0부터 완전한 K8S 클러스터를 구축하는 방법-------CentOS 8 시스템 기반
42273 단어 K8s&&dockr 컨테이너 배열
k8s에는
세 개의 centos 노드를 만듭니다.
10.0.0.180 k8s-master
10.0.0.91 k8s-nnode1
10.0.0.136 k8s-nnode2
centos 시스템 버전 보기
[root@localhost package]# cat /etc/centos-release
CentOS Linux release 8.1.1911 (Core)
[root@localhost package]#
참고: 1단계~8단계, 모든 노드를 조작하고, 9단계, 10단계 마스터 노드 조작, 11단계 노드 조작.9, 10, 11 단계가 실패하면 kubeadm reset 명령을 통해 환경을 정리하고 다시 설치할 수 있습니다.
1. 방화벽 닫기
[root@localhost ~]# systemctl stop firewalld
참고: 닫아야 합니다.
2.selinux 닫기
setenforce 0
3. swap 닫기
[root@localhost ~]# swapoff -a
vim/etc/fstab, swap 마운트 줄을 설명하면 swap 구역을 영구적으로 닫을 수 있습니다
비고: k8s 실행은 swap 구역을 닫아야 합니다
4. 호스트 이름과 IP 간의 관계 추가
vim/etc/hosts는 다음과 같이 추가됩니다.
10.0.0.180 k8s-master
10.0.0.91 k8s-nnode1
10.0.0.136 k8s-nnode2
5. 브리지에 연결된 IPV4 트래픽을 iptables의 체인으로 전달
[root@localhost ~]# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
[root@localhost ~]# sysctl --system
6. docker 설치
이전 docker를 마운트 해제하려면 다음과 같이 하십시오.
[root@localhost ~]# sudo yum remove docker \
docker-client \
docker-client-latest \
docker-common \
docker-latest \
docker-latest-logrotate \
docker-logrotate \
docker-engine
[root@localhost ~]# sudo yum install -y yum-utils \
device-mapper-persistent-data \
lvm2
[root@localhost ~]# sudo yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
[root@localhost ~]# sudo yum install docker-ce docker-ce-cli containerd.io
설치가 완료되면 docker 버전 보기
[root@localhost ~]# docker --version
Docker version 19.03.10, build 9424aeaee9
[root@localhost ~]#
Cgroupfs를 Systemd로 수정 (docker 파일 드라이브는 기본적으로 cgroupfs에서 systemd로 변경되며, k8s와 일치하게 conflict를 피함):vim/etc/docker/daemon.json
{
"exec-opts": ["native.cgroupdriver=systemd"]
}
전원 켜기 시작을 설정하려면:
[root@localhost ~]# systemctl enable docker
[root@localhost ~]# systemctl start docker
파일 제어 보기:
[root@localhost ~]# docker info | grep Driver
Storage Driver: overlay2
Logging Driver: json-file
Cgroup Driver: systemd
[root@localhost ~]#
7.Kubernetes yum 소스 구성:
vim/etc/yum.repos.d/kubernetes.repo, 파일 추가 내용은 다음과 같습니다.
[kubernetes]
name=Kubernetes Repo
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
gpgcheck=0
enabled=1
8. k8s 설치
yum install -y docker-ce kubelet kubeadm kubectl --nobest
k8s 전원 켜기 부팅 설정
systemctl enable kubelet
k8s 백엔드 데몬 시작
systemctl start kubelet
9. Kubernetes Master 배포
[root@localhost ~]# kubeadm init --kubernetes-version=1.18.3 \
> --apiserver-advertise-address=10.0.0.180 \
> --image-repository registry.aliyuncs.com/google_containers \
> --service-cidr=10.10.0.0/16 --pod-network-cidr=10.122.0.0/16
W0529 03:59:44.481771 67801 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
[init] Using Kubernetes version: v1.18.3
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/kube-apiserver:v1.18.3: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/kube-apiserver:v1.18.3 not found
, error: exit status 1
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/kube-controller-manager:v1.18.3: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/kube-controller-manager:v1.18.3 not found
, error: exit status 1
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/kube-scheduler:v1.18.3: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/kube-scheduler:v1.18.3 not found
, error: exit status 1
[ERROR ImagePull]: failed to pull image registry.aliyuncs.com/google_containers/kube-proxy:v1.18.3: output: Error response from daemon: manifest for registry.aliyuncs.com/google_containers/kube-proxy:v1.18.3 not found
, error: exit status 1
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher
[root@localhost ~]# kubeadm init --kubernetes-version=1.18.0 --apiserver-advertise-address=10.0.0.180 --image-repository registry.aliyuncs.com/google_containers --service-cidr=10.10.0.0/16 --pod-network-cidr=10.122.0.0/16
W0529 04:00:11.903932 68144 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
[init] Using Kubernetes version: v1.18.0
