vlambda博客
学习文章列表

k8s集群master01:192.168.19.11 kube-apiserver kube-controller-manager kube-scheduler etcdk8s集群master02:192.168.19.33 （为多节点准备）

k8s集群node01:192.168.19.44 kubelet kube-proxy docker flannelk8s集群node02: 192.168.19.55

etcd集群节点1:192.168.19.11 etcdetcd集群节点2:192.168.19.44etcd集群节点3:192.168.19.55

负载均衡nginx+keepalive01 (master）:192.168.19.66负载均衡nginx+keepalive02 (backup）:192.168.19.77

systemetl stop firewalldsystemctl disable firewalldsetenforce 0

# k8smaster02（192.168.19.33）hostnamectl set-hostname k8smaster02susystemctl stop firewalld.servicesystemctl disable firewalld.servicesetenforce 0

# lb01（192.168.19.66）hostnamectl set-hostname lb01susystemctl stop firewalld.servicesystemctl disable firewalld.servicesetenforce 0

# lb02（192.168.19.77）hostnamectl set-hostname lb02susystemctl stop firewalld.servicesystemctl disable firewalld.servicesetenforce 0

#从 k8smaster01 节点上拷贝证书文件、各master组件的配置文件和服务管理文件到 k8smaster02 节点scp -r /opt/etcd/ root@192.168.19.33:/opt/scp -r /opt/kubernetes/ root@192.168.19.33:/optscp /usr/lib/systemd/system/{kube-apiserver,kube-controller-manager,kube-scheduler}.service root@192.168.19.33:/usr/lib/systemd/system/

#修改配置文件kube-apiserver中的IPvim /opt/kubernetes/cfg/kube-apiserverKUBE_APISERVER_OPTS="--logtostderr=true \--v=4 \--etcd-servers=https://192.168.19.11:2379,https://192.168.19.44:2379,https://192.168.19.55:2379 \--bind-address=192.168.19.33 \ #修改--secure-port=6443 \--advertise-address=192.168.19.33 \ #修改......

#在 master02 节点上启动各服务并设置开机自启systemctl start kube-apiserver.servicesystemctl enable kube-apiserver.servicesystemctl start kube-controller-manager.servicesystemctl enable kube-controller-manager.servicesystemctl start kube-scheduler.servicesystemctl enable kube-scheduler.service

#查看node节点状态ln -s /opt/kubernetes/bin/* /usr/local/bin/kubectl get nodeskubectl get nodes -o wide #-o=wide：输出额外信息；对于Pod，将输出Pod所在的Node名

#此时在master02节点查到的node节点状态仅是从etcd查询到的信息，而此时node节点实际上并未与master02节点建立通信连接，因此需要使用一个VIP把node节点与master节点都关联起来

#配置nginx的官方在线yum源，配置本地nginx的yum源cat > /etc/yum.repos.d/nginx.repo << 'EOF'[nginx]name=nginx repobaseurl=http://nginx.org/packages/centos/7/$basearch/gpgcheck=0EOF

yum install -y nginx

#修改nginx配置文件，配置四层反向代理负载均衡，指定k8s群集2台master的节点ip和6443端口vim /etc/nginx/nginx.confevents { worker_connections 1024;}

#添加stream { log_format main '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';

access_log /var/log/nginx/k8s-access.log main;

 upstream k8s-apiserver { server 192.168.19.11:6443; server 192.168.19.33:6443; } server { listen 6443; proxy_pass k8s-apiserver; }}

http {......



#检查配置文件语法nginx -t 

#启动nginx服务，查看已监听6443端口systemctl start nginxsystemctl enable nginxnetstat -natp | grep nginx

yum install keepalived -y

#修改keepalived配置文件vim /etc/keepalived/keepalived.conf! Configuration File for keepalived

global_defs { # 接收邮件地址 notification_email { [email protected] [email protected] [email protected] } # 邮件发送地址 notification_email_from [email protected] smtp_server 127.0.0.1 smtp_connect_timeout 30 router_id NGINX_MASTER #lb01节点的为 NGINX_MASTER，lb02节点的为 NGINX_BACKUP}

#添加一个周期性执行的脚本vrrp_script check_nginx { script "/etc/nginx/check_nginx.sh" #指定检查nginx存活的脚本路径}

vrrp_instance VI_1 { state MASTER #lb01节点的为 MASTER，lb02节点的为 BACKUP interface ens33 #指定网卡名称 ens33 virtual_router_id 51 #指定vrid，两个节点要一致 priority 100 #lb01节点的为 100，lb02节点的为 90 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.19.100/24 #指定 VIP } track_script { check_nginx #指定vrrp_script配置的脚本 }}

#创建nginx状态检查脚本
vim /etc/nginx/check_nginx.sh#!/bin/bash#egrep -cv "grep|$$" 用于过滤掉包含grep 或者 $$ 表示的当前Shell进程IDcount=$(ps -ef | grep nginx | egrep -cv "grep|$$")

if [ "$count" -eq 0 ];then systemctl stop keepalivedfi



chmod +x /etc/nginx/check_nginx.sh

#启动keepalived服务（一定要先启动了nginx服务，再启动keepalived服务）systemctl start keepalivedsystemctl enable keepalivedip a #查看VIP是否生成

cd /opt/kubernetes/cfg/lsvim bootstrap.kubeconfigserver: https://192.168.19.100:6443

vim kubelet.kubeconfigserver: https://192.168.19.100:6443

vim kube-proxy.kubeconfigserver: https://192.168.19.100:6443

#重启kubelet和kube-proxy服务systemctl restart kubelet.servicesystemctl restart kube-proxy.service

tail /var/log/nginx/k8s-access.log

#测试创建podkubectl run nginx --image=nginx

#查看Pod的状态信息kubectl get podsNAME READY STATUS RESTARTS AGEnginx-dbddb74b8-5n654 1/1 Running 0 41s

kubectl get pods -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODEnginx-dbddb74b8-5n654 1/1 Running 0 71s 172.17.52.3 192.168.19.44 <none>#READY为1/1，表示这个Pod中有1个容器

#在对应网段的node节点上操作，可以直接使用浏览器或者curl命令访问curl 172.17.52.3

#这时在master01节点上查看nginx日志，发现没有权限查看kubectl logs nginx-dbddb74b8-5n654



#在master01节点上，将cluster-admin角色授予用户system:anonymouskubectl create clusterrolebinding cluster-system-anonymous --clusterrole=cluster-admin --user=system:anonymous

#再次查看nginx日志kubectl logs nginx-dbddb74b8-5n654