CentOS 7 使用 kubeadm 搭建 Kubernetes 集群
點擊“程序員面試吧”，選擇“星標(biāo)??”
“下拉至文末”解鎖資料
注意：本篇文章已整理成pdf文檔，需要的可拉至文末領(lǐng)取
注意事項
檢查是否關(guān)閉了 SELinux 和 iptables，阿里云這個系統(tǒng)版本默認已經(jīng)關(guān)閉
# 檢查 selinux
getenforce
# 永久修改 selinux
sed 's/SELINUX=enforcing/SELINUX=disabled/' -i /etc/selinux/config #
立即修改
selinux setenforce 0
# 關(guān)閉防火墻, 禁止防火墻自啟動
systemctl stop firewalld; systemctl disable firewalld
關(guān)閉 swap
目前 Kubernetes 和 Docker 尚不支持內(nèi)存 Swap 空間的隔離機制
# 臨時關(guān)閉，立即生效
swapoff -a
# 永久關(guān)閉
sed -i '/swap/ s/^/#/' /etc/fstab
# 檢查是否生效
free -m
安裝 Docker
使用阿里云的源進行安裝:
# step 1: 安裝必要的一些系統(tǒng)工具
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
# Step 2: 添加軟件源信息
sudo yum-config-manager --add-repo http://mirrors.aliyun.com/docker-
ce/linux/centos/docker-ce.repo
# Step 3: 更新并安裝 Docker-CE, Kubernetes 目前只支持 Docker 18.09
sudo yum makecache fast
sudo yum -y install docker-ce-18.09.9
# Step 4: 開啟Docker服務(wù)
sudo service docker start
sudo systemctl enable docker
創(chuàng)建 kubernetes 集群
更換阿里巴巴開源鏡像站的源
curl -o /etc/yum.repos.d/CentOS7-Aliyun.repo
http://mirrors.aliyun.com/repo/Centos-7.repo
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-
x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum clean all && yum makecache
安裝 kubeadm, kubelet, kubectl
# 刪除舊包
yum remove -y kubelet kubeadm kubectl
# 安裝新版本 這三個軟件包版本必須一致
yum install -y kubelet-1.15.5 kubeadm-1.15.5 kubectl-1.15.5
systemctl enable kubelet
# systemctl start kubelet && systemctl status kubelet
初始化 master 節(jié)點
配置 Docker
## Create /etc/docker directory.
mkdir -p /etc/docker
# Setup daemon.
cat > /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
]
}
EOF
# Restart Docker
systemctl daemon-reload
systemctl restart docker
設(shè)置 Kubernetes 需要的內(nèi)核參數(shù)
cat > /etc/sysctl.d/kubernetes.conf <<EOF
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
vm.swappiness=0
vm.overcommit_memory=1
vm.panic_on_oom=0
EOF
sysctl -p /etc/sysctl.d/kubernetes.conf
編寫 init.yml 配置文件
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
clusterName: kubernetes-dev
imageRepository: registry.aliyuncs.com/google_containers
# curl https://storage.googleapis.com/kubernetes-release/release/stable-
1.txt 查看當(dāng)前版本.
# 必須小于等于 kubeadm 版本, 如想要升級需要先升級 kubeadm
kubernetesVersion: v1.15.5
apiServer:
extraArgs:
service-node-port-range: 80-32767
extraVolumes:
- hostPath: /etc/localtime
mountPath: /etc/localtime
name: localtime
- hostPath: /etc/kubernetes
mountPath: /etc/kubernetes
name: etc-kubernetes-fs
controllerManager:
extraVolumes:
- hostPath: /etc/localtime
mountPath: /etc/localtime
name: localtime
scheduler:
extraVolumes:
- hostPath: /etc/localtime
mountPath: /etc/localtime
name: localtime
networking:
dnsDomain: cluster.local
podSubnet: 10.200.0.0/16
應(yīng)用初始化配置創(chuàng)建集群
kubeadm init --config init.yml
集群創(chuàng)建成功后屏幕上會出現(xiàn)一些提示, 其中有一段代碼類似于: kubeadm join 172.17.230.22:6443 --token gf6tzb.85cy2c4is8xbj01a --discovery-token-ca-cert- hash sha256:b4501f5f92f16665a0ea0583f0e802e66ecc94db6362d541819b8ddc748ab3c6 , 這 段代碼是其他節(jié)點加入集群的命令, 需要保存好!!!
配置 kubectl
mkdir -p $HOME/.kube
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
# 移除 master 節(jié)點的污點
kubectl taint nodes k8s-master node-role.kubernetes.io/master:NoSchedule-
# 配置命令補全
echo 'source <(kubectl completion bash)' >> ~/.bashrc
# 重啟 shell
exec $SHELL -l
加入其它節(jié)點
在其它節(jié)點上執(zhí)行此命令來加入 k8s 集群
kubeadm join 172.17.230.22:6443 --token gf6tzb.85cy2c4is8xbj01a \
--discovery-token-ca-cert-hash
sha256:b4501f5f92f16665a0ea0583f0e802e66ecc94db6362d541819b8ddc748ab3c6
安裝 Calico 網(wǎng)絡(luò)插件
下載 Calico 配置文件
curl https://docs.projectcalico.org/v3.9/manifests/calico-etcd.yaml -O
修改 etcd 配置
最后一步的指定探測網(wǎng)卡我這里寫的是 eth0 , 你需要指定為自己系統(tǒng)中的主網(wǎng)卡名稱
# 修改網(wǎng)絡(luò)配置
POD_CIDR="10.200.0.0/16"
sed -i -e "s?192.168.0.0/16?$POD_CIDR?g" calico-etcd.yaml
# 修改證書
sed -i 's/# \(etcd-.*\)/\1/' calico-etcd.yaml
etcd_key=$(cat /etc/kubernetes/pki/etcd/peer.key | base64 -w 0)
etcd_crt=$(cat /etc/kubernetes/pki/etcd/peer.crt | base64 -w 0)
etcd_ca=$(cat /etc/kubernetes/pki/etcd/ca.crt | base64 -w 0)
sed -i -e 's/\(etcd-key: \).*/\1'$etcd_key'/' \
-e 's/\(etcd-cert: \).*/\1'$etcd_crt'/' \
-e 's/\(etcd-ca: \).*/\1'$etcd_ca'/' calico-etcd.yaml
# 修改 etcd 地址
ETCD=$(grep 'advertise-client-urls' /etc/kubernetes/manifests/etcd.yaml |
awk -F= '{print $2}')
sed -i -e 's@\(etcd_endpoints: \).*@\1"$ETCD"@' -e 's/\
(etcd_.*:\).*#/\1/' -e 's/replicas: 1/replicas: 2/' calico-etcd.yaml
指定探測網(wǎng)卡
sed '/autodetect/a\ - name: IP_AUTODETECTION_METHOD\n
value: "interface=eth0"' -i calico-etcd.yaml
創(chuàng)建 Calico
kubectl apply -f calico-etcd.yaml
刪除節(jié)點
先把要刪除的節(jié)點設(shè)置為維護狀態(tài)
kubectl drain k8s-node1-ct --delete-local-data --force --ignore-daemonsets
執(zhí)行刪除node節(jié)點命令
kubectl delete node k8s-node1-ct
刪除集群
kubeadm reset -f
rm -fr /etc/kubernetes/*
[[ -d /var/lib/etcd ]] && rm -fr /var/lib/etcd
iptables -F && iptables -t nat -F && iptables -t mangle -F && iptables -X
# 上面的命令也會清空 Docker 的規(guī)則，執(zhí)行后需要重啟一下 Docker Daemon 讓 Docker 重新加載規(guī)
則
systemctl restart docker
故障排查
Docker
報錯:
[WARNING IsDockerSystemdCheck]: detected "cgroupfs" as the Docker cgroup
driver. The recommended driver is "systemd". Please follow the guide at
https://kubernetes.io/docs/setup/cri/
解決辦法: Centos 系統(tǒng)需要先檢查 docker driver 是否是 systemd
參考: https://kubernetes.io/docs/setup/cri/
Kernel
報錯:
[init] Using Kubernetes version: v1.15.5
[preflight] Running pre-flight checks
[WARNING Hostname]: hostname "asap244" could not be reached
[WARNING Hostname]: hostname "asap244": lookup asap244 on
192.168.1.1:53: no such host
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileContent--proc-sys-net-bridge-bridge-nf-call-iptables]:
/proc/sys/net/bridge/bridge-nf-call-iptables contents are not set to 1
[preflight] If you know what you are doing, you can make a check non-fatal
with `--ignore-preflight-errors=...`
解決方法: 需要提前設(shè)置內(nèi)核參數(shù)
參考：http://i.yungeio.com/articles/14
Kubelet
報錯:
Unfortunately, an error has occurred:
timed out waiting for the condition
This error is likely caused by:
- The kubelet is not running
- The kubelet is unhealthy due to a misconfiguration of the node in some
way (required cgroups disabled)
If you are on a systemd-powered system, you can try to troubleshoot the
error with the following commands:
- 'systemctl status kubelet'
- 'journalctl -xeu kubelet'
Additionally, a control plane component may have crashed or exited when
started by the container runtime.
To troubleshoot, list all containers using your preferred container runtimes
CLI, e.g. docker.
Here is one example how you may list all Kubernetes containers running in
docker:
- 'docker ps -a | grep kube | grep -v pause'
Once you have found the failing container, you can inspect its logs
with:
- 'docker logs CONTAINERID'
error execution phase wait-control-plane: couldn't initialize a Kubernetes
cluster
解決方法: centos 7.3 部署 Kubernetes 1.15.5 的時候如果指定了 cgroupdriver=systemd, 在 init.yml 文件中也要為 kubelet 增加 cgroupdriver 的配置
點擊閱讀原文獲取文檔
評論
圖片
表情