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [k8s-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.10.0.1 10.0.0.180]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [k8s-master localhost] and IPs [10.0.0.180 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [k8s-master localhost] and IPs [10.0.0.180 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
W0529 04:01:28.678836 68144 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[control-plane] Creating static Pod manifest for "kube-scheduler"
W0529 04:01:28.679847 68144 manifests.go:225] the default kube-apiserver authorization-mode is "Node,RBAC"; using "Node,RBAC"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[apiclient] All control plane components are healthy after 24.510178 seconds
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config-1.18" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node k8s-master as control-plane by adding the label "node-role.kubernetes.io/master=''"
[mark-control-plane] Marking the node k8s-master as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: 8urlva.75zrerl6uctfenec
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.0.0.180:6443 --token 8urlva.75zrerl6uctfenec \
--discovery-token-ca-cert-hash sha256:c462c05da6c3685a334b1b1743d4d9b30a38b78208c338f03f5e7d67befaf8bb
[root@localhost ~]#
생성된 마지막 부분의 내용을 기록합니다. 이 내용은 다른 노드가 Kubernetes 그룹에 가입하기 전에 실행해야 합니다.init 이후의 알림에 따라kubectl 프로필을 만듭니다
[root@master01 ~]# mkdir -p $HOME/.kube
[root@master01 ~]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@master01 ~]# sudo chown $(id -u):$(id -g) $HOME/.kube/config
docker 미러를 보려면 다음과 같이 하십시오.
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.aliyuncs.com/google_containers/kube-proxy v1.18.0 43940c34f24f 2 months ago 117MB
registry.aliyuncs.com/google_containers/kube-controller-manager v1.18.0 d3e55153f52f 2 months ago 162MB
registry.aliyuncs.com/google_containers/kube-scheduler v1.18.0 a31f78c7c8ce 2 months ago 95.3MB
registry.aliyuncs.com/google_containers/kube-apiserver v1.18.0 74060cea7f70 2 months ago 173MB
registry.aliyuncs.com/google_containers/pause 3.2 80d28bedfe5d 3 months ago 683kB
registry.aliyuncs.com/google_containers/coredns 1.6.7 67da37a9a360 4 months ago 43.8MB
registry.aliyuncs.com/google_containers/etcd 3.4.3-0 303ce5db0e90 7 months ago 288MB
[root@localhost ~]#
kube-apiserver는 기본적으로 보안 접근 인터페이스 6443만 시작하고 설치되지 않은 접근 인터페이스 8080을 시작하지 않기 때문에kubectl은 8080 포트를 통해 k8s kubelet에 접근하기 때문에 설정 파일을 수정하여 8080 포트 접근을 지원하도록 합니다:
vim/etc/kubernetes/manifests/kube-apiserver.yaml에서 – insecure-port=0을: – insecure-port=8080으로 수정
다음은 바로 kubectl 명령을 사용할 수 있습니다.
[root@localhost ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady master 28m v1.18.3
[root@localhost ~]#
10. calico 네트워크 설치
[root@localhost ~]# kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrolebinding.rbac.authorization.k8s.io/calico-node created
daemonset.apps/calico-node created
serviceaccount/calico-node created
deployment.apps/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
[root@localhost ~]#
마스터 노드 상태를 보려면:
[root@localhost ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master NotReady master 41m v1.18.3
[root@localhost ~]#
calico 네트워크가 성공적으로 생성되었는지 확인합니다.
[root@localhost ~]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
calico-kube-controllers-76d4774d89-78vpw 0/1 ContainerCreating 0 3m47s
calico-node-vqt8t 0/1 PodInitializing 0 3m47s
coredns-7ff77c879f-bmkxb 0/1 ContainerCreating 0 45m
coredns-7ff77c879f-pmlm9 0/1 ContainerCreating 0 45m
etcd-k8s-master 1/1 Running 0 45m
kube-apiserver-k8s-master 1/1 Running 0 17m
kube-controller-manager-k8s-master 1/1 Running 1 45m
kube-proxy-2rsm4 1/1 Running 0 45m
kube-scheduler-k8s-master 1/1 Running 1 45m
[root@localhost ~]#
노드를 다시 보면 마스터 노드 상태가ready인 것을 볼 수 있습니다
[root@localhost ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
k8s-master Ready master 45m v1.18.3
[root@localhost ~]#
kubernetes-dashboard 설치 (잠시 사용하지 않음, 생략)
이로써 k8s 마스터 노드가 생성되었습니다.
