scraper-5657497c4c-pjn56 1/1 Running 0 10m
kubernetes-dashboard-78f87ddfc-57b84 1/1 Running 0 10m
# 如上所示，dashboard 已经安装成功。
# 查看dashboard前端的service
[root@k8s-master ~]# kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper NodePort 10.96.19.163 <none> 443:30000/TCP 10m
kubernetes-dashboard ClusterIP 10.98.91.215 <none> 443/TCP 10m
# 检查相关服务运行状态
[root@k8s-master ~]# kubectl get deployment kubernetes-dashboard -n kubernetes-dashboard
NAME READY UP-TO-DATE AVAILABLE AGE
kubernetes-dashboard 1/1 1 1 11m
上面可看到 service 类型是 NodePort，master-ip:30000 端口即可访问 kubernetes dashboard，在浏览器(使用火狐浏览器)访问如下地址: https://192.168.200.180:30000
2、通过 token 令牌访问 dashboard
创建管理员 token，具有查看任何空间的权限，可以管理所有资源对象
# 编辑yaml，创建管理用户
[root@k8s-master ~]# vi dashboard_admin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
# 用户创建
[root@k8s-master ~]# kubectl apply -f dashboard_admin.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
# 创建并查看admin-user的令牌值
[root@k8s-master ~]# kubectl -n kubernetes-dashboard create token admin-user
eyJhbGciOiJSUzI1NiIsImtpZCI6Ijh4TDJ2Y2pVWTlRWU9taUZrcHplRW9Kc3FDbmZFN0x6UFNfeXVLaEpETlUifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzgwMzY1NDc4LCJpYXQiOjE3ODAzNjE4NzgsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhZG1pbi11c2VyIiwidWlkIjoiYWI3OTY0NDUtODE2Yy00NjljLTg0MWYtMjU2YTYwNDhlMTc4In19LCJuYmYiOjE3ODAzNjE4NzgsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDphZG1pbi11c2VyIn0.IOBvs8XI-kQw_sjY-o2F_FtO9dYSGcDjOySuOnieLtAwBsn4snOjMlHVewNxR_hvLobOJjo1DzPw2IrDzYMLHF-GUN9VFVtG1GO2Yrd_Grq-uxa47UwM0xDSqOUzF089P7pbcskfRa4QLPzB15BvFybcrl1A7P8IUcGg0iUvbM7oQC5uBW2P6ffZh-naH0L_p6jaBjuVuu_jvknD4-Pyn7yha2vYGBg6mjHoSaQDegutsUkG4tK6G_sOprU65tS3WgDTOnACk7vcd6j34WOd9RKqmxySYD9aVw7WS80SgITut7nUqIWY0OanxfhVv_RVZmwQySHkX_hoKs6KCGjNLQ
复制令牌值内容到浏览器token登录处，然后sign in，进入集群管理页面:
3、关于 port、targetport、nodeport 的说明
nodeport 是集群外流量访问集群内服务的端口，比如客户访问 nginx，apache。
port 是集群内的 pod 互相通信用的端口类型，比如 nginx 访问 mysql，而 mysql 是不需要让客户访问到的，port 是 service 的的端口。
targetport 目标端口，也就是最终端口，也就是 pod 的端口。
五、安装 metrics-server 组件
metrics-server 是一个集群范围内的资源数据集和工具，同样的，metrics-server 也只是显示数据，并不提供数据存储服务，主要关注的是资源度量 API 的实现，比如 CPU、文件描述符、内存、请求延时等指标，metric-server 收集数据给 k8s 集群内使用，如 kubectl,hpa,scheduler 等。
Metrics Server 是 Kubernetes 内置自动缩放管道的可扩展、高效的容器资源指标来源。Metrics Server 从 Kubelets 收集资源指标，并通过 Metrics API 在 Kubernetes apiserver 中公开它们，以供 Horizontal Pod Autoscaler 和Vertical Pod Autoscaler 使用。Metrics API 也可以通过访问kubectl top，从而更容易调试自动缩放管道。
kubectl top 是一个用于查看 Kubernetes 集群中资源使用情况的命令。它可以显示节点或Pod的CPU、内存和存储的使用情况。该命令要求正确配置Metrics Server并在服务器上工作。
# 先到Metrics Server项目地址，查询对应版本支持那个K8S版本
# 由于我安装的k8S版本是1.28.2，所以需要下载1.21+的版本
[root@k8s-master ~]# wget https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/high-availability-1.21+.yaml
[root@k8s-master ~]# ls
high-availability-1.21+.yaml
# 修改high-availability-1.21+.yaml配置文件，把镜像的地址修改阿里云镜像，并添加一个参数kubelet-insecure-tls
144 containers:
145 - args:
146 - --cert-dir=/tmp
147 - --secure-port=10250
148 - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
149 - --kubelet-use-node-status-port
150 - --metric-resolution=15s
151 - --kubelet-insecure-tls
152 image: registry.aliyuncs.com/google_containers/metrics-server:v0.7.0
153 imagePullPolicy: IfNotPresent
# 执行kubectl命令部署
[root@k8s-master ~]# kubectl apply -f high-availability-1.21+.yaml
serviceaccount/metrics-server created
clusterrole.rbac.authorization.k8s.io/system:aggregated-metrics-reader created
clusterrole.rbac.authorization.k8s.io/system:metrics-server created
rolebinding.rbac.authorization.k8s.io/metrics-server-auth-reader created
clusterrolebinding.rbac.authorization.k8s.io/metrics-server:system:auth-delegator created
clusterrolebinding.rbac.authorization.k8s.io/system:metrics-server created
service/metrics-server created
deployment.apps/metrics-server created
poddisruptionbudget.policy/metrics-server created
apiservice.apiregistration.k8s.io/v1beta1.metrics.k8s.io created
# 检查
[root@k8s-master ~]# kubectl get apiservices | grep metrics
v1beta1.metrics.k8s.io kube-system/metrics-server True 70s
1、测试 kubectl top 命令
# 查看 pod 资源使用情况：
[root@k8s-master ~]# kubectl top pods -n kube-system
NAME CPU(cores) MEMORY(bytes)
calico-kube-controllers-658d97c59c-ht2wn 2m 74Mi
calico-node-2fbw6 25m 152Mi
calico-node-kvf8p 27m 155Mi
calico-node-t9995 24m 146Mi
coredns-66f779496c-8xqqj 1m 54Mi
coredns-66f779496c-spg62 1m 28Mi
etcd-k8s-master 15m 107Mi
kube-apiserver-k8s-master 42m 420Mi
kube-controller-manager-k8s-master 14m 159Mi
kube-proxy-bh6b8 1m 76Mi
kube-proxy-f6m77 1m 75Mi
kube-proxy-ggpth 1m 74Mi
kube-scheduler-k8s-master 3m 75Mi
metrics-server-7d79df8559-cck8z 2m 17Mi
metrics-server-7d79df8559-rt77r 3m 17Mi
# 查看 节点 资源使用情况：
[root@k8s-master ~]# kubectl top node
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
k8s-master 145m 7% 1269Mi 33%
k8s-node1 62m 3% 731Mi 19%
k8s-node2 65m 3% 698Mi 18%
浙公网安备 33010602011771号