Centos7上 kubeadm init 1.11.3

秒速五厘米 2022-04-23 03:36 168阅读 0赞

> 经过半天的折磨，终于 init成功！

### 安装kubeadm ###

docker安装就跳过了，使用阿里镜像安装 kubeadm

# 配置源
    cat <<EOF > /etc/yum.repos.d/kubernetes.repo
    [kubernetes]
    name=Kubernetes
    baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
    enabled=1
    gpgcheck=1
    repo_gpgcheck=1
    gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
    EOF
    
    # 安装 注意这里的版本！
    yum install -y kubelet-1.11.3 kubeadm-1.11.3 kubectl-1.11.3

### 配置系统相关参数 ###

# 临时禁用selinux
    # 永久关闭 修改/etc/sysconfig/selinux文件设置
    sed -i 's/SELINUX=permissive/SELINUX=disabled/' /etc/sysconfig/selinux
    setenforce 0
    
    # 临时关闭swap
    # 永久关闭 注释/etc/fstab文件里swap相关的行
    swapoff -a
    
    
    
    # 开启forward
    # Docker从1.13版本开始调整了默认的防火墙规则
    # 禁用了iptables filter表中FOWARD链
    # 这样会引起Kubernetes集群中跨Node的Pod无法通信
    
    iptables -P FORWARD ACCEPT
    
    # 配置转发相关参数，否则可能会出错
    cat <<EOF >  /etc/sysctl.d/k8s.conf
    net.bridge.bridge-nf-call-ip6tables = 1
    net.bridge.bridge-nf-call-iptables = 1
    vm.swappiness=0
    EOF
    sysctl --system

### master init ###

准备工作做好了，部署k8的master节点，`kubeadm.yaml`文件如下

apiVersion: kubeadm.k8s.io/v1alpha1
    kind: MasterConfiguration
    controllerManagerExtraArgs:
      horizontal-pod-autoscaler-use-rest-clients: "true"
      horizontal-pod-autoscaler-sync-period: "10s"
      node-monitor-grace-period: "10s"
    apiServerExtraArgs:
      runtime-config: "api/all=true"
    kubernetesVersion: "v1.11.3"

运行 `$ kubeadm init --config kubeadm.yaml`  
这里如果没有安装对 kubeadm 的版本，比如安装成了1.13 / 1.12 就会报错：

your configuration file uses an old API spec: "kubeadm.k8s.io/v1alpha1". Please use kubeadm v1.11 instead and run 'kubeadm config migrate --old-config old.yaml --new-config new.yaml', which will write the new, similar spec using a newer API version

如果直接从 `k8s.gcr.io` pull image 会被墙，报错：

[ERROR ImagePull]: failed to pull image k8s.gcr.io/kube-apiserver:v1.13.0: output: Error response from daemon: Get https://k8s.gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

如果你的docker版本不符合要求，可以使用 `kubeadm init --ignore-preflight-errors=SystemVerification` 跳过checkError

解决办法：  
将 docker 镜像从anjia 这个大牛的站下载，再tag

#!/bin/bash
    images=(kube-proxy-amd64:v1.11.3 kube-scheduler-amd64:v1.11.3 kube-controller-manager-amd64:v1.11.3
    kube-apiserver-amd64:v1.11.3 etcd-amd64:3.2.18 coredns:1.1.3 pause:3.1)
    for imageName in ${images[@]} ; do
    docker pull anjia0532/google-containers.$imageName
    docker tag anjia0532/google-containers.$imageName k8s.gcr.io/$imageName
    docker rmi anjia0532/google-containers.$imageName
    done