11. 노드가 클러스터에 참여
그룹에 새 노드를 추가하고 kubeadm init에서 출력하는kubeadm join 명령을 실행합니다: 위 명령을 복사하고 node 노드에서 k8s-nnode1에서 실행합니다:
[root@localhost ~]# kubeadm join 10.0.0.180:6443 --token 8urlva.75zrerl6uctfenec \
> --discovery-token-ca-cert-hash sha256:c462c05da6c3685a334b1b1743d4d9b30a38b78208c338f03f5e7d67befaf8bb
W0529 04:52:05.907097 67097 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
[root@localhost ~]#
k8s-nnode2에서 실행:
[root@localhost package]# kubeadm join 10.0.0.180:6443 --token 8urlva.75zrerl6uctfenec \
> --discovery-token-ca-cert-hash sha256:c462c05da6c3685a334b1b1743d4d9b30a38b78208c338f03f5e7d67befaf8bb
W0529 04:52:32.100812 66117 join.go:346] [preflight] WARNING: JoinControlPane.controlPlane settings will be ignored when control-plane flag is not set.
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[kubelet-start] Downloading configuration for the kubelet from the "kubelet-config-1.18" ConfigMap in the kube-system namespace
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
[root@localhost package]#
k8s-master에서 그룹 노드 보기:
[root@localhost ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
k8s-master Ready master 52m v1.18.3
k8s-nnode1 Ready <none> 2m29s v1.18.3
k8s-nnode2 Ready <none> 2m3s v1.18.3
[root@localhost ~]#
테스트k8s:
[root@localhost ~]# kubectl get namespace
NAME STATUS AGE
default Active 53m
kube-node-lease Active 53m
kube-public Active 53m
kube-system Active 53m
[root@localhost ~]# kubectl create namespace test
namespace/test created
[root@localhost ~]# kubectl get namespace
NAME STATUS AGE
default Active 54m
kube-node-lease Active 54m
kube-public Active 54m
kube-system Active 54m
test Active 2s
[root@localhost ~]# kubectl get pods
NAME READY STATUS RESTARTS AGE
nginx-f89759699-9265g 1/1 Running 0 65s
[root@localhost ~]#
nginx 인스턴스를 생성하고 포트를 노출하려면 다음과 같이 하십시오.
[root@localhost ~]# kubectl create deployment nginx --image=nginx
[root@localhost ~]# kubectl expose deployment nginx --port=80 --type=NodePort
[root@localhost ~]# kubectl get pod,svc
[root@localhost ~]# kubectl get pod,svc
NAME READY STATUS RESTARTS AGE
pod/nginx-f89759699-9265g 1/1 Running 0 5m30s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.10.0.1 <none> 443/TCP 62m
service/nginx NodePort 10.10.19.203 <none> 80:31806/TCP 2m29s
[root@localhost ~]#
웹 브라우저에서 아래 주소를 입력하면nginx 환영 인터페이스로 돌아갑니다http://10.0.0.180:31806/
linux 노드에서curl로 방문하면nginxhtml 환영 페이지의 내용을 되돌려줍니다
[root@localhost ~]# curl http://10.0.0.180:31806/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
[root@localhost ~]#
이 내용에 흥미가 있습니까?
현재 기사가 여러분의 문제를 해결하지 못하는 경우 AI 엔진은 머신러닝 분석(스마트 모델이 방금 만들어져 부정확한 경우가 있을 수 있음)을 통해 가장 유사한 기사를 추천합니다:
java oop 17 변수의 초기화변수의 초기화 지역변수(lv)는 수동 초기화 해야함(사용전에 꼭 직접 초기화해줘야 한다.) 멤버변수(iv,cv)는 자동초기화 된다. 자동초기화시 기본값 boolean false char '\u0000' byte,sh...
텍스트를 자유롭게 공유하거나 복사할 수 있습니다.하지만 이 문서의 URL은 참조 URL로 남겨 두십시오.
CC BY-SA 2.5, CC BY-SA 3.0 및 CC BY-SA 4.0에 따라 라이센스가 부여됩니다.
좋은 웹페이지 즐겨찾기
