kubespray 安装 k8s

参考

配置免密码登录

ssh-keygen -t rsa
ssh-copy-id root@192.168.1.200
ssh-copy-id root@192.168.1.201
ssh-copy-id root@192.168.1.202

下载kubespray

# master分支还在更新中，此处使用当前最新release的版本v2.14.1
git clone --single-branch -b v2.14.1 https://github.com/kubernetes-sigs/kubespray.git

安装python3-pip

yum install python3-pip

安装kubespray依赖

pip3 install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

使用ansible对每台机器进行批处理

配置ansible访问k8s集群hosts

vi /etc/ansible/hosts

[k8s]

192.168.1.200 ansible_ssh_user=root
192.168.1.201 ansible_ssh_user=root
192.168.1.202 ansible_ssh_user=root

测试

ansible k8s -m ping

更新yum

ansible k8s -m shell -a 'yum update -y'

安装ntp服务，统一集群时间

ansible k8s -m shell -a 'yum install -y ntp &&
systemctl enable ntpd &&
systemctl start ntpd &&
timedatectl set-timezone Asia/Shanghai &&
timedatectl set-ntp yes && 
ntpq -p'

配置ipv4转发

ansible k8s -m shell -a 'echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf && sysctl -p'

关闭防火墙

ansible k8s -m shell -a 'systemctl stop firewalld && systemctl disable firewalld'

生成kubespray所需配置

创建可自定义的配置

cp -rfp inventory/sample inventory/mycluster

IPS=(此处填写k8s集群的ip地址，注意空格分割)

declare -a IPS=(192.168.1.200 192.168.1.201 192.168.1.202)

CONFIG_FILE=inventory/mycluster/hosts.yaml python3 contrib/inventory_builder/inventory.py ${IPS[@]}

查看生成的hosts.yaml

cat inventory/mycluster/hosts.yaml

此处是 2个master 3个node 3个etcd 的高可用配置，可以根据喜好进行配置

all:
  hosts:
    node1:
      ansible_host: 192.168.1.200
      ip: 192.168.1.200
      access_ip: 192.168.1.200
    node2:
      ansible_host: 192.168.1.201
      ip: 192.168.1.201
      access_ip: 192.168.1.201
    node3:
      ansible_host: 192.168.1.202
      ip: 192.168.1.202
      access_ip: 192.168.1.202
  children:
    kube-master:
      hosts:
        node1:
        node2:
    kube-node:
      hosts:
        node1:
        node2:
        node3:
    etcd:
      hosts:
        node1:
        node2:
        node3:
    k8s-cluster:
      children:
        kube-master:
        kube-node:
    calico-rr:
      hosts: {}

下载依赖

方案1
- 将所有源换成国内镜像加速
方案2
- 离线安装
方案3
- 设置代理
此处使用方案3

vi inventory/mycluster/group_vars/all/all.yml

http_proxy: "http://192.168.1.9:1080"
https_proxy: "http://192.168.1.9:1080"

在阿里云环境下使用代理
- 开启自己电脑上的http proxy server
- 使用frp将本地电脑http proxy port 映射至公网
- 配置http_proxy
- 直接在阿里云内使用代理可能会被警告，因此使用frp做一层中转
配置docker镜像源

vi inventory/mycluster/group_vars/all/docker.yml
## Add other registry,example China registry mirror.
docker_registry_mirrors:
  - https://mirror.aliyuncs.com
  - https://registry.docker-cn.com

提前下载k8s所需依赖，避免安装时报错

ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml --tags container_engine

ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml --tags download

若遇到报错，可尝试将http_proxy注释掉重新下载，重复试几次后一般都能下完
- 阿里云apt, yum等源设置的是内网地址，需要直连才可以访问

vi inventory/mycluster/group_vars/all/all.yml

# http_proxy: "http://192.168.1.9:1080"
# https_proxy: "http://192.168.1.9:1080"

ubuntu 系统安装完毕后，请删除/etc/apt/apt.conf里的代理配置

(可选)开启helm

vi inventory/mycluster/group_vars/k8s-cluster/addons.yml
# Helm deployment
helm_enabled: true

安装

ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml

验证

重置

若在安装过程中遇到问题可用以下命令重置

ansible-playbook -i inventory/mycluster/hosts.yaml reset.yml

Dashboard

Kubespray并没有替你创建用户，所以需要创建用户，然后获得Token，使用Token登录。

添加admin-user用户

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system
EOF

获取admin-user的token

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

访问dashboard

https://192.168.1.200:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login

services "https:kubernetes-dashboard:" is forbidden: User "system:anonymous" cannot get services/proxy in the namespace "kube-system"

遇到此问题请查看system:anonymous 无法访问 k8s dashboard

最近更新于 Nov 27, 2020