这里[服务器翻墙][Link 1] \+ [ss][Link 1]没有办法解决docker pull 的问题

### 附上成功的Log ###

[root@localhost yaml]# kubeadm init --ignore-preflight-errors=SystemVerification --config kubeadm.yaml
    [init] using Kubernetes version: v1.11.3
    [preflight] running pre-flight checks
    I0123 15:57:29.868215   16202 kernel_validator.go:81] Validating kernel version
    I0123 15:57:29.868376   16202 kernel_validator.go:96] Validating kernel config
    [preflight] The system verification failed. Printing the output from the verification:
    KERNEL_VERSION: 3.10.0-693.el7.x86_64
    CONFIG_NAMESPACES: enabled
    CONFIG_NET_NS: enabled
    CONFIG_PID_NS: enabled
    CONFIG_IPC_NS: enabled
    CONFIG_UTS_NS: enabled
    CONFIG_CGROUPS: enabled
    CONFIG_CGROUP_CPUACCT: enabled
    CONFIG_CGROUP_DEVICE: enabled
    CONFIG_CGROUP_FREEZER: enabled
    CONFIG_CGROUP_SCHED: enabled
    CONFIG_CPUSETS: enabled
    CONFIG_MEMCG: enabled
    CONFIG_INET: enabled
    CONFIG_EXT4_FS: enabled (as module)
    CONFIG_PROC_FS: enabled
    CONFIG_NETFILTER_XT_TARGET_REDIRECT: enabled (as module)
    CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled (as module)
    CONFIG_OVERLAY_FS: enabled (as module)
    CONFIG_AUFS_FS: not set - Required for aufs.
    CONFIG_BLK_DEV_DM: enabled (as module)
    DOCKER_VERSION: 18.09.1
    OS: Linux
    CGROUPS_CPU: enabled
    CGROUPS_CPUACCT: enabled
    CGROUPS_CPUSET: enabled
    CGROUPS_DEVICES: enabled
    CGROUPS_FREEZER: enabled
    CGROUPS_MEMORY: enabled
        [WARNING SystemVerification]: unsupported docker version: 18.09.1
    [preflight/images] Pulling images required for setting up a Kubernetes cluster
    [preflight/images] This might take a minute or two, depending on the speed of your internet connection
    [preflight/images] You can also perform this action in beforehand using 'kubeadm config images pull'
    [kubelet] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
    [kubelet] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
    [preflight] Activating the kubelet service
    [certificates] Generated ca certificate and key.
    [certificates] Generated apiserver certificate and key.
    [certificates] apiserver serving cert is signed for DNS names [localhost.localdomain kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.3.15]
    [certificates] Generated apiserver-kubelet-client certificate and key.
    [certificates] Generated sa key and public key.
    [certificates] Generated front-proxy-ca certificate and key.
    [certificates] Generated front-proxy-client certificate and key.
    [certificates] Generated etcd/ca certificate and key.
    [certificates] Generated etcd/server certificate and key.
    [certificates] etcd/server serving cert is signed for DNS names [localhost.localdomain localhost] and IPs [127.0.0.1 ::1]
    [certificates] Generated etcd/peer certificate and key.
    [certificates] etcd/peer serving cert is signed for DNS names [localhost.localdomain localhost] and IPs [192.168.3.15 127.0.0.1 ::1]
    [certificates] Generated etcd/healthcheck-client certificate and key.
    [certificates] Generated apiserver-etcd-client certificate and key.
    [certificates] valid certificates and keys now exist in "/etc/kubernetes/pki"
    [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
    [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
    [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"
    [kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"
    [controlplane] wrote Static Pod manifest for component kube-apiserver to "/etc/kubernetes/manifests/kube-apiserver.yaml"
    [controlplane] wrote Static Pod manifest for component kube-controller-manager to "/etc/kubernetes/manifests/kube-controller-manager.yaml"
    [controlplane] wrote Static Pod manifest for component kube-scheduler to "/etc/kubernetes/manifests/kube-scheduler.yaml"
    [etcd] Wrote Static Pod manifest for a local etcd instance to "/etc/kubernetes/manifests/etcd.yaml"
    [init] waiting for the kubelet to boot up the control plane as Static Pods from directory "/etc/kubernetes/manifests"
    [init] this might take a minute or longer if the control plane images have to be pulled
    [apiclient] All control plane components are healthy after 46.004872 seconds
    [uploadconfig] storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
    [kubelet] Creating a ConfigMap "kubelet-config-1.11" in namespace kube-system with the configuration for the kubelets in the cluster
    [markmaster] Marking the node localhost.localdomain as master by adding the label "node-role.kubernetes.io/master=''"
    [markmaster] Marking the node localhost.localdomain as master by adding the taints [node-role.kubernetes.io/master:NoSchedule]
    [patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "localhost.localdomain" as an annotation
    [bootstraptoken] using token: qh194a.90yx0eqzgnnytgbb
    [bootstraptoken] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
    [bootstraptoken] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
    [bootstraptoken] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
    [bootstraptoken] creating the "cluster-info" ConfigMap in the "kube-public" namespace
    [addons] Applied essential addon: CoreDNS
    [addons] Applied essential addon: kube-proxy
    
    Your Kubernetes master has initialized successfully!
    
    To start using your cluster, you need to run the following as a regular user:
    
      mkdir -p $HOME/.kube
      sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
      sudo chown $(id -u):$(id -g) $HOME/.kube/config
    
    You should now deploy a pod network to the cluster.
    Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
    https://kubernetes.io/docs/concepts/cluster-administration/addons/
    
    You can now join any number of machines by running the following on each node
    as root:
    
      kubeadm join 192.168.3.15:6443 --token qh194a.90yx0eqzgnnytgbb --discovery-token-ca-cert-hash sha256:00fd3d883743c6c692ccad2d6c66d7b3afd6263c2b6f2e57778092619d2643c5

看到 `kubeadm join 192.168.3.15:6443 --token qh194a.90yx0eqzgnnytgbb --discovery-token-ca-cert-hash sha256:00fd3d883743c6c692ccad2d6c66d7b3afd6263c2b6f2e57778092619d2643c5`

就说明成功啦！

[Link 1]: https://bodyno.com/tool/2017/09/03/centos-ss.html