一、安裝環境
| 角色 | 服務器地址 | 組件 |
| master | 192.168.174.140 | kube-apiserver，kube-controller-manager，kube-scheduler etcd |
| node | 192.168.174.151 | kube-proxy，flannel，kubelet，docker，etcd |
| node | 192.168.174.190 | kube-proxy，flannel，kubelet，docker，etcd |
二、安裝步驟
1、安裝cfssl工具
在其中一台安裝即可，用來生成簽署各組件的證書。
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl mv cfssljson_linux-amd64 /usr/local/bin/cfssljson mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
2、部署etcd集群
生成三個文件：ca-config.json, ca-csr.json, server-csr.json
# cat ca-config.json
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"www": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
# cat ca-csr.json
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Beijing",
"ST": "Beijing"
}
]
}
# cat server-csr.json
{
"CN": "etcd",
"hosts": [
"192.168.174.140",
"192.168.174.151,
"192.168.174.190"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
生成證書文件：
cfssl gencert -initca ca-csr.json | cfssljson -bare ca - cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server # ls *pem ca-key.pem ca.pem server-key.pem server.pem
下載etcd：
二進制包下載地址：https://github.com/coreos/etcd/releases/tag/v3.2.12
mkdir /opt/etcd/{bin,cfg,ssl} -p tar zxvf etcd-v3.2.12-linux-amd64.tar.gz mv etcd-v3.2.12-linux-amd64/{etcd,etcdctl} /opt/etcd/bin/
創建etcd配置文件：
這里的配置文件，除了節點名，服務器當前IP不同，其他都相同，在其他節點進行相同的操作。
# cat /opt/etcd/cfg/etcd #[Member] ETCD_NAME="etcd01" ETCD_DATA_DIR="/var/lib/etcd/default.etcd" ETCD_LISTEN_PEER_URLS="https://192.168.174.140:2380" ETCD_LISTEN_CLIENT_URLS="https://192.168.174.140:2379" #[Clustering] ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.174.140:2380" ETCD_ADVERTISE_CLIENT_URLS="https://192.168.174.140:2379" ETCD_INITIAL_CLUSTER="etcd01=https://192.168.174.140:2380,etcd02=https://192.168.174.151:2380,etcd03=https://192.168.174.190:2380" ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster" ETCD_INITIAL_CLUSTER_STATE="new"
以下是各選項的說明：
ETCD_NAME 節點名稱
ETCD_DATA_DIR 數據目錄
ETCD_LISTEN_PEER_URLS 集群通信監聽地址
ETCD_LISTEN_CLIENT_URLS 客戶端訪問監聽地址
ETCD_INITIAL_ADVERTISE_PEER_URLS 集群通告地址
ETCD_ADVERTISE_CLIENT_URLS 客戶端通告地址
ETCD_INITIAL_CLUSTER 集群節點地址
ETCD_INITIAL_CLUSTER_TOKEN 集群Token
ETCD_INITIAL_CLUSTER_STATE 加入集群的當前狀態，new是新集群，existing表示加入已有集群
配置etcd啟動文件：
[Unit] Description=Etcd Server After=network.target After=network-online.target Wants=network-online.target [Service] Type=notify EnvironmentFile=/opt/etcd/cfg/etcd ExecStart=/opt/etcd/bin/etcd \ --name=${ETCD_NAME} \ --data-dir=${ETCD_DATA_DIR} \ --listen-peer-urls=${ETCD_LISTEN_PEER_URLS} \ --listen-client-urls=${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \ --advertise-client-urls=${ETCD_ADVERTISE_CLIENT_URLS} \ --initial-advertise-peer-urls=${ETCD_INITIAL_ADVERTISE_PEER_URLS} \ --initial-cluster=${ETCD_INITIAL_CLUSTER} \ --initial-cluster-token=${ETCD_INITIAL_CLUSTER_TOKEN} \ --initial-cluster-state=new \ --cert-file=/opt/etcd/ssl/server.pem \ --key-file=/opt/etcd/ssl/server-key.pem \ --peer-cert-file=/opt/etcd/ssl/server.pem \ --peer-key-file=/opt/etcd/ssl/server-key.pem \ --trusted-ca-file=/opt/etcd/ssl/ca.pem \ --peer-trusted-ca-file=/opt/etcd/ssl/ca.pem Restart=on-failure LimitNOFILE=65536 [Install] WantedBy=multi-user.target
把剛才證書移動到ssl目錄下：
cp ca*pem server*pem /opt/etcd/ssl
在3個節點都進行以上部署etcd集群的操作。
啟動etcd集群。
# systemctl start etcd # systemctl enable etcd
集群健康狀態檢查。
/opt/etcd/bin/etcdctl \ --ca-file=ca.pem --cert-file=server.pem --key-file=server-key.pem \ --endpoints="https://192.168.174.140:2379,https://192.168.174.151:2379,https://192.168.174.190:2379" \ cluster-health
