Kubernetes--note1-安装部署
·
一 Kubernetes部署
1）构建harbor镜像仓库
1.安装docker
[root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF
[docker]
name = docker
baseurl = https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/
gpgcheck = 0
EOF
[root@harbor ~]# dnf install docker-ce-3:28.5.2-1.el9 -y初始化
[root@harbor ~]# vim docker.sh
[root@harbor ~]# cat docker.sh
#!/bin/bash
# Docker 生产环境内核&网络一键优化脚本
# 自动配置：br_netfilter、ip_forward、iptables、开机自启
# 1. 加载内核模块并开机自启
echo "===== 加载网桥内核模块 ====="
echo br_netfilter > /etc/modules-load.d/docker_mod.conf
modprobe -a br_netfilter
# 2. 配置内核网络参数
echo "===== 配置内核转发参数 ====="
cat > /etc/sysctl.d/docker.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
# 3. 立即生效内核参数
sysctl --system
# 4. 确保 Docker 开启 iptables 管理
echo "===== 优化 Docker 启动参数 ====="
sed -i 's|^ExecStart=.*|ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --iptables=true|' /usr/lib/systemd/system/docker.service
# 5. 重启 Docker 生效
systemctl daemon-reload
systemctl enable --now docker
systemctl restart docker
echo "===== Docker 优化完成！ ====="
docker -v
echo "内核转发状态："
sysctl net.ipv4.ip_forward
[root@harbor ~]# sh docker.sh
2.生成key
[root@harbor ~]# mkdir /data/certs -p
[root@harbor ~]# openssl req -newkey rsa:4096 \
> -nodes -sha256 -keyout /data/certs/timinglee.org.key \
> -addext "subjectAltName = DNS:reg.timinglee.org" \
> -x509 -days 365 -out /data/certs/timinglee.org.crt
.....+..+...+....+..+...............+.+..+.+.....+....+...+..+++++
.+.......+.....+++++++++++++++++++++++++++++++++++++++++++++*..............+.....+....+........+.........+......+.........+...+................+..+.............+......+...+..+.+.................+......+++++++++++++++++++++++++++++++++++++++++++++*..+.......+........+......+.+..+...+...+......+....+..+.......+......+......+...+........+...+.......+..+.+..+....+...............+........+...+....+...+..+...+...+..........+............+..+...+.+..+..................+....+......+.....+.+.....+...................+..+...+....+....
Common Name (eg, your name or your server's hostname) []:reg.timinglee.org
3.编辑harbor配置文件
[root@harbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/
[root@harbor ~]# cd /opt/harbor/
[root@harbor harbor]# ls
common.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
[root@harbor harbor]# vim harbor.yml
hostname: reg.timinglee.org
certificate: /data/certs/timinglee.org.crt
private_key: /data/certs/timinglee.org.key
harbor_admin_password: xier
[root@harbor harbor]# ./install.sh --help
Note: Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.yml bacause notary must run under https.
