跳到主要内容

k8s 安装(通过 kubeadm 安装)

各组件作用介绍​

  • kubectl：向apiServer发送请求，执行相关的操作，如create，edit，delete，log...
  • controller manager：监听apiServer，确认每个节点的信息，状态，以及pod控制器管理
  • scheduler：监听当前没用绑定信息nodename为空的pod，根据pod配置亲和性来合理的调度到节点去关联
  • kubelet：监听当前节点需要运行哪些pod，调用cri接口实现容器的创建
  • kube-proxy：监听apiServer上节点相关的IPVS规则和防火墙规则，实现网络规则的制订

1.安装 docker(所有主机要安装)​

安装 docker 环境​

# 安装自动补全
yum install -y bash-completion
echo "source <(kubectl completion bash)" >> ~/.bashrc

# 一些工具
yum -y install wget psmisc vim net-tools nfs-utils telnet yum-utils device-mapper-persistent-data lvm2 git tar curl ipvsadm

# 关闭swap,selinux
# 永久关闭swap
sed -ri 's/.*swap.*/#&/' /etc/fstab
# 临时关闭
swapoff -a
# 查看状态
free -h | grep Swap
swapon --show

# 临时关闭selinux
setenforce 0
# 查看状态
getenforce
# 永久关闭
sed -ri 's/SELINUX=enforcing/SELINUX=disabled/'  /etc/selinux/config

# 加载bridge
yum install -y epel-release
yum install -y bridge-utils

modprobe br_netfilter &&
echo "br_netfilter" >> /etc/modules-load.d/bridge.conf &&
echo "net.bridge.bridge-nf-call-iptables=1" >> /etc/sysctl.conf &&
echo "net.bridge.bridge-nf-call-iptables=1" >> /etc/sysctl.conf &&
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf &&
sysctl -p

cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system

时间同步​

# 服务端
yum install -y chrony
cat > /etc/chrony.conf << EOF
pool ntp1.aliyun.com iburst
pool ntp2.aliyun.com iburst
pool ntp3.aliyun.com iburst
driftfile /var/lib/chrony/drify
makestep 1.0 3
rtcsync
allow 192.168.123.0/24
local stratum 10
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony
EOF

systemctl restart chronyd
systemctl enable --now chronyd

# 客户端
yum install chrony -y
cat > /etc/chrony.conf << EOF
pool 192.168.123.10 iburst
pool 192.168.123.11 iburst
pool 192.168.123.12 iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony
EOF

systemctl restart chronyd
systemctl enable --now chronyd

# 客户端验证
chronyc sources -v

docker换源​

# 进行简易代理
vim ~/.bash_profile
alias proxyOn='export http_proxy=http://192.168.123.5:7897; export https_proxy=http_proxy=http://192.168.123.5:7897'
alias proxyOff='unset http_proxy; unset https_proxy'

# 添加docker-ce yum源
# 中科大
sudo dnf config-manager --add-repo https://mirrors.ustc.edu.cn/dockerce/linux/centos/docker-ce.repo
# 阿里
sudo dnf config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

cd /etc/yum.repos.d
# 切换中科大源
sed -o 's|download.docker.com|mirrors.ustc.edu.cn/docker-ce|g' docker-ce.repo
sudo yum makecache

# 安装docker-ce
yum -y install docker-ce

# 配置daemon
cat <<EOF>>/etc/docker/daemon.json
{
        "default-ipc-mode": "shareable",
        "data-root": "/data/docker",
        "exec-opts": ["native.cgroupdriver=systemd"],
        "log-driver": "json-file",
        "log-opts": {
                "max-size": "100m",
                "max-file": "100"
        },
        "insecure-registries": ["harbor.xinxainghf.com"],
        "registry-mirrors": [
        "https://zemxtma9.mirror.aliyuncs.com",
        "https://dockerproxy.com",
        "https://mirror.baidubce.com",
        "https://docker.m.daocloud.io",
        "https://docker.nju.edu.cn",
        "https://docker.mirrors.sjtug.sjtu.edu.cn"
    ]
}
EOF

# 重启服务
mkdir -p /etc/systemd/system/docker.service.d &&
systemctl daemon-reload && systemctl restart docker && systemctl enable docker

2.安装 cri-dockerd(所有主机要安装)​

前往下载可执行压缩包​

https://github.com/Mirantis/cri-dockerd/releases
wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.0/cri-dockerd-0.4.0-3.fc35.x86_64.rpm
wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.0/cri-dockerd-0.4.0.amd64.tgz

解压获取可执行文件移动到/usr/bin​

tar -zxvf *.tar.gz
mv cri-dockerd/cri-dockerd /usr/bin/
chmod +x /usr/bin/cri-dockerd

创建服务文件​

cat <<EOF>>/usr/lib/systemd/system/cri-docker.service
[Unit]
Description=CRI Interface for Docker Application Container Engine
Documentation=https://docs.mirantis.com
After=network-online.target firewalld.service docker.service
Wants=network-online.target
Requires=cri-docker.socket

[Service]
Type=notify
ExecStart=/usr/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.7
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
StartLimitBurst=3
StartLimitInterval=60s
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
Delegate=yes
KillMode=process

[Install]
WantedBy=multi-user.target
EOF

创建 socket 文件并启动​

cat >>/usr/lib/systemd/system/cri-docker.socket<<EOF
[Unit]
Description=CRI Docker Socket for the API
PartOf=cri-docker.service

[Socket]
ListenStream=%t/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF

systemctl daemon-reload
systemctl enable --now cri-docker

3.安装 kubelet、kubeadm 和 kubectl​

cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.29/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.29/rpm/repodata/repomd.xml.key
EOF

sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
sudo systemctl enable kubelet

初始化主节点​

kubeadm init \
  --apiserver-advertise-address=192.168.123.10 \
  --image-repository registry.aliyuncs.com/google_containers \
  --kubernetes-version 1.29.15 \
  --service-cidr=10.10.0.0/12 \
  --pod-network-cidr=10.244.0.0/16 \
  --cri-socket unix:///var/run/cri-dockerd.sock \
  --v=5

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

重新生成 work token​

kubeadm token create --print-join-command

重置 k8s​

sudo kubeadm reset --cri-socket unix:///var/run/cri-dockerd.sock
rm -rf /etc/kubernetes/ /var/lib/kubelet/ /var/lib/etcd/
sudo rm -rf /etc/cni/net.d /var/lib/cni
sudo iptables -F && sudo iptables -t nat -F && sudo iptables -t mangle -F && sudo iptables -X

4.部署网络插件(calico)​

# 方案一：Operator 方式
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml
# 修改 custom-resources.yaml 中的 cidr: 10.244.0.0/16

# 方案二：手动部署
curl https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/calico.yaml -O
# 修改 CALICO_IPV4POOL_IPIP=off, CALICO_IPV4POOL_CIDR=10.244.0.0/16
kubectl apply -f calico.yaml

5.基本指令​

# 官方资源简写
service svc
deployment deploy
pod po
replicationController rc
replicaSet rs
daemonset ds
job
cronJob cj

# 生成资源清单模板
kubectl create deploy myapp --image=wangyanglinux/myapp:v1.0 --dry-run=client -o yaml > deploy.yaml

# 获取资源
kubectl get pod -A -o wide --show-labels
kubectl get pod podName -o yaml

# 进入容器
kubectl exec -it podName -c containerName -- /bin/bash

# 查看日志
kubectl logs -n kube-system podName -c containerName

# 查看描述
kubectl describe pod podName

# 创建/更新/删除
kubectl apply -f pod.yaml
kubectl delete -f pod.yaml

# 标签操作
kubectl label pod podName version=v1

# 扩容
kubectl scale rc rcName --replicas=10

# 滚动更新
kubectl set image deployment/deployName containerName=image:v2
kubectl rollout status deployment/deployName
kubectl rollout history deployment/deployName
kubectl rollout undo deployment/deployName --to-revision=2

6.Pod 的生命周期​

image-20250320231659617

7.Pod 控制器 ReplicaSet(rs)​

rs 相比 rc，在标签选择器上支持 matchExpressions 字段，提供更多选择方式。

8.service 的使用​

image-20250324232216791

# 修改 kube-proxy 模式为 ipvs
kubectl edit configmap kube-proxy -n kube-system
# mode: ipvs
kubectl delete pod -n kube-system -l k8s-app=kube-proxy

# 查看ipvs规则
ipvsadm -Ln