出現以下輸出就說明集群是健康的。
至此，etcd集群安裝成功。
3、在node節點安裝docker組件
# yum install -y yum-utils device-mapper-persistent-data lvm2
# yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
# yum install docker-ce -y
# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://bc437cce.m.daocloud.io
# systemctl start docker
# systemctl enable docker
4、安裝flannel組件
Falnnel要用etcd存儲自身一個子網信息，所以要保證能成功連接Etcd，寫入預定義子網段：
/opt/etcd/bin/etcdctl \ --ca-file=ca.pem --cert-file=server.pem --key-file=server-key.pem \ --endpoints="https://192.168.174.140:2379,https://192.168.174.151:2379,https://192.168.174.190:2379" \ set /coreos.com/network/config '{ "Network": "172.17.0.0/16", "Backend": {"Type": "vxlan"}}'
以下操作在所有的node節點上運行：
# wget https://github.com/coreos/flannel/releases/download/v0.10.0/flannel-v0.10.0-linux-amd64.tar.gz # tar zxvf flannel-v0.9.1-linux-amd64.tar.gz # cp flanneld mk-docker-opts.sh /usr/bin
# cp flanneld mk-docker-opts.sh /opt/kubernetes/bin/
flannel配置文件:
cat /opt/kubernetes/cfg/flanneld:
FLANNEL_OPTIONS="--etcd-endpoints=https://192.168.174.140:2379,https://192.168.174.151:2379,https://192.168.174.190:2379 -etcd-cafile=/opt/etcd/ssl/ca.pem -etcd-certfile=/opt/etcd/ssl/server.pem -etcd-keyfile=/opt/etcd/ssl/server-key.pem"
配置flannel啟動文件：
# cat /usr/lib/systemd/system/flanneld.service [Unit] Description=Flanneld overlay address etcd agent After=network-online.target network.target Before=docker.service [Service] Type=notify EnvironmentFile=/opt/kubernetes/cfg/flanneld ExecStart=/opt/kubernetes/bin/flanneld --ip-masq $FLANNEL_OPTIONS ExecStartPost=/opt/kubernetes/bin/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/subnet.env Restart=on-failure [Install] WantedBy=multi-user.target
配置docker啟動文件，用來指定和flannel同網段：
# cat /usr/lib/systemd/system/docker.service [Unit] Description=Docker Application Container Engine Documentation=https://docs.docker.com After=network-online.target firewalld.service Wants=network-online.target [Service] Type=notify EnvironmentFile=/run/flannel/subnet.env ExecStart=/usr/bin/dockerd $DOCKER_NETWORK_OPTIONS ExecReload=/bin/kill -s HUP $MAINPID LimitNOFILE=infinity LimitNPROC=infinity LimitCORE=infinity TimeoutStartSec=0 Delegate=yes KillMode=process Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target
重啟服務：
# systemctl daemon-reload
# systemctl start flanneld
# systemctl enable flanneld
# systemctl restart docker
確保docker0與flannel.1在同一網段。 測試不同節點互通，在當前節點訪問另一個Node節點docker0 IP，確保能通信。
部署master節點組件
# cat ca-config.json { "signing": { "default": { "expiry": "87600h" }, "profiles": { "kubernetes": { "expiry": "87600h", "usages": [ "signing", "key encipherment", "server auth", "client auth" ] } } } } # cat ca-csr.json { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "Beijing", "ST": "Beijing", "O": "k8s", "OU": "System" } ] }
生成CA證書：cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
配置apiserver證書json文件
ca server-csr.json
{ "CN": "kubernetes", "hosts": [ "10.0.0.1", "127.0.0.1", "192.168.174.140","kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster", "kubernetes.default.svc.cluster.local" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] }
生成apiserver證書：cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
並把證書復制到/opt/kubernetes/ssl/目錄下：
mv *pem /opt/kubernetes/ssl/
下載kubernetes組件地址：https://github.com/kubernetes/kubernetes/releases
# mkdir /opt/kubernetes/{bin,cfg,ssl} -p # tar zxvf kubernetes-server-linux-amd64.tar.gz # cd kubernetes/server/bin # cp kube-apiserver kube-scheduler kube-controller-manager kubectl /opt/kubernetes/bin
創建token：