Please set --with-trivy if needs enable Trivy in Harbor
Please set --with-chartmuseum if needs enable Chartmuseum in Harbor
[root@harbor harbor]# ./install.sh --with-chartmuseum
4.启动并验证
[root@harbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p
[root@harbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt
[root@harbor harbor]# vim /etc/hosts
[root@harbor harbor]# systemctl restart docker
[root@harbor harbor]# docker compose up -d
WARN[0000] /opt/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] up 10/10
✔ Container harbor-log Running 0.0s
✔ Container chartmuseum Started 0.8s
✔ Container harbor-portal Started 1.3s
✔ Container redis Started 1.0s
✔ Container registryctl Started 0.7s
✔ Container harbor-db Started 1.0s
✔ Container registry Started 0.9s
✔ Container harbor-core Started 0.6s
✔ Container nginx Started 0.9s
✔ Container harbor-jobservice Started 0.5s
[root@harbor harbor]# docker login reg.timinglee.org -u admin
Password:
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
Login Succeeded
[root@harbor harbor]#
2）构建部署kubernetes所需主机
| 主机名 | ip | 配置 | 角色 |
|---|---|---|---|
| harbor | 172.25.254.200 | cpu1、mem 1G | harbor仓库 |
| master | 172.25.254.100 | cpu4、mem 4G | master，k8s集群控制节点 |
| node1 | 172.25.254.10 | cpu2、mem 2G | worker，k8s集群工作节点 |
| node2 | 172.25.254.20 | cpu2、mem 2G | worker，k8s集群工作节点 |
1.所有主机配置
关闭swap
systemctl disable --now swap.target
systemctl mask swap.target
sed '/swap/s/^/#/g' -i /etc/fstab
原因：
Swap 就是磁盘分区当内存用（虚拟内存），速度比物理内存慢几百倍
① 性能崩盘
内存不够时，系统把内存数据挪到磁盘 Swap，容器读写瞬间卡死、延迟飙升、卡顿超时。
Docker/Redis/MySQL 都是吃内存、要低延迟的服务，一用 Swap 直接拉胯。
② 资源调度错乱（重点！K8s 刚需）
开启 Swap：系统分不清「物理内存用完了」还是「挪到磁盘了」
容器 OOM（内存溢出）杀进程不准、调度异常、节点负载假低
K8s 官方强制要求必须关闭 Swap，不然 kubelet 直接报错起不来集群
③ 高可用 / 高并发稳定性
企业级服务：宁愿物理内存不够直接崩、告警扩容，也绝不走慢速磁盘 Swap 拖垮整个服务
安装docker
[root@harbor ~]# cd /etc/yum.repos.d/
[root@harbor yum.repos.d]# ll
总用量 16
-rw-r--r-- 1 root root 113 3月 29 11:51 docker.repo
-rw-r--r-- 1 root root 116 1月 15 11:35 epel.repo
-rw-r--r-- 1 root root 358 1月 14 22:04 redhat.repo
-rw-r--r-- 1 root root 146 1月 15 11:36 rhelbendi.repo
[root@harbor yum.repos.d]# for i in 10 20 100; do
scp docker.repo root@172.25.254.$i:/etc/yum.repos.d/
done
Warning: Permanently added '172.25.254.10' (ED25519) to the list of known hosts.
docker.repo 100% 113 161.9KB/s 00:00
Warning: Permanently added '172.25.254.20' (ED25519) to the list of known hosts.
docker.repo 100% 113 266.3KB/s 00:00
Warning: Permanently added '172.25.254.100' (ED25519) to the list of known hosts.
docker.repo 100% 113 276.8KB/s 00:00
[root@harbor yum.repos.d]#
dnf install docker-ce-3:28.5.2-1.el9 -y[root@harbor ~]# for i in 10 20 100; do scp docker.sh root@172.25.254.$i:/root/; done
docker.sh 100% 1032 219.4KB/s 00:00
docker.sh 100% 1032 228.9KB/s 00:00
docker.sh 100% 1032 3.5MB/s 00:00
[root@harbor ~]#
sh docker.sh
配置可以使用harbor仓库
mkdir /etc/docker/certs.d/reg.timinglee.org/ -p
[root@harbor ~]# for i in 10 20 100; do scp /data/certs/timinglee.org.crt root@172.25.254.$i:/etc/docker/certs.d/reg.timinglee.org/ca.crt; done
