一.集群服务器配置信息展示
| 角色 | IP地址 | 组件 | 规格 |
| k8s-master1 | 192.168.0.201 | kube-apiserver |
1C 2G |
| k8s-master2 | 192.168.0.202 | kube-apiserver |
1C 2G |
| k8s-node1 | 192.168.0.203 | kube-proxy |
1C 2G |
| k8s-node2 | 192.168.0.204 | kube-proxy |
1C 2G |
| Load Balancer(负载均衡) | 192.168.0.205 VIP:192.168.0.200 |
Nginx | 1C 2G |
| Load Balancer(负载均衡) | 192.168.0.206 | Nginx | 1C 2G |
二.搭建一主二从的单集群模式(使用k8s-master1,k8s-node1,k8s-node2三台机器)
（1）系统初始化(可三台机器同时操作)
关闭防火墙：
systemctl stop firewalld
systemctl disable firewalld
关闭selinux：
setenforce 0
sed -i 's/enforcing/disabled/' /etc/selinux/config
关闭swap：
swapoff -a
sed -ri 's/.*swap.*/#&/' /etc/fstab
同步服务器时间为win系统时间：
yum install ntpdate -y
ntpdate time.windows.com
添加hosts,所有机器都添加本身和其它的：
vi /etc/hosts
192.168.0.201 k8s-master1
192.168.0.203 k8s-node1
192.168.0.204 k8s-node2
分别修改主机名：
hostnamectl set-hostname k8s-master1
hostnamectl set-hostname k8s-node1
hostnamectl set-hostname k8s-node2
（2）集群证书安装配置(可在任意一台操作，如在k8s-master1上操作)
上传 TLS.tar.gz 到服务器/usr/local/k8s下
mkdir /usr/local/k8s 解压证书文件 cd /usr/local/k8s tar -zxvf TLS.tar.gz 执行脚本文件将证书拷贝到/usr/local/bin下 cd /usr/local/k8s/TLS ./cfssl.sh 修改相关配置文件自动生成证书 cd /usr/local/k8s/TLS/etcd vi server-csr.json 将hosts中的IP改为192.168.0.201，192.168.0.203，192.168.0.204
./generate_etcd_cert.sh #脚本生成证书
部署三个Etcd节点，上传 etcd.tar.gz 到服务器/usr/local/k8s下
解压etcd压缩文件
cd /usr/local/k8s
tar -zxvf etcd.tar.gz
etcd文件迁移
mv etcd /opt/
mv etcd.service /usr/lib/systemd/system
vi /opt/etcd/cfg/etcd.conf
修改etcd-2和etcd-3的IP分别改为192.168.0.203，192.168.0.204,其它IP均改为192.168.0.201
etcd证书文件迁移
cd /usr/local/k8s/TLS/etcd
cp {ca,server,server-key}.pem /opt/etcd/ssl #都写 y
分别拷贝Etcd到另外两个节点
scp -r /opt/etcd root@192.168.0.203:/opt
scp -r /opt/etcd root@192.168.0.204:/opt
scp /usr/lib/systemd/system/etcd.service root@192.168.0.203:/usr/lib/systemd/system
scp /usr/lib/systemd/system/etcd.service root@192.168.0.204:/usr/lib/systemd/system
分别登陆k8s-node1和k8s-node2两台服务器修改配置文件
vi /opt/etcd/cfg/etcd.conf
分别将ETCD_NAME改为etcd-2和etcd-3
除集群参数行ETCD_INITIAL_CLUSTER的IP不动外，其它IP均分别改为192.168.0.203和192.168.0.204
重启etcd使配置文件生效并设置开机自启动(三台机器均要执行)
systemctl start etcd
systemctl enable etcd
如启动失败报错，可执行 journalctl -xe 查看报错信息后调整，若无，跳过
查看集群健康状态
/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints="https://192.168.0.201:2379,https://192.168.0.203:2379,https://192.168.0.204:2379" cluster-health
显示
则成功
为APIServer生成证书，修改请求文件中hosts字段包含所有etcd节点IP
cd /usr/local/k8s/TLS/k8s
vi server-csr.json
生产证书
./generate_k8s_cert.sh
(3)Master节点部署apiserver，controller-manager和scheduler(在k8s-master1上操作)
上传 k8s-master.tar.gz 到服务器/usr/local/k8s下
解压etcd压缩文件
cd /usr/local/k8s
tar -zxvf k8s-master.tar.gz
修改配置文件中的IP信息
cd /usr/local/k8s/kubernetes/cfg
vi kube-apiserver.conf
复制证书到ssl目录
cd /usr/local/k8s/TLS/k8s
cp *.pem /usr/local/k8s/kubernetes/ssl/
cp -rf /usr/local/k8s/kubernetes /opt
cd /usr/local/k8s
cp *.service /usr/lib/systemd/system
各组件启动
systemctl start kube-apiserver
systemctl start kube-controller-manager
systemctl start kube-scheduler
systemctl enable kube-apiserver
systemctl enable kube-controller-manager
systemctl enable kube-scheduler
ps -ef|grep kube 查看组件进程是否启动
授权启用TLS
cd /opt/kubernetes/bin
cp kubectl /bin/
给kubelet-bootstrap授权
kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap
(4)部署Node节点组件(所有node节点可同时操作)
上传 k8s-node.tar.gz 到服务器/usr/local/k8s下,部署docker
cd /usr/local/k8s
tar -zxvf k8s-node.tar.gz
tar -zxvf docker-18.09.6.tgz
mv docker/* /usr/bin
mkdir /etc/docker
vi daemon.json 中的IP为master的IP
mv daemon.json /etc/docker/
mv docker.service /usr/lib/systemd/system
systemctl start docker
systemctl enable docker
部署kubelet和kube-proxy
cp kubelet.service kube-proxy.service /usr/lib/systemd/system
mv kubernetes /opt
从master中拷贝证书到当前的node节点(仅下两条命令操作k8s-master1服务器)
cd /usr/local/k8s/TLS/k8s
scp ca.pem kube-proxy*.pem root@192.168.0.203:/opt/kubernetes/ssl/
scp ca.pem kube-proxy*.pem root@192.168.0.204:/opt/kubernetes/ssl/
修改以下两个配置文件中IP地址
cd /opt/kubernetes/cfg
vi kube-proxy.kubeconfig
vi bootstrap.kubeconfig
各组件启动
systemctl start kubelet
systemctl start kube-proxy
systemctl enable kubelet
systemctl enable kube-proxy
master给Node颁发证书(仅下三条命令操作k8s-master1服务器)
kubectl get csr
//将上条命令生成的NMAE属性加到 kubectl certificate approve后面
kubectl certificate approve node-csr-MYUxbmf_nmPQjmH3LkbZRL2uTO-_FCzDQUoUfTy7YjI
kubectl get node
(5)AAAAA