參考: https://blog.csdn.net/yu33575/article/details/135387548
二進制安裝k8s: https://blog.csdn.net/qq_73990369/article/details/143217084
K8S二進制安裝與部署 :https://blog.csdn.net/fantuan_sss/article/details/139073366
k8s-(六)在kubernertes上部署運行項目: https://blog.csdn.net/qq_21187515/article/details/112320972
解決logs不能查看的問題: https://blog.51cto.com/shunzi115/2432164
ssh免密登錄
#在每臺服務器上生成RSA密鑰對
ssh-keygen -P '' -f ~/.ssh/id_rsa#將公鑰傳輸給要遠程的服務器(在每臺服務器上,將生成的公鑰復制到其他兩臺服務器上)
ssh-copy-id -i ~/.ssh/id_rsa.pub root@k8s-node1
ssh-copy-id -i ~/.ssh/id_rsa.pub root@devdb
ssh-copy-id -i ~/.ssh/id_rsa.pub root@node
Kubernetes 部署
安裝 kubeadm、kubelet 和 kubectl
kubeadm:用來初始化集群的指令。
kubelet:在集群中的每個節點上用來啟動 Pod 和容器等。
kubectl:用來與集群通信的命令行工具。
kubeadm 安裝
1 安裝 CNI 插件(大多數 Pod 網絡都需要):
CNI_PLUGINS_VERSION="v1.3.0"
ARCH="amd64"
DEST="/opt/cni/bin"
sudo mkdir -p "$DEST"
curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/cni-plugins-linux-${ARCH}-${CNI_PLUGINS_VERSION}.tgz" | sudo tar -C "$DEST" -xzcurl -L "https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-amd64-v1.3.0.tgz" | sudo tar -C "/opt/cni/bin" -xztar -C "/opt/cni/bin" -xz -f cni-plugins-linux-amd64-v1.3.0.tgz
2 安裝 crictl(kubeadm/kubelet 容器運行時接口(CRI)所需):
DOWNLOAD_DIR="/usr/local/bin"
sudo mkdir -p "$DOWNLOAD_DIR"CRICTL_VERSION="v1.28.0"
ARCH="amd64"
curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xzcurl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.28.0/crictl-v1.28.0-linux-amd64.tar.gz" | sudo tar -C /usr/local/bin -xztar -C /usr/local/bin -xz -f crictl-v1.28.0-linux-amd64.tar.gz
3 安裝 kubeadm、kubelet、kubectl 并添加 kubelet 系統服務:
RELEASE="$(curl -sSL https://dl.k8s.io/release/stable.txt)"
RELEASE="v1.32.0"
ARCH="amd64"
cd $DOWNLOAD_DIR
cd /usr/local/binsudo curl -L --remote-name-all https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/{kubeadm,kubelet}
sudo curl -L --remote-name-all https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/{kubeadm,kubelet}
sudo chmod +x {kubeadm,kubelet}RELEASE_VERSION="v0.16.2"
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/krel/templates/latest/kubelet/kubelet.service" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/v0.16.2/cmd/krel/templates/latest/kubelet/kubelet.service" | sed "s:/usr/bin:/usr/local/bin:g" | sudo tee /etc/systemd/system/kubelet.servicesed "s:/usr/bin:/usr/local/bin:g" kubelet.service | tee /etc/systemd/system/kubelet.servicesudo mkdir -p /etc/systemd/system/kubelet.service.d
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/krel/templates/latest/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/v0.16.2/cmd/krel/templates/latest/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:/usr/local/bin:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.confsed "s:/usr/bin:/usr/local/bin:g" 10-kubeadm.conf | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
–
kubelet 安裝
install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
install -o root -g root -m 0755 kubeadm /usr/local/bin/kubeadm
install -o root -g root -m 0755 kubelet /usr/local/bin/kubelet
–
kubectl 安裝
https://kubernetes.io/zh-cn/docs/tasks/tools/install-kubectl-linux/
安裝命令
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
測試:
kubectl version --client
–
kubeadm init 用于搭建控制平面節點
kubeadm join 用于搭建工作節點并將其加入到集群中
kubeadm upgrade 用于升級 Kubernetes 集群到新版本
kubeadm config 如果你使用了 v1.7.x 或更低版本的 kubeadm 版本初始化你的集群,則使用 kubeadm upgrade 來配置你的集群
kubeadm token 用于管理 kubeadm join 使用的令牌
kubeadm reset 用于恢復通過 kubeadm init 或者 kubeadm join 命令對節點進行的任何變更
kubeadm certs 用于管理 Kubernetes 證書
kubeadm kubeconfig 用于管理 kubeconfig 文件
kubeadm version 用于打印 kubeadm 的版本信息
kubeadm alpha 用于預覽一組可用于收集社區反饋的特性
二進制安裝K8S:
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -O /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -O /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -O /usr/local/bin/cfssl-certinfochmod +x /usr/local/bin/cfssl*
master節點操作–給api-server創建的證書。 別的服務訪問api-server的時候需要通過證書認證