timinglee.org.crt 100% 2179 869.0KB/s 00:00
timinglee.org.crt 100% 2179 3.8MB/s 00:00
timinglee.org.crt 100% 2179 4.5MB/s 00:00
[root@harbor ~]#
systemctl enable docker
systemctl restart docker
所有主机配置docker加速器
cat >/etc/docker/daemon.json <<EOF
{
"registry-mirrors":["https://reg.timinglee.org"]
}
EOF
systemctl restart docker
docker info
可以看到
Registry Mirrors:
https://reg.timinglee.org/所有主机彼此建立解析
vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.100 master
172.25.254.10 node1
172.25.254.20 node2
172.25.254.200 reg.timinglee.org所有主机配置kubernetes安装源
vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name = kubernetes
baseurl = https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/
gpgcheck = 0
检测
[root@node1 ~]# dnf list kubelet
正在更新 Subscription Management 软件仓库。
无法读取客户身份
本系统尚未在权利服务器中注册。可使用 "rhc" 或 "subscription-manager" 进行注册。
kubernetes 1.1 kB/s | 12 kB 00:10
可安装的软件包
kubelet.aarch64 1.35.3-150500.1.1 kubernetes
kubelet.ppc64le 1.35.3-150500.1.1 kubernetes
kubelet.s390x 1.35.3-150500.1.1 kubernetes
kubelet.src 1.35.3-150500.1.1 kubernetes
kubelet.x86_64 以上操作完成后重启主机检测swap分区
reboot
swapon -s 没有任何输出表示ok3）kubernetes的部署
1.安装cri-dockerd（所有主机中安装）
让kubernetes能和容器沟通
[root@master ~]# ll
总用量 11004
-rw-------. 1 root root 1000 1月 14 18:32 anaconda-ks.cfg
-rw-r--r-- 1 root root 11183248 3月 29 15:18 cri-dockerd-0.3.14-3.el8.x86_64.rpm
-rw-r--r-- 1 root root 1032 3月 29 14:46 docker.sh
-rw-r--r-- 1 root root 70188 3月 29 15:18 'libcgroup-0.41-19.el8.x86_64(1).rpm'
[root@master ~]# rpm -ivh *.rpm
警告：libcgroup-0.41-19.el8.x86_64(1).rpm: 头V4 RSA/SHA256 Signature, 密钥 ID 6d745a60: NOKEY
Verifying... ################################# [100%]
准备中... ################################# [100%]
正在升级/安装...
1:libcgroup-0.41-19.el8 ################################# [ 50%]
2:cri-dockerd-3:0.3.14-3.el8 ################################# [100%]
[root@master ~]# scp cri-dockerd-0.3.14-3.el8.x86_64.rpm libcgroup-0.41-19.el8.x86_64\(1\).rpm root@172.25.254.10:/root/
Warning: Permanently added '172.25.254.10' (ED25519) to the list of known hosts.
cri-dockerd-0.3.14-3.el8.x86_64.rpm 100% 11MB 232.2MB/s 00:00
libcgroup-0.41-19.el8.x86_64(1).rpm 100% 69KB 26.0MB/s 00:00
[root@master ~]# ^C
[root@master ~]# scp cri-dockerd-0.3.14-3.el8.x86_64.rpm libcgroup-0.41-19.el8.x86_64\(1\).rpm root@172.25.254.20:/root/
Warning: Permanently added '172.25.254.20' (ED25519) to the list of known hosts.
cri-dockerd-0.3.14-3.el8.x86_64.rpm 100% 11MB 229.7MB/s 00:00
libcgroup-0.41-19.el8.x86_64(1).rpm 100% 69KB 21.7MB/s 00:00
[root@master ~]# vim /lib/systemd/system/cri-docker.service
10 ExecStart=/usr/bin/cri-dockerd --container-runtime-endpoint fd:// --network-plugin=cni --pod-infra-container-image=reg.ti minglee.org/k8s/pause:3.10.1
[root@master ~]# systemctl enable --now cri-docker
Created symlink /etc/systemd/system/multi-user.target.wants/cri-docker.service → /usr/lib/systemd/system/cri-docker.service.