# cat /opt/kubernetes/cfg/token.csv 674c457d4dcf2eefe4920d7dbb6b0ddc,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
第一列：隨機字符串，自己可生成 第二列：用戶名 第三列：UID 第四列：用戶組
api-server配置文件：
KUBE_APISERVER_OPTS="--logtostderr=true \ --v=4 \ --etcd-servers=https://192.168.174.140:2379,https://192.168.174.151:2379,https://192.168.174.190:2379 \ --bind-address=192.168.174.140 \ --secure-port=6443 \ --advertise-address=192.168.174.140 \ --allow-privileged=true \ --service-cluster-ip-range=10.0.0.0/24 \ --enable-admission-plugins=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,NodeRestriction \ --authorization-mode=RBAC,Node \ --enable-bootstrap-token-auth \ --token-auth-file=/opt/kubernetes/cfg/token.csv \ --service-node-port-range=30000-50000 \ --tls-cert-file=/opt/kubernetes/ssl/server.pem \ --tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \ --client-ca-file=/opt/kubernetes/ssl/ca.pem \ --service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \ --etcd-cafile=/opt/etcd/ssl/ca.pem \ --etcd-certfile=/opt/etcd/ssl/server.pem \ --etcd-keyfile=/opt/etcd/ssl/server-key.pem" 參數說明： --logtostderr 啟用日志 ---v 日志等級 --etcd-servers etcd集群地址 --bind-address 監聽地址 --secure-port https安全端口 --advertise-address 集群通告地址 --allow-privileged 啟用授權 --service-cluster-ip-range Service虛擬IP地址段 --enable-admission-plugins 准入控制模塊 --authorization-mode 認證授權，啟用RBAC授權和節點自管理 --enable-bootstrap-token-auth 啟用TLS bootstrap功能，后面會講到 --token-auth-file token文件 --service-node-port-range Service Node類型默認分配端口范圍
配置apiserver啟動文件：
# cat /usr/lib/systemd/system/kube-apiserver.service [Unit] Description=Kubernetes API Server Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver ExecStart=/opt/kubernetes/bin/kube-apiserver $KUBE_APISERVER_OPTS Restart=on-failure [Install] WantedBy=multi-user.target
啟動aip-server服務：
# systemctl daemon-reload # systemctl enable kube-apiserver # systemctl restart kube-apiserver
創建schduler配置文件：
# cat /opt/kubernetes/cfg/kube-scheduler KUBE_SCHEDULER_OPTS="--logtostderr=true \ --v=4 \ --master=127.0.0.1:8080 \ --leader-elect" 參數說明： --master 連接本地apiserver --leader-elect 當該組件啟動多個時，自動選舉（HA）
schduler啟動文件：
# cat /usr/lib/systemd/system/kube-scheduler.service [Unit] Description=Kubernetes Scheduler Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=-/opt/kubernetes/cfg/kube-scheduler ExecStart=/opt/kubernetes/bin/kube-scheduler $KUBE_SCHEDULER_OPTS Restart=on-failure [Install] WantedBy=multi-user.target
啟動schduler服務：
# systemctl daemon-reload # systemctl enable kube-apiserver # systemctl restart kube-apiserver
創建kube-controller-manager文件：
# cat /opt/kubernetes/cfg/kube-controller-manager KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=true \ --v=4 \ --master=127.0.0.1:8080 \ --leader-elect=true \ --address=127.0.0.1 \ --service-cluster-ip-range=10.0.0.0/24 \ --cluster-name=kubernetes \ --cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \ --cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \ --root-ca-file=/opt/kubernetes/ssl/ca.pem \ --service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem"
創建kube-controller-manage啟動文件：
# cat /usr/lib/systemd/system/kube-controller-manager.service [Unit] Description=Kubernetes Controller Manager Documentation=https://github.com/kubernetes/kubernetes [Service] EnvironmentFile=-/opt/kubernetes/cfg/kube-controller-manager ExecStart=/opt/kubernetes/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_OPTS Restart=on-failure [Install] WantedBy=multi-user.target
啟動kube-controller-manager服務：
