20分钟kubeadm安装kubernetes 1.15.1

节点四台：master、node01、node02、harbor

安装软件：链接:https://pan.baidu.com/s/1iBM9ymdvmQi67DPJ93OF0w  密码:k2m6

设置系统主机名及host文件解析

#hostnamectl set-hostname k8s-master hostnamectl set-hostname k8s-node01 hostnamectl set-hostname k8s-node02

安装依赖包

#yum -y install conntrack ntpdate ntp ipvsadm ipset jq iptables curl sysstat libseccomp wget vim net-tools git　　

设置防火墙为iptables规则并设置空规则

#systemctl stop firewalld&&systemctl disable firewalld
#yum -y install iptables-services && systemctl start iptables && systemctl enable iptables && iptables -F && service iptables save　　

关闭SElinux

# swapoff -a && sed -i '/ swap / s/^(.*)$/#1/g' /etc/fstab
#setenforce 0 && sed -I 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config　

调整内核参数

#cat > kubernetes.conf << EOF
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0 #禁止使用swap空间
vm.overcommit_memory=1 #不检查物理内存
vm.panic_on_oom=0
fs.inotify.max_user_instances=8192
fs.inotify.max_user_watches=1048576
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF　

开机调用kubernetes.conf，并生效

#cp kubernetes.conf /etc/sysctl.d/kubernetes.conf
#sysctl -p /etc/sysctl.d/kubernetes.conf　　

调整系统时区-安装系统时选择上海，这步跳过
设置时区 中国/上海

#timedatectl set-timezone Asia/Shanghai

将当前UTC时间写入硬件时钟

#timedatectl set-local-rtc 0

重启依赖于系统时间的服务

#systemctl restart rsyslog
#systemctl restart crond　　

关闭系统邮件服务

#systemctl stop postfix&&systemctl disable postfix

设置系统日志服务rsyslogd和systemd journald

创建持久化目录

# mkdir /var/log/journal　

创建journald配置文件

# mkdir /etc/systemd/journal.conf.d
#cat > /etc/systemd/journal.conf.d/99-prophet.conf <<EOF
[ Journal ]
#持久化保存到磁盘
Storage=persistent

#压缩历史日志
Compress=yes

SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000

#最大占用空间
SystemMaxUse=10G

#单日志文件最大 200M
SystemMaxFileSize=200M

#日志保存时间
MaxRetentionSec=2week

#不讲日志转发到 syslog
ForwardToSyslog=no

EOF
#systemctl restart systemd-journald　

升级系统内核为4.44版本

#rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm　　

查看 /boot/grub2/grub.cfg是否存在menuentry 中是否包含 initrd16配置，如果没有重新安装

#cat /boot/grub2/grub.cfg|grep initrd16

#yum --enablerepo=elrepo-kernel install -y kernel-lt

设置开几重启内核

#grub2-set-default 'CentOS Linux (4.4.214-1.el7.elrepo.x86_64) 7 (core)'
#reboot　

检查下三台节点内核版本是否为4.44

#uname -r
4.4.214-1.el7.elrepo.x86_64　

Kube-proxy开启ipvs前置条件

#modprobe br_netfilter
#cat > /etc/sysconfig/modules/ipvs.modules << EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF
#chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod |grep -e ip_vs -e nf_conntrack_ipv4

安装docker

#yum -y install yum-utils device-mapper-persistent-data lvm2
#yum-config-manager 
--add-repo 
http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# yum update -y && yum install -y docker-ce

创建 /etc/docker 目录

#mkdir /etc/docker

#grub2-set-default 'CentOS Linux (4.4.214-1.el7.elrepo.x86_64) 7 (core)'&&reboot　

设置docker启动，开机自启

# systemctl start docker && systemctl enable docker　

创建 daemon.json 配置文件，将存储日志的方式改为为 json file 格式存储，方便日后从 /var/log/container/ 下查找容器日志，之后就可以从 efk 中搜索索引信息了

#cat > /etc/docker/daemon.json << EOF
{
"registry-mirrors": ["https://registry.docker-cn.com"],
"exec-opts": ["native.cgroupdriver=systemd"], #centos7中有两种cgroup组（cgroupfx， cgroupdriver）是由systemd做隔离
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
}
}
EOF
#mkdir -p /etc/systemd/system/docker.service.d
#systemctl daemon-reload && systemctl restart docker && systemctl enable docker　

安装kubeadm

#cat << EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
EOF
#yum -y install kubeadm-1.15.1 kubectl-1.15.1 kubelet-1.15.1
#systemctl enable kubelet

导入kubernetes系统镜像，百度云盘链接:https://pan.baidu.com/s/1iBM9ymdvmQi67DPJ93OF0w  密码:k2m6

# tar xf kubeadm-basic.images.tar.gz

批量导入镜像脚本

# vim docker-load.sh
#!/bin/bash

ls /root/rpm/kubeadm-basic.images > /root/docker-load-list.txt

cd /root/rpm/kubeadm-basic.images

for i in $(cat /root/docker-load-list.txt)
do
docker load -i $i
done
#chmod a+x docker-load.sh
#./docker-load.sh

在master节点操作，导出kubeadm-config.yaml配置文件

#kubeadm config print init-defaults > /etc/kubernetes/kubeadm-config.yaml
#vim kubeadm-config.yaml
第12行：advertiseAddress:192.168.1.11
第34行：kubernetesVersion: v1.15.1
第36行下增加：podSubnet: "10.244.0.0/16" #pod网段

初始化master

#kubeadm init --config=/etc/kubernetes/kubeadm-config.yaml --experimental-upload-certs | tee kubeadm-init.log

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.1.11:6443 --token abcdef.0123456789abcdef
--discovery-token-ca-cert-hash sha256:69540b24d9d2eaa4fd9a9d533bfde8c6520ce7586366fa9e35474e94553532ba

# mkdir -p $HOME/.kube
# cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
# chown $(id -u):$(id -g) $HOME/.kube/config
# echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile
# source ~/.bash_profile　

保留安装文件

#mkdir install-k8s
# mv /etc/kubernetes/kubeadm-config.yaml /etc/kubernetes/kubeadm-init.log /usr/local/kubernetes/install-k8s/

master安装flannel

#wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
# kubectl create -f kube-flannel.yml

没有镜像可以下载国内镜像，然后重新打标签，将镜像scp到node01和node02节点上，docker load即可

#docker pull lizhenliang/flannel:v0.11.0-amd64
#docker tag lizhenliang/flannel:v0.11.0-amd64 quay.io/coreos/flannel:v0.11.0-amd64

Node01和Node02节点加入k8s集群

#tail -5 /usr/local/kubernetes/install-k8s/kubeadm-init.log
#kubeadm join 192.168.1.11:6443 --token abcdef.0123456789abcdef 
--discovery-token-ca-cert-hash sha256:69540b24d9d2eaa4fd9a9d533bfde8c6520ce7586366fa9e35474e94553532ba

安装harbor仓库

#mv docker-compose /usr/local/bin/
#chmod a+x /usr/local/bin/docker-compose
#tar xf harbor-offline-installer-v1.2.0.tgz -C /usr/local/harbor

修改harbor配置文件

#vim harbor.cfg
第五行：hostname = edwin.registry.docker.com
第九行：ui_url_protocol = https
#mkdir -p /data/cert/&&cd /data/cert/

制作证书
生成server.key

#openssl genrsa -des3 -out server.key 2048

生成server.csr私钥

#openssl req -new -key server.key -out server.csr

# cp server.key server.key.bak　

验证时不使用密码

# openssl rsa -in server.key.bak -out server.key　

为生成证书签名

# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt　

为生成的证书授予权限

# chmod a+x *
# cd /usr/loacl/harbor/
# ./install.sh

为k8s集群下的主机配置hosts主机解析

# echo "192.168.1.11 edwin.registry.docker.com" >> /etc/hosts