[root@master ~]# ll /var/run/cri-dockerd.sock
srw-rw---- 1 root docker 0 3月 29 16:58 /var/run/cri-dockerd.sock
2.安装构建kubernetes 集群所需软件
master节点
dnf install kubelet kubeadm kubectl -y systemctl enable --now kubelet.service
node节点
dnf install kubelet kubeadm -y systemctl enable --now kubelet.service
master节点中 kubectl 和kubeadm 补齐
[root@master ~]# echo "source <(kubectl completion bash)" >> ~/.bashrc [root@master ~]# echo "source <(kubeadm completion bash)" >> ~/.bashrc [root@master ~]# source ~/.bashrc
3.下载kubernetes集群所需镜像
下载镜像
[root@master ~]# kubeadm config images pull \ --image-repository registry.aliyuncs.com/google_containers \ --kubernetes-version v1.35.3 \ --cri-socket=unix:///var/run/cri-dockerd.sock [config/images] Pulled registry.aliyuncs.com/google_containers/kube-apiserver:v1.35.3 [config/images] Pulled registry.aliyuncs.com/google_containers/kube-controller-manager:v1.35.3 [config/images] Pulled registry.aliyuncs.com/google_containers/kube-scheduler:v1.35.3 [config/images] Pulled registry.aliyuncs.com/google_containers/kube-proxy:v1.35.3 [config/images] Pulled registry.aliyuncs.com/google_containers/coredns:v1.13.1 [config/images] Pulled registry.aliyuncs.com/google_containers/pause:3.10.1 [config/images] Pulled registry.aliyuncs.com/google_containers/etcd:3.6.6-0
上传镜像到本地harbor
[root@master ~]# docker login reg.timinglee.org -u admin
Password:
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
Login Succeeded
[root@master ~]# docker images --format "{{.Repository}}:{{.Tag}}" | awk -F "/" '/google/{system("docker tag "$0" reg.timinglee.org/k8s/"$3)}'
上传前建立项目k8s
[root@master ~]# docker images --format "{{.Repository}}:{{.Tag}}" | awk -F "/" '/timinglee/{system("docker push "$0)}'
4.在master中初始化kubernetes集群
在master中完成集群初始化
[root@master ~]# kubeadm init --pod-network-cidr=10.244.0.0/16 \ --image-repository reg.timinglee.org/k8s \ --kubernetes-version v1.35.3 \ --cri-socket=unix:///var/run/cri-dockerd.sock .... #每个人不一样，其他主机加入本集群的凭证 kubeadm join 172.25.254.100:6443 --token sve1az.48chk6mejmxk0155 \ --discovery-token-ca-cert-hash sha256:9106231c437bc69a93b826056834105188c1d15ed727a454cf5555e5f8656efd #如果忘记 [root@master ~]# kubeadm token create --print-join-command kubeadm join 172.25.254.100:6443 --token 90lrch.doimzlolqdzq0ucz --discovery-token-ca-cert-hash sha256:9106231c437bc69a93b826056834105188c1d15ed727a454cf5555e5f8656efd #如果初始化出问题 [root@master ~]# kubeadm reset --cri-socket=unix:///var/run/cri-dockerd.sock #可以重置集群设定
添加kubernets环境变量到本机
[root@master ~]# echo "export KUBECONFIG=/etc/kubernetes/admin.conf" > ~/.bash_profile [root@master ~]# source ~/.bash_profile [root@master ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION master NotReady control-plane 102s v1.35.3 让 root 用户每次登录服务器时，都能自动加载 Kubernetes 管理员认证配置，从而可以直接使用 kubectl命令管理集群
.bash_profile 是 Linux 登录时自动执行的脚本。
你把这行写进去，就等于告诉系统：
每次我登录 root，都自动设置 KUBECONFIG 环境变量。
环境变量 KUBECONFIG 的作用：
告诉 kubectl 去读取哪个配置文件进行认证
添加node节点到本集群
[root@node2 ~]# kubeadm join 172.25.254.100:6443 --token khe28f.truy56vti7ha92zw --discovery-token-ca-cert-hash sha256:9106231c437bc69a93b826056834105188c1d15ed727a454cf5555e5f8656efd --cri-socket=unix:///var/run/cri-dockerd.sock
[preflight] Running pre-flight checks
[WARNING ContainerRuntimeVersion]: You must update your container runtime to a version that supports the CRI method RuntimeConfig. Falling back to using cgroupDriver from kubelet config will be removed in 1.36. For more information, see https://git.k8s.io/enhancements/keps/sig-node/4033-group-driver-detection-over-cri
[WARNING SystemVerification]: kernel release 5.14.0-570.12.1.el9_6.x86_64 is unsupported. Supported LTS versions from the 5.x series are 5.4, 5.10 and 5.15. Any 6.x version is also supported. For cgroups v2 support, the recommended version is 5.10 or newer
[preflight] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[preflight] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/instance-config.yaml"
[patches] Applied patch of type "application/strategic-merge-patch+json" to target "kubeletconfiguration"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet at http://127.0.0.1:10248/healthz. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 504.851566ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
[root@node2 ~]##测试
[root@master ~]# kubectl get nodes #可以看到集群中主机但是因为网络插件问题状态是NotReady
NAME STATUS ROLES AGE VERSION
master NotReady control-plane 6m32s v1.35.3
node1 NotReady <none> 58s v1.35.3
node2 NotReady <none> 96s v1.35.3
5.安装网络插件
[root@master ~]# ls
anaconda-ks.cfg flannel-0.28.1.tar libcgroup-0.41-19.el8.x86_64.rpm
cri-dockerd-0.3.14-3.el8.x86_64.rpm kube-flannel.yml
[root@master ~]# docker load -i flannel-0.28.1.tar
[root@master ~]# docker tag ghcr.io/flannel-io/flannel-cni-plugin:v1.9.0-flannel1 reg.timinglee.org/flannel-io/flannel-cni-plugin:v1.9.0-flannel1
[root@master ~]# docker push reg.timinglee.org/flannel-io/flannel-cni-plugin:v1.9.0-flannel1
The push refers to repository [reg.timinglee.org/flannel-io/flannel-cni-plugin]
2c8aa52d4746: Pushed
5aa68bbbc67e: Pushed
v1.9.0-flannel1: digest: sha256:b3d30c221113b30fea3e8a7fccb145e929b097d0319b9eeb6b5a591b10b5c671 size: 739[root@master ~]# docker tag ghcr.io/flannel-io/flannel:v0.28.1 reg.timinglee.org/flannel-io/flannel:v0.28.1
[root@master ~]# docker push reg.timinglee.org/flannel-io/flannel:v0.28.1
The push refers to repository [reg.timinglee.org/flannel-io/flannel]
5668da16a30b: Pushed
5f70bf18a086: Pushed
00012e17b6cc: Pushed
9738bb9596cf: Pushed
b6233bc105d7: Pushed
03767449b95b: Pushed
9a7d8cf9ff51: Pushed
13a60c10faeb: Pushed
70dc5e033175: Pushed
256f393e029f: Pushed
v0.28.1: digest: sha256:e671adbc267460164555159210066d3304a43e3b5dd85cc0b5b6ad62e83aab52 size: 2414
[root@master ~]# vim kube-flannel.yml
image: flannel-io/flannel:v0.28.1
image: flannel-io/flannel-cni-plugin:v1.9.0-flannel1
image: flannel-io/flannel:v0.28.1
[root@master ~]# kubectl apply -f kube-flannel.yml
namespace/kube-flannel created
serviceaccount/flannel created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created
#测试
[root@master ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master Ready control-plane 13m v1.35.3
node1 Ready <none> 9m44s v1.35.3
node2 Ready <none> 9m36s v1.35.3
汇聚全球AI编程工具，助力开发者即刻编程。
更多推荐
9
0- 0
已为社区贡献2条内容
所有评论(0)