# systemctl daemon-reload # systemctl enable kube-controller-manager # systemctl restart kube-controller-manager
檢查集群master組件是否健康：
部署node節點
將hel用戶綁定到系統集群角色
注意：這里如果不同節點的話，需要創建不同的用戶來管理。
kubectl create clusterrolebinding hel \ --clusterrole=system:node-bootstrapper \ --user=hel
創建kubeconfig文件：
export KUBE_APISERVER="https://192.168.174.140:6443" TOKEN=674c457d4dcf2eefe4920d7dbb6b0ddc # 設置集群參數，在k8s CA證書的目錄下 kubectl config set-cluster kubernetes \ --certificate-authority=./ca.pem \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=hel.kubeconfig # 設置客戶端認證參數 kubectl config set-credentials hel \ --token=${TOKEN} \ --kubeconfig=hel.kubeconfig # 設置上下文參數 kubectl config set-context default \ --cluster=kubernetes \ --user=hel \ --kubeconfig=hel.kubeconfig
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
創建kube-proxy證書：
# cat kube-proxy-csr.json { "CN": "system:kube-proxy", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] }
生成kube-proxy證書：
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy
創建kube-proxy kubeconfig文件:
kubectl config set-cluster kubernetes \ --certificate-authority=./ca.pem \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-credentials kube-proxy \ --client-certificate=./kube-proxy.pem \ --client-key=./kube-proxy-key.pem \ --embed-certs=true \ --kubeconfig=kube-proxy.kubeconfig kubectl config set-context default \ --cluster=kubernetes \ --user=kube-proxy \ --kubeconfig=kube-proxy.kubeconfig kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
將hel.kubeconfig kube-proxy.kubeconfig這兩個文件拷貝到Node節點/opt/kubernetes/cfg目錄下
在node節點上：
創建kubelet配置文件：
# cat /opt/kubernetes/cfg/kubelet KUBELET_OPTS="--logtostderr=true \ --v=4 \ --hostname-override=192.168.174.151 \ --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \ --bootstrap-kubeconfig=/opt/kubernetes/cfg/hel.kubeconfig \ --cert-dir=/opt/kubernetes/ssl \ --cluster-dns=10.0.0.2 \ --cluster-domain=cluster.local. \ --fail-swap-on=false \ --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0" 參數說明： --hostname-override 在集群中顯示的主機名 --kubeconfig 指定kubeconfig文件位置，會自動生成 --bootstrap-kubeconfig 指定剛才生成的bootstrap.kubeconfig文件 --cert-dir 頒發證書存放位置 --cluster-dns 集群DNS IP，先配置上，后面會講到 --cluster-domain DNS域 --fail-swap-on=false 禁止使用swap --pod-infra-container-image 管理Pod網絡的鏡像
創建kubelet啟動文件：
# cat /usr/lib/systemd/system/kubelet.service [Unit] Description=Kubernetes Kubelet After=docker.service Requires=docker.service [Service] EnvironmentFile=/opt/kubernetes/cfg/kubelet ExecStart=/opt/kubernetes/bin/kubelet $KUBELET_OPTS Restart=on-failure KillMode=process [Install] WantedBy=multi-user.target
啟動服務：
# systemctl daemon-reload
# systemctl enable kubelet
# systemctl restart kubelet
在Master審批Node加入集群：
啟動后還沒加入到集群中，需要手動允許該節點才可以。 在Master節點查看請求簽名的Node：
# kubectl get csr # kubectl certificate approve XXXXID # kubectl get node
部署kube-proxy組件：
創建kube-proxy配置文件：
# cat /opt/kubernetes/cfg/kube-proxy KUBE_PROXY_OPTS="--logtostderr=true \ --v=4 \ --hostname-override=192.168.174.151 \ --cluster-cidr=10.0.0.0/24 \ --kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"
創建kube-proxy啟動文件：
# cat /usr/lib/systemd/system/kube-proxy.service [Unit] Description=Kubernetes Proxy After=network.target [Service] EnvironmentFile=-/opt/kubernetes/cfg/kube-proxy ExecStart=/opt/kubernetes/bin/kube-proxy $KUBE_PROXY_OPTS Restart=on-failure [Install] WantedBy=multi-user.target
啟動服務：
# systemctl daemon-reload # systemctl enable kube-proxy # systemctl restart kube-proxy
OK，至此，k8s二進制安裝已完成。
測試是否能正常運行：
查看集群節點狀態：
說明集群創建成功。
三、測試
跑個nginx服務，測試是否能生成pod並正常被訪問：
kubectl run nginx-deploy --image=nginx --port=80 --replicas=1