[root@k8s-master1 ~]# mkdir -p /opt/crt/
[root@k8s-master1 ~]# cd /opt/crt/
# vim ca-config.json
{"signing": {"default": {"expiry": "87600h"},"profiles": {"kubernetes": {"expiry": "87600h","usages": ["signing","key encipherment","server auth","client auth"]}}}
}# vim ca-csr.json 定義生產簽名所需要的信息參數
{"CN": "kubernetes","key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "Beijing","ST": "Beijing","O": "k8s","OU": "System"}]
}生產ca證書和私鑰
[root@k8s-master1 crt]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -生成apiserver證書:
[root@k8s-master1 crt]# vim server-csr.json
# cat server-csr.json
{"CN": "kubernetes","hosts": ["10.0.0.1", //這是后?dns要使用的虛擬網絡的網關,不用改,就用這個切忌"127.0.0.1","10.xxx.xxx.xx1", // master的IP地址。"10.xxx.100.xx2","10.xxx.100.xx3","kubernetes","kubernetes.default","kubernetes.default.svc","kubernetes.default.svc.cluster","kubernetes.default.svc.cluster.local"],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "BeiJing","ST": "BeiJing","O": "k8s","OU": "System"}]
}[root@k8s-master1 crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server[root@139devdb crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
invalid character '/' looking for beginning of value
Failed to parse input: unexpected end of JSON input生成kube-proxy證書:
[root@k8s-master1 crt]# vim kube-proxy-csr.json
# cat kube-proxy-csr.json
{"CN": "system:kube-proxy","hosts": [],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "BeiJing","ST": "BeiJing","O": "k8s","OU": "System"}]
}
[root@k8s-master1 crt]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
配置好前面生成的證書,確保能連接etcd
systemd管理apiserver[root@k8s-master1 cfg]# cd /usr/lib/systemd/system
# vim kube-apiserver.service
# cat /usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes[Service]
EnvironmentFile=-/opt/k8s/cfg/kube-apiserver
ExecStart=/opt/k8s/bin/kube-apiserver $KUBE_APISERVER_OPTS
Restart=on-failure[Install]
WantedBy=multi-user.target 啟動:
systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver
設置集群參數
# 設置集群參數
[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=${KUBE_APISERVER} --kubeconfig=bootstrap.kubeconfig# 設置客戶端認證參數
[root@k8s-master crt]# /opt/k8s/bin/kubectl config set-credentials kubelet-bootstrap --token=${BOOTSTRAP_TOKEN} --kubeconfig=bootstrap.kubeconfig# 設置上下文參數
[root@k8s-master crt]# /opt/k8s/bin/kubectl config set-context default --cluster=kubernetes --user=kubelet-bootstrap --kubeconfig=bootstrap.kubeconfig# 設置默認上下文
[root@k8s-master crt]# /opt/k8s/bin/kubectl config use-context default --kubeconfig=bootstrap.kubeconfig# 創建kube-proxy kubeconfig文件[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=${KUBE_APISERVER} --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-credentials kube-proxy --client-certificate=kube-proxy.pem --client-key=kube-proxy-key.pem --embed-certs=true --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config set-context default --cluster=kubernetes --user=kube-proxy --kubeconfig=kube-proxy.kubeconfig[root@k8s-master1 crt]# /opt/k8s/bin/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig// 1 添加kubernetes集群
kubectl config set-cluster my-cluster \--server=https://10.xxx.100.xxx:6443 \--certificate-authority=/opt/crt/ca.pem// 2 添加用戶
kubectl config set-credentials my-user \--client-certificate=kube-proxy.pem \--client-key=kube-proxy-key.pem// 3 添加上下文
kubectl config set-context my-context \--cluster=my-cluster \--user=my-user \--namespace=default// 4 切換上下文
kubectl config use-context my-contextkubectl config set-credentials system:kube-proxy \--client-certificate=/opt/crt/kube-proxy.pem \--client-key=/opt/crt/kube-proxy-key.pemkubectl config set-context system-context \--cluster=system-cluster \--user=system:kube-proxy \--namespace=system-name 命令:
kubectl config view // 查看配置
kubectl config get-contexts // 上下文
kubectl config use-context system-context //切換上下文
kubectl get pods
systemd管理kubelet組件:
# vim /usr/lib/systemd/system/kubelet.service[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service
[Service]
EnvironmentFile=/opt/k8s/cfg/kubelet
ExecStart=/opt/k8s/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process
[Install]
WantedBy=multi-user.target--
啟動:
systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet
systemd管理kube-proxy組件:
[root@k8s-node1 ~]# cd /usr/lib/systemd/system
# vim /usr/lib/systemd/system/kube-proxy.service[Unit]
Description=Kubernetes Proxy
After=network.target
[Service]
EnvironmentFile=-/opt/k8s/cfg/kube-proxy
ExecStart=/opt/k8s/bin/kube-proxy $KUBE_PROXY_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target--啟動:
systemctl daemon-reload
systemctl enable kube-proxy
systemctl start kube-proxy
kubernetes部署運行項目
./kubectl get cs
pwd
./kubectl get node
./kubectl get csr
./kubectl get pods--
kubernetes部署運行項目參考: https://blog.csdn.net/qq_21187515/article/details/112320972在k8s中,我們不會單獨創建一個pod資源對象,而是創建Deployment對象,通過Deployment來管理pod。apiVersion: v1 #描述文件遵循v1版本的kubernetes API
kind: Pod #我們在描述一個pod
metadata: name: kubia-manual #pod的名稱
spec:containers:- image: luksa/kubia #創建容器所用的鏡像name: kubia #容器的名稱ports:- containerPort: 8080 #應用監聽的端口protocol: TCP
--apiVersion: v1
kind: Pod // k8s資源類型
metadata: // pod元數據name: dnsutil-pod // pod的名稱
spec: // pod規格containers:- image: tutum/dnsutils // 創建容器所用的鏡像name: dnsutil // 容器的名稱command: ["sleep", "infinity"]
--
apiVersion: v1
kind: Service
metadata:name: test-svc
spec:ports:- port: 80 // 該服務的可用端口targetPort: 8080 // 服務將連接轉發到的容器端口selector: // label app=testing的pod屬于該服務app: testing
創建Deployment的YAML描述文件
kubectl create deployment countgame --image=192.xxx.xxx.xxx:5000/countgame:0.91 --dry-run -o yaml > deploy.yaml
命令:
kubectl config view // 查看配置
kubectl config get-contexts // 上下文
kubectl config use-context system-context //切換上下文
kubectl config use-context my-contextkubectl get csr // 查看申請加入集群的節點(master)
kubectl certificate approve XXXXID // master審批通過允許加入集群
kubectl get node
kubectl get cs // 通過kubectl?具查看當前集群組件狀態
kubectl get pods// 創建Deployment對象
kubectl apply -f deploy.yamlkubectl get namespaces // 命名空間
創建管理員賬戶
1 創建一個 ServiceAccount。ServiceAccount 是 Kubernetes 中用于運行 Pod 的賬戶。
admin-user.yaml :apiVersion: v1
kind: ServiceAccount
metadata:name: admin-usernamespace: kube-systemkubectl apply -f admin-user.yamlapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:name: admin-role
rules:
- apiGroups: ["*"]resources: ["*"]verbs: ["*"]kubectl apply -f admin-role.yamlapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:name: admin-role-binding
subjects:
- kind: ServiceAccountname: admin-usernamespace: kube-system
roleRef:kind: ClusterRolename: admin-roleapiGroup: rbac.authorization.k8s.iokubectl apply -f admin-role-binding.yaml/opt/kubernetes/bin/kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrapkubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymouskubectl -n kube-system get secret $(kubectl -n kube-system get sa admin-user -o jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64 --decodekubectl config set-credentials admin-user --token=<TOKEN>
kubectl config set-context admin-context --cluster=<CLUSTER_NAME> --user=admin-user
kubectl config use-context admin-contextkubectl config set-credentials admin-user --token=<TOKEN>
kubectl config set-context admin-context --cluster=admin-cluster --user=admin-user
kubectl config use-context admin-context驗證權限
kubectl auth can-i create deployments --namespace=default
K8S kubelet logs報錯
設置
https://blog.51cto.com/shunzi115/24321641.error: You must be logged in to the server (the server has asked for the client to provide credentials ( pods/log nginx-7bb7cd8db5-v756s))
處理方法:
kubelet配置文件配置默認用戶權限如圖:
kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous2.Error from server (Forbidden): Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy) ( pods/log nginx-7bb7cd8db5-v756s)
處理方法:
anonymous用戶綁定一個cluster-admin的權限
kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous