【k8s部署】8. 部署集群插件

如果没有特殊指明，所有操作均在 zhaoyixin-k8s-01 节点上执行。

插件是集群的附件组件，丰富和完善了集群的功能。

1.部署 coredns 插件

下载和配置 coredns

cd /opt/k8s/work
git clone https://github.com/coredns/deployment.git
mv deployment coredns-deployment

创建 coredns

cd /opt/k8s/work/coredns-deployment/kubernetes
source /opt/k8s/bin/environment.sh
./deploy.sh -i ${CLUSTER_DNS_SVC_IP} -d ${CLUSTER_DNS_DOMAIN} | kubectl apply -f -

检查 coredns 功能

$ kubectl get all -n kube-system -l k8s-app=kube-dns
NAME                           READY   STATUS    RESTARTS   AGE
pod/coredns-59c6ddbf5d-fs4nh   1/1     Running   0          44s

NAME               TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)                  AGE
service/kube-dns   ClusterIP   10.254.0.2   <none>        53/UDP,53/TCP,9153/TCP   44s

NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/coredns   1/1     1            1           44s

NAME                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/coredns-59c6ddbf5d   1         1         1       45s

新建一个 Deployment：

cd /opt/k8s/work
cat > my-nginx.yaml <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      run: my-nginx
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80
EOF

kubectl create -f my-nginx.yaml

expose 该 Deployment，生成 my-nginx 服务：

$ kubectl expose deploy my-nginx
service/my-nginx exposed

$ kubectl get services my-nginx -o wide
NAME       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE   SELECTOR
my-nginx   ClusterIP   10.254.239.51   <none>        80/TCP    14s   run=my-nginx

创建另一个 Pod，查看 /etc/resolv.conf 是否包含 kubelet 配置的 --cluster-dns 和 --cluster-domain，是否能够将服务 my-nginx 解析到上面显示的 Cluster IP 10.254.239.51

cd /opt/k8s/work
cat > dnsutils-ds.yml <<EOF
apiVersion: v1
kind: Service
metadata:
  name: dnsutils-ds
  labels:
    app: dnsutils-ds
spec:
  type: NodePort
  selector:
    app: dnsutils-ds
  ports:
  - name: http
    port: 80
    targetPort: 80
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: dnsutils-ds
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    matchLabels:
      app: dnsutils-ds
  template:
    metadata:
      labels:
        app: dnsutils-ds
    spec:
      containers:
      - name: my-dnsutils
        image: tutum/dnsutils:latest
        command:
          - sleep
          - "3600"
        ports:
        - containerPort: 80
EOF
kubectl create -f dnsutils-ds.yml

$ kubectl get pods -lapp=dnsutils-ds -o wide 
NAME                READY   STATUS    RESTARTS   AGE     IP              NODE               NOMINATED NODE   READINESS GATES
dnsutils-ds-45nbv   1/1     Running   0          2m16s   172.30.219.4    zhaoyixin-k8s-02   <none>           <none>
dnsutils-ds-ghc6l   1/1     Running   0          2m16s   172.30.180.67   zhaoyixin-k8s-01   <none>           <none>
dnsutils-ds-jgwvg   1/1     Running   0          2m16s   172.30.200.4    zhaoyixin-k8s-03   <none>           <none>

$ kubectl -it exec dnsutils-ds-45nbv  cat /etc/resolv.conf
search default.svc.cluster.local svc.cluster.local cluster.local openstacklocal
nameserver 10.254.0.2
options ndots:5

$ kubectl -it exec dnsutils-ds-45nbv nslookup kubernetes
Server:		10.254.0.2
Address:	10.254.0.2#53

Name:	kubernetes.default.svc.cluster.local
Address: 10.254.0.1

$ kubectl -it exec dnsutils-ds-45nbv nslookup www.baidu.com
Server:		10.254.0.2
Address:	10.254.0.2#53

Non-authoritative answer:
www.baidu.com	canonical name = www.a.shifen.com.
Name:	www.a.shifen.com
Address: 163.177.151.110
Name:	www.a.shifen.com
Address: 163.177.151.109


$ kubectl -it exec dnsutils-ds-45nbv nslookup www.baidu.com.
Server:		10.254.0.2
Address:	10.254.0.2#53

Non-authoritative answer:
www.baidu.com	canonical name = www.a.shifen.com.
Name:	www.a.shifen.com
Address: 163.177.151.109
Name:	www.a.shifen.com
Address: 163.177.151.110


$ kubectl -it exec dnsutils-ds-45nbv nslookup my-nginx
Server:		10.254.0.2
Address:	10.254.0.2#53

Name:	my-nginx.default.svc.cluster.local
Address: 10.254.239.51

可以看到，pod 中将服务 my-nginx 正确得解析到了 Cluster IP 10.254.239.51 上。

2.部署 Dashboard 插件

下载和修改配置文件

cd /opt/k8s/work
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc4/aio/deploy/recommended.yaml
mv  recommended.yaml dashboard-recommended.yaml

执行所有定义文件

cd /opt/k8s/work
kubectl apply -f  dashboard-recommended.yaml

查看运行状态

$ kubectl get pods -n kubernetes-dashboard
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-7b8b58dc8b-l2vrq   1/1     Running   0          5m39s
kubernetes-dashboard-6cfc8c4c9-gvp7n         1/1     Running   0          5m41s

访问 dashboard

从 1.7 开始，dashboard 只允许通过 https 访问，如果使用 kube proxy 则必须监听 localhost 或 127.0.0.1。对于 NodePort 没有这个限制，但是仅建议在开发环境中使用。对于不满足这些条件的登录访问，在登录成功后浏览器不跳转，始终停在登录界面。

通过 port forward 访问 dashboard

启动端口转发：

[root@zhaoyixin-k8s-01 work] kubectl port-forward -n kubernetes-dashboard  svc/kubernetes-dashboard 14443:443 --address 0.0.0.0

浏览器访问 URL：https://192.168.16.8:14443

创建登录 Dashboard 的 token 和 kubeconfig 配置文件

dashboard 默认只支持 token 认证（不支持 client 证书认证），所以如果使用 Kubeconfig 文件，需要将 token 写入到该文件。

创建登录 token

kubectl create sa dashboard-admin -n kube-system
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
ADMIN_SECRET=$(kubectl get secrets -n kube-system | grep dashboard-admin | awk '{print $1}')
DASHBOARD_LOGIN_TOKEN=$(kubectl describe secret -n kube-system ${ADMIN_SECRET} | grep -E '^token' | awk '{print $2}')
echo ${DASHBOARD_LOGIN_TOKEN}

使用输出的 token 登录 Dashboard。

创建使用 token 的 KubeConfig 文件

source /opt/k8s/bin/environment.sh
# 设置集群参数
kubectl config set-cluster kubernetes 
  --certificate-authority=/etc/kubernetes/cert/ca.pem 
  --embed-certs=true 
  --server=${KUBE_APISERVER} 
  --kubeconfig=dashboard.kubeconfig

# 设置客户端认证参数，使用上面创建的 Token
kubectl config set-credentials dashboard_user 
  --token=${DASHBOARD_LOGIN_TOKEN} 
  --kubeconfig=dashboard.kubeconfig

# 设置上下文参数
kubectl config set-context default 
  --cluster=kubernetes 
  --user=dashboard_user 
  --kubeconfig=dashboard.kubeconfig

# 设置默认上下文
kubectl config use-context default --kubeconfig=dashboard.kubeconfig

用生成的 dashboard.kubeconfig 登录 Dashboard。

参考

opsnull/follow-me-install-kubernetes-cluster